Kaseya Patches Zero-Days Used in REvil Attacks

Reading Time: 1 Minute

Kaseya released the VSA 9.5.7a (9.5.7.2994) update to fix three zero-day vulnerabilities used in the ransomware attacks.

See Also: Kaseya ransomware supply chain attack: What you need to know

The company said on its rolling advisory page that all of its software-as-a-service (SaaS) customers were back up as of this morning, while the company was still working to restore on-premises customers that needed help:

The restoration of services is now complete, with 100% of our SaaS customers live as of 3:30 AM US EDT. Our support teams continue to work with VSA On-Premises customers who have requested assistance with the patch. —Kaseya

A Brazen Ransomware Blitz

On July 2, the REvil gang wrenched open those three VSA zero-days in more than 5,000 attacks. As of July 5, the worldwide assault had been unleashed in 22 countries, reaching not only Kaseya’s managed service provider (MSP) customer base but also, given that many of them use VSA to manage the networks of other businesses, clawing at those MSP’s customers

Kaseya customers use VSA to remotely monitor and manage software and network infrastructure. It’s supplied either as a hosted cloud service by Kaseya, or via on-premises VSA servers.

Following the brazen ransomware attacks, CISA and FBI last week offered guidance to victims. Threat actors were quick to exploit the situation, having planted Cobalt Strike backdoors by malspamming a bogus Microsoft update along with a malicious “SecurityUpdates” executable.

As of July 6, Kaseya said in its updated rolling advisory that there were fewer than 60 customers affected but far more – “fewer than 1,500,” it said – downstream businesses that got hit.

Kaseya already knew about these bugs when the attacks were launched. In April, the Dutch Institute for Vulnerability Disclosure (DIVD) had disclosed seven vulnerabilities to Kaseya.

On Saturday, Bloomberg reported that software engineering and development employees at Kaseya’s U.S. offices had brought up a laundry list of “wide-ranging cybersecurity concerns” to company leaders multiple times over the course of three years, from 2017 to 2020. When the outlet asked Kaseya to address the anonymous workers’ accusations, a Kaseya spokesperson declined, citing a policy of not commenting on matters involving personnel or the ongoing criminal investigation into the hack.

See Also: Offensive Security Tool: It Was All A Dream (Windows Print Spooler RCE)

UPDATE 1: Dana Liedholm, senior vice president of corporate marketing for Kaseya, told Threatpost on Monday that the company has bigger fish to fry than responding to “random speculation”: “Kaseya’s focus is on the customers who have been affected and the people who have actual data and are trying to get to the bottom of it, not on random speculation by former employees or the wider world,” Liedholm said via email.

UPDATE 2: Jake Williams, co-founder and CTO at incident response firm BreachQuest, told Threatpost that dismissing workers’ input as being “speculation” doesn’t make the accusations less credible. “After a quick analysis of the VSA server product, it’s pretty easy to believe these claims,” he said via email. “Until management at software development firms begin prioritizing security fixes over feature updates, we can expect incidents like this to continue. The fact that Kaseya downplayed the reported 40-page security memo as ‘speculation’, without denying its existence, is a huge red flag and lends a lot of credence to the claims.”

UPDATE 3: Granted, managing security is tough for any company, including software vendors, noted Dirk Schrader, global vice president of security research at New Net Technologies (NNT). That doesn’t let them off the hook, though, he told Threatpost on Monday. “A company can’t decline doing the essentials, because that is equivalent to being negligent on the risks related to cybersecurity, and there is plenty of material about what is essential.”

Quick searches point to areas in Kaseya’s security that could be improved, Schrader added, such as outdated certificates on networking devices and on Kaseya’s  own instances of VSA. “It comes down to its security operations, its processes and whether they are up to par with the current threat landscape,” Schrader said.

To support his statement, Schrader pointed to Cisco IOS device(s) with an outdated cert used by Kaseya itself, noting that there are a couple of IPs showing the same issue. He found multiple additional certificate issues, including this one and this one.

See Also: Hacking Stories: Andrian Lamo – The ‘homeless’ Hacker

Source: threatpost.com

(Click Link)