What is Zoombombing and how to defend against it

Before I define Zoombombing let me explain what Zoom is.  Zoom is a very popular video conference service that has a free option that allows many users to have meetings and chat sessions with each other.  It has been on the rise as more people are using it to stay in touch during the coronavirus restrictions.

Zoombombing is when an unauthorized person or stranger joins a Zoom meeting/chat session and cause disorder by saying offensive things and even photobombing your meeting by sharing pornographic and hate images.  Imagine if your young kids are participating in an online school meeting and suddenly it is interrupted in that manner.  Well unfortunately is has happened numerous times.

Most Zoom meetings have a public link that, if a person were to click it, it will allow them to join.  Malicious individuals or Zoombombers have been collecting these links and sharing them in private chat groups, then signing on to other people’s conferences to cause disruption.

On Monday the FBI warned users of a nationwide rise on this issue, as more people have turned to the Zoom video-teleconferencing service.  Zoom the company encouraged users hosting public group meetings to review settings for their safety as well as report incidents to its support team so it could “take appropriate action.”

When using Zoom for online classrooms, meetings or events, the host is advised to making meetings private and require a password or use the waiting room feature to control the admittance of additional people.  The links to a teleconference or classroom should be sent directly to the individual participants and never be publicly available on a social media post.  Finally, those managing a conference in Zoom should change the screen sharing option to “Host-Only.”

Experts in the field of information security and privacy have provided numerous suggestions when hosting a Zoom event.  Compiled below is a list of recommendations.  I have provided a few of the implementation process to apply these security and privacy features.  For items not covered in this post, please check on the Zoom web page for additional instructions.

Zoom Safety Checklist

Before Meeting:

  • Disable autosaving chats
  • Disable file transfer
  • Disable screen sharing for non-hosts
  • Disable remote control
  • Disable annotations
  • Use per-meeting ID, not personal ID
  • Disable “Join Before Host”
  • Enable “Waiting Room”

During Meeting:

  • Assign at least two co-hosts
  • Mute all participants
  • Lock the meeting, if all attendees are present

If you are Zoombombed:

  • Remove problematic users and disable their ability to rejoin when asked
  • Lock the meeting to prevent additional Zoombombers

If you schedule a meeting from the web interface, you won’t see the option to disable screen sharing. Instead:

  • Click on “Settings” in the left-hand menu
  • Scroll down to “Screen sharing” and under “Who can share?” click “Host-Only”
  • Click on “Save”

On the Zoom Settings page, turn off participant controls:

  1. Sign in to Zoom
  2. Click on the Settings link on the upper right (it looks like a gear).
  3. On the right side of the page, turn off: Autosaving chats, file transfer, screen sharing, and remote control.

Assign a Co-Host

For larger meetings, identify a co-host or two ahead of time whose role is to be a virtual room monitor and manage order during the meeting by managing the participants. Co-hosts are assigned during a meeting and cannot start a meeting.

  1. Sign into Zoom.us.
  2. Click on the Settings link on the left of the screen.
  3. Scroll down to the Co-host option on the Meeting tab and verify that the setting is enabled.
  4. Turn on Co-Host. If a verification dialog displays, choose Turn On to verify the change.

Prevent Screen Sharing by non-hosts

To prevent participants from screen sharing during a call, use the host controls at the bottom of the window, click the arrow next to Share Screen and then choose Advanced Sharing Options.

  • Under “Who can share?” choose “Only Host” and close the window. You can also lock the Screen Share by default for all of your meetings in your web settings.

Enable the Waiting Room

Before you start your meeting, enable the Waiting Room for your meeting. You and your co-host will then play an active role in choosing who to allow into the room through the participants’ list.

Meeting hosts can customize Waiting Room settings for additional control, and can even personalize the message that people see when they enter the Waiting Room so they know they’re in the right spot. This is a great way to post rules and guidelines for your event, like your screen-sharing or muting policy.

Locking the Meeting to Prevent Re-Joining of Removed Participants

During the meeting, a host or co-host can click on the More and Mute All Controls at the bottom of the Participants List.

  1. When viewing the Participants List, click Lock Meeting (under More) to prevent other participants from joining the meeting in progress.

Muting All Participants

During the meeting, a host or co-host can click on the More and Mute All Controls at the bottom of the Participants list.

  1. On the Participants List, click Mute All to mute all meeting attendees.

 

I hope this information was helpful, more importantly, I hope this information lets you know you do not have to sit back and be a victim and that you have options that can protect your events.  Please share this information with your peers and colleagues.

 

Good luck and be safe during these trying times…

The CMMC Accreditation Body signs MOU with the U.S. Department of Defense

The CMMC-AB is pleased to announce that it has mutually signed the Memorandum of Understanding (MOU) with the Department of Defense.  We are working to make additional information available to the public in conjunction with our DoD partners, who are necessarily focused on the COVID-19 public crisis.

The CMMC-AB continues its collaboration with DoD and industry across multiple lines of effort related to implementing CMMC in support of current milestones.

We are grateful for the opportunity to establish and implement CMMC assessment, certification, training, and accreditation processes to help the Department achieve the goals of improving cybersecurity in the Defense Supply Chain.

-The Cybersecurity Maturity Model Certification Body

Microsoft Windows SMB Server Could Allow for Remote Code Execution (CVE-2020-0796) – Security Advisory

SUBJECT:

A Vulnerability in Microsoft Windows SMB Server Could Allow for Remote Code Execution (CVE-2020-0796)

 

OVERVIEW:

A vulnerability has been discovered in Microsoft Windows SMB Server that could allow for remote code execution. Microsoft Server Message Block (SMB) is a network file sharing protocol that allows users or applications to request files and services over the network. Successful exploitation of this vulnerability could result in an attacker gaining the same privileges as the account running the SMB server and client processes. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

 

THREAT INTELLIGENCE:

There are no reports of this vulnerability being exploited in the wild.

 

SYSTEMS AFFECTED:

  • Windows 10 Version 1903 for 32-bit Systems
  • Windows 10 Version 1903 for ARM64-based Systems
  • Windows 10 Version 1903 for x64-based Systems
  • Windows 10 Version 1909 for 32-bit Systems
  • Windows 10 Version 1909 for ARM64-based Systems
  • Windows 10 Version 1909 for x64-based Systems
  • Windows Server, version 1903 (Server Core installation)
  • Windows Server, version 1909 (Server Core installation)

 

RISK:

Government:

  • Large and medium government entities: High
  • Small government entities: Medium

Businesses:

  • Large and medium business entities: High
  • Small business entities: Medium

Home users: Low

 

TECHNICAL SUMMARY:

A vulnerability has been discovered in Microsoft Windows SMB Server that could allow for remote code execution. This vulnerability is due to an error in handling maliciously crafted compressed data packets within version 3.1.1 of Server Message Blocks. To exploit this vulnerability, an attacker can send specially crafted compressed data packets to a target Microsoft Server Message Block 3.0 (SMBv3) server. Clients who connects to the malicious SMB server would then also be impacted. Microsoft Server Message Block (SMB) is a network file sharing protocol that allows users or applications to request files and services over the network. Successful exploitation of this vulnerability could result in an attacker gaining the same privileges as the account running the SMB server and client processes. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

 

 

RECOMMENDATIONS:

We recommend the following actions be taken:

  • Consider applying the workarounds provided by Microsoft until patches are released; The workaround does not mitigate attacks targetting SMB clients.
  • Run all software as a non-privileged user (one without administrative privileges) to diminish the effects of a successful attack.
  • Remind users not to visit websites or follow links provided by unknown or untrusted sources.
  • Inform and educate users regarding the threats posed by hypertext links contained in emails or attachments especially from un-trusted sources.
  • Apply the Principle of Least Privilege to all systems and services.

 

REFERENCES:

Microsoft:

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/adv200005

 

Tenable:

https://www.tenable.com/blog/cve-2020-0796-wormable-remote-code-execution-vulnerability-in-microsoft-server-message-block

 

CVE:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-0796

Setting up the root account on Kali 2020

Starting with Kali 2020.1, there is no longer a superuser account and the default user is now a standard, non-privileged user.  In Kali Linux 2020.1, both the default username and password are “kali

 

If you would like to use root instead of the none superuser account kali, here are the instructions to do so:

Issue command “sudo su”

<Enter the password for kali user account>

Issue command “passwd root”

<Enter new password and retype that password>

At this point you can log-off and re log-in or you can just switch the user and log in as root.

 

Let me know if this helped you.

 

Kali 2020.1 Default Username & Password – kali kali

Starting with Kali 2020.1, there is no longer a superuser account and the default user is now a standard, non-privileged user. Until now, users have logged on to the system with the user “root” and the password “toor”. In Kali Linux 2020.1, both the default user and password will be “kali

 

username: kali

password: kali

kali linux invalid password root toor for version 2020.1

 

If you would like to use root instead here are the instructions to do so:

Issue command “sudo su”

<Enter the password for kali user account>

Issue command “passwd root”

<Enter new password and retype that password>

At this point you can log-off and re log-in or you can just switch the user and log in as root.

 

Let me know if this helped you.

 

 

Intel Active Management Technology Multiple Vulnerabilities (INTEL-SA-00241)

Vulnerability: Intel Active Management Technology Multiple Vulnerabilities (INTEL-SA-00241)

Severity: High

Location: 623/TCP & 16992/TCP

Summary: Multiple potential security vulnerabilities in Intel Active Management Technology (Intel AMT) may allow escalation of privilege, information disclosure, and/or denial of service.
Vulnerability Detection Result

Installed version: 11.8.55.3510
Fixed version: 11.8.70
Installation
path / port:      /

Solution type: VendorFix  – Upgrade to version 11.8.70, 11.11.70, 11.22.70, 12.0.45 or later.

Affected Software/OS: Intel Active Management Technology 11.0 to 11.8.65, 11.10 to 11.11.65, 11.20 to 11.22.65 and 12.0 to 12.0.35.

Vulnerability Insight:

Intel Active Management Technology is prone to multiple vulnerabilities:

– Cross site scripting may allow a privileged user to potentially enable escalation of privilege via network access (CVE-2019-11132)

– Insufficient input validation may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access (CVE-2019-11088)

– Logic issue may allow an unauthenticated user to potentially enable escalation of privilege via network access (CVE-2019-11131)

– Insufficient input validation may allow an unauthenticated user to potentially enable denial of service or information disclosure via adjacent access (CVE-2019-0131)

– Insufficient input validation may allow an unauthenticated user to potentially enable information disclosure via network access (CVE-2019-0166)

– Insufficient input validation may allow an unauthenticated user to potentially enable information disclosure via physical access (CVE-2019-11100)

Vulnerability Detection Method:

Checks if a vulnerable version is present on the target host.

Details: Intel Active Management Technology Multiple Vulnerabilities (INTEL-SA-00241) (OID: 1.3.6.1.4.1.25623.1.0.143286)

Version used: 2020-01-07T08:25:23+0000

References

CVE: CVE-2019-11132, CVE-2019-11088, CVE-2019-11131, CVE-2019-0131, CVE-2019-0166, CVE-2019-11100
CERT: CB-K19/0978, DFN-CERT-2019-2375
Other: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00241.html