Patched EternalDarkness bug code being exploited CISA warns

News by Bradley Barth

Hackers using point-of-concept exploit code for the highly critical “SMBGhost” bug - aka EternalDarkness - that Microsoft patched in March in its Server Message Block 3.1.1 (SMBv3) protocol

Functioning point-of-concept exploit code now exists for the highly critical “SMBGhost” bug - also known as EternalDarkness - that Microsoft patched last March in its Server Message Block 3.1.1 (SMBv3) protocol, and attackers are taking advantage, the US Cybersecurity and Infrastructure Security Agency (CISA) has warned, citing open-source reports.

Designated CVE-2020-0796, the bug can result in a wormable remote code execution attack on a targeted SMB server or client. Microsoft on 12 March issued an out-of-band patch for the vulnerability after an apparent error in the Microsoft vulnerability disclosure process led to at least two cyber companies prematurely posting information about the flaw before Microsoft had the opportunity to publicly disclose the bug.

In addition to patching the vulnerability, CISA recommends that users employ a firewall to block SMB ports from the internet.

Various news sources have reported that a researcher with the Twitter handle “Chompie” has shared SMBGhost RCE exploit code publicly on GitHub. Back in April, the cybersecurity company Ricerca Security similarly made PoC code available.

BleepingComputer also reported that the cybersecurity company ZecOps has demonstrated how SMBGhost can be exploited for denial of service and local privilege escalation, and Kryptos Logic demoed a DoS exploit as well. It has also reported that cybercriminals already have been leveraging the bug to deliver the Ave Maria remote access trojan.

This article was first published in SC US.

Find this article useful?

Get more great articles like this in your inbox every lunchtime

Video and interviews