Attacks/Breaches

7/16/2018
05:36 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Russian National Vulnerability Database Operation Raises Suspicions

Recorded Future says Russia's Federal Service for Technical and Export Control has ability to find, weaponize vulnerabilities under cover of doing technology inspections.

The official mission of the organization in charge of maintaining Russia's national vulnerability database gives it legitimate cover for inspecting foreign technologies and products for security vulnerabilities that can later be weaponized.

That's according to Recorded Future, which Monday released a report summarizing its analysis of the vulnerability disclosure practices and mission of the Federal Service for Technical and Export Control of Russia (FSTEC), the military organization responsible for BDU, the nation's official vulnerability database.

The analysis revealed that the FSTEC's extensive list of responsibilities includes the authority to test and inspect proprietary products and services for issues that could pose a risk to state and critical infrastructure security. That mission is troubling, says Priscilla Moriuchi, director of strategic threat development at Recorded Future.

"The primary threat to Western companies is from the technology licensing process," Moriuchi says. "During these inspections the Russian military could discover and operationalize vulnerabilities in proprietary products or services," she says.

The threat from having to work with the FSTEC — and by extension the Russian military — is not to the companies directly or to their intellectual property. Rather, what is concerning is the derivative risk for computer users around the world.

"Russia has demonstrated during at least two incidents in the past year a willingness to exploit western technologies, companies, and accesses in an attempt to obtain the information or communications of their customers," Moriuchi says.

The two incidents are the April targeting of network devices and the more recent attacks involving VPNFilter. "The [national vulnerability] database provides a legitimate cover under which the Russian government can demand reviews of foreign technologies and products," she notes.

Recorded Future performed a similar analysis of China's vulnerability disclosure practices last November. The report concluded that China's Ministry of State Security likely influences security vulnerability disclosures in the country especially in the case of high-value security flaws that could be used for surveillance and other offensive purposes.

Russia's FSTEC publishes only about 10% of the vulnerabilities it knows about and that too about 50 days after the data has been published in the U.S. and 83 days after it appears in China's NVD, according to Recorded Future.

A majority of the vulnerabilities in BDU are those that primarily present a threat to Russian state-owned information systems and automated systems for managing technical processes and production and critical infrastructure facilities. The data is publicly accessible and is designed for use by a wide range of people including security professionals, operators of critical infrastructure, and developers.

Unlike China's Ministry of State Security, which has a penchant for delaying or hiding data on vulnerabilities that the state can exploit for surveillance and other offensive purposes, Russia's FSTC over-reports on vulnerabilities that have been exploited by Russian state-sponsored threat groups. "Our analysis reveals that the BDU actually publishes 61% of vulnerabilities utilized by Russian military intelligence groups and does not seek to hide these vulnerabilities."

The number is noteworthy because it is significantly larger than the 10% of other vulnerabilities that the FSTC normally discloses. One reason could be to ensure that owners and operators of government and critical infrastructure systems are properly informed of the threats so they can protect against them.

The FSTEC started publishing vulnerability data only in 2014, about 15 years after the US started the practice. Somewhat unsurprisingly, the BDU contains data on just about 11,000 vulnerabilities compared to the 107,901 in the U.S. NVD — though that could also be the result of the FSTEC's habit of occasionally lumping multiple vulnerabilities under a single identifier. Among the vulnerabilities the organization published fastest were those related to browsers and industrial control systems.

Recorded Future's analysis showed that the FSTEC reports on vulnerabilities in some technologies relatively extensively while it under-reports flaws in the case of some other technologies. For instance, the FSTEC discloses a substantially greater proportion of flaws in Adobe, Linux, Microsoft, and Apple than it does with flaws in content management systems and technologies from IBM and Huawei.

What is unclear, however, is why FSTEC is even publishing the data considering just how delayed, state-focused and sparse the data is, Recorded Future noted in its report. In fact, the vulnerability data in the BDU reveals more about Russia's state information systems and the FSTEC's mission itself than anything else, the vendor said.

Related Content:

 

 

 

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Google Engineering Lead on Lessons Learned From Chrome's HTTPS Push
Kelly Sheridan, Staff Editor, Dark Reading,  8/8/2018
White Hat to Black Hat: What Motivates the Switch to Cybercrime
Kelly Sheridan, Staff Editor, Dark Reading,  8/8/2018
PGA of America Struck By Ransomware
Dark Reading Staff 8/9/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Now about that mortgage refinance offer from Wells Fargo .....
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-6970
PUBLISHED: 2018-08-13
VMware Horizon 6 (6.x.x before 6.2.7), Horizon 7 (7.x.x before 7.5.1), and Horizon Client (4.x.x and prior before 4.8.1) contain an out-of-bounds read vulnerability in the Message Framework library. Successfully exploiting this issue may allow a less-privileged user to leak information from a privil...
CVE-2018-14781
PUBLISHED: 2018-08-13
Medtronic MMT 508 MiniMed insulin pump, 522 / MMT - 722 Paradigm REAL-TIME, 523 / MMT - 723 Paradigm Revel, 523K / MMT - 723K Paradigm Revel, and 551 / MMT - 751 MiniMed 530G The models identified above, when paired with a remote controller and having the "easy bolus" and "remote bolu...
CVE-2018-15123
PUBLISHED: 2018-08-13
Insecure configuration storage in Zipato Zipabox Smart Home Controller BOARD REV - 1 with System Version -118 allows remote attacker perform new attack vectors and take under control device and smart home.
CVE-2018-15124
PUBLISHED: 2018-08-13
Weak hashing algorithm in Zipato Zipabox Smart Home Controller BOARD REV - 1 with System Version -118 allows unauthenticated attacker extract clear text passwords and get root access on the device.
CVE-2018-15125
PUBLISHED: 2018-08-13
Sensitive Information Disclosure in Zipato Zipabox Smart Home Controller allows remote attacker get sensitive information that expands attack surface.