- The Cybersecurity Index
- Posts
- Your Daily Decrypt
Your Daily Decrypt
8/25/2023 - Today’s news and insights for cybersecurity pros and leaders
The Cybersecurity Index
August 25, 2023
📸 Cybersecurity Snapshot
📰 Top Stories
Summary
Who's Making the Change: Meta
What They're Doing: Announcing that Messenger will have default end-to-end encryption (E2EE) by the end of this year.
How They're Doing It: Meta has undergone a massive system overhaul to integrate E2EE into Messenger. The company has developed a new Hardware Security Module infrastructure for message history access via PIN codes and redeveloped more than 100 features, such as link sharing to YouTube, to comply with encryption protections.
What's Been Affected: The integration of E2EE affects Messenger's functionality, requiring changes to various features.
What Actions Were Taken: Meta expanded E2EE to millions more accounts earlier this week and continues to test and upgrade the service. Users will need to update their app to a recent build to access default E2EE.
Why it’s important to you
Stay Informed: If you use Messenger, expect enhanced privacy and security with the implementation of E2EE.
Be Proactive: Keep an eye on updates to ensure you have access to the latest encryption feature as it rolls out.
Consider Implications: The move towards E2EE reflects a broader industry trend of prioritizing user privacy and data security, impacting both individual users and businesses that rely on these communication platforms.
Summary
Who's Behind the Attack: Hackers affiliated with the People's Republic of China.
What They Did: They are continuously exploiting a zero-day vulnerability, CVE-2023-2868, in Barracuda Network's Email Security Gateway (ESG) appliances, despite patches.
How They Did It: The attackers have used remote command injection to gain administrator privileges on the devices. They've crafted TAR file attachments and emails using various extensions and employed counter-forensic techniques to hide their actions.
What's Been Affected: Barracuda Network's ESG devices, leading to unauthorized access, scanning of email, credential harvesting, and data exfiltration.
What Actions Were Taken: The FBI has issued an alert, and Barracuda has urged customers to replace compromised devices. Patches have been ineffective, and the company is working with Mandiant, a unit of Google Cloud, to respond to the attacks.
Why it’s important to you
Stay Informed: If you use Barracuda's ESG appliances, be aware of the ongoing vulnerability.
Be Proactive: Consider replacing affected appliances as recommended by Barracuda and monitoring logs for signs of unauthorized activities.
Consider Implications: The continued failure of patches highlights the challenges in addressing sophisticated cyber threats and emphasizes the need for robust cyber defense strategies and incident response plans.
🚨 Threat Alerts
Summary
Who's Affected: Websites using the Jupiter X Core plugin, part of the Jupiter X theme, affecting over 172,000 WordPress and WooCommerce sites.
What's at Risk: Two critical vulnerabilities have been discovered that allow unauthorized file uploads and account hijacking.
Flaw Details:
CVE-2023-38388 (Severity Score: 9.0):
What It Does: Enables unauthorized file uploads, potentially leading to arbitrary code execution on the server.
Affected Versions: All JupiterX Core versions 3.3.5 and below.
Fix: Version 3.3.8 of the plugin; includes checks for authentication and risky file types.
CVE-2023-38389 (Severity Score: 9.8):
What It Does: Allows an unauthenticated attacker to take control of any WordPress user account if the email address is known.
Affected Versions: All Jupiter X Core versions starting from 3.3.8 and below.
Fix: Version 3.4.3 of the plugin; includes improvements to the Facebook login process to ensure legitimacy.
What Actions Were Taken: The developer, ArtBees, has released patches to address the issues.
Why it’s important to you
Stay Protected: If you are using the Jupiter X Core plugin, it is crucial to update to the latest release (version 3.4.3) to mitigate the risks.
Be Aware: Even though there are no public reports of the vulnerabilities being exploited, awareness and timely action are key to maintaining website security.
What's Been Affected: The integrity of WordPress sites using the affected versions of the Jupiter X Core plugin could be compromised if action is not taken.
Summary
What's Happening: Ransomware attacks are reaching new heights in 2023, with a 150% increase in data leaks in July compared to the previous year. The trend shows no signs of slowing down, with attackers becoming more efficient and aggressive.
Key Findings:
Rapid Escalation: Attackers are moving more quickly to compromise organizations, with the average dwell time shrinking to five days from nine in 2022.
Double Extortion: Most groups continue to pursue double extortion, relying on both theft and encryption of data to pressure payment.
Active Directory Targets: Attackers are focusing on compromising Active Directory servers within 16 hours to gain extensive access within networks.
Industrial Sector Hits: The industrial sector has seen a significant number of breaches due to less regulation and lower cybersecurity spending.
Cl0p Group's Impact: The Cl0p group's shift from encryption to data theft and extortion has accounted for much of the growth in ransomware activity.
No Summer Slump: Unlike previous years, there has been no drop in ransomware activity during the summer, possibly due to the economic downturn driving criminal groups.
Why it’s important to you
Stay Vigilant: With the surge in ransomware activity and rapid escalation of attacks, organizations must be on constant alert.
Protect Critical Systems: Focus on safeguarding systems like Active Directory, which can be central targets for attackers.
Consider Double Extortion Risk: Prepare for the double threat of data theft and encryption in a ransomware attack.
⚖️ Regulatory Updates
Summary
Who's Behind the Development: The National Institute of Standards and Technology (NIST).
What They Did: Released draft standards for three quantum-resistant encryption algorithms, with a call for feedback until Nov. 22, 2023. A draft standard for the fourth algorithm will be released next year.
How They Did It: NIST initiated the process in 2016, requesting submissions for candidate algorithms. After receiving 69 submissions, they underwent multiple rounds of evaluation by global cryptographic experts, resulting in the selection of four algorithms.
What's Been Affected: The draft standards released cover three algorithms: CRYSTALS-Kyber (FIPS 203), CRYSTALS-Dilithium (FIPS 204), and SPHINCS+ (FIPS 205). They are designed to withstand attacks by quantum computers.
What Actions Were Taken: NIST released the draft standards and called for public feedback. Additional standards for other selected algorithms and ongoing evaluations for future algorithms are also planned.
Why it’s important to you
Stay Informed: Keep an eye on the progress of these standards as they may become essential in defending against quantum computing threats.
Be Proactive: Consider how these new algorithms might be implemented within your organization's security infrastructure.
Consider Implications: The development of quantum-resistant algorithms highlights the evolving landscape of cybersecurity and the need for forward-thinking strategies to counter future threats.
👀 Curated Finds
Summary
Emerging Technology: The 4 Most Overhyped Technologies in IT
1. Generative AI
What's the Hype: Transformational potential; expected to disrupt industries and provide value.
Reality Check: Implementation challenges, concerns about bias and disinformation, and a lack of readiness are barriers to its immediate impact.
Takeaway: The potential is significant, but immediate results are unlikely. Long-term transformation is expected, but not without complexity and time-consuming efforts.
2. Quantum Computing
What's the Hype: Exponential speed and power; expected to disrupt sectors.
Reality Check: Uncertain timeline for becoming operational; will not replace classical computing in the foreseeable future; requires complete rewriting of current systems.
Takeaway: Interest is justified, but mass-market products and immediate impact on most companies are unlikely.
3. The Metaverse and Extended Reality
What's the Hype: A new digital realm; immersive experiences for consumers.
Reality Check: Limited use cases, expensive and inaccessible devices, health concerns, and unenticing form factors restrict large-scale adoption.
Takeaway: Useful in specific areas like training and industrial guidance, but widespread adoption will take longer than expected.
4. Web3: Blockchain, NFTs, and Cryptocurrencies
What's the Hype: Transformation of business operations; new ways of owning and transacting property.
Reality Check: Slow uptake, scalability issues, legal recognition, skepticism about cryptocurrencies, and NFTs' devaluation.
Takeaway: Holds promise but requires more maturity. The shift from Web2 to Web3/4 is worth watching, but it's still in the early stages.