Microsoft's PrintNightmare update is causing a lot of problems with network printers
Dears, the latest Windows updates is causing a lot of problems with network printers mapped on a print server. Reference: https://support.microsoft.com/en-us/topic/kb5005652-manage-new-point-and-print-default-driver-installation-behavior-cve-2021-34481-873642bf-2634-49c5-a23b-6d8e9a302872 https://support.microsoft.com/en-us/topic/managing-deployment-of-printer-rpc-binding-changes-for-cve-2021-1678-kb4599464-12a69652-30b9-3d61-d9f7-7201623a8b25 The two recent patches (KB5004945, KB5004760, or KB5003690) causes these two main problems: 1) unable for users without administrative rights to install new print drivers. The end user receive this error 2) unable to use the print server with the new registry key RpcAuthnLevelPrivacyEnabled **The system logs reports this error: 0x0000011b** The two workarounds that you have to apply to survive and allow corporate users to be able to use the print server are: 1) Even if you have a GPO with "Point and Print Restrictions=disabled", you have to apply this registry key to allow non administrative users to install the latest print drivers from the print server HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint RestrictDriverInstallationToAdministrators = 0 2) Apply this registry key to disable the new default settings related to the print spooler vulnerabilities HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print RpcAuthnLevelPrivacyEnabled = 0 The above workarounds are only a temporary solution to survive and allow users to print. What is unclear to me is what should be the right way to manage these settings in a corporate environment without any end user interaction. So, if I want to be protected and apply the recent security fixes without asking the end users to do something, what should I do? Microsoft states that you need to set "RpcAuthnLevelPrivacyEnabled" to "1" on both Client and Print Server in order to be protected, but if you do this, you can't print. So, what should we do in a Corporate environment to be secure and print without any end user interaction about "driver installation" etc.? Thanks in advance
Need assistance in regards to possible zero-day printer nightmare exploit
We are all aware of the printer nightmare exploit and the threat level. I believe I have found a windows system file that is undetected by every AV solution however is not signed by microsoft and shows over 300 indicators on virustotal. The file in question is the udhisapi.dll. After a forensic investigation into printer issues, I found that a local desktop was hosting this file for download as a server. After this I looked and found 12 different versions of this dll on my desktop and 16 versions on the front register (all of which had different locations and sizes). I took the largest of the files to virustotal and found this information. Our enterprise security, bitdefender, had reported 3 printer nightmare exploits on our endpoints, which went up to 6 total exploits within the first two hours of today. The file in question references the SOAP protocol and many blacklisted strings that are whitelisted once the file itself is executed. This is the reason behind my sfc scans and dism commands not properly remediating the issue. From what it seems, there is a MITM actor that intercepts the windows order for a print, through the spooler service, and drops a malicious file instead. I have had the MRT.exe remove two variants of windows 32-bit ransomware (cerberus variant) in the past two days, found under the local microsoft edge cache (the browser which I print from). The link to the dll in question on virustotal is here:https://www.virustotal.com/gui/file/6f2ec54de75cb421f464682068e2d32e27644b3a1f3d03f8b2295760e50523cb/detection I will also include the file itself on this post, encrypted with password: malicious. My printer shows intermittent signs of this exploit, as well as being detected as affected by this exploit, regardless of it being updated daily. Signs would include: spooler showing one document pending with no document in the queue. Inability to properly disable the spooler service (before the ransomware removal) whether through powershell or windows services. Please offer any guidance on this issue as it is CURRENT. I also have other files that I believe to be related that I will submit if this issue catches traction. Thank you so much! Edit: now 8/10 endpoints are showing the printer nightmare exploit. Edit 2: Attached another file, the windows media creation tool, downloaded directly from microsoft, but showing blacklisted languages for, chinese traditional, and saudi arabia. As well related files seem to be malicious. Compiled in 1974 according to PE information. Edit 3: My security software is blocking connection to our POS server, citing data protection. Printer stopped working for about an hour but was able to get it back online for now. Edit 4: Security software blocking credit card processing machine, running android OS I believe. Owner had me disable data protection module so they could process a transaction. Logged in my notes.... Edit 5: 9/10 endpoints showing printer nightmare exploit. Edit 6: Security support team from bitdefender said the files don't relate to the printer nightmare exploit, apologies if this was tagged incorrectly. Edit 7: not at office today, just expanding contacted ips, referring files and communicating files (regarding the media creation tool) link to vt graph: https://www.virustotal.com/graph/embed/gf8aeac13b1b74d7d90f369b434226dc2a58e14b3bf604091a86b75007d19b49e nearly all files are new as of this year or last year. Edit 8: Yes I am making the claim that the main windows media creation tool for 21h1 is backdoored, I understand the implications and how unlikely this is. Reddit classified this type of malware as "polymorphic code with variable covert data exfiltration". I also have made a simplified graph on VT only containing the execution parents, and communicating files to contacted ips by the media creation tool. Link: https://www.virustotal.com/graph/gac59b3c279394c019262f6fc7cb03e6eabaf85fa7cda48de87880b180c58826b Edit 9: Here is the link to an analysis of the original officesetup.exe that started my investigation 3 months ago :https://analyze.intezer.com/analyses/be1706a9-f94f-4e34-8c55-706cbaf9ecc2 the strings referenced that concern me are the "admin tools": Teamviewer, monero, wireshark, bitcoin, injectproc, driver toolkit, and others. More malicious files being detected by msert.exe today. I will upload the office setup file here as well password: malicious. Edit 10: As well the MITRE shows a unix command/scripting interpreter utilized and references a command and control server. Edit 11: Suspicious program connecting through firewall, according to bitdefender. Uploading with password: malicious also will run a dynamic sandbox report. Edit 12: https://analyze.intezer.com/analyses/b9172ae7-26cc-45db-9dc1-183297ded4db Edit 13 : Msert found over 20 infected files, but did not remove or list any. I have seen this before and know it can be normal. Given my situation I have suspicions however. Edit 14: Home system seems to be infected still by whatever form of malware this is. Uploading more files that were dropped as a windows upgrade and scan clean, my explorer (windows ui) is crashing randomly and restarting. Password malicious, removed wildtangentservice, as it is not windows related I believe.
