Cisco Breach
Overview
In October 2024, Cisco experienced a significant cybersecurity breach related to Non-Human Identities (NHIs). The threat actor ‘IntelBroker’ exploited exposed credentials, API tokens, and keys located in DevHub, Cisco’s public development environment. This platform used to support third-party developers building applications for Cisco devices. Accidentally this platform contained sensitive information which gave the attacker unauthorized access to Cisco’s internal system and customer data.
Incident Analysis
Root Causes
Secrets Mismanagement: leaving secrets exposed without rotating them or even any access controls measures.
Improper Storage: Storing secrets improperly in publicly accessible place.
Attack Vector
Initial Access
The attacker discovered secrets such as API keys, tokens, hard-coded credentials on DevHub. These secrets were publicly available which allowed the attacker to access Cisco’s system.
Lateral Movement
The attacker used overprivileged credentials that he found to move laterally and expand in Cisco’s network.
Data Exfiltration
The attacker after expanding in the system, he exfiltrated sensitive data and listed it for sale on underground forums, targeting entities that could misuse this information.
Impact
Data Exposure: Internal Data and customer information were compromised, posing risks to both Cisco and its clients.
Reputation Damage: Cisco faced scrutiny over its security practices, particularly its governance of NHIs and its ability to secure customer’s data.
Recommendations
Enhanced Secrets Management
Use secure vaults for storing secrets.
Automate secrets rotation and enforce short expiry date.
Use fine-grained access tokens to take control of the permissions.
Training and Awareness
Educate teams on secure code practices and NHI management.
Adopt Least Privilege Principles
Ensure all NHIs has the necessary privileges only to avoid unauthorized overprivileged access.
Real-Time Monitoring
Deploy real-time monitoring and detection tools to monitor and detect any abnormal activity.
Conclusion
This incident is a reminder of the growing threat posed by mismanaged non-human identities. It highlights the need for comprehensive security strategies, robust governance policies, and advanced monitoring tools to mitigate risks associated with NHIs. By fixing these vulnerabilities, Cisco and other organizations can improve their cybersecurity defences and reduce any risks in the future.
The Stolen Data on Underground Forum - Source Oasis Security