The IT Nerd

CircleCI, a company that develops testing and deployment tools for software engineers, has shared details about how hackers broke into its systems last month and compromised customer data. CircleCI chief technology officer Rob Zuber said hackers gained access to its networks after infecting an employee’s laptop with malware. And here’s what happened next:

On December 29, 2022, we were alerted to suspicious GitHub OAuth activity by one of our customers. This notification kicked off a deeper review by CircleCI’s security team with GitHub.

On December 30, 2022, we learned that this customer’s GitHub OAuth token had been compromised by an unauthorized third party. Although that customer was able to quickly resolve the issue, out of an abundance of caution, on December 31, 2022, we proactively initiated the process of rotating all GitHub OAuth tokens on behalf of our customers. Despite working with GitHub to increase API rate limits, the rotation process took time. While it was not clear at this point whether other customers were impacted, we continued to expand the scope of our analysis.

By January 4, 2023, our internal investigation had determined the scope of the intrusion by the unauthorized third party and the entry path of the attack. To date, we have learned that an unauthorized third party leveraged malware deployed to a CircleCI engineer’s laptop in order to steal a valid, 2FA-backed SSO session. This machine was compromised on December 16, 2022. The malware was not detected by our antivirus software. Our investigation indicates that the malware was able to execute session cookie theft, enabling them to impersonate the targeted employee in a remote location and then escalate access to a subset of our production systems.

Because the targeted employee had privileges to generate production access tokens as part of the employee’s regular duties, the unauthorized third party was able to access and exfiltrate data from a subset of databases and stores, including customer environment variables, tokens, and keys. We have reason to believe that the unauthorized third party engaged in reconnaissance activity on December 19, 2022. On December 22, 2022, exfiltration occurred, and that is our last record of unauthorized activity in our production systems. Though all the data exfiltrated was encrypted at rest, the third party extracted encryption keys from a running process, enabling them to potentially access the encrypted data.

Clearly the threat actors knew who to target to get what they wanted. That’s scary. The company has put out a security alert that has been consistently updated since this incident happened. I’d spend some time reading this if you are using CircleCI products. An example of this is that Datadog’s RPM GPG signing keys and its passphrases were exposed during this breach. Anyone who uses their products, and any vendor who uses those products are potentially at risk.

Kevin Bocek, VP of Security Strategy and Threat Intelligence at Venafi had this to say: 

“Another day, another software supply chain attack. It’s clear that this type of threat isn’t going away. Targeting a developer tool and delivery platform, like CircleCI, was clearly intended to fly under the radar and slip into other development environments. In this case, they were able to gain access to Datadog’s environment meaning that its RPM GPG signing machine identities were exposed. Fortunately, Datadog has responded quickly to rotate the impacted identities and it doesn’t appear that they’ve been abused. But if an attacker had seized this opportunity, then it would have given them a very powerful weapon – potentially allowing them to spread across Datadog’s customer networks by enabling them to sign and send malware while appearing completely trusted. This could have had serious repercussions.

“This incident demonstrates the growing risk of attacks targeted at developers, machine identities and modern development pipelines. When combined with the speed of modern development, widespread use of automation and use of the cloud, an attacker with access to powerful machine identities can create ripples fast which are extremely hard to protect against or remediate. In a machine-driven world, having a control plane to manage the lifecycle of your machine identities is essential. As this incident shows, you can be doing all the right things and still find yourself exposed. All businesses – whether they be a software publisher, or a consumer of software – need to be able to automate controls that say who and what can and can’t be trusted, and to have the agility to respond to change.”

This isn’t a trivial hack and should not be treated as such. If you’re reliant on CircleCI products, you should be ensuring that you are not exposed. And you should double check with your vendors that they have done their due diligence as well.

For years I’ve argued that the auto industry has to step up its game in terms of security or something serious is going to happen to car owners. The best example of this that I can think of is when researchers took control of a Jeep remotely and was able to gain complete control of the car. That led to a recall to fix this along with a class action lawsuit and senate action. But clearly this continues to be an issue. Case in point is this work by Sam Curry.

We brainstormed for a while, and then realized that nearly every automobile manufactured in the last 5 years had nearly identical functionality. If an attacker were able to find vulnerabilities in the API endpoints that vehicle telematics systems used, they could honk the horn, flash the lights, remotely track, lock/unlock, and start/stop vehicles, completely remotely.

At this point, we started a group chat and all began to work with the goal of finding vulnerabilities affecting the automotive industry. Over the next few months, we found as many car-related vulnerabilities as we could. The following writeup details our work exploring the security of telematic systems, automotive APIs, and the infrastructure that supports it.

I really encourage you to read this. It’s not eye opening to me, but you’ll be shocked by what Curry has discovered and how many companies are affected by API vulnerabilities. Giora Engel, the CEO and Co-Founder of Neosec has this commentary:

“APIs are used to connect virtually every business and today they are largely unprotected. For most organizations they don’t even have an inventory of which APIs they created and expose to the outside and have no idea if any API is being abused. The reality is that for most businesses, the impact of API vulnerabilities and any abuse of that API results in data theft or monetary loss, which are certainly damaging. But in an automotive vehicle, the problem of abuse of any API is potentially physically dangerous to drivers on the road. Protecting APIs from behavioral abuse in the automotive industry is no longer optional. It is essential.”

Honestly, the car makers in this blog post by Sam Curry really need to up their game. Because if you buy a car, you should be assured that it is safe from being pwned by hackers. And what really bothers me is that the Jeep hack was in 2015. Thus you would have thought that this would be either less of an issue or a non issue by now. But I guess I expect too much from car makers who clearly don’t have security as their top priority.

Late yesterday I came across a report about the PurpleUrchin threat actor group. Here’s a quick synopsis about them:

The PurpleUrchin cryptomining campaign, first uncovered in October 2022, is characterized as a freejacking operation. While doing our own investigation of this threat actor, Unit 42 researchers found evidence that PurpleUrchin threat actors employed Play and Run tactics, using cloud resources and not paying the cloud platform vendor’s resource bill.

PurpleUrchin actors performed these Play and Run operations through the creation and use of fake accounts, with falsified or potentially stolen credit cards. These fake accounts held a pending unpaid balance. Although one of the largest unpaid balances we found was $190 USD, we suspect the unpaid balances in other fake accounts and cloud services used by the actors could have been much larger due to the scale and breadth of the mining operation.

The report goes into the details of their “play and run” scheme including the fact that:

• Some of the automated account creation cases bypassed CAPTCHA images using simple image analysis techniques. 
• The threat actors created fake accounts with stolen or fake credit cards.
• The creation of more than 130,000 user accounts on various cloud platform services like Heroku, Togglebox and GitHub was observed.

Crane Hassold, Director of Threat Intelligence at Abnormal Security had this to say:

“While the tactics described in the report rely on creating a large number of fake accounts and exploiting free trials, the same techniques could be used to leverage resources in an organization’s compromised cloud environment to accomplish the same goals. This is one of the reasons cloud credentials are so valuable in today’s underground cybercrime economy; they can be exploited in dozens of different ways.”

The report makes for some interesting reading and I would encourage you to read it as I can see how this sort of attack could be used for other means other than crypto mining. Thus organizations need to have the means to defend against these sorts of attacks.

Bad news for anyone who owns a Samsung, LG, Xiaomi among other Android phones. Apparently this phones have been left vulnerable to malicious apps with system-level privileges, following the leaking of their platform-signing keys:

As shared by Googler Łukasz Siewierski (via Mishaal Rahman), Google’s Android Partner Vulnerability Initiative (APVI) has publicly disclosed a new vulnerability that affected devices from Samsung, LG, and others.

The core of the issue is that multiple Android OEMs have had their platform signing keys leaked outside of their respective companies. This key is used to ensure that the version of Android that’s running on your device is legitimate, created by the manufacturer. That same key can also be used to sign individual apps.

By design, Android trusts any app signed with the same key used to sign the operating system itself. A malicious attacker with those app signing keys would be able to use Android’s “shared user ID” system to give malware full, system-level permissions on an affected device. In essence, all data on an affected device could be available to an attacker.

Notably, this Android vulnerability doesn’t solely happen when installing a new or unknown app. Since these leaked platform keys are also in some cases used to sign common apps — including the Bixby app on at least some Samsung phones — an attacker could add malware to a trusted app, sign the malicious version with the same key, and Android would trust it as an “update.” This method would work regardless of if an app originally came from the Play Store, Galaxy Store, or was sideloaded.

Google’s public disclosure doesn’t lay out which devices or OEMs were affected, but it does display the hash of example malware files. Helpfully, each of the files has been uploaded to VirusTotal, which also often reveals the name of the affected company. With that, we know the following companies’ keys were leaked (though some keys have not yet been identified):

• Samsung
• LG
• Mediatek
• szroco (makers of Walmart’s Onn tablets)
• Revoview

Yikes! I have a pair of comments from Venafi on this:

Tony Hadfield, Sr. Director of Solutions Architects at Venafi: “This is a great example of what happens when organizations sign code without a plan to manage code signing keys. If they keys fall into the hands of an attacker it can lead to catastrophic breaches. The only way to prevent this kind of problem is to have an auditable, ‘who/what/where’ solution: how do you control signing keys, where are they stored, who has access to them, and which kind of code gets signed? You need this information to protect your keys and also respond quickly to a breach by rotating your public and private keys.”

Ivan Wallis, Global Architect at Venafi: “This is a great example that showcases the lack of proper security controls over code signing certificates, in particular the signing keys for the Android platform. These certificate leaks are exactly related to this, where these vendor certificates made it into the wild, allowing for the opportunity for misuse and the potential to sign malicious android applications masquerading as certain “vendors”, similar to Solarwinds. Bad actors can essentially gain the same permissions as of the core service. The lack of the who/what/where/when around code signing makes it difficult to know the impact of a breach, because that private key could be anywhere. At this point it must be considered a full compromise of the code signing environment and key/certificate rotation must happen immediately.”

The article that I linked to has some really good advice in terms of protecting yourself. Specifically”

While the details of this latest Android security leak are being confirmed, there are some simple steps you can take to make sure your device stays secure. For one, be sure that you’re on the newest firmware available for your device. If your device is no longer receiving consistent Android security updates, we recommend upgrading to a newer device as soon as possible.

Beyond that, avoid sideloading applications to your phone, even when updating an app that’s already on your phone. Should the need to sideload an app arise, be sure you completely trust the file you’re installing.

This is advice that you should be following anyway as it will keep you safe from exploits of any type.

The UK Government has just updated their Network and Information Systems (NIS) regulations in order to bring providers of outsourced IT and managed service providers (MSPs) into scope. The regulations were introduced to improve the cyber security companies which provide services to energy, healthcare and transport sectors. Fines of up to £17m will could be issued for non-compliance.

Yaron Kassner, CTO and Cofounder, Silverfort had this commentary:

“The Government’s decision to update these regulations reflects how MSPs present a ripe target for attackers.

“As central points of cybersecurity management for lots of organizations – they provide a jumping-off point for lateral movement inside a large number of environments. As we saw with Operation Cloudhopper – attackers were able to access MSP customers using seemingly legitimate credentials, before moving through the network to exfiltrate data.

“While controls such as MFA on internal resources could technically help address attacks like this, the regulation provides a necessary impetus to ensure MSPs act according to best practice.”

Many clients that I work with use MSPs and they, along with anyone else who uses an MSP should heed this advice.

The Pentagon has put forward a Zero Trust strategy. The purpose of this is to guide the DoD how to direct their cybersecurity investments and efforts in the coming years to reach a “target” level of zero trust maturity over the next five years

The release of DoD’s zero trust strategy follows on the heels of the White House Office of Management and Budget’s federal zero trust strategy published earlier this year. DoD’s strategy lays out a detailed and ambitious plan for defense components to attain specific zero trust capabilities by 2027.

The aim is to counter a “rapid growth” in offensive cyber threats by shifting away from a perimeter defense model to a “never trust always verify” mindset, DoD Chief Information Officer John Sherman wrote in the foreword to the strategy.

Providing commentary on this strategy is Steve Judd, Solutions Architect at Venafi:

“The latest zero trust strategy from the Defense Department is an important step in ensuring investment is made to accelerate the adoption of zero trust. It’s encouraging to see that deadlines to submit execution plans and for completion have been set, as without these there is often a lack of urgency to act. The move towards a “never trust always verify” mindset is also very positive as an essential element of zero trust is identity. Every actor on the network – whether inside or outside the perimeter – must be authenticated and authorized with a valid identity. Yet what people often overlook is that there are two actors on the network: humans and machines. These machines include everything from cloud servers and Kubernetes clusters to servers and applications, with special levels of privileges to communicate with one another in a trusted and secure way. So, it’s important that any zero trust project takes machine identity into consideration alongside human identity management. The best way to enable this is through a control plane which automates the management of these machine identities.”

Groups outside the DoD should pay attention this as I am certain that this will be helpful to guide them as to how to make their environments much more secure.

The Ukrainian Computer Emergency Response Team (CERT) has issued a statement on a new attack campaign by suspected Russian threat actors which are compromised victims’ VPN accounts to access and encrypt networked resources. More details are available here:

Initial compromise is achieved by tricking victims into downloading “Advanced IP Scanner” software which actually contains Vidar malware. CERTU-UA believes this was achieved by initial access brokers (IABs) working for the Russians.

“It should be noted that the Vidar stealer, among other things, steals Telegram session data, which, in the absence of configured two-factor authentication and a passcode, allows unauthorized access to the victim’s account,” the statement continued.

“As it turned out, the victim’s Telegram was used to transfer VPN connection configuration files (including certificates and authentication data) to users. Given the lack of two-factor authentication when establishing a VPN connection, attackers were able to gain an unauthorized connection to the corporate network.”

Once inside, attackers conducted reconnaissance work using the Netscan tool and then launched Cobalt Strike Beacon, exfiltrating data using the Rclone program. There are also signs of the threat actors using Anydesk and Ngrok at this stage.

It’s unclear how widespread the campaign was, although “several” Ukrainian organizations are thought to have been impacted since spring 2022.

Most pointedly, CERT-UA confirmed that the end goal is not to generate profits from a ransom but to destroy victim environments.

Dr. Darren Williams, CEO and Founder, BlackFog had this comment:

“This is another great example of a clever phishing technique to disguise the attack vector inside another application. These are very difficult to detect with existing solutions because of the mechanism of action that steals VPN session information to ultimately exfiltrate data from the device. VPN’s have been routinely targeted in the past because they contain a treasure trove of valuable data for extortion and a centralized repository of data from the victim and the organization. Once the attacker has gained access it is very easy to spread laterally within the organization. This emphasizes why companies need to not only provide defense strategies but also proactive ones that protect an organization and its devices from unauthorized data exfiltration.”

This is clearly an attack meant to hurt Ukraine. Hopefully they are doing their best to make sure that attacks like this are not successful going forward. I say that because while they are winning on the the battlefield, the battlefield has changed to being cyberspace. And for the rest of us, I would say that 2FA for your VPN connections is a must to stop this sort of thing from happening to you.

There’s been a lot of activity this week on education cybersecurity. Starting with the federal student aid CISO begging the government to make cyber incident reporting for higher education institutions to be at the same standard as K-12 institutions, and a recent report from the GAO criticizing the U.S. Department of Education for not sufficiently coordinating communication between school districts and the feds on cybersecurity.

Stan Golubchik, Co-Founder and CEO, ContraForce, works directly with K-12 and higher education institutions to detect attacks and incidents. In response to Educause’s annual conference, specifically the education department and federal student aid office CISO on cyber incident reporting, Stan says: 

“While there are over 9,000 EdTech tools in the K12 space, it is unknown how many tools are actually used in Higher Education (HigherEd institutions are not held to the same standards of reporting as K12). This is precisely why the government is begging HigherEd to report on cyber attacks— because today, there is no reason for private colleges to report anything to anyone.”

“With the proliferation of remote education and SaaS applications, colleges struggle with knowing when incidents occur due to the distributed educational footprint. They lack visibility to security threats when they occur, and lack effective incident response plans and systems. With loose regulations on what should be reported in times of a breach, colleges will struggle to not only gather the information needed for reporting a breach but to understand what information is needed and how to communicate it.”

It’s pretty clear that cybersecurity within education needs to be a key focus as this is where threat actors will focus as the education sector tends not to have the same resources available for cybersecurity versus other organization. Effectively making them soft targets. Any sort of soft target needs to be eliminated so that everyone is safer as a result.

The White House who is very focused on cybersecurity has declared November to be Critical Infrastructure Security and Resilience Month:

This month, we recommit to improving the resilience of our Nation’s critical infrastructure so it can withstand all hazards — natural and manmade.  By building better roads, bridges, and ports; fortifying our information technology and cybersecurity across sectors, including election systems; safeguarding our food and water sources; moving to clean energy; and strengthening all other critical infrastructure sectors, we will lay the foundation for long-term security and prosperity.

The proclamation is an interesting read and I will give my thoughts in a second. First I’d like to share the thoughts of Craig Burland who is the CISO of Inversion6:

“This announcement continues a trend of active participation by the US government in cybersecurity.  Last week, CISA announced the Cross-Sector Cybersecurity Performance Goals.  The head of CISA has been working hard to build public-private partnerships to boost our collective defense.  CMMC is coming in 2023.  These are all positive steps that will help increase the mind-share cybersecurity occupies in corner offices and board rooms, especially for those that do business with the US government.  With the interdependency of the global supply chain and global economy, it’s in everyone’s best interest to do business securely.”

My thoughts go something like this. This administration is clearly focused on increasing America’s cybersecurity readiness. That’s a noble and required goal given the times that we live in. And initiatives like these will help to make sure that cybersecurity is at the forefront of every American company, and citizen.