{"id":51527,"date":"2022-09-22T12:35:14","date_gmt":"2022-09-22T04:35:14","guid":{"rendered":"http:\/\/www.upgrademag.com\/web\/?p=51527"},"modified":"2022-09-22T12:35:16","modified_gmt":"2022-09-22T04:35:16","slug":"kaspersky-reveals-external-cybersecurity-loopholes-in-sea","status":"publish","type":"post","link":"http:\/\/www.upgrademag.com\/web\/2022\/09\/22\/kaspersky-reveals-external-cybersecurity-loopholes-in-sea\/","title":{"rendered":"Kaspersky reveals external cybersecurity loopholes in SEA"},"content":{"rendered":"\n

Cyberattacks can be prevented before an attacker is inside the internal network. Threat monitoring allows organizations to take action and properly neutralize a threat before it can exploit any existing vulnerabilities and affect the target institutions.<\/strong><\/p>\n\n\n\n

Kaspersky unveiled the results of its Digital Footprint Intelligence<\/a> (DFI) report covering the external threats for a selection of countries from the Asia Pacific (APAC) region in 2021, including the six key countries in Southeast Asia (SEA).<\/p>\n\n\n\n

The report\u2019s sole purpose is to create awareness about security threats and demonstrate effective approaches to risk mitigation for widespread attacks with high business impact. <\/p>\n\n\n\n

Cybercriminals\u2019 exploitation capabilities<\/h2>\n\n\n\n

The rapidly growing share of adversaries\u2019 initial access approach is the exploitation of 1-day vulnerabilities. Complicated business processes are forced to leave services on the perimeter, which in turn increases the external attack surface. <\/p>\n\n\n\n

With the help of public sources and specialized search engines, Kaspersky collected information on 390,497 services available from public networks and analyzed them for key security issues and vulnerabilities. <\/p>\n\n\n\n

Analysis revealed that in 2021, almost every fifth of the vulnerable services contained more than one vulnerability, thereby increasing the chances of an attacker performing a successful attack.<\/p>\n\n\n\n

All industry sectors, analyzed in the report, in all countries have issues with application of security updates for publicly available services.<\/p>\n\n\n\n

Government institutions (major personally identifiable information (PII) processors and providers of critical services for citizens) are potential incident-generators by a huge margin.<\/p>\n\n\n\n

Singapore has a low number of vulnerabilities and an outstanding low ratio between the number of services and the sum of vulnerabilities in them, while Vietnam, Indonesia, Thailand and Malaysia have the highest ratio among SEA countries<\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n

Figure 1. Distribution of vulnerable services<\/em><\/p>\n\n\n\n

In terms of the share of vulnerabilities with publicly available exploits, 3 countries out of TOP-5 are located in Southeast Asia (SEA) \u2013 these are Malaysia, Vietnam, and Philippines.<\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n

Figure 2. Distribution of vulnerable services with publicly available exploits<\/em><\/p>\n\n\n\n

From Kaspersky\u2019s practice in incident response handled by Global Emergency Response Team (GERT) and CISA advisory adversaries use a well-known list of vulnerabilities to exploit organization defenses.  While researching the security problems of companies from the APAC region, Kaspersky experts observed a number of commonly used vulnerabilities dubbed ProxyShell and ProxyLogon. Exploits for these vulnerabilities are easily available on the Internet, therefore, they can be easily exploited by even a low-skilled attacker.<\/p>\n\n\n\n

While ProxyShell is quite common in China and in Vietnam, the countries most affected by ProxyLogon are:<\/p>\n\n\n\n