The incident is a reminder why organizations need to pay attention to how they store and secure data in SaaS and cloud environments.

Source: JHVEPhoto via Shutterstock

Fortinet has confirmed the compromise of data belonging to a "small number" of its customers, after a hacker using the somewhat colorful moniker "Fortibitch" leaked 440GB of the information via BreachForums this week.

The hacker claimed to have obtained the data from an Azure SharePoint site and alleges they leaked it after the company refused to negotiate with the individual on a ransom demand. The situation once again highlights the responsibility that companies have to secure data held in third-party cloud repositories, researchers say.

Fortinet itself has not specifically identified the source of the breach. But in a Sept. 12 advisory, the company said someone had gained "unauthorized access to a limited number of files stored on Fortinet’s instance of a third-party, cloud-based shared file drive."

The security vendor, one of the largest in the world by market cap, identified the issue as impacting less than 0.3% of its more than 775,000 customers worldwide, which would place the number of affected organizations at around 2,325.

Fortinet said it had seen no signs of malicious activity around the compromised data. "Fortinet immediately executed on a plan to protect customers and communicated directly with customers as appropriate and supported their risk mitigation plans," the security vendor noted in the advisory. "The incident did not involve any data encryption, deployment of ransomware, or access to Fortinet’s corporate network." Fortinet said it does not expect the incident to have any material impact on its operations or finances.

In a threat intelligence report shared with Dark Reading, CloudSEK said it had observed a threat actor using the Fortibitch handle leaking what appeared to include not just customer data, but also financial and marketing documents, product information, HR data from India, and some employee data.

"The actor attempted to extort the company but, after unsuccessful negotiations, released the data," CloudSEK said.  The company surmised that the hacker would have attempted to sell the data first, if it had been of any true value.

Fortinet did not confirm or deny if the hacker had attempted to engage with the company on the stolen data.

The hacker's post on BreachForums included somewhat context-free references to Fortinet's acquisitions of Lacework and NextDLP. It also referenced a few other threat actors, the most interesting of whom is a Ukrainian outfit tracked as DC8044. "There are no direct links between Fortibitch and DC8044, but the tone suggests a history between the two," according to CloudSEK. "Based on the available information, we can ascertain with medium confidence that the threat actor is based out of Ukraine."

**Breach a Reminder of Cloud Data Exposure Risks**

The Fortinet compromise — though apparently not too major — is a reminder of the heightened data exposure risks to enterprise organizations when using software-as-a-service (SaaS) and other cloud services without the appropriate guardrails. A recent scan by Metomic of some 6.5 million Google Drive files showed more than 40% of them containing sensitive data, including employee data and spreadsheets containing passwords.

Often, organizations stored the data on Google Drive files with little protection. More than one-third (34.2%) of the scanned files were shared with external email addresses, and more than 350,000 files had been shared publicly.

Rich Vibert, CEO and founder of Metomic, says there are three fundamental mistakes organizations make when it comes to protecting data in cloud environments: not using multifactor authentication (MFA) to control access to SaaS apps; giving employees too much access to folders and sensitive assets within the app itself; and storing sensitive data for too long.

It's unclear yet how the hacker might have accessed the data from Fortinet's SharePoint environment. But one likely scenario is that the attacker gained access to valid login credentials, via phishing for instance, and then logged in and exfiltrated data from SharePoint and similar environments, says Koushik Pal, threat intelligence reporter at CloudSEK. Information stealers are also a "really common" attack vector, Pal notes.

**Rethinking Cloud Security**

"Typically, developers should use environment variables, vaults, or encrypted storage for sensitive information, and avoid hardcoding credentials in source code," Pal says. Often developers hardcode access credentials like API keys, username and password into the source code and inadvertently push the code into a public or unsecured private repository from where they can be accessed relatively easily.

"Organizations should make MFA mandatory for accessing SharePoint and other critical systems to prevent unauthorized access even if credentials are compromised," Pal explains. "Monitor repositories on a regular basis for exposed credentials, sensitive data, or misconfigurations, and enforce security best practices across all teams."

Akhil Mittal, senior manager of cybersecurity at Synopsys Software Integrity Group, says incidents like the one Fortinet experienced show why it's a mistake for organizations to leave security around their cloud assets entirely to cloud service providers. "Organizations should rethink how they store customer data in shared drives, ensuring critical information is kept separate from less sensitive files," he says.

It's a good idea too to encrypt sensitive data both in transit and at rest, to mitigate damage even if attackers gain access. Mittal perceives continuous monitoring of cloud assets as fundamental to protecting them. "Applying zero-trust principles to third-party platforms also ensures no external service is trusted automatically, reducing the risk of unauthorized access," he adds.

Don't miss the latest Dark Reading Confidential podcast, where we talk to two cybersecurity professionals who were arrested in Dallas County, Iowa, and forced to spend the night in jail — just for doing their pen-testing jobs. Listen now!

**About the Author**

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year career at Computerworld, Jai also covered a variety of other technology topics, including big data, Hadoop, Internet of Things, e-voting, and data analytics. Prior to Computerworld, Jai covered technology issues for The Economic Times in Bangalore, India. Jai has a Master's degree in Statistics and lives in Naperville, Ill.

Fortinet Confirms Customer Data Breach via Third Party

In this case study, a CISO helps a B2B marketing automation company straighten out its manual compliance process by automating it.

Source: Moodboard Stock Photography via Alamy Stock Photo

Like many tech companies, Metadata.io built its B2B marketing automation business from the ground up, consistently adding key functions like personalization, prospect data enrichment, and creative micro-targeting strategies.

As it was growing, the company did its best to comply with critical attestations and standards like SOC 2 Type II and ISO 27001. But most of the focus was on building the company's core assets, not thinking of ways to streamline and automate compliance.

These frameworks aren't easy to comply with. Although they share about 60% of the same controls, they are completely different frameworks and require different processes.

The company did the best it could to comply with these controls with largely manual processes. All controls were written in spreadsheets, with no owners of specific controls and no way to ensure version control. Controls were stored in nested folders and Google Drive.

After a few years, it became clear that the compliance process simply wasn't working. To address the issue and shore up security in general, Metadata.io hired veteran CISO Raymond Taft.

**A Tangle of Manual Compliance**

"When I first got here, the company was just shy of about three months of its Series B fundraiser. It was still a very scrappy company," Taft says.

The first order of business was addressing the haphazard way Metadata.io was handling compliance. The current, largely manual system made it difficult to track compliance and ensure that controls were continuously monitored.

"Every single background check and confidentiality agreement had to be marked in a folder. It can take an enormous amount of time if you're continuously grabbing evidence for every one of those controls and putting them in these folders," Taft says. "It ends up being a nightmare to collect because you have to go back to that spreadsheet to, for example, collect evidence on specific need to things on specific days."

It was also labor-intensive, taking six people to do nothing but evidence collection. That's a lot of people when the total employee count is only 40.

Taft also discovered that the company was missing controls around background checks, performance reviews, and continuous monitoring of its cloud environment. Perhaps even more concerning was the haphazard way that data loss prevention, and security in general, was monitored and controlled.

"I knew within the first three months of working here that it would never scale as the company planned to grow to three or four times its current size," he says.

Without automation, Taft could see the writing on the wall. In addition to losing customer trust, the company would have had to continue spending a lot of money on evidence-gathering, and may have ended up outsourcing the entire function.

**Automating Compliance via Outsourcing**

Automating the compliance function was the only way Taft could see to gain control and ensure that controls were being consistently met. He didn't think it was a good idea to try to automate the function internally; not only was it not a core competency of the company, but it would incur a significant learning curve and take a significant amount of time.

Compliance automation is a good option for many enterprises, says Rik Turner, a cybersecurity analyst at Omdia.

"If your business spans multiple verticals and/or geographies, it's likely that you will be subject to multiple compliance requirements. This makes complying with them all a time- and resource-consuming undertaking, so automating your compliance activities represents significant potential savings," he says.

In addition, a typical human-driven compliance project is carried out on a monthly, quarterly, or even semi-annual basis, which means that it provides only a point-in-time view of compliance at the moment it was completed. An automated approach, on the other hand, holds the promise of continuous checking and alerting as soon as a change to the infrastructure or business processes risks slipping out of compliance, he adds.

Taft wanted a full-stack automation tool that would be able to configure policies, identify control failures or other issues, and quickly incorporate new controls. He also wanted to ensure that the solution could integrate with the stacks Metadata.io used most commonly. That included Jira, AWS, and GCP, along with its background check provider and HR platform.

"We knew if we could plug into those and continuously gather evidence, we could knock off more than 80% of our total evidence-gathering requirements for the year," he says.

There are plenty of tools that meet the requirements around continuous compliance, Turner says. More specifically, he notes that vertical and geographical breadth of coverage is key. But most importantly, he adds, potential buyers should check whether a tool that measures compliance stops at the alerting stage or can actually remediate situations when it detects that a change has caused the organization to slip out of compliance.

With these issues in mind, Taft settled on Drata for automated compliance monitoring. The tool automates evidence collection from all of its tooling, querying it every second of the day and reporting on status. It also communicates the state of Metadata.io's compliance program to auditors through a portal that also allows them to ask questions.

**Building on Good Results**

Since the implementation, Metadata.io's internal compliance team has been reduced to four people, even though the company has now grown to more than 100 employees. Taft says companies Metadata.io's size typically have compliance teams of 10 to 15.

The company also realized an unanticipated benefit: being able to fold some of its services into Drata via its trust center. Before, the company was paying $30,000 per year to upload its documentation to a trust center, where customers could access it. Drata's solution includes a trust center, saving the company that money.

That's just part of the cost savings. Taft says that all told, automated compliance has resulted in a 6x reduction in cost.

Time savings also has been substantial. For SOC 2 Type II and ISO 27001 compliance audits alone, for example, prep time went from six weeks to two weeks. Taft says that he recently met with the company's auditors for a total of five hours for the audit period. Last year that took four days.

With SOC 2 Part II and ISO 27001 fully automated and under control, Taft's next project is expanding into other compliance projects like ISO 27701, which is focused on data privacy, along with other frameworks.

The key to expanding, he says, is leveraging the automation tool's approach to control mappings and its ability to cross-map.

"There are dozens of frameworks, and they all share a little bit of DNA with each other," Taft explains. "The cross-mappings could be horrendous and could take months. For example, how does ISO 27701 relate to privacy for SOC 2?"

Drata's control and framework mapping enables users to click on a framework and see which controls apply to it. With that information, it's fairly simple to determine what's needed in terms of human resources to adopt the new framework, he says, and whether it makes sense for the business to move forward with it.

**About the Author**

Contributing Writer, Dark Reading

Karen D. Schwartz is a technology and business writer with more than 20 years of experience. She has written on a broad range of technology topics for publications including ITProToday, CIO, InformationWeek, GCN, FCW, FedTech, BizTech, eWeek, and Government Executive.

Compliance Automation Pays Off for a Growing Company

PRESS RELEASE

LONDON, Sept. 10, 2024 /PRNewswire/ -- In the past 12 months, over half of organisations were impacted by cyber threats. Larger companies in particular were much more likely to come under attack.

The severity of these incidents is directly contributing to job losses. Of 500 UK IT, resilience and cyber security professionals surveyed, 37% reported that cyber-attacks resulted in dismissals.

Last year, Databarracks' Data Health Check (DHC) found that cyber-attacks are organisation's leading cause of downtime and data loss. In 2024, that is still the case.

Data lost to cyber incidents varies greatly by company size, with larger businesses five times more likely to be impacted.

Chris Butler, Resilience Director at Databarracks, commented:

"It should come as little surprise that cyber remains organisations' leading cause of downtime and data loss. The real news is that cyber is now having a significant impact on employees.

"Over a third of those surveyed in the DHC report job losses as a result of cyber-attacks. These could be IT or Security staff being dismissed in direct response to the breach, or wider layoffs from business disruption.

"Cyber-attacks on businesses are often seen as victimless crimes because losses are covered by insurance. These results show that attacks have a personal impact.

"Today, IT teams are faced with significantly more risk and threats to the continuity of their organisations, which can have a profound impact on their wellbeing. But the same can be said for employees across a business.

"Staff may be uncertain about what an attack means for the future of their company, and by extension their own job security. Your first line of defence is your staff, and so it is crucial that they are kept well-trained and appropriately informed in the event of an incident."

Read the highlights from the Data Health Check 2024: https://datahealthcheck.databarracks.com/2024/ 

Download the full DHC report: https://www.databarracks.com/resources/data-health-check-2024

Over a Third of Cyberattacks Result in Job Losses

The FBI and CISA are warning citizens of attempts to convince voters that US election infrastructure has been compromised. (It hasn't been.)

Source: David R. Frazier Photolibrary, Inc. via Alamy Stock Photo

The FBI and Cybersecurity and Infrastructure Security Agency (CISA) are warning US citizens that the spread of disinformation is high, as false claims of cyberattacks compromising US voter registration databases begin to unfurl.

The agencies say that malicious actors are behind the discord, which is an attempt to manipulate public opinion as well as undermine trust in US democratic institutions. The tactics the malicious actors use involve obtaining voter registration information to support their false claims that election infrastructure has been compromised. 

According to the agencies, access to this kind of information is not in itself an indicator of voter registration database compromise. In fact, voter registration information can be viewed through sources that are publicly available. 

"The FBI and CISA have no information suggesting any cyberattack on US election infrastructure has prevented an election from occurring, changed voter registration information, prevented an eligible voter from casting a ballot, compromised the integrity of any ballots cast, or disrupted the ability to count votes or transmit unofficial election results in a timely manner," according to the announcement. 

The agencies recommend that individuals not take claims of election intrusion at face value, be cautious of the veracity of social media posts or emails from unfamiliar addresses, and seek information from state and local government election officials and trusted sources if they have questions. 

**About the Author**

Malicious Actors Sow Discord With False Election Compromise Claims

PRESS RELEASE

CLEARWATER, Fla., Sept. 11, 2024 /PRNewswire/ --  Concerns about the trustworthiness of internal data exist in nearly all organizations globally according to "The Real Value of Technology Connectivity" report released today by TeamViewer, a leading global provider of remote connectivity and workplace digitalization solutions. Ninety-nine percent of business leaders pointed to factors undermining trust in internal data, citing multiple versions of the truth (38%), conflicting data management practices (32%) and too many instances of poor hardware reliability (31%) as top reasons for mistrust.

Interestingly this mistrust of internal data varies across company size. It is more likely to be driven by lack of data literacy in smaller organizations. Forty percent of respondents working for companies generating US $10 million - US $49.99 million in yearly revenue report a lack of data literacy among employees, compared to 21% of companies generating US $10 billion and above.

The global research study also found that only 5% of business leaders believe they have seamless technology connectivity across their organizations, identifying a huge opportunity to close the connectivity gap to not only gain internal trust in data, but to also enhance nearly all areas of the business from innovation to HR.

When asked how seamless technology connectivity could help their organization:

*   80% of respondents state is allows for better customer interactions and increases customer satisfaction
    
*   81% say it enables better innovation
    
*   82% believe it allows more time for considered decision making
    
*   86% consider it an important aspect of working at their company increasing talent retention
    

Technology Connectivity = Industry Leadership & Cyber Defense 

The research also uncovered a correlation between excellent connectivity and industry leadership, with 33% of business leaders at organizations with excellent technology connectivity saying their financial performance is among the leaders in their industry. Just 16% of business leaders with good connectivity say the same. In addition, 61% say that excellent technology connectivity gives them a competitive edge.

Further, 34% of businesses with excellent connectivity say their operational performance is on par with industry leaders but only 19% with good connectivity say this is the case. Seamless technology connectivity, the extent to which staff can operate and connect without interruptions, and what all businesses should be aiming for, also increases resilience and supports risk management. In particular, better connectivity helps organizations to withstand the growing threat of cyberattacks. 38% of those with excellent connectivity, those one step below achieving seamless connectivity, are among the leaders in their sector for cybersecurity performance, compared to 22% of those with good connectivity.

"It's clear from the research that connectivity isn't just about driving workforce productivity and efficiencies. The approach of shifting connectivity from a supporting role and cost centre to one that empowers the business has an impact on growth, and ultimately revenue. Fragmented systems blunt competitive advantage so just being good is not good enough when it comes to connectivity. Businesses need seamless integration and harmonization of data to fully realise the opportunities that technologies like augmented reality (AR) and artificial intelligence (AI) bring," said Mei Dent, chief product and technology officer, TeamViewer.   

What is holding organizations back?

Organizations with gaps in connectivity (those who say they have good connectivity but not excellent or seamless) are more likely to be held back by differences between departments within their organization (30%) and the inability to show the ROI of tech connectivity (27%). Whereas those who say they have excellent connectivity are most likely to be held back by concerns about cybersecurity (24%). So, cybersecurity is both a benefit and a hindrance to better connectivity.

A company's ability to connect to any device, application and system in its infrastructure, and to make use of existing data, has an outsized influence on performance. Whether it is smarter logistics operations or remote technical guidance, access to knowledge from any device, at any time, helps people work smarter and reduces the mistrust that there are multiple versions of truth in data.

Dent continued, "There is a long way to go for companies to achieve seamless connectivity, but the benefits far outweigh the initial investment of time and resources. Doing nothing also has a cost. With many struggling with increased competition and a lack of skilled labour available, organizations need to do all they can to attract and retain the best talent. And one way to do this is to offer a working environment with integrated systems and connectivity that makes it a great place to work and thrive in their careers."

Research Methodology 

The research was conducted by FT Longitude between March and April 2024. 500 business leaders across six countries took part: Australia, Canada, Japan, Germany, United Kingdom and the United States. Business leaders represented enterprises from the automotive, industrial manufacturing, IT, logistics, transport & distribution, financial services, retail, public sector and utilities industries.

About TeamViewer

TeamViewer is a leading global technology company that provides a connectivity platform to remotely access, control, manage, monitor, and repair devices of any kind – from laptops and mobile phones to industrial machines and robots. Although TeamViewer is free of charge for private use, it has around 640,000 subscribers and enables companies of all sizes and from all industries to digitalize their business-critical processes through seamless connectivity. Against the backdrop of global megatrends like device proliferation, automation and new work, TeamViewer proactively shapes digital transformation and continuously innovates in the fields of Augmented Reality, Internet of Things and Artificial Intelligence. Since the company's foundation in 2005, TeamViewer's software has been installed on more than 2.5 billion devices around the world. The company is headquartered in Goppingen, Germany, and employs more than 1,500 people globally. In 2023, TeamViewer achieved a revenue of around EUR 627 million. TeamViewer SE (TMV) is listed at Frankfurt Stock Exchange and belongs to the MDAX. Further information can be found at  https://www.teamviewer.com/.

99% of Business Leaders Have Concerns About the Trustworthiness of Internal Data

PRESS RELEASE

REDWOOD CITY, Calif., Sept. 11, 2024 /PRNewswire/ -- According to a recently published report from Dell'Oro Group, the trusted source for market information about the telecommunications, security, networks, and data center industries, the Network Security market showed signs of recovery in 2Q 2024, growing 6 percent year-over-year (Y/Y) to reach $5.9 billion and breaking a streak of six consecutive quarters of deceleration. This growth was primarily driven by solid demand for cloud-native security solutions and virtual firewalls, which saw a 17 percent increase. In contrast, hardware-based solutions experienced their fourth consecutive quarter of decline, dropping 2 percent.

"The Network Security market's performance in 2Q 2024 reaffirms the enduring shift towards cloud-centric architectures," said Mauricio Sanchez, Sr. Director, Enterprise Security and Networking at Dell'Oro Group. "The firewall segment serves as a microcosm of this transformation. While overall firewall revenue grew modestly at 2 percent, virtual firewalls surged by 22 percent as physical firewall sales struggled. This stark contrast in growth rates within a single product category underscores how enterprises consistently favor flexible, cloud-native security solutions to address their evolving needs."

Additional highlights from the 2Q 2024 Network Security Quarterly Report:

*   The Infrastructure Security market, comprising firewalls, Security Service Edge (SSE), and traditional Secure Web Gateway (SWG) appliances, achieved nearly $5 billion, marking a mid-single-digit growth.
    
*   The Application Security and Delivery market, including Application Delivery Controllers (ADC) and Web Application Firewall (WAF) segments, experienced high single-digit growth, reaching $1.2 billion, primarily driven by robust WAF sales that offset the weakness of ADCs.
    
*   SSE revenue increased to nearly $1.5 billion, with the top three vendors – Zscaler, Palo Alto Networks, and Broadcom – controlling almost 60 percent of the market.
    
*   WAF revenue rose 18 percent, driven by a 25 percent growth in SaaS-based WAF solutions.
    
*   High-end physical firewalls showed signs of stabilization with a slight 1 percent revenue growth, potentially indicating a turning point after several quarters of decline.
    

About the Report  
The Dell'Oro Group Network Security Report includes manufacturers' revenue covering the ADC, Firewall, SSE, traditional SWG appliances, and WAF product segments. Moreover, SSEs are further broken down across four primary functions: CASB, FWaaS, SWG, and ZTNA. The report also splits many segments by form factor: physical, virtual, and SaaS. To purchase this report, please contact us at \[email protected\].

About Dell'Oro Group  
Dell'Oro Group is a market research firm that specializes in strategic competitive analysis in the telecommunications, security, enterprise networks, and data center markets. Our firm provides in-depth quantitative data and qualitative analysis to facilitate critical, fact-based business decisions. For more information, contact Dell'Oro Group at +1.650.622.9400 or visit https://www.delloro.com.

You May Also Like

Cloud-Native Network Security Up 17%, Hardware Down 2%

As the 104th season of the National Football League kicks off, expect cyberattacks aimed at its customers, players, and arenas.

Source: Illus\_man via Shutterstock

This past weekend, the National Football League kicked off its 2024 season, and while the sport itself has remained the same, mainly — hello, new kicking rules — the technological operations around games and players is constantly evolving, and face increasing cyber threats.

While all companies have a mix of digital and physical assets, sports teams have a unique cocktail of critical assets, especially as data has become increasingly the lifeblood of sports franchises in the NFL. Pervasive Wi-Fi in every stadium and cellular systems that allow, say, concessions to more easily handle demand means there's data to be collected on every aspect of venue operations. Technology also allows connections with fans that extend online, at home, and at stadiums through loyalty programs, biometric checks at venues, and experiences customized by QR codes on every stadium seat.

In addition to information on their fans, NFL teams have real-time data on players, brands that need protecting, and critical infrastructure relied on by arena operations and video broadcasters.

In all, it's a challenging logistical puzzle that requires continuous risk assessment, threat intelligence, and an agile IT team, says Brandon Covert, vice president of IT for the Cleveland Browns (and the area's professional soccer team, the Columbus Crew).

Related:Dark Reading Confidential: Pen Test Arrests, Five Years Later

"I started here 20 years ago, and there wasn't a whole lot of tech in our stadiums — they were all-cash, concrete buildings without a lot of technology," he says. "And now you see there's pervasive Wi-Fi ... and biometric payments and identification. All of these systems are inherently at risk, and we have to manage and mitigate that risk. The challenges \[that come along with\] tech just continue to grow, and get introduced to all areas of our business."

**A Game of Data**

The Cleveland Browns kicked off their game opener at their home stadium, the Huntington Bank Field, on Sept. 8. While the fans were focused on game day, the Browns' information-technology and security groups have been working year-round to ensure that the season remains free of technological glitches and safe from cyberattacks.

One of the thorniest issues is the need to secure increasing volumes of data, be that player data, broadcast feeds, transactional data, or customer information. Every iota of that information has value to cyberattackers, says Covert.

"Our charge being a sports organization — we have a really good bond with our fans and we get a lot of trust from our fans, probably elevated beyond what other industries see with their customers — so we want to be responsible and not be involved in any of those data breaches or loss of fan information, just from a brand and reputation standpoint for us," he says.

And indeed, stolen data on fans and players can appear on the Dark Web; plus, the rapid legalization of sports gambling has added potential monetary losses to the mix, ratcheting up the emotional rollercoaster ride for many fans, says Jake Aurand, counterintelligence lead for Binary Defense, a cyberthreat intelligence firm that counts the Cleveland Browns among its customers.

"Teams have a lot of customer information — whether it's biometric or credit card data from people purchasing game tickets — so we're constantly out there on the darknet looking to see if any of that data has been stolen and is being reposted somewhere on a forum," he says. "But what we're also doing is looking for \[potential threats on the\] physical side."

For instance, among the most major of concerns to operations continues to be ransomware, says Brad Garnett, director and general manager of the Talos Incident Response team at Cisco, which has a partnership with the NFL.

"Ransomware is not going anywhere," he says. "Anything that would impact the integrity of the game — whether that's football, baseball, basketball, or footy — anything that would attack the game's integrity or around infrastructure availability" is a concern for cyber defenders.

Cyberattacks on the operational systems of an arena or stadium could cause a broadcast outage or take an approach as simple as posting a bomb threat on a scoreboard, National Football League CISO Tomás Maldonado said in an interview in June.

"I think a lot of people don't fully appreciate the convergence between cyber physical and the ... ramifications of a cyber event ... they don't usually make that connection right off the bat," said Maldonaldo, who is securing his sixth season with the organization.

**A Game of 1s and 0s**

About half of the threats detected by the company have some cyber-physical component, but the other half are purely about data, Binary Defense's Aurand says. Using the Browns' branding to fool fans into purchasing fake merchandise or just giving up their payment card details are common scams, he says.

Teams should take an active approach to defense, he adds. There are tools for doing just that: CISA and the NFL conduct annual tabletop exercises to workshop incident response, for instance.

"You need a first line of defense put in place, ... looking for those attacks immediately, in real time and throwing them off or identifying them extremely quickly," Aurand says. "And two, you need to stop the attacker from being able to move any further in their attacks."

Don't miss the latest Dark Reading Confidential podcast, where we talk to two cybersecurity professionals who were arrested in Dallas County, Iowa and forced to spend the night in jail — just for doing their pen-testing jobs. Listen now!

**About the Author**

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline Journalism (Online) in 2003 for coverage of the Blaster worm. Crunches numbers on various trends using Python and R. Recent reports include analyses of the shortage in cybersecurity workers and annual vulnerability trends.

NFL Teams Block &amp; Tackle Cyberattacks in a Digital World

To prevent this, organizations should focus on developing secure hardware and firmware foundations, enabling them to manage, monitor, and remediate hardware and firmware security.

Boris Balacheff, Chief Technologist for Security Research and Innovation, HP Inc. Security Lab

September 13, 2024

5 Min Read

Source: NicoElNino via Alamy Stock Photo

COMMENTARY

Operational resilience is becoming a watchword of IT and business leaders, and for good reason. Global IT infrastructure is now highly interconnected and interdependent and must be resilient to all manner of threats. But one of the most overlooked cybersecurity risks — and a blind spot highlighted in a recent HP Wolf Security survey — is the challenge of mitigating hardware and firmware threats. Hardware supply chain security does not end with devices being delivered. It extends through the entire lifetime of devices being used in the infrastructure and even beyond, when repurposed from one owner to the next. 

Disruptions to the hardware supply chain can take many forms: from physical supply chain disruptions by ransomware groups to tampering with hardware or firmware to deploy stealthy and persistent malicious implants at any stage of the device's lifetime. These attacks undermine the hardware and firmware foundations of devices upon which all software runs, making it critical that organizations are equipped with endpoints designed from the ground up to be resilient to such threats.

Governments have started to act to strengthen supply chain security. In 2021, US Executive Order 14028 accelerated the development of software supply chain security requirements for government procurement, with firmware explicitly in scope. The European Union (EU) is introducing new cybersecurity requirements at every stage of the supply chain, starting with software and services, with the Network and Information Systems (NIS2) directive, and extending to devices themselves with the Cyber Resilience Act to ensure safer hardware and software. Many other countries are active in this space, such as the UK with its new Internet of Things (IoT) cybersecurity regulations, and the Cyber Security and Resilience Bill to “expand the remit of regulation to protect more digital services and supply chains.”

Meanwhile, organizations are grappling with hardware and firmware threats. Thirty-five percent of organizations say that they or others they know have been affected by state-sponsored actors trying to insert malicious hardware or firmware into PCs or printers. Amid this regulatory backdrop and growing concerns over supply chain attacks, organizations must consider a new approach to physical device security.

**The Impact of Attacks on Hardware and Firmware Integrity**

The consequences of failing to protect endpoint hardware and firmware integrity are severe. Attackers who successfully compromise devices at the firmware or hardware layer can gain unparalleled visibility and control. The attack surface exposed by lower layers of the technology stack have been a target for some time for skilled and well-resourced threat actors, like nation-states, because they enable a stealthy foothold below the operating system. These offensive capabilities can quickly find their way into the hands of other bad actors. Compromises at the hardware or firmware level are persistent, providing attackers with a high level of control over everything on the system. They're hard to detect and remediate with current security tools that typically focus on OS and software layers. 

Given the stealthy nature and sophistication of firmware threats, real-world examples are not as frequent as malware targeting the OS. Examples like LoJax, in 2018, targeted PC UEFI firmware to survive OS reinstalls and hard drive replacements on most devices, which didn't have state-of-the-art protection. More recently, the BlackLotus UEFI bootkit was designed to bypass boot security mechanisms and give attackers full control over the OS boot process. Other UEFI malware, such as CosmicStrand, can launch before the OS and security defenses, allowing attackers to maintain persistence and facilitate command-and-control over the infected computer.

Organizations are also concerned about attempts to tamper with devices in transit, with many reporting being blind and unequipped to detect and stop such threats. Seventy-seven percent of organizations say they need a way to verify hardware integrity to mitigate the threat of device tampering.

**Bringing Security Maturity to Endpoint Hardware and Firmware**

As a community, we have matured our processes to manage and monitor software security configuration over the life of a device, and we are improving our ability to track software provenance and supply chain assurance. It's time to bring the same levels of maturity to the management and monitoring of hardware and firmware security, throughout the entire lifetime of endpoint devices. Because devices, as long as they are in use, constitute the hardware supply chain for an organization. 

The technical capabilities to enable this across devices have not been available broadly, because it all must start with security by design from the hardware up. This is an area that we have been investing in for more than two decades, and today, the foundations are in place. Organizations should start actively adopting the capabilities available from manufacturers and devices for security and resilience, to proactively take control of hardware and firmware security management across their devices' life cycle.

There are four key steps organizations can take to proactively manage device hardware and firmware security:

*   Securely manage firmware configuration throughout the life cycle of a device, using digital certificates and public-key cryptography. This enables administrators to manage firmware remotely and eliminate weak password-based authentication. 
    
*   Take advantage of vendor factory services to enable robust hardware and firmware security configurations right from the factory.
    
*   Adopt platform certificate technology to verify hardware and firmware integrity once devices have been delivered.
    
*   Monitor ongoing compliance of device hardware and firmware configuration across your fleet of devices — this is a continuous process that should be in place as long as devices are in use by the organization.
    

System security relies on strong supply chain security, which starts with the assurance that devices, whether PCs, printers, or any form of IoT, are built and delivered with the intended components. This is why organizations should increasingly focus on developing secure hardware and firmware foundations, enabling them to manage, monitor and remediate hardware and firmware security throughout the lifetime of any device in their fleet.

Hardware Supply Chain Threats Can Undermine Endpoint Infrastructure

A technique to abuse Microsoft's built-in source code editor has finally made it into the wild, thanks to China's Mustang Panda APT.

Source: Postmodern Studio via Alamy Stock Photo

A Chinese state-aligned espionage group has become the first documented threat actor to weaponize a known exploit in VS Code in a malicious attack.

Visual Studio Code, or VS Code, is Microsoft's free source code editor for Windows, Linux, and macOS. According to Stack Overflow's 2023 survey of 86,544 developers, it's the most popular integrated development environment (IDE) among both new (78%) and professional developers (74%), by some distance. The next most popular IDE, Visual Studio, was used by 28% of respondents.

In September 2023, a threat researcher described how an attacker could take advantage of a VS Code feature called "Tunnel" to gain initial access to a target's environment. Initially, the tactic was just fodder for red teaming. Now, according to Palo Alto Networks' Unit 42, China's Mustang Panda (aka Stately Taurus, Bronze President, RedDelta, Luminous Moth, Earth Preta, and Camaro Dragon) has used it in an espionage attack against a government entity in southeast Asia.

"The technique described requires an attacker to have previously gained code execution privileges on a target machine," a Microsoft spokesperson tells Dark Reading. "As a security best practice, we encourage customers to practice good computing habits online, including exercising caution when clicking on links to web pages or opening unknown files."

**Turning VS Code Into a Reverse Shell**

"One of the worst fears as a cybersecurity expert is detecting and preventing a signed reverse shell binary," Truvis Thornton wrote, a whole year prior to Unit 42's latest research. "Guess what? Microsoft gladly gave us one."

First introduced in July 2023, VS Code Tunnel allows users to share their VS Code environments on the open Web, and only requires authentication through a GitHub account.

An attacker with their victim's GitHub credentials could do damage, but much worse is the fact that one can remotely install a portable version of VS Code on a targeted machine. Because it's a legitimate signed binary, it will not be flagged as suspicious by security software.

And yet, it will walk and talk like a reverse shell. By running the command "code.exe tunnel," the attacker opens a GitHub authentication page, which they can log into with their own account. Then they're redirected to a VS Code environment connected to their target's system, and free to execute commands and scripts and introduce new files at will.

Mustang Panda — a 12-year-old advanced persistent threat (APT) known for espionage against governments, nongovernmental organizations (NGOs), and religious groups in Asia and Europe — used this playbook to perform reconnaissance against its target, drop malware, and, most importantly for its purposes, exfiltrate sensitive data.

**How to Deal with VSCode**

"While the abuse of VSCode is concerning, in our opinion, it is not a vulnerability," Assaf Dahan, director of threat research for Unit 42, clarifies. Instead, he says, "It's a legitimate feature that was abused by threat actors, as often happens with many legitimate software (take lolbins, for example)."

And there are a number of ways organizations can protect against a bring-your-own-VSCode attack. Besides hunting for indicators of compromise (IoCs), he says, "It's also important to consider whether the organization would want to limit or block the use of VSCode on endpoints of employees that are not developers or do not require the use of this specific app. That can reduce the attack surface." 

"Lastly, consider limiting access to the VSCode tunnel domains '.tunnels.api.visualstudio\[.\]com' or '.devtunnels\[.\]ms' to users with a valid business requirement. Notice that these domains are legitimate and are not malicious, but limiting access to them will prevent the feature from working properly and consequently make it less attractive for threat actors," he adds.

**A Second, Overlapping Attack**

While investigating the Mustang Panda attack, Unit 42 came across a second threat cluster occupying the same target's systems.

In this case, the attacker abused imecmnt.exe — a legitimate and signed file associated with Microsoft's Input Method Editor (IME), used for generating text in languages not conducive to the QWERTY keyboard — with some dynamic link library (DLL) sideloading. The file they dropped, ShadowPad, is a 7-year-old modular backdoor popular among Chinese threat actors.

This compromise occurred at the same time as the VS Code exploitation, often on the same endpoints, and the overlaps didn't end there. Still, researchers couldn't say for certain whether this second cluster of malicious activity could be attributed to Mustang Panda. "There could also be other possible scenarios to explain this connection," they wrote. "For example, it could be a joint effort between two Chinese APT groups or perhaps two different groups piggybacking on each other's access."

Don't miss the latest Dark Reading Confidential podcast, where we talk to two cybersecurity professionals who were arrested in Dallas County, Iowa, and forced to spend the night in jail — just for doing their pen-testing jobs. Listen now!

**About the Author**

Nate Nelson is a freelance writer based in New York City. Formerly a reporter at Threatpost, he contributes to a number of cybersecurity blogs and podcasts. He writes "Malicious Life" -- an award-winning Top 20 tech podcast on Apple and Spotify -- and hosts every other episode, featuring interviews with leading voices in security. He also co-hosts "The Industrial Security Podcast," the most popular show in its field.

Microsoft VS Code Undermined in Asian Spy Attack

Their findings highlight the frailty of some of the mechanisms for establishing trust on the Internet.

Source: Aree\_S via Shutterstock

Security researchers' ability to gain control of a chunk of the Internet's infrastructure for a mere $20 has focused attention on the fragility of the trust and cybersecurity mechanisms that organizations and users rely on daily.

The troubling event began with researchers at watchTowr on a whim looking for remote code execution vulnerabilities in WHOIS clients while at the recent Black Hat USA conference in Las Vegas. In poking around, the researchers discovered that the WHOIS server for the .mobi top level domain (TLD) — for mobile-optimized sites — had migrated a few years ago from "whois.dotmobiregistry.net" to "whois.nic.mobi". After the change, the registration for the original domain (whois.dotmobiregistry.net) expired last December.

**An Accidental Discovery**

A WHOIS server is like a public phone book for the Internet and contains information on the owners of an IP address or website along with lots of other related information. A WHOIS client is a tool that queries for and retrieves information about a specific domain name or IP address from a WHOIS server.

On a lark, the watchTowr researchers spent $20 to register the expired whois.dotmobiregistry.net in the company's name and stick a WHOIS server behind it to see if any WHOIS clients would query it. Their initial presumption was that few, if any, WHOIS clients would still touch the decommissioned server after the migration to the new .mobi authoritative WHOIS server (whois.nic.mobi) a few years ago.

To their surprise — and consternation — watchTowr researchers found over 76,000 unique IP addresses sending queries to their WHOIS server in just a couple hours. In about two days that number had ballooned to over 2.5 million queries from 135,000 unique systems worldwide.

Contrary to their expectations, among those querying watchTowr's WHOIS server were major domain registrars and websites performing WHOIS functions. Also querying watchTowr's WHOIS domain were mail servers for numerous government organizations in the US, Israel, Pakistan, India, the Philippines, a military entity in Sweden, and countless universities worldwide. Troublingly, even some security-related websites, including VirusTotal, queried watchTowr's WHOIS server as if it were the authoritative server for the .mobi TLD.

Had watchTowr been a bad actor, they could have easily abused their status as the owner of whois.dotmobiregistry.net to deliver malicious payloads to anyone querying the server, or to passively monitor email communications and potentially create other mayhem.

"In the wrong hands, owning the domain could enable attackers to 'respond' to queries and inject malicious payloads to exploit vulnerabilities in WHOIS clients," watchTowr's CEO and founder Benjamin Harris said in a FAQ on his company's discovery. From the standpoint of government mail servers reaching out to watchTowr's WHOIS servers, "traffic analysis can be performed to passively observe and infer email communication," he said.

**A Serious Domain Verification Weakness**

But even more troubling than that was watchTowr’s discovery of multiple Certificate Authorities (CA) — including those issuing TLS/SSL certificates for domains such as ‘microsoft.mobi and ‘google.mobi — using watchTowr’s server for domain verification purposes.

"It turns out that a number of TLS/SSL authorities will verify ownership of a domain by parsing WHOIS data for your domain— say watchTowr.mobi — and pulling out email addresses defined as the 'administrative contact'," watchTowr said. "The process is to then send that email address a verification link. Once clicked, the certificate authority is convinced that you control the domain that you are requesting a TLS/SSL cert for, and they will happily mint you a certificate."

In other words, watchTowr could provide its own email address to certificate authorities (CAs) in response to domain ownership queries and obtain TLS/SSL certificates on behalf of other organizations. Once again, contrary to expectations, watchTowr discovered multiple well known CAs — including Trustico, Comodo, GlobalSign, and Sectigo — using WHOIS data for domain verification.

"For 'microsoft.mobi', watchTowr demonstrated that CA GlobalSign would parse responses provided by its WHOIS server and present '\[email protected\]' as an authoritative email address," the security vendor said. "watchTowr's discovery effectively undermines the certificate authority process for the entire .mobi TLD, a process that has been targeted by nation-states overtly for years." The research highlights the trivial loopholes in the Internet's TLS/SSL vital encryption processes and structures and shows why trust in them is misplaced at this stage, the researchers wrote.

Nick France, CTO at Sectigo, says the issue has to do with CAs being allowed to use administrative emails on public WHOIS records for domain names. "However, the researchers found that the .mobi registry had changed their WHOIS server in the past and the 'old' name was now available as a registerable domain name — which they did," France says.

This is only a problem if a CA uses an outdated list of WHOIS server, he says. In that event, a CA's WHOIS query could get directed to an outdated server and any attacker that owns it could send any output in response, including an email address of their choice. "This leads to a failure of the domain verification process and thus mis-issued certificates."

The issue that watchTowr discovered highlights why CAs must keep their systems updated, especially with respect to critical processes like domain control validation, French says. "WHOIS is an old, insecure system — often neglected by researchers and users alike, leaving it primed for the discovery of flaws like this one," he notes.

While it may impact only smaller TLDs like .mobi, as opposed to .com, .net, and .gov, it still demonstrates a serious vulnerability in the domain verification process, he says.

Tim Callan, Sectigo's Chief Experience Officer, adds how the incident highlights a need to update some of the rules around Domain Control Validation (DCV). "We should expect the Certification Authority Browser Forum to move quickly on these changes in order to plug this particular hole."

In the meantime, the nonprofit Internet monitoring entity ShadowServer has sinkholed the dotmobiregistry.net domain and the whois.dotmobiregisry.net hostname and is redirecting all queries to the server to the legitimate WHOIS responsible for .mobi domains. "If you have code/systems still using the expired http://whois.dotmobiregistry.net to make WHOIS queries for the .mobi TLD, please update immediately to use the correct authoritative WHOIS server http://whois.nic.mobi," said Piotr Kijewski, ShadowServer's CEO in an email.

Don't miss the latest Dark Reading Confidential podcast, where we talk to two cybersecurity professionals who were arrested in Dallas County, Iowa and forced to spend the night in jail -- just for doing their pen-testing jobs. Listen now!

**About the Author**

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year career at Computerworld, Jai also covered a variety of other technology topics, including big data, Hadoop, Internet of Things, e-voting, and data analytics. Prior to Computerworld, Jai covered technology issues for The Economic Times in Bangalore, India. Jai has a Master's degree in Statistics and lives in Naperville, Ill.

Source

DARKReading