Finger.exe & ClickFix, (Sun, Nov 16th)
Source SANS ISC Handlers Diary
Description
The finger.exe command is used in ClickFix attacks.
Impact
For European organizations, the impact of this threat primarily lies in the potential for attackers to stealthily retrieve and execute malicious scripts using a legacy protocol and executable that may be overlooked by standard security controls. Successful exploitation could lead to initial footholds in networks, enabling further lateral movement or payload deployment. Organizations with legacy Windows systems and network environments that permit TCP port 79 traffic are particularly vulnerable. The use of finger.exe bypasses proxy-based filtering if transparent proxies allow port 79, potentially circumventing perimeter defenses. This could result in unauthorized data access, system compromise, or persistence mechanisms being established. However, the lack of known active exploits and the medium severity rating suggest that the threat is currently limited in scope and impact. Nonetheless, the presence of this attack vector increases the attack surface and requires attention to prevent exploitation. European organizations with critical infrastructure or sensitive data are at risk of targeted attacks leveraging this technique, especially if network segmentation and outbound traffic controls are insufficient.
Defensive guidance
1. Block outbound TCP traffic on port 79 at network firewalls and perimeter devices to prevent finger protocol communications. 2. Disable or restrict the use of finger.exe on Windows systems through application whitelisting or group policy to prevent its misuse. 3. Implement explicit proxy configurations that block direct Internet access except through the proxy, ensuring finger.exe cannot bypass filtering. 4. Monitor network traffic for any use of TCP port 79 and finger protocol communications, using intrusion detection systems or network monitoring tools to detect anomalous activity. 5. Educate security teams about the risks associated with legacy protocols and LOLBins like finger.exe to improve detection and response capabilities. 6. Conduct regular audits of legacy tools and protocols present in the environment and remove or restrict those not required. 7. Apply network segmentation to limit the ability of compromised hosts to communicate externally using uncommon protocols. 8. Incorporate detection rules in endpoint detection and response (EDR) solutions to flag execution of finger.exe retrieving external scripts. These targeted measures go beyond generic advice by focusing on controlling the specific protocol and executable involved in the ClickFix attack.