CISA Issues Guidance to Water Sector, HPE Hit by State-Sponsored Actors

This guidance is not just about reporting, but also getting your ducks in a row ahead of time. You can engage CISA to evaluate your security posture, and make sure you're actively participating in your local cyber community, from industry specific ISAC, to professional organizations such as ISSA, ISACA and ISC2, there are lots of affordable ways to get connected with nearby expertise.

Lee Neely

Timely given recent cyber-attacks against water utility providers in Ireland, the UK, and US. While the guide is specific to the US water sector, with minimal ‘cut-n-paste’ it can be applied to every critical infrastructure sector, especially the incident response section.

Curtis Dukes

Special industry guidance should not be necessary except that this is an industry with many small scale operators and little security competence. They need an ISAC. In the absence of their own, operators might subscribe to the MS-ISAC.

William Hugh Murray

Notice: First, in June 2023 HPE was "notified" of suspicious activity but apparently didn't determine they had an active breach. Then in December they were "notified" again of suspicious activity that apparently was related to the original May breach. "Notified" implies HPE did NOT discover any of this on their own or they would have said "we discovered..." Users of HPE software and services should seek assurance that HP has active efforts to drastically reduce time to detect.

John Pescatore

Need to give HPE credit for taking steps designed to eradicate, remediate and contain the activity in June of 2023. The problem is they didn't fully work. The hard lesson here is to follow-up on monitoring/detection and threat-hunting. Assume your adversary is going to dust themselves off and have another go at you. Even so, the basics still work: MFA authentication, active account management and active monitoring, across the board. Resist the temptation to give the VIP an exception; remind them they are a prime target.

Lee Neely

The Black Basta gang is taking credit for the Southern Water attack, claiming to have 750GB of data which will be released if the ransom isn't paid in 6 days. Southern Water is wisely assessing the damage to determine the sensitivity of the pilfered data to make an informed decision. Both attacks were confined to back-end IT systems, rather than their service delivery control systems, highlighting the value of separation. Note that Veolia is temporarily unable to process bill payments. Given the continued trends of attacks on critical infrastructure, beyond making sure that you've got isolation, strong access controls and robust monitoring, (see the CISA Water Sector guidance below) seems like it's a good idea for consumers to make sure they are enrolled in credit/identity protection and restoration services.

Lee Neely

In both instances, the attack appears to have targeted back-end systems via their operational network, which controls delivery of water services to consumers. That said, the attacks serve as another reminder for critical infrastructure providers to limit remote access to OT systems as part of their risk management program.

Curtis Dukes

If you're getting pushback that your services are obscure and nobody can find them, it may be a good time to introduce folks to what Shodan can list about your Internet facing services. Explain that attackers don't care if your site is important or otherwise: all exposed services are fair game. This particular vulnerability is easy to execute exploit, so get the update out there and hand the IOCs to your threat hunters to make sure that you're not already compromised.

Lee Neely

Another enterprise file upload system. These type of vulnerabilities have led to major ransomware attacks last year (remember MoveIt?). You should not just "patch and move on" but plan ahead and ask vendors for guidance on how to protect these systems better.

Johannes Ullrich

While it’s generally good to announce a vulnerability publicly, in this instance Forta did communicate privately with their users when the patch was available. That isn’t a bad thing. What is more troubling is that a large number of assets still appear to be unpatched even with the private communication.

Curtis Dukes

CVE-2024-02024, authentication bypass, CVSS score 9.8, was first exploited as much as 12 months ago, and the patch was released in December; it's time to grab the IOCs and make sure you're not already compromised. File transfer services, critical for remote integration, continue to be a top target as they are sources for a significant amount of sensitive company data.

Lee Neely

Repeat after me - I will always sanitize all user input. And yeah, it's a pain, so where practical use a web application firewall to help, but the app is still the last defense. Some of the risk, in this case, can be mitigated by having access control lists to restrict communication to your Unified Communications or Contact Center cluster from other components on your network; these make sense long term as a hedge against further vulnerabilities. Don't stop there: also apply the update.

Lee Neely

CVE-2023-6933, deserialization of untrusted data, has a CVSS score of 9.8. Make sure that you've updated to the current version (1.4.5 or higher) check your web application firewall for protections for attempted exploits of the flaw. Wordfence claims to have blocked about 2,600 attempts to exploit this vulnerability in the last 24 hours.

Lee Neely

Plugins are essential to the value of WordPress but also a major source of vulnerability. They should be used only by design and managed rigorously.

William Hugh Murray

Fortunately the phones and radio systems are still intact. It's easy to forget these are also IT systems today. The question to consider is how the data will be recorded then updated into their CAD system when it's back online. An interesting conversation to include in your BC/DR tabletop. Include a discussion of how much you are (or aren't) willing to omit.

Lee Neely

Installing a remote support agent is pretty common to aid your support desk aiding users. The trick, particularly in remote workspace, is to make sure that you're both keeping these clients updated and following best practices to secure them.

Lee Neely

The attack was against a self-managed instance that had not been updated in 4+ years. It seems as if the provider, Outcomes, has some Cybersecurity 101 work to do, as they were used in a classic supply chain attack against their customers of their products.

Curtis Dukes

As a workaround, until you can apply the patch, disable access to the command-line interface (CLI). Don't forget to go back, apply the patch, and re-enable CLI access, restricting access to the CLI to only authorized users and devices which need it.

Lee Neely