VERT’s Cybersecurity News for the Week of May 2, 2022

All of us at Tripwire’s Vulnerability Exposure and Research Team (VERT) are constantly looking out for interesting stories and developments in the infosec world. Here’s what cybersecurity news stood out to us during the week of May 2, 2022. I’ve also included some comments on these stories.

Microsoft Azure Vulnerability Exposes PostgreSQL Databases to Other Customers

Microsoft on Thursday disclosed that it addressed a pair of issues with the Azure Database for PostgreSQL Flexible Server. If untended, these issues could result in unauthorized cross-account database access in a region, reports The Hacker News.

SAMANTHA ZEIGLER | Security Researcher at Tripwire

Microsoft disclosed vulnerabilities to their Azure Databases this week that were found in January. They mitigated the vulnerabilities rapidly after disclosure but waited to disclose them to the public until now. This gives them more time to analyze and protect against the vulnerability before publicizing it. The pair of vulnerabilities allowed for databases to be replicated by people with a forged certificate, thus giving access to stored data to attackers.

How to Attack Your Own Company’s Service Desk to spot risks

In 2020 cybercriminals launched a spear phishing attack against Twitter that successfully scammed victims out of $180,000 worth of Bitcoin, reports Bleeping Computer. The attacker used a phone-based social engineering scam against Twitter employees in order to gain access to privileged accounts.

DYLAN D’SILVA | Security Researcher at Tripwire

Sometimes the path of least resistance actually works. Almost every company has an IT helpdesk, and cybercriminals are targeting them, seeing them as a potential ingress into a company’s network. When phishing and reconnaissance are done correctly, it allows cybercriminals to build data profiles and information which will help them achieve their eventual goal of data breach/ransomware/malware/data destruction etc.; take your pick.

Once enough personal information has been obtained, the next step in the social engineering attack is to pose as a legitimate user and request a password reset. If successful, the criminal will then be “handed” a password to the user’s account, which could potentially be a privileged account, and from there cause real damage.

Having a Red Team Exercise performed periodically will help leaders and cybersecurity professionals to determine how strong or weak that specific line of defense actually is. What is a Red Team Exercise you ask? For starters, it’s not a pen-test. The goal of a pen-test is to identify and exploit as many security gaps as possible. The goal of a Red Team Exercise (which is sanctioned by the company) is to simulate a security incident, and the objective is that they only need to find one way in, exploit it as much as possible, potentially moving laterally across different networks to obtain sensitive information and achieve a specific goal. The underlying goal of the Red Team Exercise is to test the organization’s detection and response capabilities.

Let me be clear in saying that this is not an “attack” against IT Helpdesks everywhere, as I have worked on Helpdesks previously and they helped me build strong technical skills. The idea here is to highlight that helpdesks are only one of many ways cybercriminals may try to exploit in order to achieve their goals.

Thoughts & Recommendations

• Have a Red Team Exercise performed on your Helpdesk, as well as other areas of the business. As stated in the article, the goal is to keep the attacks as lifelike as possible and representative of what might happen in the real world.
• Remember that this is a learning exercise for all. If the Red Team succeeds in their exercise, it’s an opportunity for everyone to improve. No one should lose their job.
• Ongoing education as it relates to phishing, social engineering and cyberattacks. If your employees understand what and how these are perpetrated, they will be better prepared to spot and defend against them.

How the French fiber optic cable attacks accentuate critical infrastructure vulnerabilities

The pictures show neatly trimmed fiber optic cables dug up from underground behind what appears to be a well-hidden grate, notes CyberScoop. The apparent simplicity of the sabotage is all the more harrowing in light of how extensively it disrupted Internet service in France, experts said.

DYLAN D’SILVA | Security Researcher at Tripwire

Here is an example of a brazen attack on critical infrastructure, which disrupted internet service throughout much of France late last week.

The article highlights that the targeted fiber optic cables were cut on both sides, complicating the repairs. Fiber optic cables are notoriously difficult to repair, if they can be at all. Remember, fiber optic cables are made up of thin strands of glass fibers. According to what I could find, there are two methods of repair: 1) Fusion Splicing, which requires an expensive tool and proper training, or 2) Mechanical Splicing, which involves aligning the fiber cores, which is difficult to do, and results in higher-loss splices.

Quoted in the article is Bob Kolasky, who recently served as Director of CISA’s National Risk Management Center, who highlighted a couple of key important points:

• This attack appears to be more significant than others in the past
• Fiber Optic Cables are not an easy asset to protect, given the sheer number of them
• The US has built resilience into its telecom and communication assets, including fiber optic systems, so if an attack was to take place, it would not be as detrimental, but there is work to do, especially with protecting vulnerable undersea cables.

Other countries in Europe have taken notice of what happened in France, and one can only assume they are taking increased necessary measures to protect their CI and fiber optic networks. While it would be next to impossible to secure every single cable from physical attack, I think what matters here is a couple of things:

• Risk Management and Identification – run all of your assets through a Risk Matrix to determine what is the most vulnerable.
• If available and at your disposal, use tools like ML and AI to assist with the above; the more data points and better data you have, the better able you will be to see where you are vulnerable.
• Detection & Response – Identify what detection methods you can and will use to determine attacks (both digital and physical), formulate response plans to each scenario and just as importantly, practice them.

Vulnerabilities in Aruba and Avaya Switches Expose Enterprise Networks to Attacks

Switches used by organizations around the world are affected by critical vulnerabilities, according to enterprise device security company Armis. If unchecked, these vulns could allow malicious actors to gain remote access to enterprise networks and steal valuable data, notes Security Weekly.

DYLAN D’SILVA | Security Researcher at Tripwire

This is a prime example of why Vulnerability Management is an important part of your overall cybersecurity strategy.

Network switches made by Avaya and Aruba, which are used by organizations in all sizes and verticals are affected by two types of critical vulnerabilities, which lead to REC (Remote Code Execution).

The root cause of this issue is related to a previously discovered flaw, by Armis Security, which was related to vulnerabilities in APC Smart-UPS devices, which misused NanoSSL, a popular TLS library. In Avaya and Aruba’s cases, researchers found their network switches suffered from a similar flaw, as those products also appear to misuse the same TLS Library. This flaw is dubbed as TLStorm 2.0, and if properly exploited, it will allow an attacker to take full control of the switch, which can lead to:

• Breaking network segmentation, allowing more access to other devices, as well as lateral movement across the network.
• Exfiltration of data and corporate network traffic.
• Captive Portal Escape

Aruba devices affected by TLStorm 2.0:

• Aruba 5400R Series
• Aruba 3810 Series
• Aruba 2920 Series
• Aruba 2930F Series
• Aruba 2930M Series
• Aruba 2530 Series
• Aruba 2540 Series

Avaya devices affected by TLStorm 2.0:

• ERS3500 Series
• ERS3600 Series
• ERS4900 Series
• ERS5900 Series

Patches from Avaya and Aruba are available from their support portals. From what the article reports, Armis Security worked with the vendors proactively to disclose the issues so they could be patched.

Thoughts and Recommendations