CISA Broke Into a US Federal Agency, No One Noticed For a Full 5 Months

A 2023 red team exercise by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) at an unnamed federal agency exposed critical security failings, including unpatched vulnerabilities, inadequate incident response, and weak credential management, leading to a full domain compromise. According to The Register’s Connor Jones, the agency failed to detect or remediate malicious activity for five months. From the report: According to the agency’s account of the exercise, the red team was able to gain initial access by exploiting an unpatched vulnerability (CVE-2022-21587 – 9.8) in the target agency’s Oracle Solaris enclave, leading to what it said was a full compromise. It’s worth noting that CVE-2022-21587, an unauthenticated remote code execution (RCE) bug carrying a near-maximum 9.8 CVSS rating, was added to CISA’s known exploited vulnerability (KEV) catalog in February 2023. The initial intrusion by CISA’s red team was made on January 25, 2023. “After gaining access, the team promptly informed the organization’s trusted agents of the unpatched device, but the organization took over two weeks to apply the available patch,” CISA’s report reads. “Additionally, the organization did not perform a thorough investigation of the affected servers, which would have turned up IOCs and should have led to a full incident response. About two weeks after the team obtained access, exploit code was released publicly into a popular open source exploitation framework. CISA identified that the vulnerability was exploited by an unknown third party. CISA added this CVE to its Known Exploited Vulnerabilities Catalog on February 2, 2023.” […]

After gaining access to the Solaris enclave, the red team discovered they couldn’t pivot into the Windows part of the network because missing credentials blocked their path, despite enjoying months of access to sensitive web apps and databases. Undeterred, CISA managed to make its way into the Windows network after carrying out phishing attacks on unidentified members of the target agency, one of which was successful. It said real adversaries may have instead used prolonged password-praying attacks rather than phishing at this stage, given that several service accounts were identified as having weak passwords. After gaining that access, the red team injected a persistent RAT and later discovered unsecured admin credentials, which essentially meant it was game over for the agency being assessed. “None of the accessed servers had any noticeable additional protections or network access restrictions despite their sensitivity and critical functions in the network,” CISA said.

CISA described this as a “full domain compromise” that gave the attackers access to tier zero assets — the most highly privileged systems. “The team found a password file left from a previous employee on an open, administrative IT share, which contained plaintext usernames and passwords for several privileged service accounts,” the report reads. “With the harvested Lightweight Directory Access Protocol (LDAP) information, the team identified one of the accounts had system center operations manager (SCOM) administrator privileges and domain administrator privileges for the parent domain. “They identified another account that also had administrative permissions for most servers in the domain. The passwords for both accounts had not been updated in over eight years and were not enrolled in the organization’s identity management (IDM).” From here, the red team realized the victim organization had trust relationships with multiple external FCEB organizations, which CISA’s team then pivoted into using the access they already had.

The team “kerberoasted” one partner organization. Kerberoasting is an attack on the Kerberos authentication protocol typically used in Windows networks to authenticate users and devices. However, it wasn’t able to move laterally with the account due to low privileges, so it instead used those credentials to exploit a second trusted partner organization. Kerberoasting yielded a more privileged account at the second external org, the password for which was crackable. CISA said that due to network ownership, legal agreements, and/or vendor opacity, these kinds of cross-organizational attacks are rarely tested during assessments. However, SILENTSHIELD assessments are able to be carried out following new-ish powers afforded to CISA by the FY21 National Defense Authorization Act (NDAA), the same powers that also allow CISA’s Federal Attack Surface Testing (FAST) pentesting program to operate. It’s crucial that these avenues are able to be explored in such exercises because they’re routes into systems adversaries will have no reservations about exploring in a real-world scenario. For the first five months of the assessment, the target FCEB agency failed to detect or remediate any of the SILENTSHIELD activity, raising concerns over its ability to spot genuine malicious activity. CISA said the findings demonstrated the need for agencies to apply defense-in-depth principles. The cybersecurity agency recommended network segmentation and a Secure-by-Design commitment.

Read more of this story at Slashdot.

OpenAI Working On New Reasoning Technology Under Code Name ‘Strawberry’

OpenAI is close to a breakthrough with a new project called “Strawberry,” which aims to enhance its AI models with advanced reasoning abilities. Reuters reports: Teams inside OpenAI are working on Strawberry, according to a copy of a recent internal OpenAI document seen by Reuters in May. Reuters could not ascertain the precise date of the document, which details a plan for how OpenAI intends to use Strawberry to perform research. The source described the plan to Reuters as a work in progress. The news agency could not establish how close Strawberry is to being publicly available. How Strawberry works is a tightly kept secret even within OpenAI, the person said.

The document describes a project that uses Strawberry models with the aim of enabling the company’s AI to not just generate answers to queries but to plan ahead enough to navigate the internet autonomously and reliably to perform what OpenAI terms “deep research,” according to the source. This is something that has eluded AI models to date, according to interviews with more than a dozen AI researchers. Asked about Strawberry and the details reported in this story, an OpenAI company spokesperson said in a statement: “We want our AI models to see and understand the world more like we do. Continuous research into new AI capabilities is a common practice in the industry, with a shared belief that these systems will improve in reasoning over time.”

On Tuesday at an internal all-hands meeting, OpenAI showed a demo of a research project that it claimed had new human-like reasoning skills, according to Bloomberg, opens new tab. An OpenAI spokesperson confirmed the meeting but declined to give details of the contents. Reuters could not determine if the project demonstrated was Strawberry. OpenAI hopes the innovation will improve its AI models’ reasoning capabilities dramatically, the person familiar with it said, adding that Strawberry involves a specialized way of processing an AI model after it has been pre-trained on very large datasets. Researchers Reuters interviewed say that reasoning is key to AI achieving human or super-human-level intelligence.

Read more of this story at Slashdot.

German Navy To Replace Aging 8-Inch Floppy Drives With an Emulated Solution

Mark Tyson reports via Tom’s Hardware: The German Navy is searching for a new storage system to replace the aging 8-inch (20cm) floppy disks which are vital to the running of its Brandenburg class F123 frigates. According to an official tender document, the ideal answer to the German Navy’s problems would be a drop-in floppy disk replacement based upon a storage emulation system, reports Golem.de. Germany’s Brandenburg class F123 frigates were commissioned in the mid 1990s, so it is understandable that floppy disks were seen as a handy removable storage medium. These drives are part of the frigates’ data acquisition system and, thus “central to controlling basic ship functions such as propulsion and power generation,” according to the source report.

The F123s are specialized in submarine hunting, and they are also being upgraded in terms of the weapon systems and weapon control systems. Swedish company Saab is the general contractor for the F123 modernizations. It won’t be trivial to replace three decades old computer hardware seamlessly, while retaining the full functionality of the existing floppies. However, we note that other companies have wrestled similar problems in recent years. Moreover, there are plenty of emulator enthusiasts using technologies for floppy emulation solutions like Gotek drives which can emulate a variety of floppy drive standards and formats. There are other workable solutions already out there, but it all depends on who the German Navy chooses to deliver the project.

Read more of this story at Slashdot.

Palestinians Say Microsoft Unfairly Closing Their Accounts

Ancient Slashdot reader Alain Williams writes: Palestinians living abroad have accused Microsoft of closing their email accounts without warning — cutting them off from crucial online services. They say it has left them unable to access bank accounts and job offers — and stopped them using Skype, which Microsoft owns, to contact relatives in war-torn Gaza. Microsoft says they violated its terms of service — a claim they dispute. He also said being cut off from Skype was a huge blow for his family. The internet is frequently disrupted or switched off there because of the Israeli military campaign – and standard international calls are very expensive. […] With a paid Skype subscription, it is possible to call mobiles in Gaza cheaply — and while the internet is down — so it has become a lifeline to many Palestinians.

Some of the people the BBC spoke to said they suspected they were wrongly thought to have ties to Hamas, which Israel is fighting, and is designated a terrorist organization by many countries. Microsoft did not respond directly when asked if suspected ties to Hamas were the reason for the accounts being shut. But a spokesperson said it did not block calls or ban users based on calling region or destination. “Blocking in Skype can occur in response to suspected fraudulent activity,” they said, without elaborating.

Read more of this story at Slashdot.

Arm Announces an Open-Source Graphics Upscaler For Mobile Phones

Arm is launching its Arm Accuracy Super Resolution (ASR) upscaler that “can make games look better, while lowering power consumption on your phone,” according to The Verge. “It’s also making the upscaling technology available to developers under an MIT open-source license.” From the reprot: Arm based its technology on AMD’s FidelityFX Super Resolution 2 (FSR 2), which uses temporal upscaling to make PC games look better and boost frame rates. Unlike spatial upscaling, which upscales an image based on a single frame, temporal upscaling involves using multiple frames to generate a higher-quality image.

You can see just how Arm ASR stacks up to AMD’s FSR 2 and Qualcomm’s GSR tech in [this chart] created by Arm. Arm claims ASR produced 53 percent higher frame rates than rendering at native resolution on a device with an Arm Immortalis-G720 GPU and 2800 x 1260 display, beating AMD FSR 2. It also tested ASR on a device using MediaTek’s Dimensity 9300 chip and found that rendering at 540p and upscaling with ASR used much less power than running a game at native 1080p resolution.

Read more of this story at Slashdot.

Amazon Says It Now Runs On 100% Clean Power. Employees Say It’s More Like 22%

Today, Amazon announced that it reached its 100% renewable energy goal seven years ahead of schedule. However, as Fast Company’s Adele Peters reports, “a group of Amazon employees argues that the company’s math is misleading.” From the report: A report (PDF) from the group, Amazon Employees for Climate Justice, argues that only 22% of the company’s data centers in the U.S. actually run on clean power. The employees looked at where each data center was located and the mix of power on the regional grids — how much was coming from coal, gas, or oil versus solar or wind. Amazon, like many other companies, buys renewable energy credits (RECs) for a certain amount of clean power that’s produced by a solar plant or wind farm. In theory, RECs are supposed to push new renewable energy to get built. In reality, that doesn’t always happen. The employee research found that 68% of Amazon’s RECs are unbundled, meaning that they didn’t fund new renewable infrastructure, but gave credit for renewables that already existed or were already going to be built.

As new data centers are built, they can mean that fossil-fuel-dependent grids end up building new fossil fuel power plants. “Dominion Energy, which is the utility in Virginia, is expanding because of demand, and Amazon is obviously one of their largest customers,” says Eliza Pan, a representative from Amazon Employees for Climate Justice and a former Amazon employee. “Dominion’s expansion is not renewable expansion. It’s more fossil fuels.” Amazon also doesn’t buy credits that are specifically tied to the grids powering their data centers. The company might purchase RECs from Canada or Arizona, for example, to offset electricity used in Virginia. The credits also aren’t tied to the time that the energy was used; data centers run all day and night, but most renewable energy is only available some of the time. The employee group argues that the company should follow the approach that Google takes. Google aims to use carbon-free energy, 24/7, on every grid where it operates.

Read more of this story at Slashdot.