Cybersecurity Roundup July 2023

Chinese Malware on U.S. Bases in Taiwan: A Sophisticated Cyberattack 

Chinese malware has reportedly been detected on the computer systems of U.S. military bases in Taiwan. The strategic and sophisticated nature of these attacks suggests they originate from Chinese nation-state actors. 

These cyber intrusions, aimed at disrupting U.S. military activities in the geopolitically tense Taiwan region, target logistics and communication systems. This strategic targeting underscores the potential for significant disruption.  In response, U.S. and Taiwanese authorities have initiated a comprehensive investigation to gauge the intrusion’s extent, identify any breaches, and bolster cybersecurity measures to thwart future attacks.  These attacks underline the escalating cybersecurity issues the U.S. military grapples with, especially in geopolitical hotspots. It highlights potential vulnerabilities in military systems, reinforcing the need for robust national defense cybersecurity infrastructure.  China’s stance on these accusations remains unknown. Such incidents stir global discourse on nation-state cyber activities, their international security implications, and the crucial need for sweeping cybersecurity norms and regulations. 

SSL.com Insights: Client Authentication digital certificates can play a critical role in addressing the cybersecurity issue described above. These certificates can enhance the security of communication and access control within the military infrastructure and protect against unauthorized access and data breaches. Here’s how they can help:

1. Strong Authentication: Client Authentication digital certificates are used to verify the identity of users or devices attempting to access secure systems or services. By requiring client authentication certificates for all users and devices trying to access sensitive military systems, the U.S. military can ensure that only authorized personnel with valid certificates can gain entry. This prevents malicious actors, including those associated with Chinese nation-state actors, from impersonating legitimate users and gaining unauthorized access to military systems. 
2. Limiting Access to Authorized Devices: Client Authentication certificates can be issued to specific devices used by the military, such as laptops or smartphones, ensuring that only trusted and properly configured devices are allowed to connect to military networks. This restricts the potential attack surface and reduces the risk of malware infiltrating the systems through unauthorized devices.

SSL.com Client Authentication Certificates protect critical systems by shielding sensitive data and digital assets from malicious actors, ensuring that only verified individuals or organizations are granted access.  

Buy your SSL.com Client Authentication Certificates here

Smart Device Cybersecurity: U.S. Floats Labelling Idea  

The U.S. government is considering implementing mandatory cybersecurity labels for smart devices, a move aimed at enhancing consumer awareness of the risks associated with the ever-increasing use of Internet of Things (IoT) devices. The labels will guide consumers on potential risks and urge manufacturers to up their security game.  However, this strategy has its critics who feel the brief nature of the labels may oversimplify the complexities of cybersecurity. They propose comprehensive education as an essential accompaniment to the labeling initiative.  Despite this critique, many consider the label proposal a vital stride towards fostering a cybersecurity-conscious society. Advocates believe that when these labels are supplemented with continued education, consumers’ cybersecurity habits can improve, substantially mitigating IoT-related risks.  As the proposal progresses, its potential impact on consumers, manufacturers, and the wider cybersecurity sector is keenly watched. This step highlights the vital role transparency and information dissemination play in reducing cybersecurity risks. 

SSL.com Insights: Public Key Infrastructure (PKI) plays a significant role in device security. It provides a framework for secure communication, authentication, and data integrity in an environment with interconnected devices. Here are a few examples of how PKI can be incorporated into the proposed cybersecurity labels.

1. Enhanced Device Authentication: PKI enables strong device authentication using digital certificates. Each smart device can have its unique certificate, issued by a trusted Certificate Authority (CA). When a consumer buys a device, they can verify the authenticity of the certificate through the label, ensuring that the device comes from a legitimate manufacturer. This helps prevent malicious actors from impersonating devices and reduces the risks of using counterfeit or compromised devices.
2. Secure Communication: IoT devices often communicate with each other and with cloud services. PKI allows for secure and encrypted communication between devices and services using public and private key pairs. The cybersecurity label can include information about the cryptographic algorithms used and the encryption strength, helping consumers understand the level of security provided by the device.

Visit our IoT solutions page to see how SSL.com can help you improve the security of your IoT devices. Education is an important element of cybersecurity, and we’re here to assist you better understand your alternatives. 

Visit SSL.com’s dedicated page for IoT Solutions

OpenSSH Vulnerability CVE-2023-38408: A Call to Update  

A critical flaw, CVE-2023-38408, has been discovered in OpenSSH’s Forwarded SSH-Agent, presenting a significant security risk. Revealed by cybersecurity firm Qualys, this vulnerability allows remote execution of arbitrary commands by attackers.

The flaw, linked to the mishandling of certain requests by the SSH-Agent, can trigger a stack-based buffer overflow, potentially leading to system disruption or execution of harmful code.  In response, the OpenSSH project swiftly issued patches. Users are strongly advised to update to OpenSSH 8.7 or later, which contains the fix. System administrators are also recommended to regularly review security configurations and follow a layered security approach.  This vulnerability highlights the importance of ongoing vulnerability scanning and patch management, stressing the need for robust security practices around widely-used open-source tools like OpenSSH.     

Chinese Hackers Infiltrate Commerce Secretary Raimondo’s Email and Penetrate State Department Accounts   

Chinese cyber actors capitalized on a critical vulnerability within Microsoft’s cloud infrastructure to breach email accounts at the US Commerce and State departments, including that of Commerce Secretary Gina Raimondo.   Notably, Raimondo’s agency had imposed stringent export controls on Chinese tech, prompting backlash from Beijing. While officials have contained the breaches and an FBI investigation is ongoing, the extent of the infiltration raises concerns.   The State Department uncovered the vulnerability last month. Although several email accounts were targeted, only State and Commerce branches were confirmed to have been breached.   The hackers had access for about a month before discovery, raising implications around data access. While the Biden administration seeks to curtail tech exports aiding Chinese military advancements, the breach strengthens its push for greater cloud security measures. 

SSL.com offers comprehensive PKI-based solutions for governments around the world. 

Explore our dedicated article: PKI and Digital Certificates for Government

SSL.com Announcements

Automate Validation and Issuance of Email Signing and Encryption Certificates for Employees 

Bulk enrollment is now available for Personal ID+Organization S/MIME Certificates (also known as IV+OV S/MIME), and NAESB Certificates through the SSL.com Bulk Order Tool. Bulk enrollment of Personal ID+Organization S/MIME and NAESB Certificates has the additional requirement of an Enterprise PKI (EPKI)  Agreement. An EPKI Agreement allows a single authorized representative of an organization to order, validate, issue, and revoke a high volume of these two types of certificates for other members, thereby enabling a faster turnaround in securing an organization’s data and communication systems.     

New Key Storage Requirements for Code Signing Certificates

Starting June 1, 2023, SSL.com’s Organization Validation (OV) and Individual Validation (IV) Code Signing Certificates have been issued either on Federal Information Processing Standard 140-2 (FIPS 140-2) USB tokens or through our eSigner cloud code signing service. This change is in compliance with the Certificate Authority/Browser (CA/B) Forum’s new key storage requirements to increase security for code signing keys. The previous rule allowed OV and IV code signing certificates to be issued as downloadable files from the internet. Since the new requirements only allow the use of encrypted USB tokens or cloud-based FIPS compliant hardware appliances to store the certificate and private key, it is expected that instances of code signing keys being stolen and misused by malicious actors will be greatly reduced. Click this link to learn more about the SSL.com eSigner cloud code signing solution.