Cybercriminals are exploiting remote monitoring and management (RMM) platform vulnerabilities to launch ransomware attacks on MSPs and their customers.

Earlier this year, Asigra warned its global network of MSPs about an RMM platform ransomware threat that puts solution provider and end-customer applications and data at high risk. ConnectWise also has been rushing to address RMM vulnerabilities that threaten the company and its MSP customers.

During a Channel Partners Virtual presentation titled “RMM Vulnerabilities that Are Devastating Service Providers,” Sept. 8, Jason Ingalls, CEO of Ingalls Information Security, will lead a panel discussion on the impact of RMM vulnerabilities.

Panelists include: Chris Noles, president of Beyond Computer Solutions; Eric Pinto, senior director of channel and product strategy for SOCSoter; and James Wroten, founder of Need Computer Help.

In a Q&A with Channel Futures, Noles and Pinto give a sneak preview of what they plan to cover during the presentation.

Channel Futures: Why are we seeing so many RMM platform vulnerabilities?

Beyond Computer Solutions’ Chris Noles

Chris Noles: The attackers know that RMM tools and MSPs have access to multiple businesses if they can exploit the MSP and its RMM tool. It is a turnkey business for them.

Eric Pinto: As a platform, remote management solutions provide threat actors with a direct conduit into dozens – if not hundreds – of small business environments. This makes them ripe for malicious activity. There are any number of reasons why service providers might miss a known or established vulnerability. Much of this is rooted in awareness and having the infrastructure in place to implement remediation strategies quickly. Just because someone reports a vulnerability, it doesn’t mean systems are compromised — yet. However, the clock is ticking. The scenario becomes not if, but when.

CF: Is it almost too late by the time you discover an RMM platform vulnerability?

CN: Without the proper tools to monitor for this, yes. Unfortunately, most MSPs have not added the tools or extra layers of security to know before it is too late.

CF: What sort of damage has occurred and can occur from these types of vulnerabilities?

CN: The worst-case scenario could be catastrophic. If an MSP’s RMM tool gets compromised, the attacker could gain control of an MSP’s RMM console. There, they could remotely log in to every client of that MSP organization and encrypt live data and the backups with ransomware demanding that ransoms be paid for every client. This could put an MSP and all of its clients out of business. Or it could at least create costly downtime, loss of reputation and hundreds of thousands of dollars in legal fees. Unfortunately, there are cases where this has happened to multiple MSPs.

If the case involves a health care client, then Health Insurance Portability and Accountability Act of 1996 (HIPAA) violations could easily cost hundreds of thousands of dollars. We’ve even heard of cases where attackers target patients from health care organizations that a compromised MSP was managing. These patients have been threatened by the attackers to have their medical records published unless a ransom is paid.

SOCSoter’s Eric Pinto

EP: The longer a system’s vulnerabilities persist, the increased risk of compromise. Depending on the severity of the concern, a vulnerability will affect the service provider (internally). But it could also create access downstream into their entire customer portfolio. With or without a data breach, the impact and potential damage to the relationship could be huge. If a security breach results in access to sensitive materials, this could require the service provider to announce publicly exactly what has happened — and their role in the it. The resulting damage to the business may be irrecoverable.

CF: Are there things organizations aren’t doing that they should be doing to protect themselves from these vulnerabilities?

CN: Absolutely. Most MSPs are good about telling their clients to enable multifactor authentication (MFA), but so many of these MSPs don’t …

… even have MFA enabled for their own RMM tool and other tools. MSPs should also partner with a security operations center (SOC) team that can monitor their systems to ensure that they themselves are secure.

EP: Service providers should be diligent in reviewing possible vulnerabilities. As a general practice, they should evaluate them quarterly, if not monthly. Some of the best service providers are checking much more frequently with systems in place to scan and alert in real time. There are certainly a number of tools and authentication processes that MSPs can deploy to better secure the platforms and how you access them. In addition, there are systems designed to monitor and alert on these types of vulnerabilities. A service provider should have a regimented assessment strategy based on common standards like the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and the emerging Cybersecurity Maturity Model Certification (CMMC) guidelines to review key systems and policies annually.

Although not directly connected to systems vulnerabilities, the human element can be the weakest point in any network. All team members should have continued education and awareness to become more knowledgeable about what’s possible. The best partners are extending these campaigns into their customer environments in the hopes that a more informed employee is less likely to fall victim to simple threats.

CF: How can the channel work together to stop the exploitation of these RMM platform vulnerabilities?

CN: We should have a set of security standards that we all adhere to in order to demonstrate that we are safe to work with. If we don’t start doing more to lock down our own internal tools, the MSP industry will lose credibility among many organizations that continue to get exploited by MSPs who are supposed to be protecting them.

EP: The channel can be the biggest collective voice to connect service providers to the range of tools available. Working together as a community, when vulnerabilities are discovered, the collective action should be to not only remedy your own network, but to communicate the concern to both vendors and peers in hopes of preventing large scale attack. This session should be a great step in that direction.

CF: What do you hope attendees learn and can make use of from this session?

CN: The importance of identifying and securing any admin accounts they have with any vendor, not just RMM vendors. So enable MFA and be sure you have a SOC team that can monitor your own internal systems, including endpoints, email and remote access tools that touch your client systems.