Latest / CYBR.Signal / Barracuda ESG Flaw Thoughts

Transcript

Barracuda ESG Flaw Thoughts · CYBR.Signal

• 0:00
  SPEAKER_00: And hello everybody.
• 0:01
  SPEAKER_00: Happy Cyber Sunday.
• 0:02
  SPEAKER_00: My name is Michael Farnum.
• 0:03
  SPEAKER_00: Hope you're doing well.
• 0:05
  SPEAKER_00: Wanted to talk about.
• 0:07
  SPEAKER_00: Well, I usually don't talk about specific like vulnerability stuff, and I'm not going to this time, but it kind of brings up a point, and that's around the Barracuda email security gateway appliance vulnerability that's been popping up.
• 0:19
  SPEAKER_00: So if you don't know about it, go look it up.
• 0:22
  SPEAKER_00: I'm going to include some links with some details on it in this Cyber Sunday.
• 0:26
  SPEAKER_00: But what's interesting about this vulnerability is that Barracuda has come back and has said you need, if you have a hardware appliance, you just need to replace the appliance.
• 0:36
  SPEAKER_00: And essentially what has happened is the group that's going after it, after them with this vulnerability, has managed to, every time they've patched something, done something, they've managed to rework it, maintain persistence to a point where they just can't patch the physical appliance or any of the appliances.
• 0:54
  SPEAKER_00: I mean, it obviously it's easier to replace a virtual appliance than it is a physical appliance.
• 1:00
  SPEAKER_00: But they've just the group, the APT group, has just been able to maintain persistent persistence in those devices.
• 1:06
  SPEAKER_00: And Barracuda's like, look, you just need to replace the device.
• 1:09
  SPEAKER_00: So I'm setting that up because it's interesting.
• 1:13
  SPEAKER_00: It's just brought up some thoughts in my head on how to approach these types of things and what these things can lead to.
• 1:20
  SPEAKER_00: So there's another article that I'm going to include in here, I think it's from Rapid 7 research, where they conclude that they're, at least based on what they're able to find on the internet, there's around 11,000 of those appliances on the internet.
• 1:34
  SPEAKER_00: And 11,000's pretty big number, not massive, but it's it's a pretty big number.
• 1:41
  SPEAKER_00: And the reason there's so many of those is because it is a cheaper device.
• 1:46
  SPEAKER_00: And I'll be honest, I had one way back in the day when we first started worrying about spam filtering back in the early 2000s, uh, when they first came out, and they were an easy device put in.
• 1:58
  SPEAKER_00: There really wasn't a whole lot of other ones.
• 2:00
  SPEAKER_00: Now you've got a whole lot of other devices out there in a lot of companies who've come out, like you know, Proof Point and others, uh Mimecast, to name a few, who started you know being more um heavy ESGs, more feature-rich, better, just better features all the way around.
• 2:19
  SPEAKER_00: But Barracuda maintains its popularity in a lot of ways because it is a cheaper device.
• 2:23
  SPEAKER_00: And you got a lot of companies who need a device like that, need to be able to put it in their network that's a little bit cheaper.
• 2:29
  SPEAKER_00: They don't have to pay the high cost of something like a proof point or a Mimecast, relative high cost compared to you know what they can afford.
• 2:36
  SPEAKER_00: And so they they go that route.
• 2:40
  SPEAKER_00: And what happens is that now it's the age-old story, it's like the old Windows and Mac story.
• 2:45
  SPEAKER_00: You got a proliferation of a certain type of device, and the bad guys are gonna go after that device and look for something.
• 2:53
  SPEAKER_00: You can argue that a device like that, because it's cheaper, maybe there's a little less rigor put in the development process.
• 3:01
  SPEAKER_00: I'm not saying that about Barracuda.
• 3:03
  SPEAKER_00: I'm just saying that's probably there that could be something that's there because you gotta think there are a ton of Prue Point, a ton of Mimecast, other devices out there as well that I've never seen this level where you've got to like replace a device because it's able to get persistence.
• 3:20
  SPEAKER_00: They've all had vulnerabilities.
• 3:22
  SPEAKER_00: So, what it equates to, in my mind, in one way, is almost like IoT vulnerabilities when you've got a ton of cheap cameras or cheap firewalls or routers or whatever's out there, and there hasn't been a ton of rigor put into the development process, and the bad guys find a vulnerability and they're able to do whatever with it.
• 3:43
  SPEAKER_00: Typically, with something like that, though, the difference is that they're using that to do some kind of DDoS attacks or something like that, or you know, just create a botnet.
• 3:53
  SPEAKER_00: Whereas with this one has some very distinct issues that go along with along with it because of the importance of email in those organizations and the the stuff that goes through that and what can be exfiltrated.
• 4:04
  SPEAKER_00: You know, there's a lot of important data that goes through email.
• 4:07
  SPEAKER_00: So that's one thing I was thinking of.
• 4:08
  SPEAKER_00: It's like this this almost equates to a an IoT type style event with a mass vulnerability.
• 4:16
  SPEAKER_00: And second, it makes me think you need to start thinking about how you're approaching this if you are an SMB and you've got a device like this.
• 4:24
  SPEAKER_00: Do you want to keep deploying a device like this in your network?
• 4:27
  SPEAKER_00: Do you want to be the person who is managing it?
• 4:31
  SPEAKER_00: Maybe you've got a managed provider that can help you with that.
• 4:34
  SPEAKER_00: Now, if you've got a managed provider that uses Barracuda as the device, then you're you're kind of in trouble.
• 4:41
  SPEAKER_00: But anyway, it just brought up some some thoughts in my head of how do you need to approach something like this if you're an SMB?
• 4:48
  SPEAKER_00: How do you need to approach this if you are using a uh managed provider?
• 4:53
  SPEAKER_00: How do you need to approach this if you are a managed provider yourself and you're using these type of tools and thinking about maybe if you do have a bunch of physical devices out there that you're doing, maybe switching to virtual devices so it's a heck of a lot easier.
• 5:12
  SPEAKER_00: That's not that hard to do these days to switch to a virtual device.
• 5:16
  SPEAKER_00: I would highly consider that as well.
• 5:18
  SPEAKER_00: So if this happens again, pretty rare event generally, whereas a manufacturer is saying get rid of all of them, but still something you can hedge your bets against.
• 5:26
  SPEAKER_00: So, anyway, let me know what you think.
• 5:28
  SPEAKER_00: Uh, see you next time.