Initial reports of a breach at BeyondTrust surfaced when it was discovered that hackers had compromised some remote support SaaS instances by obtaining an API key.
Hackers Breach BeyondTrust Remote Support SaaS Instances
Threat actors use API key to gain unauthorized access, but BeyondTrust detected the anomaly early.
What is the attack?
The attackers leveraged this API key to reset passwords for local application accounts, gaining unauthorized access to BeyondTrust's systems. The breach also revealed vulnerabilities in BeyondTrust's products, including:
CVE-2024-12356: A critical command injection vulnerability in Remote Support (RS) and Privileged Remote Access (PRA) products, allowing attackers to execute operating system commands.
CVE-2024-12686: A medium-severity vulnerability that enabled administrative privilege misuse for command injection and file uploads.
BeyondTrust detected the anomaly early, revoked the compromised API key, and implemented countermeasures to secure affected systems.
Why did it get through?
Zero-Day Vulnerabilities: Two vulnerabilities in BeyondTrust’s products allowed successful command injection exploitation opportunities.
Exploitation of an API Key: Attackers obtained a valid Remote Support SaaS API key, enabling them to reset passwords and gain unauthorized access to accounts.
What is required to solve for this attack?
Proactive Security Testing, Vulnerability Management, and System Hardening: Conduct regular penetration testing and red teaming exercises to identify vulnerabilities, and implement system hardening measures.
Behavioral and Anomaly Detection: Deploy tools to monitor for unusual system activity, including abnormal API usage, privilege escalation attempts, and deviations from baseline behaviors to detect and respond to potential attacks in real time.
Defense-in-Depth Strategies: Implement multi-layered defenses, including network segmentation, multi-factor authentication for sensitive operations, and robust data encryption with secure key management to minimize the impact of a breach.