Week of December 19, 2022: LastPass Confirms Vault Theft, New Exchange Exploit Chain Surfaces

Security leaders closed out 2022 absorbing LastPass's disclosure that attackers had copied customer vault backups and unencrypted account data, alongside new research showing a fresh exploit chain being used against Microsoft Exchange servers to deliver ransomware. CISA also issued two rounds of industrial control systems advisories, and several executive moves, including a new CyberArk CIO, a new Sectigo CEO, and newly elected (ISC)² board officers, rounded out the week's leadership news.

LastPass discloses theft of customer vault backups

LastPass disclosed that attackers who had breached a third-party cloud storage environment obtained unencrypted customer account information and copies of backups containing customer password vault data. CEO Karim Toubba said the data included company names, billing and email addresses, telephone numbers, and IP addresses, along with encrypted vault fields such as usernames and passwords. The company said strong, unique master passwords should keep cracking infeasible but urged customers to change reused credentials and watch for phishing attempts referencing the incident. (Help Net Security)

New Exchange exploit chain tied to ProxyNotShell flaw used for ransomware access

Researchers described a new exploit chain, dubbed OWASSRF, that ransomware-wielding attackers used to achieve remote code execution on Microsoft Exchange servers via Outlook Web Access, leveraging CVE-2022-41080 alongside the earlier ProxyNotShell vulnerability CVE-2022-41082. CrowdStrike researchers said URL rewrite mitigations published before the November patches were released do not stop this method, and organizations unable to patch were advised to temporarily disable OWA. A December 22 update noted Rapid7 had observed a rise in Exchange server compromises via the same chain. (Help Net Security)

CISA issues four ICS advisories

CISA released four Industrial Control Systems advisories on December 22, 2022, covering products from Priva, Rockwell Automation, Mitsubishi Electric, and Omron. The advisories gave technical detail on vulnerabilities and exploits affecting the listed products and included mitigation guidance for administrators of affected environments. CISA encouraged users and administrators of industrial systems to review the bulletins directly for the specific CVE-level detail and recommended compensating controls applicable to their deployments. (CISA)

CISA issues six ICS advisories

CISA released six Industrial Control Systems advisories on December 20, 2022, addressing products from Fuji Electric, Rockwell Automation, ARC Informatique, Delta, and an update to a prior Prosys OPC UA Simulation Server advisory. The bulletins outlined current vulnerabilities and exploit information for the named ICS products, part of CISA's ongoing effort to keep critical infrastructure operators informed of emerging risks in operational technology environments heading into the holiday period. (CISA)

(ISC)² names 2023 board officers

(ISC)² announced four newly elected officers for its 2023 Board of Directors during its Q4 Board of Directors meeting and Annual Meeting, with the terms set to begin January 1, 2023. Yiannis Pavlosoglou was named Chair, Jill Slay Vice Chair, James Packer Secretary, and Dan Houser Treasurer. CEO Clar Rosso thanked outgoing officers Zachary Tudor, Lori Ross O'Neil, and David Melnick for their service in the roles. (Help Net Security)

Sectigo names Kevin Weiss as CEO

Digital certificate and machine identity management provider Sectigo hired Kevin Weiss as its new CEO, succeeding Gary Greenfield, who had served as interim CEO. Weiss joined from Spireon, where he spent more than six years as CEO, and previously held leadership roles at Unitrends, McAfee, and Ariba. GI Partners' Travis Pearson cited Weiss's track record in growth strategy as the company looks to expand its digital trust and PKI-related product portfolio. (Help Net Security)