Barracuda Urges Users to Replace Compromised ESGs; CL0P Ransomware Group is Exploiting MOVEit Vulnerability; Prioritize MFA

It is always recommended to rebuild systems involved in a compromise "from scratch," and to not just remove specific artifacts left behind by the attacker. But we hardly ever see a vendor's full support. I have not seen details about how Barracuda will replace the devices (easier if they are virtual), but applaud Barracuda. In particular for somewhat customized appliances, it can be difficult to conclusively assess what modifications were made by an attacker.

Johannes Ullrich

A long list of email security and web security gateways have been announcing discovering long resident zero days. Good idea to preemptively check patch status of ESGs and WSGs appliances in particular, and to prioritize threat hunting on those network segments.

John Pescatore

Barracuda had previously said they were replacing affected appliances or virtual machines, which has likely generated a queue for physical hardware, so don't wait, get ahold of your sales rep (now) to not only get your request queued up, but also find out what your options are. Have your staff brush up on the replacement process, you don't want the replacement sitting on a shelf, or running in parallel or standby any longer than is absolutely needed. Consider recreating the configuration rather than exporting it from a potentially compromised device.

Lee Neely

Well, this is the worst-case scenario. If someone has a Barracuda Email Security Gateway they want to send my way instead of sending it to the trash, I’m happy to have it. Will this keep Barracuda customers in their eco-system or move them to a cloud-based service? Hard to tell what the impact here is since many customers may be used to refreshing this hardware frequently.

Moses Frost

It seems as though email security gateways have been a target of evil-doers over the last year. Even if you don’t use Barracuda appliances, I still recommend checking patch status for your chosen email security gateway. For Barracuda users, no time like the present to have that difficult customer service discussion with them… and update the appliance.

Curtis Dukes

The major finding was a failure to move to MFA for most (89%) of high value assets. The DoI response was to cite many memos that were written and to state “The Department and the bureaus and offices will take a risk-based approach in prioritizing the conversion of systems and applications from legacy authentication methods to MFA.” There is no real risk-based approach that wouldn’t prioritize moving away from reusable passwords for critical systems. The issue is not risk assessment, it is overcoming bureaucratic and operational obstacles to having a successful transition to strong, phishing-resistant authentication.

John Pescatore

This problem is easier to work today than even five years ago. Everyone got excited about not having to change passwords when NIST SP 800-63-3 came out a few years back. Unfortunately, many didn't catch the part about reviewing them against breach data, not allowing banned words, etc. The good news is there are services you can integrate with your domain controllers to help AD managed passwords meet these requirements, including services in Microsoft Azure. Even so, you're not done at that point: you need to make sure that local passwords and systems not authenticating against AD are included. The good news is most applications now support SAML 2.0 or other mechanisms your IDP already speaks, and the IDP can enable SSO, MFA, and other authentication improvements without re-working the services and applications behind them.

Lee Neely

This OIG report simply highlights the fact that [weak] passwords are still the primary authentication mechanism throughout the federal government. EO 14028, Improving the Nation’s Cybersecurity, called for a move to a zero-trust architecture, with an emphasis on multi-factor authentication (MFA). OMB followed shortly with their own memorandum, M-22-09, that required agencies to meet specific cybersecurity standards in the EO by end of FY2024. I suspect password changes will be made in the short-term but doubtful that we’ll see a move to MFA for another year or so.

Curtis Dukes

The attack included systems both in and out of Japan, so the impacts may be broader than you may think. Here is a good example of what a prepared response team can do. Note that they are also making a forward-looking statement looking at financial impacts - giving a heads-up to stakeholders sooner than later.

Lee Neely