Armadin report: 88% of critical and high-severity flaws found in live attack tests fall outside vendor advisories
A report published on November 2 by Armadin, the offensive security startup founded by Mandiant founder Kevin Mandia, says 88% of the critical and high-severity weaknesses found in its AI-driven attacks on live client environments this year would not have been identified through vendor advisories or other outside sources. The data spans nearly a dozen industries, but Armadin did not disclose how many organizations or findings it covers. Most severe findings sat on the unauthenticated attack surface, and exposed service-account credentials created further attack paths. The report concludes that 93% of severe findings needed no third party to act, so remediation sits with each organization.
Detalhes técnicos
- Flaws in custom, in-house code made up 67% of critical and 78% of high findings that advisories could not cover. Vendor products deployed in ways no advisory describes, such as administrative consoles exposed to the internet, accounted for 24% and 22%.
- The remaining 9% of critical findings, and under 1% of high ones, were zero-days found by Armadin, including one in an identity governance platform whose vendor took almost four months to issue an advisory.
- Nearly 70% of critical and high findings sat on the unauthenticated attack surface. Of the documented attack chains, 82% began without credentials, and 56% of those went on without a password or key ever being presented.
- In more than 70% of client environments, Armadin reached a critical outcome in three steps or fewer without valid credentials.
- Just under half of the chains that started without authentication relied on an exposed credential. 71% of these belonged to applications or service accounts, and nearly 90% were reachable without extraction, often in repositories, configuration files, backups, logs or cloud settings.
- In one engagement, Armadin started from an unprivileged domain account and used a flaw in backup software to read the credentials it held. That led to a hypervisor management server and, via a domain controller backup, to domain administrator hashes.
Remediação
- Fixing severe findings meant shipping application code in 51% of cases, changing a setting, permission or policy in 43%, and rotating an exposed credential in 32%. Many needed more than one step.
- Armadin recommends policies for provisioning, storing and rotating service account credentials.
- Armadin also recommends checking pipelines and code repositories for exposed secrets.
Linha do tempo
-
Armadin report: 88% of critical and high-severity flaws found in live attack tests fall outside vendor advisories
ler a análise desta fonte ocultar
A report published on November 2 by Armadin, the offensive security startup founded by Mandiant founder Kevin Mandia, says 88% of the critical and high-severity weaknesses found in its AI-driven attacks on live client environments this year would not have been identified through vendor advisories or other outside sources. The data spans nearly a dozen industries, but Armadin did not disclose how many organizations or findings it covers. Most severe findings sat on the unauthenticated attack surface, and exposed service-account credentials created further attack paths. The report concludes that 93% of severe findings needed no third party to act, so remediation sits with each organization.
Technical Details
- Flaws in custom, in-house code made up 67% of critical and 78% of high findings that advisories could not cover. Vendor products deployed in ways no advisory describes, such as administrative consoles exposed to the internet, accounted for 24% and 22%.
- The remaining 9% of critical findings, and under 1% of high ones, were zero-days found by Armadin, including one in an identity governance platform whose vendor took almost four months to issue an advisory.
- Nearly 70% of critical and high findings sat on the unauthenticated attack surface. Of the documented attack chains, 82% began without credentials, and 56% of those went on without a password or key ever being presented.
- In more than 70% of client environments, Armadin reached a critical outcome in three steps or fewer without valid credentials.
- Just under half of the chains that started without authentication relied on an exposed credential. 71% of these belonged to applications or service accounts, and nearly 90% were reachable without extraction, often in repositories, configuration files, backups, logs or cloud settings.
- In one engagement, Armadin started from an unprivileged domain account and used a flaw in backup software to read the credentials it held. That led to a hypervisor management server and, via a domain controller backup, to domain administrator hashes.
Remediation
- Fixing severe findings meant shipping application code in 51% of cases, changing a setting, permission or policy in 43%, and rotating an exposed credential in 32%. Many needed more than one step.
- Armadin recommends policies for provisioning, storing and rotating service account credentials.
- Armadin also recommends checking pipelines and code repositories for exposed secrets.