By Need

By Industry

By Function

Datacenter Modernization

"PrintNightmare” Microsoft Zero Day in Print Spooler

What We Know
On June 29, 2021, a Proof-of-Concept (PoC) exploit code was published on GitHub for a vulnerability related to (CVE-2021-1675) in the Microsoft Print Spooler (spoolsv.exe)–the process that manages printing services. This vulnerability has been given the nickname of “PrintNightmare.” 

Although Microsoft released an update in early June 2021 as part of the updates in patch Tuesday, it does not look like this update protects against the PoC code. As this is PoC exploit, it appears to work and is being referred to as a Zero-Day exploit.

It’s important to note that the exploit does require a user login and password or a password hash to work which could be used by adversaries for use with phishing to get an elevation of privilege.

No Known Fix; Recommended Workaround
Because there is currently no known fix, the recommended workaround is to disable the print spooler service on Domain Controllers and systems that do not print.
Yesterday CISA released a VulNote for this vulnerability.  

What you should do if you are running Microsoft Windows systems 7 and higher and have the Print Spooler service enabled:

Test and evaluate the impact of these changes.
• Follow proper change control and backout procedures.
• Disable the Print Spooler service wherever possible, especially on publicly exposed devices. Note that you should follow the recommended approaches from Microsoft so that the service is not brought back on inadvertently.
• If you cannot disable the Print Spooler service, limit network access to those devices as strictly as you can, especially on publicly exposed devices.
• Apply the relevant patches, if applicable, at the earliest opportunity once they have been made available.

“Assume the Breach”
In this era of ransomware, it is safest to assume that an attacker is already inside the network somewhere, on a desktop and perhaps even in control of a user account. Assume The Breach: this vulnerability allows for elevation of privilege and we will expect it to be used by adversaries.

Additional practices you should always follow: 
• Follow proper change control process
• Test your changes and patches before rolling into production
• Ensure you have immutable backups of all systems; that way if the worst happens you have a method of recovering.

If you need help with this security threat, please reach out to your GreenPages Account Manager or reach out to us.

Randy Becker

VP and Principal Security Architect

At Blue Mantis, Randy responsible for the leadership of the offensive security team. Randy provides leadership for the cyber security practice and advising our customers on how to better protect their assets while reducing risk. With strong expertise in offensive security, cyber security and risk management; cloud security, security consulting, operations, and optimization; infrastructure modernization; and hybrid cloud architecture, design, and implementation. Randy’s security certifications include OSEP, OSCP, CISSP, and CCNP.

Working closely with clients, he regularly designs and implement security solutions that enable organizations to effectively shrink their attack surface in an increasingly dangerous, dynamic cyber security landscape. In addition to preemptive maneuvers, he also develops cyber security strategies to help clients contain, combat, and remediate threats where they appear – while ensuring that both industry-specific and federal compliance mandates are met.