CMNatic's Bot

56% of UK Businesses Plan to Hire a CISO

More than half (56%) of UK businesses plan to employ a chief information security officer (CISO) in the next 6-24 months to help protect them from surging cyber-attacks. This is according to a survey of 251 information security and IT professionals across 250 UK companies conducted by cloud provider Fastly.

The study revealed that only a quarter of businesses currently have a CISO, although there is significant variation across different industries. For example, 75% of organizations in the construction/engineering sector employ a CISO, followed by local/national government (60%) and aerospace (50%).

There was also a lack of clarity regarding the role and purpose of CISOs within organizations. For example, nearly a third (31%) of respondents believe CISOs should have an in-depth understanding of all areas of IT. Additionally, 23% said CISOs are stretched too thinly, 22% believe they are overworked, and 19% feel they are not good enough value for money.

Worryingly, a quarter claimed that CISOs are often blamed for things that aren’t their fault.

The respondents were also asked what they believed would be the security issues that would be costliest for UK businesses over the next five years. Of most concern were malware-based attacks (31%), followed by denial of service attacks (26%), attacks targeting known vulnerabilities (25%), attacks targeting unknown vulnerabilities (24%) and attacks exploiting the misconfiguration of an associated cloud service (24%).

As well as the growing interest in employing CISOs, 21% of businesses want to invest further in cybersecurity professionals and 18% expressed the need to address the impact of remote working on company and employee security moving forward.

Sean Leach, chief product architect at Fastly, commented: “Hiring a CISO is a crucial step in tackling the security threats facing organizations. However, they need to ensure this isn’t just a box-ticking exercise and that they fully embed their CISO into the organization. This will come from a joint investment in both dedicated personnel, with clear and defined roles, paired with robust and adequate security tools.”

“These findings show that, while businesses are beginning to understand how growing their digital offering will increase potential threats they still need to increase the security offerings that protect those technologies, otherwise the results can be catastrophic.”

Most Computer Code Compilers Vulnerable to Novel Attacks

Most computer code compilers are at risk of ‘Trojan source’ attacks in which adversaries can introduce targeted vulnerabilities into any software without being detected, according to researchers from the University of Cambridge.

The paper, Trojan Source: Invisible Vulnerabilities, detailed how weaknesses in text encoding standards such as Unicode can be exploited “to produce source code whose tokens are logically encoded in a different order from the one they are displayed.” This leads to very difficult vulnerabilities for human code reviewers to detect, as the rendered source code looks perfectly acceptable.

Specifically, the weakness was observed in Unicode’s bi-directional (Bidi) algorithm, which handles displaying text that includes mixed scripts with different display orders, such as Arabic – which is read right to left – and English (left to right). Unicode currently defines more than 143,000 characters across 154 different language scripts.

The researchers noted that in some cases, Bidi override control characters enable switching the display ordering of groups of characters. 

Most programming languages allow these Bidi overrides to be put in comments and strings, which developers largely ignore. This enables targeted vulnerabilities to be inserted into source code without detection.

The authors Nicholas Boucher and Ross Anderson explained: “Therefore, by placing Bidi override characters exclusively within comments and strings, we can smuggle them into source code in a manner that most compilers will accept. Our key insight is that we can reorder source code characters in such a way that the resulting display order also represents syntactically valid source code.”

“Bringing all this together, we arrive at a novel supply-chain attack on source code. By injecting Unicode Bidi override characters into comments and strings, an adversary can produce syntactically-valid source code in most modern languages for which the display order of characters presents logic that diverges from the real logic. In effect, we anagram program A into program B.”

The researchers added that Bidi overrides characters through the copy-and-paste functions on most modern browsers, editors and operating systems. Therefore, “any developer who copies code from an untrusted source into a protected code base may inadvertently introduce an invisible vulnerability.”

While there is currently no evidence that threat actors have utilized these types of attacks, the authors warned of the need for new security controls to counter this danger. They stated: “As powerful supply-chain attacks can be launched easily using these techniques, it is essential for organizations that participate in a software supply chain to implement defenses.

“We have discussed countermeasures that can be used at a variety of levels in the software development toolchain: the language specification, the compiler, the text editor, the code repository, and the build pipeline. We are of the view that the long-term solution to the problem will be deployed in compilers.”

Commenting on the research, Tim Mackey, principal security strategist at the Synopsys CyRC, said: “We’ve seen a variety of novel attacks on software supply chains in 2021, and this is another example of how the trust placed in development processes can be exploited. Teams intrinsically trust their developers, but developers are human and even the best developers can’t be expected to know all the nuances of how code libraries function. 

"When in doubt, they’ll search the internet for examples. Those examples might just be exactly what’s needed to solve the problem, with a result of the found code being copied into the application. While legal teams have been concerned about the potential licensing liability surrounding copied code, an attack using Unicode bidi overrides should concern security teams since that perfect code might only look perfect to the human eye, but instead contain code representing the launch point for an attack that will ultimately be distributed by the application owner.”

#WebSummit2021: Facebook Whistleblower Denounces Meta Rebrand and Calls for Zuckerberg to Step Down

Facebook prioritizes profits over user safety, according to whistleblower and former Facebook employee Frances Haugen. She took to the stage at the opening ceremony of Web Summit – her first public address since leaking a collection of damaging Facebook documents – to denounce the social media company’s decisions and ethics.

The interview, led by Laurie Segall, founder and CEO of Dot Dot Media, delved into the motivation behind Haugen’s decision to leave Facebook and expose the social media company’s practices and priorities by leaking internal documents.

“I’m glad I had the opportunity to bring this to life as there has been a pattern of behavior where Facebook has consistently prioritized their profits over our safety,” said Haugen. “Facebook’s content algorithm amplifies the most extreme, polarizing and divisive content.”

Haugen compares this to the three social media companies she worked for before Facebook. “It became evident to me that things were substantially worse [at Facebook] than anything else I’d seen.” She suggests that this perhaps gave her the foundation of comparison and the confidence to speak out when other employees did not.

Facebook, Haugen said, tries to reduce the user’s choice down to a false choice: “They try to frame it as ‘do you want censorship?’ or ‘do you want free speech?’… Transparency or privacy. It’s a false choice.” However, she countered, “non content-based solutions exist and are effective to make Facebook safer. Bad people and bad ideas is not the problem; it’s the question of who gets the largest megaphone.”

"Facebook has consistently prioritized their profits over our safety"Haugen

Facebook is reliant on huge groups, with millions of members, “and it ties their hands with those groups because in order to get three pieces of content from that group each day, the algorithm has to work out which three pieces of content to put on your feeds.” Right now, she explains, the most extreme and polarizing content makes the cut.

“One of the things that Facebook has that is different than Twitter, is that at Twitter, the branch that makes decisions about safe content and safety on the platform reports through a different chain to the chain that is responsible for making politicians happy. At Facebook, those organizations report to the same people.

Segall’s presented Haugen with Facebook’s accusation that she “cherry picked the documents, taken out of context, to paint a particularly negative picture of the social media giant. Haugen responded: “There is a really easy solution – I could just release more documents.”

“There are major tech companies, like Google and Twitter that are substantially more transparent than Facebook,” said Haugen. “They have a fire hose. But things that make it onto Facebook get caught by the Twitter fire hose, and that’s a red flag.”

Haugen refers to advice given to her by her mother: “Every human being deserves the dignity of knowing the truth. I truly believe that our society also deserves the truth, so we can make decisions for the public good.”

Haugen was also questioned on whether Mark Zuckerberg, Facebook’s CEO, should remain at the helm. "Facebook would be stronger with someone who was willing to focus on safety,” she considered. “I think it is unlikely the company will change if [Zuckerberg] remains the CEO." Loud applause from the Web Summit audience of 40,000 rewarded this opinion.

Asked about her opinion on the social media company’s recent rebrand – last week Facebook announced it is changing its name to Meta to focus on building the “metaverse” – Haugen was both cynical and critical. “Instead of investing in making people safe, [Facebook] is investing that money in video games instead, and I can’t imagine how that makes sense.” The rebrand, she concluded, makes no sense given the security issues that are yet to be tackled.

Cyber-Incident at South Carolina School District

A school district in South Carolina is investigating a "cyber-incident" that it says impacted hundreds of staff computers.

On October 4, some of the networks of Colleton County School District stopped operating. The unusual activity was detected by the district's information technology staff, who determined that a cybersecurity incident had occurred.

Speaking at the time of the security event, Colleton County School District coordinator of communications Sean Gruber said that because “communication remains intact for the community at large,” student instruction had not been interrupted.

“The district IT staff immediately began investigation and recovery measures and contacted a professional Incident Response and Recovery team to assist,” said Gruber.

The precise nature of the incident has not been made public, but the district has said that no physical security measures in place at Colleton County schools were affected and district facilities remain secure.

On Wednesday, the Colleton County School Board voted unanimously at a special meeting to spend nearly $200K on keeping three cybersecurity companies on the payroll to manage the district's recovery from the incident. 

The board said that approximately 800 computers used by teaching and administrative staff were involved in the incident. The services of a network engineer and a forensics engineer were required to sanitize the machines. 

Dell Support Services, Red Cloak, and Carbon Black will continue to be retained at the cost of $190,520 to carry out approximately 480 hours of work to fix the issue.

The school board said that the recovery efforts will involve working with the district's Active Directory and "shoring up its firewall." 

The vote took place on October 27, eight days after the school board sought legal advice on how to respond to the incident. 

According to a report by Count on News 2, on October 27, the district was still working on "sanitization" efforts and the district networks had not yet returned to normal operations. 

The school board has not added a notice about the cybersecurity incident to its website. The incident is being reported by Live 5 News as a cyber-attack. 

California Health Network Reports Data Breach

Cyber-criminals may have accessed the protected health information (PHI) of hundreds of thousands of patients of a network of community health centers based in California.

Nonprofit Community Medical Centers (CMC), which is headquartered in the city of Stockton, primarily serves low-income patients, migrants, and homeless people in the Northern California counties of San Joaquin, Solano, and Yolo. 

In a statement issued on October 15, CMC said that "some unusual network activity" had been detected "early on Sunday, October 10."

As a precaution, the agency shut down its entire network, including its servers, computers, and some phone lines that patients had been using to access their medical records, make appointments, and receive information relating to COVID-19.

"We know how hard this is on our patients," said Preethi Raghu, chief operating officer at Community Medical Centers. "We are doing everything in our power to continue patient care and restore our systems." 

CMC launched an investigation into the unusual network activity with the help of third-party experts in cybersecurity. An examination of the digital forensic evidence determined that unauthorized individuals had gained access to parts of its network in which patients' protected health information was stored.

Data that may have been obtained by the hackers includes medical information, first and last names, mailing addresses, dates of birth, demographic information and Social Security numbers.

A breach report filed with the Maine attorney general states that the protected health information of 656,047 individuals was potentially compromised in the incident, 8 of whom are Maine residents. 

"Please understand that this situation is fluid, and we will continue to work with law enforcement and cybersecurity experts to assess the full scope and nature of the incident, as well as to fix the situation," said CMC in a statement that was updated on October 27. 

CMC did not say whether their investigation had discovered evidence of a ransomware attack. 

Individuals affected by the security breach are being offered complimentary identity theft protection, identity theft resolution, and credit monitoring services. 

"We continue to make progress on restoring all systems safely and returning to normal operations," said CMC. 

"We have also taken steps to improve our network security to further secure sensitive data and prevent any misuse of patient information.”

Venmo to Reimburse Hacking Victims

Mobile payment service Venmo has come to the aid of a couple from Florida whose entire bank account was emptied by hackers.

Cyber-thieves stole $19,500 from retired husband and wife Alan and Aviva Sturm earlier this year. The hackers gained access to the couple's Bank of America bank accounts by creating a fraudulent Venmo account.

The hackers reportedly stole the funds from the Sturms' bank account through a series of illegal transfers that began in March and carried on until June. The sum of $1,500 was taken every week until every cent of the couple's savings was gone.

The couple from Boynton Beach discovered the theft when their rent payment bounced.  They contacted Bank of America and the Palm Beach County Sheriff's Office but were unable to recover any of the money.

Aviva told local news source WDSU that before the theft occurred, they hadn't heard of Venmo and had no idea what it was. 

"We're going around asking people if they've ever heard of Venmo, and a lot of people have, but we've never heard of it," she said.

Because of the change in their financial circumstances, Alan and Aviva, who both have heart problems, had to cancel their secondary medical insurance and downsize their accommodations at an assisted living facility to a one-bedroom apartment.  

Alan, who is 74, said: "It was just a matter of time until we ended up in the street."

Bank of America told the Sturms that it couldn't return any of the stolen money because it had been told by Venmo that the couple had authorized the transfers. 

Venmo, which is owned by PayPal, said that the company will reimburse the Sturms for the whole amount stolen. An investigation into how the hackers were able to create a fake account and get the fraudulent transfers authorized is ongoing. 

A spokesperson for Venmo said: “When we were contacted about the situation, we worked quickly to investigate the matter and assist our customers. We take every instance of potential fraud very seriously, and the company works diligently to support and protect our customers.”

Context is king, it makes all the difference. You may see something run in EDR telemetry, or in logs, but the context of when it ran in relation to other activities is often critical. Did it occur immediately following a system reboot or a user login? Does it occur repeatedly? Does it occur on other systems? Did it occur in rapid succession with other commands, indicating that perhaps it was scripted? The how and when of the context then leads to attribution.

Andy Piazza brings the same thoughts to CTI in his article, "CTI is Better Served with Context".

Automation can be a wonderful thing, if you use it, and use it to your advantage. The bad guys do it all the time. Automation means you don't have to remember steps (because you will forget), and it drives consistency and efficiency. Even at the micro-level, at the level of the individual analyst's desktop, automation means that data sources can be parsed, enriched, decorated and presented to the analyst, getting them to analysis faster. Admit it...parsing all of the data sources you have access to, the way you're doing it now, is terribly inefficient and error-prone. Imagine if you could use the system, the CPU, to do that for you, and have pivot points identified when you access the data, rather than having to discover them for yourself. Those pivot points could be based on your own individual experience, but what if it were based on the sum total experience of all analysts on the team, including analysts who were on the team previously, but are no longer available?

Understand and use the terminology of your industry. All industries have their own common terminology because if facilitates communications, as well as identifying outsiders. Doctors, lawyers, Marines all have terms and phrases that mean something very specific to the group or "tribe". Learn what those are for your industry or community, understand them and use them.  

Not all things are what we think they are...this is why we need to validate what we think are "findings", but are really assumptions. Take Windows upgrades vs. updates...an analyst may believe that a lack of Windows Event Logs is the result of an upgrade when they (a) do not have Windows Event Log records that extend back to the time in question, and (b) see that there was a great deal of file system and Registry activity associated with an update, "near" that time. Most often the lack of Windows Event Logs is assumed to be the threat actor "covering" their tracks, and this assumption will often persist despite the lack of evidence pointing to this activity (i.e., batch files or EDR telemetry illustrating the necessary command, specific event IDs, etc.). The next step, in the face of specific event IDs "missing", is to assume that the update caused the "data loss", without realizing the implication of that statement...that a Windows update would lead to data loss. How often do we see these assumptions, when the real reason for a dearth of Windows Event Logs covering a specific time frame is simply the passage of time?

BlackMatter Group Speeds Up Data Theft with New Tool

Security researchers have discovered a new data exfiltration tool designed to accelerate information theft for ransomware groups using the BlackMatter variant.

The Symantec Threat Hunter team explained in a new blog post today that the custom tool is the third discovery of its kind, following the development of the Ryuk Stealer tool and the LockBit-linked StealBit.

Dubbed “Exmatter,” it is designed to steal specific file types from selected directories and then upload them to a server under the control of BlackMatter attackers.

This process of whittling down data sources to only those deemed most profitable or business-critical is designed to speed up the whole exfiltration process, presumably so the threat actors can complete their attack stages before being interrupted.

After retrieving the drive names of all logical drives on a victim computer and collecting all file pathnames, Exmatter disregards anything under specific directories such as “C:\Documents and Settings.”

It only exfiltrates specific file types such as PDFs, Word docs, spreadsheets and PowerPoints, and aims to prioritize those for exfiltration using LastWriteTime.

Once exfiltration has been completed, Exmatter looks to overwrite and delete any traces of itself from the victim’s computer.

Symantec said it found various versions of the tool, indicating that its developers have tried to refine its functionality to accelerate the process of data theft as far as possible.

The researchers claimed BlackMatter itself is linked to the “Coreid” cybercrime group, which may have also been responsible for Darkside — the variant that led to the Colonial Pipeline outage.

However, it’s unclear whether Exmatter was developed by this group or one of the many affiliates who use BlackMatter in attacks.

“Like most ransomware actors, attacks linked to Coreid steal victims’ data and the group then threatens to publish it to further pressure victims into paying the ransom demand,” Symantec concluded.

“Whether Exmatter is the creation of Coreid itself or one of its affiliates remains to be seen, but its development suggests that data theft and extortion continues to be a core focus of the group.”

The US authorities issued an alert on BlackMatter in mid-October, after it began to target critical infrastructure providers. One vendor claims it may still help victims of the ransomware variant after finding a bug in its code.

Conti Group Leak Celebs' Data After Ransom Attack on Jeweller

Data on countless celebrities, politicians and heads of state appear to be in the hands of ransomware actors after a group using the Conti variant compromised a high-end jeweler over the weekend.

London-based Graff, which sells diamond jewelry to the super-rich, confirmed the news in a statement sent to Sky News.

“Regrettably we, in common with a number of other businesses, have recently been the target of a sophisticated – though limited – cyber-attack by professional and determined criminals,” it read.

“We were alerted to their intrusive activity by our security systems, allowing us to react swiftly and shut down our network. We notified, and have been working with, the relevant law enforcement agencies and the ICO.”

The group reportedly released tens of thousands of documents, including customer invoices and receipts, on its dark web leak site. Although there’s said to be plenty more in reserve, used as leverage to force a ransom payment, the data currently exposed is not thought to be a serious privacy risk to the victims.

What's more, researchers at Digital Shadows confirmed to Infosecurity that, when they checked, there was no mention of the breach on the Conti site.

“Although unconfirmed it is possible either that Graff has paid the ransom, or is currently in negotiations with the ransomware group," the firm noted.

Big names from Hollywood, sport and business were reportedly impacted, including former footballers David Beckham and Frank Lampard, Donald Trump, Hollywood actors Alec Baldwin and Samuel L Jackson, and retail boss Philip Green.

“We have informed those individuals whose personal data was affected and have advised them on the appropriate steps to take,” the Graff statement concluded.

According to an analysis from Group-IB, Conti attacks accounted for 15% of the total last year. The group, which only appeared on the ransomware scene in 2020, is known for issuing high ransom demands to organizations it thinks can pay.

In April this year, one attack on a Florida school district led to a $40m demand.

In September, an alert posted by US security agencies warned that Conti had been used in more than 400 attacks globally

Euro Police Swoop on 12 Suspected Ransomware Gang Members

Twelve threat actors were singled out by Europol last week in a major ransomware operation targeting multiple organized crime groups.

The unnamed suspected are believed to have been involved in deploying the LockerGoga, MegaCortex and Dharma variants or laundering the proceeds, the trans-national policing group claimed.

Focusing their efforts mainly on large organizations, the suspects impacted over 1800 victims in 71 countries, it added.

Individual players had specific roles, such as: gaining initial network access via phishing or brute-forcing credentials and SQL injection; lateral movement using Trickbot, Cobalt Strike or PowerShell Empire; and sending ransom demands for Bitcoin payment.

A joint investigation team (JIT) was first set up to tackle the threat in September 2019 – comprising police in Norway, France, the UK and Ukraine.

Last Wednesday, an action day in Ukraine and Switzerland led to the seizure of over $52,000 in cash, five luxury vehicles, and several electronic devices. However, it’s not clear whether the 12 have been arrested or charged.

Europol would only say that they are “high-value targets” under investigation in multiple high-profile cases in different jurisdictions.

Police from Norway, France, the Netherlands, UK, Ukraine, Germany, Switzerland and the US took part last week, alongside Europol and Eurojust.

More than 50 investigators were present, while a Ukrainian cyber specialist was seconded to Europol for two months to prepare for the action day.

According to SonicWall data released last week, the number of ransomware attacks in the first three quarters of 2021 surged 148% year-on-year to reach 470 million.

That makes 2021 already the worst year on record for attacks, the vendor claimed. Q3 2021 alone saw SonicWall customers hit with 190.4 million attempts, nearly as much as the total for 2020: 195.6 million.

Virtually all compilers — programs that transform human-readable source code into computer-executable machine code — are vulnerable to an insidious attack in which an adversary can introduce targeted vulnerabilities into any software without being detected, new research released today warns. The vulnerability disclosure was coordinated with multiple organizations, some of whom are now releasing updates to address the security weakness.

Researchers with the University of Cambridge discovered a bug that affects most computer code compilers and many software development environments. At issue is a component of the digital text encoding standard Unicode, which allows computers to exchange information regardless of the language used. Unicode currently defines more than 143,000 characters across 154 different language scripts (in addition to many non-script character sets, such as emojis).

Specifically, the weakness involves Unicode’s bi-directional or “Bidi” algorithm, which handles displaying text that includes mixed scripts with different display orders, such as Arabic — which is read right to left — and English (left to right).

But computer systems need to have a deterministic way of resolving conflicting directionality in text. Enter the “Bidi override,” which can be used to make left-to-right text read right-to-left, and vice versa.

“In some scenarios, the default ordering set by the Bidi Algorithm may not be sufficient,” the Cambridge researchers wrote. “For these cases, Bidi override control characters enable switching the display ordering of groups of characters.”

Bidi overrides enable even single-script characters to be displayed in an order different from their logical encoding. As the researchers point out, this fact has previously been exploited to disguise the file extensions of malware disseminated via email.

Here’s the problem: Most programming languages let you put these Bidi overrides in comments and strings. This is bad because most programming languages allow comments within which all text — including control characters — is ignored by compilers and interpreters. Also, it’s bad because most programming languages allow string literals that may contain arbitrary characters, including control characters.

“So you can use them in source code that appears innocuous to a human reviewer [that] can actually do something nasty,” said Ross Anderson, a professor of computer security at Cambridge and co-author of the research. “That’s bad news for projects like Linux and Webkit that accept contributions from random people, subject them to manual review, then incorporate them into critical code. This vulnerability is, as far as I know, the first one to affect almost everything.”

The research paper, which dubbed the vulnerability “Trojan Source,” notes that while both comments and strings will have syntax-specific semantics indicating their start and end, these bounds are not respected by Bidi overrides. From the paper:

“Therefore, by placing Bidi override characters exclusively within comments and strings, we can smuggle them into source code in a manner that most compilers will accept. Our key insight is that we can reorder source code characters in such a way that the resulting display order also represents syntactically valid source code.”

“Bringing all this together, we arrive at a novel supply-chain attack on source code. By injecting Unicode Bidi override characters into comments and strings, an adversary can produce syntactically-valid source code in most modern languages for which the display order of characters presents logic that diverges from the real logic. In effect, we anagram program A into program B.”

Anderson said such an attack could be challenging for a human code reviewer to detect, as the rendered source code looks perfectly acceptable.

“If the change in logic is subtle enough to go undetected in subsequent testing, an adversary could introduce targeted vulnerabilities without being detected,” he said.

Equally concerning is that Bidi override characters persist through the copy-and-paste functions on most modern browsers, editors, and operating systems.

“Any developer who copies code from an untrusted source into a protected code base may inadvertently introduce an invisible vulnerability,” Anderson told KrebsOnSecurity. “Such code copying is a significant source of real-world security exploits.”

Image: XKCD.com/2347/

Matthew Green, an associate professor at the Johns Hopkins Information Security Institute, said the Cambridge research clearly shows that most compilers can be tricked with Unicode into processing code in a different way than a reader would expect it to be processed.

“Before reading this paper, the idea that Unicode could be exploited in some way wouldn’t have surprised me,” Green told KrebsOnSecurity. “What does surprise me is how many compilers will happily parse Unicode without any defenses, and how effective their right-to-left encoding technique is at sneaking code into codebases. That’s a really clever trick I didn’t even know was possible. Yikes.”

Green said the good news is that the researchers conducted a widespread vulnerability scan, but were unable to find evidence that anyone was exploiting this. Yet.

“The bad news is that there were no defenses to it, and now that people know about it they might start exploiting it,” Green said. “Hopefully compiler and code editor developers will patch this quickly! But since some people don’t update their development tools regularly there will be some risk for a while at least.”

Nicholas Weaver, a lecturer at the computer science department at University of California, Berkeley, said the Cambridge research presents “a very simple, elegant set of attacks that could make supply chain attacks much, much worse.”

“It is already hard for humans to tell ‘this is OK’ from ‘this is evil’ in source code,” Weaver said. “With this attack, you can use the shift in directionality to change how things render with comments and strings so that, for example ‘This is okay” is how it renders, but ‘This is’ okay is how it exists in the code. This fortunately has a very easy signature to scan for, so compilers can [detect] it if they encounter it in the future.”

The latter half of the Cambridge paper is a fascinating case study on the complexities of orchestrating vulnerability disclosure with so many affected programming languages and software firms. The researchers said they offered a 99-day embargo period following their initial disclosure to allow affected products to be repaired with software updates.

“We met a variety of responses ranging from patching commitments and bug bounties to quick dismissal and references to legal policies,” the researchers wrote. “Of the nineteen software suppliers with whom we engaged, seven used an outsourced platform for receiving vulnerability disclosures, six had dedicated web portals for vulnerability disclosures, four accepted disclosures via PGP-encrypted email, and two accepted disclosures only via non-PGP email. They all confirmed receipt of our disclosure, and ultimately nine of them committed to releasing a patch.”

Eleven of the recipients had bug bounty programs offering payment for vulnerability disclosures. But of these, only five paid bounties, with an average payment of $2,246 and a range of $4,475, the researchers reported.

Anderson said so far about half of the organizations maintaining the affected computer programming languages contacted have promised patches. Others are dragging their feet.

“We’ll monitor their deployment over the next few days,” Anderson said. “We also expect action from Github, Gitlab and Atlassian, so their tools should detect attacks on code in languages that still lack bidi character filtering.”

As for what needs to be done about Trojan Source, the researchers urge governments and firms that rely on critical software to identify their suppliers’ posture, exert pressure on them to implement adequate defenses, and ensure that any gaps are covered by controls elsewhere in their toolchain.

“The fact that the Trojan Source vulnerability affects almost all computer languages makes it a rare opportunity for a system-wide and ecologically valid cross-platform and cross-vendor comparison of responses,” the paper concludes. “As powerful supply-chain attacks can be launched easily using these techniques, it is essential for organizations that participate in a software supply chain to implement defenses.”

Weaver called the research “really good work at stopping something before it becomes a problem.”

“The coordinated disclosure lessons are an excellent study in what it takes to fix these problems,” he said. “The vulnerability is real but also highlights the even larger vulnerability of the shifting stand of dependencies and packages that our modern code relies on.”

Rust has released a security advisory for this security weakness, which is being tracked as CVE-2021-42574 and CVE-2021-42694. Additional security advisories from other affected languages will be added as updates here.

The Trojan Source research paper is available here (PDF).