Cybersecurity

NSA warns on Russian hackers stealing data through VMware flaw

update (Alexander Supertramp/Shutterstock.com) 

The National Security Agency today announced vulnerabilities in software widely used across the federal government are being exploited by Russia-sponsored threat actors to access protected data.

The exploit could potentially affect multiple VMware Access and VMware Identity Manager products.

The attack requires a hacker to have credentials to obtain access to the management interface, according to the Dec. 7 NSA statement. Once inside, hackers can leverage the flaw to forge additional credentials to obtain protected data.

NSA's advisory stresses the importance of patching by National Security System, Department of Defense and defense industrial base system administrators.

NSA recommends administrators immediately apply the vendor-issued patch and to check server logs in the event a compromise is suspected by network operators. The advisory notes that the exploit won't show up on network security indicators because adversarial activity occurs "exclusively inside an encrypted transport layer security tunnel" that interacts with the VMware web interface.

About the Author

Justin Katz covers cybersecurity for FCW. Previously he covered the Navy and Marine Corps for Inside Defense, focusing on weapons, vehicle acquisition and congressional oversight of the Pentagon. Prior to reporting for Inside Defense, Katz covered community news in the Baltimore and Washington D.C. areas. Connect with him on Twitter at @JustinSKatz.


Featured

  • Comment
    Diverse Workforce (Image: Shutterstock)

    Who cares if you wear a hoodie or a suit? It’s the mission that matters most

    Responding to Steve Kelman's recent blog post, Alan Thomas shares the inside story on 18F's evolution.

  • Cybersecurity
    enterprise security (Omelchenko/Shutterstock.com)

    Does Einstein need a post-SolarWinds makeover?

    A marquee program designed to protect the government against cybersecurity threats is facing new scrutiny in the wake of Solar Winds Orion breach, but analysts say the program was unlikely to have ever stopped the hacking campaign.

Stay Connected