SEC595: Applied Data Science and AI/Machine Learning for Cybersecurity Professionals
SEC595Cyber Defense, Artificial Intelligence
SANS Community Benefits
Connect, learn, and share with other cybersecurity professionals
Top of the News
Europol is Investigating Alleged Breach of Law Enforcement Info Sharing Portal
Europol is investigating a threat actors claims that they stole data from the Europol Platform for Experts (EPE), a collaborative platform for law enforcement for sharing best practices and other information. EPE has been offline since Friday, May 10. A Europol spokesperson has told multiple news sites that they are aware of the incident and [are]assessing the situation.
Editor's Notes
The attacker seems to have accessed a test environment using their Zscaler proxy to access production data. With efforts tied to ZTA such as Zscaler facilitating access to internal systems, it's more important than ever to make sure that you have the same bar on access control, particularly authentication, to your non-production environments. While we could argue that dummy data should be used outside production, there are valid use cases for real data for acceptance testing or other activities, it makes sense to implement the same security on all platforms for such use cases.
Does the KEV Reduce Time to Patch in the Private Sector?
A report from Bitsight examines the effect the US Cybersecurity and Infrastructure Security Agency's (CISAÕs) Known exploited Vulnerabilities (KEV) catalog has had on the speed of vulnerability remediation, both at Federal Civilian Executive Branch (FCEB) agencies and at private sector organizations. The report says that KEV-listed vulnerabilities are patched within an average of 175 days (around six months), while vulnerabilities not in the catalog are patched within an average of 621 days (one year, eight months).
Editor's Notes
- Slide 1 of 4
While agencies struggle to meet the KEV timelines (on average only 40% are able to do so) the overall health of agency networks is improved as a result of the KEV, which is what is intended. It also provides insight into vulnerabilities being actively exploited, making it a valuable metric when assessing risk/prioritizing updates/fixes. Note that to be listed in the KEV, there has to be a remediation, evidence of exploitation and CVE number. The 175 day average, even caveated that more severe issues are resolved more quickly, still is an opportunity to improve. As more access paths are made available, through efforts like Zero Trust, the list of what you include in your Internet Accessible systems needs to be adjusted along with the risk ratings relating to patching.
- Slide 2 of 4
Good to see that publicity around exploited vulnerabilities does reduce time to patch, bad to see the 175 day average for patching. Also disappointing to see Federal agencies lagging industry in time to patch, since the Federal are the only ones subject to the CISA deadlines. Basically, use this and KEV announcements to drive at monthly server patching vs. twice per year.
- Slide 3 of 4
While I applaud CISA for their efforts in creating and managing the KEV catalog, I'm not sure I will call this a success story. I mean, it still takes upwards of six months to patch for known active exploits. In legal terms that demonstrates a failure of the reasonableness standard, should an organization fall victim to attack.
- Slide 4 of 4
One infers that patching of vulnerabilities on the list does receive priority. However, that the vulnerabilities remain exploitable, and presumably exploited, often for months is troubling. One hopes that the most sensitive systems and applications are the earliest patched (but hope is not a strategy.)
Slide 1 of 0- Slide 1 of 4
The Rest of the Week's News
Kaspersky: Seven Vulnerabilities in Telit Cinterion Modems
Researchers at Kaspersky ICS CERT are warning of multiple vulnerabilities in Telit Cinterion cellular modems. Exploitation of the flaws could lead to information leaks, privilege elevation , sandbox escape, arbitrary code execution, and unauthorized access to files and directories. Kaspersky initially detected the vulnerabilities more than a year ago, notified Cinterion in February 2023, and published advisories in November 2023. In this month's report, Evgeny Goncharov, head of Kaspersky ICS CERT, notes that since the modems are typically integrated in a matryoshka-style within other solutions, with products from one vendor stacked atop those from another, compiling a list of affected end products is challenging.
Editor's Notes
This has the potential to be a serious problem as cellular modems are used in a variety of critical infrastructure sectors. That said, the attacker must first determine which end products are vulnerable and how to monetize. In the meantime, follow the straightforward mitigation advice to disable SMS and use private APNs.
Malicious Python Package Taken Down
Researchers at Phylum have detected a malicious Python package masquerading as a fork of the requests package. The package, requests-darwin-lite, contained a backdoor hidden in a PNG file. The package was downloaded more than 400 times before it was taken down.
Editor's Notes
- Slide 1 of 2
This malicious package was interesting and different than prior incidents like this. The malicious package targeted one particular Mac. It checked the unique ID of the system before executing the malicious code. The malicious code itself was included in an image file delivered with the package, and written in Go, not Python. This may have been more a "test" to verify if the technique is viable, or maybe part of a penetration test and the specific system ID was used to avoid collateral damage.
- Slide 2 of 2
This exploit targets Macs. The exploit is a Golang library hidden in a 13Mb logo file (originally 300Kb). All versions of "requests-darwin-lite" were immediately removed after being reported by the Phylum team. If you're using the requests PyPy package, make sure that you don't have copies of the bogus package, irrespective of the platform.
Slide 1 of 0- Slide 1 of 2
Google Fixes Another Chrome Zero-day
Google has updated their Chrome browser to address a high-severity use-after-free vulnerability. The browsers Stable channel has been updated to 124.0.6367.201/.202 for Mac and Windows and 124.0.6367.201 for Linux. Google is aware that there is an exploit for the flaw available in the wild. This is the fifth zero-day vulnerability Google has patched in Chrome so far this calendar year.
Editor's Notes
- Slide 1 of 2
Google is well ahead of last year in the number of Chrome zero-day vulnerabilities reported. It's indicative of its large install base which makes Chrome vulnerabilities highly valuable in the exploit marketplace. Bottom line: get into a regular cadence of closing and restarting the browser to apply the updates automatically.
- Slide 2 of 2
As my boss Matt would say, "We've seen this movie before." You already have processes to make sure the end-users have the update, and have set limits on how long they can ignore the restart prompt. Just verify that it's done; hopefully you don't have to force/kill too many running browsers.
Slide 1 of 0- Slide 1 of 2
CISA Publishes Black Basta TTPs in Wake of Ascension Breach
The Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), Department of Health and Human Services (HHS), and Multi-State Information Sharing and Analysis Center (MS-ISAC) have published a joint cybersecurity advisory detailing the tactics, techniques, and procedures (TTPs) used by the ransomware group believed to be responsible for the attack on the Ascension healthcare organization last week. As of Monday, May 13, Ascension says they are making progress on restoring systems, but note that a full return to normal operations will take time. The Ascension Cybersecurity Event Update page provides links for each state affected by the breach.
Editor's Notes
- Slide 1 of 2
Their primary entry still relies on phishing and externally-facing vulnerable apps. You know this dance: make sure you're equipping your users with both training and technical tools, and keep an eye on externally-facing apps, insisting they remain current. Find that compromise between business impact and newspaper headline.
- Slide 2 of 2
While the advisory is helpful and is specific to Black Basta TTPs, the security mitigations are essentially the same for most ransomware attacks. They are: 1) patch as soon as software vendors update their products; 2) configure to a known security benchmark; 3) employ multi-factor authentication (MFA) on all internet-facing accounts; and 4) implement a data recovery plan. Each of these are tried and true security controls that work.
Slide 1 of 0- Slide 1 of 2
FBCS Updates Number of Individuals Affected by February Breach
Financial Business and Consumer Solutions (FBCS), a Pennsylvania-based debt collection agency, has updated the breach report they submitted to the Maine Attorney General's office (AGO). DFBCS has identified an additional 724,000 individuals affected by the breach that occurred earlier this year, bringing the total of affected individuals to 2.68 million. The notification letters FBCS sent to affected people says that the compromised data include Social Security numbers and account information. FBCS informed the Maine AGO that driver's license and identification card numbers may also have been compromised.
Editor's Notes
- Slide 1 of 2
FBCS continues to notify affected users. Even so, don't wait to see if you're in scope. You should already be getting notifications from your credit monitoring/ID protection service about breaches such as this. Make sure you're following up to see if you are included. This is an area we all need to be proactive for both ourselves and for our family members who are not as well-versed in what's at stake.
- Slide 2 of 2
As is often the case, the number of impacted individuals goes up as incident analysis completes. What's important is to download your credit report on a quarterly basis to look for signs of identity theft, or, if you're one of the impacted individuals, use the free credit monitoring service offered.
Slide 1 of 0- Slide 1 of 2