There's no quick fix after decades of underinvestment, but the process has started. Cybersecurity grants, mandatory reporting protocols, and beefed-up authentication requirements are being put in place.

Securing critical infrastructure is complicated because of the vast network of facilities and management systems. Threats targeting this sector can have dire consequences, and when attacks do happen, they're often accompanied by a media storm. This generates interest among concerned citizens, which prompts a reaction from politicians, who are spurred into action to ensure the necessary cyber protections are implemented to calm the concerned citizens — the electorate.

The 2021 ransomware attack on Colonial Pipeline, which caused long lines at gas stations, followed this very timeline and served as a much-needed wake-up call to protect critical infrastructure services against cyberattacks. The attack prompted action at the highest levels of US government, causing the president to expedite an executive order aimed at strengthening US cybersecurity defenses. The executive order, in brief, requires disclosure of incidents, creates a federal playbook for incidents, mandates cybersecurity upgrades, creates a review board, and, importantly, encourages an ethos of cyber-intelligence sharing between government agencies and the private sector.

**Wake-Up Call**

The emphasis on cybersecurity due to the increased threats to critical infrastructure — including cybercriminals attempting to monetize their efforts, terrorism, and the conflict in Ukraine — is unprecedented. In the current budget proposal, the Cybersecurity and Infrastructure Security Agency (CISA) will receive $2.93 billion, $417.1 million more than it requested. There are numerous grants available to critical infrastructure organizations to assist funding the much-needed improvements to cybersecurity; in April 2022, CISA and FEMA began rolling out the first $1 billion from the Rescue Act to help state and local entities improve cybersecurity. Testifying before the House Homeland Security Subcommittee, Jen Easterly, director of the CISA, used the cyberattack on the Oldsmar, Fla., water utility plant as an example of an attack on critical infrastructure to justify the original request.

Enormous would be an underestimate of the task of upgrading the cybersecurity of water supply and wastewater systems in the US. According to American Water, there are 53,000 water supply and sanitation providers in the US. The Environmental Protection Agency (EPA) calculates this differently, and lists 148,000 public water systems (not companies).

If, like me, you live in a rural community, the company supplying your water is likely a small local business providing a critical infrastructure service. On Feb. 5, 2021, the water treatment system servicing Oldsmar City suffered a cyber incident: A poorly secured remote-access solution based on TeamViewer was accessed by a perpetrator, who adjusted the amount of sodium hydroxide in the water from 100 parts per million to 11,000 parts per million. Fortunately, a city water plant operator noticed the increase and reversed it, stopping the attack and the potential poisoning of thousands of people. It was later disclosed that the system accessed wasn't protected by two-factor authentication and was protected by a weak, shared password. There really is no excuse.

The Wall Street Journal's CIO Journal suggests that technology spending as a percentage of revenue in banking and securities is around 7%, and in construction and manufacturing just 2%. Given that water supply is a critical infrastructure service and has been specifically called out as needing cybersecurity investment, it is reasonable to expect spending on IT, including cybersecurity, to be at the higher of these two levels. A report by Deloitte breaks this number out for cybersecurity spending, which they estimate to be 10.9%.

**The $2.5 Billion Scope of the Problem**

What does this mean in a rural water system company, without shaming any particular company? I will use a real-life example without naming the company. Company X has a total revenue budget of $12.4 million per year, with an operating cost for computer services of $211,000 for the same period. There are some costs for IT-related items that may be outside of the operating budget and are attributed to capital spending. For the fiscal year 2021–22, the only item that could have cybersecurity element is a $50,000 cost for SCADA/telemetry/electrical control replacement.

This equates to IT spending (listed as computer services) of 1.7%, and even allowing that 50% of the capital expenditure item is cybersecurity, which is unlikely, this becomes 1.9%. Using the earlier mentioned cybersecurity estimate of 10.9%, the spending on cybersecurity is just under $22,000 per year, for an organization with $12.4 million in revenue. In a sector under continual threat, it's not unreasonable to expect spending to replicate that of financial organizations, which, in this instance, would equate to an IT spending of $868,000, with cybersecurity accounting for just under $94,000 per year.

The water sector does benefit from federal assistance, and the EPA has requested $25 million in fiscal year 2023 for a new grant program to advance cybersecurity infrastructure capacity and protections within the water sector. If you do raw math on this and distribute it among the 54,000 organizations, it equates to less than $500 each. There may be other funding and grants available, but the point isn't the numbers, it’s the magnitude of the problem. To fund each water supply organization $50,000 for cybersecurity, a more realistic number, a budget of $2.5 billion would need to be set aside.

Years of underinvestment in critical infrastructure security isn't something fixable in the short term. The complexity of dealing with 53,000 organizations (around 50,000 of them rural) and attempting to bring them all to a basic level of compliance is a mammoth task. All of this comes at a time when inflation is rampant, and the cost of energy is high.

**One Possible Solution**

There is always a solution. One idea is that the IT services of water supply companies would be better serviced if they were grouped together, centralizing internal services.

If, for example, 10 companies joined together for IT and cybersecurity, there would be numerous benefits: financial, resources, communication, compliance, policy, etc. This would be similar to the way individual schools are part of a school district, with one, single governing body. This is just one solution, and I'm sure there are many options that could be pursued that could help alleviate the financial and resources burden facing the critical infrastructure sector.

What Will It Take to Secure Critical Infrastructure?

Come up with a clever caption, and our panel of experts will reward the winner with a $25 Amazon gift card.

Somebody is wide awake despite their winter hibernation bedtime. Any idea what's going on? Send us a witty cybersecurity-related caption for the cartoon, above, and you could win a $25 Amazon gift card.

The contest closes on Wednesday, Dec. 28, 2022. Here are four convenient ways to submit your ideas: 

*   Email _\[email protected\]_ with the subject line "The Edge December 2022 Toon."
*   Via social media: Twitter, Facebook, and LinkedIn.

**Last Month's Winner**

Congratulations go to Alex B., a business development pro in Alabama. Dark Reading editors were tickled over his caption for last month's "Turkey Time" contest, earning him a $25 Amazon gift card.

    

A big thanks to all who participated.

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

Name That Edge Toon: Not Your Average Bear

Global security technology provider with 20+ years of experience embraces the next evolution of its business with refreshed brand and invigorated leadership.

**MELVILLE, NY, Dec. 6, 2022 —** Intellicene, a provider of intelligent software platforms that empower organizations to better understand and respond to mission-critical events, today announced the close of its acquisition by Volaris Group and the launch of its new brand. Previously known as Cognyte Situational Intelligence Solutions (SIS), the new Intellicene embodies a strategic new direction and an ambition to being a global security intelligence leader of choice.Led by veteran security executive Alan Stoddard, Intellicene incorporates former SIS employees and assets, including the Symphia suite of technologies. The new name and strategic direction also introduces “The Age of Intelligence” which showcases Intellicene’s mission to transform security management from a reactive endeavor to a proactive process that is highly effective, data-driven, and measurable.

The launch of Intellicene follows an incredibly successful year, which saw the company strengthen its presence with new customer wins. Volaris’ buy-and hold philosophy provides stability, shared best practices and a global footprint that can create new opportunities for Intellicene.Sitting at the nexus of awareness, insight, and action, Intellicene delivers integrated, intelligent software platforms that help leaders better understand and respond to critical situations across their organizations. The company has provided intelligent security management platforms to a wide variety of mission-critical, global businesses for more than 20 years since its formation under Verint Systems in 2002.

“We are excited for Intellicene to enter this next chapter and together with Volaris see compelling opportunities to accelerate our growth trajectory and enhance customer focus,” said CEO Alan Stoddard. “With the strong support of our new owners, we are well positioned to capitalize on the many opportunities before us, and we see tremendous potential to expand our reach into new markets and drive new innovations and capabilities.”

Intellicene is focused on ensuring stakeholders have the right tools to help protect operations, assets, and people. With extensive expertise in the security and IT realms, the company and its team has helped ensure the safety of well-regarded brands by developing solutions that help leaders better understand and respond to critical situations. Its Symphia software platform connects to and correlates data from virtually any device, system, or software, providing the real-time awareness and actionable insights needed to identify potential threats and respond effectively.

“We’re pleased to complete this acquisition and support Alan and the management team in building their vision for Intellicene,” said Carl Bruce, Volaris Group. “We see this market as holding tremendous opportunity, and under our ownership, Intellicene is well positioned for future growth.”

Stoddard brings significant experience in leading global organizations and has more than 12 years of experience in the security industry. In addition to Stoddard, the senior leadership team includes Uri Shaffer, Vice President of Sales for EMEA and APAC; Craig Levin, Chief Financial Officer; Yosi Rahamim, Vice President of Research and Development; Mike Howanitz, Vice President of Sales and Business Operations; Joey Caluori, Vice President of Operations; Eran Wachman, Vice President of Product Management; Tracy Markum, Vice President of Sales for the Americas; and Jeffrey Lewis, Chief Marketing Officer.

**About Intellicene**

Intellicene sits at the nexus of awareness, insight, and action. Our mission is to help organizations worldwide harmonize security, business continuity, and risk management to protect what matters most. By delivering integrated, intelligent software platforms that help you better understand and respond to mission-critical events, Intellicene empowers you to manage the most complex security and business operations efficiently. From mobile applications and AI-driven analytics to infinitely scalable software and intelligent devices, we’re building advanced technology that raises the bar and makes the world safer. For more information, visit intellicene.com.

**About Volaris Group**

Volaris acquires, strengthens, and grows vertical market technology companies. As an Operating Group of Constellation Software Inc., Volaris is all about strengthening businesses within the markets they compete and enabling them to grow – whether that growth comes through organic measures such as new initiatives and product development, day-to-day business, or through complementary acquisitions. Learn more at volarisgroup.com.

Intellicene Brand Launches After Completion of Acquisition by Volaris Group

Extending multifactor authentication to include device identity assurance offers more authentication confidence than what multiple user-identity factors can by themselves.

For many years, multifactor authentication (MFA) has been key to mitigating password risk. But as MFA use has increased, cybercriminals have adapted their credential theft tactics.

In January 2022, the Office of the Management and Budget (OMB) issued a memo recommending that federal agencies move to passwordless MFA. And while this memo is only directed toward federal agencies, the US government is raising the cybersecurity baseline. It’s up to private-sector organizations to take notice.

One strategy that has emerged is zero trust. At least 76% of organizations have started implementing their zero-trust strategies, with MFA taking a prominent role. The National Institute of Standards and Technology recommends extending your MFA strategy to include assurance of device identity. This leads to more authentication confidence than what multiple user identity factors alone can provide.

Keep reading to learn how you can harden identity policies by extending your MFA strategy and leveraging existing security options.

**Understanding MFA Limitations**

Traditionally, strong passwords were the go-to strategy for reducing brute-force attacks. But most people can’t remember all of their complex passwords, so they end up recycling them across multiple accounts. The average person reuses their password 14 times, and they often use the same password across both personal and organizational accounts. This creates a blind spot in which organizational accounts can be compromised by phishing attacks on personal accounts — something that is completely outside of organizational email protection capabilities.

We’ve also seen an increase in man-in-the-middle (MiTM) phishing, SMS hijacking, and email hijacking attacks. MiTM phishing happens when adversaries exploit second factors with out-of-band authentication paths, such as app notification, email, or SMS. The user initiates a password authentication request that is intercepted by the adversary, who then creates a separate authentication request and accompanying out-of-band second factor prompt. Users often approve these prompts since they’re indistinguishable from their own.

In an SMS hijacking attack, the adversary redirects the SMS notification destination to their own device. This allows them to initiate an authentication request that can be approved without the knowledge of the user. Similarly, adversaries can use a compromised email mailbox to approve email-based second factors. Since email is also often used as a path for recovery of credentials to non-SSO services, a compromised mailbox can also lead to the compromise of a long chain of dependent services through third-party password resets.

Another possible blind spot is with phishing attacks that use illicit consent grants, as these can be harder to detect than traditional phishing attacks. In an illicit consent grant attack, the adversary tricks end users into granting a malicious application consent to access their data on their behalf, usually via an email with a link. This is challenging because the link destination itself is not malicious, only the application. After the malicious application has been granted consent, it uses application-level access to data without requiring the user’s credential.

Unfortunately, typical mitigation steps, such as requiring MFA or resetting passwords for breached user accounts, are not effective against these types of attacks. Because the attacks take place downstream of authentication using third-party applications external to the organization, adversaries can create their own external persistent access paths. So how do organizations address this challenge?

**Implementing Phish-Resistant Authentication**

Having stronger means of authentication and more modern options doesn’t mean organizations can roll them out overnight. In most cases, it makes sense to ensure MFA is used everywhere. For example, organizations can layer in conditional access policies requiring users to limit their activities to organizational devices, helping to mitigate external phishing scenarios.

Phish resistance is an important goal that should be combined with additional objectives to maximize authentication strength. We recommend organizations go passwordless by removing the user's password as a factor. Provide authentication options with broad applicability covering desktop and mobile scenarios, and assess device identity and health status prior to authorization.

Zero-trust principles should also be used to define an implementation road map that addresses all points in the authentication chain with a layered defense. Take steps to harden the authentication infrastructure itself, apply identity protection to users, identify and monitor applications for illicit grants, and identify devices explicitly during authentication while continually monitoring them after authorization as they use access tokens. In doing so, organizations can better create modern, phish-resistant authentication strategies.

Hardening Identities With Phish-Resistant MFA

Organizations can best defend themselves on the cyber battlefield by adopting a military-style defense.

Data leaks, breaches, and cyberattacks are becoming the norm, spawning discussions on how organizations can effectively defend themselves against an ever-evolving threat landscape. With the modern battlefield extending to cyberspace and adversaries adopting military-style tactics, today's defenders see analogies from the military sector as increasingly relevant.

**An Introduction to the OODA Loop**

The OODA loop was introduced by US military strategist and Air Force Col. John Boyd in the mid–20th century. The idea is to create a framework where decisions could be made quickly, using the latest contextual information, helping defenders outpace and out-innovate their opponents.

The loop consists of four phases: Observe, Orient, Decide, and Act. It refers to an iterative decision-making process through which entities observe evolving information, contextualize it, decide on next steps, implement an action plan, and adapt a strategy based on observations and results obtained.

**How Can the OODA Loop Benefit Cybersecurity Teams?**

While the OODA loop was originally developed as a strategy for fighter pilots to use in dogfights (a rapidly evolving environment where stakes are extremely high), a number of litigation, law enforcement, and military organizations have been using OODA successfully for years.

With technology undergoing a massive transformation over the past decade, it's become nearly impossible to monitor and track such a vast ecosystem of infrastructure, users, and applications. All in all, the stakes couldn't be higher for security teams, and since cybersecurity operations have a lot to learn from a real battlefield, the OODA loop is now witnessing an increased amount of attention from the security industry.

The OODA model is applicable to both defenders and incident responders. From a defender's perspective, OODA can be used by security teams for day-to-day operations such as monitoring security events, assessing potential risks, and conducting threat-hunting exercises. From an incident responder's perspective, OODA can help identify, investigate, and respond to potential security issues in a way that recovery can be expedited and damages can be minimized.

**How Can Cybersecurity Teams Leverage the OODA Model Effectively?**

The OODA loop alone doesn't lead to effective cybersecurity. For the model to truly be successful, organizations must ideally be able to "observe" all activity across infrastructure, users, and applications, "orient" themselves with the right contextual information so they can make the right security decisions, and finally, have a "just-in-time" cybersecurity system that can help implement controls in real-time and across the entire ecosystem.

If your organization is looking to implement the OODA model effectively, it must consider deploying a single-pass cloud engine, a converged software stack based on SD-WAN that secures all traffic based on identities — including routing, decryption, deep-packet inspection, and security policy enforcement decisions — known to be native to secure access service edge (SASE). Here are three reasons why:

**1\. End-to-End Visibility Is Key to Observation and Orientation**

Gaining insight into what's happening on the entire attack surface requires a holistic security system that provides end-to-end visibility of all network and security activity. Standard security and threat intelligence services today are siloed and do not communicate well with each other. Security teams therefore lack the right data to implement sound security decisions. On the other hand, as part of the SASE architecture, the single-pass engine ingests all network flows, including Web and cloud traffic, devices, users, applications, systems, and even the Internet of Things (IoT). Since all information flows through a single system, security teams can "observe" end-to-end flows, "orient" themselves with the right context (such as identity, device, network, application, or data), and "decide" on actionable next steps.

**2\. Rapid Decision-Making Requires Just-in-Time Situational Awareness**

When organizations encounter security incidents, time is of the essence. But for dynamic and effective security decisions, security teams require just-in-time situational awareness on infrastructure activity, user behavior, and data movement, etc., as well as contextual information like applications, user identities, locations, and time. Such information is needed to reduce the time taken from observation to action and is critical in incident response scenarios. Not to mention, legacy security tools are fragmented and usually don't provide the full picture needed in rapid OODA looping and crisis situations. With single-pass processing, all services are delivered within the architecture and therefore, security teams benefit from contextual single-pane-of-glass information, which helps them "act" (the last stage of the loop) and respond to a crisis more efficiently and minimize potential damages.

**3\. Real-Time Actions Need a Comprehensive and Ubiquitous Security Backbone**

Attack vectors and threat surfaces evolve so rapidly that security teams must evolve and adapt their defenses according to the observations they make across the industry or their own environment. Cyberattacks, breaches, and vulnerabilities come unannounced at any point in time, which is why security teams need a robust infrastructure that enables them to have seamless control over the entire IT environment at any sudden moment. With SASE, because networking and security management are combined in one place and can be applied to any user or application from anywhere, it's easier to manage security controls and apply patches to applications or devices that do not have an official patch yet (using virtual patches).

It's probably safe to say that the more cybersecurity professionals practice OODA in their everyday decision-making, the more proficient they will become and the faster they will operate. That said, one of the fundamental pillars of the OODA Loop is having an end-to-end security system that provides the right security data, in the right context, at the right time, and with the right levels of controls. This is where SASE and its single-pass cloud engine comes into play in securing the infrastructures of the future.

Applying the OODA Loop to Cybersecurity and Secure Access Service Edge

Victims include at least 15 healthcare organizations, one Fortune 500 company, and other organizations in multiple countries, security vendor says.

Russia-affiliated threat actors have compromised systems belonging to multiple organizations in the US, the UK, France, and other countries and are using them to launch attacks against targets in Ukraine.

Among those whose networks the threat actors have hijacked are at least 15 healthcare organizations, one Fortune 500 company, and one dam-monitoring system, according to a study by threat intelligence and cyber-deception company Lupovis published Dec. 6.

"Russian criminals are rerouting through their networks to launch cyberattacks on Ukrainian \[organizations\], which effectively means they are using these organizations to carry out their dirty work," Lupovis warned in its report.

Lupovis recently deployed a set of decoy documents, Web portals, and SSH services on the Internet as part of an effort to study Russian threat activity targeting Ukrainian entities. The goal was to find out the extent to which Russia's war in Ukraine had spilled over into the cyber realm, like many predicted it would.

**Ukraine-Themed Decoys**

The company designed the decoys in a manner as to entice Russian actors looking to compromise Ukrainian targets. For instance, Lupovis labeled decoy documents with names related to Ukrainian government officials and the country's Critical National Infrastructure, and its decoy websites spoofed Ukrainian government and political sites. The decoy documents contained information that adversaries would consider useful, such as usernames, passwords, and addresses to purportedly critical assets and databases on the decoy websites. The company deliberately leaked some of these fake documents in key Dark Web forums.

Lupovis managed to attract three types of adversaries to its decoy sites. One set comprised of opportunistic attackers, or those constantly scanning the Internet for exploitable CVEs and systems. This was a category of threat actor that Lupovis ignored for the purposes of its study. The second category of adversary was comprised of threat actors who landed directly on the decoy sites without following the breadcrumbs that Lupovis had planted on the Dark Web forums. The third set of threat actors were mostly Russia-based adversaries who took the bait, extracted information from the decoy documents, and used it to attack the decoy websites.

In all, between 50 and 60 attackers landed on each of the two decoy sites Lupovis has set up — some of them just minutes after the sites went live. Once on the sites, the attackers carried out a variety of malicious activities, including SQL injection attacks, remote file inclusion tactics, and Docker exploitation attempts. In many cases, threat actors on the decoy sites attempted to make them part of bigger DDoS botnets or to use them to launch attacks against other Ukrainian websites.

The largest group of attackers were independent actors, says Xavier Bellekens, CEO of Lupovis. They often appeared to be acting alone and were part of communities on Telegram, he says. "Some actors were more advanced in their techniques, tactics, and procedures. However, we haven’t yet been able to correlate them against known Russian APTs." 

The primary motivations in many of these attacks appeared to be information stealing, disruption, and using the decoy websites to launch attacks against other Ukrainian targets, he notes.

**Going After Healthcare**

One of the most disconcerting aspects that researchers at Lupovis observed was the number of attacks on its decoys from other, previously compromised websites and systems belonging to healthcare organizations and entities in other industry sectors, from multiple countries. 

Bellekens says Lupovis was unable to identify the specific groups that were carrying out these attacks, or if any of them were previously known Russian advanced persistent threat groups. "We identified them as Russian if they used scripts containing Cyrillic, tried to access Russian websites, \[or\] looked for specific information in Cyrillic," he says. "A large number of these adversaries tried to exploit the decoys further to launch attacks against Ukrainian entities."

Lupovis' findings suggests that fears earlier this year about Russian cyberattacks in Ukraine impacting organizations in other countries were correct. "Russian cyberattacks have skyrocketed and any country or business that has allied with Ukraine, or opposed the war, has become a target," according to the report.

Concerns over such attacks prompted the US Cybersecurity and Infrastructure Security Agency (CISA) to issue an advisory earlier this year urging both government and private organizations to assume a Shields Up posture for detecting and responding to attacks from Russian cyber groups. The advisory followed remarks by President Joe Biden regarding the US government's willingness to respond in kind to any attempt by Russia to attack the US in cyberspace or through other asymmetric means.

Russian Actors Use Compromised Healthcare Networks Against Ukrainian Orgs

Organizations of all sizes can now protect their cloud-native applications easily and cost-effectively across containers and all other cloud assets.

**RIDGEFIELD PARK, N.J., Dec. 6, 2022 (GLOBE NEWSWIRE) —** AlgoSec, a global cybersecurity leader in securing application connectivity, announced today that it has acquired Prevasio, a SaaS cloud-native application protection platform (CNAPP) that includes an agentless cloud security posture management (CSPM) platform, anti-malware scan, vulnerability assessment and dynamic analysis for containers.

As applications rapidly migrate to the Cloud, security teams are being flooded with alerts. These teams are struggling to detect and prioritize risks through Cloud providers’ native security controls, especially in multi-cloud environments. Furthermore, security teams are hard-pressed to find solutions that meet their budgetary restrictions.

To answer this need, AlgoSec will offer the Prevasio solution at aggressive pricing to new customers, as well as the existing 1,800 blue chip enterprise organizations they currently serve, allowing them to reduce their cloud security costs.

Prevasio’s user-friendly, cost-effective SaaS solution is designed for hardening security posture across all cloud assets, including containers. The solution provides increased visibility into security issues and compliance gaps, enabling the cloud operations and security teams to prioritize risks and comply with CIS benchmarks.

Prevasio customers have successfully reduced administration time and achieved operational cost reductions, even across small teams, within days of operationalization.

Leveraging patented technology developed by Stanford Research Institute International® (SRI), one of the world’s largest research institutes and the developer of SIRI and many other leading technologies, Prevasio’s key capabilities include:

*   Analysis of all assets across AWS, Azure, and Google Cloud, offering a unified view in a single pane of glass
*   Prioritized risk according to CIS benchmarks, HIPPA and PCI regulations
*   Blazing fast static- and dynamic- agentless vulnerability scanning of containers
*   Assessment and detection of cybersecurity threats
*   Instantaneous connection to AWS, Azure, or Google Cloud accounts without installation or deployment

Furthermore, AlgoSec will incorporate SRI artificial intelligence (AI) capabilities into the Prevasio solution.

“Applications are the lifeblood of organizations. As such, our customers have an urgent need to effectively secure the connectivity of those applications across cloud and hybrid estates to avoid unpleasant surprises. With Prevasio, organizations can now confidently secure their cloud-native applications to increase organizational agility and harden security posture,” said Yuval Baron, AlgoSec CEO.

**About AlgoSec** 

AlgoSec, a global cybersecurity leader, empowers organizations to secure application connectivity by automating connectivity flows and security policy, anywhere.  The AlgoSec platform enables the world’s most complex organizations to gain visibility, reduce risk, achieve compliance at the application-level and process changes at zero-touch across the hybrid network. AlgoSec’s patented application-centric view of the hybrid network enables business owners, application owners, and information security professionals to talk the same language, so organizations can deliver business applications faster while achieving a heightened security posture.  Over 1,800 of the world’s leading organizations trust AlgoSec to help secure their most critical workloads across public cloud, private cloud, containers, and on-premises networks. 

**About Prevasio**

Prevasio, an AlgoSec company, helps organizations of all sizes protect their cloud-native applications across containers and all other cloud assets.

Prevasio’s agentless cloud-native application protection platform (CNAPP) provides increased visibility into security and compliance gaps, enabling the cloud operations and security teams to prioritize risks and ensure compliance with internet security benchmarks.

Acquired by AlgoSec in 2022, Prevasio combines cloud-native security with SRI International’s proprietary AI capabilities and AlgoSec’s expertise in securing 1,800 of the world’s most complex organizations.

AlgoSec Acquires Prevasio To Disrupt Agentless Cloud Security Market

Threat actors can weaponize code within AI technology to gain initial network access, move laterally, deploy malware, steal data, or even poison an organization's supply chain.

Threat actors can hijack machine learning (ML) models that power artificial intelligence (AI) to deploy malware and move laterally across enterprise networks, researchers have found. These models, which often are publicly available, serve as a new launchpad for a range of attacks that also can poison an organization's supply chain — and enterprises need to prepare.

Researchers from HiddenLayer's SAI Team have developed a proof-of-concept (POC) attack that demonstrates how a threat actor can use ML models — the decision-making system at the core of almost every modern AI-powered solution — to infiltrate enterprise networks, they revealed in a blog post published Dec. 6. The research is attributed to HiddenLayer's Tom Bonner, senior director of adversarial threat research; Marta Janus, principal adversarial threat researcher; and Eoin Wickens, senior adversarial threat researcher.

A recent report from CompTIA found that more than 86% of CEOs surveyed said their respective companies were using ML as a mainstream technology in 2021. Indeed, solutions as broad and varied as self-driving cars, robots, medical equipment, missile-guidance systems, chatbots, digital assistants, facial-recognition systems, and online recommendation systems rely on ML to function.  
Because of the complexity of deploying these models and the limited IT resources of most companies, organizations often use open source model-sharing repositories in their deployment of ML models, which is where the problem lies, the researchers said.  

"Such repositories often lack comprehensive security controls, which ultimately passes the risk on to the end user — and attackers are counting on it," they wrote in the post.

Anyone that uses pretrained machine learning models obtained from untrusted sources or public model repositories is potentially at risk from the type of attack researchers demonstrated, Marta Janus, principal adversarial ML researcher at HiddenLayer, tells Dark Reading. 

"Moreover, companies and individuals that rely on trusted third-party models can also be exposed to supply chain attacks, in which the supplied model has been hijacked," she says.

**An Advanced Attack Vector**

Researchers demonstrated how such an attack would work in a POC focused on the PyTorch open source framework, showing also how it could be broadened to target other popular ML libraries, such as TensorFlow, scikit-learn, and Keras. 

Specifically, researchers embedded a ransomware executable into the model's weights and biases using a technique akin to steganography; that is, they replaced the least significant bits of each float in one of the model's neural layers, Janus says.

Next, to decode the binary and execute it, the team used a flaw in PyTorch/pickle serialization format that allows for the loading of arbitrary Python modules and execute methods. They did this by injecting a a small Python script at the beginning of one of the model's files, preceded by an instruction for executing the scrip, Janus says.

"The script itself rebuilds the payload from the tensor and injects it into memory, without dropping it to the disk," she says. "The hijacked model is still functional and its accuracy is not visibly affected by any of these modifications."

The resulting weaponized model evades current detection from antivirus and endpoint detection and response (EDR) solutions while suffering only a very insignificant loss in efficacy, the researchers said. Indeed, the current, most popular anti-malware solutions provide little or no support in scanning for ML-based threats, they said.

In the demo, researchers deployed a 64-bit sample of the Quantum ransomware on a Windows 10 system, but noted that any bespoke payload can be distributed in this way and tailored to target different operating systems, such as Windows, Linux, and Mac, as well as other architectures, such as x86/64.

**The Risk for the Enterprise**

For an attacker to take advantage of ML models to target organizations, they first must obtain a copy of the model they want to hijack, which, in the case of publicly available models, is as simple as downloading it from a website or extracting it from an application using it. 

"In one of the possible scenarios, an attacker could gain access to a public model repository (such as Hugging Face or TensorFlow Hub) and replace a legitimate benign model with its Trojanized version that will execute the embedded ransomware," Janus explains. "For as long as the breach remains undetected, everyone who downloads the trojanized model and loads it on a local machine will get ransomed."

An attacker could also use this method to conduct a supply chain attack by hijacking a service provider’s supply chain to distribute a Trojanized model to all service subscribers, she adds. "The hijacked model could provide a foothold for further lateral movement and enable the adversaries to exfiltrate sensitive data or deploy further malware," Janus says.

The business implications for an enterprise vary, but can be severe, the researchers said. They range from initial compromise of a network and subsequent lateral movement to deployment of ransomware, spyware, or other types of malware. Attackers can steal data and intellectual property, launch denial-of-service attacks, or even, as mentioned, compromise an entire supply chain.

**Mitigations and Recommendations**

The research is a warning for any organization using pretrained ML models downloaded from the Internet or provided by a third party to treat them "just like any untrusted software," Janus says. 

Such models should be scanned for malicious code — although currently there are few products that offer this feature — as well as undergo thorough evaluation in a secure environment before being executed on a physical machine or put into production, she tells us.

Moreover, anyone who produces machine learning models should use secure storage formats — for example, formats that don’t allow for code execution — and cryptographically sign all their models so they cannot be tampered with without breaking the signature. 

"Cryptographic signing can assure model integrity in the same way as it does for software," Janus says.

Overall, the researchers said undertaking a security posture of understanding risk, addressing blind spots, and identifying areas of improvement in terms of any ML models deployed in an enterprise also can help mitigate an attack from this vector.

Machine Learning Models: A Dangerous New Attack Vector

The program, dubbed CryWiper, is aimed at Russian targets; it requests a ransom but has no way to decrypt any overwritten files.

Companies infected with purported ransomware may no longer have an option to pay a ransom.

A new malicious program acts exactly like crypto-ransomware — overwriting and renaming files, then dropping a text file with a ransom note and a Bitcoin address for payment — but the program instead deletes the contents of a victim's files. The program, CryWiper, currently targets Russian organizations but could easily be used against companies and organizations in other nations, according to cybersecurity firm Kaspersky, which analyzed the program.

The camouflaged wiper program continues a trend in ransomware being used — intentionally or inadvertently — as a wiper, the company's researchers stated in the analysis.

"In the past, we've seen some malware strains that became wipers by accident — due to mistakes of their creators who poorly implemented encryption algorithms," the researchers wrote. "However, this time it’s not the case: our experts are confident that the main goal of the attackers is not financial gain, but destroying data. The files are not really encrypted; instead, the Trojan overwrites them with pseudo-randomly generated data."

Malware that deletes critical data, referred to as wipers, have become a significant threat for both the private and the public sector. Wipers have been used by Russian agencies in the conflict with Ukraine in an attempt to disrupt the country's critical services and their defensive coordination. A decade ago, Iran used the Shamoon wiper program to encrypt and make useless more than 30,000 hard drives at rival nation Saudi Arabia's state-owned oil conglomerate, Saudi Aramco.

The latest attack targeted a Russian organization, the Kaspersky researchers stated in their analysis, suggesting that it could be retribution by Ukrainian forces or partisan hackers.

"Given the blanket cover that is used — pretending to be ransomware — and the limited time it takes to write a simple wiper, it seems like anyone can be behind this attack," Max Kersten, a malware researcher at cybersecurity firm Trellix. "Kaspersky indicates the victims are Russian, meaning anti-Russian activists, pro-Ukrainian activists, Ukraine as a state, or states supporting Ukraine, could be behind it, as I see it."

**Fake Ransomware or Lazy Criminals?**

CryWiper is the latest attack program that appears to be ransomware but actually acts as a wiper instead. While past examples often deleted data because of a developer error, CryWiper's creator intended its functionality, according to a translation of Kaspersky's Russian analysis.

"After examining a sample of malware, we found out that this Trojan, although it masquerades as a ransomware and extorts money from the victim for 'decrypting' data, does not actually encrypt, but purposefully destroys data in the affected system," Kaspersky stated. "Moreover, an analysis of the Trojan's program code showed that this was not a developer's mistake, but his original intention."

CryWiper is not the first ransomware program to overwrite data without allowing for its decryption. Another recently discovered program, W32/Filecoder.KY!tr, also overwrites files, but in this case, because of poor programming, the data cannot be recovered.

"The ransomware was not intentionally turned into a wiper. Instead, the lack of quality assurance led to a sample that did not work correctly," Fortinet researcher Gergely Revay stated in an analysis. "The problem with this flaw is that due to the design simplicity of the ransomware if the program crashes — or is even closed — there is no way to recover the encrypted files."

**Similarities to Previous Ransomware**

CryWiper appears to be an original piece of malware, but the destructive malware uses the same pseudo-random number generator (PRNG) algorithm as IsaacWiper, a program used to attack public-sector organizations in Ukraine, while CryWiper appears to have attacked a group in the Russian Federation, Kaspersky stated the Russian analysis.

Several variants of the Xorist ransomware family and the Trojan-Ransom.MSIL.Agent family used the same email address in the note left behind by the CryWiper following its corruption of data, but Trellix's Kersten believes that could have intended to cause confusion.

"The re-use of the email address in the ransom note in different samples could be done to throw off analysts who are looking to connect the dots, or it could be an actual mistake," he says. "The latter, I think, is less likely as the malware's code contains some mistakes showing it hasn't been tested thoroughly, which makes me think the creator \[or creators\] were under the pressure of time."

In the past, companies targeted with ransomware have agonized over the decision of whether to pay ransomware groups to use backups and offline copies to recover from a crypto-ransomware event.

"CryWiper positions itself as a ransomware program, that is, it claims that the victim's files are encrypted and, if a ransom is paid, they can be restored. However, this is a hoax: in fact, the data is destroyed and cannot be returned," Kaspersky stated. "The activity of CryWiper once again shows that the payment of the ransom does not guarantee the recovery of files."

Wiper, Disguised as Fake Ransomware, Targets Russian Orgs

Twitter alternative Hive Social took down its servers after researchers discovered several critical vulnerabilities.

Social media users looking for an alternative to Elon Musk's Twitter should probably avoid Hive Social, according to a team of cybersecurity experts who turned their attention to the platform after it hit more than a million users.

German researchers Zerforschung issued an all-out warning to avoid Hive Social.

"The issues we reported allow any attacker to access all data, including private posts, private messages, shared media and even deleted direct messages," the team wrote in its report. "This also includes private email addresses and phone numbers entered during login."

Zerforschung was also able to demonstrate how a threat actor could also alter other users' posts.

After reporting the issues to Hive Social on Nov. 26, Zerforschung wrote, the platform took down their servers for a few hours and relaunched with an updated version on Dec. 1.

Dark Reading reached out to Hive Social for comment, but has not yet received a response.

The Zerforschung team recommends Mastodon as a (somewhat) more secure social media alternative to Hive, along with Twitter.

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

Source

DARKReading