Week of April 24, 2023: 3CX Supply Chain Fallout Widens, CISA Issues Multiple Advisories

The week centered on fallout from the 3CX supply chain compromise, as investigators linked the breach to a trojanized X_TRADER installer that also hit energy-sector and financial-trading organizations, while VMware patched two Aria Operations for Logs vulnerabilities and researchers exposed a widespread default-key flaw in Apache Superset. CISA opened comment on a federal software self-attestation form, warned of a Service Location Protocol denial-of-service vector, issued an ICS medical advisory for Illumina, and let CISA and Cyber Command's Cyber National Mission Force publicly detail how they share intelligence on nation-state threats.

3CX breach traced back to trojanized X_TRADER installer, broader fallout confirmed

New reporting tied the 3CX supply chain compromise to an earlier intrusion. Investigators found the breach originated with a trojanized installer for X_TRADER, an old futures-trading package from Trading Technologies, which a 3CX employee had downloaded, leading to a backdoor called VEILEDSIGNAL. The same X_TRADER installer was separately used to drop a backdoor on two critical infrastructure organizations in the energy sector and two organizations involved in financial trading. Indicators of compromise pointed to government-sponsored North Korean operators, and the case was described as the first known cascading software supply chain compromise. (Help Net Security)

VMware patches two Aria Operations for Logs vulnerabilities

VMware fixed two vulnerabilities in VMware Aria Operations for Logs, formerly vRealize Log Insight, a widely used cloud solution for log analysis and management. CVE-2023-20864 was a deserialization flaw that let an unauthorized, network-connected attacker execute arbitrary code as root, while CVE-2023-20865 was a command injection bug allowing an attacker with administrative privileges to run arbitrary commands as root. The vulnerabilities affected versions 8.6.x, 8.8.x, 8.10, and 8.10.2, and VMware Cloud Foundation v4.x, with no workarounds available; admins were told to upgrade to version 8.12. (Help Net Security)

Default secret key leaves most internet-facing Apache Superset servers exposed

Horizon3.ai researchers disclosed that an insecure default configuration, tracked as CVE-2023-27524, left most internet-facing Apache Superset servers open to compromise. The data visualization platform ships with a default SECRET_KEY used to sign session cookies, and many administrators never changed it, letting attackers forge valid admin cookies and gain remote code execution on connected databases and the Superset server itself. A Shodan sweep found two-thirds, 2,124 instances, still used a default key. Version 2.1 now blocks startup with a default key, though some deployment methods can still bypass the protection. (Help Net Security)

CISA flags Service Location Protocol abuse enabling amplified DoS attacks

CISA warned that the Service Location Protocol, an unauthenticated discovery protocol defined in RFC 2608, could let a remote attacker register arbitrary services and use spoofed UDP traffic to launch denial-of-service attacks with a significant amplification factor. The flaw, tracked as CVE-2023-29552 and identified by researchers at Bitsight and Curesec, affected many SLP services that appeared to be older, abandoned systems still reachable from the internet. CISA advised administrators to disable or restrict network access to SLP servers and pointed to a VMware response addressing the issue in its own products. (CISA)

CISA opens comment period on federal Secure Software Self-Attestation Form

CISA, working with the Office of Management and Budget, released proposed guidance in the form of a Secure Software Self-Attestation Form meant to apply to software used by the federal government. The agency said the standardized form is intended to reduce risk to the federal environment and create transparency around software producers' development practices for agencies procuring software. CISA specifically asked for feedback on the form's feasibility, clarity, and usefulness, with comments accepted through Regulations.gov until June 26, 2023. (CISA)

CISA releases ICS medical advisory for Illumina Universal Copy Service

CISA published a single Industrial Control Systems Medical advisory that week, covering the Illumina Universal Copy Service and identified as ICSMA-23-117-01. The bulletin was part of CISA's ongoing effort to provide timely information about current security issues, vulnerabilities, and exploits affecting medical and industrial control systems. CISA encouraged users and administrators managing affected Illumina deployments to review the advisory for technical details and mitigations relevant to the product. (CISA)

CISA and Cyber Command publicly detail how they share threat intelligence

At the RSA Conference in San Francisco, CISA Executive Assistant Director Eric Goldstein and Cyber National Mission Force commander Maj. Gen. William Hartman gave a joint presentation revealing newly declassified details of how their organizations coordinate against nation-state and criminal cyber activity. They described CNMF passing intelligence from foreign operations to support CISA's domestic defensive mission, and CISA tipping CNMF on intrusions targeting federal agencies and educational institutions, citing case studies including the SolarWinds campaign, Microsoft Exchange hacking, and an Iranian actor's compromise of an election reporting website. (CISA)