As the biomedical community rushes to develop vaccines to combat COVID-19, malicious actors are seeking to steal the sensitive intellectual property that underpins treatment.
In light of these threats, Bitsight seeks to understand how the world’s Covid-19 vaccine manufacturers are performing when it comes to cybersecurity. For this study, we looked at 17 companies of varying size who have been publicly recognized for playing a big role in the global search for a Covid-19 vaccine. Five of these companies have more than 100,000 employees, four companies have between 10,000 and 100,000 employees, four companies have between 1,000 and 2,000 employees and four companies have 200 or fewer employees.
For these companies, we find a number of security issues (as of June 1, 2020). These findings are not abnormal when compared to other groups of large companies (e.g. the Fortune 1000), but given the heightened threat environment, they do provide cause for concern.
Background on Cyber Threats to Covid-19 Vaccine Developers
This week, the UK's National Cyber Security Centre (NCSC) said Russian hackers “almost certainly" operating as "part of Russian intelligence services" used malware to try and steal information relating to Covid-19 vaccine development. According to the NCSC, the group conducted basic vulnerability scanning against specific external IP addresses owned by the organisations. The group then deployed public exploits against the vulnerable services identified.
Months ago the FBI announced last week that, in a bid to win the race for a vaccine or cure, state-sponsored Chinese hackers are targeting U.S. researchers in an attempt to “obtain valuable intellectual property and public health data related to vaccines, treatments, and testing.” And in May, Reuters reported that Iran-linked hackers had targeted Gilead Sciences, makers of the promising antiviral drug Remdesivir.
Security Issues of Covid-19 Vaccine Developers
Our primary findings can be divided into four categories: Compromised Systems, Open Ports , Vulnerabilities and Web Application Security. We provide some background information on each of these issues below.
Compromised Systems of Covid-19 Vaccine Developers
A Compromised System according to our definition is a machine running malicious software (e.g. a member of a Botnet) or a system running software that user likely did not intentionally install i.e. Potentially Unwanted Software (PUA) or in our parlance “Potentially Exploited”). We also track computers which send Spam and computers behaving in abnormal ways (Unsolicited Communications) - both types of behaviors are also indicative of a compromised machine.
Looking at the recent history of these companies, we see that a significant fraction of these companies have had Compromised Systems in the past year.
|
Risk Vector |
Companies impacted in the past year |
Companies impacted in the past six months |
|
Botnet |
8 |
7 |
|
Potentially Exploited |
9 |
8 |
|
Spam |
5 |
3 |
|
Unsolicited Communications |
3 |
3 |
The presence of compromised systems is evidence of security controls failing to prevent malicious or unwanted software from running within an organization. This suggests that there are control failures that could potentially be exploited by adversaries seeking access.
Open Ports
An Open Port is a system which exposes insecure service to the open internet. Generally these types of services should either never be used or never exposed outside of a company’s firewall. For example, Telnet is a service which allows users to access another computer using an unencrypted connection. Database technologies such as MySQL should always be behind a company’s firewall. Exposing these services allows an attacker to identify potential access points into a company’s network.
The table below shows some of the services that we found running on IP addresses associated with these companies.
|
Service |
Company Count |
|
Cisco SMI |
2 |
|
Recursive DNS |
4 |
|
Telnet |
5 |
|
Microsoft RDP |
7 |
|
Exposed Printers |
