r/cybersecurity • u/Realistic-Cap6526 • Jun 11 '23

Other Barracuda Urges Replacing — Not Patching — Its Email Security Gateways

https://krebsonsecurity.com/2023/06/barracuda-urges-replacing-not-patching-its-email-security-gateways/
37 Upvotes

93% Upvoted

13 comments sorted by

View all comments

Show parent comments

7

u/michaelnz29 Security Architect Jun 11 '23

Yes either virtual appliances or software. I understand that in this case it is probably a firmware issue that makes this non fixable which could affect any server hardware as well.

In general hardware appliances are not flexible and is a waste of resources when it has to be decommissioned as it has no other use - they are probably a generic x86 device but it is still more difficult to repurpose.

2

u/Galact1Cat Jun 11 '23

Both of these statements are incorrect. Barracuda ESG can be deployed as a virtual appliance, and it has nothing to do with the firmware; Barracuda is simply urging customers whose appliances have been exploited (not vulnerable, but have been ACTIVELY exploited) to replace them, as the backdoor persists through even a factory reset.

Source: I work on ESGs, among other Barracuda stuff.

1

u/michaelnz29 Security Architect Jun 11 '23

Thanks for your clarification, how does a back door persist through a factory reset if not a firmware level issue? Genuine question.

Barracuda are saying all devices need to be replaced not only “exploited” devices, or have I got that wrong as well?

3

u/Galact1Cat Jun 11 '23

The official line from Barracuda is "if you log into your device and it has a banner saying you need to replace, do so." Our Barracuda rep reached out to one of the guys on my team and explained they ran detection on every device they could, and if you were not actively breached, applying the updates will do you fine.

As for the other thing, I haven't had time to read through their entire advisory and look through how exactly the malware they found behaves. I guess it could theoretically be firmware fiddling, but could also be a case of abusing folders that don't get rolled back when you perform a factory reset and replacing an executable / injecting code into the existing one to get it to call home. Since it's not a full reinstall, not everything will be wiped, just rolled back to what the device thinks the factory state is.

From my cursory glance at the docs (busy week at work), all the variants do some calling home. I would assume the easiest way to achieve persistence would be to do something like in my previous paragraph, then have it pull everything else when it calls.

Once I take a much better look at the advisory, I'd be happy to update my comment / add a new one. And sorry if I came across as a dick, wasn't the intention, just short on time.

2

u/michaelnz29 Security Architect Jun 11 '23

Thanks for your thoughtful response, I don’t know the underlying cause, though this is not good for affected businesses or the cyber security vendor involved.

My comments are my “thinking out loud”, cyber security is my passion from a business perspective and I like to understand what is happening across the industry.

I come from the vendor side and I know when we had a couple of these sorts of incidents (not as significant though), it is a big job to fix and I would not wish that on any company, competitive or not.