MITRE's new FiGHT framework describes adversary tactics and techniques used against 5G systems and networks.

The modernization of wireless technology is well underway with 5G deployments -- and so are the attacks. In response, MITRE, along with the Department of Defense, announced an adversarial threat model for 5G systems to help organizations assess the threats against their networks.

A "purpose-built model of observed adversary behaviors," FiGHT (5G Hierarchy of Threats) is a knowledge base of adversary tactics and techniques for 5G systems. The framework empowers organizations to "reliably assess the confidentiality, integrity, and availability of 5G networks, as well as the devices and applications using them," according to MITRE.

FiGHT is similar to MITRE ATT&CK, a knowledge base of adversary behaviors seen in attacks against the broader ecosystem. In fact, FiGHT is derived from ATT&CK, making FiGHT's tactics and techniques complementary to those described in ATT&CK. The FiGHT Matrix lists tactics used in attacks as columns, and some of the items listed are actually ATT&CK techniques or sub-techniques relevant for 5G.

Tactics and techniques are grouped across three categories: theoretical, proof-of-concept, and observed. At the moment, most of the techniques are categorized as either theoretical or proof-of-concept as the information is based on academic research and other publicly available documents. Just a minority of the techniques described in FiGHT are based on real-world observations, reflecting the fact that the number of 5G attacks are still relatively low.

Even though 5G has built-in security features, there still some risks and vulnerabilities to be aware of. 

"We identified an industry need for a structured understanding of 5G threats because even though 5G represents the most secure cellular standard to date, it can be implemented and deployed in ways that still have risks and vulnerabilities," Dr. Charles Clancy, senior vice president and general manager of MITRE Labs, said in a statement.

During this year's RSA Conference, researchers from Deloitte & Touche described a potential avenue of attack targeting network slices, a fundamental part of 5G's architecture. Enterprises rolling out 5G LANs also need to consider that the new capabilities that come with these environments, such as cross-network roaming and cloud edge services, also increase that attack surface.

FiGHT can be used to conduct threat assessments, enable adversarial emulation, and identify gaps in security coverage. Security teams can also use FiGHT to determine which areas the organization should be investing in.

"FiGHT helps stakeholders assess where cyber investments should be made to achieve the highest impact as they build, configure, and deploy secure and resilient 5G systems," Clancy said.

MITRE's FiGHT Focuses on 5G Networks

Funding has been somewhat lower than last year, but investment remains healthy, analysts say, amid thirst for cloud security in particular.

The cybersecurity industry continues to remain largely unaffected by the uncertainty surrounding the rest of the economy.

Though funding activity this year is somewhat slower than in 2021 and market valuations of cybersecurity firms have taken a hit, mergers and acquisitions activity has remained strong through the year, as has investor interest in the sector.

So far in the third quarter, there have been multiple major transactions that, according to analysts, highlight the overall robustness of the sector amid broadening concerns of a recession.

**Robust M&A Activity**

Two of the biggest involved previously announced deals: In September, Google completed its planned acquisition of incident response firm Mandiant for $5.4 billion, and in August, private equity firm Thoma Bravo closed it $6.9 billion purchase of identity management vendor SailPoint.

That same month, Thoma Bravo announced plans to acquire Ping Identity for $2.8 billion in cash. The $28.50 per share that the private equity firm offered for Ping represented a 63% premium over the identity management vendor's closing share price on Aug. 2. Thoma Bravo will take Ping private once the deal is completed in the fourth quarter. 

Other examples of M&A activity in the third quarter include Devo's purchase of SOAR vendor LogicHub for an undisclosed amount, Volaris Group's acquisition of Hitachi ID Systems in September, Cerberus Sentinel's purchase of application security vendor CyberViking, and CrowdStrike's acquisition of Reposify last week.

M&A activity in the third quarter is consistent with activity in the previous two quarters. Data from Momentum Cyber shows there were a total of 148 cybersecurity M&A deals during the first half of 2022. Total M&A volume over the period was nearly $103 billion. Momentum Cyber identified eight M&A transactions during the first half of 2022 that topped $1 billion, including the SailPoint and Mandiant deals, and private equity firm KKR's $4 billion acquisition of Barracuda.

The most obvious trend of late has been the move by larger vendors to buy into the attack surface management (ASM) space, and more specifically external attack surface management (EASM), says Rik Turner, an analyst with Omdia.

"This has, of course, been underway for a while," he says, pointing to Palo Alto's purchase of Expanse in November 2020 and Microsoft picking up RiskIQ in July 2021. "But there has been something of an intensification of this tendency of late, with Tenable acquiring Bit Discovery in April, IBM buying Randori in June, and CrowdStrike picking up Reposify last week," Turner says.

There are numerous other EASM vendors, so there will be no shortage of acquisition targets for any other big players that want to get into this market, he says.

**Multiple Market Drivers**

Turner says one of the other trends driving the M&A activity is growing interest in proactive security technologies, as opposed to the focus on reactive detection and response of the past few years.

"The proactive wave posits not a replacement technology for the reactive ones, but rather complementary ones that seek to reduce a customer's overall attack surface before threat actors have even launched an attack," Turner says. "Unlike the extended detection and response (XDR) spectrum, proactive security doesn't have a single acronym or initialism yet that can capture the imagination of the market, though Omdia is tentatively proposing security posture management, or SPM." 

Examples of products that fall into this category include cloud-specific proactive technologies such as cloud security posture management (CSPM), SaaS security posture management (SSPM), and cloud permissions management (CPM). Breach and attack simulation technologies are other examples as are vulnerability management and patch management, Turner says.

Chris Stafford, a senior manager in West Monroe's M&A practice, sees another set of factors driving the financial activity in the cybersecurity space. According to Stafford, the big ones are accelerated cloud adoption, the shift to remote work, and the continuing talent shortage. 

 "Fundamentally, cybersecurity is a really durable sector from a growth and revenue perspective," Stafford says. "All companies across all sectors require cybersecurity tools and services. That is what is fundamentally driving growth in the industry."

**Funding & VC Interest Slow but Remain Healthy**

While M&A activity has maintained a robust pace through the year, funding activity has been somewhat lower than last year, as noted earlier. Data from analyst firm IT-Harvest shows that through Sept. 1, some 220 vendors received a total of $12.3 billion in direct funding from investors. 

"That is half of 2021's record $24 billion, but more than the previous year's $10 billion," says Richard Stiennon, chief research scientist at IT-Harvest, adding that just 33 companies received more than $100 million so far this year, compared with 69 in 2021. "I expect to see the industry finish the year at $15 billion total invested," Stiennon says.

Omdia's Turner says while venture capital funding overall appears to have dipped somewhat, there is still plenty of money available for projects that VC's find especially interesting. "I think they have gotten somewhat choosier than they were in 2021," Turner says.

IT-Harvest's analysis of funding activity so far this year showed that investors are pouring more money into the security analytics space — $2.6 billion — than any other segment. Stiennon points to the more than $500 million in total that Devo has raised so far and the massive $1-plus billion funding round that Securonix received in February as examples of investor interest in this segment.

Identity and network security were the next two most active categories, with $1.4 billion in funding in each. There is also a trend of investing in cloud analytics and general security operations center tools like XDR, and a resurgence in vulnerability management startups that are getting funding, Stiennon notes.

"In short, funding is extremely healthy. No surprise to me because venture funding is not like the stock market, where you invest on expectations of next quarter's results," he says. "Most VCs have a five-year horizon, and they can count on cybersecurity to still be a growing sector through an economic downturn."

Despite Recession Jitters, M&A Dominates a Robust Cybersecurity Market

Ukraine military intelligence says Russia is planning cyberattacks on the country's energy sector, as well as against allies including Poland and the Baltic states.

As protests against military conscription rage inside Russia, the country is planning to continue its offensive into Ukraine with cyberattacks on critical infrastructure. 

The Odessa Journal reported Ukrainian military intelligence has learned the first cyberattacks will soon be launched against the Ukrainian energy sector, informed by previous Russian cyberattacks on the country's electricity infrastructure in 2015 and 2016.  After energy supply operations are crippled by cyberattacks, the Russian military plans to ramp up missile strikes on those facilities to shut down the electrical service throughout the war-battered country. 

"The occupying command is convinced that this will slow down the offensive actions of the Ukrainian Defense Forces," the Odessa Journal added. 

Additional cyberattacks are being planned against Ukrainian allies Poland and the Baltic states, according to the report. 

**Russian Tactical Shift?** 

With increasing pressure to show military gains, Russian cyber threats are a potentially effective way to ramp up offensive measures without drawing military retaliation, according to John Hultquist, vice president of intelligence analysis at Mandiant said in response to the reports of anticipated cyberattacks. 

He added in the months since the occupation of Ukraine began, Russia hasn't been launching cyberattacks outside of Ukraine, indicating a potential shift in focus on cyberwarfare by the Kremlin. 

"Many of the disruptive and destructive cyberattacks we have seen thus far have been disrupted, isolated, or largely limited to Ukraine, where there is intense focus," Hultquist said. "With a few exceptions we have not seen the scaled, serious attacks we expected even before the war began."

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

Russia Planning Cyberattacks on Ukraine's Energy Grid

CTA now has 36 members headquartered in 11 countries who follow cyber activities across the world, showing cybersecurity industry members realize the value in collaboration.

**WASHINGTON, D.C., Sept. 26, 2022 —** Cyber Threat Alliance (CTA), a nonprofit organization working to improve the cybersecurity of the global digital ecosystem, is announcing a recent growth in membership that expands our reach to a total of 36 active members across the world.

We are pleased to announce our newest members include: Blueliv, Cloudbric, DataDome, Maltiverse, Red Piranha and Trellix. Several more are in the CTA membership onboarding process and we expect to announce those companies soon. CTA now has members headquartered in 11 countries and engaged in cyber activities across much of the world. CTA's global expansion in the midst of a global pandemic, geopolitical tension, and economic disruption reinforces the high value front-line cybersecurity companies perceive in coming together to share threat intelligence and data. As cyber threats continue to evolve in sophistication, leaders in the cybersecurity industry are realizing this strength in numbers and value in collaboration.

To date, CTA members have shared over 280 million observables along with associated context, averaging around 350-400K per day. The CTA Early Share program, where members share information such as blogs, research, threat reports and more, generally 24-72 hours before public posting, has surpassed 675 early shares. As one CTA member noted, “CTA has been the single most valuable sharing alliance that we have been a member of.”

“I'm excited to welcome these new members to the Cyber Threat Alliance,” said Michael Daniel, President and CEO of the Cyber Threat Alliance. “CTA's growth over the past two years clearly demonstrates CTA's value, because members have continued to join the Alliance despite the pandemic and other disruptions. These additions make CTA stronger and more effective by increasing our diversity, reach, and expertise. I am looking forward to working with the new members and continuing CTA's growth.”

CTA's members play a crucial role in cybersecurity protection and response across all continents and critical infrastructure sectors. Members actively share timely, actionable, contextualized and campaign-based intelligence to improve our collective defenses against cyber adversaries — improving the members' products and services to better protect their customers, as well as more systematically thwarting adversaries and strengthening the security of the broader digital ecosystem. Each additional organization that joins CTA generates new avenues of data, increasing the quality of intelligence from which members draw impactful and actionable insights to apply to their customer base.

**About the Cyber Threat Alliance**

CTA was founded by Check Point Software Technologies Ltd., Cisco, Fortinet, McAfee, Palo Alto Networks, and Symantec Enterprise Division of Broadcom. Membership also includes AT&T Alien Labs, Avast, Blueliv, Cloudbric, DataDome, Dragos, Juniper Networks, K7 Computing, Maltiverse, Morphisec, NEC Corporation, NETSCOUT, NTT, OneFirewall, Panda Security (WatchGuard), Rapid7, ReversingLabs, SANDS Lab, Scitum, SecureBrain (Hitachi), SecurityScorecard, SK shieldus, SonicWall, Sophos, TEHTRIS, Telefónica Tech, Trellix, and VMware.

CTA is the industry's first formally organized group of cybersecurity practitioners that work together in good faith to share threat information and improve global defenses against advanced cyber adversaries. CTA's mission is to facilitate the sharing of actionable intelligence and situational awareness about sophisticated cyber threats to improve its members' cyber defenses, more effectively disrupt malicious cyber actors around the world and raise the level of cybersecurity throughout the Internet and cyberspace. The alliance is continuing to grow on a global basis, enriching both the quantity and quality of the information that is being shared across the platform. CTA is actively recruiting additional regional players to enhance information sharing to enable a more secure future for all. For more information about CTA, please visit: https://www.cyberthreatalliance.org/.

SOURCE: Cyber Threat Alliance

Cyber Threat Alliance Extends Membership to 6+ Leading Cybersecurity Companies

Company unnecessarily collected consumers' personal data and failed to safeguard it, suit alleges, leading to two back-to-back data breaches.

OAKLAND, Calif., Sept. 23, 2022 /PRNewswire — Earlier this month, two Samsung users, Shelby Holtzclaw and Naeem Seirafi, fired a class action lawsuit at Samsung Electronics of America, accusing the company of unnecessarily collecting consumers' personal data and failing to safeguard it.

Represented by powerhouse public interest firm, Clarkson Law Firm, the Plaintiffs further allege that Samsung failed to take appropriate protective measures leading to two back-to-back data breaches. Samsung then exacerbated the problem, according to the lawsuit, by neglecting to inform consumers whose data may have been compromised. The 43-page complaint asserts that Samsung violated consumer protection laws in all 50 states.

According to the lawsuit, Samsung disabled functions and features of its electronics like TVs and printers unless consumers submitted personal identification data like their home address and date of birth. Samsung then stored, monitored, and sold that data without adequately securing it, despite having assured its customers that "security and privacy are at the core of what we do and what we think about every day." Samsung allegedly touted that it was "protecting users' security and privacy at all times" via "holistic" and "industry-leading security." However, the lawsuit claims the tech giant's deficient security measures led to two data breaches and distribution of consumers' private, personal information.

The first breach allegedly occurred in April 2022 when confidential data was accessed, stolen, and published online. Samsung reassured customers that the leak only included "some source code relating to the operation of Galaxy devices" which the Plaintiffs assert "minimized entirely the impact of this first data breach." A preventable second attack then occurred when personal identification data was allegedly stolen by an "unauthorized third party." According to the complaint, "It is believed that greater than half of Samsung's U.S. consumers had their \[personal identifiable information\] compromised in the breach."

The plaintiffs allege that Samsung consumers have been left vulnerable to phishing scams, identity theft, and dual-authentication scams, requiring them to spend time, energy, and money on extra security protocols like credit monitoring.

Holtzclaw and Seirafi are demanding that Samsung notify all consumers whose data was stolen, improve their security systems, and compensate victims for the financial harm they've sustained.

The case is pending in the United States Federal District Court for the Northern District of California, Case Number 3:22-cv-05176. Visit clarksonlawfirm.com for updates.

SOURCE: Clarkson Law Firm, PC

Samsung Fails Consumers in Preventable Back-to-Back Data Breaches, According to Federal Lawsuit

For white hats who play by the rules, here are several ethical tenets to consider.

Earlier this year when international cyber-gang Lapsus$ attacked major tech brands including Samsung, Microsoft, Nvidia and password manager Okta, an ethical line seemed to have been crossed for many cybercriminals.

Even by their murky standards, the extent of the breach, the disruption caused, and the profile of the businesses involved was just too much. So, the cybercrime community came together to punish Lapsus$ by leaking information on the group, a move that ultimately led to their arrest and breakup.

So maybe there's honor amongst thieves after all? Now, don't get me wrong; this isn't a pat on the back for cybercriminals, but it does indicate that at least some professional code is being followed.

Which raises a question for the wider law-abiding hacking community: Should we have our own ethical code of conduct? And if so, what might that look like?

**What Is Ethical Hacking?**

 First let's define ethical hacking. It is the process of assessing a computer system, network, infrastructure, or application with good intentions, to find vulnerabilities and security flaws that developers might have overlooked. Essentially, it's finding the weak spots before the bad guys do and alerting the organization, so it can avoid any big reputational or financial loss.

Ethical hacking requires, at a bare minimum, the knowledge and permission of the business or organization which is the subject of your attempted infiltration.

Here are five other guiding principles for activity to be considered ethical hacking.

**Hack To Secure**

An ethical and white-hat hacker coming to assess the security of any company will look for vulnerabilities, not only in the system but also in the reporting and information handling processes. The goal these hackers is to discover vulnerabilities, provide detailed insights, and make recommendations for building a secure environment. Ultimately, they're looking to make the organization more secure.

**Hack Responsibly**

Hackers must ensure they have permission, outlining clearly the extent of access the company is giving, as well as the scope of the work they are doing. This is very important. Target knowledge, and a clear scope, help prevent any accidental compromises and establish solid lines of communication if the hacker uncovers anything alarming. Responsibility, timely communication, and openness are vital ethical principles to abide by, and clearly distinguish a hacker from a cybercriminal and from the rest of the security team.

**Document Everything**

All good hackers keep detailed notes of everything they do during an assessment and log all command and tool output. First and foremost, this is to protect themselves. For example, if an issue occurs during a penetration test, the employer will look to the hacker first. Having a timestamped log of the activities performed, be it exploiting a system or scanning for malware, gives piece of mind to organizations by reminding them that hackers work with them, not against them.

Good notes uphold the ethical and legal side of things; they are also the basis of the report hackers will produce, even when there are no major findings. The notes will allow them to highlight the issues they have identified, the steps needed to reproduce the issues, and detailed suggestions on how to fix them.

**Keep Communications Active**

Open and timely communications should be clearly defined in the contract. Staying in communication throughout an assessment is key. Good practice is to always notify when assessments are running; a daily email with the assessment run times is vital.

While the hacker might not need to report all the vulnerabilities they find immediately to their client contact, they still should flag any critical, show-stopping flaw during an external penetration test. This could be an exploitable unauthenticated RCE or SQLi, a malicious code execution, or sensitive data disclosure vulnerability. When encountering these, hackers stop testing, issue a written vulnerability notification via email, and follow up with a phone call. This gives teams on the business side the chance to pause and fix the issue immediately if they choose. It's irresponsible to let a flaw of this magnitude go unflagged until the report is issued weeks later.

Hackers should keep their main points of contact aware of their progress and any major issues they discover as they proceed. This ensures everyone is aware of any issues ahead of the final report.

**Have a Hacker Mindset**

The term hacking was used even before information security grew in importance. It just means to use things in unintended ways. For this, hackers first seek to understand all the intended use cases of a system and take into consideration all its components.

Hackers must keep developing this mindset and never stop learning. This allows them to think both from a defensive and an offensive perspective and is useful when looking at something you have never experienced before. By creating best practices, understanding the target, and creating attack paths, a hacker can deliver amazing results.

Should Hacking Have a Code of Conduct?

YouTuber minutephysics explains how Shor's algorithm builds on existing formulae like Euclid's algorithm and Fourier transforms to leverage quantum superpositioning and break encryption.

The rise of quantum computing and its implications for current encryption standards are well known. But why exactly should quantum computers be especially adept at breaking encryption? The answer is a nifty bit of mathematical juggling called Shor's algorithm. The question that still leaves is: What is it that this algorithm does that causes quantum computers to be so much better at cracking encryption? In this video, YouTuber minutephysics explains it in his traditional whiteboard cartoon style.

"Quantum computation has the potential to make it super, super easy to access encrypted data — like having a lightsaber you can use to cut through any lock or barrier, no matter how strong," minutephysics says. "Shor's algorithm is that lightsaber."

According to the video, Shor's algorithm works off the understanding that for any pair of numbers, eventually multiplying one of them by itself will reach a factor of the other number plus or minus 1. Thus you take a guess at the first number and factor it out, adding and subtracting 1, until you arrive at the second number. That would unlock the encryption (specifically RSA here, but it works on some other types) because we would then have both factors.

One reason why this seemingly simple process relies on the development of powerful quantum computers is that finding the correct power to multiply the first number by in order to find a factor of the second number (N) ± 1 takes an enormous amount of tries. The encryption key is quite a long number and thus the power could be anything from 1 to millions. But brute force is not why quantum computers work so well here.

**The Superpowers of Superpositions**

Briefly, thanks to quantum superpositioning, a quantum computer can calculate many answers for a single input. However, the video says that you only get one answer output at a time, with probabilities attached. To solve that issue, the calculation is set up so that wrong answers interfere with each other so that only the correct answer (or at least a good guess) is likely to be output. That calculation, which focuses on finding the right power _p_, is Shor's algorithm.

It's all extremely mathemagical, involving an assist from Euclid's algorithm, as well as a quantum Fourier transform that turns a series of superpositions of superpositions into sine waves that either constructively (add to each other) or destructively interfere — i.e., cancel each other out. The video says that, essentially, you can rig it so that only 1/_p_ is saved, with all the other answers destructively interfered out of contention. Once you're there, it's a walk in the park to find _p_, which makes finding the two encryption factors a whole lot easier. Watch the whole video for more details, and to maybe feel a little smarter.

By the way, Peter Shor is still thriving, and if you're interested in a deep dive on how he broke the Internet, here's another video where the man himself explains how he figured out his eponymous masterpiece.

How Quantum Physics Leads to Decrypting Common Algorithms

Many enterprise applications are built outside of IT, but we still treat the platforms they're built with as point solutions.

We're used to thinking about securing software-as-a-service (SaaS) platforms and the cloud as two separate beasts. This separation stems from the way SaaS and the public cloud first emerged as small point solutions and an extension of the traditional data center, respectively. Today, due to the advent of low code, this separation is wrong, and it's holding us back from seeing what's right in front of our eyes. Low code makes SaaS platforms a part of the public cloud, a place where developers build multiple applications rather than consuming a single one: a cloud platform.

Failing to shift our mindset leads to where we are today, with those applications being left up for grabs with no security visibility. And to make matters worse, low-code applications are embedded right into platforms like Salesforce and Microsoft Dynamics, which we all use and that hold our most sensitive business data.

**How Did We Get Here?**

Origin stories are always interesting because they explain something fundamental about the way we perceive the hero of the story. While SaaS started as an extension of the corporate network, the public cloud started as an extension of the data center. Those very different starting points explain why securing SaaS started with shadow IT (protecting the perimeter) and securing the public cloud started with workload protection (lift-and-shift servers and their network/host agents). This also meant that different security teams were tasked with securing SaaS and the cloud, which of course led to a separation of tools, different threat modeling, and, most importantly, the formation of different security mindsets.

Both SaaS and the public cloud have drastically evolved from those early days. Public cloud vendors introduced ever more granular compute paradigms, gradually introducing infrastructure as a service (IaaS), platform as a service (PaaS), and serverless to help developers focus on the business problem at hand. They also built an entire ecosystem of ready-made solutions for complex yet common problems — identity, permissions, logging, configuration, and deployment, to name a few.

SaaS used to mean a point solution for a specific problem. Salesforce started as a CRM, ServiceNow as a ticketing system, and Office365 as email, spreadsheets, docs, and slides. (While this is more than one solution, these are very specific ones.) Contrast that with today: Salesforce Developers are building apps for just about any business need on top of the Salesforce Platform, ServiceNow low-code apps are handling just about anything from HR to health and finance processes, and Power Platform, Microsoft's low-code platform embedded into Office365, is being used by more than 20 million users across the industry to solve every business need, from productivity through procurement and COVID-related processes.

Clearly, these have become enterprise-grade application development platforms, not point solutions to specific business problems. Many developers today choose to build their applications on platform-provided abstractions, whether those are serverless functions on the public cloud or extendable building blocks on SaaS low-code platforms.

**The Introduction of Business Developers**

Comparing how SaaS platforms started and where they are now clearly shows how far these have come from their earlier versions. But there's still a major shift we haven't mentioned yet: the introduction of business developers.

SaaS low-code platforms draw their power from the data they maintain and their existing users. Those are both not limited to IT but rather skew heavily toward the business. Having access to both business data and business users means that SaaS is in the perfect position to tackle the most pressing issue many enterprises face today — digital transformation.

With a global shortage of developers and the difficulty of streamlining a business process with so many stakeholders, low-code platforms introduce a shortcut, letting the business users streamline their processes themselves without waiting for IT.

Low code is taking off with business users, so much so that in his 2019 Inspire keynote, Microsoft CEO Satya Nadella discussed the opportunity of low code to empower people and to create new white-collar jobs just like Excel did.

Just like the public cloud is an application development platform enabling developers to focus on their business logic, SaaS platforms have become application development platforms using low code to empower business users to become developers and address any business need.

SaaS is now focused on new types of developers addressing a whole range of unmet business needs with dedicated applications, creating a new type of cloud: the business cloud.

**Securing Low Code as an Extension of Cloud**

With the realization that some SaaS platforms are now application development platforms and an extension of the cloud, we should re-examine the responsibilities for securing those applications and bringing them under the security team's umbrella.

We should treat platforms like Salesforce, ServiceNow, and Office365 the same way we treat AWS, Azure, and GCP, where we focus on the applications that were built and are hosted in these application development platforms rather than treating the whole platform as a single application.

Shadow IT, for example, remains an issue with smaller and an ever-growing number of point-solution SaaS. But it doesn't make sense to treat any single platform mentioned above as a single app to discover and catalog. Instead, we should discover and catalog the applications built with those platforms — and there are tens of thousands of those. In most organizations, this enormous complexity is hidden behind a single line in an application inventory.

Applications built with SaaS low-code platforms should be examined with the same security rigor we use for those built on the cloud because, at the end of the day, an application is an application, no matter where it was built and hosted.

What does matter for the security of our business applications is the people, process, and tools that are involved in making, maintaining, and protecting those applications. For applications built in the cloud, we have professional developers, automated CI/CD processes, and various security tools from code scanning and dynamic analysis through runtime monitoring and prevention. For applications built on SaaS low-code platforms, we have some professional developers but also business users who are not security-savvy, with few to no deployment processes and no security controls or guarantees.

Thinking about low-code platforms as part of SaaS makes it difficult for us to see that a huge portion of our business applications are now being built by the business, outside of IT and outside of security control. To begin seeing the problem and figuring out our approach to it, we must shift our mindset to acknowledge low-code platforms as a part of the cloud and treat the applications on those platforms like we do any other application.

We're Thinking About SaaS the Wrong Way

Slack, Docker, Kubernetes, and other applications that allow developers to collaborate have become the latest vector for software supply chain attacks.

Developers are increasingly under attack through the tools that they use to collaborate and to produce code — such as Docker, Kubernetes, and Slack — as cybercriminals and nation-state actors aim to access the valuable software that developers work on every day.

For instance, an attacker claimed on Sept. 18 to have used stolen Slack credentials to access and copy more than 90 videos representing the early development of Grand Theft Auto 6, a popular game from Take-Two Interactive's Rockstar Games. And a week earlier, security firm Trend Micro discovered that attackers were systematically searching for and attempting to compromise misconfigured Docker containers.

Neither attack involved vulnerabilities in the software programs, but security missteps or misconfiguration are not uncommon on the part of developers, who often fail to take the care necessary to secure their attack surface area, says Mark Loveless, a staff security engineer at GitLab, a DevOps platform provider.

"A lot of developers don't think of themselves as targets because they are thinking that the finished code, the end result, is what attackers are going after," he says. "Developers often take security risks — such as setting up test environments at home or taking down all the security controls — so they can try out new things, with the intent of adding security later."

He adds, "Unfortunately, those habits become replicated and become culture."

Attacks against the software supply chain — and the developers who produce and deploy software — have grown quickly in the past two years. In 2021, for example, attacks that aimed to compromise developers' software — and the open source components widely used by developers — grew by 650%, according to the "2021 State of the "Software Supply Chain" report, published by software security firm Sonatype.

**Developer Pipelines & Collaboration in the Sights**

Overall, security experts maintain that the fast pace of continuous integration and continuous deployment environments (CI/CD) that form the foundations of DevOps-style approaches pose significant risks, because they are often overlooked when it comes to implementing hardened security.  

    

Slack, Teams, and Zoom top the synchronous tools used by professional developers. Source: StackOverflow

  
This affects a variety of tools used by developers in their efforts to create more efficient pipelines. Slack, for example, is the most popular synchronous collaboration tools in use among professional developers, with Microsoft Teams and Zoom coming in a close second and third, according to the 2022 StackOverflow Developer Survey. In addition, more than two-thirds of developers use Docker and another quarter use Kubernetes during development, the survey found.

Breaches of tools like Slack can be "nasty," because such tools often perform critical functions and usually only have perimeter defenses, Matthew Hodgson, CEO and cofounder of messaging-platform Element, said in a statement sent to Dark Reading.

"Slack is not end-to-end encrypted, so it’s like the attacker having access to the company’s entire body of knowledge," he said. "A real fox-in-the-henhouse situation."

**Beyond Misconfigs: Other Security Woes for Developers**

Cyberattackers, it should be noted, don't just probe for misconfigurations or lax security when it comes to going after developers. In 2021, for example, a threat group's access to Slack through the gray-market purchase of a login token led to a breach of game giant Electronic Arts, allowing the cybercriminals to copy nearly 800GB of source code and data from the firm. And a 2020 investigation into Docker images found that more than half of the latest builds have critical vulnerabilities that put any application or service based on the containers at risk.

Phishing and social engineering are also plagues in the sector. Just this week, developers using two DevOps services — CircleCI and GitHub — were targeted with phishing attacks. 

And, there is no evidence that the attackers targeting Rockstar Games exploited a vulnerability in Slack — only the claims of the purported attacker. Instead, social engineering was likely way to bypass security measures, a Slack spokesperson said in a statement.

"Enterprise-grade security across identity and device management, data protection, and information governance is built into every aspect of how users collaborate and get work done in Slack," the spokesperson said, adding: "These \[social engineering\] tactics are becoming increasingly common and sophisticated, and Slack recommends all customers practice strong security measures to guard their networks against social engineering attacks, including security awareness training."

**Slow Security Improvements, More Work to Do**

Developers have only slowly accepted security as application security professionals call for better controls, however. Many developers continue to leak "secrets" — including passwords and API keys — in code pushed to repositories. Thus, development teams should focus on not just protecting their code and preventing the importing of untrusted components but also ensuring that the critical capabilities of their pipelines are not compromised, GitLab's Loveless says.

"The whole zero-trust part, which is typically about identifying people and things like that, there also should be the same principles that should apply to your code," he says. "So don't trust the code; it has to be checked. Having people or processes in place that assumes the worst — I'm not going to trust it automatically — particularly when the code is doing something critical, like build a project."

In addition, many developers still do not use basic measures to strengthen authentication, such as using multifactor authentication (MFA). There are changes afoot, however. Increasingly, the various open source software package ecosystems have all started requiring that major projects adopt multifactor authentication.   

In terms of tools to focus on, Slack has gained attention because of the latest major breaches, but developers should strive for a baseline level of security control across all of their tools, Loveless says.

"There are ebbs and flows, but it is whatever works for the attackers," he says. "Speaking from my experience of wearing all kinds of hats of different colors, as an attacker, you look for the easiest way in, so if another way becomes easier, then you say, 'I will try that first.'"

GitLab has seen this follow-the-leader behavior in its own bug bounty programs, Loveless notes.

"We see when people send in bugs, all the sudden something — a new technique — will become popular, and a whole slew of submissions resulting from that technique will come in," he says. "They definitely come in waves."

App Developers Increasingly Targeted via Slack, DevOps Tools

The ongoing ad fraud campaign can be traced back to 2019, but recently expanded into the iOS ecosystem, researchers say.

The threat actors behind a newly discovered malicious advertising app operation have been active since at least 2019, but researchers tracking their evolution report the group has become more sophisticated, expanding beyond its previous Android-specific attacks into the iOS ecosystem.

The latest campaign, according to researchers with Human Security's Satori research team, included 80 Android Apps lurking in the Google Play store and, notably, 9 in the Apple App Store. All together, the team reported the malicious applications were downloaded at least 13 million times.

Once downloaded, the malicious applications spoof other apps to rack up digital ad views, play hidden ads the user couldn't see to gain fraudulent views, and even track legitimate ad clicks to hone the group's ability to fake them more convincingly later.

The research team, which flagged the apps for removal from the official stores, calls this latest iteration of the attack group Scylla. The earliest version of the group was called Poseidon, then Charybdis. Scylla is the third wave of attacks from the threat actors, the Human team explained in their report.

"Today's announcement of the disruption of Scylla — named after the granddaughter of Poseidon — reflects a new evolution from the threat actors behind the scheme," the Human team said about the find. "While the Poseidon and Charybdis operations centered wholly on Android apps, the Satori team has found evidence that Scylla additionally targets iOS apps and has expanded the attack to other parts of the digital advertising ecosystem."

Human Security worked with Google and Apple to remove the malicious applications and is continuing to work with advertising software development kit developers to mitigate the campaign's fallout.

"These tactics, combined with the obfuscation techniques first observed in the Charybdis operation, demonstrate the increased sophistication of the threat actors behind Scylla," the Human team added. "This is an _ongoing_ attack, and users should consult the list of apps in the report and consider removing them from all devices."

Source

DARKReading