The US Cyber Safety Review Board (CSRB) has recently released a comprehensive report shedding light on the operations of the notorious extortion-focused hacker collective, Lapsus$. The findings reveal that Lapsus$ exploited basic strategies to sidestep conventional security measures, prompting the CSRB to propose ten concrete recommendations for governmental bodies and industries to enhance cybersecurity measures.
Background and Collaborative Effort
The report, delivered to President Biden by Secretary of Homeland Security, Alejandro N. Mayorkas, is the result of a collaborative effort involving input from over 40 entities. This includes threat intelligence firms, targeted organizations, international law enforcement agencies, and cybersecurity experts. The wide-ranging collaboration ensures a holistic approach to identifying vulnerabilities and proposing effective countermeasures.
Exploitation of basic strategies
One prominent discovery from the report was Lapsus$’s recurrent use of unsophisticated tactics, such as phishing employees and stealing cell phone numbers, which allowed them to gain unauthorized access to organizations and sensitive data. These tactics serve as a reminder that even less advanced techniques can pose a significant threat when not addressed effectively.
Systemic oversight in assessing vulnerabilities
A concerning observation made by the CSRB was the systemic oversight among organizations when assessing the vulnerabilities linked to text message and voice call-based multi-factor authentication (MFA). Such oversights increase the risk of successful hacker attacks and compromise sensitive information. It underscores the need for organizations to reevaluate their existing security measures.
Transition to Secure Authentication Methods
To counter the vulnerabilities associated with traditional multi-factor authentication methods, the CSRB advocates for an immediate transition to more secure, passwordless authentication methods. These methods provide a higher level of security by eliminating common attack vectors used by hackers.
Addressing the primary attack vectors
The CSRB emphasizes the need for organizations, particularly those with substantial resources like Microsoft and Okta, to address the primary attack vectors employed by Lapsus$. These include SIM swap attacks and phishing employees, which can be easily addressed with adequate investment in countermeasures.
Expert Opinion on Countermeasures
Rosa Smothers, a former CIA cyber threat analyst and current KnowBe4 executive, highlights the basic techniques used by Lapsus$ and suggests possible solutions. Smothers states, “Hardware authentication requires in-person direct engagement, preventing remote, phone-based attacks. Training employees to spot and report social engineering attempts like phishing should be the basis of any company’s security awareness training program.” It is crucial for organizations to focus on educating their employees and implementing robust authentication protocols.
Recommendations for cell phone carriers
As cell phones are often targeted by hackers for SIM swap attacks, the CSRB suggests that cell phone carriers enhance customer security through stringent authentication procedures. Implementing stricter verification processes can significantly reduce the risk of unauthorized access by malicious actors.
Standardized guidelines from the FCC and FTC
The CSRB’s report calls upon regulatory bodies like the Federal Communications Commission (FCC) and the Federal Trade Commission (FTC) to establish standardized guidelines for thwarting SIM-swapping attacks. Providing comprehensive guidelines will aid organizations in implementing effective measures to prevent these types of attacks and protect their customers’ personal information.
The CSRB’s report sheds light on the operations of the Lapsus$ hacker collective and highlights the need for immediate action to strengthen cybersecurity measures. The concrete recommendations put forth by the CSRB provide a roadmap for governmental bodies and industries to enhance their security posture. By transitioning to more secure authentication methods, addressing primary attack vectors, and involving cell phone carriers and regulatory bodies, organizations can effectively mitigate the risks posed by hacker collectives like Lapsus$.
With coordinated efforts and robust implementation of these recommendations, industries and governmental bodies can fortify their cybersecurity infrastructure, safeguard sensitive data, and stay one step ahead of evolving hacker tactics. The CSRB’s report serves as a wake-up call, urging all stakeholders to prioritize cybersecurity and take proactive steps to effectively protect crucial assets. By doing so, organizations will be better equipped to navigate the ever-evolving threat landscape and ensure a safer digital environment for all.