2023 - Sherri Davidoff

### Overview In this presentation, Sherri Davidoff (CEO of LMG Security) explores the rising prevalence of mass zero-day exploits and supply chain attacks. Combining lessons from incidents such as MOVEit, SolarWinds, Log4j, Accellion, GoAnywhere, Kaseya, and Cisco IOS XE, Davidoff emphasizes that organizations must fundamentally assume compromise and vulnerability. The presentation outlines the mechanics of zero-day exploitation, the compounding risks introduced by third- and fourth-party technology vendors, and a structured response framework for handling zero-day disclosures.

### Key Topics - **Targeting Sensitive Software & File Transfer Solutions:** Attackers intentionally target systems designed to hold or process sensitive data—notably secure file transfer appliances such as MOVEit Transfer, Accellion FTA, and GoAnywhere MFT. For example, the Clop ransomware gang weaponized zero-days against these platforms to steal sensitive data from thousands of victim organizations without needing to immediately notify or negotiate with each victim manually. - **Holiday & Weekend Attack Timing:** Attackers frequently launch exploits during off-hours, weekends, or major holidays (e.g., the MOVEit campaign over Memorial Day weekend, Kaseya over the 4th of July). Mandiant/FireEye data highlights that 76% of ransomware attacks initiate after hours or on weekends, exposing organizations that lack 24/7 vulnerability intelligence monitoring. - **Supply Chain Ripple Effects & Cascading Delays:** Exploitations of vendors (such as Fiserv or PwC using MOVEit) ripple downstream to clients like Flagstar Bank months after the original incident. Downstream organizations face delayed breach disclosures and complex investigations as each link in the supply chain assesses its exposure. - **Root Causes of Zero-Day Proliferation:** Years of corporate source code thefts (e.g., Operation Aurora) and hacked bug-tracking databases (such as Microsoft's 2013 bug tracker breach reported in 2017) provide adversaries with proprietary blueprints to comb for unpatched flaws. Furthermore, mature zero-day exploit markets (e.g., 0day.today) now sell or freely distribute turnkey exploits. - **Data Minimization as Primary Risk Reduction:** Because data hoarding drastically escalates breach liability (with average U.S. breach costs reaching $9.48 million according to IBM), organizations must implement automatic data retention and purging policies for temporary transfer systems, alongside maintaining rigorous hardware, software, and data inventories.

### Technical Details - **The Cisco IOS XE Zero-Day Chain:** On October 16, Cisco announced a critical CVSS 10.0 vulnerability allowing remote attackers to execute level 15 admin commands and create a local user to access the web UI. Four days later (October 20), Cisco revealed a second vulnerability: a privilege escalation flaw enabling attackers to break out of IOS into underlying Linux, run arbitrary commands, and install a persistent implant/backdoor that survives local user remediation. Device telemetry tracked over 40,000 compromised devices until attackers altered their implant to return different HTTP responses (initially returning a 404), temporarily evading detection scripts. - **Exploit & Detection Windows:** Attackers begin scanning within 15 minutes of public disclosure, and in cases like Log4j, weaponized exploits were observed in the wild a full day prior to public announcement. Conversely, Microsoft research shows it takes an average of 120 days (4 months) for newly patched vulnerabilities to be integrated into common automated vulnerability scanning tools. - **Forensic Investigation Realities:** In a real-world response to a MobileIron server vulnerable to Log4j, LMG Security identified two distinct botnets (the Muhstik cryptojacking botnet and the Mirai DDoS botnet) co-existing on the same system. This aligns with Mandiant data showing multiple threat actors present in 27% of compromised environments.

### Takeaways Organizations must treat zero-day disclosures as active security incidents rather than standard patching routines, executing a structured response checklist: 1. **Monitor Threat Intelligence 24/7:** Establish monitoring for vendor advisories and exploit intelligence across off-hours and holidays. 2. **Determine Applicability & Inventory:** Utilize software bills of materials (SBOMs) and accurate asset inventories to confirm running software and affected versions. 3. **Proactively Query Suppliers:** Mandate that key suppliers rapidly confirm whether they are running vulnerable software versions. 4. **Preserve Evidence Before Remediating:** Capture forensic images/logs prior to altering or rebuilding systems to preserve the ability to rule out data breaches for regulatory compliance. 5. **Enact Rapid Containment:** Minimize attack surfaces by disabling unnecessary public-facing web management interfaces (e.g., ports 80/443 on appliances or admin UIs). 6. **Hunt for Indicators of Compromise (IoCs) & Threats:** Patching alone does not remove previously planted implants, web shells, or secondary threat actors. Verify systems for compromise, monitor evolving IoC definitions, and perform deep threat hunting. 7. **Institutionalize Playbooks:** Adopt formal playbooks, such as CISA's Incident and Vulnerability Response Playbooks, and conduct regular incident response testing.