China-Linked Cybercrime Group Attacks Asian Certificate Authority, Breaches Government Agencies

Billbug is longstanding threat

All the targets of the attacks are in Asia but Symantec wasn’t more specific about the location or identities of the targets.

Symantec calls the group responsible Billbug, an Advanced Persistent Threat (APT) group they believe to be active at least since 2009. The group is allegedly linked to China, according to reports. The attacks revealed today used specific backdoors Symantec had previously attributed to Billbug in earlier blogs.

According to Symantec, Billbug is regarded as an “espionage actor.” That the attack was been ongoing for at least six months against sophisticated targets testifies to the sophistication of the attackers. While the blog does not speculate on the ultimate contractor of this espionage, Kevin Bocek, Venafi’s VP of Security Strategy and Threat Intelligence, says it “has all the tell-tale signs of a sophisticated nation-state attack.”

Billbug’s techniques and software are complex and polished by many years of practical hacking against high-value targets. And a target doesn’t get a much higher value than a CA. As Bocek puts it, the attack “doesn’t just impact the CAs – the issuer of machine identities – it’s the business, consumers, and governments that rely on these to know if a digital service is real or fake; if communications are private or tapped.”

Damage control

A successful compromise of a CA would force all customers to determine what assets may have been compromised and control that damage. The CA would have to reissue certificates to the customers, assuming they still trusted the CA enough to work with them and that the CA was certain that any breaches were completely remediated.

The customer would then immediately have to deploy all new certificates and reconfigure any systems designed to access breached CA resources. In short, as bad as it would be for the CA, it would be a five-alarm fire for security and many other groups at every CA customer.

While Symantec detected the attacks against the unnamed CA and notified it of the activity, they “[have] seen no evidence to suggest [the attackers] were successful in compromising digital certificates.“ Symantec does say that attacks against at least one of the government victims were successful and that “a large number of machines on the network were compromised.”

There have been successful attacks against CAs, most famously the compromise of Dutch CA DigiNotar in 2011, which led to their blacklisting from the PKI and a quick bankruptcy. There was evidence that the attack on DigiNotar was sponsored by Iran, but nothing definitive was found.

As Bocek said, the compromise of a certificate authority is one of the most serious to contemplate. He adds: “it’s no wonder why Venafi research shows an overwhelming number of cybersecurity professionals believe we’re already in a state of cyber warfare. Every business is impacted. “

Managing machine identities essential

“This compromise of a certificate authority highlights the importance of managing all machine identities in an enterprise. If the compromised were to be the root CA, then the attacker can potentially gain full control over the entire PKI infrastructure and compromise the trust in the system,” said Sitaram Iyer, Senior Director of Cloud Native Solutions, Venafi.

This can be even more serious as organizations create subordinate CAs that are used for signing workloads in cloud native environments for managing pod or mesh identities, according to Iyer.

“The sheer volume of these identities and the need to revoke all subordinates, recreate them and issue identities for workloads is a huge effort…Manual processes need to be eliminated, and all machine identity management should be 100% automated with security teams having the right kind of observability,” Iyer said.

CA compromises and certificate bulk replacement

Generally speaking, to respond to security events that require bulk replacement of certificates, like CA compromises, mechanisms for fast incident response must be in place before the event occurs, as Venafi notes in a white paper. Organizations need to maintain a certificate inventory with detailed intelligence—such as owner, location, issuing CA and applied policies—to enable the fast identification of impacted certificates. Automation is also essential to support timely bulk certificate replacement.

“To cope with this complexity, you need a flexible, CA-agnostic approach to certificate management that allows you to support certificates issued by internal and multiple external CAs. A CA-agnostic approach allows you to easily adapt your CA strategy to meet your business needs and environment, while also enabling you to respond to both internal and external CA issues.”

Related Posts

PKI Bootcamp: Anatomy of a Certificate Attack

CertLock Trojan: Upping the Ante on Certificate Attacks

Attack on Trust Threat Bulletin: APT Operators Exploit Heartbleed

On Tuesday, Symantec revealed a sophisticated, six-month-long series of attacks against a certificate authority (CA) and on an unspecified number of government and defense agencies.

“>