Stopping ‘Venus’ ransomware starts at firewall configuration
Additional defenses like web application firewalls, pen testing, and rule reviews help, too.
Getty Images
Additional defenses like web application firewalls, pen testing, and rule reviews help, too.
Getty Images
Ransomware of the “Venus” variety has hit at least one hospital, leading the US Health Sector Cybersecurity Coordination Center (HC3) to remind security pros to lock down the attackers’ way in: Remote Desktop Services.
“As the ransomware appears to be targeting publicly-exposed Remote Desktop Services, even those running on non-standard TCP ports, it is vital to put these services behind a firewall,” reads an HC3 report from early November.
Microsoft’s Remote Desktop Protocol (RDP) enables remote connections to other computers, most frequently over TCP port 3389.
While adjusting the firewall for remote services may seem like a straightforward process—allow a few machines to use port 3389 and no one else—misconfigurations happen. To account for mistakes, network-level access control also calls for additional defenses, like penetration testing and detection analytics, according to industry pros who spoke with IT Brew.
Remote control. Like other employers who sent their workforces home in 2020, hospitals have remote-access scenarios requiring RDP. Maybe a vendor has to “remote in” to provide updates to some legacy equipment, which brings the device onto the internet, exposing it.
With enough time (and password tries), an attacker can guess the RDP login credentials and “talk” to the device.
A Sophos survey in early 2022 found that 66% of surveyed healthcare organizations were hit by malware during the previous year, on par with the global average.
Venus ransomware appears to have begun operating in August 2022, hacking the RDP service to encrypt devices and terminate 39 processes associated with database servers and Microsoft Office applications, said the HC3 advisory.
While placing the RDP services behind a firewall is “vital,” according to HC3, mistakes happen.
Misconfiguration recommendations. Some tech exists to avoid misconfigurations, including web application firewalls and detection analytics that spot suspicious behavior like many unsuccessful login attempts. Multi-factor authentication for RDP access also helps the cause, said the HC3 report.
Penetration tests can also find publicly accessible ports, according to Steve Winterfeld, advisory CISO at the cybersecurity company Akamai Technologies, who appreciates a good list of defenses.
“Multiple security controls are going to ensure that even if one fails, you’re still protected,” Winterfeld told IT Brew.—BH
