The alleged Wipro network breach continues to earn headlines. And for good reason. The apparent breach of the major IT solutions provider ultimately extended out to customer systems to conduct gift card fraud. Moreover, similar attacks apparently targeted Infosys and Cognizant, according to KrebsOnSecurity -- the go-to source on these alleged attacks.
MSPs are familiar with this type of story. The various attacks essentially targeted large MSPs and IT consulting firms, and then used the MSP's network as a sort of island hopper system to move onto customer networks for potential financial gain.
The U.S. Department of Homeland Security (DHS) has specifically warned MSPs and CSPs multiple times about such attacks and the associated risks, as we've reported on MSSP Alert, our sister site.
So, What Was Actually Breached or Hacked?
Now, here's where the MSP industry needs to be extra careful about the facts:
So far, Wipro hasn't said much about the attack. But if my reading of the situation is correct, the attack may have gone something like this:
In the meantime, all the facts aren't in. Alas, Wipro has tried its best to evade KrebsOnSecurity's intense, detailed reporting. That's inexcusable. An honest, timely reply to KrebsOnSecurity's initial inquiry would have gone a long way to strengthening -- rather than weakening -- Wipro's reputation. Even a "no comment" would have been smarter than the apparently nonsensical reply Wipro initially offered Krebs.
ConnectWise Advice to MSPs
Meanwhile, it's a tricky time for ConnectWise. The company's name is associated with the Wipro story. But it's not like the software company can issue some sort of patch, fix or alert for a product that apparently wasn't hacked as part of the alleged Wipro incident. (If details emerge stating otherwise, we'll update our coverage accordingly.)
Still, there are some natural steps that MSPs should take. For starters, MSPs should embrace a Protect Your House mindset, according to ConnectWise Chief Product Officer Jeff Bishop. The idea: MSPs need to assess their own systems, pinpoint risk areas, and harden their own networks.
Also of note: If a company or individual believes that ConnectWise Control was used in an exploit or their instance has been exploited, ConnectWise encourages them to report the details of the activity on this page, according to Bishop. Also, partners can find more ConnectWise Control security guidance here.
The Bottom Line
My takeaways? No doubt, hackers will continue to target MSP-oriented software as a springboard into end-customer systems. Sometimes the attacks will involve software vulnerabilities. Other times, as I've outlined above, the attacks will involve legitimate remote control software used for illegal purposes. Consider yourself warned. Yet again.
