Week of March 28, 2022: Spring4Shell surfaces, and $620 million drained from the Ronin bridge

What mattered to security leaders in the week of March 28, 2022? A leaked proof-of-concept for a remote code execution flaw in the Spring Java framework, soon named Spring4Shell and patched as CVE-2022-22965, sent application teams hunting through their Java estates, and Sky Mavis disclosed that roughly $620 million had been taken from Axie Infinity's Ronin bridge. The PCI Security Standards Council also published PCI DSS v4.0, starting a two-year transition clock.

Spring4Shell: a leaked exploit, then patches for CVE-2022-22965

Around March 30, proof-of-concept code for an unauthenticated remote code execution bug in Spring Core began circulating online, and researchers described it as a bypass of an incomplete fix for the old CVE-2010-1622 affecting JDK 9 and later. Early analysis suggested it was exploitable only in certain configurations, unlike Log4Shell. By April 1 Spring had shipped Framework 5.3.18 and 5.2.20 for the flaw, now CVE-2022-22965, plus Spring Cloud Function 3.1.7 and 3.2.3 for a separate RCE, CVE-2022-22963, and CISA urged immediate updates. (CISA, Help Net Security)

Nearly $620 million stolen from Axie Infinity's Ronin bridge

On March 29 Sky Mavis disclosed that an attacker had taken 173,600 Ethereum and 25.5M USDC tokens from the Ronin bridge used by the Axie Infinity game, then valued at $617 million. The attacker gained control of five of the nine validator signatures needed to approve withdrawals: four Sky Mavis validators and one run by Axie DAO, reached through a backdoor in a gas-free RPC node. The theft had happened on March 23 and went unnoticed for almost a week, until a user could not withdraw funds. Sky Mavis shut the bridge while it investigated. (BleepingComputer)

Sophos Firewall authentication bypass exploited in South Asia

Sophos warned that CVE-2022-1040, a critical authentication bypass in the User Portal and Webadmin of Sophos Firewall that allows remote code execution, was being exploited against a small set of organizations mainly in South Asia. The flaw affects v18.5 MR3 and older; hotfixes began rolling out on March 23 and reached devices with automatic hotfix installation, which is on by default. Sophos updated its advisory on Monday, March 28, to report the attacks and said it had notified each targeted organization. Where patching lagged, the advice was to remove WAN access to both interfaces. (Help Net Security)

PCI DSS v4.0 published, with v3.2.1 retiring in March 2024

On March 31 the PCI Security Standards Council published version 4.0 of the PCI Data Security Standard, replacing v3.2.1. The older version stays active for two years and retires on 31 March 2024, and many new requirements get extra implementation time. The council said more than 200 organizations submitted over 6,000 items of feedback across three years. Among the changes, firewall language became "network security controls," and Requirement 8 was expanded to require MFA for all access into the cardholder data environment. Payment-card programs now had a dated migration target to plan against. (PCI Security Standards Council)

Atento puts a $42.1 million price on its LockBit attack

CRM and outsourcing provider Atento reported in its 2021 results, covered on March 31, that the ransomware attack it suffered in October 2021 cost $42.1 million. That figure combined $34.8 million in lost revenue from its disrupted Brazil operations with $7.3 million in mitigation costs. The attack forced Atento to suspend its Brazil-based systems, and LockBit later listed the company on its leak site. Few victims put such a precise number on an incident, which makes it a useful benchmark for board discussions of ransomware exposure. (BleepingComputer)

FBI warns ransomware is straining local governments

CISA on March 31 highlighted an FBI Private Industry Notification telling Government Facilities Sector partners that ransomware attacks on local government agencies had disrupted operational services, created risks to public safety and caused financial losses. CISA asked local officials and public service providers to review the notification and apply its mitigations. For municipal CISOs it was federal confirmation that their sector remained a primary ransomware target. (CISA)