CAUGHT IN THE ACT — If it’s news to you that (likely) North Korea hackers nearly mounted a SolarWinds-sized cyberattack, don’t beat yourself up. Pyongyang’s attempt to slink into the software delivery pipeline of a widely-used enterprise communications firm named 3CX hasn’t gotten much attention within the Beltway because private sector security companies largely nipped it in the bud. (I also heard there was some news regarding a former president late last week?) And while the now-foiled campaign offers some alarming signs that Pyongyang is moving up the hacker hierarchy by replicating Kremlin tradecraft, as I reported Friday (for subscribers, alas!), the incident also shows how far the defensive community has come since 2020, when Russian hackers rode the supply chain’s secretive back alley en route to a nine-month jaunt through some nine federal agencies and 100 private companies. “I think the only reason we're not looking at a SolarWinds 2.0 is really the response time of the industry,” said Juan Andres-Guerrero Saade, senior director of SentinelLabs, the research arm of security firm SentinelOne. “Detecting a supply chain attack is really difficult,” added Adam Meyers, senior vice president of intelligence at CrowdStrike. “The fact that we were able to stop this inside of a few weeks, not several months, is a huge win.” The details — Pyongyang’s hackers first infiltrated the update mechanism for 3CX’s flagship desktop communication software and turned it into a trojan horse for malware — a deft feat that incident response firm Mandiant is now investigating. For the public, 3CX’s problems only began to surface on March 22, when a subset of its 600,000 customers received a suspicious-looking update to the 3CX software, which triggered alerts in their endpoint security products. While customers quickly began to voice concern, the updates bore the stamp of approval of a known vendor in 3CX. Because they failed to get much help from the firm itself — whose CEO later acknowledged it was slow to investigate the issue — many customers opted to ignore the red flags, assuming it was a false positive. Caught red-handed — About one week later, on March 29, the altered 3CX desktop software began to phone home to GitHub repository and, in turn, a slate of suspicious web domains controlled by the North Koreans. That seven-day “sleep period” seems designed to throw off defenders, said John Hammond, a senior security researcher at Huntress. But given that 3CX users and their security providers already had a close eye on the 3CX app, the security community quickly zeroed in on the “especially shady” new activity. “On the 29th, the storm kicks up and it becomes clear it was something absolutely worth discussing and tracking,” said Hammond. “Jig is up” — Within a day, CrowdStrike, SentinelOne and a host of other endpoint security companies had outed the activity, dismantled Pyongyang’s command and control infrastructure, and contacted the U.S. government, said CrowdStrike’s Meyers. Because it was tracking the same North Korean hackers targeting the energy and financial sectors, said Meyers, CrowdStrike was even able to pin the blame on Pyongyang that same day — a rapid but evidently reliable charge that no one has cast doubt on. And while the North Koreans could still have a toehold inside some companies who downloaded the malicious software, Meyers argued defenders unraveled the campaign so quickly it's doubtful Pyongyang will be able to get much out of it — an assessment that other firms and even the U.S. government agree with. “The National Security Council tasked agencies to provide a rapid assessment of impact across government and critical infrastructure — the agencies assessed the impact was minimal,” a senior Biden administration official told MC via email. “The jig is up,” said Chester Wisniewski, field CTO applied research at security firm Sophos. The campaign “is effectively neutered at this point.” Word of caution — Nobody thinks the industry’s response was flawless, let alone that the supply chain is as secure as it needs to be. Savvier hackers could have bought more time inside victims’ networks by testing their malware against top security products, pointed out Wisniewski. Or the North Koreans could have leveraged 3CX to launch wide-reaching ransomware or wiper attacks, observes a recent essay from Joe Slowik, a threat intelligence manager at Huntress. “It's still very much a kind of terrifying situation,” said SentinelOne’s Guerrero-Saade. “It shows just how many different layers there are to the things that we rely on, to the supply chain in general, and how weak a lot of those are.” But a win is a win — Still, there’s a prevailing sense that defenders did much better than they would have because this happened in the new era of cybersecurity: that is, post-SolarWinds. “It's not our first rodeo anymore,” said Huntress’ Hammond.
| 
No comments:
Post a Comment