By Anton Ivanov, Chief Technology Officer at Kaspersky

September 28, 2022

Digital transformation, that’s been boosted by the pandemic, has reached an unprecedented scale, with IDC expecting its global spending to reach $2.8 trillion within three years. Companies shifting their businesses online inevitably led to an increased adoption of digital products and a surge in IT expenditure. According to rough estimates, an average organization used about 110 different software-as-a-service applications in 2021. In comparison, that figure stood at 16 just five years ago. It’s clear that we are currently in a stage of high software consumption. What isn’t clear though is whether it has already peaked or if the peak is yet to come.

From a cybersecurity perspective, a business’ reliance on numerous types of software is a big issue as threat actors can benefit from the expanded attack surface. A recent global survey of over 400 companies showed that 98% of organizations were concerned about the security of their software. However, there isn’t much that they can do about it, aside of diligently patching their software as soon as updates are available.

However, on a level of mature enterprise, sustainability of IT infrastructure that includes various types software depends how much we know about each solution and our visibility into them. IT products are developed with extensive use of various open source libraries and elements sourced from third parties. With dozens and hundreds of software solutions in use, this means that achieving high level of visibility is extremely challenging. Without clear security requirements for evaluating software security and promoting greater transparency, the cyber domain is likely to remain under limited control.

One of the concepts aimed at streamlining the connections across software supply chains is Software Build of Materials (SBOM). Borrowed from manufacturing, where the ‘Build of Materials’ represents a list of items used in a product, SBOM is a de facto list of components that make up a software, containing comprehensive information and describing the relationships between each elements. By having SBOMs in place, businesses have more chance of coping with security vulnerabilities and cybersecurity risks in a prompt manner by employing automation tools which can track newly identified flaws across them all.

In the fall of 2021, as part of its transparency efforts, Kaspersky made its SBOMs available at the company’s Transparency Centers. These centers primarily serve as facilities for the review of the company’s code, software updates, threat detection rules and other technical and business processes. Along with measures implemented by Kaspersky as part of its Global Transparency Initiative (GTI), the inclusion of SBOMs aims to empower our customers and partners with the information on how exactly our products are designed, what components they are made of, and how they operate. In doing this, our key goal is to ensure greater visibility into our solutions, our work and to give firm assurance in the security and integrity of our products.

Despite the fact that regulators and private players have praised the SBOM concept as crucial for ensuring sustainable and safe software use, fresh statistics show that fewer than a half of software developers use SBOMs to some extent today. On top of that, a mere 18% of companies use SBOMs across all segments of their business or have established practices that include the use of SBOMs.

The situation could potentially change in the near future as some governments can start considering SBOMs a necessary measure to enhance risk management in supply chains. The first being the US where, after the SolarWinds incident, SBOM has been promoted at a government level to become a wide-industry effort. Hopefully, the SBOM concept for software transparency will turn into an international effort.

Speaking of clear security requirements for software security, the European Union has also started a wider discussion on a legal framework that would bring together cybersecurity rules for digital products and services. It is likely that other governments will follow the EU’s lead, ensuring software vendors place adequate cybersecurity safeguards in their solutions, effectively respond to vulnerabilities throughout their products’ lifecycle, and systematically provide information on the product’s security. All these measures, while requiring greater transparency from software manufacturers, have the potential to enhance the security of products and build public trust in the digital economy.

For Kaspersky, the security of our users and customers is our first and foremost priority. The trust of our customers has always been seen as indispensable, and that’s why we make every effort to provide them with as much visibility into our work as possible. In 2017 we launched our GTI which was aimed at further strengthening our relationships with our partners and customers by boosting their assurance and trust in our solutions and services. We continue to develop and strengthen this initiative, for example, we have recently successfully renewed our SOC 2 audit for the protection of the development and the release process of our antivirus basis by a Big Four firm.

The industry developments that we see today indicate that transparency is achieving greater prominence: this is reflected by developments within the industry and various governments’ increasing their attention to greater security and integrity of software. Kaspersky, for its part, will seek to deliver solid support for this trend, making further continued investment in digital trust and transparency.

Click here to purchase Kaspersky solutions on Shopee.

Cybercriminals hunt for unpatched software, one-day vulnerabilities, compromised remote protocols in the region

22 September 2022

Cyberattacks can be prevented before an attacker is inside the internal network. Threat monitoring allows organisations to take action and properly neutralise a threat before it can exploit any existing vulnerabilities and affect the target institutions.

Kaspersky today unveils the results of its Digital Footprint Intelligence (DFI) report covering the external threats for a selection of countries from the Asia Pacific (APAC) region in 2021, including the six key countries Southeast Asia (SEA).

The report’s sole purpose is to create awareness about security threats, and demonstrate effective approaches to risk mitigation for widespread attacks with high business impact.

Cybercriminals’ exploitation capabilities

The rapidly growing share of adversaries’ initial access approach is the exploitation of 1-day vulnerabilities. Complicated business processes are forced to leave services on the perimeter, which in turn increases the external attack surface.

With the help of public sources and specialised search engines, Kaspersky collected information on 390,497 services available from public networks and analysed them for key security issues and vulnerabilities.

Analysis revealed that in 2021, almost every fifth of the vulnerable services contained more than one vulnerability, thereby increasing the chances of an attacker performing a successful attack.

All industry sectors, analysed in the report[1], in all countries have issues with application of security updates for publicly available services.

Government institutions (major personally identifiable information (PII) processors and providers of critical services for citizens) are potential incident-generators by a huge margin.

Singapore has a low number of vulnerabilities and an outstanding low ratio between the number of services and the sum of vulnerabilities in them, while Vietnam, Indonesia, Thailand and Malaysia have the highest ratio among SEA countries

In terms of the share of vulnerabilities with publicly available exploits, 3 countries out of TOP-5 are located in Southeast Asia (SEA) – these are Malaysia, Vietnam, and Philippines.

From Kaspersky’s practice in incident response handled by Global Emergency Response Team (GERT) and CISA advisory adversaries use a well-known list of vulnerabilities to exploit organisation defenses.  While researching the security problems of companies from the APAC region, Kaspersky experts observed a number of commonly used vulnerabilities dubbed ProxyShell and ProxyLogon. Exploits for these vulnerabilities are easily available on the Internet, therefore, they can be easily exploited by even a low-skilled attacker.

While ProxyShell is quite common in China and in Vietnam, the countries most affected by ProxyLogon are:

• In Government bodies – Thailand
• In Financial – China
• In Healthcare – Philippines
• In Industrial – Indonesia

ProxyShell is a group of vulnerabilities for Microsoft Exchange servers – CVE-2021-31206, CVE-2021-31207 , CVE-2021-34473, and CVE-2021-34523. ProxyLogon group includes CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065. The vulnerabilities from the both groups enable an actor to bypass authentication and execute code as a privileged user.

The best defense against these vulnerabilities is to keep public-faced systems updated with the latest patches and product versions. Companies should also avoid direct access to Exchange Server from the Internet.Kaspersky products protect against vulnerabilities from theboth groups – ProxyShell and Proxy-logon.

Credential brute force attacks

A great share of attackers’ initial accesses leading to cybersecurity incidents are related to services with remote access or management features. One of the best-known examples is RDP (Remote Desktop Protocol). It is Microsoft’s proprietary protocol that enables a user to connect to another computer through a network of computers running Windows.

RDP is widely used by both system administrators and less-technical users to control servers and other PCs remotely but this tool is also what intruders exploit to penetrate the target computer that usually houses important corporate resources.

Last year, Kaspersky monitored 16,003 remote access and management services available for exploit. Indonesia, India, Bangladesh, the Philippines, and Vietnam provide the maximum facilities for an attacker to gain remote access.

Government institutions are serving more than 40% of the attack surface for brute force attacks and credential leaks reuse.

“Clearly, cybercriminals are busy uncovering possible entry points in the region. From hunting for unpatched software, one-day vulnerabilities, and exploitable remote access and management services, malicious actors have a lot of options to infect lucrative industries. In short, a cyberattack is like a ticking bomb. While worrisome, reports such as our Digital Footprint Intelligence can be used as a tool to guide the cybersecurity capacity building of concerned organisations. If you know your weak areas, it’s easier to prioritise,” comments Chris Connell, Managing Director for Asia Pacific at Kaspersky.

To protect your businesses from such threats, Kaspersky experts also recommend that you:

• Regulate every major change to the network perimeter hosts, including services or applications launching, exposing new APIs, software installation and updating, network devices configuration and so on. All changes should be reviewed from the perspective of security impact.
• Develop and implement reliable procedure for identifying, installing, and verifying patches for products and systems.
• Focus your defense strategy on detecting lateral movements and data exfiltration to the internet. Pay special attention to outgoing traffic to detect cybercriminal connections. Back up data regularly. Make sure you can quickly access it in an emergency.
• Use solutions likeKaspersky Endpoint Detection and Response and the Kaspersky Managed Detection and Response service, which help to identify and stop the attack in the early stages, before the attackers achieve their goals.
• Use a reliable endpoint security solution, such as Kaspersky Endpoint Security for Business(KESB) that is powered by exploit prevention, behavior detection, and a remediation engine that is able to roll back malicious actions. KESB also has self-defense mechanisms that can prevent its removal by cybercriminals.

Read the full Digital Footprint Intelligence report for APAC on Securelist.com.

[1] Financial, healthcare, industrial, governmental