Attacks/Breaches

7/16/2018
05:36 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Russian National Vulnerability Database Operation Raises Suspicions

Recorded Future says Russia's Federal Service for Technical and Export Control has ability to find, weaponize vulnerabilities under cover of doing technology inspections.

The official mission of the organization in charge of maintaining Russia's national vulnerability database gives it legitimate cover for inspecting foreign technologies and products for security vulnerabilities that can later be weaponized.

That's according to Recorded Future, which Monday released a report summarizing its analysis of the vulnerability disclosure practices and mission of the Federal Service for Technical and Export Control of Russia (FSTEC), the military organization responsible for BDU, the nation's official vulnerability database.

The analysis revealed that the FSTEC's extensive list of responsibilities includes the authority to test and inspect proprietary products and services for issues that could pose a risk to state and critical infrastructure security. That mission is troubling, says Priscilla Moriuchi, director of strategic threat development at Recorded Future.

"The primary threat to Western companies is from the technology licensing process," Moriuchi says. "During these inspections the Russian military could discover and operationalize vulnerabilities in proprietary products or services," she says.

The threat from having to work with the FSTEC — and by extension the Russian military — is not to the companies directly or to their intellectual property. Rather, what is concerning is the derivative risk for computer users around the world.

"Russia has demonstrated during at least two incidents in the past year a willingness to exploit western technologies, companies, and accesses in an attempt to obtain the information or communications of their customers," Moriuchi says.

The two incidents are the April targeting of network devices and the more recent attacks involving VPNFilter. "The [national vulnerability] database provides a legitimate cover under which the Russian government can demand reviews of foreign technologies and products," she notes.

Recorded Future performed a similar analysis of China's vulnerability disclosure practices last November. The report concluded that China's Ministry of State Security likely influences security vulnerability disclosures in the country especially in the case of high-value security flaws that could be used for surveillance and other offensive purposes.

Russia's FSTEC publishes only about 10% of the vulnerabilities it knows about and that too about 50 days after the data has been published in the U.S. and 83 days after it appears in China's NVD, according to Recorded Future.

A majority of the vulnerabilities in BDU are those that primarily present a threat to Russian state-owned information systems and automated systems for managing technical processes and production and critical infrastructure facilities. The data is publicly accessible and is designed for use by a wide range of people including security professionals, operators of critical infrastructure, and developers.

Unlike China's Ministry of State Security, which has a penchant for delaying or hiding data on vulnerabilities that the state can exploit for surveillance and other offensive purposes, Russia's FSTC over-reports on vulnerabilities that have been exploited by Russian state-sponsored threat groups. "Our analysis reveals that the BDU actually publishes 61% of vulnerabilities utilized by Russian military intelligence groups and does not seek to hide these vulnerabilities."

The number is noteworthy because it is significantly larger than the 10% of other vulnerabilities that the FSTC normally discloses. One reason could be to ensure that owners and operators of government and critical infrastructure systems are properly informed of the threats so they can protect against them.

The FSTEC started publishing vulnerability data only in 2014, about 15 years after the US started the practice. Somewhat unsurprisingly, the BDU contains data on just about 11,000 vulnerabilities compared to the 107,901 in the U.S. NVD — though that could also be the result of the FSTEC's habit of occasionally lumping multiple vulnerabilities under a single identifier. Among the vulnerabilities the organization published fastest were those related to browsers and industrial control systems.

Recorded Future's analysis showed that the FSTEC reports on vulnerabilities in some technologies relatively extensively while it under-reports flaws in the case of some other technologies. For instance, the FSTEC discloses a substantially greater proportion of flaws in Adobe, Linux, Microsoft, and Apple than it does with flaws in content management systems and technologies from IBM and Huawei.

What is unclear, however, is why FSTEC is even publishing the data considering just how delayed, state-focused and sparse the data is, Recorded Future noted in its report. In fact, the vulnerability data in the BDU reveals more about Russia's state information systems and the FSTEC's mission itself than anything else, the vendor said.

Related Content:

 

 

 

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
12 Free, Ready-to-Use Security Tools
Steve Zurier, Freelance Writer,  10/12/2018
Most IT Security Pros Want to Change Jobs
Dark Reading Staff 10/12/2018
6 Security Trends for 2018/2019
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/15/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-10839
PUBLISHED: 2018-10-16
Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow, which could lead to buffer overflow issue. It could occur when receiving packets over the network. A user inside guest could use this flaw to crash the Qemu process resulting in DoS.
CVE-2018-13399
PUBLISHED: 2018-10-16
The Microsoft Windows Installer for Atlassian Fisheye and Crucible before version 4.6.1 allows local attackers to escalate privileges because of weak permissions on the installation directory.
CVE-2018-18381
PUBLISHED: 2018-10-16
Z-BlogPHP 1.5.2.1935 (Zero) has a stored XSS Vulnerability in zb_system/function/c_system_admin.php via the Content-Type header during the uploading of image attachments.
CVE-2018-18382
PUBLISHED: 2018-10-16
Advanced HRM 1.6 allows Remote Code Execution via PHP code in a .php file to the user/update-user-avatar URI, which can be accessed through an "Update Profile" "Change Picture" (aka user/edit-profile) action.
CVE-2018-18374
PUBLISHED: 2018-10-16
XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter.