Attack on Trust Threat Bulletin: Sony Breach Leaks Private Keys, Leaving Door Open

The Breach

On 24 November news of a major breach at Sony Pictures Entertainment was reported. An organization self-described as the Guardians of Peace (also known by #GOP) claimed responsibility. The group released compressed archives of over 217MB that the organization claims contains Sony data. Those able to access the data reported dozens of SSH private keys were included in the exfiltrated data. This appears to be only a sample of the data stolen as later upcoming Sony movies were leaked online.

Message Displayed When Employees Logged into the Company Network

This breach is significant for at least three reasons:

1. It is one more example that bad guys are looking for and obtaining SSL and SSH keys like we’ve seen with Mask, Crouching Yeti, APT18, and others.
2. Theft of private keys means attackers can have access to an unknown number of systems with elevated privileges, enabling them to obtain more unpublished keys and certificates.
3. Until keys and certificates are replaced following the breach, attackers maintain their foothold—retaining elevated privileges, having the ability to decrypt sensitive data in transit, and spoofing systems and administrators.

Below is some of the content that was stolen from Sony, including SSH keys in the PuTTY SSH client .PPK format.

Sony now joins the at least 44% of organizations Forrester Research found to have already had keys and certificates compromised.

Threat

An anonymous source was quoted in a The Next Web (TNW) article as saying, “a single server was compromised and the attack was spread from there.” With stolen SSH keys, an attacker can gain unauthorized access to a system with elevated privilege, like Edward Snowden. Attackers then expand their attack by gaining more data or misusing a compromised system, gain access to more systems, and leave behind backdoors as we’ve seen with Shellshock.

Attackers also target SSL/TLS private keys. When attackers gain access to these keys, they have the ability to spoof trusted services. Bad guys can also launch man-in-the-middle (MITM) attacks to decrypt encrypted communications. The threat is amplified when SSL/TLS keys used for mobile applications are compromised because many mobile applications lack the additional validation checking that many browsers provide.

Impact

After realizing that private keys and other sensitive information was revealed, Sony’s initial response was to go dark to prevent further access. In the reports about the Sony breach, Sony was said to have taken their corporate network offline and disabled the VPN. Insiders also shared that Sony asked employees to turn off their computers and disable WIFI on their mobile devices.

But Sony’s business cannot be sustained with their corporate systems down. What does Sony need to do to remediate this breach? The examples of stolen content show that SSH keys were stolen, including SSH keys to the ADP payroll system. But Sony should not stop with the private keys shared by attackers. Like with Heartbleed, Sony must assume that all keys and certificates were compromised.

Until incident response teams fully remediate keys and certificates, adversaries retain unauthorized access and the ability to execute spoofing and MITM attacks. Remediation requires not only that servers, virtual machines, and network segments be brought back to a known good state, but also that new keys be generated and then certificates be re-issued, installed, and validated, and old ones revoked.

Furthermore, if Sony fails to remediate their keys and certificates, the bad guys can exploit this to undermine other security controls, from strong authentication to privileged access to behavioral analysis. When attackers have the trusted status of valid keys and certificates, they can authenticate and cloak their malicious activities.

Recommended Remediation

If Sony is like most Global 2000 organizations, the IT team is not even aware of all of the digital certificates and cryptographic keys that support trusted communications and authentication in the network. To effectively remediate this type of breach, organizations must know how all keys and certificates are used to establish trust (from SSL and SSH through to POS and mobile devices), where they are located, and who is responsible for them.

Only once a baseline inventory is known can organizations then respond to incidents by replacing keys and certificates. However, most organizations then rely on manual methods that keep organizations vulnerable for extended periods of time. APT operators, from Mask to Crouching Yeti, have been known to exploit stolen keys over periods of up to 7 years.

Remediation that is automated can close doors on attackers in minutes versus days, weeks, or months that it may take organizations to remediate manually. Until keys and certificates are replaced, your network, intellectual property, and customer data is still vulnerable.  Time is of the essence.

Being Prepared

This breach is a problem not just for Sony. Organizations are breached every day but are not aware keys and certificates are being stolen for misuse and do not remediate by changing keys and certificates.

Venafi recommends customers use the Venafi Trust Protection Platform in preparation to respond to increasing incidents of attackers compromising keys and certificates with the following actions:

Securing SSH Keys

1. Determine trusted relationships and map privileged access
   • Detect all SSH keys across all servers, virtual machines, cloud instances, and administrator workstations with Venafi TrustAuthority
   • Understand trust relationships and access with TrustMap reporting
2. Reduce exposure to misuse by rolling SSH keys more often by policy
   • Use TrustAuthority to establish lifetime policies for SSH keys
   • Use TrustForce to automate the replacement of SSH keys
3. Detect possible misuse and remediate automatically
   • Detect all changes to SSH trust relationships with TrustAuthority
   • Automate remediation by removing keys from authorized key lists with TrustForce
4. Respond quickly to incidents by replacing SSH keys
   • Force new keys to be generated
   • Ensure certificates are reissued, installation confirmed, and authorized key lists updated with TrustForce
5. Validate and report on remediation
   • Use the shared reporting services of the Trust Protection Platform to identify progress in reducing risk
   • Turn to the Venafi support team for more information and examples

Securing SSL/TLS Certificates and Keys

1. Establish a baseline of keys and certificates and continuously surveil to detect new ones with Venafi TrustAuthority
   • Scan networks to identify SSL/TLS certificates
   • Use Venafi Aperture portal to establish ownership of keys and certificates
   • Surveil for new keys and certificates continuously with scheduled discoveries
2. Reduce exposure to misuse by limiting key and certificate lifetimes with TrustAuthority and TrustForce
   • Set policy to limit lifetimes for keys and certificate similar to Google’s lifetime policies, which is now down to 3 months
   • Generate and securely distribute new keys and certificates regularly with TrustAuthority
   • Replace keys and certificates automatically using TrustForce
3. Respond quickly to incidents by replacing keys and certificates
   • Force new keys to be generated
   • Ensure certificates are reissued, installation confirmed, and old certificates revoked with TrustForce
4. Validate and report on remediation
   • Use the shared reporting services of the Trust Protection Platform to identify progress in reducing risk
   • Turn to the Venafi support team for more information and examples

Venafi CISO, Tammy Moskites, has prepared guidance’s for CISO and their team on why organizations need to prepare to respond to more incidents involving the compromise and misuse of keys and certificates.

Please contact Venafi support with any questions or for help with remediation.

Additional Resources

• The Mask, Attacks on Trust, and Game Over
  https://www.venafi.com/blog/post/the-mask-attacks-on-trust-and-game-over
• Attack on Trust Threat Bulletin: APT Operators Exploit Heartbleed
  https://www.venafi.com/blog/post/attack-on-trust-threat-bulletin-apt-operators-exploit-heartbleed
• Forrester Research on Closing Gaps in SSH Security
  https://www.venafi.com/offers/forrester-gaps-in-ssh-security-whitepaper
• Gartner on Responding to New SSL Cyber Threats
  https://www.venafi.com/collateral/wp/gartner-responding-to-new-ssl-cybersecurity-threats
• Completing Heartbleed Remediation with Venafi Trust Protection Platform:
  https://www.venafi.com/solutions/heartbleed-vulnerability/remediating-the-heartbleed