Russian hackers are targeting millions of devices around the world to spy, steal information and build networks for potentially devastating future cyberattacks. IT security experts commented below.
Gavin Millard, Technical Director at Tenable:
“Irrelevant of who the threat actors are or their motivations, the existence of an easily exploited vulnerability on critical infrastructure connected to the internet should be addressed immediately. As stated in the technical alert, if a threat actor can gain privileged access to a router, the options for further exploitation are endless.
“It’s important to note, even though the recently disclosed Cisco Smart Install vulnerability doesn’t affect routers, unfortunately there are over 100,000 switches that could be vulnerable currently exposed to the internet. Similar to MS17-10, the vulnerability in SMBv1 leveraged for the global Wannacry attack, these flaws affect protocols that should never be exposed to the internet but frequently are due to a lack of basic security hygiene.
“Owners and operators of MOXA EDR-810 industrial routers, frequently deployed to secure highly critical environments, should take particular note of this advisory as a slew of recently disclosed vulnerabilities could lead to many of the issues outlined.
“The guide from the joint task force includes some good best practices that should be enforced to reduce the chance of a router falling under the control of an attacker, irrelevant of their country of origin or motivation. Continuous visibility of what corporate systems are exposed to the internet, how well they are configured against security best practices (CIS or NIST for example), and whether they are affected by any known vulnerabilities should be part of every robust security program.”
Anthony Chadd, Senior Director, EMEA at Neustar:
“Today’s warnings regarding the Russian hacking offensive, which highlight the probability of Kremlin-backed cyber-experts sitting invisibly on networks with the hope of collecting information, should come as no surprise.
“We are already aware that the Russians are armed with the vast capabilities, resources and motives to steal classified information from governments, and are able to unleash disruption to key industries globally. But today’s news highlights the increasing intensity of the Russian offensive, as it has been revealed that Kremlin cyber-experts have been proactively targeting routers in British homes, scanning for weaknesses such as obvious passwords and expired anti-virus software.
“With such an obvious imposition on US and UK security, it is of the greatest importance that the push for key industries to strengthen their cyber-defences are put in place – fast. This includes deploying efficient technologies and ensuring key processes are up to scratch. However, these marching orders should not just apply to the government, but also society as whole. Every citizen should be proactive in their own cyber-defence, but US and UK governments must make educating the general public a priority, reinforcing the necessity for effective usernames and passwords to prevent their data getting into the wrong hands.
“Beyond that, in order to be proactive in their cyber defences, both citizens and businesses should be aware of the importance of securing any IoT technologies, which is considered to be a crucial first point of defence. This involves ensuring that the proper procedures are in place and that anti-virus software in every device is updated frequently.”
Ross Rustici, Senior Director of Intelligence Services at Cybereason:
“Although tensions with Russia are at an all-time high, the threat of retaliatory cyber-attacks against the UK and its allies is overblown.
“We are likely to see increased disinformation campaigns and some low-level activity by apparently independent groups, but nothing that breaks Russia’s usual plausible deniability. We may also see some cyber activity within the Syrian theatre, such as jamming communications, but nothing which targets nations directly.
An unconcealed, high-level attack on UK infrastructure such as a powerplant would cross a red line into open warfare. Russia’s failure to interfere with the airstrike itself indicates that Putin is not yet ready to escalate and risk a war breaking out. Nobody wants to see these nuclear powers go toe-to-toe in a real conflict.”
The opinions expressed in this post belong to the individual contributors and do not necessarily reflect the views of Information Security Buzz.