Category: Vulnerability Management

Posted on

NetSarang Computer Xmanager software backdoor

Kaspersky Lab discovered a backdoor in signed code from NetSarang Computer, a South Korean company.  The software, Xmanager, is used to manage Linux/Unix applications on Windows platforms.  According to Kelly Jackson Higgins in a DarkReading article,

The cyber espionage malware was embedded in one of the source code libraries of NetSarang Computer’s July 18, 2017 software builds. Its Xmanager Enterprise 5.0 Build 1232, Xmanager 5.0 Build 1045, Xshell 5.0 Build 1322, Xftp 5.0 Build 1218, and Xlpd 5.0 Build 1220, were all compromised.

NetSarang Computer’s network was apparently compromised, resulting in distribution of trusted, signed code with embedded malware (Goodin, 2017).  This is now patched, and customers should apply the patch immediately.

This is an example of an attacker-created vulnerability created by attacking the supply chain instead of actual targets.  As in this case, customers have no reason to believe the vendor is malicious.  NetSarang Computers is not a threat agent, but a vulnerability in its security resulted in weaknesses in many organizations.

As with any organization, no security framework is perfect.   We have to believe that, as target organization security strengthens, attackers will start looking at supply chain attacks.  Some organizations have hundreds, or thousands, of applications installed by IT and business employees.  One or more of these vendors will eventually fall victim to an attack like that experienced by NetSarang Computer.  Goodin writes,

The NotPetya worm that shut down computers around the world in June used the same tactic after attackers hijacked the update mechanism for tax software that was widely used in Ukraine. Supply-chain attacks that targeted online gamers included one used to spread the PlugX trojan in 2015 and the malware dubbed WinNTi in 2013.

In this case, blocking and monitoring for anomalous traffic would likely prevent or detect backdoor activity.  However, software whitelisting is still one of the best ways to minimize the number of applications you have to watch.

Posted on

“Security in depth is spending in depth”

It’s always a good idea to understand our current controls and how they work together.  We must also fully utilize each control.  This is becoming something expected by business managers during budget time.  Dawn Kawamoto writes,

One possible contributor to tight security budgets and tempered growth in the industry is a desire by companies to achieve greater efficiencies with their existing technology. “Rather than spending more on security, boards are asking ‘what are you doing to spend less and do it in a better way than what we are doing?'” Pescatore says. “Security in depth is spending in depth.”

I wrote about this several years ago.  Using a controls matrix, it’s easy to start bringing together the information we need to optimize each control and more effectively manage risk.

 

Posted on

Don’t kneejerk to every vulnerability announcement

Brian Krebbs makes good points about assessing vulnerability announcements.  But in addition to looking deeper into the claims, organizations must also determine how much risk actually exists based on administrative, technical, and physical controls.  In this example, the annoucement only required a simple review of how an organization might submit suspicious files…

Posted on

PowerShell script for helping with vulnerability management

This paper, by Colm Kennedy, presents a PowerShell script useful for managing vulnerabilities.

The goal of this paper is to show how a small script in PowerShell can aid in the investigation of many systems and report information in an organized manner that will help streamline investigations of possible false positives. The script in this paper will assist in identifying missing patches or old versions of software installed. The PowerShell script in this paper sends the results to a CSV file that lists the system name, the operating system installed, the number of missing critical and important patches, last boot time of the system, Chrome version, Firefox Version, Java Version, Adobe Flash Version, and Adobe Reader Version. The format of the CSV file makes it easy to browse over all systems scanned to make a quick determination if more investigation needs to take place for each system. An important part of this script is that it needs to be transferrable to any environment with little effort.