A recent survey showed a surprising correlation between those who operate their businesses with risk and compliance data in silos and those who experienced data breaches in the last 24 months.

What are the consequences of operating your business with risk and compliance data in silos? Turns out, it might be more impactful than you think.

A recent 2023 survey of more than 1,000 IT risk, compliance, and security professionals found a correlation between data silos and breaches: namely, that companies operating with their risk management and compliance operations data in silos experienced a higher frequency of breaches.

Let's dig into the data.

**Risk Management Confidence Remains High, but Data Silos Persist**

First, let's start with risk. Survey respondents take risk management seriously, with a staggeringly high 93% of respondents feeling that they've done well in identifying and assessing risks. Additionally, 56% of infosec professionals are conducting annual security risk assessments, and 27% are conducting biannual assessments, meaning risk management is top priority for respondents. In short, confidence to address risk is high.

    

However, although respondents grasp the importance of risk management, according to the data, their processes for managing IT risks lag behind their intentions. Despite this overwhelming confidence respondents have about identifying and assessing risks, 51% said they struggle with identifying where the critical risks are to assess what remediations to prioritize. Thirty percent of respondents said their process to identify controls that can mitigate risks does not meet their company's objectives, and 39% of all respondents said they struggle with finding risk-related information when they need it.

    

Why are survey respondents so confident in their ability to address risks but still struggling to identify risk-related critical tasks? The answer is simple: 90% of surveyed organizations are managing risk management and compliance operations activities in silos, which is opening them up to vulnerabilities. Thirty-eight percent of respondents admitted that they switch between multiple systems throughout the risk management process and that they have separate places for risk assessments vs. tracking remediation efforts, such as multiple spreadsheets containing risk assessment results or multiple platforms tracking risk.

**The Connection Between Data Silos and Security Vulnerabilities**

The survey uncovered that only 10% of respondents have an integrated view on how to manage their unique set of risks and have aligned their risk and compliance activities, and organizations that managed risk in an ad hoc manner or only when a negative event happened were more likely to experience a breach.

    

Let's break these metrics down a little more:

Managing risk ad hoc or in siloed departments had negative impacts on those surveyed: One in two companies managing risk ad hoc or in siloed departments experienced a breach in 2022. Parsing this number further, we saw that 61% of companies that characterized their risk management approach as "ad hoc" experienced a breach, and 46% of those managing risk in siloed departments experienced a breach.

In contrast, only 36% of companies with an integrated approach and manual tools experienced a breach. Additionally, only 30% of companies with an integrated approach and automated tools experienced breaches.

    

The takeaway? Companies that unified their risk and compliance operations did not suffer the same frequency of breaches, indicating that operating in silos opens companies up to vulnerabilities.

**The Power of Unifying Risk and Compliance Data**

Although risk and compliance continues to operate in silos, respondents recognize the benefits of changing this reality. Fifty-seven percent of respondents said that having a solid compliance program helps them mitigate risks, even though risk management and compliance activities are typically conducted in response to separate events.

Taking an integrated approach to risk and compliance operations allows organizations to focus on their unique set of risks while avoiding duplicate activities across their risk and compliance management processes. Organizations that take this approach typically start the risk management process with conducting a risk assessment. From there, they create security policies and implement internal controls tailored to the results of their risk assessment. This allows for greater alignment throughout the organization by allowing for input from all stakeholders, not just a select few. Also, it helps create a compliance program that integrates directly with risk operations.

The survey results provided evidence that organizations taking an integrated approach have better security posture than their counterparts who view compliance solely as the function that enforces rules and regulations: On average, organizations that take an integrated approach to risk management experienced security breaches less often than those who view their compliance function as the enforcer of rules. Additionally, as a group, organizations that take an integrated approach spend less time on repetitive and administrative tasks compared to those who believe the compliance function's purpose is to enforce the rules.

To learn more, read the full survey report here.

**About the Author**

    

Kayne McGladrey, CISSP, is the field CISO for Hyperproof and a senior member of the IEEE. He has over two decades of experience in cybersecurity and has served as a CISO and advisory board member, and focuses on the policy, social, and economic effects of cybersecurity lapses to individuals, companies, and the nation.

Survey Findings Show Link Between Data Silos and Security Vulnerabilities

In order to reduce cybersecurity risks and failures, organizations will need to focus on employees, management, and new operating models.

In order for cybersecurity initiatives to be effective in reducing security failures, Gartner, a research and consulting firm, finds that it will be essential for security and risk management leaders to turn to a human-centered approach.

A human-centric approach in cybersecurity practices prioritizes the individual employee and their experience, which ultimately encourages better practices while also reducing friction and risk. 

In the past, there has been a focus in improving the technology or the many different processes that uphold security practices. Going forward, having a "human-centric talent management approach" means focusing on the employees that require these kinds of updates to technology and program processes to be made in the first place, and shifting from external hiring to internal or "quiet hiring," according to Gartner.

In addition to a human-centric security design and enhancing people management in security programs, changing the cybersecurity operating model will also be amongst the top three trends in cybersecurity for 2023, according to the analyst firm. It will be necessary for employees to understand and manage a variety of different types of risks related not only to cybersecurity, but also "financial, reputational, competitive, and legal risks." 

Creating effective cybersecurity policies and initiatives is not a one and done deal, analysts stressed, but instead requires continuous management and integration into the model of the core business strategy.

"Business leaders now widely accept that cybersecurity risk is a top business risk to manage — not a technology problem to solve," Richard Addiscott, senior director analyst at Gartner, said in Gartner's announcement. "Supporting and accelerating business outcomes is a core cybersecurity priority yet remains a top challenge."

The additional six cybersecurity trends for 2023 noted in Gartner's rundown this week are:

*   Threat Exposure Management
*   Identity Fabric Immunity
*   Cybersecurity Validation
*   Cybersecurity Platform Consolidation
*   Composable Business Need Composable Security
*   Boards Expand Their Competency in Cybersecurity Oversight

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

Gartner: Human-Centric Design Is Top Cybersecurity Trend for 2023

CrowdStrike Falcon Insight for IoT covers  Internet of Things, Industrial IoT, Operations Technology, as well as medical devices.

Cybersecurity vendor CrowdStrike introduced new extended detection and response (XDR) capabilities within its Falcon platform to secure “extended” internet of things (XIoT). CrowdStrike Falcon Insight for IoT delivers tailored threat prevention, rapid patch management, and interoperability across XIoT assets.

XIoT is a broader category of assets and encompasses the Internet of Things, Industrial IoT, Operations Technology, as well as medical devices.

The IT/OT convergence means security teams are now responsible for securing critical infrastructure systems. Gartner estimates 70% of organizations will have converged “security functions across both enterprise and operational environments” by 2025.

However, traditional IT security solutions don’t interoperate with XIoT assets, lack context for effective threat prevention and detection, and disrupt operations. CrowdStrike Falcon Insight for IoT collects asset-specific context such as device type, operating system version, and protocols and provides response actions, such as host/process containment and USB device control. Tailored, AI-based threat prevention stops threats at the source, and custom policy recommendations help organizations limit system burden and manage sensor updates.

With Falcon, organizations can use the same platform across IoT, IT endpoints, cloud workloads, identities, and data, CrowdStrike said.

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

CrowdStrike Expands Falcon to Include IoT

Devastating cyberattacks often can be prevented with basic cybersecurity measures.

The LastPass breach will be remembered as paradigmatic. The blast radius from this August 2022 breach grew from bad to catastrophic during a six-month period. Initially, the LastPass CEO declared the breach contained. However, in November 2022, an unknown threat actor was discovered to have accessed the LastPass' cloud-based storage environment and encrypted password vaults using information obtained during the August incident. By the end of the year, LastPass confirmed that customer data, including encrypted passwords and usernames, had been compromised. 

On March 3, it was revealed that the root cause of the LastPass data breach was surprisingly basic. The attacker compromised a LastPass DevOps engineer's personal computer through an old vulnerability in a third-party media software package called Plex, which was apparently used by an employee for personal purposes. Consequently, the computer was infected with a keylogger, allowing threat actors to steal partially encrypted password vault data and customer information. 

The recently revealed details of the LastPass data breach provide important lessons for organizations, particularly security companies. 

**Adhere to Your BYOD Policy: A Must for Privileged Users**

It's concerning that four LastPass engineers with access to highly sensitive assets were able to use their personal devices, including personal applications, for work purposes. Personal devices often lack the same security protocols and patches as company-issued devices, and they may be used by family members or for non-work-related activities, which can significantly increase the risk of compromise. According to a survey by Action1, 43% of IT professionals reported that the top risky behavior remote workers are susceptible to is allowing family members to use corporate devices for activities unrelated to work.

To mitigate these risks, organizations should have strict security policies that apply to all users, particularly privileged ones. Issuing company-owned devices subject to regular security updates and protocols is the best practice. However, in situations where personal devices are used for work, it's essential to establish a robust bring-your-own-device (BYOD) policy, ensuring that personal machines follow the same security measures as company-issued devices, including regular updates, anti-malware software, and multifactor authentication (MFA). 

**Don't Let Legacy Vulnerabilities Put Your Endpoints at Risk**

In the LastPass breach, the attacker exploited a vulnerability in a third-party media software package called Plex. Although Plex had issued a patch for the vulnerability 75 versions ago, the employee's machine at LastPass had not been updated. This underscores the importance of companies remaining vigilant in their patch management, especially for third-party software. It's also essential to monitor the software installed on employees' machines and ensure that it adheres to corporate security policies. However, it's not just legacy security vulnerabilities that can be found in unapproved third-party software — they can also exist in commonly used apps like browsers. It’s hard to underestimate the importance of automated patch management for both OS and third-party applications in cybersecurity.

**Avoid Easily Bypassed MFA**

The LastPass breach highlights the limitations of MFA. In that incident, keylogging malware captured an employee's MFA token, allowing the attacker to bypass this security measure. This shows that not all MFA methods are equally secure. 

The thing is, despite the popularity of MFA, some organizations may have adopted it without fully understanding the nuances of different MFA methods. There are many services that provide authentication via SMS, email, or authentication applications. However, the reality is that MFA with hardware tokens is the most secure one. Hardware tokens generate unique passcodes that are difficult to intercept or replicate, and they do not rely on Internet or cellular connections and should be considered for securing access to services with highly sensitive assets. 

**Build Security Into Your Products and Infrastructure From the Start**

Although LastPass declared advanced security measures for their products, the breach revealed gaps in various areas. For example, LastPass stored MFA seeds and the split knowledge component (K2) key together, which allowed threat actors to access them after obtaining decryption keys for encrypted backups of the LastPass MFA/federation database. It would have been more prudent to store these highly sensitive assets separately. Additionally, although LastPass requires users to implement strong master passwords, these measures are not always enforced, and notifications may not be noticeable enough, as indicated by some experts. 

This suggests that a typical situation occurred where IT architecture develops in response to business demand for meeting the needs and capturing the market, and IT security is incorporated into the architecture only later on. As a result, it becomes difficult to incorporate security policies and redesign the architecture accordingly. Therefore, it's better to consider IT security from the outset of product development. 

**Conclusion**

Devastating cyberattacks often can be prevented with basic cybersecurity measures, yet even security companies can make mistakes. We should learn from these errors to improve our own security practices.

LastPass Breach Reveals Important Lessons

A wide-ranging campaign to inject malicious code into WordPress-run websites has been ongoing for at least five years.

At least 1 million websites that run on WordPress have been infected by a campaign that uses rafts of WordPress plug-in and theme vulnerabilities to inject malicious code into sites, including a hefty number of zero-days.

According to research from Sucuri, the campaign, which the firm dubbed "Balada Injector," is not only prolific but also Methuselah-like in its longevity, slamming victim sites with malware since at least 2017. Once injected into the site, the bad code redirects website visitors to a panoply of scam sites, including fake tech support, fraudulent lottery wins, and push notifications asking for Captcha solutions.

Behind the scenes, though, injected scripts search for various files that could contain any sensitive or potentially useful information, such as access log files, error logs, files with debug information, database administration tools, administrator credentials, and more. They also load backdoors into the sites for persistent access and in some cases, site takeover.

While the 1 million stat is the number of sites collectively infected in the last five years, researchers only recently tied all of the activity into one operation. Going forward, the campaign shows no signs of slowing down.

"In 2022 alone, our external website scanner SiteCheck detected this malware over 141,000 times, with more than 67% of websites with blocklisted resources loading scripts from known Balada Injector domains," Sucuri researchers noted in a blog post.

**A Focus on WordPress Plug-in & Theme Vulnerabilities**

The Balada Injector campaign has a few instantly recognizable hallmarks that allowed Sucuri researchers to bring all of the observed activity under one attribution umbrella. These include uploading and leaving multiple backdoors throughout the compromised environment; using a rotating roster of domain names where malicious scripts are hosted on random subdomains; and the spammy redirects.

But perhaps most notably, the operators of Balada Injector make very good use of security vulnerabilities in WordPress plug-ins and themes. These types of modular add-ons to the main WordPress content management system (CMS) allow site admins to add various kinds of functionality, such as polling capability, message board support, or click-to-call integration for e-commerce outfits.

"All sorts of vulnerabilities in WordPress themes and plugins can allow an attacker to inject code or gain unauthorized access to the website — which can eventually be escalated to the level where code injections are possible," according to the Sucuri analysis. "This entire time, Balada Injector has been quickly adding newly disclosed vulnerabilities (and sometimes undisclosed zero-days), occasionally starting massive waves of infections within a few hours after vulnerability disclosures."

In fact, this bug-centric strategy dictates the cadence of the attacks — Sucuri has been tracking fresh waves of activity occurring every couple of weeks, with lulls in between that are "probably utilized for gathering and testing newly reported and zero-day vulnerabilities."

Further, older vulnerabilities are part of the mix as well, with some remaining in use by the campaign for months and years after being patched.

**Targeting the WordPress Ecosystem**

The WordPress landscape is a popular target for cybercriminals of all stripes, helped along by the fact that the plug-in ecosystem is notoriously buggy.

"Depending on how you measure it, in 2023, WordPress still powers 60% of the websites available on the Internet today," says Casey Ellis, founder and CTO at the Bugcrowd bug bounty platform. "The sheer volume of code that goes into this, the degree of customization often present on WordPress sites, and in general the WordPress plug-in ecosystem's complexity, popularity, and the lack of consistent security measures and practices, contribute to its attractiveness to cybercriminals as a rich hunting ground for exploitable bugs."

iThemes, a firm that tracks plug-in ecosystem flaws on a weekly basis, tallied 37 newly disclosed and patched plug-in vulnerabilities (and one theme vulnerability) for the week of March 15, affecting more than 6 million WordPress sites. It also counted 27 plug-in vulnerabilities (and three theme vulnerabilities) with no patch available yet. And those significant numbers are not unusual.

In all, iThemes identified a total of 1,425 disclosed WordPress plug-in and theme vulnerabilities in 2022 — and in any given week, 20 to 50 individual plug-ins and themes experienced at least one vulnerability, with a monthly average of 121 individual plug-ins and themes that had at least one vulnerability emerge.

iThemes' report also noted that vulnerable WordPress plug-ins and themes are the No. 1 reason WordPress sites get hacked.

"WordPress definitely needs updating on a regular basis, more so if you have a website that has a lot of plug-ins and third-party code, and this is one of many examples where security ends up being just that little bit too difficult for the average user who's also trying to run a business," Ellis notes.

**Protecting Against WordPress Plug-in Insecurity**

In order to protect against Balada Injector and other WordPress threats, organizations should first and foremost ensure that all of their website software is up-to-date, remove unused plug-ins and themes, and utilize a Web application firewall.

Mike Parkin, senior technical engineer at Vulcan Cyber, explains that the ability to add plug-ins easily to WordPress from official download stores (much like the mobile app ecosystem) adds to the security issue, so education for the Web team around the dangers of installing unvetted modules is also a must.

"The myriad available plug-ins, multiple places to get them, and the ease of deployment — you have a recipe for easy malicious plug-in distribution," he says.

Even large organizations aren't immune to WordPress security problems. "There are cases, even in large enterprises, where a website is developed and maintained by an individual or small team," he says. "Often, those folks aren’t especially security conscious and are more interested in keeping their site up and fresh than they are in doing it securely. Patches get missed. Security alerts get missed. New and interesting plug-ins get installed without making sure they are safe or, sometimes, even work."

1M+ WordPress Sites Hacked via Zero-Day Plug-in Bugs

The April 2023 Patch Tuesday security update also included a reissue of a fix for a 10-year-old bug that a threat actor recently exploited in the supply chain attack on 3CX.

Microsoft's Patch Tuesday security update for April 2023 contains patches for 97 CVEs, including one zero-day bug under active exploit in ransomware attacks, another that's a reissue of a fix for a flaw from 2013 that a threat actor recently exploited in a supply chain attack on 3CX, and a wormable bug rated critical in severity.

Microsoft identified a total of seven of the bugs it fixed this month as being of critical severity, which typically means organizations need to make them a top priority from a patch implementation standpoint.

**Zero-Day Used in Ransomware Attacks**

Nearly half, or 45, of the vulnerabilities in the April update enable remote code execution (RCE), a significant uptick from the average of 33 RCE bugs that Microsoft has reported in each of the previous three months. Even so, the company rated nearly 90% of the CVEs in the latest batch as bugs that cyberattackers are less likely to exploit — just 9% are characterized as flaws that threat actors are more likely to exploit.

The zero-day bug, tracked as CVE-2023-28252, is an elevation-of-privilege vulnerability in the Windows Common Log File System (CLFS) that affects all supported versions of Windows 10 and Windows Server. It is the second CLFS zero day in recent months — the other was CVE-2022-37969 — and it gives adversaries who already have access to the platform a way to gain highly privileged system-level privileges. 

"This vulnerability leverages existing system access to actively exploit a device and is a result of how the CLFS driver interacts with objects in memory on a system," said Gina Geisel, a security researcher at Automox. To exploit the flaw, an attacker would need to log in to a system and then execute a malicious binary to elevate privileges. 

"Automox recommends patch deployment within 24 hours since this is an actively exploited zero-day," Geisel said in emailed comments to Dark Reading.

In a blog post issued in tandem with Microsoft's update, Kaspersky said its researchers had observed a threat actor exploiting CVE-2023-28252 to deliver Nokoyawa ransomware on systems belonging to small and midsized organizations in North America, the Middle East, and Asia. The security vendor's analysis shows that the exploits are similar to already-known driver exploits targeting CLFS. 

"The exploit was highly obfuscated with more than 80% of its code being 'junk' elegantly compiled into the binary," according to the analysis. Kaspersky researchers said they reported the bug to Microsoft after observing an adversary using it in ransomware attacks in February.

**A Patch From the Past**

Another patch in Microsoft's April update that researchers are recommending organizations pay attention to is CVE-2013-3900, a 10-year-old signature validation vulnerability in the Windows WinVerifyTrust function. A threat actor — believed to be North Korea's Lazarus Group — recently exploited the flaw in a supply-chain attack on 3CX that resulted in malware landing on systems belonging to users of the company's video-conferencing software. 

When Microsoft released the patch in 2013, the company had decided to make it an opt-in patch because of the potential for the fix to cause problems for some organizations. With the April security update, Microsoft has made the fix available for more platforms and provide more recommendations for organizations on how to address the issue. 

"Definitely take the time to review all of the recommendations, including the information on the Microsoft Trusted Root Program, and take the actions needed to protect your environment," Dustin Childs, researcher with Trend Micro's Zero Day Initiative (ZDI) said in a blog post.

**A Slew of RCE Vulnerabilities**

Researchers identified two of the critical vulnerabilities in April's batch as needing immediate action. One of them is CVE-2023-21554. 

The bug affects Microsoft Message Queuing (MSMQ) technology and gives attackers a way to gain RCE by sending a specially crafted MSMQ packet to a MSMQ server. The vulnerability affects Windows 10, 11, and Server 2008-2022 systems that have the message queuing feature enabled on their systems, Automox researcher Peter Pflaster said in emailed comments. Administrators should consider applying Microsoft patch for the issue ASAP, since the company has noted that threat actors are more likely to exploit the vulnerability.

That's just one of two critical vulnerabilities affecting the Windows Message Queuing system that Microsoft fixed this week. The other is CVE-2023-28250, a vulnerability in Windows Pragmatic Multicast that, like CVE-2023-21554, has a base score of 9.8 and is potentially wormable. 

"This patch Tuesday MSFT fixed some critical flaws, of which we would recommend organizations to prioritize patching vulnerabilities those that are actively being exploited and wormable," said Bharat Jogi, director of vulnerability and threat Research, at Qualys.

The other critical vulnerability that needs immediate fixing is CVE-2023-28231, a RCE bug in the DHCP Server service. Microsoft has assessed the bug as another issue that attackers are more likely to try and weaponize. To exploit the bug, an attacker would need prior access on a network. But once on it, the adversary could initiate remote code execution on the DHCP server, according to Kevin Breen, director of cyber threat research at Immersive Labs. 

"Microsoft recommends that DHCP services are not installed on Domain Controllers, however, smaller organizations will commonly see DC and DHCP services co-located. In this instance the impact could be a lot higher," Breen warned in emailed comments. Attackers that have control over DHCP servers could wreak considerable havoc on the network including stealing credentials for software-as-a-service (SaaS) products, or to carry out machine-in-the-middle (MITM) attacks, he noted.

Microsoft Patches 97 CVEs, Including Zero-Day & Wormable Bugs

Azure admins are urged to disable shared key access and implement Azure Active Directory authentication.

Abuse of shared key authorizations, a default on Azure storage accounts, could allow a threat actor to steal higher privileged access tokens, move laterally throughout the network, and execute remote code, aka RCE.

Researchers at Orca were able to demonstrate how an attacker could breach Microsoft Storage Accounts, but Microsoft's Security Response Center (MSRC) chalked it up to a misconfiguration rather than a vulnerability. MRSC did offer guidance to users to appropriately configure Azure Functions and "effectively deploy environments with the least privilege." The company said it is planning to address the issue as part of its regular "experience improvements."

Orca researchers urge IT teams to take the issue seriously, and added that even though Microsoft doesn't consider the potential privilege escalation a vulnerability, "This does not mean that it is less dangerous," Orca's report said. "Actually, it should be considered even more dangerous since there is no straightforward 'fix'."

Administrators are advised by Microsoft to:

1.  Review user permissions to ensure least-privilege access
2.  Monitor logs for account key access
3.  Consider using a storage account dedicated to application code blob storage
4.  Enable Microsoft Defender for Cloud (MDC) on storage accounts

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

Microsoft Azure Shared Key Misconfiguration Could Lead to RCE

Malware-as-a-service hackers from Spain decided to use a public code repository to openly advertise their wares.

Researchers have discovered malware peddlers advertising an info-stealer out in the open on the Python Package Index (PyPI) — the official, public repository for the Python programming language — with only the thinnest veneer of obfuscation.

The perpetrators — whom researchers from Sonatype associated with a Spain-based malware-as-aservice (MaaS) gang called SylexSquad — gave their program a not-so-subtle name: "reverse-shell." Reverse shells are programs that hackers commonly use to run commands remotely and receive data from targeted computers.

"I think what's quite funny about this is that it's just so blatant," says Dan Conn, developer advocate at Sonatype. "Perhaps SylexSquad were advertising themselves, or they simply didn't care about being caught."

However, their brazenness doesn't end there.

**Inside the 'reverse-shell' Data-Heisting Malware**

Sonatype researchers did a double-take when they found a package called "reverse-shell" uploaded to a public forum. "Why would someone name a malicious package in such an blatantly obvious way?" the researchers wondered in their Malware Monthly blog post.

The program turned out to be much more than a reverse shell, in fact. That became clear when the researchers examined one of its files, called "WindowsDefender.py."

WindowsDefender.py includes various obviously named functions, including get\_login\_data(), get\_web\_history(), get\_downloads(), get\_cookies(), get\_credit\_cards(), and ImageGrab.grab(). Per the theme, the hackers had not tried hard to conceal their intentions: this was malware designed to steal information.

"With no obfuscation, \[this\] appears to be ... a Discord bot that executes commands and performs actions on the infected machine," according to the analysis. "The malware can retrieve cookies, take screenshots, run shell commands, steal browsing history, and send all this data to the attacker's Discord channel."

Further answers lay in another file, "setup.py." Here, there were several Spanish-language instructions to "Clone GitHub repository and execute file," "replace with URL of your GitHub repository," and "path where you want to clone the repo" — an indication that reverse-shell was a MaaS product.

Further digging uncovered multiple "Made by SylexSquad" tags scattered in the code, some of which was lightly obfuscated. SylexSquad, the researchers found, was once a hacking marketplace operating over the Sellix e-commerce platform in 2022. It has since been shut down.

Publishing so openly to a public repo may have been a way for the group to intentionally draw attention to their product. "How do we know about groups like Anonymous or LulzSec or Killnet?" Conn asks, rhetorically. "It's because they get a reputation."

But PyPI holds much more value to them than that.

**Why Hackers Use Public Repos**

The SylexSquad attackers aren't the only miscreants utilizing forums like PyPI and GitHub, and there are many reasons for such brazenness, according to Sonatype.

"Hosting malicious files on a public repository provides bad actors more control over them," the researchers explained in their blog. "It gives them the power of deleting, upgrading, or even doing version control of the payload."

Among other benefits, "it allows the malware to be shared a lot more widely," Conn elaborates, "and it might actually trip up, in particular, a lot of antivirus software that uses generic signatures — like, actual bytes — to store whether something is malicious or not."

In other words, rather than delivering malware upfront — which antivirus scanners can pick up on quickly — hackers can simply link to their malicious code elsewhere: "By providing a link to a GitHub, they're maybe circumventing that check,"”" he notes.

Public repositories have protective measures in place to avoid becoming a hub for hackers. Still, even the best scanners and moderators aren't perfect, and they can't be everywhere at once.

"Hackers take certain measures like encoding or otherwise obfuscating the code they host, to make it a little bit more difficult for automated engines to pick up," Juan Aguirre, security researcher at Sonatype, points out. In this case, SylexSquad encoded their malicious script as numbers, using easily reversible ASCII codes corresponding to each character.

In this case, Sonatype reported the package to the PyPI maintainers and it was taken down. But "it's just a game of cat and mouse," Aguirre says. "Someone catches them and they just run to the next spot."

Aguirre views this story in light of a broader concern with open source software — that, as long as malware authors find use in public repositories, organizations must be aware of the kinds of packages they might be sweeping up.

"It's important to understand what it is that you're running," he concludes. "This is a great case for that. You have to have a bill of materials, you've got to know what you're doing, and what dependencies you're using. If you're just blindly installing things and grabbing code you see, things like this could very easily get into your system."

'Blatantly Obvious': Spyware Offered to Cyberattackers via PyPI Python Repository

Stepped-up recruiting efforts along with better work-life balance policies and mentoring and recruitment programs will help balance the scales.

The cybersecurity threat continues to rage, and much has already been said about the need for concerted, coordinated, and cohesive steps to combat the menace. A cybersecurity policy is necessary for all institutions, whether big or small, to ensure the entire organization moves in the right direction. This policy, in turn, needs cybersecurity professionals who envisage a strategy to keep the organizations' needs, strengths, and weaknesses in sight. It's no surprise to hear, therefore, that there is a shortage of such professionals. One of the quickest solutions to this 3.4 million shortage is to tap into the underrepresented demographic, women.

According to the International Information System Security Certification Consortium (PDF), women are only 24% of the workforce for cybersecurity professionals. However, the numbers go down to 5% for the Middle East and Africa. This disparity is ironic as it is women who face disproportional levels of online harassment and can contribute invaluable insights for the counteroffensive for many cybersecurity spaces. Consequently, there is a clear need to identify the pain points and decide on actionable measures to close the gender gap.

**Overcoming the Gender Gap**

Understanding the reasons for this gender gap is an excellent place to start. Some of the identified factors are "industry perception and culture, societal and family constraints, barriers to entry due to limited digital and cyber literacy, wage gaps, lower earning potential at every level, missed or delayed promotions, and a much harder path to reach the upper echelons of the corporate world." A glance at these factors reveals that they mirror the shackles faced by women a couple of decades ago for the regular workforce. As a result, learning from earlier successes can be a viable solution.

The first step should focus on building awareness for the industry as a whole and at a micro level so that the organization can understand the gap and take steps to address it. For example, Atos, an informational technology service, has created a strategy to rebalance its gender equity by improving shortlisting of women candidates by 20%, having 40% more women hires, and initiating 400% more mentorship programs for them. The latter is an important point, as mere hiring does not address the above-mentioned factors; women must be retained and allowed to grow into their roles.

Another factor hindering women in cybersecurity and general tech roles is the fear that they do not allow a good work-life balance. The Global Cybersecurity Forum is working to counteract such concerns by engaging girls with STEM. However, this engagement will remain an empty promise unless the industry reciprocates with better work-life balance policies and support for women professionals.

Mentoring is another technique for aiding women's retention in cybersecurity jobs. For example, the International Telecommunication Union has designed a learning program revolving around mentorship in cybersecurity to encourage more women to assume leadership roles in this sector. The program uses examples of existing leaders to set role models that can help create identification and aspiration in young women. Further, opportunities to network are also extended, which can be a gold mine of insights, support, and the formation of an industrywide offensive against online miscreants.

These measures are by no means the only actionable steps that can be devised to encourage and sustain more women in this industry. However, they do offer a starting point for tapping into this resource.

**Gender Equality Benefits**

As the drive to engage with women is initiated, it is equally essential to establish excellent reasons for this initiative among men. The advantages of bringing in gender equality extend beyond the need for finding more professionals to combat the cybersecurity threat. Research has shown that gender diversity supports better decision-making, with inclusive teams making better decisions 87% of the time. At a time when cybercriminals are growing bolder, using creativity to break down defenses, and demanding increasing amounts of ransomware, there has never been a greater need to come up with innovative solutions. A variety of perspectives can aid in holistic, better-designed solutions. With such benefits, it is natural to wonder what can be done by the state and the industry to encourage women into the fold.

Apart from assessing and recruiting women to balance the skewed ratio of men and women in cybersecurity roles, the industry can work toward building policies allowing women to take career breaks if they want. Initiatives like IBM's "returnship" program can support women to brush up on their skills and rejoin their career path after a pause. Mentoring has already been cited as an initiative already operationalized by industrial forums. Mentoring should be combined with a precise mapping of career paths for professionals. It can be further supported with events like hackathons for women, training programs focusing on skill gaps, and workshops leading conversations and discussions on the subject.

The US government can help with some of these events. It is already considering the benefits of encouraging female veterans into cybersecurity roles as they possess the skills and basic training to fit the bill. However, there is a long path in front of the state as the US government statistics show a lower-than-average presence of women in American cybersecurity professional roles. For the US government, the first steps need to be initiated closer home before they contemplate their role in building a foundation for catapulting women into the cybersecurity industry.

Where Are the Women? Making Cybersecurity More Inclusive

Incident response experts share their secrets for success when it comes to creating a professional-grade ransomware response playbook. Are you ready for the worst?

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

Source

DARKReading