Wiz Recaps Its 2023 Cloud Security Stories and Key Lessons
Summary
Wiz revisits selected 2023 stories on cloud vulnerabilities, supply-chain attacks, ransomware, Microsoft’s stolen signing key and AI data poisoning, highlighting lessons about credential security, data hygiene and training-data integrity.
Key points
- The article notes that CVE-2023-4863 and CVE-2023-5217 affected shared libraries, not only Chrome, and were mainly client-side risks for cloud workloads.
- The MOVEit Transfer vulnerabilities were exploited in an operation attributed to Cl0p, which claimed it had gathered sensitive information from companies.
- Scattered Spider and ALPHV were reported to have expanded into cloud lateral movement and ransomware operations, complicating attribution between the groups.
- In the CircleCI supply-chain attack, an attacker reportedly compromised an engineer’s 2FA-backed SSO session and obtained customer access keys.
- An attacker who accessed Okta’s environment reused session tokens found in customer HAR files shared with support; some affected organizations publicly disclosed their impact.
- Microsoft’s investigation into the Storm-0558 incident found the signing key was probably stolen from a crash dump on an internal server and used to forge authentication tokens.
- The article highlights proposed defenses against AI training-data poisoning, including hashing expected content and randomizing data ingestion schedules.
Article Details
- Topic
- Notable cloud security vulnerabilities, incidents, supply chain attacks, and AI data poisoning discussed in 2023
CVE
CVE-2023-34362the first in a series of exploited remote code execution (RCE) flaws affecting MOVEit Transfer (CVE-2023-34362), in what turned out to be the first public sign of an operation seemingly going back as far as 2021.CVE-2023-35036an operation seemingly going back as far as 2021. Shortly afterward, two additional vulnerabilities (CVE-2023-35036 and CVE-2023-35708) crashed the scene with SQL injection issues. Despite MOVEit's relatively rareCVE-2023-35708going back as far as 2021. Shortly afterward, two additional vulnerabilities (CVE-2023-35036 and CVE-2023-35708) crashed the scene with SQL injection issues. Despite MOVEit's relatively rare presence in theCVE-2023-41064is interesting for another reason: two other CVEs were issued for the exact same vulnerability (CVE-2023-41064 and CVE-2023-5129), which was a source of much confusion for a few days and certainly goes againstCVE-2023-4863cases, items that fell into the Chrome category were hiding much more interesting vulnerabilities. CVE-2023-4863 and CVE-2023-5217 caused quite a stir when they were initially published as vulnerabilities in GoogleCVE-2023-5129for another reason: two other CVEs were issued for the exact same vulnerability (CVE-2023-41064 and CVE-2023-5129), which was a source of much confusion for a few days and certainly goes against industry norms — theCVE-2023-5217fell into the Chrome category were hiding much more interesting vulnerabilities. CVE-2023-4863 and CVE-2023-5217 caused quite a stir when they were initially published as vulnerabilities in Google Chrome, only to be
People
ChompieHacker and computer security researcher interviewed about kernel post-exploitation and Amazon Firecracker tenant-isolation research.Corey QuinnInterviewed about cloud security, including the Microsoft signing-key incident.Scott PiperCloud security researcher interviewed about cloud security and fwd:cloudsec.Will PiercePresented research on AI data poisoning during model training.
Threat Actors
0ktapusExplicitly identified as another name for Scattered-Spider.ALPHVRansomware group described as collaborating with Scattered-Spider in cloud-focused operations; also called BlackCat.BlackCatExplicitly identified as another name for ALPHV.Cl0pRansomware group that claimed responsibility for the MOVEit Transfer exploitation.Scatter SwineExplicitly identified as another name for Scattered-Spider.Scattered SpiderThreat actor described as using social engineering and malware to compromise victim credentials and participating in cloud-focused operations.Storm-0558Threat actor described as stealing a Microsoft signing key and using forged authentication tokens to target accounts, including government email.UNC3944Explicitly identified as another name for Scattered-Spider.
Vendors
CircleCICircleCI supply chain attack MicrosoftMicrosoft signing key compromised by Storm-0558 OktaOkta support system supply chain attack Progress SoftwareOn May 31, 2023, Progress published the first in a series of exploited remote code execution (RCE) flaws affecting MOVEit Transfer (CVE-2023-34362), in what turned out to be the first public sign of an operation
Products
Amazon Firecrackerwith tales of her unique path to a cybersecurity career, insights gleaned from her research into Amazon Firecracker tenant isolation, and the importance of virtualization security in general. Personally, I thinkAzure(from Episode #6: “Chinese Spies Acquire Keys to the Azure Kingdom”) Google ChromeSeveral critical vulnerabilities in Google Chrome were published in 2023. In a few cases, items that fell into the Chrome category were hiding much more interesting vulnerabilities. CVE-2023-4863 and CVE-2023-5217Microsoft 365 Apps for EnterpriseIn a wild cybersecurity twist, Chinese hackers broke into a U.S. government agency's Microsoft 365 tenant by snagging a key from Microsoft themselves meant for verifying customer identities. By forging authenticationMozilla Firefoxto be later revealed as library vulnerabilities impacting an extensive list of other products, including Firefox, Slack and Signal. At first, we were concerned about the potential impact on cloud environments (wouldProgress MOVEit TransferMOVEiT Transfer 0days exploited by Cl0p to disastrous effect Signalas library vulnerabilities impacting an extensive list of other products, including Firefox, Slack and Signal. At first, we were concerned about the potential impact on cloud environments (would either of theseSlackrevealed as library vulnerabilities impacting an extensive list of other products, including Firefox, Slack and Signal. At first, we were concerned about the potential impact on cloud environments (would either of