30 March 2023 Retrospectives Vlad
You like this content ?
Share it on the networks
Here it is at last, you've all been waiting for it... and it's very slightly delayed (by 2.5 months), like a 10-year anniversary episode of JDG coming out for the 11th birthday 😉.
This year it smells like dried security manager (CISO) tears vaporized by the heat of vulnerability detonations: this is your traditional arbitrary top cybersecurity events of the past year 🎊. For all the details, I refer you to the emails on this list as well as the OSSIR 2022 news reviews in PDF and video form: https://www.ossir.org/support-des-presentations/?date=2022 and https://www.youtube.com/@OSSIR/videos
Let's go over this again:
The main question to ask is, "What was 2022? What characterized it?"
Unfortunately yes, still and again major vulnerabilities, massively exploited in the wild and allowing to almost totally compromise an enterprise 😥.
In 2022, we saw the aftermath of Log4J with new ways of exploiting the vulnerability (see review of 2022-01-11 and 2022-02-08) and variants of the former.
In 2022, a few days after the release of a patch for a Java code injection with the "Spring Expression Language" named Spring4Shell was released. (CVE-2022-22963). A kind of Log4J but fortunately requiring a configuration is not very common (see review of 2022-04-12).
In 2022, we understood that yes, there are major vulnerabilities in Cloud providers and yes, they can be exploited in the wild with gigantic impacts, like : Those affecting AWS CloudFormation (see review of 2022-02-08). Those affecting Azure Automation Account, allowing to retrieve the tokens of other customers (see review of 2022-03-08).
In 2022, we also saw many vulnerabilities affecting Microsoft Exchange such as ProxyNotShell, allowing a complete compromise and that Microsoft will have taken 3 months to fix (see review of 2022-10-11).
In 2022, we finally saw that Zimbra (the email suite) was targeted with exploits of vulnerabilities unknown to the editor (0-days) at the time of the attacks (cf. review of 2022-02-08, 2022-07-12, 2022-09-13, 2022-10-11).
Again and again vulnerabilities affecting microprocessors, which generally allow to read protected memory and sometimes even to elevate privileges.
These vulnerabilities are particularly troublesome in the case of shared infrastructure like the cloud:
It is perhaps one of the major events of the 2022 cybersecurity but not very visible: since July 2022, Office macros are disabled by default, if the document comes from the Internet (from an insecure zone) by mail, download, network share... Announced in February (see review of 2022-02-08), applied in July following a series of rocky blocks and backtracking: Microsoft has finally blocked the number 1 factor of compromises.
Unfortunately there are still workarounds with:
In 2022, we discovered the LastPass hack and the questionable communication of the publisher:
And many other hacks with potential consequences on thousands of companies or individuals:
What could be easier than hacking a supplier, a dependency (in the sense of a software library), a third party access... to hack the target at the end of the chain.
In 2022, we discovered:
In 2022, even bug bounty programs and were no longer secure, with HackerOne employees forging reports to steal and resell these vulnerabilities (see 2022-07-12 review)
You know it, we have been repeating it for years: you should NEVER expose an administration interface on the Internet, especially if it is a security product giving access to your internal resources. The editors of these security software and equipment remain editors, subject to the same pressures as everyone else and suffer, like everyone else, from critical vulnerabilities. The problem is that they are not software or hardware like any other and should not have critical vulnerabilities, at least not as trivial as some of those listed below.
In 2022, we saw again security solutions being compromised (and companies afterwards) due to exposed administration interfaces on the Internet like:
In 2022, we had many critical vulnerabilities on Palo Alto solutions such as the XDR Cortex (see 2022-02-08 review)
In 2022, as in previous years, Zoho's products suffered from numerous vulnerabilities, Manage Engine in the lead, some of which were trivial such as the takeover by a simple web request (CVE-2021-44515) (see review of 2022-02-08)
Fashions are cyclical. Would it be the same for vulnerabilities with the return of trivial vulnerabilities worthy of the 90s?
In 2022, we had a crazy amount of trivial ert vulnerabilities worthy of the 90s-2000s:
It has become our daily lot, companies, hospitals, communities that are ransomed with the publication of stolen data on the sites of cybercriminals and sometimes dramatic effects. Not a week goes by without an announcement of this type and it has unfortunately become a daily occurrence. These cybercriminals clearly have no soul.
These soulless individuals attacked in 2022:
Don't worry, the LockBit group has apologized for the compromise of a children's hospital in Canada 🤦♂️ (see review of 2023-01-10)
Fortunately, sometimes, these cybercriminals get hacked themselves, as with the publication of all the internal exchanges of the Conti group, which is pro-Russian, but with pro-Ukraine members (see review of 2022-03-08).
Shortage and weariness of employees, need to secure its applications, need to have more visibility... No, we are not talking about classic companies but about cybercriminal groups. They too have embraced the "startup nation" trend.
LockBit has announced a bugbounty program, a vulnerability buyout program, partnerships, recruitment... (see 2022-07-12 review)
Lapsus$, but who hasn't heard about this group that hacked:
No ransom demands, no threats to release data... but just publications of what they had stolen and a Telegram group to brag about their exploits. Companies were not ready for this type of threat, not ready to deal with attackers ... teenagers! 7 people were arrested including the potential 16 year old leader (see review of 2022-04-12).
And yes, an antivirus and an EDR is good, but it's not enough, especially since there are lots of bypass methods.
I'm not going to list them all but in almost every monthly OSSIR news review I've featured one or two... well, come on, yes, I'll put some of them on here 😉 :
Every year leaks, every week even...
Here are some of them:
If you are interested in the subject, here is a visual site showing data leaks by year: https://www.informationisbeautiful.net/visualizations/worlds-biggest-data-breaches-hacks/
Your personal data is a currency but above all, the solutions you use continue the collection even when you think it is not.
In 2022 (but also before), Cisco WebEx was listening to you even when the mic is off but rest assured, it's only for telemetry 🤪 (see review of 2022-06-14) In 2022, the world discovered that iPhones never really turn off and always listen in NFC as well as GPS: "Evil never sleeps" (see review of 2022-04-12) In 2022, intimate photos taken by robot vacuum cleaners were released on Facebook (see review of 2023-01-10)
It seems to be commonly accepted that cybercriminals are safe and, on a smaller scale, that there are no consequences for companies that don't play by the rules. The facts in 2022 have fortunately shown otherwise.
On the fines side, there were quite a few things in 2022, like:
Cyber is not experiencing a crisis with many buyouts, mergers or fundraisings.
On the buyout side:
On the fundraising side:
2022, the year private companies become aware of threats? Who hasn't heard of NSO Group and its malware (spyware?) Pegasus.
In 2022, we discovered that Pegasus was used :
As a result of all this, several actions have been taken:
Detecting and alerting against Pegasus is good, but there are still many companies offering this kind of services like :
The Team Jorge affair (but I topic mostly broke in 2023 in France):
In France, we have the best engineers... and this year, they shone!
In 2022, Synacktiv continued to show its muscles, with success, during international competitions such as Pwn2Own, Pwn2Own Vancouver (see review of 2022-02-08, 2022-04-12) In 2022, many French tools have been recognized worldwide as references:
Insurance is the principle of many paying for few, of a rare risk, costly but rare, which allows everyone to pay a little, to help the few exposed to risk, to a disaster (this is the "dispersion"). Except that in cybersecurity, more than half of the insureds suffer a loss, making the risk difficult to insure.
In 2022, we experienced an emotional elevator of announcements (or emotional roller coaster to fit the illustration above) with:
The cloud is magic, it works on its own except that no, it's just a commercial reformulation of outsourced hosting (with many of the products in service mode / SaaS, ok 😉 ). The cloud is just someone else's computer and that computer is not failure free, nor is it free of major failures impacting hundreds, thousands or even hundreds of thousands of businesses!
In 2022, we saw a lot of outages from the big cloud players:
And for you, what characterized this year? Despite my delay in publishing this article, I wish you a great 2023 and... happy Easter 🤣.
Happy New Year 2023, the year of text and image responses generated by "deep learning" at the top of kalitéy and accuracy, when asked to wish them a Happy New Year 2023 🤦♂️:
