Kaseya apologises for extended downtime after ransom attack

CEO of Kaseya apologises after pushing back the restoration of the firm’s VSA service following a REvil ransomware attack
Kaseya CEO Kevin Voccola has apologised to the firm’s thousands of users currently unable to service their own customer bases while both hosted and on-premise instances of its VSA endpoint and network management service remain offline following a devastating ransomware attack by the REvil/Sodinokibi syndicate.The firm had hoped to bring its software-as-a-service (SaaS) datacentres back online over 24 hours ago, but technical issues forced this timeline to be reset, and on-premise versions of VSA cannot be restarted until the SaaS version is up and running. In the meantime, Kaseya has published a runbook for on-premise customers to help them prepare to restart.

“It has been a long, long five days for everyone, and I want to express my sincere apologies that you’re not up on VSA, that VSA is not accessible for you to serve your customers, to serve your internal IT folks, and to make your lives easier,” said Voccola. “I recognise … this sucks. We take this very seriously.

“The fact that we had to take down VSA was very disappointing to me… I feel like I let this community down, I let my company down, our company let you down,” he said.

“The new release time, which we are very confident in, is going to be this Sunday [11 July] in the early afternoon Eastern Standard Time,” added Voccola.

Voccola said he took responsibility for having pulled the planned release this week and described it as the hardest decision he’d had to make in his career.

“The fact that we had to take down VSA was very disappointing to me… I feel like I let this community down, I let my company down, our company let you down”

Kevin Voccola, Kaseya

He said Kaseya’s teams had locked down the vulnerabilities exploited in the attack and felt comfortable with the release, but, on the advice of third-party cyber consultants and Kaseya’s own engineers, they wanted to take time to put additional protections in place and harden VSA as much as possible.

Kaseya was downed late in the day on Friday 2 July by the REvil gang, ahead of a holiday weekend for the US company.

Between 50 and 60 of its managed service provider (MSP) customers were hit, with the cumulative impact spreading to thousands of downstream businesses – many of them small ones – that rely on the IT channel for their tech resource.

Most notably, the Swedish Coop supermarket chain was forced to shut hundreds of stores due to its payment systems dropping offline.

The ransomware operators have demanded $70m for a master decryption key, and far smaller sums from individual victims (see image below), but Voccola has been vocal in his refusal to negotiate with the criminals. It is not known if any of the other impacted businesses have entered negotiations.

In the past 24 hours, more details have begun to emerge via the Dutch Institute for Vulnerability Disclosure (DIVD) of the precise vulnerabilities exploited by REvil.

DIVD said it had been working extensively behind the scenes on seven newly discovered common vulnerabilities and exposures (CVEs) in the VSA product since 6 April.

These are CVE-2021-30116, a credential leak and business logic flaw; CVE-2021-30117, a SQL injection vulnerability; CVE-2021-30118, a remote code execution (RCE) vulnerability; CVE-2021-30119, a cross-site scripting (XSS) vulnerability; CVE-2021-30120, a two-factor authentication (2FA) bypass; CVE-2021-30121, a local file inclusion vulnerability; and CVE-2021-30201, an XML external entity vulnerability.

Of these, 30117, 30118, 30121 and 30201 have been resolved in previous patches, from which one can now infer that REvil used one or more of 30116, 30119 and 30120 to access the target systems.

DIVD’s chairman, Victor Gevers, said that, throughout the process, Kaseya had shown that it was willing to put maximum effort and initiative into getting the issue fixed and its customers patched.

“[Kaseya] showed a genuine commitment to do the right thing,” he said. “Unfortunately, we were beaten by REvil in the final sprint, as they could exploit the vulnerabilities before customers could even patch.”

Laisser un commentaire

Votre adresse e-mail ne sera pas publiée. Les champs obligatoires sont indiqués avec *

Ce site utilise l'intelligence artificielle et l'apprentissage automatique pour réduire les spams. Découvrez comment vos données de commentaire sont traitées.

Articles connexes


L'émergence du monde souterrain hors ligne : Réseaux de contrebande numérique

Découvrez comment les réseaux de contrebande numérique à travers le monde offrent un accès non censuré au monde numérique dans les zones avec lesquelles des restrictions Internet et une censure sont en place. Cet article met en évidence le phénomène d'Internet hors ligne et l'illustre à travers des exemples tels que le "paquete semanal" cubain et le réseau de rues de La Havane.

Lire la suite

Cela prolonge considérablement la durée de vie de votre batterie de téléphone.

Combien de temps utilisez-vous en moyenne un smartphone Apple ou Samsung ? Souvent, les contrats associés à ces appareils ont une durée de deux ans, après quoi vous avez la possibilité de souscrire un nouveau contrat avec un appareil. C'est dommage et tout sauf durable ; l'appareil est fréquemment encore en bon état après deux ans. Seule la batterie du téléphone aura généralement perdu en qualité après deux ans. Cela ne signifie pas que vous devez remplacer l'appareil dans son intégralité ; le remplacement de la batterie de votre téléphone Samsung peut être suffisant pour continuer à l'utiliser pendant un certain temps. Non seulement c'est durable, mais c'est aussi plus avantageux ! Le remplacement de la batterie peut commencer à partir de 30 euros, en fonction du modèle Samsung que vous possédez.

Lire la suite
  • Étiquettes

  • Catégories

  • Archives