Security researchers have observed a spike in attacks from multiple threat actors targeting Elasticsearch clusters, in what is believed to be attempts to place malware on victims’ machines.

Attackers appear targeting clusters using versions 1.4.2 and lower, and are leveraging old vulnerabilities to pass scripts to search queries and drop the attacker’s payloads, according to a blog post by researchers at Cisco Talos. Researchers found that both malware and cryptocurrency miners were being left on target machines.

Researchers explained that because Elasticsearch is typically used to manage very large datasets, the repercussions of a successful attack on a cluster could be devastating due to the amount of data present.

Hackers have been consistently deploying two distinct payloads with the initial exploit, always using CVE-2015-1427. The first payload invokes wget to download a bash script, while the second payload uses obfuscated Java to invoke bash and download the same bash script with wget.

“This is likely an attempt to make the exploit work on a broader variety of platforms,” said researchers.

Researchers also saw a second hacker exploiting CVE-2014-3120, using it to deliver a payload that is derivative of the Bill Gates distributed denial-of-service malware. “The reappearance of this malware is notable because, while Talos has previously observed this malware in our honeypots, the majority of actors have transitioned away from the DDoS malware and pivoted toward illicit miners,” said researchers.

A third hacker was observed to download a file named «LinuxT» from an HTTP file server using exploits targeting CVE-2014-3120. hosts that attempted to download the «LinuxT» sample also dropped payloads that executed the command «echo ‘qq952135763.'»

“This behaviour has been seen in elastic search error logs going back several years,” said researchers.

Honeypots set up by researchers also detected additional hosts exploiting Elasticsearch to drop payloads that execute both «echo ‘qq952135763′» and «echo ‘952135763,’» suggesting that the attacks are related to the same QQ account.

“However, none of the IPs associated with these attacks have been observed attempting to download the «LinuxT» payload linked to this attacker. Additionally, unlike other activity associated with this attacker, these attacks leveraged the newer Elasticsearch vulnerability rather than the older one,” said researchers.

Researchers said that these Elasticsearch vulnerabilities only exist in versions 1.4.2 and lower, so any cluster running a modern version of Elasticsearch is unaffected by these vulnerabilities. “Given the size and sensitivity of the data sets these clusters contain, the impact of a breach of this nature could be severe,” warned researchers.

Organisations using Elasticsearch are urged to patch and upgrade to a newer version of Elasticsearch if at all possible.

VMware made many announcements at MWC 2019 and they all centred around one common theme: network virtualisation.

«If a telco wants to progress in the future, they need to think software-defined,» said Gabriele di Piazza, VP products & solutions for telco at VMware. «More and more communication service providers (CSPs) are turning to VMware to lead their transformation ahead of 5G rollout.»

It thinks that there needs to be a shift away from hardware-defined architecture, towards a fully virtualised one which will enable telcos to beat competitors to market with fully automated, scalable infrastructure.

Traditional data centre models will be a thing of the past and phones will transmit to masts and that data will be sent to the cloud, where the network is managed virtually in a SlaaS configuration – we’re noticing a pattern here.

VMware calls it a ‘telco cloud’ which will exist alongside the traditional public, private, hybrid and edge clouds. The network function virtualisation (NFV) platform on its telco cloud will enable better management of a network and improved efficency of services.

Features and applications can be applied to the cloud environment such as machine learning-driven technology that can spot issues and vulnerabilities and automatically patch them without having to physically attend a data centre and make a repair.

«With the current demands placed on carrier networks reaching new levels and 5G on the horizon, there’s no room for error when it comes to network infrastructure,» said Piazza. «Near real-time solutions are the key to identifying and fixing issues in order to keep networks humming. Networks need unified monitoring, automation and assurance across physical and virtualized networks to deliver the highest levels of performance, scalability and resiliency.»

Among the vast amount of announcements the company made at this year’s MWC which included its telco cloud, NFV virtual cloud platform, it also announced some key business partnerships that aim to strengthen 5G network management on the whole.

Building on a relationship dating back to 2012, VMware announced it’s teaming up with Ericsson to test, validate and optimise the biggest network functions in VMware’s cloud.

This makes both firm’s offerings more appealing as Ericsson becomes one of the prime chargers in the 5G infrastructure scene, it benefits from having its applications available on the VMware cloud and having them tested for assurance by the pair of them.

It will make it easier for telcos to access and manage the Ericsson services they need while knowing that they’re safe and optimised as they reside in the cloud.

VMware also announced that it will be servicing T-Systems as its managed services provider using its Workspace One multi-cloud platform.

When the company hires a new employee, that employee’s work device, say a phone, can be delivered to them on their first day pre-loaded with every application they need to function in the office.

One of the main issues with the current workplace is those presented, ironically, by security products, said Adam Rykowski, VP product management for Workspace One.

Multi-factor authentication can be an issue for new starters or when working remotely because users would have to log in to every service, of which there could be up to 30-40 which is hugely laborious and time-consuming.

Using Workspace One, all the apps the employee needs reside in the cloud and can be accessed using a single sign-on that VMware applies to all relevant apps.

A new flaw has been discovered by security researchers that could enable hackers to install backdoors on the firmware of bare-metal cloud servers that stay active even when the customer using the hardware has been re-assigned elsewhere.

Called “Cloudbourne”, the vulnerability was first discovered by researchers at the Eclypsium Research Team, who detailed their findings in a blog post. They found that hackers could plant backdoors and malware in the firmware of a server, or in its baseboard management controller (BMC), with relative ease.

These BMCs enable remote management of a server for initial provisioning, operating system reinstall and troubleshooting. Cloudborne exploits a flaw in the hardware’s reclamation process when moving clients on and off a bare metal server.

While physical servers are dedicated to one customer at a time, they don’t stay that way forever,” said researchers. “Servers are provisioned and reclaimed over time and naturally move from customer to customer.”

The firmware of the hardware is not reflashed in the reclamation process, allowing backdoors to persist. A hacker uses a known vulnerability in Supermicro hardware to rewrite the BMC and gain direct access to the hardware.

Researchers said that hackers “could spend a nominal sum of money for access to a server, implant malicious firmware at the UEFI, BMC, or even component level, such as in drives or network adapters. Then the attacker could release the hardware back to the service provider, which could put it back into use with another customer.”

They added that given a BMC’s ability to control the server, any compromises to that firmware can provide access to powerful tools for an attacker to exploit.

“Given the nature of the applications and data hosted on bare-metal offerings, this opens up the possibility for high-impact attack scenarios,” they said.

These scenarios include application disruption, where a malicious implant at the BMC level could permanently disable a server; data theft, as it provides attackers with another very low-level way of stealing or intercepting data; and ransomware attacks, as attackers would naturally have the ability to take hold of valuable assets.

The backdoor could also compromise other parts of cloud infrastructure. For example, hackers could send malicious IPMI commands over system interfaces from the host without the commands being authenticated.

“Since there is no authentication performed when using system interfaces, the only barrier to running arbitrary code within the BMC is whether the BMC itself performs cryptographically secure signature verification of the firmware update image before applying the update. Unfortunately, not all BMCs perform this check, and even when they do, malware can exploit vulnerabilities in the BMC firmware to bypass it,” noted researchers.

Researchers said that as firmware underlies even the host operating system and the virtualization layers of a server, any implants would naturally be able to subvert any controls and security measures running at these higher layers.

Quickbooks has made its Making Tax Digital suite widely available for small businesses and accountants, which includes software that will allow users to continue to file VAT using spreadsheets.

The updated tools will ensure that anyone filing a VAT return using the tools will be compliant with the government’s new digital tax legislation, set to come into force on 1 April.

The platform comprises tools such as SmartCheck, a pilot software that identifies common mistakes in VAT returns, and Smart Notifications, which notifies accounting professionals when their clients need to file for VAT, advising on due dates and making sure the tasks are scheduled so the deadline isn’t missed.

“Accounting professionals and small businesses are looking to the software industry to make MTD easy,” Shaun Shirazian, head of product Europe, said.

“After conducting numerous pilots, through listening to the feedback of our customers and by working closely with HMRC, we have optimized and iterated QuickBooks and built a best-in-class solution ready for the MTD generation that is available to QuickBooks users.”

A major new feature included in all QuickBooks Online subscriptions is the Quickbooks Bridging Software, which allows small businesses to use spreadsheets to file their VAT return using Quickbooks. The hope is that this will make it easier for businesses already using spreadsheets to file their return to comply with new regulations – something that is likely to be welcome among smaller businesses.

“As digital tax is embraced, our next challenge is to help small businesses and accounting professionals put digital at the heart of their business to help them supercharge productivity, run and grow their business.”

Quickbooks has also launched a helpline for small businesses to check they’re compliant with the new Making Tax Digital legislation. It will also serve accounting professionals using Quickbooks to file returns for both themselves and clients.

A handful of new products will also be made available for SMBs and those that are self employed, including Receipt Capture, which can take photographs of receipts and automatically import the required data. 

Sauce Labs has launched a virtual data centre in Germany and expanded its London office to keep up with European data demands, the company has announced.

It’s a reflection of the company’s success in the EMEA region and, after doubling its European workforce, it now needs office space to support its rapid growth.

“Since establishing itself in Europe more than two years ago with the acquisition of TestObject, Sauce Labs has continually made strong investments in the region, and today’s announcement is just the latest example of our commitment to customers in EMEA,” said Hannes Lenke, vice president of New Ventures and general manager, Germany, Sauce Labs.

The company now has grown its local enterprise customers to more than 100 and achieved year-on-year recurring revenue increases of 60%, demonstrating a hunger for digital transformation in the UK and beyond, despite challenging economic conditions.

Businesses are increasingly searching for a robust continuous app testing platform so they can get services to market faster and Sauce Labs believes it’s able to offer this with the introduction of an additional facility in Europe.

“Now anchored by our new data center in Frankfurt, Sauce Labs continues to be at the forefront of empowering organisations in Europe to quickly and reliably scale both the volume and velocity of their tests, enabling them to successfully move forward with their digital initiatives while meeting mounting compliance requirements.”

The new Frankfurt-based data centre will offer European businesses a platform to test devices, alongside its existing European real device data centre, significantly boosting its resources.

The company also announced the appointment of Joe Pynadath, as vice president of sales for the EMEA region and Karolin Beck as vice president of EMEA marketing.

What does cloud mean to you and what benefits do you think it brings to businesses?

That’s a big question! If I was to boil it down, I think that businesses that embrace the possibilities around cloud will accelerate their success in the future. To me, it’s the ability to shift the focus and energy away from maintaining IT to ensuring that whatever organisation you are, your customers – both internal and external, are served better.

Do you think the UK cloud industry has an advantage over other geographies? Are we excelling? 

CDW being a global organisation gives me the advantage of experiencing cloud culture across the world. Individual cases aside, it feels like we’ve broken the back of the commercial versus technical/business led drivers for cloud adoption in the UK. It’s becoming a standard here, as it is in the US. Others are now starting to follow.

What else do you think needs to be done to champion innovation in the UK cloud industry?

I think we’re doing a great job. I’d like to see more IT leaders coming together regularly to help drive organisations large and small into cloud adoption, sharing the war stories and helping to overcome the perceived risks and challenges. Most of the time, with some experienced assistance, it’s not as hard as people think.

Can you provide a bit more detail for those not familiar with your company?

CDW UK is a solutions and services led organisation. We’re a leader in Cloud Services with continued investments in resources to support our customers. We help to enhance their use of cloud platforms and applications to drive innovation.

Why have you decided to get involved with the UK Cloud Awards 2019?

We’re really proud to be sponsoring the UK Cloud Awards this year. CDW UK is a big advocate for the cloud industry in the UK and we’re keen to collaborate with our peers in the industry to best help customers with their adoption. We’re also keen to tell the world about our capabilities.

What key trends/challenges are you seeing with your customers around cloud?

It’s inevitable that businesses will adopt cloud services, whether that’s today or in the future. Today, we’re seeing customers that jump into transformation very quickly and others that spend far too long deliberating. Both of these are challenging and can result in botched environments or pure inertia.

How is your company helping customers address these challenges?

We’re helping our customers to reduce their risk, learning from our experiences to help their cloud adoption. Design, planning and migrations are different for each organisation and CDW assists to ensure that we help our customers drive the most value from their investments in these new platforms.

How do you think the cloud landscape has evolved in the past five years?

It’s a case of when not if these days. In order to keep up with competitors in their industry, organisations need to make that shift, however challenging it might be. Five years ago there may still have been a question mark, not today.

What do you think has driven this shift?

The public cloud platforms of Microsoft, Amazon, Google and Alibaba in the UK have shifted the speed of adoption. Certainly, most organisations have a Microsoft relationship, and when Microsoft decided to go all in on the cloud, the tide turned.

What other trends and patterns do you see around cloud computing and related technologies?

Customers are now starting to move beyond the infrastructure layer, to more DevOps related projects including application modernisation, data analytics and AI. Some are more advanced than others, lots are still trying to work out how to take advantage of and monetise these types of technologies.

What role do you see cloud playing in business life a year or five years from now?

As cloud becomes ubiquitous, I’m not sure the phase will exist in the same way in five years’ time. As change becomes faster and faster, making the most of the scalability of cloud platforms will mean better use of data. Technology teams will become more and more important in a business and will be the department to drive innovation, growth and most importantly, profits.

How can we prepare for such change(s)?

A lot of that comes down to skills and culture. Companies can have all the best intentions but ultimately the delivery of this new role in business comes down to the expertise of the people involved. Organisations need to be able to either re-train their existing teams or make sure that they are looking at new ways to recruit talent – a mix of experience and raw youth, to ensure that end users and customers are delivered with the services they expect. In the future, these will be the differentiators.

Looking further along the line, how do you see cloud shaping the way we live and work in the future?

Technology will continue to evolve at a faster and faster rate. I have two young children and I’m certain that by the time they are introduced to the working world it will be very different from today. Cloud is enabling organisations to deliver against projects that were unthinkable only a decade ago; I wish I could see into the future to predict what that may look like in 20 years time.