Week of July 31, 2023: Ivanti EPMM Zero-Days Exploited, CISA Publishes Strategic Plan

Security leaders spent the week of July 31, 2023 tracking active exploitation of Ivanti Endpoint Manager Mobile flaws that CISA and Norway's NCSC linked to a compromise of a Norwegian government network, alongside a newly identified SUBMARINE backdoor found on compromised Barracuda ESG appliances. CISA also published its FY2024-2026 Cybersecurity Strategic Plan and a joint advisory on the top vulnerabilities exploited in 2022, issued guidance urging the UEFI community to address firmware persistence threats, welcomed a new Open Source Security Lead, and researchers disclosed a Salesforce email zero-day abused for phishing.

CISA Adds Ivanti EPMM Path Traversal Flaw to KEV Catalog

CISA added CVE-2023-35081, a path traversal vulnerability in Ivanti Endpoint Manager Mobile (EPMM), to its Known Exploited Vulnerabilities Catalog on July 31, 2023, citing evidence of active exploitation. The addition followed disclosure that attackers could chain the flaw with an earlier authentication-bypass bug, CVE-2023-35078, to gain privileged access to EPMM systems and execute uploaded files such as webshells. Federal Civilian Executive Branch agencies were required to remediate the vulnerability under Binding Operational Directive 22-01. (CISA)

CISA and Norway's NCSC Detail APT Exploitation of Ivanti EPMM

CISA and Norway's National Cyber Security Centre published a joint advisory on August 1, 2023 detailing advanced persistent threat exploitation of two Ivanti Endpoint Manager Mobile vulnerabilities, CVE-2023-35078 and CVE-2023-35081. The advisory said APT actors exploited the authentication-bypass flaw as a zero day from at least April 2023 through July 2023, gathering information from several Norwegian organizations and compromising a Norwegian government agency's network. Ivanti released patches on July 23 and July 28, 2023, and the agencies urged organizations to hunt for compromise using included indicators. (CISA)

CISA Flags New SUBMARINE Backdoor in Barracuda ESG Attacks

On July 31, 2023, Help Net Security reported that CISA had published an analysis of a new backdoor called SUBMARINE found on Barracuda Email Security Gateway appliances compromised via CVE-2023-2868. The malware executed with root privileges and lived in a SQL database on the ESG appliance, combining a SQL trigger, shell scripts and a loaded library to enable persistence, command and control, and cleanup. CISA described the backdoor as posing a severe threat for lateral movement and provided indicators of compromise for defenders. (Help Net Security)

CISA Releases FY2024-2026 Cybersecurity Strategic Plan

CISA released its Cybersecurity Strategic Plan on August 4, 2023, laying out nine objectives it will pursue over the next three years to fulfill its cybersecurity mission. The objectives span increasing visibility into cyber threats, coordinating vulnerability disclosure, executing joint cyber defense operations, driving development of trustworthy technology products, reducing risks from emergent technologies such as artificial intelligence, and building a national cyber workforce. CISA said the plan aligns each objective to enabling measures and measures of effectiveness intended to drive accountability across the agency. (CISA)

CISA Urges UEFI Community to Fix Persistent Firmware Threats

In an August 3, 2023 blog post, CISA technical leaders warned that attackers have exploited flaws in the Unified Extensible Firmware Interface to gain persistence on compromised systems, citing recent incident response work on UEFI malware such as BlackLotus. CISA said UEFI secure boot developers had not all implemented public key infrastructure practices needed for patch distribution and called on vendors to mature product security incident response operations, integrate patch distribution with secure-by-design practices, and give system owners the ability to audit and update UEFI components like any other software. (CISA)

CISA Names Aeva Black as Open Source Security Lead

CISA announced on July 31, 2023 that Aeva Black had joined the agency as its Open Source Security Lead, a role intended to strengthen software security across the nation's critical infrastructure. Aeva previously worked at several major technology companies and founded open source projects including OmniBOR and OpenStack Ironic "Bare Metal." CISA said the hire would support a new initiative to engage open source community organizations and to foster security-by-design and secure-by-default principles within that community. (CISA)

Guardio Uncovers Salesforce Zero-Day Used in Phishing Campaign

Guardio researchers disclosed on August 2, 2023 that they had found a zero-day vulnerability in Salesforce's email services that let threat actors send phishing emails from genuine @salesforce.com addresses by abusing the platform's Email-To-Case feature. The messages included legitimate Facebook links and exploited legacy quirks in Facebook's web games platform to evade detection, bypassing conventional anti-spam and anti-phishing mechanisms. Guardio said it reported the findings to Salesforce and Meta, and both companies addressed the issue. (Help Net Security)