More React Bugs Reaction, the Challenge of Vulnerability Management, and CI Attacks

They don't really go into that, but that used to be the biggest fear on Earth, especially in the in the early, not early, but you know, like 20 years ago, the idea that like the Windows source code, if that ever got out there, the world would end or, you know, the source code for Chrome or something like that. And those have leaked over the years and nothing, we're all still here. Like essentially, source code is not the magic key that everybody you know sort of feared it might be, right?

Yeah, it says like the the security advisory for it lists it as a medium severity bug 5.3 on the CBSS scale. It says malicious HTTP request sent to a vulnerable server function may unsafely return the source code of any server function, and then exploitation requires the existence of a server function. It's basically it's, it's pretty. It's not something that seems as serious as. No.

Anything else like the the DOS bug but then obviously not the the initial React bug that kind of kicked all of this off? Yeah. I mean, we're going to talk about this in a larger context in terms of just the proliferation, the continued proliferation of vulnerabilities and how difficult it is for organizations to manage this stuff. But this week we also saw continued and I would say expanded exploitation of those initial React server component bugs, Gray noise, shadow server, you guys at Huntress, I saw so many different analysis of the exploit activity, the POC's that were out there.

There's much more sharpened and sophisticated PO CS out there, I would say now than, you know, even just a week ago when we last recorded, because as we said last week, some of those were sort of red herrings or just didn't work very well, which happens all the time. But now it seems like there's much more sophisticated PO CS out there available for everybody, and lots of people are taking advantage. Yeah, it is funny like in the first few days after, you know, this this flaw was disclosed, we like I feel like we initially just saw you know, kind of smattering of PO CS, but then also like the just a couple of like crypto miners and those types of things and now. It seems like it's.

Yeah, it's classic. But now it seems like it's definitely escalated. We're seeing new types of, excuse me, you know, malware droppers, new types of kind of cross-platform, you know, threats. So I think that you know this it will be interesting to see kind of the the longer tail of of this, the exploitation of this flaw. And I know, you know, I don't know if you saw this, but Gray Noise came out with this really interesting analysis report that looked at all the different attack sessions and the countries where exploitation's been observed and all of this. We can probably drop this in the show notes, but it shows attack volume over time and it's really great breakdown of kind of the the bits and pieces that have gone into this exploitation. So there's a lot more of an understanding now of like how this is being exploited.

I think I would be curious to talk to people and get a better understanding of how defense teams feel that they're being able to handle this. And like have they been able to, you know, effectively roll out the patches and find where these components are in their environments and everything else? Because like you said, this is this is also been a really crazy week in terms of disclosed vulnerabilities in general. So. Yeah. Yeah. I mean the I have not read that Gray noise report, but they do some of the best stuff around on that kind of thing.

And what one thing I did notice is that both the geographic breakdown and the types of hosts that we're trying to exploit this were not exactly what I might have expected. I think we said last year that last year last week, good God, time is a flat circle. We said last week that what we were seeing at the time were mostly APT groups from, you know, China, that that's what you would expect, right?

Because they have the resources to quickly build exploits and find vulnerable hosts and get down to business. And that that's still happening. But there's also plenty of other groups trying to exploit this bug from all over the world. And some of them, some of the activity is coming from previously compromised hosts, you know, which is typical too. But some of it is just like infrastructure used by these APT groups all the time, just like here's our go to, you know, server infrastructure. We're coming at you because we know that you guys have all these vulnerable apps, so try and stop us. Right.

Yeah, It is interesting to see how that's kind of spread out. And this, the report has a geographic distribution as well. And I, I think this is for, I'd assume for victims. But surprisingly it looks like Poland is right now at the top, which is very odd. And then Czech Republic, Brazil, Netherlands, and then the US So it's kind of it's, there's some really cool data there to try to figure out, you know, what the escalation of attacks has looked like and everything else.

That's so odd. I wonder what you, I remember in there was a supply chain attack a few years ago and the IT was like an account or a tax software that was used by everybody. I think I want to say it was in Romania. I cannot remember the name of the software. It was like 4 or five years ago now, but essentially everybody in that country used this tax prep software and that got compromised and the downstream effects were terrible for that one, but nobody else.

It didn't exist anywhere else. So I wonder if there's some app that's used really widely in Poland that has the vulnerable Reacts framework in it that is just getting hit all the time. Because almost always in a widespread bug like this, it's the US, the UK, you know, maybe Brazil, like big, big countries that have a lot of computers that get hit. You don't typically see, you know, Poland at the top of the victim list. Yeah, that's it is interesting.

I'd I'd have to double check that this is geographic distribution of victims versus like other like parts and pieces of the attack. But, and I think also like visibility in terms of, but you know, it's, it's interesting when you see analysis like that, like every, every vendor, every company is going to have a different level of visibility given what their, you know, customer base is. Exactly right. Yeah. But it it is interesting to be able to kind of look at all the different aspects of kind of how this is playing out right now, so. Yeah, it could also be a hosting provider or some large platform in that country.

That's, you know, the the the sort of underlying issue there, but. Yeah, but the I also wanted to just like in terms of people who are dealing with this right now, I wanted to read some of these like news headlines off for context of like where we're at this week. Fortnet patches critical authentication bypass vulnerabilities, Avanti EPM updates update patches critical RCE flaw. Microsoft fixes 57 flaws, including three zero days and Adobe patches 140 flaws.

And that's not even all of them. The Adobe ones, Adobe and Oracle, you can't just read those things out of context because you look at them and Oracle does them quarterly, not not monthly. So you look at the Oracle patch updates, there are always hundreds of vulnerabilities and a lot of them are critical because Oracle has tons of products same way Adobe does that are used all over the place, right? Like everybody has some Adobe product on their computer whether they use it or not.

And 145 or what are you, whatever you said is just it's wild. Imagine if we were talking about this is the larger context how an organization, even one that has a good vulnerability management and patching program and a well funded security team, how do they deal with this on? I mean, we've talked to a lot of people that this is their job, but dealing with this on a monthly basis, even though you know the timing of it, OK, the second Tuesday of every month we're going to get our teeth kicked in.

We got to be ready. Let's plan this and that and downtime and all that kind of stuff. Trying to fix 145 Adobe bugs. I mean, obviously you're just updating software packages, but on, you know, thousands or 10s of thousands of endpoints and possibly servers and trying to figure out how people can still do their jobs while you're fixing this along with the Windows bugs. I mean, 30 days, that would have been like the biggest headline 10 years ago. You know, Windows.

Now it's just like, hey, it's Tuesday, it's December. Good luck. Like go get them, Tiger. I know, and it's just it's what's wild to me is that they're you know, we're dealing with that on top of this already like insane vulnerability that teams are already kind of wrap trying to wrap their heads around and deal with there. So it's like just feeling overwhelmed, I think by everything. But like, even without react, like how are people like what you know, there, there's always the discussion about how do you best prioritize vulnerability management and things like that. And there's so many different factors in it. And you know, we have, you know, the ability to look at, you know, the CVSS score.

But then also there's like, is it actually being exploited? How easy is it to exploit? Like is it in a product that is, you know, potentially impacts other things and all these different questions. And I think it's, it's not just, you know, black and white issue. No, not at all. Everything requires some kind of context and prioritization because even some of these bugs, even if they are exploited, a lot of times it doesn't matter to a given organization if the attacker can't get anywhere with that or there's no sensitive data exposed after exploitation, if it just causes a crash or a DOS or something like that. Those are ones that you, you know, can be farther down the list.

But I would just like me personally, if I had one of those jobs, I would be like, my brain would just never stop spinning trying to figure out, you know, it's like, how do you even ever take a deep breath and like go away for the weekend or something? Or just, you know, go to the movies without feeling like your server farm might fall over while you're, you know, out of touch. It's it, it seems like, and it honestly is just kind of a, a vicious cycle that you you never really can get out of.

Yeah, no, I agree. I think it's it's every every month. The fact that there's like this, the cadence of this too, I think is, is tough because this is all falling on everyone's lap like over the course of like a couple days. And I understand, you know why that has to happen. But yeah, it makes it pretty, pretty tough, I would say. And it's also, you know, two weeks before Christmas in the middle of the holiday season. Yeah, yeah. Everybody kind of trying to wind down and plan for, you know, time away from the office in and all those sorts of things. And when more fires are being piled on top of existing ones every week, I would just, you know, it would be really hard to enjoy a little family time with all this in the back of your head.

I know yeah, it's tough. I I also saw it too. I don't know if you saw this, but the, the list of top most dangerous security weaknesses was just released by later. That was Oh, no resting too. Yeah, just, I know they release it every year and it's, it's always funny to me because you know, a lot of these, you know, once again, cross site scripting, like no surprise there, but it's, it's always interesting. Like I'm, I'm curious, you know, how they pull that, that list together in terms of measuring the level of danger, 'cause there's so many factors I think that go into that and everything is so.

That's a good question. Yeah. And it says they scored each weakness based on its severity and frequency after analyzing CBE records for for flaws that were reported over the past year or so. And so it's, it's just really hard though, because you know, if you have a even just like a react to shell type of situation like that is going to be what much more have much more of a widespread kind of downstream impact than a different type of flaw under a different categorization that might be on here. So anyways, I it that must be a really tedious and tough process to kind of work through and understand kind of how these weaknesses work.

Right. Yeah, I assume that they look at publicly disclosed Cves over the course of the year, sort of group them by, you know, the CVSS score along with maybe some public exploitation activity, things like that, and put it into a soup and, you know, ask Chachi PT what what's the most dangerous? Like give me a list of the worst things in this group. Actually I I assume they do not do that with AI, but actually I hope not.

Yeah, but it says too they they so they brought in the CV ES in the cab, the known exploitation vulnerability catalog too. So like they're they're factoring in, you know, if these are being exploited as well. And, you know, it's like I said, cross site scripting, sequel injection, like just these things that are not, you know, it's really a surprise to anyone path traversal, but then they missing authorization and it looks like missing authentication, like also ranked up words after a few years. So I don't know, I, I think like with all the conversations people have been having over the past year or two around like, you know, secure by design, like trying to figure out like, how can we actually take this list that comes out every year and like make it actionable.

Like I, I think I would like to still kind of better understand that. Those, you know, Secure by Design and SDLC and all those software security initiatives are great and I love them and you know, people should pay attention to those. But when you look at the reality of most modern apps, they're literally built on foundation of a pile of open source code that maybe hasn't been reviewed by a human in six years, if it ever was.

There might be some libraries in there that have critical bugs that nobody ever updated. You know, and this is no knock on open source maintainers. That's most of them are doing this for free, as you know, has side projects and those that's the foundation of most of the modern Internet and even enterprise apps. You know, there's just hundreds and hundreds and hundreds of open source projects and libraries in every enterprise app.

And there's no real way to to, you know, shore that up. It's it's the XKCD meme of like the giant unwieldy building that has all the apps and then there's one little stick holding it up. That's like OSS libraries. Yeah, yeah, I know. I think it's like the fact that it's just how it's this, it's a systemic thing, you know, and it's just how like I, I don't understand how that can really be changed, unfortunately. There's no way to unwind it.

Yeah. And honestly like it it it could potentially introduce new other types of risks if if that was unwinded. Absolutely. Yeah. It's, it reminds me a little bit of, I mean, on a different scale. But what we were talking about last week with like the telecom infrastructure, you know, a lot of it is so old and, you know, purpose built and there's no real way to upgrade some of those things without breaking the entire network. It's sort of that. But software like you can't, there's no, there's, there's no way to change the way that apps are built at this point. It's just, you know, we're too far down the road. Yeah, I know.

Well, that kind of is a segue I guess into one other news item too in terms of when you look at operational technology and that's. Always. Fun to talk about. Always. Good. Always good. Yeah. The the only. Yeah. This, the other thing I saw that was interesting this week was, you know, Sisa came out with a new advisory basically warning of Russian hacktivists that were conducting attacks against US critical infrastructure, which is absolutely not new at all. But it also came out in tandem with the Justice Department charging a Ukrainian national who had conducted some cyber attacks on various critical infrastructure organizations worldwide.

Basically, it was part of it was linked to Russian state sponsored hacking operations that were targeting, you know, all these kind of critical infrastructure orgs like water utilities and like food processing facilities, government networks, things that we've really we've seen bubble up in the past couple years that over over a variety of different incidents. But it, it just kind of brings up the same conversation around, you know, operational technology security and the risks and potential impact that these types of attacks could have downstream.

So. Yeah, it's always those kind of things. It's easy for me and you to look at those and be like, yeah, we know this is what they like. Hackers going to hack type thing like this is what they do. But for a lot of people, and especially, you know, the government, like as administrations change and personnel changes and people have different jobs and different responsibilities, like there is sort of a recurring cycle of people becoming aware of this activity.

And how, how I don't sophisticated is not the right word, but how maybe persistent and pervasive it is and how much of it goes on every single day all the time. And the amount that we uncover privately or exposed publicly is really small, a really small percentage of the total activity. You know, it's the the thing of like the duck swimming on the surface and then all the legs like underneath, like paddling furiously.

It's just like we're only seeing a little bit of what's going on here. Right, which is definitely scary. Oh, it's terrifying. Yeah. I mean, yeah. And that that kind of leads into the last thing I wanted to mention, which is the a podcast that we published this week that I recorded a couple weeks ago with a woman named Aaron Whitmore, who works for a company called Cypher now and does sort of executive risk in strategic intelligence type stuff, which sounds really cool. And but her background, she was a CIA operations officer. She worked in the office of the Director of National Intelligence on cybersecurity for a while. She supported the Defense Intelligence Agency and the NGA is a civilian in the private sector. She has this really fascinating back story and sort of group of experiences and that it was one of the most fascinating conversations I've had in a long

time on or off a podcast. And she talked a lot about that, you know, sort of in broad terms, as you might expect being a former CIA officer, but about how there are threats going on all the time that most people have no concept of and don't need to know about. And you just, you know, the things that you hear about are the tiny, tiny percentage of what the government thinks you should know about, which I mean, maybe that's good or bad, I don't know.

But the, the entire conversation was was just amazing. It's really it's it's longer than most of the podcast we do. It's like an hour and a half. And I thought about splitting it up, but I couldn't really find like a good point to stop it. So I was like, the hell with it. Here's an hour and a half of this fascinating woman talking and me asking like 4 questions. Which is It was great. It was like the easiest kind of podcasting. That's great. Yeah, No, definitely everyone should go listen to that one because I feel like they just like it's, it's really good conversation given, you know, all the the different things that are happening today. So yeah.

It is. It's also heartening because she talks a lot about how her family has this military background and sort of a history of service, whether it's in the military or, or other parts, and how she felt this kind of pull to go do that in one way or another. And not just, you know, go make money somewhere. And, you know, which is something that you don't hear about all that much anymore.

You know, it, it was just kind of like, ow, there are people out there that are thinking about other people and not just themselves. That's nice. Yeah. It's good to know for. The holidays, yeah. Heartwarming. Story. Yeah. We don't get enough of those, especially in this business. I. Know, yeah. All right, well, it's good to see you as always, and I'm sure we'll have plenty to talk about next week. I think we're going to hopefully get the Home Alone podcast done next week, so we'll have something for you guys to listen and watch, listen to and watch while you're avoiding your family over the holidays. Yeah.

All right, have a good weekend. Talk to you soon.