Some of the cybersecurity vulnerabilities most commonly exploited by cyber criminals to help distribute ransomware are years old – but attackers are still able to take advantage of them because security updates aren’t being applied.
Cybersecurity researchers at Qualys examined the Common Vulnerabilities and Exposures (CVEs) most used in ransomware attacks in recent years and found that some of these vulnerabilities have been known – and had vendor patches available – for almost a decade. But because many organisations still haven’t applied the available security updates, they remain vulnerable to ransomware attacks.
The oldest of the top five vulnerabilities detailed in the analysis is CVE-2012-1723, a vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7, which was detailed in 2012. According to researchers, it’s been commonly used to distribute Urausy ransomware. This ransomware is somewhat basic, but some organisations have remained vulnerable because they haven’t applied the relevant security patches.
Two other common vulnerabilities detailed by researchers are from 2013. CVE-2013-0431 is a vulnerability in JRE exploited by Reveton ransomware, while CVE-2013-1493 is a flaw in Oracle Java that is targeted by Exxroute ransomware. In both cases, patches to remedy the vulnerabilities have been available for over eight years.
CVE-2018-12808, meanwhile, is a three-year-old vulnerability in Adobe Acrobat, which is used to deliver ransomware via phishing emails and malicious PDF files. Both Ryuk ransomware and what many believe to be its successor, Conti ransomware, have been known to use this attack method.
See also: A winning strategy for cybersecurity (ZDNet special report).
The most recent vulnerability on the list is Adobe CVE-2019-1458, a privilege escalation vulnerability in Windows that emerged in December 2019 and has been commonly used by the NetWalker ransomware group. Like the other vulnerabilities detailed by researchers, cyber criminals are have been able to continue luanching successful attacks because the available security update hasn’t been applied.
For IT and information security teams, applying all the patches needed to keep a network secure is often an uphill battle. “The rate at which vulnerabilities are rising is exponentially higher than the rate at which operations teams are patching. This is the number one driving factor for why vulnerabilities remain unpatched,” Shailesh Athalye, SVP of product management at Qualys, told ZDNet.
“It is easy for operations teams to get overwhelmed when they do not have a prioritized list of patches or software listings provided from security teams.”
Cyber attackers know that many organisations struggle with patching, so are actively scanning for vulnerabilities that enable them to lay down the foundations for ransomware and other cyber attacks.
Patch management can be a complex and time-consuming process, but it’s vital for information security teams to take the time to apply critical security updates, particularly if they’re known to be commonly exploited by cyber criminals and ransomware gangs.
“There is no silver bullet to prevent ransomware and remediate vulnerabilities, but overall, driving processes for reducing an attack surface should be the goal,” said Athalye.
“The important part of vulnerability management is the combination of vulnerability assessment, prioritization and remediation.”
MORE ON CYBERSECURITY
