AI will help enterprises scale cybersecurity defenses to handle the growing complexity of modern networks and increased number of cyberthreats.

Shortly after Zscaler acquired TrustPath, (where I was the CEO and co-founder), I was out on a hike with a non-technical business friend. During the hike, my friend asked, “I know what AI can do for self-driving cars, but what can it do for the cybersecurity industry?”

For the next 20 minutes, I explained the fine details of why AI was needed in cybersecurity and how more companies should be leveraging it, but it didn’t resonate with my friend. I didn’t get that “ah-ha” moment that I was looking for, which told me I didn’t do a very good job explaining it to someone who wasn’t very technical. I likely lost my friend five minutes into the conversation.

When I got back to my work desk, I thought to myself, “_How can I better answer this next time, in a way that’s simple and easy to digest?_” I can talk day and night about AI because it’s what I’m passionate about. AI has shaped my career. So why didn’t it click this time?

For months, this question bothered me. Nearly every day, I thought about why AI is needed in cybersecurity. I drafted different elevator pitches on how the future of cybersecurity relies upon AI. Then it clicked with one word: scale.

**The Upcoming "Scale" Challenge**

Scale can mean so many things in a technology stack and can mean so many things in the cybersecurity world too.

Customers want a well-designed security architecture that can scale linearly and beautifully along with the capacity needed.The cyber industry has made a lot of good progress on this front in the last decade with the adoption of the cloud-native architecture.

However, the sophistication level and the elusive nature of modern cybersecurity threats have been increasing non-linearly, and the cybersecurity industry is facing a much higher “scale” challenge in the coming decade.

To my hiking friend, I should have talked about scale, because only AI and machine learning technology will be able to help the cyber industry meet the super-high scale challenge. Only AI and machine learning can cope with the exponential growth of cyberthreats and the order of magnitudes of higher scale requirements of the cyber world.

Gone are the days we could throw in cybersecurity professionals into reverse engineering, configuration management, and responding to alerts. Cyberthreats are so rampant that CISOs worldwide would love to have hundred more of the resources they currently have, but unfortunately, will never get.

**How AI Addresses Scale**

AI can help the cybersecurity industry deal with the scale challenge because AI technology is the force multiplier for cybersecurity professionals in two major areas.

**1\. The policy area.** The current policy scale is at a human scale and at a very coarse granularity. The enterprise users that belong to the same department often have the same static policy.

For the enterprise to have zero-trust security, they not only need a zero-trust architecture but also a zero-trust digital assistant to help them do the proper configurations. If a business wants to do granular, dynamic, and contextual zero-trust configurations in a shop with 10,000 users and 10,000 applications, you can’t simply hire 200 people and have them work 24/7. Instead, AI can make appropriate recommendations automatically so that humans only need to do the confirmation.

**2\. The threat area.** The conventional threat detection method is reasonably effective, yet at the same time, the bad guys have increased their rate of making variations of threats by several orders of magnitude. They also have become much more elusive. In order to detect such a large quantity of elusive threats, one needs a very large army as a starting point.

We are familiar with the elusive nature of the Solar Winds supply chain attack that impacted major companies like Microsoft, Cisco, and government agencies like the U.S. Department of the Treasury and the U.S. Department of State back in 2019. This threat could potentially have been discovered months earlier, had the industry had hundred times the amount security professionals monitoring various metrics, but it’s unrealistic to expect to have that many resources readily available. However, AI has the potential to uncover this type of stealthy threat by combining the power of data with the power of data science and domain knowledge.

Cloud-native security helped to deliver the scale requirements for the cyber industry in the last decade. Similarly, AI-native security will help to deliver the next phase of the scale requirement for the cyber world.

How AI Can Deliver the Next Phase of Scalability

Organizations should update to the latest encryption (version 3.0.7) as soon as possible, but there's no need for Heartbleed-like panic, security experts say.

Security experts described two highly anticipated vulnerabilities that the OpenSSL Project team patched Tuesday as issues that need to be addressed quickly, but not necessarily meriting a drop-everything-else type of emergency response.

The release of version 3.0.7 of the almost ubiquitously used cryptographic library addresses two buffer overflow vulnerabilities, which exist in OpenSSL versions 3.0.0 to 3.0.6.

Leading up to the disclosure, security experts had warned that one of the issues, originally characterized as a "critical" remote code-execution issue, could present a Heartbleed-level, all-hands-on-deck problem. Thankfully, that doesn't seem to be the case — and in disclosing the flaw, the OpenSSL project team said it had decided to downgrade the threat to "high" based on feedback from organizations that had tested and analyzed the bug.

**A Pair of Buffer Overflows**

The first bug (CVE-2022-3602) could indeed — under a specific set of circumstances — enable RCE, which originally led some security experts to worry that the flaw could have industry-wide repercussions. But it turns out that there are mitigating circumstances: For one, it's difficult to exploit, as explained below. Also, not all systems are impacted.

Specifically, only browsers that support OpenSSL 3.0.0 through 3.0.6, such as Firefox and Internet Explorer, are impacted at this time, according to Mark Ellzey, senior security researcher at Censys; notably unaffected is Google Chrome, which is the leading Internet browser.

"The impact is expected to be minimal due to the complexity of the attack and the limitations in how it can be carried out," he says. "Organizations should brush up on their phishing training and keep an eye on threat intelligence sources to ensure they are prepared if they are targeted by an attack such as this."

To boot, Alex Ilgayev, lead security researcher at Cycode, noted that the flaw can't be exploited on certain Linux distributions; and, many modern OS platforms implement stack overflow protections to mitigate against threats like these in any event, Ilgayev says.

The second vulnerability (CVE-2022-3786), which was uncovered while a fix for the original flaw was being developed, could be used to trigger denial of service (DoS) conditions. The OpenSSL team assessed the vulnerability as being of high severity but ruled out the possibility of it being used for RCE exploitation.

Both vulnerabilities are tied to a functionality called Punycode for encoding internationalized domain names.

"Users of OpenSSL 3.0.0 - 3.0.6 are encouraged to upgrade to 3.0.7 as soon as possible," the OpenSSL team said in a blog accompanying the bug disclosure and release of the new version of the cryptographic library. "If you obtain your copy of OpenSSL from your Operating System vendor or other third party then you should seek to obtain an updated version from them as soon as possible."

**Not Another Heartbleed**

The bug disclosure is sure to tamp down — for the moment, at least — the widespread concern sparked by the OpenSSL team's notification last week of its then-impending bug disclosure. The description of the first flaw as being "critical," in particular, had prompted several comparisons to 2014's "Heartbleed" bug — the only other bug in OpenSSL to earn a critical rating. That bug (CVE-2014-0160) impacted a wide swathe of the Internet and even now has not be fully addressed at many organizations.

"Heartbleed was exposed by default on any software that used a vulnerable version of OpenSSL, and it was very easily exploitable by attackers to see cryptographic keys and passwords stored in server memory," says Jonathan Knudsen, head of global research at Synopsys Cybersecurity Research Center. "The two vulnerabilities just reported in OpenSSL are serious but not of the same magnitude."

**OpenSSL Bugs Are Hard to Exploit...**

To exploit either of the new flaws, vulnerable servers would need to request client certificate authentication, which is not the norm, Knudsen says. And vulnerable clients would need to connect to a malicious server, which is a commonplace and defensible attack vector, he says.

"Nobody's hair should be on fire about these two vulnerabilities, but they are serious and should be handled with appropriate speed and diligence," he notes.

In a blog post, the SANS Internet Storm Center meanwhile described the OpenSSL update as fixing a buffer overrun during the certificate verification process. For an exploit to work, the certificate would need to contain a malicious Punycode-encoded name, and the vulnerability would be triggered only after the certificate chain is verified.

"An attacker first needs to be able to have a malicious certificate signed by a certificate authority the client trusts," SANS ISC noted. "This does not appear to be exploitable against servers. For servers, this may be exploitable if the server requests a certificate from the client."

Bottom line: The likelihood of exploitation is low since the vulnerability is complex to exploit, as is the flow and requirements to trigger it, Cycode's Ilgayev says. Plus, it affects a relatively small number of systems, compared to those using pre-3.0 versions of OpenSSL.

**...But Do Be Diligent**

At the same time, it is important to keep in mind that hard-to-exploit vulnerabilities have been exploited in the past, Ilgayev says, pointing to a zero-click exploit that the NSO Group developed for a vulnerability in iOS last year.

"\[Also\], like the OpenSSL team says, there is 'no way of knowing how every platform and compiler combination has arranged the buffers on the stack,' and therefore remote code execution may still be possible on some platforms," he cautions.

And indeed, Ellzey outlines one scenario for how attackers could exploit CVE-2022-3602, the flaw that OpenSSL team had originally assessed as critical.

"An attacker would host a malicious server and attempt to get victims to authenticate to it with an application vulnerable to OpenSSL v3.x, potentially through traditional phishing tactics," he says, although the scope is limited due to the exploit being predominantly client-side.

Vulnerabilities such as this highlight the importance of having a software bill of materials (SBOM) for every binary used, Ilgayev notes. "Looking at package managers is not enough as this library could be linked and compiled in various configurations that will affect the exploitability," he says.

The Sky Is Not Falling: Disclosed OpenSSL Bugs Are Serious but Not Critical

The retailer reported that an employee fell for a phishing scam, allowing malicious actors to access shared drives.

Bed Bath & Beyond is registering additional shares of stock, and tucked several paragraphs down in its Security and Exchange Commission (SEC) filing is an "additional disclosure" — confirming that the company was breached in October. 

The company said that one of its employees was tricked by a phishing scam and handed over access to their own hard drive as well as company shared drives. Besides the fact that the breach happened, the retailer offered few additional details, including how many people might be affected and what information was exposed.

"The Company is reviewing the accessed data to determine whether these drives contain any sensitive and/or personally identifiable information," the SEC filing said. "At this time, the Company has no reason to believe that any such sensitive or personally identifiable information was accessed or that this event would be likely to have a material impact on the Company."

Expect more details to emerge on this one.

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

Bed Bath & Beyond Discloses Data Breach to SEC

First in our series addressing the top 10 unanswered questions in security: What's going to replace EDR?

Endpoint detection and response (EDR) is a cybersecurity staple. The EDR market is still growing at an impressive rate, with a compound annual growth rate projected to exceed 20% through 2027. Additionally, EDR leaders CrowdStrike and SentinelOne's latest ARR growth rates are at 59% and 122%, respectively.

However, at the same time, security professionals are realizing that endpoint detection alone isn't enough. True end-to-end visibility requires accounting for all devices, servers, containers, cloud platforms, and network data flows. Incidents like the Black Basta ransomware attacks have made the point loud and clear that organizations need to be constantly watching what is happening on the network.

In addition to the limited scope of EDR visibility and protection, there are operational challenges. Tool sprawl and complexity make it difficult for EDR to scale and increase the chances of human error that can lead to security oversights.

Extended detection and response (XDR) and managed detection and response (MDR) are rapidly emerging as more holistic solutions for security-conscious organizations. XDR expands on the capabilities of EDR by providing visibility into other attack vectors on the corporate network, rapidly growing cloud resources, sensitive identities, and unmanaged data. XDR enables SOCs to detect, proactively hunt for threats, and contain sophisticated threats from a centralized user interface.

MDR — which involves a third party providing threat hunting, alert triaging, and incident response — is useful for organizations that don't have a dedicated security operations center (SOC) or sufficient in-house cybersecurity expertise. By providing XDR-like functionality while offloading the operational complexity, MDR platforms can help these organizations drastically improve their security posture quickly.

MDR and XDR both provide the holistic threat detection and response capabilities EDR lacks, and we can expect to see more and more organizations adopt MDR or XDR instead of EDR-only in the years to come. That's good news for key players in the XDR/MDR market, like Cisco, Microsoft, CrowdStrike, SentinelOne, and Cybereason.

**Beyond XDR**

What's even more interesting than the evolution from EDR to XDR/MDR is the general consolidation of functionality we're seeing with XDR/MDR and other security tooling. For example, by aggregating network security data, XDRs are effectively competing with existing security information and event management (SIEM) tools.

This "federated logging" trend, where the tool aggregating the data also analyzes it, is becoming more popular. That may be bad news for legacy SIEMs, but it is an opportunity for vendors that can get it right. Performing the aggregation and analysis of cloud, network, and endpoint data in a single platform, these next-gen tools are paving the way for life after EDR for what remains of this year and beyond.

Uptycs' unified XDR and CNAPP platform is a prime example and inspiration of where we can expect the XDR market to go. Windows, macOS, and Linux endpoints are just one piece of the puzzle. What used to take multiple discrete tools for EDR, cloud security posture management (CSPM), cloud infrastructure entitlement management (CIEM), asset management, and compliance can all be managed with one data model.

In the years to come, we can expect to see more vendors attempt to consolidate functionality into XDR-like tools and MDR services. While integrations aren't going away anytime soon, the solutions that do the best job of limiting tool sprawl without limiting functionality will be well-positioned to become market leaders in the mid-2020s.

Now That EDR Is Obvious, What Comes Next?

With the vast majority of business leaders expecting a recession in 2023, cybersecurity firms are bolstering their operations and cash flow by laying off workers.

Cybersecurity firms Snyk and Cybereason separately announced significant layoffs during the last week of October, cutting their workforces by 198 and 200 workers and representing 14% and 17% of their workforces, respectively.

The two companies are the latest cybersecurity vendors to join a growing list of more than three dozen firms to pare their workforces in the past six months, as the global economy continues to flash signs of a slowdown and possible recession. On Oct. 24, for example, Snyk CEO Peter McKay announced that, while the developer security firm continues to grow, the company "must operate even more efficiently in order for Snyk to effectively withstand the continued headwinds facing the global economy."

Cybereason CEO and co-founder Lior Div also claimed strong operations but stressed its need to move away from aggressive investments in research and development, sales, and marketing and instead focus on customer retention and innovating in its core market of extended detection and response (XDR).

"While we are making significant traction in these areas and our growth remains strong, we are seeing significant volatility in the global financial markets that require us to prioritize profitability over growth," he said in an Oct.26 blog post.

Snyk and Cybereason are not alone. In June, privacy and security firm OneTrust announced it would lay off 950 employees, or 25% of its workforce. In late May, cloud security firm Lacework announced it would layoff approximately 300 workers, or 20% of its head count. Last week, cybersecurity automation firm Forescout announced it would be cutting costs but did not release the specific number of layoffs, instead saying the company intended to "optimize our cost base to prepare for difficult economic times over the next period to ensure the future success."

In total, 32 cybersecurity firms have announced layoffs or restructuring since early May, according to layoff tracking site Layoffs.FYI, most citing the tightening market and need to protect the longevity of the business.

"While we do not have control of the environment around us, we do have a responsibility to control how we operate our business and make changes as needed to best position the company for continued and long-term success," Jay Parikh, CEO of Lacework, said in a May update. "We have adjusted our plan to increase our cash runway through to profitability and significantly strengthened our balance sheet so we can be more opportunistic around investment opportunities and weather uncertainty in the macro environment."

**Investments Become Scarcer**

Cybersecurity vendors' retrenchment is not without cause. The vast majority (83%) of companies expect to contend with a recession in 2023, and most of those businesses are taking steps to prepare, according to the "2023 State of IT" report. IT budgets will likely stagnate: While half of businesses (51%) expect to increase IT budgets in 2023, a significant portion of those increases are due to inflation, not expanding purchases and services, the report stated.

Investments are drying up as well, leaving startup companies more reliant on their actual cash flow to fuel future operations. Venture capital financing totaled $3.1 billion in the third quarter of 2022, down from $7.9 billion for the same quarter in 2021, according to cybersecurity-focused venture capital firm Momentum Cyber.

"It's at that point where investors can be much more scrutinizing with valuations, because if they feel like the whole economy is slowing down, they might not feel like they want to take that go-to-market risk," Eric McAlpine, managing partner at Momentum Cyber, said in the company's "Cybersecurity Market Review Q3 2022" report.

It should be said that not every company says layoffs are the result of economic realities. In August, for example, security software firm Malwarebytes reportedly sacked at least 125 employees, or about 14% of its global workforce, maintaining the company was not trying to achieve profitability but shifting to a different strategy. A month later, Malwarebytes announced a $100 million investment and a strategic shift to the managed detection and response (MDR) market.

Yet for the most part, companies appear to be hunkering down, cutting spending, and making sure they can survive as long as possible if market conditions worsen. Privacy and security firm OneTrust, for example, pointed to a potential poor economy as the reason for the paring of its workforce.

"My responsibility is to ensure OneTrust thrives and is positioned for sustained growth, and unfortunately, reducing our headcount and adapting to the capital markets sentiment is what is needed to keep us in our leadership position," Kabir Barday, the firm's CEO, said in a blog post. 

**Cybersecurity Jobs Still Strong**

While specific cybersecurity vendor companies are cutting workers, overall the job market for cyber pros continues to be strong — a good sign for those workers who have been laid off. Businesses continue to look for cybersecurity experts, with the workforce growing 6% to 1.34 million in North America over the past 12 months, according to (ISC)2, a cybersecurity professional organization.

And job listings for tech jobs in general on jobs site Indeed.com have climbed 49% above the pre-pandemic baseline as of Oct. 21.

Meanwhile, the continued shortfall in cybersecurity workers and the increasing adoption of cloud services will result in more organizations gaining their cybersecurity expertise delivered as a service. (ISC)2 expects greater adoption, especially by small businesses, that do not have the need or budget to fund a permanent on-site team.

"We have seen a greater demand for cybersecurity skills to defend, protect, and secure our trail of personal data as threats become increasingly complex and our digital footprint continues to grow," says Clar Rosso, CEO of (ISC)2, urging organizations to not drop their collective guard.

"As organizations navigate increased economic pressures, I encourage them to continue to prioritize their cybersecurity needs," Rosso says. "Bad actors and exploits will not go away if the economy worsens; in fact, one might argue the threat landscape worsens during challenging times."

Layoffs Mount as Cybersecurity Vendors Hunker Down

Ed-tech company Chegg is ordered by FTC to secure its systems after repeated breaches that exposed tens of millions of users' personal data.

The Chegg educational technology company has been ordered by the Federal Trade Commission to get its cybersecurity in order after four separate data breaches exposed the sensitive data of about 40 million customers and employees. 

The FTC accuses the company of failing to adhere to basic security measures like two-factor authentication, while also insecurely storing personal data in the cloud, failing to implement a security policy, and skipping employee training altogether. 

As a result of the FTC complaint, Chegg will now be required to limit data collection and delete old stored data, provide consumers with the option to delete data or opt out of collection, implement multifactor authentication, and develop a comprehensive information security program. 

“Chegg took shortcuts with millions of students' sensitive information," Samuel Levine, director of the FTC's Bureau of Consumer Protection, said in a statement about the action. "Today's order requires the company to strengthen security safeguards, offer consumers an easy way to delete their data, and limit information collection on the front end. The Commission will continue to act aggressively to protect personal data."

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

FTC Gives Chegg an 'F' for Careless Cybersecurity Impacting 40M Students

Retailers' new holiday jingle must hit cybersecurity high points to help survive the season. Forget Dasher and Dancer — add SAST and DAST to app testing; manage third-party risks; and use MFA along with training and proper authentication to secure credentials.

As the holidays creep around the corner, consumers and retailers aren't the only ones gearing up for the season. Cybercriminals are right on their tail. It's no secret that major consumer holidays — from Amazon Prime Day to the end-of-year holiday sprint — carry big targets for threat actors. Projections for this year's Black Friday shows online spending reaching $13 billion.

That's a lucrative opportunity for bad actors.

This year, retailers are already facing inflation, an impending recession, and looming data privacy legislation. They simply cannot afford a $4.35 million breach.

**Limited Security Ho-Ho-Ho This Year?**

Retailers must keep their security posture top of mind. That means implementing effective detection and response; finding vulnerabilities _before_ the retail change freezes occur that mark this time of year; managing third-party risks; and making sure employees get the training they need.

**Finding the Weakest Link Before the Mad Rush**

It's common for retailers to implement hard change freezes one to two months before the holiday rush through the second or third week of January. This prevents any major system changes (which affect consumer experiences) from being implemented during the busiest and most-important sales days of the year.

In the weeks leading up to the hard change freeze, developers are often trying to squeeze in one last change of code or infrastructure. This rush before the deadline can sometimes include errors, leaving unpatched and untested systems vulnerable to attacks. Cybercriminals are all too familiar with these hard change freeze seasons, and often time their attacks during this window.

Running static and dynamic application security tests (SAST and DAST) as part of regular app-testing programs are the best ways to identify vulnerabilities before annual code freezes. These two tests examine applications from different sides. SAST focuses on software flaws such as SQL injection, while DAST finds weaknesses that bad actors can exploit.

Retailers should focus testing on critical and high-traffic applications such as payment gateways, input fields, and even core Web codes.

**Keeping an Eye on Third-Party Vendors**

Earlier this year, auto manufacturer Toyota halted its production after a plastic and electronics supplier was hit with a cyberattack. The suspended production cost the company roughly 13,000 cars. While the loss of production might seem costly, it's a small price to pay compared with an actual breach.

This shows that third-party risk management (TPRM) remains an underserved area in security for many organizations and retailers must still prioritize TPRM and learn from the case study.

TPRM and vendor risk management questionnaires help assess the security posture of partnered organizations. Many enterprise-level surveys have up to 1,000 questions, but the primary areas that should be addressed are: information security, data center security, Web application security, infrastructure protection, and security controls and technology.

While retailers regularly run tests on their own code, which includes third-party integrations, it doesn't extend beyond the boundaries of their own networks. Retailers should require their vendors to run full code-penetration testing on a biannual basis and nightly testing when their partners update or change codes.

**Maintaining Security Trainings Despite the Revolving door of Talent**

Training is undoubtedly the hardest part for retailers. The Great Resignation has forced companies to re-evaluate their training and onboarding processes, with cybersecurity being a small component of it. However, 82% of breaches analyzed by Verizon's "Data Breach Investigations Report" involved a human element. This makes employee training more important than ever.

Established retailers likely have some sort of cybersecurity awareness program in place. But they can (and should) expand upon that. When cybersecurity teams identify gaps from penetration testing, they can share those findings with employees and explain how those vulnerabilities can be manipulated. This level of transparency helps employees understand their role in protecting the enterprise and consumers' data.

**Password Security Paramount**

And last, but definitely not least, in the employee program: passwords. Password security is still a core problem leading to or playing a key factor in a staggering amount of data breaches that occur today. Stolen credentials are one of the easiest ways for threat actors to gain access to information. Compromised credentials are the cause of 19% of data breaches (PDF). The sad part is 45% of consumers don't view password sharing as a serious issue. Retailers should reinforce the priority of good password hygiene, but just as important, they should be implementing multifactor authentication (MFA) everywhere and anywhere that it is possible.

Many retailers have already started holiday sales to get ahead of inflation and staffing concerns. But they mustn't forget about their security posture in this rush to the year's end. Organizations must make cybersecurity a priority as important as driving sales by incorporating SAST and DAST in their app testing; monitoring and managing third-party risks; and securing credentials through training and proper authentication using MFA.

How Retailers Can Stay Protected During the Most Wonderful Time of the Year

Come up with a clever caption, and our panel of experts will reward the winner with a $25 Amazon gift card.

They say a picture is worth 1,000 words. Well, we don't need that many — just a short, witty cybersecurity-related caption for the cartoon, above. We offer four convenient ways for you to submit your idea before the contest closes on Wednesday, Nov. 30, 2022. The winner will receive a $25 Amazon gift card.

*   Email _\[email protected\]_ with the subject line "The Edge November 2022 Toon."
*   Via social media: Twitter, Facebook, and LinkedIn.

**Last Month's Winner**

Congratulations to Pedro P., who specializes in remote monitoring and management systems. His caption for last's month "Mumbo, Dumbo" contest was voted the winner. A big thank you to all who submitted ideas.

    

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

Name That Edge Toon: Talk Turkey

Integrated OT solution streamlines the auditing of firewalls for misconfigurations and conflicting rules.

**CHICAGO & SAN CARLOS, Calif. —** **(BUSINESS WIRE) —** Network Perception, innovators of operational technology (OT) solutions that protect mission-critical assets, and Check Point Software Technologies Ltd., a leading provider of cyber security solutions globally, today announced the integration of security technologies, making it possible to ensure that OT firewall environments are properly configured and continuously verified for the protection of critical assets.

Check Point provides the security infrastructure while Network Perception’s NP-View platform protects critical assets by providing compliance verification, cybersecurity visibility and operational velocity, allowing for the continuous verification and visualization of the security posture. Network Perception NP-View uses the Check Point Security Management Restful API to import network device configurations, offline or continuously, to instantly visualize network architecture, identifying all points of network connectivity and the exposure of protected assets. The combined solution verifies access to ports and services across different trust zones to protect mission critical assets.

“Checking for firewall misconfigurations and conflicting rules sounds easy, but manual audits on dozens or hundreds of firewalls can take days or weeks of time - and one error or omission can expose your network to security vulnerabilities and risks,” said Robin Berthier, CEO of Network Perception. “Integrating with Check Point ensures that a security infrastructure is configured the best way possible, protecting networks from the latest threats.”

“Network Perception’s platform takes essential auditing technology and makes it continuous for proactive OT network security that builds cyber resiliency,” said Jason Min, Head of Business Development at Check Point Software Technologies. “By integrating our technologies, our joint solution allows for a fully consolidated cyber security architecture that protects business and OT infrastructure against sophisticated cyber-attacks across networks, endpoint, cloud and mobile.”

For more information on the integration between Network Perception NP-View and Check Point, please view this short video: https://www.youtube.com/watch?v=rZfHHmWAmEw

**About Network Perception**

Network Perception proactively protects industrial control systems by ensuring network access security as the first line of perimeter defense. Our monitoring software provides complete network transparency and continuous mapping to better support cybersecurity compliance and enable greater cyber resiliency. For more information, visit www.network-perception.com.

Network Perception and Check Point Software Technologies Partner to Tighten the Security of OT Firewall Environments

The sophisticated and ever-evolving threat known as LodeInfo is being deployed against media, diplomatic, government, public sector, and think-tank targets.

Chinese-speaking threat actor APT10 has been using a sophisticated and sometimes fileless backdoor to target media, diplomatic, governmental, public sector, and think-tank targets, since at least March, researchers have found.

Researchers at Kaspersky have been tracking the LodeInfo malware family since 2019, they said in one of two blog posts  published Monday that lay out a two-part investigation on the emerging threat. The group is bent on espionage, primarily against Japanese targets to date.

However, as threat actors are constantly updating and modifying LodeInfo — particularly with anti-detection features and varying infection vectors — it's been difficult to stay on top of its use and deployment, the researchers said.

"LodeInfo and its infection methods have been constantly updated and improved to become a more sophisticated cyber-espionage tool while targeting organizations in Japan," the researchers wrote in one of their posts. "The LodeInfo implants and loader modules were also continuously updated to evade security products and complicate manual analysis by security researchers."

JPCERT/C first named LodeInfo in a blog post in February 2020, when it was the payload in a spear-phishing campaign targeting Japan, according to Kaspersky. The following year, Kaspersky researchers also shared new findings during the HITCON 2021 conference that covered LodeInfo activities from 2019 to 2020. At the time they attributed the malware to APT10 — also known as the "Cicada" group — with "high confidence," the researchers said.

Kaspersky's latest intelligence on LodeInfo in the first half of their report focuses on their identification of current versions of the malware — in which researchers detected v0.6.6 and v0.6.7 — and their various infection methods tracked between March and September in use against targets in Japan. The second part unveils an investigation of new versions of LodeInfo shellcode — including v0.5.9, v0.6.2, v0.6.3 and v0.6.5 — identified in March, April, and June, respectively, the researchers said.

**Varied Infections Methods**

Researchers outlined four different infection methods that threat actors are using to get the LodeInfo backdoor on victim systems.

The first, identified in March and used in previous attacks observed by Kaspersky, started with a spear-phishing email that included a malicious attachment installing malware persistence modules, the researchers said. These modules were comprised of a legitimate EXE file from the K7Security Suite software used for DLL sideloading, as well as a malicious DLL file loaded via the DLL sideloading technique.

The malicious DLL file includes a loader for the LodeInfo shellcode that contains a 1-byte XOR-encrypted LodeInfo shellcode internally identified by version 0.5.9, the researchers said.

Another infection method uses a self-extracting archive (SFX) file in RAR format that contains three files with self-extracting script commands. When a targeted user executes this SFX file, the archive drops other files opens a .docx containing just a few Japanese words as a decoy, the researchers said.

While this decoy file is being shown to the user, archive script executes a malicious DLL via DLL sideloading that start a process that eventually deploys LodeInfo v0.6.3, they said.

A third infection vector uses another SFX file, first seen spread via a spear-phishing campaign in June, that exploits the name of a well-known Japanese politician and uses self-extracting script and files similar to the previous vector. This initial infection method also includes an additional file that decrypts shellcode for the LodeInfo v0.6.3 backdoor, the researchers said.

"The file name and the decoy document suggest the target was the Japanese ruling party or a related organization," they explained, adding that they observed another SFX file with a similar method and payload on July 4.

The fourth infection vector that researchers outlined was observed in June and appears to be a brand-new method that threat actors added this year, they said. This vector uses a fileless downloader shellcode — dubbed "DOWNIISSA" by the researchers — delivered by a password-protected Microsoft Word file. The file includes malicious macro code completely different from previously investigated samples of LodeInfo, the researchers said.

"Unlike past samples … where the malicious VBA macro was used to drop different components of the DLL sideloading technique, in this case the malicious macro code injects and loads an embedded shellcode in the memory of the WINWORD.exe process directly," they explained. "This implant was not present in past activities, and the shellcode is also a newly discovered multi-stage downloader shellcode for LodeInfo v0.6.5."

**Advanced Evasion Tactics**

Kaspersky researchers also outlined the various advanced evasion tactics displayed in new versions of the malware's shellcode, demonstrating how threat actors are evolving the malware to increase the chances they won't be caught, the researchers said.

"These modifications may serve as a confirmation that the threat actors track publications by security researchers and learn how to update their TTPs \[tactics, techniques, and procedures\] and improve their malware," they wrote.

For example, the LodeInfo v0.5.6 shellcode demonstrates several enhanced evasion techniques for certain security products, as well as three new backdoor commands implemented by the developer, researchers said.

It also contains a hardcoded key, NV4HDOeOVyL, used later by an antiquated Vigenere cipher, and it generates random junk data "possibly to evade beaconing detection based on packet size," they noted.

Another shellcode, in LodeInfo v0.5.6, uses revised crypto-algorithms and backdoor command identifiers — obfuscated with a 2-byte XOR operation that that was defined as 4-byte hardcoded values in previous LodeInfo shellcodes, the researchers said.

"We also observed the actor implementing new backdoor commands such as 'comc,' 'autorun,' and 'config' in LodeInfo v0.5.6 and later versions," they explained. "Twenty-one backdoor commands, including three new commands, are embedded in the LodeInfo backdoor to control the victim host."

Other LodeInfo shellcodes, v0.6.2 and later versions specifically, include a curious geographic identifying feature that looks for the “en\_US” locale on the victim’s machine in a recursive function and halts execution if that locale is found, the researchers said, indicating that the threat actors are avoiding US targets.

Another core modification of the LodeInfo shellcode observed by Kaspersky was support for Intel 64-bit architecture, which expands the type of victim environments that threat actors can target, they said.

Overall, the updated TTPs and improvements in LodeInfo and related malware "indicate that the attacker is particularly focused on making detection, analysis, and investigation harder for security researchers," the researchers wrote.

Kaspersky shared various indicators of compromise in part two of its post on LodeInfo. The firm is encouraging other security researchers and the overall community in general to collaborate on identifying LodeInfo and related malware attacks in victim environments to prevent and mitigate further attacks.

Source

DARKReading