As infrastructure has grown more complex, the need to effectively manage it has grown, too – particularly for applications and APIs.

With many businesses moving application and API infrastructure to the cloud, business environments have grown more complex in recent years. As a result, it has become harder for businesses to manage, operate, maintain, and protect that infrastructure.

Fortunately, a new crop of solutions analysts have dubbed the "distributed cloud" has been introduced to help customers reduce complexity and better protect their application and API infrastructure, regardless of whether it contains any combination of on-premises, private cloud, public cloud, multicloud, and hybrid environments.

What are some of the top use cases for customers that are in the market for these solutions? Here are seven use cases that I've seen come up repeatedly.

**1\. Visibility**

As was the case when most applications were deployed and hosted either on-premises or in what we now call a private cloud, visibility is a must in complex environments as well. Without proper logging, we are blind to the traffic traversing and hitting our applications and APIs. Without this visibility, we won't be able to properly monitor the environment for compliance violations, security issues, intrusions, abuse, fraud, and other issues. We also won't be able to investigate and analyze when we become aware of an issue, event, or incident.

Clearly we cannot allow ourselves to be in this state; thus, visibility is one of the top use cases for distributed cloud.

**2\. Automation**

Bots continues to be an issue for e-commerce businesses. Whether bots are looking to take over accounts, hoard inventory, open fake accounts, scrape prices, commit loyalty fraud, or otherwise, bots costs enterprises money.

Bots make online applications less appealing to end users, cause fraud losses, increase support costs, and tie up precious infrastructure resources and cycles. Businesses that transact online understand the value in being able to effectively mitigate the risk from malicious bots.

**3\. Fraud Prevention**

When famous bank robber Willie Sutton was asked why he robbed banks, he reportedly replied, "Because that's where the money is." Fraudsters know where the money is, and they pursue that money regardless of where applications and APIs are deployed. As such, the ability to detect and mitigate fraud in near real time is another use case that businesses often look for from this group of solutions.

**4\. Security Policy Portability**

In any environment, creating, implementing, and managing effective security policies is an important part of the overall security strategy. As infrastructure has grown more complex, effectively managing security policy across different environments has become significantly more difficult for businesses.

Businesses are looking for the ability to implement and enforce either a standard security policy across multiple complex environments or the appropriate security policy for each environment or type of environment. For this reason, security policy portability is another popular use case for distributed cloud solutions.

**5\. API Discovery**

Proper asset and infrastructure inventory remains as important as always, regardless of how complex the environment has become. This includes APIs, of course.

Knowing where our APIs are allows us to protect and monitor them. It also allows us to ensure that policies and procedures are being followed during the development life cycle. If we are unaware of APIs, we have absolutely no ability to safeguard them from attack. As you can imagine, businesses are often very interested in this particular use case.

**6\. Malicious User Detection**

Malicious users can be difficult to detect with standard security monitoring techniques. That's because they don't compromise or attack applications, but rather they misuse or abuse the business logic of those applications. This is much more difficult to detect and requires insight into the user layer and the way in which the user is interacting with the application.

Without this ability, malicious users can "go rogue" within applications and cause monetary loss for the business. This is obviously something that businesses are looking to avoid, which makes malicious user detection a favorite use case for distributed cloud.

**7\. Scalability**

It may seem too obvious to state explicitly, but most businesses are looking for easy and flexible deployments across multiple environments, regardless of how complex those environments have become in recent years. This allows companies to develop and deploy applications at the speed required by the competitive environment they operate within.

Customers are, appropriately, demanding, and a business' ability to keep up with the competition translates into real money. Thus it is not surprising that scalability is a top use case here.

**Finding Common Solutions**

As infrastructure has grown more diverse and complex, the need to effectively manage that infrastructure has grown as well. The distributed cloud addresses the needs of businesses, particularly around applications and APIs.

Not surprisingly, many businesses face similar challenges, and thus there are a number of common use cases that are seen repeatedly. By understanding these use cases, businesses can look for a solution that addresses many of them, thus reducing the need for multiple, overlapping technologies.

7 Use Cases for Distributed Cloud Environments

A model of continuous authentication and identification is needed to keep consumers safe.

The emergence of Web 3.0 came during a pivotal transformation for the world. Though we were told to stay home and limit face-to-face interactions during the COVID-19 pandemic, life had to keep moving. Business needed to proceed as usual, deals needed to be signed, and money still needed to be transferred. Web 3.0 is an opportunity for businesses to embrace a digital future that will make all of this easier.

Many more things can and are being done digitally compared with three years ago, and while the benefits are clear, new risks and challenges have emerged. With the transition to Web 3.0, the attack surface has also shifted to the largely unchecked customer journey. As a result, our information, money, and identity are more vulnerable than ever before.

**Trust Levels Have Risen****

Ten years ago, purchasing something online for $20 was a big deal, but today, we make large purchases online without a second thought. Our level of comfort has grown immensely over the years and will only continue to grow. We may have started off making small purchases, but now, high-value transactions like loans, money transfers, and insurance claims are all digital, which means there's much more at stake.

At a consumer level, platforms like Apple Pay and Amazon Pay have emerged, which infuse a sense of trust and security into online purchases. Still, when asked to enter our personal credit card information, many of us pause and consider the legitimacy of the site, vendor, etc. A system with the comfort level provided by platforms like Apple Pay doesn't yet exist for high-value business transactions. What's more, there is no system in place to confirm that a company is who it says it is. Or that a link is valid. Or that a real loan is being signed. The move to a digitized world happened so quickly that no one stopped to think about the fact that we need to make sure the process is legitimate. Without face-to-face interactions, how do we know what is real?

There's a reason phishing attacks have grown by 61% since 2021 and a reason bots are more prominent now than they were five years ago: Because attackers have identified an opportunity and seized it. As an industry, we are at an impasse because our solutions have focused on protecting endpoints. But we now need to secure complete digital processes and customer journeys. We need to consistently prove our identity. Solutions like multifactor authentication (MFA), biometrics, and token-based authentication do some of this today, but unfortunately, it's not enough. Almost every week we see stories of sophisticated business email compromise (BEC) scammers bypassing MFA, leveraging tactics like adversary-in-the-middle (AiTM) phishing attacks.

****It's Time for a New Model****

Organizations should examine their customer journeys and identify friction points. This will allow them to pinpoint instances throughout the journey that attackers could exploit. Most organizations have identified at least one of these instances and put protective measures in place. For example, before we can view our final bill, we get a text with a six-digit code we must enter before moving any further in the process. These are the right steps, but we must remember that a digital transaction isn't just a one-step process.

We're moving toward a model that requires continuous authentication and identification throughout these transactions. This model will look slightly different for each organization, but it ultimately will follow these five steps:

1.  Take an unknown identity and turn it into a known one. This should happen at the beginning of every process before any engagement or transaction occurs. Every party involved should prove their identity, whether it be via government-issued ID, biometrics, etc.
2.  Once identities are confirmed and verified, individualized credentials should be distributed to access the digital property — whether it be a website, app, electronic document, or virtual environment.
3.  Guide customers and consumers through multistep and high-assurance transactions over an interactive, secure virtual environment with various authentication methods.
4.  To execute and complete the transaction itself, the process needs to offer strong identity assurance, be equipped with capabilities like digital signature encryption, and comply with the most rigorous security standards and regulations.
5.  Many contracts must be stored and maintained as unique, original copies throughout their lifecycle in accordance with laws such as ESIGN, the Uniform Electronic Transactions Act (UETA), and Uniform Commercial Code (UCC) Article 9-105. To ensure the integrity of the document or transaction, you must preserve the chain of custody and capture the audit trail.

With a shift in the attack surface, security will need to be woven throughout the journey and throughout workflows, and it will need to be done seamlessly to avoid disrupting the digital experience that exists. As we move into the new year, I anticipate this will be a top priority for organizations and security companies alike, and proving identity and ensuring trust in digital processes will become the defining factor of success.

**

Web 3.0 Shifts Attack Surface and Highlights Need for Continuous Security

Security stands on the shoulders of giants. We take a moment to remember their contributions toward keeping people, data, and systems safe.

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

In Memoriam: Remembering Those Who Passed

Using command-and-control servers from the decade-old Andromeda malware, the group is installing reconnaissance tools and a backdoor on previously infected systems to target Ukrainian victims.

A hacking group — suspected to be the Russia-linked Turla Team — reregistered at least three old domains associated with the decade-old Andromeda malware, allowing the group to distribute its own reconnaissance and surveillance tools to Ukrainian targets.

Cybersecurity firm Mandiant stated in a Thursday advisory that Turla Team APT, also known by Mandiant's designation of UNC4210, took control of three domains that were part of Andromeda's defunct command-and-control (C2) infrastructure to reconnect to the compromised systems. The endgame was to distribute a reconnaissance utility known as Kopiluwak and a backdoor known as QuietCanary.

Andromeda, an off-the-shelf commercial malware program, dates back to at least 2013 and compromises systems through infected USB drives. Post-compromise, it connects to a list of domains, most of which have been taken offline.

There is no relationship between the Turla Team and the group behind Andromeda, making the co-opting of previous infected systems quite novel, says Tyler McLellan, senior principal analyst at Mandiant.

"Co-opting the Andromeda domains and using them to deliver malware to Andromeda victims is a new one," he says. "We've seen threat actors reregister another group's domains, but never observed a group deliver malware to victims of another."

The slow spread of Andromeda allows attackers to wrest control of infected systems for free.

"As older Andromeda malware continues to spread from compromised USB devices, these re-registered domains pose a risk as new threat actors can take control and deliver new malware to victims," Mandiant stated in the advisory. "This novel technique of claiming expired domains used by widely distributed, financially motivated malware can enable follow-on compromises at a wide array of entities."

While the hijacking of another group's infected assets is uncommon, it has happened in the past, with hackers fighting over compromised machines, stealing each other's systems, or using the same vulnerability to infect a system and overwrite a previous infection. In the early 2000s, for example, the MyDoom worm infected systems but left the compromised computers open to further attack, leading to a scramble between hackers looking to increase their stable of exploited systems.

Today, cybercriminals are more likely to compromise systems and then sell those infected machines, or credentials to access those systems, on underground forums and dark markets as part of the initial access broker subeconomy.

****A Slowly Moving Galaxy of Andromeda Infections****

The attack began in December 2021, when an infected USB drive was inserted into a system at a Ukrainian organization and an employee inadvertently clicked on the malicious link. The cyberattack infected the system with a version of Andromeda first seen in March 2013 by the antivirus scanning service VirusTotal, Mandiant stated.

Mandiant first detected the attack in September 2022. Turla is a Russian-based threat group, but it has targeted a wide variety of organizations in some 45 countries over nearly two decades, according to the MITRE ATT&CK page.

While there is no relationship between Turla and Andromeda, using the Andromeda malware to infect other systems has helped keep the Turla operation under the radar, says Tyler McLellan, senior principal analyst at Mandiant.

"Despite Andromeda being old and not likely operational today, we still see a lot of victims," he says. "As a user inserts a clean USB into an already infected system, that new USB can become infected and continue the spread."

****Carefully Selected Targets: A Very Specific Threat****

The attackers attempted to remain as stealthy as possible by profiling systems to determine the most interesting targets and then only attacking a handful of those systems. Mandiant only observed the Turla-controlled servers active for short periods of time, usually a few days, with weeks of downtime, the company stated.

"Mandiant identified several different hosts with beaconing Andromeda stager samples," the company stated in the advisory. "However, we only observed one case in which Turla-related malware was dropped in additional stages, suggesting a high level of specificity in choosing which victims received a follow-on payload."

The Turla Team operation underscores the importance of eliminating vectors of attack and responding to incidents, even if they appear to be low priority, McLellan says.

"Companies should pay attention to what USB's are in their environment and discourage employees from using them where possible," he says. "This incident should also raise concerns of what longer-term malware infections are in your environment, and could a threat actor co-opt that C2 infrastructure to gain access."

Russia-Linked Turla APT Sneakily Co-Opts Ancient Andromeda USB Infections

In what's become a pattern, the cybercriminal ring stole data, demanded payment, and posted personal information when ransom was denied.

Another month, another release of personal information stolen from a school system. This time, it's a group of 14 schools in the United Kingdom.

Once again, the perpetrator appears to be Vice Society, which is well known for targeting educational systems in the US. As the Cybersecurity and Infrastructure Security Agency (CISA) pointed out in a bulletin from Sept. 6, "K-12 institutions may be seen as particularly lucrative targets due to the amount of sensitive student data accessible through school systems or their managed service providers."

The UK hack may have turned up even more confidential information than the Los Angeles school system breach last year. As the BBC reported on Jan. 6, "One folder marked 'passports' contains passport scans for pupils and parents on school trips going back to 2011, whereas another marked 'contract' contains contractual offers made to staff alongside teaching documents on muscle contractions."

Some prominent school cyberattacks in the US include public school districts in Chicago, Baltimore, and Los Angeles. A new study from digital learning platform Clever claims that one in four schools experienced a cyber-incident over the past year, and according to a new report from security software vendor Emsisoft, at least 45 school districts and 44 higher learning institutions suffered ransomware attacks in 2022.

"Schools are an attractive target as they are typically data-rich and resource-poor," Karen Sorady, vice president of member engagement at the Center for Internet Security (CIS), told Michigan Live in November, after a K-12 school district in Jackson, Mich., was hit. "Without proper resources in terms of dedicated staffing and the necessary tools and training to protect against cyber-attacks, schools can be a soft target."

Many of the 14 schools hit by this latest leak are colleges and universities, but primary and secondary schools were also hit, according to the BBC's list.

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

Vice Society Releases Info Stolen From 14 UK Schools, Including Passport Scans

The macro issues shaping the threat landscape can help security pros reset their priorities and reformulate strategy.

As remote work grows, many organizations are managing a complex web of in-person, online, and hybrid work scenarios while also juggling cloud migration to support their diversified workforce. For CISOs, this has created a variety of new challenges.

Based on our conversations with security leaders, Microsoft has identified the top three focus areas that CISOs are prioritizing today so you can understand what steps your organization should take to guard against ongoing cybersecurity threats.

**1\. Rapidly Shifting Threat Landscape and Attack Vectors**

The new technologies required to facilitate stronger remote collaboration and productivity have opened up new vulnerabilities for cybercriminals to exploit. Based on a 2020 Microsoft study of CISOs, 55% of security leaders have detected an increase in phishing attacks since the beginning of the pandemic, and 88% say that phishing attacks have affected their organizations.

While news headlines are dominated by increasingly aggressive nation-state attacks and novel incidents like the Nobelium supply-chain attack, even advanced threat actors tend to focus on low-cost, high-value attacks of opportunity. Take the uptick in password-spray attacks, for example. While large-scale attacks like the above aren’t an everyday occurrence, it is still important for security teams to be prepared in the event of a breach.

A healthy cybersecurity posture often comes down to a careful balance between managing risk and strengthening cyber hygiene practices. Microsoft estimates that basic security hygiene like multifactor authentication (MFA), patching, and vulnerability management can protect against 98% of attacks.

**2\. Rise in Increasingly Complex Supply Chain Risks**

The global supply chain is also top-of-mind for CISOs, as many have been forced to expand their security perimeter outside of the security organization and IT. This focus makes sense given the 650% increase in supply-chain attacks from 2020 to 2021.

As security leaders continue outsourcing apps, infrastructure, and human capital, they’re also searching for more effective frameworks and tools to evaluate and mitigate their risk across suppliers. Traditional vetting methods can help reduce risk when choosing a new vendor, but they aren’t foolproof. Security teams also need a way to enforce compliance and mitigate risk in real time, not just during the selection process or a point-in-time review cycle.

One effective method for decreasing the impact of major supply chain attacks and improving the overall efficiency of supply chain operations is zero trust. Many security leaders rely on zero-trust principles, such as explicit verification, least privileged access, and assumed breach, to protect their supply chains and strengthen their cyber hygiene foundation. For example, attackers typically weaken the supply chain by exploiting gaps in explicit verification. They might target a highly privileged vendor account that isn’t protected with MFA or inject malicious code into a trusted application. Through zero trust, security teams can strengthen their verification methods and extend security policy requirements to third-party users, limit the impact of compromised resources, and increase threat detection and response times.

**3\. Creative Organizational Security Despite Talent Shortage**

Finally, CISOs are focused on finding and retaining top talent as a result of the industry’s workforce shortage. The number of unfilled cybersecurity jobs grew by 350%, from 1 million positions in 2013 to 3.5 million in 2021. However, there’s also a push to make security everyone’s job — regardless of their positions within the organization or their level of knowledge about cybersecurity best practices.

To start, development teams, system administrators, and even end users should be familiar with the security policies that are relevant to them. Likewise, some CISOs have said they are deputizing employees outside of the security team by boosting and enhancing end-user knowledge of security threats. Employees and end users alike should know how to recognize common phishing techniques and the signs of more subtle cyberattacks. IT teams should also be kept in the loop and briefed on current security strategies. Focusing on automation and other proactive workflow and task management strategies is another easy way for CISOs to maximize their impact. 

These three trends are only the tip of the iceberg when talking about where CISOs are prioritizing responsibilities; however, they paint a solid picture of the main concerns on their minds in today’s modern threat landscape. This is a great opportunity for organizations to reset and take a look at what they are prioritizing to determine whether they are properly protected. 

For more information on the latest cybersecurity threat trends, download the full "CISO Insider" report.

CISOs Are Focused on These 3 Trends. Are You?

The Automated Libra group is deploying all components of its campaign in an automated manner via containers, stealing free trial resources for cryptomining, but the threat could get larger.

More information has become available on "PurpleUrchin," a malicious campaign in which a threat group called Automated Libra is using DevOps and continuous integration/continuous deployment (CI/CD) practices to mine cryptocurrency on cloud platforms using free trial accounts.

The campaign began in August 2019 and has mainly targeted platforms such as GitHub, Heroku, and ToggleBox. Security vendor Sysdig first reported on the campaign last October. This week, Palo Alto Networks' Unit 42 threat hunting team provided fresh insight on the campaign based on a recent analysis of the threat group's activities — and noted that while cryptomining is the game now, the infrastructure could be used to deliver much worse threats down the road.

Unit 42's research showed that Automated Libra has so far created some 180,000 free trial accounts on various cloud platforms — substantially more than Sysdig had initially reported — using an automated container-based approach for spinning them up. At its peak last November, Automated Libra was creating between three and five new accounts on GitHub every minute. Sysdig previously had estimated that the coin-mining activity via free trial accounts was costing GitHub some $100,000 in lost revenue per user account.

**A Fully Containerized Operation**

Unit 42's analysis showed each individual component of PurpleUrchin's cryptomining operation — from user account creation to coin-mining and trading — shipped within a container and deployed in a highly automated manner. 

An initial container contains all the tools needed for automatic account creation. That container automatically creates new accounts on a targeted cloud provider's platform, while also pulling down tools for creating additional containers with cryptomining components for each of the user accounts.

These additional containers house the individual and unique containerized components of the larger operation, says William Gamazo, principal threat researcher for Unit 42 at Palo Alto Networks. For example, they include containers specific to the accounts created for each targeted cloud provider, containers created for system administration (like panel displays for monitoring the mining operation), and containers created for coin-miners themselves.

The threat actors have implemented each component in the architecture as a container, Gamazo says. "In some cases, the entire process starts with a single script," he notes. That script calls on a configuration file stored in DockerHub, GitHub, or BitBucket for its base operational guidelines, Gamazo tells Dark Reading.

"From here, the process becomes highly dynamic and modular, with the creation of a user account that pulls down a container that will start the mass container generation process — essentially a single container that builds all of the additional containers required to perform the mining operation."

The container functionality for initial account creation on GitHub also includes a feature that allows Automated Libra to bypass CAPTCHA images using relatively straightforward image analysis techniques. The CAPTCHA bypass technique basically reuses publicly available tools, though in some cases the threat actors did perform some custom processing.

"While we didn’t feel the actor was very sophisticated, they were very effective with this tactic," Gamazo notes.

**A DevOps Approach to Optimize Resource Utilization**

Unit 42 researchers assessed that Automated Libra had adopted the DevOps and CI/CD approaches to optimize its ability to utilize the limited resources available to them under the free trial programs that many cloud vendors offer. 

"We have not directly witnessed other threat actors performing these types of containerized operations," Gamazo says. "However, last year we saw DDoS attack implementations using containers as part of the deployment," he notes pointing to a pro-Ukrainian denial-of-service campaign that CrowdStrike reported on last May that involved compromised Docker honeypots.

To create user accounts for free trials, the threat actors likely used stolen or fake credit cards, Unit 42 said. In some cases, the attackers adopted what the security vendor described as a "play and run" approach where they used a cloud provider's resources for a certain period of time but then disappeared without paying the bill for those services. 

The largest unpaid balance that Unit 42 researchers were able to uncover during their research was just $190. But the unpaid balances in other fake accounts could have been much larger considering the scale and breadth of the PurpleUrchin cryptomining operation, they noted.

**Cryptomining Now; Much Worse Later?**

Cryptomining attacks — where a threat actor stealthily uses an organization's computing resources to mine for cryptocurrencies — have become extremely common in recent years. A study that Kaspersky conducted last year showed that threat actors mainly distribute malicious mining software via unpatched vulnerabilities. In 2022's third quarter, more than 15% of vulnerability exploits that Kaspersky analyzed involved cryptomining tools. In the same quarter, Kaspersky counted more than 150,000 new miner variants, or more than triple the number from 2021's third quarter.

Nathaniel Quist, manager of cloud threat intelligence at Unit 42, says that in the PurpleUrchin campaign, Automated Libra actors were using free or limited-use cloud services specifically for their CPU resources. But that doesn't mean that they couldn’t have used it for other purposes as well. The actors, for instance, could have used these resources to perform malicious operations targeting victim organizations such as scanning, brute-forcing accounts, or hosting malicious content.

"If this happened, the victim would have been targeted by attacks originating from the trusted cloud service providers where the actors were creating these accounts," he notes.

The key takeaway for enterprise organizations is that threat actors will increasingly use containers for malicious infrastructure deployment in coming years. "Trusted sources such as cloud providers, cloud storage services, and public services hosted on clouds will be leveraged for launching attacks and it will be prevalent and difficult to detect," he says.

PurpleUrchin Gang Embraces DevOps in Massive Cloud Malware Campaign

Security vulnerabilities plague automakers, and as vehicles become more connected, a more proactive stance on cybersecurity will be required — alongside regulations.

A range of automakers from Acura to Toyota are plagued by security vulnerabilities within their vehicles that could allow hackers to access personally identifiable information (PII), lock owners out of their vehicles, and even take over functions like starting and stopping the vehicle's engine.

According to a team of seven security researchers, whose efforts were detailed on Web application security specialist Sam Curry's blog, vulnerabilities across automakers' internal applications and systems allowed them in a proof-of-concept hack to send commands using only the VIN (vehicle identification number), which can be seen through the windshield outside the car.

In all, the team uncovered serious security issues from automakers such as BMW, Ferrari, Ford, Volvo, and many others, across Europe, Asia, and the United States. It also found issues at suppliers and telematics companies including Spireon, which develops GPS-based vehicle tracking solutions.

A BMW Group spokesperson tells Dark Reading that IT and data security have the "highest priority" for the company and that it is continuously monitoring its system landscape for possible vulnerabilities or security threats.

The spokesperson adds that the vulnerability mentioned in the report has been known since beginning of November, and has been processed according to BMW's "security standard operating procedures," e.g., its bug-bounty program.

"The relevant addressed vulnerability issues were closed within 24 hours and we have no indication of any data leaks," the spokesperson says. "No vehicle-related IT systems were affected nor compromised. No BMW Group customers or employee accounts were compromised."

This is only the latest security concern to come to light. In March, telemetry from industrial systems security firm Dragos spotted Emotet command-and-control servers communicating with several automotive manufacturer systems. The malware is commonly used as an initial infection vector to drop ransomware.

In December, at least three mobile apps tailored to allow drivers to remotely start or unlock their vehicles were found to have security vulnerabilities that could allow unauthenticated malicious types to do the same from afar.

**Automakers Slow to Recognize Growing Threat**

Even though security vulnerabilities have been an issue in the industry for some time (going back to Charlie Miller and Chris Valasek's infamous 2015 Jeep hack detailed at Black Hat USA), automakers have been slow to recognize the potential severity of the developments, says Gartner automotive industry analyst Pedro Pacheco.

He explains that as automakers transition into becoming software developers, they are struggling to address all points of that development cycle — including security.

"One very simple notion is if you're not good in software, you're probably not going to be very good in making that software safe," he says. "That is guaranteed."

From his perspective, automakers are also too complacent when it comes to addressing and patching security vulnerabilities right away.

"Automakers look at this in a more reactive way than a proactive way, basically saying we'll address the small number of customers affected and solve the issue and then everything goes back to normal," he says. "That's the way of thinking for many carmakers."

As automakers develop more complex ecosystems that connect customers with application stores and connect them with their smartphones and other connected devices, the stakes are raised.

"This is the reason why cybersecurity is going to become more and more of a pressing issue," he says. "The more the vehicle takes over driving, then of course the more chances there are that this can be used against the customer and against the automaker. It hasn't happened yet, but it could very well happen in the future."

John Bambenek, principal threat hunter at Netenrich, adds another problem is that as technology evolves, car manufacturers implement it into their vehicles before the technology is truly vetted.

"Web apps have their own security concerns distinct from that path of communication," he explains. "I don’t have to own the entire communication stack. I just need to find a soft spot and researchers continue to find them. The reality is that it’s all put together with defective duct tape and bailing wire — it always has been."

He points out that the more things are put online, the more it gives opportunities for criminals.

"In this case, I’m less concerned about cybercriminals and more for stalkers and their ilk," he says. "This opens a new genre of digital harassment, which may be hard to track and harder to prosecute. That’s where I think the real risk is."

**Mandating Automotive Security Through Regulations**

Help is on the way, however. Pacheco points to the adoption of UN Regulation No. 155, focused on mandating standards for automotive cybersecurity, which went into power in July and will be enforced in Japan and South Korea — a total of 60 countries will ultimately enforce this regulation.

"This is a new dawn for cybersecurity in the automotive industry, because from this point on, cybersecurity in the vehicle becomes a legal requirement," he says. "This is the reason many automakers have already spent a considerable amount of money and time building up new cybersecurity management systems in accordance with this regulation."

He explains that under the regulation, every three years, the cybersecurity management system from the automaker from a particular vehicle will have to be audited by authorities to assess whether it complies to the regulation or not.

"Now we will start seeing a lot more things happening in cybersecurity than in the past, because until 2022 it was a bit more casual," he says.

He advises automakers not to wait to revise their security every three years but rather to incrementally update and improve their security software.

"They need to keep raising the bar in terms of the performance of their cybersecurity management system," Pacheco says. "This means adding the best cybersecurity technology in terms of hardware and software into the vehicle and running an advanced vehicle security operations center."

**Automakers Must Change Their Approach**

Pacheco explains that the industry is reaching a tipping point when it comes to cyber safety — but that improving automotive security will require a cultural shift.

"In the end, it always starts with a mindset, meaning when you have a certain threat, it must first be perceived as a threat," he says. "This is what they need to start by doing."

This could include actions as simple as running a competition amongst white hat hackers to search for any vulnerabilities they can find in this vehicle.

"Above all, automakers must be very open towards addressing \[these\] vulnerabilities and cybersecurity issues," Pacheco says. "Unfortunately, what happens is several automakers have a culture of hiding these issues."

He cautions the industry is approaching a point where automakers have less and less margin to maneuver to wait for the problems to happen.

"If they don't take considerable steps towards improving cybersecurity, it will hurt them a lot in the future," he says.

From Ferrari to Ford, Cybersecurity Bugs Plague Automotive Safety

It's imperative we collaborate and partner to improve software security. This may require developing tools and standards that can enrich SBOMs and provide deeper analysis.

Many in our industry are weighing the benefits that software bills of materials (SBOMs) could possibly bring to software quality and security. I think SBOMs are needed to understand and assess risk in software because they should provide visibility into the software construction process for a given software system. At some level, SBOMs already exist for certain products and software systems; however, their application for evaluating quality and security as stipulated in Executive Order 14028, Improving the Nation's Cybersecurity and recent federal guidance by the US Office of Management and Budget, the National Institute of Standards and Technology, and the Cybersecurity Infrastructure and Security Agency is fairly new and unproven at scale.

**The Royce Bill That Never Passed****

Around 2013, SBOM legislation H.R.5793 – Cyber Supply Chain Management and Transparency Act (known as the Royce Bill) was introduced but never gained the momentum it needed to pass as a mandate, bill, or requirement. The industry did not then have the appetite for transparency to manage software supply chain risk.

The issues this legislation would have addressed are outlined in the Congressional Record – Extensions of Remarks. These issues have now been exacerbated given the overwhelming amount of complexity and growing size in modern software development, and the increasing rate of attacks against open source software. With the increasing consumption rate of open source software in modern software development, consumers must be aware of the technical debt in open source software projects that has accumulated over time to better manage software risk. The idea of more software complexity, larger software systems, and mounting technical debt does not bode well for the federal government's desire for software integrity and trustworthiness through the software supply chain.

The fact that the Royce Bill didn't pass can be seen as a missed opportunity to address the growing threats and risk in software security at the time. Almost a decade later, the industry is still struggling to figure out how to implement SBOMs and strike the right balance to make them useful and not a target for adversaries to exploit. This raises major concern in industry about whether SBOMs are ready for prime time given the skepticism regarding the current requirements outlined in federal guidance.

****SBOM Must Inform About Unknown Risk****

One of the challenges for SBOMs is advancing and understanding how risky software is determined. I use the term "risky" because all software has vulnerabilities, and the SBOM must be able to differentiate or provide context to the level of risk associated with a software component, whether in isolation or once it has been implemented and integrated into a software system. To simply say you can't use this software component because it has CVEs (common vulnerabilities and exposures) associated with it becomes moot because all software can have vulnerabilities. SBOMs must be able to succinctly qualify which CVEs are the most dangerous and exploitable given the context the software will be implemented and used — the component function (logging, encryption, access control, authorization), the environment, and whether it can be hardened to reduce a given attack surface. The way in which software components are integrated into a system matters because software components can be implemented poorly or incorrectly, exposing vulnerabilities in software systems.

Using CVEs to establish a security baseline for open source software consumption make sense; however, tallying a bunch of CVEs to determine what software is less risky or riskier only focuses on the "known knowns" (as shown in the figure below) and does very little to help organizations understand what weaknesses are lurking that may expose vulnerabilities and impact the overall hygiene of that software component (over a period of time). Furthermore, the current state of practice regarding SBOMs doesn't encourage software supply chainers to understand the defect proneness or attack proneness rates associated with software. This is important because some software components are highly targeted and require significant patching due to inherent technical debt, low code quality, and security issues that expose vulnerabilities. More patching means developers and engineering teams are spending less time on creating and delivering new features and functionality to customers.

Defect proneness refers to the likelihood that a software component will be defective after a software product is released. There are various socio-technical factors that contribute to defect proneness such as low code quality and design flaws. Attack proneness refers to the rate at which software components can be successfully exploited, or the likelihood that software components will contain exploitable weaknesses — bug, defect, or flaw — or vulnerabilities.

    

Source: Kevin Greene

SBOM solutions must give organizations visibility into potential risk for a given software component as shown in the figure above, helping organizations make informed decisions about which software components to use and which software components to avoid. For instance, advice in the National Security Agency (NSA) Cybersecurity Information Sheet encourages developers to avoid using software developed in C and C++ because those programming languages were not intended to enforce good memory management checks. It will be interesting to see how this advice will affect the software supply chain, mainly for embedded safety critical systems, and whether suppliers will turn to programming languages that are memory safe, such as Rust and Go.

****Go Deeper to Guide SBOM****

SBOMs are not going away, so it's imperative we all collaborate and partner to improve software security. This may require developing tools and standards that can enrich SBOMs and provide deeper analysis and insight about the characteristics of software that help inform about software risk. This will help organizations effectively evaluate and attest to software integrity, as well as other software assurance properties. Ultimately, it's important for software supply chainers to understand not just the risk associated with a given software component but the potential maintenance associated with using that software component over a period of time, given the challenges in industry to remediate vulnerabilities in software in a timely fashion. The use of defect and attack proneness rates could provide actionable intelligence that helps lower the consumption of risky software with poor hygiene, and guide software supply chainers in building software systems that are more resilient to cyberattacks. 

In theory, software components with high defect and attack proneness rates should be avoided to help stimulate and encourage the use of alternatives with better hygiene. In my opinion, SBOMs don't improve code quality and security directly, but they can make software supply chainers more aware of risk in their software construction process. Improving code quality and security for open source software requires a culture shift given that having many eyes does not make all bugs shallow.

**

Don't Be Blindsided by Software Bills of Materials

The role of artificial intelligence in cybersecurity is growing. A new AI model highlights the opportunities and challenges.

_Artificial intelligence (AI) has the potential to revolutionize many aspects of our lives, including how we approach cybersecurity. However, it also presents new risks and challenges that need to be carefully managed._

_One way that AI can be used in cybersecurity is through the development of intelligent systems that can detect and respond to cyber threats._

This was the AI chatbot’s reply when I asked it to write about AI and cyber threats. I am sure by now you know I am talking about the most popular lad in town, ChatGPT.

In November 2022, OpenAI, an AI research and development company, introduced ChatGPT (Generative Pre-trained Transformer) based on a variation of its InstructGPT model, which is trained on a massive pool of data to answer queries. It interacts in a conversational way once given a detailed prompt, admits mistakes, and even rejects inappropriate requests. Though only available for beta testing right now, it has become extremely popular among the public. OpenAI plans to launch an advanced version, ChatGPT-4, in 2023.

ChatGPT is different from other AI models in the way it can write software in different languages, debug the code, explain a complex topic in multiple ways, prepare for an interview, or draft an essay. Similar to what one can do through Web searches to learn these topics, ChatGPT makes such tasks easier, even providing the final output.

The wave of AI tools and apps has been growing for some time. Before ChatGPT, we saw the Lensa AI app and Dall-E 2 making noise for digitally creating images from text. Though these apps have shown exceptional results that could be nice to use, the digital art community was not very happy that their work, which was used to train these models, is now being used against them as it raised major privacy and ethical concerns. Artists have found their work was used to train the model and now has been used by app users to create images without their consent.

**Pros and Cons**

As with any new technology, ChatGPT has its own benefits and challenges and will have a significant impact on the cybersecurity market.

AI is a promising technology to help develop advanced cybersecurity products. Many believe broader use of AI and machine learning are critical to identifying potential threats more quickly. ChatGPT could play a crucial role in detecting and responding to cyberattacks and improving communication within the organization during such times. It could also be used for bug bounty programs. But where there is the technology, they are cyber-risks, which must not be overlooked.

**Good or Bad Code**

ChatGPT will not write a malware code if asked to write one; it does have guardrails, such as security protocols to identify inappropriate requests.

But in the past few days, developers have tried various ways to bypass the protocols and succeeded to get the desired output. If a prompt is detailed enough to explain to the bot steps of writing the malware instead of a direct prompt, it will answer the prompt, effectively constructing malware on demand.

Considering there are already criminal groups offering malware-as-a-service, with the assistance of an AI program such as ChatGPT, it may soon become quicker and easier for attackers to launch cyberattacks with the help of AI-generated code. ChatGPT has given the power to even less experienced attackers to be able to write a more accurate malware code, which previously could only be done by experts.

**Business Email Compromise**

ChatGPT is excellent at replying to any content query, such as emails and essays. This is especially applicable when paired with an attack method called business email compromise, or BEC.

With BEC, attackers use a template to generate a deceptive email that tricks a recipient into providing the attacker with the information or asset they want.

Security tools are often employed to detect BEC attacks, but with the help of ChatGPT, attackers could potentially have unique content for each email generated for them with the help of AI, making these attacks harder to detect.

Similarly, writing phishing emails may become easier, without any of the typos or unique formats that today are often critical to differentiate these attacks from legitimate emails. The scary part is it’s possible can add as many variations to the prompt, such as "_making the email look urgent_," "_email with a high likelihood of recipients clicking on the link_," "_social engineering email requestion wire transfer_," and so on.

Below was my attempt to see how ChatGPT would reply to my prompt, and it returned results that were surprisingly good.

    

**Where Do We Go From Here?**

ChatGPT tool is transformational in many cybersecurity scenarios if put to good use.

From my experience researching with the tool and from what the public is posting online, ChatGPT is proving to be accurate with most detailed requests, but it still is not as accurate as a human. The more prompts used, the more the model trains itself.

It will be interesting to see what potential uses, positive and negative, come with ChatGPT. One thing is for sure: The industry cannot merely wait and watch if it creates a security problem. Threats from AI are not a new problem it has been around, it's just that now ChatGPT is showing distinct examples that look scary. We expect the security vendors will be more proactive to implement behavioral AI-based tools to detect these AI-generated attacks.

Source

DARKReading