The vulnerability, tracked as CVE-2019-0708, impacts the Windows Remote Desktop Services (RDS) and was addressed by Microsoft with May 2019 Patch Tuesday updates. BlueKeep is a wormable flaw that can be exploited by malware authors to create malicious code with WannaCry capabilities.
As explained by Microsoft, this vulnerability could be exploited by malware with wormable capabilities, it could be exploited without user interaction, making it possible for malware to spread in an uncontrolled way into the target networks.
Many security experts have already developed their own exploit code for this issue without publicly disclosing it for obvious reasons.
Microsoft has released patches for Windows 7, Server 2008, XP and Server 2003. Windows 7 and Server 2008 users can prevent unauthenticated attacks by enabling Network Level Authentication (NLA), and the threat can also be mitigated by blocking TCP port 3389.
The Metasploit module could be used to trigger the BlueKeep flaw on vulnerable Windows XP, 7, and Server 2008, but the expert has not publicly disclosed it to avoid threat actors abusing it.
Unfortunately, it has been determined that roughly one million devices exposed online are vulnerable to attacks exploiting the BlueKeep Windows vulnerability and hackers are ready to hit them.
Zǝɹosum0x0 also published a video PoC that shows how to exploit the BlueKeep vulnerability on a Windows 2008 system.
According to Zǝɹosum0x0, the module could be used also against machines running on Windows 7 and Server 2008 R2.
This Metasploit module doesn’t work against Windows Server 2003.
Zǝɹosum0x0 also developed a scanner Metasploit module for the CVE-2019-0708 BlueKeep RCE vulnerability.
The NSA also issued an alert to urge users to install the security patches to address the BlueKeep flaw.
“The National Security Agency is urging Microsoft Windows administrators and users to ensure they are using a patched and updated system in the face of growing threats. Recent warnings by Microsoft stressed the importance of installing patches to address a protocol vulnerability in older versions of Windows ” reads the NSA’s advisory.
“This is the type of vulnerability that malicious cyber actors frequently exploit through the use of software code that specifically targets the vulnerability. For example, the vulnerability could be exploited to conduct denial of service attacks. It is likely only a matter of time before remote exploitation code is widely available for this vulnerability. NSA is concerned that malicious cyber actors will use the vulnerability in ransomware and exploit kits containing other known exploits, increasing capabilities against other unpatched systems.
NSA urges everyone to invest the time and resources to know your network and run supported operating systems with the latest patches.”
Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.
Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.