Cyber Defense eMagazine February Edition for 2023

This is what happened to Dropbox last month, when a bad actor logged into a corporate GitHub
account following a phishing campaign that imitated a CircleCI (a continuous integration tool)
email and login page.
Interestingly, the fact that Multi-Factor Authentication (MFA) was used to protect the corporate
GitHub perimeter did not stop the attack. MFA has long been advocated as a security must-have,
but several of the most significant breaches of 2022 have demonstrated that attacker techniques
could thwart them.
As a result, we can expect much work to be done to improve MFA implementations in large
enterprise accounts in 2023.
●
Doubling down on MFA
In 2022, multiple high-impact security incidents started with an MFA bypass.
Take the Uber hack, for instance. The threat actor used an Uber contractor’s compromised VPN
credentials to repeatedly attempt to log in, generating an MFA notification each time. Abusing
MFA notifications—also known as "MFA fatigue" attacks—is a spamming technique used to flood
an employee’s phone with notifications until they accept one. It proved to work not only in the
Uber case but also in major breaches at Okta and Cisco this year.
Phishing texts are becoming more and more believable as hackers start to invest more time in
targeting people's phones. It should be noted that not all MFA hacks require social engineering.
as some can also exploit system misconfigurations or zero-days. Anyway, the roadmap is now
clear: as the first line of defense, multi-factor authentication will be a top priority for security teams
in 2023 to catch up with the various malicious techniques that have proven effective.
Extending on this reasoning, we can predict that another trend will be reinforced in 2023: code
security.
●
Source code security, a rising concern
Microsoft, Nvidia, Samsung, or Rockstar would all agree that ensure codebases don’t expose
confidential information, such as API keys, username and password combinations, or personal
identifying information (PII) is fundamental. These companies, and others, have all fallen victim
to source code leaks in 2022 and surely did not expect to see so much sensitive information
exposed: for instance, Samsung’s source code contained as many as 6,695 secrets! Source code
security is now acknowledged as one of the most important failsafe measures to prevent attack
escalations, We will see companies ’threat models continue to be updated accordingly next year.
●
More efforts to measure the software supply chain attack surface
Software supply chain attacks are far from new phenomena, but their frequency is accelerating.
The weaknesses in the software supply chains are numerous and hard to inventory for
Cyber Defense eMagazine – February 2023 Edition 47
Copyright © 2023, Cyber Defense Magazine. All rights reserved worldwide.