Microsoft Warns Of Ongoing Zerologon Attacks On Windows PCs By Cybercriminals
One would think that once a vulnerability received ample coverage and explicit warnings that encouraged uses to patch, we might see a drop-off in attacks. That is not the case; however, as Microsoft is again reporting that the Zerologon security flaw is still being exploited in the wild. This is another succinct warning on top of the pile already saying that Zerologon is dangerous, and people need to patch their systems ASAP.
In late September, we reported, as others did, that hackers were actively exploiting the Zerologon security flaw. Following a Department of Homeland Security emergency directive, Microsoft confirmed that they were tracking the use of Zerologon. Microsoft also reported that a patch was available for domain controllers to eliminate the vulnerability. As we wrote at the time, “it is common for businesses and other organizations to put off updating systems temporarily, in part to test compatibility and avoid potential unforeseen issues. In this case, they should make it a priority to get their ducks in a row, and apply the patch.”
Although the Emergency Directive only applies to those federal agencies, we strongly recommend that state & local government, the private sector, and the American public also apply this security update as soon as possible. More info: https://t.co/O303PodUon #NetSec 2/2
— Cybersecurity and Infrastructure Security Agency (@CISAgov) September 19, 2020
Microsoft went to the Cybersecurity and Infrastructure Agency (CISA) so that they could release an emergency alert as well. The CISA alert states that “until every domain controller is updated, the entire infrastructure remains vulnerable, as threat actors can identify and exploit a vulnerable system in minutes.” The alert also reminds people that Microsoft has guidance for updating systems, so admins need to follow that to make sure systems and accounts are secure.
Businesses and organizations need to patch domain controllers so they can secure their user accounts. If you want to see Microsoft’s hub of resources for handling the Zerologon vulnerability, you can do so here. As CISA states, it is crucial that all domain controllers on a network are updated with the patch. Until then, users and entire organizations are vulnerable.
