New 0-Day Attacks Linked to China's 'Volt Typhoon'

https://krebsonsecurity.com/2024/08/new-0-day-attacks-linked-to-chinas-volt-typhoon/

by todsacerdoti • 2 years ago

206 48 2 years ago

krebsonsecurity.com

skybrian2• 2 years ago

What does Versa Director do? Is it widely used?

diggan• 2 years ago

Second paragraph:

Versa Director systems are primarily used by Internet service providers (ISPs), as well as managed service providers (MSPs) that cater to the IT needs of many small to mid-sized businesses simultaneously.

From their own website:

Versa Director is Versa Networks’ virtualization and service creation platform that simplifies the creation, automation and delivery of services using Versa WAN edge software, FlexVNF.

https://versa-networks.com/documents/datasheets/versa-direct...

skybrian2• 2 years ago

Yes, but that doesn’t really do it for me, so I was wondering if someone who has used them could explain it better.

josecapurro• 2 years ago

Versa Director is the management solution for their SD-WAN, SD-LAN, SASE, ZTNA and whatnot. It manages the Versa CSG routers and their respective configuration.

Here in Paraguay we have an ISP using it for their enterprise secure SD-WAN offering. I know it is deployed in Colombia also by the same ISP. So, it is used, although widely i do not know.

It is similar to FortiManager, Aruba Central, and the like.

iaaan• 2 years ago

As a developer on a project like 5 years ago that was intended to integrate one of our products with Versa's equipment and Director, I'm surprised it took this long. There are probably more where that came from.

imhereforwifi• 2 years ago

Versa said the weakness allows attackers to upload a file of their choosing to vulnerable systems.

I am curious why doesn't Versa use the exploit themselves to patch the issue? it would be a great wake up moment to realize that stuff is not secure as it should be with updates.

ethbr1• 2 years ago

Liability and the recent CrowdStrike patch fiasco.

tormeh• 2 years ago

Enterprise customers don't like surprises; not even positive ones. This is a good way to lose trust.

0xdeadbeefbabe2• 2 years ago

They did, but they didn't tell you.

Edit: (Just speculation)

Jerrrrrrry• 2 years ago

Like Omicron beat Delta in 2020?

Liability - when you do not have the monopoly on violence, you don't set the rules.

blahgeek2• 2 years ago

(I'm a Chinese and a software engineer, so it's my obviously-biased 2 cents)

Based on my observation of fellow Chinese software engineers' average knowledge and skills about cyber security, as well as the absolute absent of security considerations of most "SOHO network devices" in China, I would rather apply Hanlon's razor and say that it's not the Chinese attackers, but it's Chinese botnet.

As you may already know, Chinese users and software engineers generally does not care about personal privacy and hence also cyber security, so the entire industry is rather undeveloped.

loufe• 2 years ago

What on earth would the "average" developer's knowledge and skills in cyber security have anything to do with it? I believe there are enormous quantities of brilliant and well educated people in every major country. China certainly doesn't lack them, nor does the US, Russia, India, Germany, Brazil,m etc.

If you read the CVE description linked you'll notice some details focused on the actual specific product, I have a hard time believing random hackers trying to build a botnet would search out critical infrastructure and burn expensive 0-days for small amounts of compute.

blahgeek2• 2 years ago

What on earth would the "average" developer's knowledge and skills in cyber security have anything to do with it?

I may be wrong, but I think the development of an "industry" would depend on the foundation of related education and its popularity in the population. Like if football is not taught in the school and people generally don't play it in a country, it's unlikely to have a team to win in olympics even if the government wants it.

aragonite2• 2 years ago

The link between Volt Typhoon and China is not as firmly established as news reports tend to suggest. It's mostly based on tactical attributions (as opposed to operational and strategic ones). China attributes the indicators to a cybercrime group. This blog post has a good summary of the state of evidence (such as it is):

https://nattothoughts.substack.com/p/who-is-volt-typhoon-a-s...

2OEH8eoCRo02• 2 years ago

The article states this

Black Lotus Labs said it assessed with “medium” confidence that Volt Typhoon was responsible for the compromises, noting the intrusions bear the hallmarks of the Chinese state-sponsored espionage group — including zero-day attacks targeting IT infrastructure providers, and Java-based backdoors that run in memory only.

Who is Natto Thoughts and why should I care? Substack opinions are cheap.

spr-alex• 2 years ago

Regarding attribution to Volt Typhoon please see CISA's previous advisory where they have raised alarms about the targeting of critical internet infrastructure by this threat actor

https://www.cisa.gov/news-events/cybersecurity-advisories/aa...

JKCalhoun• 2 years ago

No one seems to be telling who got pwned. Another article suggested one of the ISPs was a "big one".

2OEH8eoCRo02• 2 years ago

We are so fucked we just don't know it yet.

ck2• 2 years ago

during any future armed conflict with China

well there's a sentence to think about in horror

Sysreq22• 2 years ago

The odds are getting higher by the day. There is a lot happening in the world with China’s economic blessing. American sanctions don’t work when China manufactures everything.

0xdeadbeefbabe2• 2 years ago

But who will buy their stuff then?

Lonestar14403• 2 years ago

"The advisory placed much of the blame on Versa customers who “failed to implement system hardening and firewall guidelines…leaving a management port exposed on the internet that provided the threat actors with initial access.”"

If ISPs are leaving management ports open on the Internet, it's going to take more than a vendor patch to protect them from cyber warfare.

halJordan3• 2 years ago

Yeah but come on. Everytime someone says "There needs to be a regulation or a certification" forcing cyber hygiene this whole site rises up in arms clamoring that checklists mean nothing and prevent nothing.

This is what you get when there's no checklist enforced. I would like to see all those people pour into the conversation jumping up and down with glee that their plan worked.

Lonestar14403• 2 years ago

The objection to Regulations, checklists, etc seems to stem from the idea that the Checklist will include 100 useless or worse items (405.i.18: Passwords MUST BE rotated by the user every 30 days) for every good one like "close the damn ports". In theory, such a thing will just slow a solid admin down.

I don't think this aligns with the reality of modern IT. Even with high competence and good intentions, it's an organizational problem and mistakes are easy.

We need better checklists, I guess.

mmsc• 2 years ago

In many ways, anybody that leaves an management port open to the internet is to blame. It's not even security 101, it's sysadmin 101.

It's like leaving a BMC open to the internet: these things are built with no security in mind, and can be rooted as soon as they can be connected to.

Sysreq22• 2 years ago

Relevant: https://samcurry.net/hacking-millions-of-modems

metadat2• 2 years ago

This is a fun article. It was also discussed at the time:

Hacking millions of modems and investigating who hacked my modem - https://news.ycombinator.com/item?id=40570781 - June 2024 (13 comments)

nojs• 2 years ago

In that story why was the replaying of HTTP requests so suspicious? They were cleartext requests sent over the internet, anyone could have seen the path.

tru3_power• 2 years ago

Lol the vuln itself is so low bar too- literally just upload a malicious jar file and it execs.

idunnoman1222• 2 years ago

So… if your ISP automatically updates your modems firmware, you may be backdoored

halJordan3• 2 years ago

Your modems already have a backdoor. Your wifi password is stored on their servers and modems already will execute arbitrary code through the management interface.

lazycog512• 2 years ago

"Volt Typhoon" sounds like a shonen anime villain.

New 0-Day Attacks Linked to China's 'Volt Typhoon'

Related Stories