Newly leaked NSA documents from Edward Snowden, entitled “I Hunt Sys Admins” show that sophisticated attackers are aiming to breach targets by taking aim on system administrators. Threatpost aptly described this strategy as the “biggest no-brainer.” A core part of this playbook is targeting SSH and the keys used to gain authenticated privileged access.
We must assume that based on previous attacks that adversaries of all types also are targeting system administrators and have the same or even more effective techniques. These sophisticated adversaries include nation states seeking to exploit intellectual property for economic benefit and organized cybercriminals motivated for profit.
The targeting of SSH comes as no surprise given The Mask APT operators and others hunger for SSH keys to infiltrate networks, gain administrator level access, and keep it for a very, very long time.
Part 4 of the leaked documents - “I hunt admins that use SSH” – demonstrates attackers understand the opportunity SSH provides and value for Computer Network Exploitation (CNE) - also known as owning your network, data, and business. As previous Venafi research identified, an attacker with SSH is able to gain administrator-level access that travels over encrypted sessions and in most organizations will never expire. With 1 in 2 organizations never changing SSH keys, attackers fly under the radar and remain in a breached state, forever. And in recent conversations I’ve had with some of the world’s most sophisticated IT security teams, incident response teams indicated they don’t change SSH keys during remediation – perpetuating the insanity!
If organizations can take just a few steps, they’ll have taken giant leaps in defending their enterprises from the assault on SSH and system administrators:
Taking these steps will go a long way to defending against attackers that hunt system administrators. Venafi is already helping the world’s most targeted enterprises secure their SSH keys with Venafi TrustAuthority to gain visibility and Venafi TrustForce to enforce policy, detect anomalies, and respond immediately. This powerful security is part of the Venafi Trust Protection Platform that secures not only SSH keys but also SSL keys and certificates along with mobile certificates.
And one more thing: if system administrators and their SSH keys are targets, it is not a giant leap to assume that SSL keys and certificates are also being targeted and compromised by the same adversaries. This would allow attackers to monitor encrypted SSL communications, surveil their targets, and impersonate trusted web services to collect data and further expand attacks. Defending our enterprises from these assaults means not just protecting SSH keys but also SSL keys and certificates.
Putting these new revelations together with our current understanding means were just another step closer to Gartner’s prediction of “Living in a World Without Trust.” If we don’t secure and protect all of the keys and certificates that establish trust for our enterprises, “I Hunt Sys Admins” shows we’re quickly headed to making this prediction a reality.