Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

3/20/2020
09:10 AM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
100%
0%

Attack Surface, Vulnerabilities Increase as Orgs Respond to COVID-19 Crisis

In typical fashion, attackers are gearing up to take advantage of the surge in teleworking prompted by the pandemic.

The speed at which organizations are being forced to respond to the unfolding COVID-19 health crisis could be leaving many of them vulnerable to attack by threat actors rushing to exploit the situation.

Over the past few weeks security vendors and researchers have reported an increasing number of malicious activities tied to COVID-19 that they say are elevating risks for organizations across sectors, especially healthcare and law enforcement.

Predictably, a lot of the activity has involved phishing and social-engineering campaigns where COVID-19 has been used as a thematic lure to get people to click on malicious attachments and links in emails or to download malware on mobile and other devices. There have also been reports about account takeover and business email compromise activity, a growth in domains serving up drive-by malware, and attempts to exploit virtual private networks (VPNs) and other remote access tools.

The danger posed by these threats has been exacerbated by new requirements for "social distancing" and the resulting push by many organizations to widen or implement telework capabilities for their workforce. The sudden COVID-19-related surge in the use of videoconferencing, remote access, and VPN services — especially at organizations that have not used them before — is giving attackers more targets to go after and defenders a lot more terrain to protect.

"Many companies did not have the infrastructure for this sort of work and had to deploy it quickly," says Omri Herscovici, security research team leader at Check Point.

This includes externalizing internal Web services and email access, desktop, and other internal resources. In some cases, internal services that may not have been previously accessible from outside the perimeter are now being hastily opened to allow employees to work from home.

Many are implementing new technologies for remote access without enough testing or without first ensuring secure configurations, Herscovici says. Companies are also likely struggling with managing and protecting a sudden rise in server loads and with issues like implementing proper authentication mechanisms and security auditing capabilities for their newly telecommuting workers, he notes.

"The attack surface for malicious actors has increased since some parts of an organization's infrastructure that were only used internally are now exposed to the Internet," Herscovici says.

VPN and Telework Risks
Attacks that seek to take advantage of user inexperience with respect to remote working are one major concern. "Tens of thousands of businesses are turning their workforce into a remote army, and they are urging staff to use VPNs for the first time," says Lior Rochberger, a security analyst with Cyberason's Nocturnus team and the co-author of a recent COVID-19 research report.

"Unsuspecting victims around the world are falling victim because they are being tricked into downloading and installing malware masquerading as legitimate VPN clients," Rochberger says.

One malicious website that Cybereason's team uncovered claimed to provide a range of legitimate VPN installers and installers for apps like Instagram and Facebook. However those who attempt to download the VPN installer only get directed to a malware-hosting site. "There is a lot of danger because as anxiety sets in, people's minds are elsewhere and they trust these websites without double-checking that it is legitimate and trusted," Rochberger says.

Concerns over enterprise VPN security were high even before the COVID-19 crisis. Security researchers have reported on numerous critical remotely executable vulnerabilities in widely used VPN products in recent months that have prompted alerts from the US Department of Homeland Security (DHS) and others. Organizations that might have been close to addressing those issues are likely going to fall behind once again in the new rush to enable telecommuting at many organizations, says Pascal Geenens, security evangelist at Radware.

"VPNs have been the subject of targeted access over 2019," he says. "[Now] the opportunity and attack surface [have grown] with more organizations deploying remote access."

In a March 13 alert, the DHS's Cybersecurity and Infrastructure Security Agency (CISA) urged organizations that are implementing remote access capabilities for workers in response to COVID-19 to install the latest security patches and configurations on their VPNs. It also advised the use of multifactor authentication on all VPN connections to increase security. "If MFA is not implemented, require teleworkers to use strong passwords," the CISA said.

Exploiting a Crisis
Meanwhile, threat actors, who have a penchant for exploiting a crisis situation, are launching a barrage of spam, phishing, and other malicious campaigns to get users to part with credentials and other sensitive data.

According to KnowBe4, there has been a virtual epidemic of COVID-19-themed phishing emails in recent weeks. Many of them have purported to be from the US Centers for Disease Control (CDC), the World Health Organization (WHO), the US Department of Health and Human Services (HHS), and enterprise HR departments. Just this week, for instance, IBM reported on a new campaign where a previously known keylogger called HawkEye was being distributed in emails spoofing WHO's director general. While most of the phishing emails have spoofed government organizations, attackers have been spoofing private ones as well. One campaign that KnowBe4 tracked, for instance, involved a phishing email with a fake bill for COVID-19 insurance coverage from Cigna

An interactive map from Johns Hopkins University tracking the spread of COVID-19 globally has been an especially popular spoofing target. Numerous attackers have begun hosting near-identical-looking trackers on malware-laden sites and are using phishing emails to lure people to these sites.

Some are using an app-version of the tracker to get users to load malware on mobile devices. Kristin Del Rosso, senior staff intelligence engineer at Lookout, says researchers from the company recently discovered a trojanized version of a functional COVID-19 tracking app being used to download surveillance software on mobile phones.

"We have seen other actors using the COVID-19 media coverage to deploy Coronavirus-themed mobile ransomware and banking Trojans, as well as track a device's geolocation," Del Rosso says. With the order to shelter in place, organizations are quickly implementing work-from-home policies that have the potential to increase their mobile risk. "Ultimately, it comes down to educating the end users and continuing to follow best practices, even in times of crisis," she says.

Rochberger says Cybereason, too, has seen attackers creating malicious mobile applications posing as legitimate apps developed by the WHO purportedly to help people recover from COVID-19. "Instead, the application downloads the Cerberus Trojan to steal sensitive data," she notes.

According to Check Point, more than 16,000 new Coronavirus-related domains have been registered since January. More than 2,200 of them are suspicious and another 93 are being used to serve malware. Many malware authors appear to be viewing the pandemic as an opportunity to accelerate sales and are offering Coronavirus specials and discounts to criminals and wannabe-criminals in Dark Web markets. Among the COVID-19 specials is a 15% discount on a Facebook account-hacking service.

While many of the new and emerging COVID-19 related threats are targeted primarily at individuals, they impact organizations equally. So enterprises need to special attention to the security fundamentals, researchers say.

This includes keeping software properly updated to prevent exposure to new threats, resetting and enforcing strong passwords for remote workers, and ensuring passwords are changed periodically, says Geenens from Radware, which recently published a set of recommendations on the topic.

VPNs are another way to secure data between remote workers and core systems, says Kevin Curran, IEEE senior member and professor of security at Ulster University. "In the ideal world, organizations would have a zero trust network system deployed," Curran says. But it can be difficult to implement purely in response to the unfolding health crisis, he admits.

Mobile device management capabilities are another fundamental requirement for organizations right now, Curran notes. "Even Windows 10 now enables devices to connect to a cloud-based Azure Active Directory, which bolsters the existing support in Windows for the traditional version of Active Directory," he says. Organizations need to have control of mobile devices that access their environments and have capabilities such as remote wipe and configuration of enterprise data protection policies.

"Containerization is another option for companies to separate corporate and personal data on an employee's device," Curran says. "This involves separating out the corporate mobile apps and the data associated with these into 'containers' on the mobile device, creating a clear division as to what is subject to corporate security policies, such as wiping." 

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's featured story: "Security Lessons We've Learned (So Far) from COVID-19."

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
chisecurity
50%
50%
chisecurity,
User Rank: Apprentice
3/25/2020 | 10:57:30 AM
Exposing the Threats Companies are Facing
Great article, I concur that there are many more risks right now for businesses than ever before. People are exploiting the situation and taking advantage of people in this time of crisis. Not only are there more cyber security threats, but overall outside crime has increased due to people being desparate and panicked with massive job losses and paranoia. Many businesses are left without any attendance and no protection. Its upsetting to me because the need for physical security (security cameras, access control, alarm systems) are even more necessary right now but companies don't want to spend a dime. Its really a shame. Our website chisecuritysystems.com details ways to protect properties, including homeowners, in this time of crisis.
Malicious USB Drive Hides Behind Gift Card Lure
Dark Reading Staff 3/27/2020
How Attackers Could Use Azure Apps to Sneak into Microsoft 365
Kelly Sheridan, Staff Editor, Dark Reading,  3/24/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
State of Cybersecurity Incident Response
State of Cybersecurity Incident Response
Data breaches and regulations have forced organizations to pay closer attention to the security incident response function. However, security leaders may be overestimating their ability to detect and respond to security incidents. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-10940
PUBLISHED: 2020-03-27
Local Privilege Escalation can occur in PHOENIX CONTACT PORTICO SERVER through 3.0.7 when installed to run as a service.
CVE-2020-10939
PUBLISHED: 2020-03-27
Insecure, default path permissions in PHOENIX CONTACT PC WORX SRT through 1.14 allow for local privilege escalation.
CVE-2020-6095
PUBLISHED: 2020-03-27
An exploitable denial of service vulnerability exists in the GstRTSPAuth functionality of GStreamer/gst-rtsp-server 1.14.5. A specially crafted RTSP setup request can cause a null pointer deference resulting in denial-of-service. An attacker can send a malicious packet to trigger this vulnerability.
CVE-2020-10817
PUBLISHED: 2020-03-27
The custom-searchable-data-entry-system (aka Custom Searchable Data Entry System) plugin through 1.7.1 for WordPress allows SQL Injection. NOTE: this product is discontinued.
CVE-2020-10952
PUBLISHED: 2020-03-27
GitLab EE/CE 8.11 through 12.9.1 allows blocked users to pull/push docker images.