Educate Users to Recognize MFA “Prompt Bombing”; Don’t Expose UPS Devices to the internet; Install Apple Patches ASAP

No legitimate business would ever communicate to customers in a manner that even came close to “prompt-bombing.” That makes this a good attack technique to educate users on, as it is pretty easy for them to recognize. More modern FIDO2-based MFA approaches are more resistant to this, but every form of authentication will have to have backup approaches that can be “bombed” as well.

John Pescatore

Red Teams have been using this technique for years as part of testing people and process in addition to the MFA implementation itself. Offense needs to continue to inform defense and defense inform offense. There is no reason this should be news or considered novel. If it is, your Red Team did not do their job.

Jorge Orchilles

here are two forms of this technique. The first overwhelms you with requests to approve a login and hopes you ultimately relent and let it in. The second is a few requests spread out in hopes you won’t notice and approve it without question. Make sure to train users to accept or allow only authentication permission requests they know are legitimate.

Lee Neely

UK Police arrested 7 males suspected of being part of the Lapsus$ gang. All but two have been released. The remaining two individuals are aged 16 and 17. They have been charged with various cyber-crime related offences and will appear in court. https://www.bbc.com/news/technology-60953527

Brian Honan

I have seen systems like this exposed to the Internet to obtain the ability to reboot systems without having to rely on VPNs or other security devices that may require to be rebooted. At the VERY LEAST, use TLS and limit the IP addresses that are able to reach the UPS (or power controller). TLS can be a bit tricky with these devices as they are usually just slapping a standard TLS library on minimal hardware that is years old. You may need to limit what ciphers are being used to get a reliable connection. But a little bit of TLS is better than no TLS (and well... I guess if a couple hundred $$ for a secondary VPN/FW is too expensive, you probably stopped caring anyway).

Johannes Ullrich

The target is large sized UPSs which are Internet reachable with the goal of causing large outages. If your UPS is network connected, isolate that traffic to make sure only legitimate devices and users can access it. Ideally never expose control interfaces directly to the Internet.

Lee Neely

Good advice and practice for all appliances and controls connected to the public networks.

William Hugh Murray

We do not have a lot of details to go by here, but update your Apple devices over the weekend. Just be careful if you still using macOS 12.1 (instead of 12.2): macOS 12.2 removes Python 2 which MAY be required by some software you are using. One example being the Indigodomo home automation software.

Johannes Ullrich

Seems like we just kicked off rolling out 15.4. This update primarily addresses CVE-2022-22675 which is being exploited for RCE, so reset the process for 15.4.1. The last two iOS updates have resulted a noticeable battery drain when using push notifications for mail and calendar messages. A workaround was to switch to fetch instead. It is far simpler to apply the update fixing both issues.

Lee Neely

VPN appliances are turning up in more and more high-profile attacks. Monitoring VPN access, patching appliances and regular configuration reviews should be on your "to do" list. (But don't worry if you are not going STRONG MFA and still relying on passwords to authenticate. You are behind the curve too far already.)

Johannes Ullrich

Viasat has confirmed the attack was due to new wiper malware with possible ties to the Russian government. https://arstechnica.com/information-technology/2022/03/mystery-solved-in-destructive-attack-that-knocked-out-10k-viasat-modems/:

Brian Honan

When faced with a significant outage, make sure that you have closed the attack vector prior to taking steps to restore service (such as deployment of replacement devices) so the replacements don’t immediately suffer the same fate as their predecessors.

Lee Neely

If lessons learned from Struts, Log4j, and others were implemented, your organization should have a decent inventory of which applications leverage the impacted frameworks.

Jorge Orchilles

Recent efforts have focused on providing open-source projects with secure coding reviews and tools. But open-source projects also need the ability to quickly respond to security issues and publish meaningful guidance for users. 24 hours isn't bad, but in this case too slow.

Johannes Ullrich

There is a good news side to this story: Secure BGP configurations by Twitter as well as by ISPs around the globe prevented this issue from spreading much beyond the initial misconfiguration. BGP security is improving.

Johannes Ullrich

This is not a big deal because your QNAP device should not be exposed to the public anyway, and it is just a DDOS. It is only making the news because QNAP cares enough to let its users know.

Johannes Ullrich

The ultimate fix is to apply the QNAP update when it it released. While you’re waiting, make sure that you’re not exposing these devices to the Internet, and only authorized devices can reach the administration interfaces. Review for and remove any unexpected user accounts and applications.

Lee Neely

I’m reminded of projects that didn’t have clear ownership and commitment to deliver. Make sure you’re tracking flaw remediation activities, whether code reviews or monthly patch application, to ensure nothing falls through the cracks.

Lee Neely

The bill requires VA to use a Federally Funded Research and Development Center (FFRDC) to perform the assessment. No offense to FFRDCs, but some are very good at cybersecurity, and some are very good at cancer research or optical-infrared astronomy – but cybersecurity, not so much. The bill’s language says the FFRDCs must “… take into account industry best practices and the current state-of-the-art in cybersecurity evaluation and review.” The bill should just allow private security firms that are setting those best practice/state-of-the-art standards to compete for the assessment.

John Pescatore

Can you detect unauthorized services on your network? How about cloud services - do you allow all of them or only those authorized? The VA is already tasked with authorization of all systems processing their data, including shutting down or blocking rogue or unauthorized devices and applications. In either case, what’s your response? Make sure you know your risk tolerance.

Lee Neely