NSA, FBI warning: Beware these 20 software flaws most used by hackers

The National Security Agency (NSA), Cybersecurity and Infrastructure Security Agency (CISA) and Federal Bureau of Investigation (FBI) have listed the top 20 software flaws that China-funded hackers have been using to compromise networks since 2020. 

The advisory emphasizes that China-backed hackers actively target not just the networks of the US government and its allies but also software and hardware companies in the supply chain to steal intellectual property and gain access to sensitive networks. These hackers are an active threat to the IT and telecoms sector, the defense industrial base, and critical infrastructure owners and operators. 

“NSA, CISA, and FBI continue to assess [People’s Republic of China] PRC state-sponsored cyber activities as being one of the largest and most dynamic threats to U.S. government and civilian networks,” they note. 

Also: White House warns: Do these 8 things now to boost your security ahead of potential Russian cyberattacks

CISA this week disclosed that several state-backed hacking groups were active on defense industrial base enterprise networks after gaining access through their Microsoft Exchange Server infrastructure from around mid-January 2021. Exchange Server is now under attack by newly discovered flaws similar to last year’s ProxyShell.

Among the top 20 flaws used by China-backed hackers are four Microsoft Exchange Server flaws: CVE-2021-26855, a remote code execution bug, as well CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065. These are all part of the the Exchange Server ProxyLogon pre-authentication vulnerabilities disclosed in 2021.   

Microsoft in July warned these bugs were being used in combination with malware tailored for networks using Microsoft’s Internet Information Services (IIS) web server to host Outlook on the web. 

Other commonly used flaws include those in Apache Log4Shell, and flaws in code-hosting site GitLab, F5’s network gear, VPN endpoints, and popular server products from VMware, Cisco, and Citrix. 

All the bugs are publicly known and present a risk for organizations that haven’t applied available firmware and software updates. 

The GitLab and Atlassian Confluence bugs stand out as examples of hackers targeting developer and IT operations tools.   

“These state-sponsored actors continue to use virtual private networks (VPNs) to obfuscate their activities and target web-facing applications to establish initial access,” CISA notes. 

Many of the top 20 vulnerabilities “allow the actors to surreptitiously gain unauthorized access into sensitive networks, after which they seek to establish persistence and move laterally to other internally connected networks,” it added. 

The agencies recommend patching systems, using multi-factor authentication, disabling unused protocols at the network edge, ditching end-of-life devices, adopting a model that trusts no person, device or app, and enabling logging of internet-facing systems.  

The top flaws used since 2020 are listed in the table below.