Ash Devata, Vice President & General Manager, Cisco Zero Trust and Duo Security, sits down with Dark Reading’sTerry Sweeney for a Fast Chat on the future of secure access.

Authentication used to be binary: I give you access or I don’t give you access. But with the rise of remote/hybrid work and the growing number of cloud applications in use, organizations need an even more precise approach to authentication, says Ash Devata, vice-president and general manager of Cisco Zero Trust and Duo Security.

“Every time you're giving access, you have to inspect the user \[and\] inspect the device,” Devata says. “End users just want to get their work done. They don't want to go through all the security checks.“

The security landscape has increased in complexity, with the rise of remote and hybrid work and the accelerated pace of cloud adoption. “The key thing is around, how do we make sure only the right people have access to the applications?” Devata says in his Fast Chat with Dark Reading’s Terry Sweeney.  

Devata also expands on the concept of post-login security. “You log into \[xbox.com\]. You just have the login cookie for six months,” Devata says, in reference to session cookies. So long as the cookies don’t expire, the session is valid and users don’t have to log back in again. However, the session cookie presupposes that nothing has changed to affect the security of the session. It could be the device needing new security updates, or the geographic location.

This is more than risk-based authentication, though. The idea behind continuous password access is to continuously measure all the signals – such as whether device encryption is turned on, if there are pending patches, if the firewall is enabled, and the network location -- completely in the backend, without adding friction to the user experience. Once a signal changes, details about what has changed is then communicated back to the application. Depending on the change, the user may be prompted to re-authenticate, even if the session hasn’t expired.

“Once we give trust, how long can the trust last?” Devata asks.

Cisco’s Ash Devata on the Future of Secure Access

Academic researchers are developing projects to apply artificial intelligence to detect and stop cyberattacks and keep critical infrastructure secure, thanks to grants from the C3.ai Digital Transformation Institute.

Editors' Choice

Jai Vijayan, Contributing Writer, Dark Reading

Kelly Jackson Higgins 2, Editor-in-Chief, Dark Reading

Nathan Eddy, Contributing Writer, Dark Reading

Joshua Bevitz, Partner, Newmeyer Dillion

Gabriella Stevens, Associate, Newmeyer Dillion

Prashant Sharma, Co-Founder & CTO, Secuvy Inc.

Webinars

*   Outsourcing Cybersecurity: A Decision Maker's Guide
*   Using Threat Modeling to Improve Enterprise Cyber Defenses
*   Vendors as Your Largest BEC Threat
*   Implementing Zero Trust in Your Enterprise
*   How Data Breaches Happen and What To Do When They Happen To You

White Papers

*   Understanding DNS Threats and How to Use DNS to Expand Your Cybersecurity Arsenal
*   5 Critical Cyber Range Exercises from the Experts
*   De-identifying Analytics Data with Skyflow
*   Securely Work From Anywhere With the Fortinet Security Fabric
*   Endpoint Detection Net Suite Use Cases

Events

*   Dark Reading Virtual Event - June 23 - Learn More
*   Black Hat USA - August 6-11 - Learn More

More Insights

White Papers

*   Understanding DNS Threats and How to Use DNS to Expand Your Cybersecurity Arsenal
*   5 Critical Cyber Range Exercises from the Experts

Webinars

*   Outsourcing Cybersecurity: A Decision Maker's Guide
*   Using Threat Modeling to Improve Enterprise Cyber Defenses

Reports

*   Incorporating a Prevention Mindset into Threat Detection and Response
*   Practical Network Security Approaches for a Multicloud, Hybrid IT World

7 Ways to Bring AI to Cybersecurity

A novel timing attack allows remote attackers with low privileges to infer sensitive information by observing power-throttling changes in the CPU.

A side-channel timing attack dubbed "Hertzbleed" by researchers could allow remote attackers to sniff out cryptographic keys for servers. It affects most Intel processors, as well as some chipsets from AMD and likely others.

The issue is a timing side-channel flaw (tracked as CVE-2022-24436 for Intel and CVE-2022-23823 for AMD) found in the CPU-throttling technology known as dynamic voltage and frequency scaling (DVFS). DVFS regulates power consumption and electrical current use so that a CPU doesn't overheat when processing large amounts of data, and it conserves battery power during low-activity times.

As Intel explains in guidance published this week, observing these regulation changes can allow attackers to infer sensitive information.

"CPU frequency throttling is triggered when one of these limits is reached, which results in CPU frequency," according to Intel. "This frequency change and derived behavior may be correlated with information being processed by the CPU, and it may be possible to infer parts of the information through sophisticated analysis of the frequency change behavior."

"In the worst case, these attacks can allow an attacker to extract cryptographic keys from remote servers that were previously believed to be secure," according to a technical research paper (PDF) by the team who discovered the attack, from the University of Texas at Austin, the University of Illinois Urbana-Champaign, and the University of Washington.

Hertzbleed – its name a take on the infamous "Heartbleed" timing attack from 2014 – is significant because it allows remote attacks without the need to subvert a power-measurement interface, the researchers note, thus widening the attack surface.

"Software-based power-analysis attacks can be mitigated and easily detected by blocking (or restricting \[10\]) access to power-measurement interfaces," according to the paper. "Up until today, such a mitigation strategy would effectively reduce the attack surface to physical power analysis, a significantly smaller threat."

**Actual Threat or Not?**

While the researchers acknowledge that any real-world attacks would require a high level of complexity, they demonstrated successful proofs of concept for extracting keys as remote attackers authenticated with low privileges and no user interaction requires. This makes "Hertzbleed is a real, and practical, threat to the security of cryptographic software," they say.

Intel begs to differ. 

"While this issue is interesting from a research perspective, we do not believe this attack to be practical outside of a lab environment," said Jerry Bryant, Intel's senior director of security communications and incident response, in a recent posting. "Also note that cryptographic implementations that are hardened against power side-channel attacks are not vulnerable to this issue."

However, he also explained that the issue may extend past Intel and AMD.

"CVE-2022-24436 is not architecture-specific and any modern CPU that has dynamic power and thermal management is potentially affected," he said. "Intel shared its findings with other silicon vendors so they could assess their potential impact."

Neither Intel nor AMD are issuing microcode to address the issue; instead, they recommend that developers achieve mitigation through masking and blinding techniques that would hide the timing changes from observation.

'Hertzbleed' Side-Channel Attack Threatens Cryptographic Keys for Servers

The ability to handle intense pressure is just one of the skills that veterans bring to corporate cybersecurity work.

The contributions of ex-military personnel expand beyond their time of public service. They come to private-sector cybersecurity roles ready to take on foes that range from harbingers of mischief to deliverers of destruction.

"The importance of paying attention to even the tiniest of details due to potential impact and lives on the line is drilled into every military member," says Devon Bryan, global chief information security officer at Carnival Corp. and co-founder of the International Consortium of Minority Cybersecurity Professionals, now known as Cyversity. "Irrespective of branch of service and without regard to rank or station, the military emphasizes the necessity of working hard and with a passion for excellence, which are key for the infosec challenges of today."

It's no secret that former service members come prepared with training that many companies in the private sector find beneficial. But just which military skills transfer best to private cybersecurity jobs?

"An understanding of physical security and access control," says Oxana Parsons, senior cyber intelligence analyst at LookingGlass Cyber Solutions.

Many skills, even those seemingly unrelated to cybersecurity or IT, easily transfer, she adds. 

"In the military I have learned how to set up a local network — and I did it as a HUMINTer \[human intelligence collector\], so \[even\] not really an IT-related job can still provide some related training," Parsons says. "Also, in the military there are lots of opportunities to receive foreign language training and intelligence training, which taught me to understand the tradecraft behind intelligence collection and analysis."  

Other experienced vets point out that their collaboration and self-assessment skills alone can prove priceless to private-sector defense measures.

"Cybersecurity is such a broad field. The ability to be comfortable both knowing and accepting what you don't know, while being humble enough to seek out who does, is a particularly powerful skill to master," says Alex Diaz, customer success leader at Horizon3ai, who served both as a military intelligence officer and an enlisted all-source intelligence analyst in the US Army.

**Fulfilling Private Cybersecurity Needs**

"As cybersecurity grows in prominence as a risk factor for organizations, private firms will need experienced and capable leaders to manage their security postures," says Matt Georgy, chief technology officer at Redacted. "Veterans bring a unique perspective working in chaotic situations and often making consequential decisions in high pressure situations." 

Previously, Georgy served as chief of intelligence of the US Air Force 18th Fighter Squadron, lead US government forensics analyst in Baghdad, and held several technical leadership roles at the National Security Agency (NSA).

While one could argue that all military service is security-related, not all ex-military personnel currently employed in cybersecurity served in security-related positions. Even so, their training often transfers to a new position in the private sector.

"I did not work in security while in the military. But I can find similarities to when I worked in a Navy Combat Information Center (CIC) or a Tactical Operations Center (TOC)," says Josh Smith, cybersecurity analyst at Nuspire, who previously served as operations supervisor, mission control and evaluation supervisor, and operations and logistics department head in the US Navy. "All require the ingestion of data, analyzing what was received, disseminating it to the appropriate parties, and taking action based on the findings."  

The constant shape-shifting of threats and attackers is familiar to military-trained professionals. That alone is a major plus to employers looking to protect themselves from whatever digital abomination is cresting the horizon next.

"Military veterans have a very wide skill set, as we're often asked to work outside of our specific roles," Smith says. "We're exposed to numerous situations that are dynamic, stressful, 24/7, and leave no room for error. Cybersecurity is very similar in this respect. Cybersecurity never sleeps and is consistently changing. Veterans can easily adapt to this lifestyle."  

For those who transferred their cybersecurity skills directly from public to private concerns, commonalities between the sectors smoothed the transition.

"Military operations are steeped in risk and threat by their very nature, so military veterans develop a keen sense for assessing and weighting threat and risk," says Mac McMillan, CEO of healthcare cybersecurity, privacy, and compliance consultancy CynergisTek. Formerly, McMillan was director of security at the Defense Threat Reduction Agency for the Department of Defense (DoD).

"On a personal level, their sense of urgency, structure, discipline, etc., is well-suited for cyber and IT jobs," McMillan adds.

**Rank Is Optional**

Higher ranks in any military branch generally signify accomplishment and experience that are also highly prized in the civilian world. However, limiting hiring to high-ranking ex-military applicants is shortsighted.

"As CISO of the US Marine Corps, I dealt with many early-day cyber incidents from both nation-state threat actors and crime syndicates ... like the Melissa virus and ILOVEYOU," says Carl Wright, chief commercial officer at AttackIQ. 

Officers and enlisted members participate in training programs worth millions of dollars to earn Military Occupational Specialty (MOS) designations. 

"One of those areas is cybersecurity, and within cyber you have defensive operations and offensive operations," Wright says. "The level of training these individuals receive to protect our most critical infrastructure and carry out cyber operations against our adversaries goes far beyond most private-sector offerings and is highly transferable to a career in the private sector."  

Ex-military personnel bring excellent security practices to other areas as well.

"While I did not directly work in a security billet, my team worked to design software and had security requirements we had to align with," says Heath Anderson, VP of information security and technology at LogicGate and former system test architect for the US Air Force. "This experience was some of the best education around security principles I could have asked for, since we had to focus on the intent of the requirement in order to make it actionable in our code for the software we were designing and testing."

For his part, Andrew Maloney, chief operations officer and co-founder of Query.AI, worked on a help desk and in systems administration until 2003, when he was deployed to Oman, in the Middle East, to manage the base's perimeter security firewalls and proxy servers. 

"This was my break into cyber," says Maloney, formerly systems administrator/security engineer for the US Air Force.

**Bringing Softer Skills to Bear**

Skills including leadership, planning, and organization and traits like duty, responsibility, and loyalty make military vets excellent team members and leaders in civilian roles, McMillan adds.

"The military not only expects these things from its members, they spend time teaching these skills to their members," he said. "All too often these are not things that are either taught or stressed in the private sector, which is a shame because there is nothing particularly proprietary about any of them."  

Successful in cybersecurity and in the military means sharpening soft skills as much as hard skills.

"The one common denominator that I have seen be the most successful is the insatiable desire to learn," says Brad LaPorte, a security consultant who served as systems administration branch chief in the US Army Pacific Command. "Cybersecurity is technically difficult and not for the faint at heart. It requires long hours and constant diligence to keep up with the multidaily changes that occur in this field. Those \[who\] constantly read, write, learn, and mentor others are exponentially more successful. Anyone can learn this stuff, but it requires them to put the work in."

It isn't just the hard-nosed tactics that win battles. Almost always, adding soft skills to the mix hones the best defenses.

"The skill that I found most beneficial is the ability to think in terms of the 'big picture' but act at a lower level." says Phil Hagen, faculty fellow at SANS Institute and formerly a computer network defense analyst and IT manager with the US Air Force. "Knowing the overall strategic or tactical arc of your actions is a big part of infosec. Infosec is a huge effort, and if you try to solve it all, it's going quickly to turn into a fool's errand. Seeing the long-term goals but identifying the dozens of smaller, interim milestones has been very helpful."

Responding to conflict and always being ready to assume command also top the soft skills most in demand from ex-military personnel.

William Mendez, managing director of operations at CyZen, says all military personnel are trained as leaders, since the nature of conflict creates uncertainty around when you may land in a situation where you have to assume command.

"Personnel with military backgrounds have the skills to lead successful teams," he says. "They often gain the respect of other members through leadership traits such as empathy and motivation. They often lead by example, always mentoring and never asking anyone to do something they would not be willing to do themselves." 

Every day, those who previously served their country can still stand guard. Their paths to cybersecurity careers are as varied as those of their civilian counterparts. Their dedication and sense of duty, however, remains intense.

"Employers have a cybersecurity skills gap to overcome, and they should see the military as a hugely untapped resource," says Susan Peediyakkal, infosec operations manager at NASA Ames Research Center. "Companies should consider building their own mentoring programs or partnering with organizations that have programs in place to ensure that veterans get the essential training and networking resources they need to build a successful career in cybersecurity."

Veterans Explain How Military Service Prepared Them for Cybersecurity Careers

Citrix ADM vulnerabilities could lead to admin password reset and disruption of ADM license service, company warns.

Citrix is advising users of its Application Delivery Management (ADM) solutions to update their systems against a pair of newly discovered vulnerabilities. 

Tracked under CVE-2022-27511, the first vulnerability could allow system corruption leading to the admin password being reset after reboot. The second, CVE-2022-27512, if exploited, could allow a threat actor to temporarily disrupt the ADM license service. 

Although a fix has been issued, customers using outdated, unsupported versions are advised by Citrix to upgrade. 

Also, "Citrix strongly recommends that network traffic to the Citrix ADM’s IP address is segmented, either physically or logically, from standard network traffic," the vulnerability notice from Citrix recommended. "Doing so diminishes the risk of exploitation of these issues."

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

Critical Citrix Bugs Impact All ADM Servers, Agents

As the public cloud matures, enterprises are converging on two platforms that meet their workload protection needs via a strategy based on zero-trust security.

In the early days of a new B2B information technology market, it is common for the vendor community to step up with dozens of point products, each with its own differentiators within its niche. Nowhere is this phenomenon more evident now than in public cloud security, where there is a nearly incomprehensible acronym soup of solutions, each of which solves its own slice of the broader cloud protection problem. Examples include CSPM, CIEM, DLP, IAM, multicloud networking, microsegmentation, IaC scanning, container runtime security, and vulnerability assessment, to name a few.

Even if you had the budget to buy all of these tools separately, the operational complexity associated with training the staff, integrating the products, and meeting the deadline with a dozen different vendors would be a nightmare. Fortunately, as public clouds mature, enterprises converge on two key platforms that meet their workload protection needs via a strategy based on zero-trust security: Cloud Native Application Protection Platforms (CNAPP) and Secure Access Service Edge (SASE).

Zero-trust security is a framework built around the concept of least-privileged access, in which no user or application should be inherently trusted. This framework is the opposite of a traditional secure perimeter approach in which employees and data reside in an office building.

With zero trust, every user and application is deemed hostile. But if you keep everything out, it is difficult for users and applications to communicate, so access is granted only to the specific resource that is necessary once identity and risk context have been established and verified. While zero trust has gained wide adoption for user access to applications over the last several years, many enterprises are extending it to application-to-application communication use cases.

Enter CNAPP and SASE …

**CNAPP and Zero Trust**

The job of a CNAPP is to identify, prioritize, and help mitigate cloud workload risks. These platforms provide visibility into both public cloud infrastructure and the workloads running on that infrastructure. A CNAPP also helps identify and remediate risks before deployment to the cloud by combining DevOps tools and integrated development environments (IDEs).

CNAPPs provide insights into a broad range of cloud risks, taking the place of several previously separate categories of products. Hazards include those related to misconfigurations, excessive privileges and permissions, sensitive data-at-rest, unpatched software vulnerabilities, and more. In addition, these platforms correlate across functions to help prioritize actual exploitable issues and provide an accurate picture of how an enterprise might be compromised.

Not only does a CNAPP identify and prioritize cloud risks, it assists with remediation of those risks as well, either through automated remediation or through guided manual remediation. The CNAPP process of identifying, prioritizing, and mitigating cloud risks is continuous. In dynamic cloud environments, risk posture is constantly changing.

In a zero-trust architecture, CNAPP provides the critical element of risk context that can be used to make more informed decisions about the level of access a workload should have within and across the enterprise cloud footprint. As with users, a risky cloud workload should have limited access until those risk factors are adequately mitigated.

**SASE and Zero Trust**

With risk context established, the next step is to allow access only to what is necessary. This is where SASE comes into play. SASE uses workload identity and risk context to verify access rights, applying business policies based on that context and the transaction being attempted. As context changes, access privileges are continually reassessed. SASE has traditionally been associated with the protection of user communications and has only recently begun to gain traction as a platform for the protection of workload communications.

SASE platforms connect cloud workloads directly to other workloads — without connecting them to networks — and implementation of zero trust communications for workloads. By providing this app-to-app connectivity and segmentation, SASE reduces the ability of malicious software or bad actors to move laterally across the network. SASE enables cloud workload communications for several use cases, including:

*   Cloud-to-cloud

*   Cloud-to-data center

*   Cloud-to-internet

*   Intracloud

Traditional perimeter technologies, such as firewalls, use a "passthrough" security approach, making a lousy protection tradeoff in favor of performance. If malicious traffic is found, it is often too late to stop it. A SASE-based solution thoroughly inspects every transaction, terminating every connection to hold and check encrypted traffic before forwarding it to its destination. The inspection often includes data loss and threat prevention, and access control.

**Two Parts of One Whole**

Together, CNAPP and SASE provide a comprehensive approach to cloud workload security by securing the workloads and access to the workloads while ensuring optimal application performance and user experience. Over the next few years, there will be an increasing concentration of functionality provided by point products today into one of these two platforms. The result will be widespread adoption of zero-trust security for public cloud workloads and simplification from significant tool consolidation.

**About the Author**  

    

Rich Campagna is Senior Vice President and General Manager, CNAPP, at Zscaler, where he leads strategy for securing public cloud infrastructure and workloads. In his 20+ years in technology, Rich has held product management and marketing leadership positions at Balbix, Bitglass, F5 Networks, and Juniper Networks. Rich received an MBA from the UCLA Anderson School of Management and a B.S. in Electrical Engineering from Pennsylvania State University.

Two Platforms to Rule Them All: CNAPP and SASE

Interpol says it busted fraudsters who were operating call centers for romance scams, get-rich-quick schemes, and more.

Interpol has announced that a coordinated, global law-enforcement effort has led to the arrest of 2,000 individuals and the seizure of more than $50 million in illicit funds stolen through a variety of social-engineering scams. 

The operation, code-named First Light 2022, included police raids on call centers, where cybercriminals are alleged to have been operating a variety of social engineering telephone frauds, ranging from romance scams to connected financial crimes, according to Interpol. 

The international law-enforcement agency said the effort included coordinated policework across 76 countries. In all, 1,770 individual locations were raided, leading to the arrests of thousands of accused fraudsters, operators, and money launderers, along with the identification of other suspects. 

The investigation also revealed an uptick in social media driving human trafficking, money laundering through victims' personal bank accounts, scammers posing as bank employees to trick targets into giving up credentials, and more. 

“Telecom and \[business email compromise\] BEC fraud are sources of serious concern for many countries, and have a hugely damaging effect on economies, businesses and communities.” said Rory Corcoran, director of Interpol's Financial Crime and Anti-Corruption Centre (IFCACC), in a statement about First Light 2022. “The international nature of these crimes can only be addressed successfully by law enforcement working together beyond borders."

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

Thousands Arrested in Global Raids on Social-Engineering Scammers

Work across the organization and take practical steps to ease user stress — prioritize user productivity by offering the right tools to avoid shadow IT and cultivate a transparent security culture. Remember the security team, too, and automate as many processes as possible.

The art of balance has never been as important as it has in the past two years. The toll that job pressures and burnout can have on the workforce is at an all-time high and at the forefront during daily conversations.

As security leaders, we can't ignore the list of ramifications that stem from employee burnout, such as apathy, disengagement, or other more serious mental health concerns.

**Practical Steps Toward Security**

Although battling something as big as employee burnout may seem daunting, there are practical steps security teams can take to streamline and ease user stress when it comes to security.

*   **Cultivate a transparent** **security culture:** Cultivate a proactive and interactive security culture to create a safe place for employees to ask questions and have transparent, open communications with security. Promote and ensure data-use policies are clear and concise. Be transparent about what you're monitoring and collecting, as well as what you're doing with that data.

*   **Investigate with empathy and assume positive intent**: Over three-quarters of insider data breaches this year have been considered nonmalicious. When you see possible data exposure or leaks coming from an insider, first presume that the users had positive intentions and approach the situation with empathy. That means asking questions to get context about the situation and a clear solution to reversing the action before it causes any damage to the organization.  
    

*   **Minimize shadow IT, prioritize user productivity**: Provide users with the right tools they need to do their jobs — and make it easy for users to contact the proper people if they want to use an alternative — so they don't have to or won't be tempted to go around security. For common business practices like sharing files externally, share the "best practice" method and make this information easily accessible to users. The more security can prioritize users' work preferences, the less burnout users will have in the first place.

**Standardize Security Best Practices**

I would be remiss to discuss burnout without acknowledging burnout among security teams. For chronically understaffed security teams who operate in a constantly evolving environment where threats, zero-day vulnerabilities, and data loss incidents are everyday occurrences, there unfortunately is no silver bullet to reduce stresses on security and technology teams. However, the one critical tip security teams should take is to:  

*   **Automate, automate, automate:** Turn fire drills into standard operating procedures and automate work wherever possible. Security should create workflows to manage the most common security alerts that require the most standard response, which frees up time to focus on the most pressing security concerns — and not just spinning unnecessary cycles and flaming burnout across security teams.

As we look toward the second half of the year, I encourage security leaders to take factors like workplace burnout and employee retention rates into consideration in tandem with the general movement toward more empathetic workplace cultures.

The notoriously stoic cybersecurity culture is changing. I expect that we'll see more organizations adapting to this shift, changing traditional titles such as "Security Manager" to "Security Culture Manager" to align with the overdue need to recognize that the culture a security team brings to the overall business is equally as important as the protections it brings to the business.

Security leaders — and their teams — play a strategic and impactful role in helping to create a safe space for employees at work. When they work across the entire organization, they can have more impact on the security culture and innovation of the company altogether so that mental health and well-being can be top of mind for all.

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

How Information Security Teams Can Help Reduce Stress and Burnout

Multiple cybercrime groups have been spotted selling stolen credentials and other sensitive personal information pilfered from travel-related websites.

Much in the same way that cybercriminals followed the fervor around the pandemic, they now are doing the same with the travel boom, creating various scams that aim to take advantage of travel organizations, airlines, and individuals going on vacation.

Since the start of the year, security firm Intel 471 has tracked several cybercrime groups selling credentials and databases of stolen personal identifiable information (PII) tied to travel-related websites.

"People are starting to travel more than they have in the past few years, so there is increased attention and heightened traffic online," Intel 471 researcher Greg Otto explains. "Cybercriminals love operating in areas where a lot of people are congregating and trying to spend money ASAP."

The methods of malicious actors have evolved because of the concentration on PII: From reservations to rewards programs to security checks, these organizations collect a wide array of PII, he says.

He points to one threat actor that was specifically targeting individuals with at least 100,000 miles in their mileage rewards accounts. Other actors are seeking help in gathering additional information to perpetrate travel fraud schemes, offering up their own slate of PII as incentive.

"Financially motivated cybercriminals have realized how much value lies in the data that travel companies and organizations collect, which is why they have moved to target organizations in the travel, aviation, and hospitality industry," he says. "If that PII is not protected, it's going to be targeted."

While ransomware-as-a-service (RaaS) does not appear to pose an acute threat to the global travel industry so far, an Intel 471 blog post outlined the threat RaaS has posed to regional airlines, including low-cost Indian airline SpiceJet and an unnamed Thai airline.

**What to Do About It**

What can organizations do to deter cybercriminals from targeting their systems? Have written security policies and procedures tailored to your specific organization, Otto says, and craft expectations for protection of data, including the confidentiality of data, and set limits of permissible data access and use for employees.

"Be aware of social engineering scams, have a robust passwords policy for employees and users, and patch vulnerabilities when applicable," he says.

Meanwhile, Intel 471 also noted activity around pro-Russia hacktivist groups, namely an actor joining KillNet, which has conducted attacks against targets in Romania and other countries providing support to Ukraine.

Threat actors are using their position within the government agencies to facilitate illegal border crossings for Ukrainian males aged 18 to 60.

“Accomplices used to facilitate the activity allegedly would transfer a person seeking to cross the Moldova-Ukraine border and bypass official checkpoints,” the blog post noted.

Cybercriminals Capitalizing on Resurgence in Travel

The Japanese-language Panchan botnet has been discovered stealing SSH keys from Linux servers across Asia, Europe, and North America, with a focus on telecom and education providers.

A peer-to-peer (P2P) botnet and worm called Panchan has been actively breaching Linux servers and harvesting Secure Shell (SSH) keys to perform lateral movement — at times brute-forcing credentials.

That's according to researchers from Akamai, who discovered the botnet in late March. Written in Golang, it parses local SSH private keys and known hosts on each victim (using a static dictionary), then uses them to spread itself further.

While it could use the botnet for anything, Panchan is focused on a cryptojacking endgame for now. 

"It is mostly a cryptojacker, so I don't think it's that dangerous. But it is unique," Akamai researcher Stiv Kupchik says. "P2P communication is not that common in malware, and the SSH key harvesting also seems pretty novel. Also, I don't think I've ever seen a Japanese threat actor."

The malware is believed to have Japanese origins (it's name is a possible reference to Panchan Rina, the Japanese kickboxer), and focuses on attacking telecommunications education providers in Asia, Europe, and North America.

From Kupchik's perspective, education was likely a highly targeted vertical because of the SSH-key harvesting aspect of the botnet.

"I have seen some victim institutes that were in the same country, or very close geographically," he says. “I think that academic collaborations between institutes might yield a higher percentage of shared SSH keys than in other verticals, so maybe that is the reason."

**Unique Botnet Features**

The malware — which deploys two miners, XMrig and nbhash, has a handful of unique technical features, according to the Akamai researchers. For one, it uses NiceHash for its mining pools and wallets. Because Nicehash is a regular wallet (using certain defined Bitcoin addresses for deposits) and not a blockchain wallet, Akamai was unable to see transaction and mining details to estimate the actual revenue that Panchan has earned.

Further, to hamper traceability, the cryptominers are dropped as memory-mapped files without any disk presence, and the cryptomining can be terminated if any process monitoring is detected. 

There's also a "godmode" feature baked into the malware, in the form of an admin panel that can edit the mining configuration — another unique feature of Panchan, according to the firm.  

**Defeating Panchan**

Because the malware uses a basic list of default passwords to spread, Kupchik says one of the key steps security teams can take to stop the malware in its tracks is through password hardening.

"The dictionary that the malware uses to spread is extremely basic, so any non-default password should help thwart it," he explains. “Segmentation and access control can help mitigate the SSH key harvesting risk, and MFA can help as well."

He adds that Akamai has published indicators of compromise, queries, signatures, and scripts that organizations can use to test for infection.

The report also recommends continuous monitoring of virtual machine resources. Monitoring could alert security teams to suspicious activity since botnets focused on cryptojacking can raise machine resource usage to abnormal levels.

"In the case of Panchan, resource usage monitoring would have also terminated the cryptomining entirely," according to the report.

Source

DARKReading