Stopping ‘Venus’ ransomware starts at firewall configuration

Ransomware of the “Venus” variety has hit at least one hospital, leading the US Health Sector Cybersecurity Coordination Center (HC3) to remind security pros to lock down the attackers’ way in: Remote Desktop Services.

“As the ransomware appears to be targeting publicly-exposed Remote Desktop Services, even those running on non-standard TCP ports, it is vital to put these services behind a firewall,” reads an HC3 report from early November.

Microsoft’s Remote Desktop Protocol (RDP) enables remote connections to other computers, most frequently over TCP port 3389.

While adjusting the firewall for remote services may seem like a straightforward process—allow a few machines to use port 3389 and no one else—misconfigurations happen. To account for mistakes, network-level access control also calls for additional defenses, like penetration testing and detection analytics, according to industry pros who spoke with IT Brew.

Remote control. Like other employers who sent their workforces home in 2020, hospitals have remote-access scenarios requiring RDP. Maybe a vendor has to “remote in” to provide updates to some legacy equipment, which brings the device onto the internet, exposing it.

With enough time (and password tries), an attacker can guess the RDP login credentials and “talk” to the device.

A Sophos survey in early 2022 found that 66% of surveyed healthcare organizations were hit by malware during the previous year, on par with the global average.

Venus ransomware appears to have begun operating in August 2022, hacking the RDP service to encrypt devices and terminate 39 processes associated with database servers and Microsoft Office applications, said the HC3 advisory.

While placing the RDP services behind a firewall is “vital,” according to HC3, mistakes happen.

• Admins sometimes apply the “any/any” rule, which allows all traffic on any port from any source to any destination—an error that Michael Hamilton, co-founder and CISO of the threat-detection software company Critical Insight, sees from stumped network managers just wanting to get connections working again. “In a lot of cases, that’s what they do because they can’t figure out a problem. And so they’ll just open it up to the world. That’s a big mistake,” said Hamilton.
• A network engineer may intend to expose a device to the internet for only a short period of time…and then get distracted. “They forget about closing the hole that they poked to make this thing work,” said Derek Wilson, senior information security analyst at the penetration-testing company NetSPI.

Misconfiguration recommendations. Some tech exists to avoid misconfigurations, including web application firewalls and detection analytics that spot suspicious behavior like many unsuccessful login attempts. Multi-factor authentication for RDP access also helps the cause, said the HC3 report.

Penetration tests can also find publicly accessible ports, according to Steve Winterfeld, advisory CISO at the cybersecurity company Akamai Technologies, who appreciates a good list of defenses.

“Multiple security controls are going to ensure that even if one fails, you’re still protected,” Winterfeld told IT Brew.—BH