Cloud Hopper:ゼロトラストの視点

Cloud Hopper, the hacking campaign suspected to be orchestrated by government-sponsored Chinese operatives (affectionately known as "APT10”), ran from 2014 through at least 2017, and impacted multiple Western companies in a range of industries. This specific collection of cyber espionage was so significant that it continued to attract attention in both the security and business media due to the scale of the operation, the range of organisations targeted, the type of information harvested, and – most significantly – the very nature of the initial breach. Cloud Hopper achieved its now well-known name due to the attackers’ compromise of the victims’ managed service providers (MSP), leveraging these to "hop" from the MSPs’ "cloud" to the target enterprises’ networks.

There have been many excellent summaries and detailed write-ups of the breach, such as the in-depth Operation Cloud Hopper report from PWC, which provides a deep analysis of the breach. Rather than repeating the same information here, we will look at Cloud Hopper from the perspective of a Zero Trust framework, and specifically into how adopting this type of approach to security could have reduced the effectiveness of the attackers.

Forrester Researchは、約10年前にゼロトラストを初めて導入し、「信頼するが検証する」というセキュリティの姿勢から、「何も信頼せず、すべてを監視し、最小限の権限」のアプローチへの移行を提唱しました。この移行は、多くの資産のグループを保護するために大規模な境界に依存することから、すべての資産をターゲットとみなす境界への移行であり、企業を攻撃に対してより脆弱にする固有の信頼を排除することを目的としています。

The Zero Trust framework extends across seven pillars that, when combined, provide a comprehensive strategy for securing the enterprise. It also provides a useful starting point for analysing why an attack was successful, and understanding which pillar could have helped thwart the attack had it been stronger. As will become apparent, Cloud Hopper was highly successful due to excessive levels of trust, which attackers were able to exploit in a perfect storm of control deficiencies.

The starting point, as with many data breaches, was the compromise of the People pillar. Highly targeted spear phishing attacks leveraged documents tailored to both the sector of the company being targeted. and the job function of the individual receiving the message. This helped ensure the malicious payload was executed, allowing the attacker to gain a foothold into the MSP’s network and obtain the credentials of a victim. Further, if the victims had administrative access, the "barrier to entry" was further reduced. From a Zero Trust perspective, privileged access should be delivered "Just-In-Time" (only for the time period required, and removed once access is no longer needed) based on approved business need from an authorised system.

The next pillar to fall was the Network. The malware performed reconnaissance on the organization’s network, mapping out key assets, establishing persistent footholds, and determining how it could most efficiently reach its intended target. In the case of Cloud Hopper, this meant weaving a path from the initial compromised host (often called the “beachhead”) on the MSP network through to the ultimate target in the client’s environment. Another key network element was the malware’s ability to send information and receive instructions through its Command and Control (CNC or C2) environment on the internet. These two phases – reconnaissance through network traversal and call-home capabilities – will be looked at separately, as they highlight distinct types of failures addressed in the Zero Trust framework’s network security principles.

まずコールホームの部分を取り上げると、このマルウェアはCNCインフラストラクチャと通信できることに大きく依存しており、このアクセスが失敗した場合には自分自身を完全に削除します。マルウェアが最も一般的に配信されるデスクトップ環境では、インターネットアクセスが生産性に不可欠であるため、インターネットにアクセスするためにWebプロキシを使用することがよくあります。組織は、このアクセスの管理方法に細心の注意を払い、承認された認証されたユーザーのみがプロキシにアクセスできるようにし、ユーザーが通常の業務機能を実行できるように、このアクセスが最小レベルであることを確認する必要があります。ただし、これらの制御が適切に実装されているにもかかわらず、攻撃者はドメインを登録し、これらのプロキシ レベルの制御をバイパスするために Web フィルタリング プロバイダーの正当なカテゴリに配置するだけで済みます。このような場合、すべてのWebアクセスのログ記録と監視は必須であり、通常のアクティビティからの逸脱を特定して調査できるように、エンドユーザーの行動分析に結び付けられる必要があります。

Cloud Hopper の成功の本当の鍵は、攻撃者が横方向に移動できることでした。

But the real key to the success of Cloud Hopper was the ability for the attackers to move laterally within each MSP network, with little in the way of restrictions. This allowed them to quickly build a map of available hosts, processes and ports that could be exploited, and determine which might be the most suitable to leverage in the next phase of the attack. To use a military phrase, this is often described as an "island hopping" campaign by cyber professionals. The successful harvesting of privileged user credentials and relatively unrestricted network access allowed the attackers to access systems in a manner that appeared legitimate, using common management protocols, allowing them to fly under the radar. The relatively low-effort network reconnaissance allowed for the easy identification of jump hosts that provided the MSP access into each client’s network, from where the attackers were able to access the real targets of their efforts.

これは、デバイス、ネットワーク、ワークロードのゼロトラストの柱の失敗が融合したものです。 Flat networks – networks with little or no segmentation – are a playground for the adversary and this situation was no exception. The lack of adequate segmentation or monitoring on the MSP’s internal network allowed attackers to move effortlessly, and without detection. Segmentation would have blocked the attackers’ ability to map out the network, identify open paths, or move, except as permitted explicitly by policy. Visibility on all network traffic would have provided insight into the attacker’s movements, possibly triggering an investigation early enough to halt the attack before it found its target data. Key assets such as jump servers (also known as bastion hosts) had connectivity to both the MSP and client networks, but were not adequately secured in terms of either network or user access. Mandating some form of Privileged Access Management for all jump server access would have severely limited the attackers’ ability to penetrate the client networks.

Cloud Hopper攻撃は、複数の主要なセキュリティ制御の失敗を浮き彫りにし、組織が侵害の確率を100%と想定し、侵害を迅速に検出し、その影響を最小限に抑えることができるように環境を設計するアプローチである、セキュリティに対する別のアプローチの必要性を強調しています。高度な攻撃者の活動方法を考えると、最も賢明なアプローチは、すべてが 最小特権の原則 、つまりセキュリティに対するゼロトラストアプローチに基づいて構築されるアプローチです。