DNS Vulnerability: Your IT Team to the Rescue

July 14th: as Microsoft flag a ‘Critical’ Level-10 DNS vulnerability on Domain Name System (DNS) servers worldwide, Lineal engineers rush to patch the infrastructure of dozens of organisations overnight.

The Microsoft Security Response Center recently released details of CVE-2020-135, a ‘Critical Remote Code Execution’ weakness deemed ‘wormable’ (potentially spreading between devices automatically) affecting all Windows Server versions.

A grade of 10.0 is the highest possible severity level that can be assigned under the Common Vulnerability Scoring System Calculator. For comparison the WannaCry attack, which temporarily crippled the NHS in 2017, had a CVSS rating of 8.5.

Lineal staff use remote monitoring software to administer large numbers of client servers and devices, monitor hardware health and deploy patches more rapidly – and were quickly on the case overnight to patch the vulnerability as a special emergency.

dns vulnerability conversation

Within 8 hours we’d patched a large number of DNS servers – applying both an initial fix and further scheduled updates.

DNS is a naming technology which translates the identities of computers, servers and other networked devices into the IP addresses used for connecting on private and public IT networks.

dns how stuff works diagram

For this reason, DNS servers often have massive reach, and must be carefully protected to mitigate the risk of compromising an organisation’s technology on a huge scale – even across the globe.

Israeli IT security firm Checkpoint Software Technologies, who discovered the 17-year old hidden bug and reported it to Microsoft, argue ‘this is not just another vulnerability’ and risks handing an attacker ‘complete control of your IT’ if IT admins fail to address the issue urgently.

 

For IT expertise and support, please contact our team today.


Microsoft announce end of support for Windows Server 2008

Support and security updates for Microsoft’s Windows Server 2008 and 2008 R2 operating systems will end in January 2020.

Customers operating Windows Server 2008 will then cease to receive security patches and other important system updates.

Around 70% of the world’s server operating systems are Windows based, with Server 2008 one of the most successful versions, still representing more than half of these installations as recently as 2016.

Users of Server 2008 and 2008 R2 have just over 6 months to decide whether to upgrade to a newer version of Windows Server (such as the long-awaited Server 2019, hardware permitting), replace servers with newer models, or migrate those server-based processes to a cloud-based platform, such as Microsoft Azure.

‘Mainstream’ Support for Server 2008 is unlikely to be extended – having already been granted temporary extensions, once from July 2013 to January 2015, and again to the final deadline next year.

As with previous operating systems, enterprise customers will have the option of purchasing ‘Premium Assurance’ support packages of different levels, to extend support as late as 2026 – but as with other legacy Windows products, for increasingly high associated costs.

Businesses will need to weigh up for how long they can afford to delay upgrading, or depending on the physical server hardware, whether it makes more sense to spurn the licensing costs of upgrading the Windows Server version and go directly to either the cloud, or a new server.

 

For IT infrastructure support and expertise, please contact our team today.


Windows Server 2003 vulnerability for 1 in 5 businesses

Windows Server 2003

Nearly 1 in 5 Windows Server users are still running Windows Server 2003 at great risk, more than a year after Microsoft announced end of security support for the product, new findings have shown.

Research by Spiceworks and Cloudphysics both found that 18% of Windows Server licensing market share is still taken up by Windows Server 2003, based on data recorded in June 2016. More than 53% of those surveyed also still ran one or more instances of Windows Server 2003 somewhere in their organisation.

Anyone still using the old software risks becoming vulnerable to security threats, which Microsoft will no longer address, with many organisations potentially being in violation of their compliance, insurance or regulatory obligations for data protection.

The continuation of Windows Server 2003 (which Tech Radar last year touted as potentially “the biggest security threat of 2015”) has been left unresolved within many companies, many of whom believe they lack a clear decision, expertise, or funds to replace the now unsupported operating system.

In the short term the best measure is risk mitigation: isolate any Windows Server 2003 systems as much as possible to prevent access by outside security threats.

But sooner or later, all companies will need to upgrade important systems, and those that do make the move are less likely to invest in the capital expense of physical hardware as they were over a decade ago – with increasing numbers likely to utilise an outside IT provider to migrate to a managed virtualised solution, for example business cloud services.

For Windows licensing support or guidance, please contact Lineal today – 01271 375999 or click here.