ZeroFox Daily Intelligence Brief

ZeroFox Daily Intelligence Brief - April 26, 2023

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup with recommendations that aim to give you and your clients an advantage over the adversary.

Key Findings

Chinese Hackers Could Breach U.S. Government Networks Within Five Years
Industrial Organization Exposed to Remote Attacks Through a Vulnerability Found in RTU
New SLP Bug May Lead to Massive DDoS Amplification Attacks

Chinese Hackers Could Breach U.S. Government Networks Within Five Years

A leaked document reveals that China is testing capabilities to bypass the "zero-trust" cybersecurity model adopted by the U.S. government. The zero-trust model incorporates identity verification, access limitation, and operating under the assumption that attackers have already breached an organization’s networks. The Defense Department and White House have made zero-trust a cybersecurity priority, and President Biden's proposed 2024 budget includes further spending on the model. Despite the U.S. government’s efforts, Chinese-state employment of advanced infiltration techniques could still grant them access to government networks within the next five years. The document, leaked on Discord, mentions progress made by the Chinese state in order to prepare for a breach of the defenses used by the U.S. Defense Department and other federal agencies.

Recommendations:

Enable robust logging of internet-facing services and monitor logs for signs of compromise.
Isolate internet-facing services and disable external management capability in a network Demilitarized Zone (DMZ) to reduce the exposure of internal networks.

Industrial Organization Exposed to Remote Attacks Through a Vulnerability Found in RTU

A Remote Terminal Unit (RTU) manufactured by Slovenia-based industrial automation company Inea has a critical vulnerability that can expose industrial organizations to remote hacker attacks. The vulnerability was published by U.S. Cybersecurity and Infrastructure Security Agency (CISA) in an advisory tracked as CVE-2023-2131 and can impact Inea ME RTUs running firmware versions prior to 3.36, allowing for remote code execution. The impacted product provides a data interface between remote field devices and the control center through a cellular network. This product is used worldwide in industries related to energy, transportation, water and wastewater.

Recommendations:

Impacted industrial organizations should immediately consider updating the firmware to version 3.36 or later released by Inea.
Locate control system networks and remote devices behind firewalls and isolate them from business networks. Use secure methods, such as Virtual Private Networks (VPNs), when access is required.

New SLP Bug May Lead to Massive DDoS Amplification Attacks

A reflective denial-of-service (DoS) amplification vulnerability in the Service Location Protocol (SLP) may allow hackers to organize a massive 2,200X amplification DoS attack. About 2,000 organizations are using devices that expose roughly 54,000 exploitable SLP instances for use in distributed denial-of-service (DDoS) amplification attacks. The flaw, tracked as CVE-2-23-29552, causes vulnerability in services that include VMWare ESXi Hypervisors, Konica Minolta printers, IBM Integrated Management Modules, and Planex Routers deployed by unsuspecting organizations worldwide. Most vulnerable instances are in the United States, Great Britain, Japan, Germany, Canada, France, Italy, Brazil, the Netherlands, and Spain and are owned by several Fortune 1000 companies in technology, telecommunications, healthcare, insurance, finance, hospitality and transportation.

Recommendations:

To protect an organization's assets from potential exploitation, disable SLP services on systems exposed to the internet or untrusted networks.
To prevent exploitation of SLP services through malicious requests, organizations can configure a firewall that filters traffic on UDP and TCP port 427.