Armadin report claims 88% of severe flaws fall outside vendor advisories

What happened

Offensive security startup Armadin says that 88% of the critical and high-severity weaknesses it found in live attack tests on enterprise environments this year would not have been identified through vendor advisories or other outside sources, according to Infosecurity Magazine. Infosecurity Magazine reports that Armadin, launched by Mandiant founder Kevin Mandia, published the report on November 2. Armadin says the data is based on AI-driven attacks against its clients’ live systems. The data has not been independently verified.

Infosecurity Magazine reports that the clients span nearly a dozen industries. Armadin did not disclose how many organizations or findings the data covers, so the sample size is not confirmed.

According to Armadin’s figures, as reported by Infosecurity Magazine:

• Defects in software the clients had written themselves made up 67% of the critical findings and 78% of the high findings that advisories could not cover.
• Vendor products deployed in ways no advisory describes, such as administrative consoles exposed to the internet, accounted for 24% of critical and 22% of high findings.
• The remaining 9% of critical findings, and under 1% of high ones, were zero-days Armadin says it found itself. One was in an identity governance platform whose vendor took almost four months to issue an advisory. The vendor and product are not named, so they are not confirmed.
• Nearly 70% of critical and high findings sat on the unauthenticated attack surface. Of the documented attack chains, 82% began without credentials, and 56% of those went on without a password or key ever being presented.
• In more than 70% of client environments, Armadin says it reached a critical outcome in three steps or fewer without valid credentials.

Armadin also reports that just under half of the chains that started without authentication relied on an exposed credential. It says 71% of those credentials belonged to applications or service accounts rather than people. It adds that nearly 90% were reachable without extraction, often in repositories, configuration files, backups, logs or cloud settings.

In one engagement described in the report, Armadin says it started from an unprivileged domain account. It then used a flaw in backup software to read the credentials that software held. From there it reached a hypervisor management server and, through a domain controller backup, domain administrator hashes. The backup software and the flaw are not named, so they are not confirmed.

Am I affected?

This is aggregate research data, not a disclosure about a specific product. There are no CVEs, versions or fixes in the source. Armadin’s figures suggest the following areas deserve attention:

• Applications your organization builds itself.
• Vendor products deployed in non-standard ways, such as admin consoles reachable from the internet.
• Application or service account credentials stored in repositories, configuration files, backups, logs or cloud settings.

The identity governance platform zero-day and the backup software flaw mentioned in the report are not identified. Whether any specific product you use is involved is not confirmed.

What to do now

1. Armadin reports that fixing severe findings meant shipping application code in 51% of cases. Include your in-house code in vulnerability testing, not only third-party products (Infosecurity Magazine).
2. Check whether administrative consoles of vendor products are exposed to the internet. Armadin reports that 43% of fixes involved changing a setting, permission or policy (Infosecurity Magazine).
3. Follow Armadin’s recommendation to set policies for provisioning, storing and rotating service account credentials. Rotate any credential you find exposed. Armadin reports this was needed in 32% of cases (Infosecurity Magazine).
4. Following Armadin’s recommendation, check pipelines and code repositories for exposed secrets (Infosecurity Magazine).

Sources

• Infosecurity Magazine: Armadin Tests Find 88% of Severe Flaws Outside Vendor Advisories