CISOs and cybersecurity teams will play a key role in hardening artificial intelligence and machine learning systems.

RSA CONFERENCE 2023 – San Francisco – As enterprises and government agencies increasingly weave artificial intelligence (AI) and machine learning (ML) into their broader set of systems, they'll need to account for a range of risk resilience issues that start with cybersecurity concerns but spread far beyond those. 

A panel on April 24 at RSA Conference 2023 composed of distinguished AI and security researchers examined the problem space of AI resilience, which includes weighty issues like adversarial AI attacks, AI bias, and ethical application of AI modeling.

Cybersecurity professionals need to start to tackling these issues both within their organizations and as collaborators with government and industry groups, panelists noted.

"Many organizations will look to integrate AI/ML capabilities of their core business functions, but in doing so will increase their own attack surface," explained panel moderator Bryan Vorndran, assistant director at the FBI Cyber Division. "Attacks can occur in every stage of the AI and ML development and deployment cycle, models, training data, and APIs can be targeted."

The good news is that there is time to ramp up into these efforts if the community begins work now.

"We have a really unique opportunity here as a community," said Neil Serebryany, CEO of CalypsoAI. "We're aware of the fact that there is a threat, we're seeing early incidents of this threat, and the threat is not full-blown yet."

The 'yet' is the operative word, he emphasized, and his fellow panelists agree. The field of risk management is in a place with AI similar to where cybersecurity was with the Internet in the 1980s, said Bob Lawton, chief of missions capabilities for the Office of the Director of National Intelligence Science and Technology Group.

"Imagine if it's 1985 and you knew the challenges that we were going to face in the cyber domain now, what would we as a community, as an industry do differently 35 years ago, and that's exactly where we're at with AI right now," said Lawton. "We have the time and space to get it right."

Specifically when it comes to direct attacks against AI systems by adversaries, the threats are still very rudimentary, but that's only because the attackers are only putting the work they need to in order to achieve their objectives right now, said Christina Liaghati, AI strategy execution and operations manager for MITRE Corporation.

"I think we're going to see many more of the malicious actors having a higher level of sophistication of these attacks, but right now they don't have to, which I think is what's really interesting about this space," she told the audience.

Nevertheless, she warned that organizations can't treat the risks lightly. The interest of threat actors to increase their sophistication and knowledge of AI models will only keep growing as it is embedded into systems they can profitably attack. And this is just as true of smaller organizations using simple ML models in financial systems as it would be for government agencies using it in an intelligence capacity.

**Everyone Is at Risk**

"If you're deploying AI in any environment where any actor might want to misuse or evade or attack that system, your system is vulnerable," she said. "So, it's not just super advanced tech giants or anybody that's deploying AI in a massive way. If your system is in any kind of consequential environment and then you incorporate AI and machine learning into that broader system of systems context, you could be exposing it in new ways that you're probably not thinking about or necessarily prepared for."

The challenge with AI for many cybersecurity executives is that addressing these risks will require they and their teams gain a whole new set of knowledge and parlance around AI and data science.

"I don't think that AI assurance at its core is a traditional infosec problem," Serebryany said. "It's a machine learning problem that we're trying to figure out how to translate into the infosec community."

For example, hardening the models requires understanding of key data science metrics like recall precision accuracy and F1 scores, he said.

"So I think it's kind of incumbent upon us to be able to figure out how to take these underlying ML concepts and research and translate the parlance, the concepts and the standard operating procedures within a soft context that makes sense within the infosec community," he said.

At the same time, Liaghati said to not discount the security basics as AI/ML models and systems will be deployed in the context of other systems for which security teams have decades of experience managing risk. The principles of data security, application security, and network security are still extremely relevant, as are standard risk management and OpSec best practices.

"So many of those are just good practices. It's not just a big, fancy adversarial layer or being able to patch a data set. It's not necessarily that complicated," she says. "Many of the ways that you can mitigate these threats are just thinking about the amount of information that you're putting out within public domain on what models you're using, what data you're using, where it's coming from, \[and\] what the broader system context looks like around that AI system.

AI Experts: Account for AI/ML Resilience & Risk While There's Still Time

**CAMBRIDGE, Mass.****,** **April 25, 2023** **/PRNewswire/ --** Akamai Technologies, Inc. (NASDAQ: AKAM), the cloud company that powers and protects life online, today announced the launch of its Prolexic Network Cloud Firewall. This new capability of Akamai Prolexic allows customers to define and manage their own access control lists (ACLs) while enabling greater flexibility to secure their own network edge.

Prolexic is Akamai's cloud-based DDoS protection platform that stops attacks before they reach applications, data centers and internet-facing infrastructure.

DDoS threats are on the rise again, a trend that is being accelerated by the growing number of businesses and organizations that rely on online services to operate. An increasing availability of DDoS tools and services on the dark web makes it easier for attackers to launch these types of attacks. The growing number of internet-connected devices and the rise of the Internet of Things (IoT) has created a larger attack surface for cybercriminals to exploit. DDoS attacks are now increasingly being used as one of multiple threat vectors in triple extortion attacks, typically in combination with ransomware and data exfiltration.

Increasingly, nation state threat actors, hacktivists, and similar highly organized collectives are currently using DDoS as part of their attack portfolio against a growing number of very diverse targets. In all of these scenarios, DDoS is often used as a distraction to divert attention away from other types of attacks, such as data exfiltration or network infiltration. Victims that have no sufficient DDoS protection in place will typically spend all their resources fencing off that one attack while not having the attention span or bandwidth to fight other threats that were launched in parallel.

Akamai Prolexic provides DDoS protection services to a wide range of organizations, including businesses, governments, and non-profit organizations. With a growing mitigation capacity of currently 20 Tbps, Prolexic can fight off even the largest, most complex threats, like recently record-breaking DDoS attacks in 

The Prolexic network cloud firewall allows more efficient and flexible defense against DDoS attacks and even expands Prolexic's protection capabilities beyond DDoS.

While Prolexic's overall service and mitigation stacks are not changing, the new offering allows customers to define and adjust their own access control rules and provides analytics of existing ones. Improvements include the ability to define proactive defenses to block malicious traffic instantly, alleviate local infrastructure by moving rules to the edge and to quickly adapt to network changes via a new user interface.

"The feature most requested by our Prolexic customers is the network cloud firewall," said Sean Lyons, Senior Vice President and General Manager of Infrastructure Security at Akamai. "We are expanding Prolexic's leading DDoS protection capabilities and empowering customers to define access control and firewall rules centrally and quickly, for their entire networks advertised through the Prolexic global footprint. This is a powerful tool in emergency situations, not just DDoS attacks, but also in scenarios like zero day vulnerabilities, where access can be shut down in an immediate, yet targeted way. As we enforce rules at the edge of our customers' networks, they don't have to worry about getting all internal firewalls configured – which might just take too long."

Akamai Prolexic stops attacks with a cloud-based DDoS scrubbing platform to protect applications wherever they are deployed, whether in a data center, the public cloud, or a colocation facility. It provides comprehensive protection against the broadest range of DDoS attack types and defends against high-bandwidth sustained attacks, as well as today's complex multi-vector attacks that jump from application to application. Prolexic includes proactive mitigation controls tailored to network traffic to stop attacks instantly, backed by active mitigation performed by Akamai's 24/7 global Security Operations Command Center (SOCC), and provides customers a unique 100% uptime Service Level Agreement (SLA).

**About Akamai**

Akamai powers and protects life online. Leading companies worldwide choose Akamai to build, deliver, and secure their digital experiences — helping billions of people live, work, and play every day. With the world's most distributed compute platform — from cloud to edge — we make it easy for customers to develop and run applications, while we keep experiences closer to users and threats farther away. Learn more about Akamai's security, compute, and delivery solutions at akamai.com and akamai.com/blog, or follow Akamai Technologies on Twitter and LinkedIn.

Akamai Introduces Prolexic Network Cloud Firewall

**AUSTIN, Texas – April 25, 2023 –** Global security leader Forcepoint today extended the depth and breadth of its Data-first SASE (Secure Access Service Edge) offering with the launch of Forcepoint Data Security Everywhere. Forcepoint is simplifying enterprise DLP management across cloud, web and private apps and streamlining compliance wherever hybrid workers store, access and use confidential information.

The company is also bringing to market Forcepoint ONE Insights thatenables users to quickly visualize and quantify the financial value of security efficacy delivered by Forcepoint solutions. Forcepoint ONE Insights’ visualization console presents key performance indicators such as adoption, data and threat protection, policy violations, performance, and risk.

“Data isn’t the new oil; it is the new air. Literally everything runs on data today and our lives and livelihoods depend on it. Before today, securing data required a mishmash of point solutions. Forcepoint is taking the lead in solving this problem with Forcepoint Data Security Everywhere,” said Manny Rivelo, CEO of Forcepoint. “We’re deliveringenterprise-wide data security plus the power and flexibility of Forcepoint ONE SSE to keep data safe at all times, even after it is accessed.Comprehensive data security is a critical capability within our Data-first SASE solution, providing the visibility and control organizations need to protect their data and simplify Zero Trust security.”

In two years, humanity's collective data will reach 175 billion terabytes -- the number 175 followed by 21 zeros. This data includes everything that powers business and consumers’ day-to-day lives. It is accessed and used by hybrid workforces on corporate endpoints and personal devices such as phones and tablets to do their jobs. Forcepoint Data Security Everywhere is a direct response to the reality that business productivity depends upon people having the ability to safely and efficiently use data anywhere.

By connecting Forcepoint Enterprise DLP to the Forcepoint ONE Security Service Edge (SSE) platform, customers can extend a new or existing enterprise DLP policy, including its advanced classifiers, data fingerprinting, and enforcement settings, to the web and cloud. A unified security policy from Forcepoint protects sensitive data across all channels, including endpoints, websites, cloud services, networks, email and private apps.Forcepoint’s data-first approach goes far beyond basic data protection that is often built into SASE solutions. By classifying data and organizing it into different groups rather than relying on hardcoded patterns, Forcepoint data security policies can be written once and enforced everywhere to automatically handle new instances and types of sensitive data.This end-to-end enforcement is ideal for organizations with cloud-based applications or distributed workforces.

**Key Benefits of Enforcing Data Security Everywhere**

*   Adds Forcepoint ONE SSE channels to Forcepoint Enterprise DLP, protecting data across any website, cloud application, and web-based private applications. 
*   Applies new or existing DLP policies across CASB, SWG, and ZTNA channels. 
*   Simplifies DLP management by leveraging over 1,600 out-of-the-box classifiers, policies and templates enabling granular enforcement for files.
*   Gives security operations center (SOC) and IT teams complete incident reporting and forensic information from a single management console.

Forcepoint Data Security Everywhere is immediately available direct from Forcepoint and through the company’s global network of channel partners.

**AI-powered Data Visualization with Forcepoint ONE Insights**

Further extending the value-added capabilities of Forcepoint ONE, in late Q2 2023 the company will unveil Forcepoint ONE Insights, formerly code-named Symphony, which provides economic value and advanced security analytics for real-time insights into an organization's security status.

Forcepoint ONE Insights technology, included with all Forcepoint ONE subscriptions, uses machine learning and artificial intelligence to analyze security data from multiple sources, such as network traffic, endpoint devices, and cloud applications. Using the at-a-glance visualization, security teams can identify potential threats more quickly, reducing the risk of data breaches. They can also see in real-time dashboards showing the economic value and ROI of their use of Forcepoint ONE.

**Meet Forcepoint Experts at RSA 2023**

During the week of RSA, April 25-27, the company will provide hands-on opportunities with Forcepoint Data Security Everywhere and Forcepoint ONE Insights at the Forcepoint Experience Center on the fourth floor of the St. Regis San Francisco. Organizations that want to learn more and get demos can request a meeting.

**Additional information**

*   Read the Data Security Everywhere blog \[link\]
*   Read the Forcepoint Insights blog \[link\]
*   Learn about Data-first SASE
*   Learn about Forcepoint ONE, FlexEdge Secure SD-WAN

**About Forcepoint**

Forcepoint simplifies security for global businesses and governments. Forcepoint’s all-in-one, truly cloud-native platform makes it easy to adopt Zero Trust and prevent the theft or loss of sensitive data and intellectual property no matter where people are working. Based in Austin, Texas, Forcepoint creates safe, trusted environments for customers and their employees in more than 150 countries. Engage with Forcepoint on www.forcepoint.com, Twitter, and LinkedIn.

Forcepoint Delivers Data Security Everywhere, Extending DLP Policies From Endpoints to the Cloud

Full packet capture and log monitoring directly on SASE nodes maintains enterprise-grade security, no matter where the data originates.

**SAN FRANCISCO** **— April 24, 2023 —** NetWitness, a globally trusted provider of threat detection and response technology and incident response services, today announced  the launch of direct Secure Access Service Edge (SASE) packet integrations with several market-leading SASE vendors, including Palo Alto Networks (NASDAQ: PANW), Broadcom, a Symantec company (NASDAQ: AVGO), and Netskope. The new integrations enable NetWitness to deliver unparalleled network visibility across the enterprise. The news comes on day one of RSA Conference 2023, where NetWitness will be demonstrating the technology at booth number 5744.

With hybrid/remote work environments becoming ever more common, SASE is the gold standard network technology that enables modern workforces to interact with corporate resources wherever they are - securely.  By performing full packet capture and log monitoring directly on SASE nodes and combining them with all on-prem, cloud, and SaaS sources, NetWitness can maintain enterprise-grade network security, no matter where the data originates. Featuring better security, including encryption and Zero-Trust access, SASE offers major benefits to today’s distributed organizations. 

“I certainly think companies want to be proactive with their network security, but until now it’s been very difficult to do,” said Ken Naumann, CEO of NetWitness. “The landscape has gotten exponentially more complex over the years with hybrid work and third-party cloud providers. Data is now originating from, well, everywhere. Examining those data logs after the fact is like closing the barn door after the horse has already left the stable. You’re losing if you’re not doing it in real time - when it actually matters.”

Network edge security has historically created numerous blind spots for important security technologies that perform threat analysis, detection, and response. Traditional network and security architectures were not designed for the new work environment, where data and traffic come from all over the globe and hundreds, if not thousands, of different devices. This has led to visibility issues for network managers, who have traditionally relied on VPN and proxies to solve the problem. Unfortunately, routing everything to specific points increases difficulty and network costs, and presents a massive scaling issue.

NetWitness’s integrations overcome these issues and restore full visibility to critical SASE data. A SASE architecture converges networking and security functions in the cloud to securely connect users, things, and applications and deliver an exceptional experience, anywhere.  

In 2019, Gartner announced SASE as the future state of network security. Since then, the SASE landscape has evolved quickly, with SASE networking and security components being delivered from a single vendor as a way to create seamless, secure access that extends across on-premises to the cloud.  

For more information, visit www.NetWitness.com or visit booth 5744 at RSA Conference. 

**About NetWitness**

NetWitness provides comprehensive and highly scalable threat detection and response capabilities for organizations around the world. The NetWitness Platform delivers complete visibility combined with applied threat intelligence and user behavior analytics to detect, prioritize, investigate threats, and automate response. This empowers security analysts to be more efficient and stay ahead of business-impacting threats. For more information, visit netwitness.com.

NetWitness Partners With Palo Alto Networks, Broadcom to Launch SASE Packet Integrations at RSA Conference 2023

Integration of AI can lead to reduction of up to 90% in meantime to resolve security incidents.

**TAMPA, Fla. – April 24, 2023 –** ReliaQuest, a force multiplier of security operations, today announced the introduction of powerful artificial intelligence (AI) capabilities to its GreyMatter Intelligent Analysis solution, delivering meaningful insights on emerging security incidents within seconds. With this feature, security teams can easily make sense of threats and take action, enhancing their efficiency.  

ReliaQuest GreyMatter is a security operations platform built on an open XDR architecture and designed to help security teams increase visibility, reduce complexity, and manage risk across their security tools, including on-premises, clouds, networks, and endpoints. On average, GreyMatter customers see up to a 70% reduction in alert noise in the first year.  

GreyMatter Intelligent Analysis was introduced in July 2022 as part of the security operations platform. The new AI features enable security analysts to automate security operations and workflows. Updates to the solution include: 

*   Augment investigations – get answers faster: Pairs automation with generative AI capabilities to help analysts gain clarity quicker. Capabilities that augment investigations include dynamic and automated enrichment of alerts, deeper context from historical incident data and external sources such as threat and vulnerability feeds and recommend action prompts.  

*   Assist analysts – focus on investigations, not documentation: GreyMatter Intelligent Analysis takes the pain of low-brain, high-time tasks out of security operations. The solution assists with key tasks including automated ticket summaries, interactive AI assistants for quicker search and threat hunting hypothesis.  

*   Automate actions – smarter and faster response actions: With the continued training of the generative AI and Machine Learning models with real-world cyber security data and fine-tuning by analysts and customers, GreyMatter Intelligent Analysis can automate investigations, response actions and alert escalations.  

“Generative AI is a genuine game changer and important step to help ReliaQuest’s, mission to Make Security Possible. Since inception, ReliaQuest GreyMatter has been using AI/ML to automate tasks across the detection, investigation, and response workflow, helping customers realize better and faster security outcomes. With updates to GreyMatter Intelligent Analysis, our 700+ global customers will have automation capabilities with generative AI to further reduce response time by up to 90% in multiple scenarios and help security analysts get answers faster than ever before,” said Brian Murphy, Founder and CEO at ReliaQuest.   

“We work with ReliaQuest as our security partner because of their innovative and unique approach to solving challenges faced by security teams around the world. Generative AI has the potential to disrupt security operations and we’re thrilled to be working with ReliaQuest to bring AI to the SOC. Their practical approach, based on years of managing security operations, places them in a unique position and we’re glad to be partnering with them on this journey,” said Dannie Combs, Senior Vice President and Chief Information Security Officer at Donnelley Financial Solutions. 

ReliaQuest has over 15 years of curated security incident response data with trillions of signals from across some of the world’s leading organizations. Pairing this with its team of over 400 security professionals gives ReliaQuest the unique opportunity to train its AI/ML models with real-world data and fine-tune them with human expertise. GreyMatter is used by some of the leading Fortune 500 companies.  

Currently in early release with select customers, generative AI with GreyMatter Intelligent Analysis will reach general availability in the second half of 2023. For more information about ReliaQuest, please visit www.reliaquest.com  

**About ReliaQuest** 

ReliaQuest is the force multiplier of security operations. Our security operations platform, GreyMatter, automates detection, investigation and response across cloud, endpoint, and on-premises tools and applications. GreyMatter is cloud native, built on an open XDR architecture and delivered as a service any time of the day, anywhere in the world. With over 700 customers worldwide and 1,200 teammates working across six global operating centers, ReliaQuest is driving outcomes for the most trusted enterprise brands in the world. ReliaQuest is a private company headquartered in Tampa, Fla., with multiple global locations. For more information, visit www.reliaquest.com.

ReliaQuest Adds AI Capabilities to GreyMatter Intelligent Analysis

**BOSTON****,** **April 24, 2023** **/PRNewswire/ --** Vantage Travel wishes to inform its valued customers that the company has experienced a data security incident.

The company has hired a leading national forensic firm to investigate the incident.

Be assured that Vantage Travel is committed to solving this problem quickly and effectively to ensure the protection and privacy of our valued customers and staff. We understand customers may have questions regarding this incident. We will provide more information as soon as it becomes available.

For more information please visit: https://govantagetravel.com/

SOURCE Regan Communications; Vantage Deluxe World Travel; Vantage

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

Vantage Travel Experiences Data Security Incident

The Iranian threat actor displays activity similar to that of other advanced persistent threat groups.

An Iranian threat actor, under the name of Educated Manticore, has been the cause of targeted phishing attacks towards Israeli victims, with researchers finding that its activity links the group to another advanced persistent threat (APT) group by the name of Phosphorus.

Its activity is similar to other well-known hacking groups like TA453 and Cobalt Illusion in that its phishing attempts are designed to deploy a new version of PowerLess — something that Phosphorus has managed to do in the past while operating in the Middle East and Africa.

In a report released by Check Point, researchers say that the new version of the PowerLess payload uses "an ISO file to initiate the infection chain." They also reported that other documents in the ISO file were written in Hebrew, Arabic, and English, claiming to feature information about Iraq from the Arab Science and Technology Foundation leading researchers to believe that "the research community may have been the target of the campaign."

It's likely that these threat actors will continue to test and refine the tools used to commit these attacks in the future. "While the new PowerLess payload remains similar," Check Point researchers said in the analysis, "its loading mechanisms have significantly improved, adopting techniques rarely seen in the wild, such as using .NET binary files created in mixed mode with assembly code."

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

'Educated Manticore' Targets Israeli Victims in Improved Phishing Attacks

Ultimately, AI will protect the enterprise, but it's up to the cybersecurity community to protect "good" AI in order to get there, RSA's Rohit Ghai says.

Threat actors armed with artificial intelligence (AI) tools like ChatGPT can pass the bar exam, ace an Advanced Placement biology course, and even create polymorphic malware. It's up to the cybersecurity community to put AI to work to combat it.

RSA CEO Rohit Ghai used the opening keynote of this year's RSAC in San Francisco, Calif. to call on the cybersecurity community to use AI as a tool to work on the side of "good." First, that means putting it to work on solving cybersecurity's "identity crisis," he said.

To demonstrate, Rhai called up onto the screen a ChatGPT avatar, one he called "GoodGPT."

"Calling it 'good' is somehow personally comforting to me," he added. He then asked it basic cybersecurity questions.

While "GoodGPT" spat out a sequence of words culled from a veritable ocean of available cybersecurity data, he went on to explain there are critical cybersecurity applications for AI far beyond simple language learning, and it starts with identity management.

"Without AI, zero trust has zero chance," Ghai said. "Identity is the most attacked part of the attack surface."

It's no big secret the security operations center (SOC) is overwhelmed. In fact, Ghai said the industry average timeframe to identify and remediate an attack is about 277 days. But with AI, it's possible to manage access in the most granular terms, in real time, and at the data level, creating a framework that is truly based on the principle of least privilege.

"We need solutions that ensure identity throughout the user lifecycle," he added.

During this year's RSA, Ghai said there are at least 10 vendors selling AI-powered cybersecurity solutions positioned as a tool that will help human cybersecurity professionals. Ghai characterized the current pitch as AI-as-a-copilot. But that framing belies the reality, he warned.

"The copilot description sugarcoats a truth," Ghai said. "Over time many jobs will disappear."

The role of humans, he explained, will evolve into creating algorithms to ask important questions, along with supervising AI's activities and handling exceptions.

"It's humans who will ask those questions which have never been asked before," he said.

Ultimately, humans and enterprises will have to rely on AI to protect them.

"And the cybersecurity community can protect 'good' AI," Ghai added.

'Good' AI Is the Only Path to True Zero-Trust Architecture

Customers should apply updates to the print management software used by more than 100 million organizations worldwide, with typical US customers found in the SLED sector.

Security researchers have revealed new details about how attackers are exploiting two flaws in the PaperCut enterprise print management system — used by more than 100 million customers worldwide — to bypass authentication and execute remote code. The flaws once again highlight the risk that enterprise printers and related systems, an often overlooked threat, pose to the overall security of organizations.

Researchers from PaperCut as well as security companies already have warned that attackers are exploiting the vulnerabilities — patched by PaperCut in a March 8 update to its PaperCut MF and NG products — to take over unpatched versions of the software. Moreover, the Cybersecurity and Infrastructure Security Agency (CISA) added the flaws to its catalog of known exploited vulnerabilities on April 21.

The Zero Day Initiative tracks the flaws as ZDI-CAN-18987 and ZDI-CAN-19226; they also are being tracked as CVE-2023-27350 and CVE-2023-27351, respectively, by NIST's National Vulnerability Database. The flaws affect PaperCut MF and NG version 8.0 and later, on all OS platforms, according to PaperCut.

Researchers at Horizon3.ai released proof-of-concept exploit code for CVE-2023-27350 — the more dangerous of the two bugs with a CVSS rating of 9.8 versus its companion flaw's rating of 8.2 — on Monday.

**Abusing CVE-2023-27350**

The Horizon3.ai team also included a technical analysis of how attackers are abusing "the built-in 'Scripting' functionality for printers" to abuse the RCE exploit. The Device Scripting page of the system enables the administrator to develop hooks to customize printing across the enterprise using JavaScript-based scripts and executed in the context of the PrintCut service, which on Windows runs as NT AUTHORITY\\SYSTEM, researchers explained.

Though PaperCut's Web application's use of dynamic form fields based on the last request made developing a script to interact with the site less straightforward, they demonstrate how they were able to do so in a proof-of-concept exploit they released on GitHub.

CVE-2023-27350 exists within the SetupCompleted class and results from improper access control, according to its listing on the Zero Day Initiative website.

"An attacker can leverage this vulnerability to bypass authentication and execute arbitrary code in the context of SYSTEM," according to the listing.

Meanwhile, CVE-2023-27351, also an authentication-bypass RCE bug affecting PaperCut NG, exists within the SecurityRequestFilter class as a result of improper implementation of the authentication algorithm, according to its listing on the Zero Day Initiative website.

**Uncovering the PaperCut Bugs**

Horizon3.ai's detailed analysis follows a warning by PaperCut on April 19 that the flaws found in PaperCut NG were under active attack, urging organizations to update to the latest version of the product.

The company said in an advisory that it received its first report from a customer of suspicious activity on their PaperCut server on April 17, though later analysis revealed that the activity may have started as soon as April 13.

Researchers from Trend Micro originally reported the issues to PaperCut, which has credited Piotr Bazydlo (@chudypb) for discovering CVE-2023-27351 and an anonymous researcher for discovering CVE-2023-27350.

PaperCut also acknowledged a security research team from security management firm Huntress — including Joe Slowik, Caleb Stewart, Stuart Ashenbrenner, John Hammond, Jason Phelps, Sharon Martin, Kris Luzadre, Matt Anderson, and Dave Kleinatland — for aiding the company's investigation of the flaws.

On April 21, the Huntress researchers revealed that attackers were exploiting the vulnerabilities to take over compromised servers using both the legitimate Atera and Syncro remote management and maintenance software tools.

"Based on preliminary analysis, both appear to be legitimate copies of these products and do not possess any built-in or added malicious capability," the Huntress researchers wrote.

While the threats are split into two CVEs, they both "ultimately rely on an authentication bypass that leads to further compromise as an administrative user within the PaperCut Application Server," the researchers wrote.

Once a threat actor uses a flaw or both flaws to bypass authentication, he or she "may then execute arbitrary code on the server running in the context of the NT AUTHORITY\\SYSTEM account," the researchers wrote.

Huntress researchers also observed post-exploitation evidence in the form of a Truebot payload installation that suggest exploitation of the PaperCut flaws could be a precursor to future Clop ransomware activity based on previous investigation of similar activity, according to Huntress.

Huntress security researcher Caleb Stewart also recreated a proof-of-concept exploit to demonstrate how CVE-2023-27350 could be exploited, a video of which is included in the post.

**Who's at Cyber-Risk**

PaperCut MF is print management software to support various devices and manage print configurations for printing across an enterprise network. PaperCut NG is companion software for detailed print-job tracking and reporting aimed at helping organizations cut printing paper waste.

The PaperCut print management system has more than a hundred million users in organizations worldwide to help companies minimize waste and facilitate printing across the enterprise, according to PaperCut. In the United States, state, local, and education (SLED) environments are among the typical organizations using the software.

A Shodan query for http.html:"papercut" http.html:"print" showed approximately 1,700 Internet exposed PaperCut servers, with education customers comprising 450 of those results, according to Horizon3.ai.

In its protected environments, Huntress researchers reported observing 1,014 total Windows hosts with PaperCut installed, with 9087 of those hosts spread across 710 distinct organizations vulnerable to exploit, they said.

Only three total macOS hosts, two of which were vulnerable, had PaperCut installed in the environments they observed, the researchers added, noting that they sent incident reports to all customers affected and recommended updates.

**Detection and Mitigation**

PaperCut included a list of indicators of compromise for its customers in its advisory and advised them to upgrade, assuring that there "should be no negative impact" from applying the security fixes.

However, if a customer can't upgrade to the latest version — which could be true particularly with an older application version — the company recommended that customers lock down network access to the affected server.

To do this, they can lock all inbound traffic from external IPs to the Web management port (port 9191 and 9192 by default) and block all traffic inbound to the Web management portal on the firewall to the server.

To mitigate CVE-2023-27351, customers also can apply "Allow list" restrictions to the server found under the Options > Advanced > Security > Allowed site server IP addresses by setting it to only allow the IP addresses of verified Site Servers on their networks, according to PaperCut.

Attackers Abuse PaperCut RCE Flaws to Take Over Enterprise Print Servers

A study found that ransomware threats are viewed as having the lowest overall perceived likelihood of attack on the edge.

Distributed denial-of-service (DDoS) is the attack method businesses are most concerned about, believing it will have the largest impact on the business.

That was among the chief findings of AT&T's "2023 Cybersecurity Insights Report," based on a survey of 1,418 participants. Theresa Lanowitz, head of cybersecurity evangelism at AT&T Business, calls the perceived risk and rise in concern for DDoS attacks surprising.

"With edge, the attack surface is changing, and taking down a large number of Internet of things (IoT) devices can have significant impact on the business," she says. "The near real-time data created and consumed by most edge use cases make DDoS attacks attractive. By its definition, a DDoS attack will degrade a network and response time."

She adds, "Those who have not invested in DDoS protection are indicating the timing is right to do so."

The study also found ransomware dropped to eighth place out of eight in perceived likelihood of attack type. Yet Lanowitz notes that over the past 24 months, organizations of all types and sizes have invested in ransomware prevention.

"However, ransomware criminals and their attacks are relentless," she cautions. 

Additional analysis suggests cyber-adversaries may be cycling with the rise and fall of different types of attacks.

"Operating systems embedded in edge IoT devices make it more expensive for a financially motivated adversary to target the device with ransomware," Lanowitz says. "It is far more time intensive to write and deploy destructive code for an IoT device running a derivative of a version of Linux than to target a Windows-based laptop."

She explains one of the most pleasantly surprising findings in the report is how organizations are investing in security for edge: Security budgets have become 22% of overall project budgets, equally distributed with strategy.

"We asked survey participants how they were allocating their budgets for the primary edge use cases," she says. "The results show that security is clearly an integral part of edge, and that security is being planned for proactively."

She points to survey results that indicate applications, and the much-needed security for ephemeral edge applications, are part of the broader plan for edge project budgets.

"The expected outcome of what the edge delivers is shifting how organizations budget, plan, and think about focusing on a digital-first business," Lanowitz adds.

Another surprising result from the survey is that globally, the likelihood of a compromise and impact to the business decreased by 28% and 26%, respectively.

"Perhaps this is a case of irrational exuberance, but our qualitative analysis proves that with the edge there is far more communication and collaboration," she says. "Communication, cross-functional work, the line of business leading edge investments, and the use of trusted advisors all play a role in more optimism regarding catastrophic security events."

She adds this also points to the eradication of silos in organization and the reality that teams need to work together.

"Edge computing, with its changing attack surface means the adversaries are seeing things differently," Lanowitz says. "Likewise, businesses must take that same view of an expanded attack surface, potential new threats, or potential increases in existing threats."

**DDoS Threat Persists as International Crackdowns Commence**

The report comes as DDoS attacks continue to make headlines, from German websites getting knocked offline temporarily by the Killnet DDoS to the Serbian government reporting that it staved off five attacks aimed at crippling Serbian infrastructure.

More recently, the pro-Russian hacktivist group KillNet, which launches its campaigns against countries supporting Ukraine, ramped up its daily DDoS attacks against healthcare organizations.

In November 2022, nearly 50 of the most popular platforms available for hire to launch distributed DDoS attacks against critical Internet infrastructure were shut down and their operators arrested in a massive international law enforcement crackdown called Operation Power Off.

Source

DARKReading