How to remediate – ARCserve Backup for Laptops & Desktops Server Detection

1. Introduction

BrightStor ARCserve Backup for Laptops & Desktops Server is a backup service running on remote hosts, enabling clients to back up and restore files. Its presence indicates an enterprise-class backup solution for Windows PCs is installed. A successful exploit could allow unauthorized access to backed-up data. This affects confidentiality, integrity, and availability of the backups.

2. Technical Explanation

ARCserve Backup listens on a port used by clients for file transfer. An attacker can attempt to connect to this service remotely. The vulnerability lies in the exposure of this listening service, potentially allowing unauthorized access if not properly secured. There is no known CVE associated with simply detecting the running service; however, misconfigurations or vulnerabilities within the ARCserve Backup software itself could be exploited through this exposed port. An attacker could attempt to enumerate files and initiate unauthorized downloads.

• Root cause: The backup service is listening on a network port without sufficient restrictions.
• Exploit mechanism: An attacker attempts to connect to the service’s port, potentially enumerating data or initiating file transfers.
• Scope: Windows-based PCs running BrightStor ARCserve Backup for Laptops & Desktops Server / BrightStor Mobile Backup Server.

3. Detection and Assessment

• Quick checks: Use netstat -an | findstr "port_number", replacing “port_number” with the port ARCserve Backup uses (typically TCP 9876). A listening connection indicates the service is active.
• Scanning: Nessus plugin ID 134520 can detect BrightStor ARCserve Backup for Laptops & Desktops Server. Other scanners may have similar checks.
• Logs and evidence: Check Windows Event Logs for events related to ARCserve Backup, specifically looking for service start or connection attempts.

netstat -an | findstr "9876"

4. Solution / Remediation Steps

These steps limit access to the exposed backup service.

4.1 Preparation

• Change window: Consider a change window if network access restrictions could impact users. Approval from the IT security team may be required.

4.2 Implementation

1. Step 1: Configure the Windows Firewall to allow connections only from trusted IP addresses or networks.
2. Step 2: If possible, restrict access based on user accounts instead of IP addresses for increased security.
3. Step 3: Review firewall rules regularly to ensure they remain appropriate and effective.

4.3 Config or Code Example

Before

netsh advfirewall firewall show rule name=all

After

netsh advfirewall firewall add rule name="ARCserve Backup - Allow Trusted IPs" dir=in action=allow protocol=TCP localport=9876 remoteip=trusted_ip_address/32 enable=yes

4.4 Security Practices Relevant to This Vulnerability

Several security practices can help prevent this issue.

• Practice 1: Least privilege – only allow necessary network access to the backup service, reducing the attack surface.
• Practice 2: Network segmentation – isolate the backup server on a separate network segment to limit potential damage from compromise.

4.5 Automation (Optional)

A PowerShell script can automate firewall rule creation.

#Requires -RunAsAdministrator
$RuleName = "ARCserve Backup - Allow Trusted IPs"
$PortNumber = 9876
$TrustedIPs = @("192.168.1.10", "10.0.0.5")
foreach ($IP in $TrustedIPs) {
  New-NetFirewallRule -DisplayName $RuleName -Direction Inbound -Action Allow -Protocol TCP -LocalPort $PortNumber -RemoteAddress $IP -Enabled True
}

5. Verification / Validation

Confirm the fix worked by verifying firewall rules and testing connectivity.

• Post-fix check: Run netsh advfirewall firewall show rule name="ARCserve Backup - Allow Trusted IPs" and confirm the rule exists with the correct IP addresses.
• Re-test: Use telnet 9876 from an untrusted IP address; the connection should be refused.
• Smoke test: Verify authorized clients can still connect to the backup service and perform backups/restores.
• Monitoring: Monitor Windows Firewall logs for blocked connections attempts on port 9876 from unauthorized sources.

netsh advfirewall firewall show rule name="ARCserve Backup - Allow Trusted IPs"

6. Preventive Measures and Monitoring

Update security baselines and implement regular patch reviews.

• Baselines: Update your Windows Firewall baseline to include default rules for blocking unnecessary ports, including those used by backup services.
• Asset and patch process: Implement a regular review of installed software and apply security patches promptly.

7. Risks, Side Effects, and Roll Back

Incorrect firewall configuration can disrupt backup operations.

• Roll back: Remove the newly created firewall rule using netsh advfirewall firewall delete rule name="ARCserve Backup - Allow Trusted IPs" and restore default firewall settings if necessary.

8. References and Resources

Links to official advisories and documentation.

• Vendor advisory or bulletin: https://www.ca.com/us.html
• NVD or CVE entry: Not applicable for service detection only.
• Product or platform documentation relevant to the fix: Refer to CA ARCserve Backup documentation for firewall configuration best practices.