Ransomware Gang Exploits Veritas Backup Exec Flaws: CISA Orders Urgent Action

Summary

CISA has issued an urgent directive to federal agencies, mandating the patching of vulnerabilities in Veritas Backup Exec software. These flaws have been actively exploited by the ALPHV/BlackCat ransomware gang to gain unauthorized access to networks. This highlights the crucial need for robust backup and recovery strategies in the face of evolving cyber threats.

Explore the data solution with built-in protection against ransomware TrueNAS.

Main Story

Let’s talk about backups, shall we? They’re not just some nerdy IT thing; they’re absolutely vital for any modern business. You know, the whole ‘copying your data’ concept? Well, it’s what stands between you and total chaos if, say, your hard drive decides to take an unscheduled vacation, a piece of software goes rogue, or—heaven forbid—you accidentally delete something important. I know I’ve done that a few times, and backups saved my skin more than once! We’ve all been there, right?

So, there’s a few different ways to do this backup thing, each with its pluses and minuses. First up, we’ve got full backups. Think of it as making a complete photocopy of everything—the ultimate protection but, yeah, it hogs a lot of storage space. Then, there are incremental backups, which are more like taking snapshots of what’s changed since the last backup, using way less space but making the restore process potentially a bit slower. Finally, you have differential backups, kind of a sweet spot between the two—backing up changes since the last full backup. It’s about balance, ya know?

You can keep your backups onsite, on your own hardware or software. Or, more and more of us are moving them to the cloud. Cloud backups are great because they scale easily and give you a lot of flexibility, too. It’s all about what works for your specific needs.

That said, even with a fantastic backup plan in place, we’re not totally safe from cyber crooks. Take the recent Veritas Backup Exec security hole, for instance. The ALPHV/BlackCat ransomware crew exploited this vulnerability, which is pretty scary. And it shows that, no matter how good your backups are, if the bad guys can get into your system through your backup software, you’ve got trouble. Seriously, the Cybersecurity and Infrastructure Security Agency (CISA) even flagged these vulnerabilities and told federal agencies to get patching. It’s that serious!

Specifically, there are a few vulnerabilities (CVE-2021-27876, CVE-2021-27877, and CVE-2021-27878) that were being exploited. These let hackers gain remote access to Backup Exec, potentially leading to data theft, ransomware attacks, and total system compromise. These vulnerabilities can be used over the internet which makes them even more dangerous and it’s why CISA was so urgent.

Speaking of urgent, CISA told all federal agencies that they had to fix this issue by a deadline, which highlights how significant this is. While this directive was only for federal agencies, CISA was quick to tell everyone to fix this vulnerability before it was exploited. And, quite frankly, they’re right to be concerned. It goes to show having a backup isn’t enough, you need to keep that backup software protected, too.

We have to have multiple layers of security, not just relying on one thing. It’s like building a house, you wouldn’t just use one nail, right? You’d make sure the foundations were solid, walls were sturdy, and you have a good roof! In terms of security, things like strong passwords, multi-factor authentication, and routine security checks should be standard.

Veritas did address these issues in later versions of Backup Exec. If you’re using the software you have to update to version 21.2 or later, it really is that important. The thing is, this isn’t just about Veritas. Any software should be kept up-to-date with security patches. That’s kind of like common sense, right?

Beyond patching there are other things we can do to protect ourselves from ransomware. First, keep backing up data, and make sure you store it offline or in a ‘closed off’ area, that way you can avoid it being corrupted by ransomware. Also, you need an incident response plan, which is basically the steps you take if a ransomware attack happens, like isolating the systems, getting your data back, and calling law enforcement. And finally, teach your employees about cybersecurity so they can spot dodgy emails or links.

So, bottom line? This whole Veritas Backup Exec issue is a wake-up call. It’s a reminder that we need to stay on our toes, patch our software when it’s needed, and have multiple layers of security. It’s not optional, it’s just how things have to be in today’s world. And let’s be real, it’s not just big businesses at risk, small businesses are, too. As of Jan 18 2025, all of this information is current. I mean, who knows what tomorrow will bring though?