FireEye Breach Fallout Yet to Be Felt

Aftermath of the FireEye breach by Russias foreign service agency raises concerns over what the attackers could do next - and how to defend against it.

FireEyes
revelation earlier this week
that it had been infiltrated by a nation-state hacking operation that stole its red-team hacking tools served as a chilling reminder to the security industry that no one is impermeable to an attack — not even a major incident response company more accustomed to probing and cleaning up the breaches of other high-profile organizations.
Several reports and sources say Russias SVR foreign service agency, aka APT 29 or Cozy Bear, was the perpetrator. There are still plenty of unknowns about the attack: how the attackers got initial access to FireEyes systems, what defenses they bypassed and how, whether any Windows zero-days were used, and just what if any internal information they accessed on what
FireEye CEO Kevin Mandia described
as their ultimate target: certain government customers of the company.
While FireEye attempted to defang the attackers ability to use its tools in attacks by publishing
detailed mitigations
, experts say APT29/Cozy Bear could use the purloined red-team tools to glean intel on its clients weaknesses or even as a means to cause confusion and sow distrust — trademarks of Russian intelligence — of FireEye and the tools themselves, experts say.
Theres also a risk of organizations that are not tuned into the FireEye breach mistaking Russian intel-controlled red-team maneuvers as legitimate FireEye red-team activity, for example, notes Steve Ryan, former deputy director of the National Security Agencys Threat Operations Center, and now CEO and co-founder of security startup Trinity Cyber.
That puts everything into question. Thats Russias game, he says. Sowing distrust on their [FireEyes] name and the concept of red teaming, he says, is another potential way they could inflict pain if concerns rise over FireEyes exposure.
Then theres the risk of the weaponization of those tools: if these tools can be turned in a way to cause damage in some way and have it put back to FireEye, or succeed [in attacks] because it looks like a FireEye tool, Ryan says.
Theres also an intel-gathering opportunity for the attackers with the stolen tools. Sounil Yu, CISO-in-residence at VC firm YL Ventures, says there is the possibility that the attackers could glean some intel about the FireEye clients whose networks have been probed by FireEye in red-team exercises. Theyre [FireEye] going to have tools that work on those government agencies who hire them for red teaming, he says.
The presumption [is] that these tools are effective against the targets, he says. This [information] gives them [the attackers] an opportunity to target more efficiently now, he says.
Dmitri Alperovitch, former CTO and co-founder of CrowdStrike, says he believes the red-team tool theft likely wasnt part of the original plan by the attackers. I actually think the red-team tools were probably an opportunistic grab: While were there, we might as well download them.
He says its not surprising that the Russian SVR would employ previously unseen, novel attack methods and tactics for the FireEye attack operation. The infrastructure they set up for this attack was done exclusively for [targeting] FireEye, he says. SVR is very good — they are one of the best in Russian intel and theyre always very stealthy. In this particular case, they have a very high-profile target, a very hard target, and to succeed ... they need to bring in their A game.
The specifics of the methods used in the attack remains a key missing piece that Alperovitch and other security experts hope FireEye eventually will reveal publicly.
I hope they would share them, Alperovitch says, adding that FireEyes mitigation disclosure was important too. They [FireEye] deserve a lot of credit for the mitigations for the stolen tools. ... That was a very good step.
FireEyes Mandia indeed has gotten plenty of props from security experts, even those from rival companies, for his relatively detailed disclosure of the attack. What was really cool is they not only published the red-team tools the Russians stole, but the countermeasures of those tools, Trinity Cybers Ryan says. That wasnt the case with the NSAs tool breach, he notes. Everybody was kind of on their own to defend against attacks using them, including the infamous EternalBlue exploit.
Its still unclear whether APT29 accessed any sensitive product information or FireEye intel on other threat actors. YL Ventures Yu says access to FireEyes product suites could allow APT29 to find ways to bypass the technology, for example. And FireEye spends a lot of time gathering information and tactics of other threat actor groups. That would be like a playbook of all of your competitors for the attackers, he says.
Any security company is a big target of determined attackers. Security companies are always one of top targets because of how much information they have and how much access they have to customer networks. Obviously, the ability to get into a security vendor can give you insight into the countermeasures they have, and [then] you can evade them to break into their customers networks, Alperovitch says.
For its part, FireEye says it currently cannot provide any additional information about the attack beyond Mandias disclosure post.
Were actively investigating this incident with our partners at Microsoft and coordinating with the FBI. Please know that there may be some delay in our ability to share that information, as we do not want to do anything to interfere with the ability of the FBI to conduct its separate, ongoing investigation, a FireEye spokesperson said. We want to be absolutely certain we obtain all the evidence available to us to further advance this case, and some disclosures at this point would jeopardize that collection.
Not the First
FireEye isnt alone. Several security companies have been breached over the past 10 years, including Bit9 (now part of VMware), Kaspersky, McAfee, RSA, and Symantec.
Every security company now is hopefully on notice and thinking hard about how to protect themselves and how to be watchful. How you respond is indicative of how good you are, Alperovitch says.
Enterprise organizations, especially FireEye customers, should apply the mitigations FireEye released, as well as ensure theyve applied security patches. Then theres the possibility of an upcoming Microsoft patch if indeed there was a zero-day involved, experts say.
The fact that Microsoft is involved indicates the attack could have employed a previously unknown Windows vulnerability, notes Peter Firstbrook, vice president of research at Gartner. I suspect were going to find out there was a zero-day.

Last News
▸ Researchers create BlackForest to gather, link threat data. ◂ Discovered: 23/12/2024 Category: security	▸ Travel agency fined £150,000 for breaking Data Protection Act. ◂ Discovered: 23/12/2024 Category: security	▸ 7 arrested, 3 more charged in StubHub cyber fraud ring. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
FireEye Breach Fallout Yet to Be Felt