By
Kevin Bocek
December 4, 2014
On 24 November news of a major breach at Sony Pictures Entertainment was reported. An organization self-described as the Guardians of Peace (also known by #GOP) claimed responsibility. The group released compressed archives of over 217MB that the organization claims contains Sony data. Those able to access the data reported dozens of SSH private keys were included in the exfiltrated data. This appears to be only a sample of the data stolen as later upcoming Sony movies were leaked online.
This breach is significant for at least three reasons:
Below is some of the content that was stolen from Sony, including SSH keys in the PuTTY SSH client .PPK format.
Sony now joins the at least 44% of organizations Forrester Research found to have already had keys and certificates compromised.
An anonymous source was quoted in a The Next Web (TNW) article as saying, “a single server was compromised and the attack was spread from there.” With stolen SSH keys, an attacker can gain unauthorized access to a system with elevated privilege, like Edward Snowden. Attackers then expand their attack by gaining more data or misusing a compromised system, gain access to more systems, and leave behind backdoors as we’ve seen with Shellshock.
Attackers also target SSL/TLS private keys. When attackers gain access to these keys, they have the ability to spoof trusted services. Bad guys can also launch man-in-the-middle (MITM) attacks to decrypt encrypted communications. The threat is amplified when SSL/TLS keys used for mobile applications are compromised because many mobile applications lack the additional validation checking that many browsers provide.
After realizing that private keys and other sensitive information was revealed, Sony’s initial response was to go dark to prevent further access. In the reports about the Sony breach, Sony was said to have taken their corporate network offline and disabled the VPN. Insiders also shared that Sony asked employees to turn off their computers and disable WIFI on their mobile devices.
But Sony’s business cannot be sustained with their corporate systems down. What does Sony need to do to remediate this breach? The examples of stolen content show that SSH keys were stolen, including SSH keys to the ADP payroll system. But Sony should not stop with the private keys shared by attackers. Like with Heartbleed, Sony must assume that all keys and certificates were compromised.
Until incident response teams fully remediate keys and certificates, adversaries retain unauthorized access and the ability to execute spoofing and MITM attacks. Remediation requires not only that servers, virtual machines, and network segments be brought back to a known good state, but also that new keys be generated and then certificates be re-issued, installed, and validated, and old ones revoked.
Furthermore, if Sony fails to remediate their keys and certificates, the bad guys can exploit this to undermine other security controls, from strong authentication to privileged access to behavioral analysis. When attackers have the trusted status of valid keys and certificates, they can authenticate and cloak their malicious activities.
If Sony is like most Global 2000 organizations, the IT team is not even aware of all of the digital certificates and cryptographic keys that support trusted communications and authentication in the network. To effectively remediate this type of breach, organizations must know how all keys and certificates are used to establish trust (from SSL and SSH through to POS and mobile devices), where they are located, and who is responsible for them.
Only once a baseline inventory is known can organizations then respond to incidents by replacing keys and certificates. However, most organizations then rely on manual methods that keep organizations vulnerable for extended periods of time. APT operators, from Mask to Crouching Yeti, have been known to exploit stolen keys over periods of up to 7 years.
Remediation that is automated can close doors on attackers in minutes versus days, weeks, or months that it may take organizations to remediate manually. Until keys and certificates are replaced, your network, intellectual property, and customer data is still vulnerable. Time is of the essence.
This breach is a problem not just for Sony. Organizations are breached every day but are not aware keys and certificates are being stolen for misuse and do not remediate by changing keys and certificates.
Venafi recommends customers use the Venafi Trust Protection Platform in preparation to respond to increasing incidents of attackers compromising keys and certificates with the following actions:
Venafi CISO, Tammy Moskites, has prepared guidance’s for CISO and their team on why organizations need to prepare to respond to more incidents involving the compromise and misuse of keys and certificates.
Please contact Venafi support with any questions or for help with remediation.
In the meantime, please explore more of our solutions