Perimeter Security Devices from Citrix, Sonicwall, and Ivanti Continue to Put Enterprises at Risk

Citrix, Ivanti, Sonicwall. This edition of NewsBites covers three different known to be exploited vulnerabilities in commercial perimeter security devices. This shouldn't be news to anybody. Back in 2020, we added this as one of our top attack vectors for our annual RSA keynote. You must include perimeter devices in your vulnerability management process and you must be able to mitigate vulnerabilities within days, not weeks, months or years.

Johannes Ullrich

This is separate from the November/December CitrixBleed flaw, but with the success of those exploits, threat actors are likely to be seeking similar results with these, particularly CVE-2023-6548. Apply the update, then make sure the management interface is either logically or physically isolated. Beyond this flaw, threat actors are searching for, finding, and attacking exposed management interfaces. While it’s increasingly necessary for these to be available for remote support, you still need to only access them via a secure pathway.

Lee Neely

The vulnerability has been exploited since before it was made public. But with PoC exploits being available now, internet-wide scanning for vulnerable devices has started. At the Internet Storm Center, our honeypots have picked up some of the exploit attempts starting Wednesday.

Johannes Ullrich

If you were delaying, waiting for the patch, or concerned about the impacts of the mitigation, you need to get it deployed now, and check for IOCs. Per Volexity, the early exploits started on December 3rd, but as of Jan 11th, the scanning and attempted exploits went through the roof. Three tasks here: first, make sure the mitigations are in place; fecond, based on the release date for the patch for your version of the VPN, have a deployment plan with dates; third, make sure your remote access and boundary control devices are at the top of the list when it comes to applying patches/security updates.

Lee Neely

What’s concerning is that for one vulnerability, 62% of devices are vulnerable two years later. For the other vulnerability, 76% of devices are vulnerable one year later. It speaks to a lack of a patch management process in those organizations. It’s hard for them to be able to demonstrate a standard duty of care should they be attacked and subsequently hauled into court. Follow the mitigation advice, remove the web management interface from public access, and update the firmware.

Curtis Dukes

This is being referred to as the LeftoverLocals vulnerability, and the flaw is used to read another user’s data in the GPU. Not every affected device has a patch or mitigation yet. Patches are being developed by AMD, Qualcomm and other chip manufacturers; expect those around March. Google has released updates to ChromeOS, Apple has a fix in their M3 and A17 chips, and devices with as far back as their A12 CPU, with the latest OS, are also fixed. Exploiting the flaw requires local access, so start with making sure you’re monitoring for unauthorized accounts or unexpected application. Make sure you’re keeping the firmware and OS current.

Lee Neely

This is a good example of the ROI of a well-managed bug bounty program, paired with the processes, resources and willpower to rapidly fix vulnerabilities found in your products or services. Investment in both is required but there are many success stories to point out demonstrating great rates of return on the overall investment in your customers’ safety.

John Pescatore

GitHub has been highly responsive in mitigating this vulnerability. Rotating, or changing the cryptographic keys, is a standard security practice. Well done GitHub!

Curtis Dukes

This is Google Chrome’s first zero-day of 2024. Given its large install base globally, it has become a frequent target of both hackers and security researchers. Simply refresh your browser to install the latest version of the browser.

Curtis Dukes

The Rapid SCADA platform is open source and very attractive to small-to-medium businesses for developing OT systems. There are no patches available at this time, so the risks have to be mitigated via isolation (segmentation, not Internet accessible, only access from approved devices) and monitoring. Given the target is a SMB, it’s likely the best strategy is to make sure they have a VPN to access the system versus making it directly accessible.

Lee Neely

While this is directed towards critical infrastructure, we should all read it. The guidance outlines the risks of Chinese-manufactured UAS, to include what the manufacturer is compelled to provide to the PRC. Consider that the threat not only includes data collected while in operation but also includes risks in any provided firmware updates. The guidance also points to the DOD Blue cleared UAS list (https://www.diu.mil/blue-uas-cleared-list) for devices which don’t have these risks.

Lee Neely

China’s 2017 national intelligence law does require Chinese companies to ‘work’ with the government and is very concerning. That said, there is already large usage of drone technology in this country, many of which are manufactured in China. I’m afraid the guidance is a tad late and given it doesn’t require replacement, likely not to be followed.

Curtis Dukes

The FTC is flexing its regulatory muscle to protect user ‘opt-out’ requests. Separately, over the last two years, several states have enacted privacy legislation. For those states, the AG can use the FTC order to pursue data aggregators operating in their state.

Curtis Dukes

This was only a week after the ban on Outlogic. Data brokers are being held to not only obtaining consent for use of precise location data, but also the retention of that data (InMarket was keeping it for five years). InMarket permission indicated the data would be used for discounts and promotions. This is also embedded in the InMarket SDK, which has been incorporated into over 300 applications. Time to double check the location sharing settings on your apps, particularly where it doesn’t make sense, such as a photo editing app.

Lee Neely

While there are claims this is a LockBit attack, the attackers aren’t following LockBit’s normal process. For example: LockBit discloses the victim on their DarkWeb site, not by defacing their website. Further, there have been an increasing number of attacks on Taiwanese companies relating to their recent elections as China would like to see a change in their ruling party. Most of these manifested as DDoS attacks. As LockBit is not a politically motivated group, if they were indeed behind this, it would be for some other reason, such as financial gain.

Lee Neely