Kaseya has released a security update for the VSA zero-day vulnerabilities used by the REvil ransomware gang to attack MSPs and their customers.
Kaseya VSA is a remote management and monitoring solution commonly used by managed service providers to support their customers. MSPs can deploy VSA on-premise using their servers or utilize Kaseya’s cloud-based SaaS solution.
In April, the Dutch Institute for Vulnerability Disclosure (DIVD) disclosed seven vulnerabilities to Kaseya:
Kaseya had implemented patches for most of the vulnerabilities on their VSA SaaS service but had not completed the patches for the on-premise version of VSA.
Unfortunately, the REvil ransomware gang beat Kaseya to the finish line and utilized these vulnerabilities to launch a massive attack on July 2nd against approximately 60 MSPs using on-premise VSA servers and 1,500 business customers.
It is unclear which vulnerabilities were used in the attack, but it is believed to be one or a combination of CVE-2021-30116, CVE-2021-30119, and CVE-2021-30120.
Also Read: The 5 Phases of Penetration Testing You Should Know
Since the attack, Kaseya has urged on-premise VSA customers to shut down their servers until a patch is ready.
Almost ten days after the attacks, Kaseya has released the VSA 9.5.7a (9.5.7.2994) update to fix the vulnerabilities used in the REvil ransomware attack.
With this release, Kaseya has fixed the following vulnerabilities:
However, Kaseya is urging customers to follow the ‘On Premises VSA Startup Readiness Guide‘ steps before installing the update to prevent further breaches and make sure devices are not already compromised.
Below are the basic steps that admins should perform before starting up VSA servers again and connecting them to the Internet:
Of these steps, it is critical that on-premise VSA servers not be publicly accessible from the Internet to prevent compromise while installing the patch.
Kaseya also urges customers to utilize their “Compromise Detection Tool,” a collection of PowerShell scripts to detect whether a VSA server or endpoints have been compromised.
The scripts will check VSA servers for the presence of ‘Kaseya\webpages\managedfiles\vsaticketfiles\agent.crt’ and ‘Kaseya\webpages\managedfiles\vsaticketfiles\agent.exe,’ and ‘agent.crt’ and ‘agent.exe’ on endpoints.
The REvil affiliate used the agent.crt and agent.exe files to deploy the REvil ransomware executable.
For additional security, Kaseya is also suggesting on-premise VSA admin restrict access to the web GUI to local IP addresses and those known to be used by security products.
“For VSA On-Premises installations, we have recommended limiting access to the VSA Web GUI to local IP addresses by blocking port 443 inbound on your internet firewall. Some integrations may require inbound access to your VSA server on port 443. Below are a list of IP addresses you can whitelist in your firewall (allow 443 inbound to FROM ), if you are using these integrations with your VSA On-Premises product.” explains Kaseya.
After installing the patch, all users will be required to change their password to one using new password requirements.
Also Read: How Does Ransomware Work? Examples and Defense Tips
Established in 2018, Privacy Ninja is a Singapore-based IT security company specialising in data protection and cybersecurity solutions for businesses. We offer services like vulnerability assessments, penetration testing, and outsourced Data Protection Officer support, helping organisations comply with regulations and safeguard their data.
Singapore
7 Temasek Boulevard,
#12-07, Suntec Tower One,
Singapore 038987
