Veille - Microsoft piqué par une mouche TSE-RDP

Cette semaine, Veille importante sur RDP et la faille MS12-020. L'affaire si elle est confirmée est grave, très grave, très très grave. Mais bon pour le moment on n'en sait rien. Tout le monde connaît la mouche TSE-TSE qui endort les personnes qu'elle pique. Et bien voici la mouche TSE-RDP qui réveille toutes les vieilles craintes. A la base, une classique histoire de faille sur un protocole bien connu. Jusque là, rien de grave. La faille date de novembre 2011. Les partenaires de Microsoft lui communiquent des informations et travaillent dessus dans le cadre du programme MAPP. Toutes les communications sont chiffrées via PGP et tout se passe bien.

Mais voilà quand Microsoft sort le patch au patch tuesday de mars 2012, il y a des rumeurs d'exploit déjà disponible assez peu de temps après la communication officielle sur la faille. En creusant un peu, on s'aperçoit que sur des sites de recrutements de hackers, des offres proposent 1500$ pour un exploit sous Metasploit. De plus, un des chercheurs ayant communiqué à Microsoft sur la faille et qui aurait vu un exploit disponible dit que ce dernier est forcément celui qu'il avait envoyé à Microsoft pour la preuve de concept.

Et là, une question se pose ? D'où vient la fuite ?

Je vous laisse lire les articles ci-dessous qui sont à peu près dans l'ordre chronologique. Chacun y va de son interprétation, mais il semblerait bien que cela provienne de chez Microsoft. Et du coup la deuxième question qui se pose concerne l'origine : Délibérée, Accidentelle, suite à une Intrusion ?

D'ici à ce qu'on nous parle d'APT dans quelques temps......A suivre........... Mais en tout cas, cela n'a pas de quoi rassurer le commun des mortels sur les capacités des Whitehats à se protéger des Balckhats.

Microsoft Fixes Critical RDP Vulnerability with March Patch Tuesday
http://threatpost.com/en_us/blogs/microsoft-fixes-critical-rdp-vulnerability-march-patch-tuesday-031312

Microsoft says be prepared for RDP attack within the next 30 days
http://news.hitb.org/content/microsoft-says-be-prepared-rdp-attack-within-next-30-days
http://www.theregister.co.uk/2012/03/13/microsoft_patch_tuesday_mozilla/

    Microsoft, Security Experts Warn ‘Wormable’ RDP Exploit Will Come Sooner Than Later
    http://threatpost.com/en_us/blogs/microsoft-security-experts-warn-wormable-rdp-exploit-will-come-sooner-later-031412

Will the new Microsoft RDP vulnerability spawn Conficker 2.0?
http://news.hitb.org/content/will-new-microsoft-rdp-vulnerability-spawn-conficker-20
http://www.zdnet.com.au/new-windows-flaw-to-spark-conficker-20-339333749.htm

•     Although RDP is disabled by default on fresh installations of Windows, its popularity among users, especially in the enterprise space, makes it a significant and lucrative threat to hackers.

Exploit for Microsoft RDP vulnerability already in the wild?
http://news.hitb.org/content/exploit-microsoft-rdp-vulnerability-already-wild
http://www.h-online.com/security/news/item/Reward-offered-for-Windows-RDP-exploit-1473304.html

•     On the hacker job site gun.io, a reward of about $1,500 has even been offered for a Metasploit module that can be used to exploit the vulnerability. If someone wants to claim the reward, they will have to release the Metasploit module under an open source licence and make it available to the public.

MS12-020 RDP Exploit Found, Researchers Say Code May Have Leaked From Security Vendor
http://threatpost.com/en_us/blogs/ms12-020-rdp-exploit-found-researchers-say-code-may-have-leaked-security-vendor-031612

•     There is a confirmed legitimate working exploit for the MS12-020 RDP vulnerability in Windows circulating already and researchers say it is capable of either crashing or causing a denial-of-service condition on vulnerable machines.

•     In an email interview, Auriemma said he had no doubts that the code in the exploit was his and that the code leak came from Microsoft.

   
MS12-020 RDP Code Leak Mystery Deepens As Microsoft Remains Silent
http://threatpost.com/en_us/blogs/ms12-020-rdp-code-leak-mystery-deepens-microsoft-remains-silent-031612

•     The MAPP program includes several dozen security and antimalware companies from around the world, and although those companies have signed NDAs and should restrict access to the MAPP info to a small group of people within their organizations, it's possible that there's a rogue employee somewhere along the line who could have done this.

•     Which leads to the last possibility: the MSRC is compromised. This is the doomsday scenario for Microsoft and its customers. The MSRC is a respository of a tremendous amount of valuable vulnerability data, and if that organization was somehow owned, the repercussions would be mind-boggling. It seems likely that if this was the case, there would have been other indications of the compromise at some point, possibly in the form of other exploits being leaked. And it also stands to reason that if someone had compromised the MSRC, he wouldn't advertise that fact by posting identifiable exploit code on a public site.

Ryan Naraine on Exploit Mitigations and the MS12-020 RDP Bug
http://threatpost.com/en_us/blogs/ryan-naraine-exploit-mitigations-and-ms12-020-rdp-bug-031512
http://threatpost.com/sites/default/files/digital_underground_95.mp3

Microsoft Denies Reports of Exploits For Critical Windows RDP Hole
http://threatpost.com/en_us/blogs/live-exploits-identified-critical-windows-rdp-vulnerability-031512

Bonne lecture
Tristan