Elevando o nível dos atacantes: como a microssegmentação pode proteger as organizações contra ataques semelhantes aos do Kaseya

One reason why IT security vendors can never let their guard down is the constant innovation coming from the cybercrime community. Knowledge spreads far and wide across underground forums with a speed that can take many organizations by surprise. So when we saw some of the techniques used in the infamous SolarWinds campaign applied in the recent Kaseya ransomware attacks, we shouldn’t have been surprised.

However, by deploying micro-segmentation in the right places, organizations could have made life a lot harder for the bad guys — both in minimizing the risk of initial zero-day exploitation and blocking subsequent command and control communications.

O que aconteceu no ataque de Kaseya?

Kaseya provides software primarily to managed service provides (MSPs) to streamline essential IT tasks like patching and remote monitoring for smaller and mid-sized businesses. As was the case with SolarWinds software, the Kaseya VSA product that was targeted in this attack is granted highly privileged access to perform its core tasks for remotely monitoring and managing networks and computing devices — making it the ideal choice for spreading malware far and wide.

An additional benefit for the REvil ransomware affiliates behind the attack is the nature of Kaseya’s customers. As MSPs, they each have multiple customers of their own which the attackers could infect and extort. That’s a pretty good ROI for cybercriminals looking to make some easy money.

Kaseya has detailed its response to the attack. The vendor was first notified about a breach on July 2, just before the holiday weekend in the U.S. It appears that the threat actors used a zero-day authentication bypass exploit in the web interface of the on-premises Kaseya VSA. This helped them gain an authenticated session, upload their payload, and then execute commands via SQL injection.

With access to the MSPs’ Kaseya VSA servers, they were able to push out a fake update to these organizations’ customers, dubbed “Kaseya VSA Agent Hot-fix,” which was in fact REvil/Sodinokibi ransomware.

Acredita-se que menos de 60 MSPs de um potencial de 40.000 clientes tenham sido afetados. Mas o impacto indireto significou que os clientes posteriores dos MSPs foram infectados com ransomware, totalizando cerca de 1.500 organizações em todo o mundo, de escolas a supermercados.

Um patch para a vulnerabilidade de dia zero explorada foi lançado, mas para essas empresas comprometidas, é tarde demais.

Como a microssegmentação pode ajudar: tráfego de entrada

MSPs could have mitigated the initial breach by restricting administrative access to the Kaseya VSA web interface. In this way, only specific authorized users from a small set of bastion hosts would be able to access the Kaseya software on management ports.

Na verdade, eles estariam usando a microssegmentação para reduzir a superfície de ataque, colocando barreiras extras no caminho dos cibercriminosos para que eles tivessem que trabalhar muito mais para implantar uma exploração de dia zero. Combine isso com a autenticação multifatorial para esses usuários autorizados limitados e você tornará exponencialmente mais difícil para os cibercriminosos invadirem sua rede.

Ao forçá-los a passar mais tempo e fazer mais “barulho” enquanto pesquisam na rede em busca de uma porta destrancada, você também ajuda suas ferramentas de detecção e resposta a ameaças a “ouvi-los” enquanto eles se escondem no escuro.

Como a microssegmentação pode ajudar: tráfego de saída

A segunda maneira pela qual a microssegmentação ajuda é com a comunicação de saída de terminais infectados para a Internet.

At some point, cybercriminals typically need to communicate with their command and control (C&C) server to provide instructions and download malicious payloads. By ensuring that policies limit outbound connectivity from the Kaseya infrastructure to only well-known and pre-approved IP addresses, you could stop attackers in their tracks. If the criminals can’t communicate with their own servers, they can’t proceed to the next stage of the attack.

Zero Trust começa com a segmentação

To protect your organization against ransomware attacks like Kaseya and SolarWinds, organizations need to develop robust and comprehensive Zero Trust policies and practices across their entire IT infrastructure. And Zero Trust starts with segmentation, since breaches will happen and criminals will find an unlocked door somewhere on your network. The key is to make sure they can’t go any farther.

Não há solução mágica na segurança. Mas, ao aplicar uma microssegmentação como essa, você tem uma grande chance de tornar a vida significativamente mais difícil para seus atacantes, pelo menos aumentando as chances de detecção e, idealmente, forçando-os a desistir e seguir em frente.