The tragic incident of WannaCry ransomware a few years ago, I believe many people still remember it, and originally thought that it would be unlikely to happen again after such a long time, but I did not expect that the Windows that broke out a while ago still has an SMB vulnerability, and it is the Windows 10 and Windows Server 2019 systems that are currently used by the most people. The severity has even attracted the attention of the U.S. Department of Homeland Security (CISA). If not taken seriously, it is likely to cause a new wave of cyber attacks.
Windows exposes another SMB security vulnerability
The vulnerability reported this time is CVE-2020-0796, also known as SMBGhost or CoronaBlue. It exists in version 3.1.1 of the Microsoft Server Message Block Protocol. It is the same target attacked by the notorious WannaCry ransomware a few years ago. It can quickly infect multiple computers on the same network, thus causing an enterprise information security crisis.
U.S. Department of Homeland Security (CISA) Warning, although Microsoft has provided a patch update for this vulnerability in March this year, according to recent open source reports, malicious network attackers are using new PoC to lock these computers that have not been updated. It is strongly recommended to use a firewall to disable the SMB port of the computer and download the update that patches the vulnerability as soon as possible. (
This is a temporary implementation step that Threatpost provides to enterprise network administrators. Use PowerShell commands on the server to disable SMBv3 to thwart unauthenticated attackers (no reboot required):
- Set-ItemProperty -Path “HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters” DisableCompression -Type DWORD -Value 1 -Force.
A few weeks ago, a Chompie1337 user shared a test video of his successful attack through the CVE-2020-0796 vulnerability on his personal Twitter:
This was a pain 😂. But I was able to achieve RCE with CVE 2020-0796 #SMBGhost. pic.twitter.com/mvQ0YQt9GT
— chompie (@chompie1337) June 1, 2020
Although there have been no major security incidents related to this vulnerability reported at home and abroad, there are some problems every time a new version of Windows is launched, which also makes many people reluctant to update frequently, especially corporate and enterprise users. However, this vulnerability really needs to be taken seriously. Even if you don’t want to upgrade to the latest version, you still have to download the patched version.
The patched version is KB4551762, available in March this year for Windows 10 (versions 1903 and 1909) and Windows Server 2019 (versions 1903 and 1909). If you cannot update for some reason, Microsoft also provides solutions:
Source: KOCPC Chinese