When critical software vulnerabilities are publicly announced, the cyber security community must act swiftly and decisively.
This was the case on February 19 of this year when ConnectWise released an urgent security alert affecting versions of their ScreenConnect software earlier than 23.9.8. This widely-used remote management tool was identified with two severe vulnerabilities (CVE-2024-1709 and CVE-2024-1708), with one scoring a CVSS 10, the maximum severity level. The advisory was marked as “Critical,” raising significant concern among cyber security professionals, including the Huntress team.
In response to this high-stakes situation, the Huntress team took immediate action. This behind-the-scenes account highlights their rapid, coordinated efforts and dedication to protecting the community.
The Essential Role of Cyber Security Teams
When faced with urgent vulnerabilities, it’s crucial for cyber teams to leverage their expertise to accelerate remediation efforts. Within hours of ConnectWise’s announcement, the Huntress team worked together to reproduce the vulnerabilities and develop a proof of concept for the authentication bypass exploit, which they dubbed “SlashAndGrab.” This straightforward but dangerous exploit posed a significant threat to users.
Cyber teams need to communicate with precision and clarity, emphasizing the seriousness of the threat while providing actionable guidance. At the time, over 8,800 ConnectWise servers were vulnerable. Thus, a temporary hot-fix was developed along with detailed instructions for users to prevent exploitation.
Navigating a Crisis with a Strategic Approach
Mike Tyson once said, “Everyone has a plan until they get punched in the face.” When dealing with major cyber incidents, teams must rely on experience, established procedures, and strong communication to navigate the crisis effectively.
Step 1: Assess the Situation
Understanding the nature of the threat is essential. The Huntress team promptly began analyzing the vulnerabilities despite the initial lack of detailed information. They quickly documented critical details, preparing marketing and support teams to address the issue. Within hours, they managed to understand the exploit and create a proof of concept, illustrating the exploit’s simplicity and potential for abuse.
Step 2: Raise Awareness
It’s vital to alert stakeholders in a way that drives immediate action and strengthens defenses. Following the advisory, Huntress contacted over 1,600 partners with vulnerable ScreenConnect versions, providing clear instructions for patching. The team avoided public disclosure of the exploit details initially to prevent aiding malicious actors. However, once the details were leaked, they pivoted to supporting the community with detailed analysis, detection methods, and urgent patching recommendations.
Step 3: Take Decisive Action
Instead of waiting for the situation to worsen, Huntress took proactive measures by releasing a hotfix. This temporary solution helped mitigate the risk while users updated their systems. The hotfix and detection guidance were quickly made available, with step-by-step instructions provided to partners and affected organizations.
Strengthening Cyber Security Responses
As our CEO Kyle Hanslovan put it, “This situation was severe.” However, it was manageable with a coordinated and strategic response. A well-defined crisis management plan enables cyber teams to respond effectively, protecting the community and mitigating risks efficiently.
