SolarWinds Updates; Mobile Device Emulators in Massive Bank Account Theft; DoJ Seizes Fake COVID Domains

The use of SAML to support federated authentication has been a huge enabler for cloud services, and also to allow for alternative authentication mechanisms including SSO, MFA, as well as changing the authentication requirement based on location. Attackers are using forged SAML tokens to access your cloud services, particularly email systems, but also any insourced applications using federated authentication. This is done either by stealing the private key which signs SAML authentication tokens, or by obtaining sufficient privileges to create new trust relationships. Verify the security configuration of federated authentication components and monitor for any malicious behavior. Talk to your cloud service providers about their use of SolarWinds and their response plans, if any.

Lee Neely

When considering the impact of email account compromise, look beyond BEC to other services, such as file, meeting, and collaboration services protected by the same authentication tokens. Verify trust relationships used with federated authentication are genuine, and that they are also verifying their security.

Lee Neely

A key lesson from this supply chain compromise is that defensive controls by themselves are not enough. No matter how robust they are, you also need good and effective detective and responsive controls in place. Do not think of your defensive controls as ways to stop attackers but as ways to detect an attacker fast enough and delay the attacker long enough for you to respond to them.

Brian Honan

While all SolarWinds customers must be assumed to have been compromised, many are not immediate targets. All should apply updates, assume that there are now backdoors on their networks, and attempt to isolate the backdoors with "zero trust" strategies on a timely basis. These strategies are indicated for most large enterprises in any case.

William Hugh Murray

As the discovered depth of compromise of SolarWinds systems increases, it becomes prudent to consider all versions of SolarWinds Orion as suspect, include copies deployed on isolated or air-gapped networks; follow CISA guidelines for response and mitigation. https://us-cert.cisa.gov/ncas/alerts/aa20-352a#mitigations

Lee Neely

This attack involved fraudulent credential reuse. Both bankers and their customers should require strong authentication on mobile banking apps. This should include the use of device identifiers that are difficult to mimic.

William Hugh Murray

While customers should expect security representations from vendors, history suggests that they be taken with a grain of salt. Vendors making such claims should specify the limits of the remedy that they will offer when they fail to meet their security goals.

William Hugh Murray

The mitigation is to update to iOS 14. This attack was very targeted, and leveraged zero-click infection vectors, making it both harder to detect, and harder to prevent, as there was no user action required. Even so, enable on-device protection mechanisms to block or filter unknown senders to prevent messages from being processed.

Lee Neely

It appears that this attack was narrowly focused, required a lot of special knowledge, but no special privileges. Current versions of iOS are not vulnerable to this attack, but it seems clear that iOS is a continuing target, at least in part because it is relied upon by so many for so much.

William Hugh Murray

Having a certificate like this provides visibility to user action rather than preventing cyber attacks. A different approach is needed to truly provide endpoint protection and should not be limited to only certain sites.

Lee Neely

This is the logical equivalent of a postal service requiring the use of stamps that send a copy of every letter to the government. That is not a recipe for high levels of security.

John Pescatore

Apple and Google already do limited versions of this in the Safari and Chrome browsers. There is increasing demand from consumers for privacy, as well as increased government scrutiny of intrusive practices (well, not so much in Kazakhstan...). Good to let the product/business side know that privacy and security are increasingly features of top products, not impediments to their adoption and use.

John Pescatore

Kudos to Europol and the European Commission for this initiative. This now enables smaller EU member states' police forces access to decryption technologies that normally are the preserve of police forces with much larger budgets. Having a centralized platform also enables better intelligence and data analysis capabilities targeting criminal activities.

Brian Honan

Such efforts are most likely to succeed against device encryption where the key, the method, and the cryptogram are all available, at least at some cost. They are more expensive for message encryption, and so expensive that they cannot be used for wide-spread surveillance.

William Hugh Murray