Zerologon vulnerability: How federal teams can secure endpoints

Zerologon is one of the most significant vulnerabilities to surface in a long time. Earlier this year, the Cybersecurity and Infrastructure Security Agency (CISA) released a notice stating the Zerologon vulnerability poses an “unacceptable risk” to the federal civilian executive branch, and required that all federal agencies “immediately apply the Windows Server August 2020 security update” or disconnect from federal networks.

Zerologon allows devices to authenticate to the domain controller and update their password in the Active Directory (AD). Zerologon can maintain relationships between members of domains and the DC, or between many DCs across one or many domains, and replicate the DC database. Microsoft released the software update Netlogon EoP to mitigate a critical vulnerability in the Windows Netlogon Remote Protocol server interface. This was the first update in a phased rollout expected to conclude February 2021.

It is normal for federal systems to go through software updates and routine patches. These patches fix security vulnerabilities and other bugs cybercriminals might use to gain unauthorized access to a user’s device and sensitive data. Software vendors release critical patches with the intent of protecting the organizations and individuals using the software. Sometimes, though, while the patch may safeguard against the latest threat, it can also create other problems across the network.

What’s unique about the patch for Zerologon is that Microsoft knew prior to release that there would be compatibility issues. This explains the complexity in the response and guidance, which includes phased implementation, partial enforcement now and more coming later, an option to go to full enforcement sooner, new logged events to tell users when compatibility issues are occurring, and a Group Policy Object to exempt specific systems from the new restriction.

These patch complexities can leave some networks and users in a difficult position. The patch introduces certain compatibility issues, but without the patch, hackers can use this vulnerability to create easy-to-use exploits. Once attackers get admin rights and control of the DC, they’re almost invisible from federal IT teams and security systems. Hackers can then execute remote procedure calls to gain access to agency networks.

In the case of Zerologon, since an agency’s AD rarely, if ever, gets completely rebuilt or replaced over time, a skilled cybercriminal could quietly establish long-term, full administrative presence inside the entire network and remain unnoticed. Further, agencies underestimate its impact because it “only affects DCs.” However, the problem is agencies often have far more DCs than they think -- and those DCs are generally spread all over the globe. Control of any DC grants the attacker what amounts to unlimited power on any member machine in the AD forest.

Zerologon isn’t something agencies can simply patch and forget. Remediation requires several steps and ongoing validation -- both in terms of complete inventory of DCs at any given time and their patch status.

In addition, DCs often receive patches later than other systems in the agency network because of a “if it ain’t broke, don’t fix it” mentality. Having the DCs updated and stable is critical -- and this means patches might be installed with reluctance and hesitation.

The bottom line? This vulnerability exposes the keys to the kingdom – and it is absolutely critical that agencies understand it and take it seriously.

Zerologon patches are only available for versions of Windows that are still supported and receive security updates. In practice, though, many networks have legacy Windows devices or non-Windows devices that communicate with DCs using the protocol.

Agencies that use Microsoft Windows are better served by taking a holistic risk management approach, using complete, accurate and real-time data from a single source to reduce risk and improve security. In doing so, they can also reduce the number of point products, reallocate budget and scarce resources and justify future budget requests for critical security activities – all while providing a more comprehensive view of the security landscape that enables more strategic business decisions.

Leveraging a single platform that integrates endpoint operations and security management serves to unify teams, effectively breaking down the data silos and closing the accountability, visibility and resilience gaps that often exist between IT operations and security teams.

A platform approach also gives agencies end-to-end visibility across end users, DCs, servers, and cloud endpoints -- as well as the ability to identify assets, protect systems, detect threats, respond to attacks and recover at scale. When agencies achieve complete visibility and control, the risk from cyberattacks is significantly reduced and they improve their ability to make good business decisions.

Agencies are currently aware of the vulnerabilities that Zerologon brings. To secure their IT environments, teams must prioritize standard checks for patches and routinely complete vulnerability assessments to analyze and determine the current level of risk.