Sepio Systems, announced a product to mitigate hardware-based cyber-attacks from manipulated peripherals, transparent network devices, and firmware vulnerabilities. The software solution has been deployed in over 20 mid to large banks, insurance, and telecom companies in the US, Singapore, Brazil, and Israel. The current install base secures over 600,000 workstations and network ports.
Yossi Appleboum, CEO of Sepio Systems said in a statement that targetting an organization is often as simple as replacing a trusted peripheral with a manipulated one. For example, the firm discovered multiple Raspberry Pi computer modules, that include wireless connectivity, implanted in keyboards that were used for exfiltration attacks. The implant was emulating keyboard keystrokes to infect the workstation and steal data and was running undetected before Sepio’s RDM was deployed, he explained.
In another incident, an off-the-shelf network router was used for infiltrating a tier 1 bank. This tiny device was plugged in-line between a printer and the enterprise network, allowing covert remote access into the bank’s IT systems. Sepio’s software was able to trace this rogue device based on its physical fingerprint.
“Manipulated devices, intentionally used by insiders or socially engineered employees, are causing significant damages. We also witness an increasing number of penetrated uncontrolled supply chains that deliver infected equipment.” said Appleboum.
“While companies were focused on their software cyber risks, they overlooked the threat coming from their hardware. Users can not install unregulated software on a corporate computer but can easily connect an uncontrolled hardware accessory.”
Sepio Prime provides security teams with full visibility into their hardware assets and their behavior in real time. A comprehensive policy enforcement module allows administrators to easily define granular device usage rules and continuously monitor and protect their infrastructure.
Using a combination of physical fingerprinting technology together with device behavior analytics, Sepio’s software-only solution offers instant detection and response to any threat or breach attempt that coming from a manipulated or infected element.