Malware Devil

Friday, February 12, 2021

Network Security News Summary for Friday February 12nd, 2021

A brief daily summary of what is important in cybersecurity. The podcast is published every weekday and designed to get you ready for the day with a brief, usually about 5 minutes long, summary of current network security-related events. The content is late breaking, educational and based on listener input as well as on input received by the SANS Internet Storm Center. You may submit questions and comments via our contact form at https://isc.sans.edu/contact.html .

The post Network Security News Summary for Friday February 12nd, 2021 appeared first on Malware Devil.

https://malwaredevil.com/2021/02/12/network-security-news-summary-for-friday-february-12nd-2021/?utm_source=rss&utm_medium=rss&utm_campaign=network-security-news-summary-for-friday-february-12nd-2021

When Organizations Take a Risk-First Approach to IT Compliance, They’re Better at Avoiding Security Incidents

Cybersecurity and IT risk management professionals know that staying on top of security is a constant battle. Cyber …

The post When Organizations Take a Risk-First Approach to IT Compliance, They’re Better at Avoiding Security Incidents appeared first on Hyperproof.

The post When Organizations Take a Risk-First Approach to IT Compliance, They’re Better at Avoiding Security Incidents appeared first on Security Boulevard.

The post When Organizations Take a Risk-First Approach to IT Compliance, They’re Better at Avoiding Security Incidents appeared first on Malware Devil.

https://malwaredevil.com/2021/02/12/when-organizations-take-a-risk-first-approach-to-it-compliance-theyre-better-at-avoiding-security-incidents/?utm_source=rss&utm_medium=rss&utm_campaign=when-organizations-take-a-risk-first-approach-to-it-compliance-theyre-better-at-avoiding-security-incidents

ITOM: hacia una gestión de operaciones de última generación

El 2020 marcó un punto de inflexión a nivel mundial. Desde las relaciones humanas hasta los modelos económicos, todo ha sufrido una transformación de grandes proporciones mediada por la digitalización. La gestión de operaciones no es inmune a estos cambios. …

The post ITOM: hacia una gestión de operaciones de última generación appeared first on ManageEngine Blog.

The post ITOM: hacia una gestión de operaciones de última generación appeared first on Security Boulevard.

The post ITOM: hacia una gestión de operaciones de última generación appeared first on Malware Devil.

https://malwaredevil.com/2021/02/12/itom-hacia-una-gestion-de-operaciones-de-ultima-generacion/?utm_source=rss&utm_medium=rss&utm_campaign=itom-hacia-una-gestion-de-operaciones-de-ultima-generacion

Harvard’s Mandatory Course on Race and Racism in America

Is it unethical and irresponsible to train public leaders without requiring a course on how race and power work? Yes. Is the Stanford University able to overcome their racist and genocidal namesake with just a mandatory course on race, power, and business. No. Harvard Kennedy School, however, already is in a better place with its … Continue reading Harvard’s Mandatory Course on Race and Racism in America →

The post Harvard’s Mandatory Course on Race and Racism in America appeared first on Security Boulevard.

The post Harvard’s Mandatory Course on Race and Racism in America appeared first on Malware Devil.

https://malwaredevil.com/2021/02/12/harvards-mandatory-course-on-race-and-racism-in-america/?utm_source=rss&utm_medium=rss&utm_campaign=harvards-mandatory-course-on-race-and-racism-in-america

Thursday, February 11, 2021

Buffalo Soldiers: America’s First Park Rangers

Recently I found out blacks invented mountain biking in America. In that history I found multiple references to Buffalo Soldiers being the first park rangers in America. In 1869, Congress established four all-black regiments within the Army – the 9th and 10th Cavalry and the 24th and 25th Infantry. These soldiers, known for their fierce … Continue reading Buffalo Soldiers: America’s First Park Rangers →

The post Buffalo Soldiers: America’s First Park Rangers appeared first on Security Boulevard.

The post Buffalo Soldiers: America’s First Park Rangers appeared first on Malware Devil.

https://malwaredevil.com/2021/02/11/buffalo-soldiers-americas-first-park-rangers/?utm_source=rss&utm_medium=rss&utm_campaign=buffalo-soldiers-americas-first-park-rangers

Ransomware Attackers Set Their Sights on SaaS

Ransomware has begun to target data-heavy SaaS applications, open source, and Web and application frameworks.

Ransomware attacks have begun to more heavily target software applications, open source tools, and Web and application frameworks as attackers seek more direct paths to organizations’ largest and most important data stores.

The ransomware threat landscape has seen tremendous growth in the past few years alone, RiskSense researchers report in a new study, “Ransomware – Through the Lens of Threat and Vulnerability Management.” They detected 223 vulnerabilities associated with 125 ransomware families, a massive increase from their 2019 findings of 57 CVEs tied to 19 ransomware families.

These attackers are diversifying their targets, moving “up the stack” to target software-as-a-service (SaaS) applications and remote technology. Ransomware is now taking over the application layer, explains RiskSense CEO Srinivas Mukkamala, a shift that shows how attackers are adapting as businesses move more of their operations to the cloud.

“This year, what we found even more interesting was it’s not [only] touching your SaaS applications, open source software, and open source libraries,” he says of ransomware. “It didn’t stop there. It started going after the perimeter technologies, like your VPNs, remote access services, and zero trust.”

He calls it a “very fast shift.” It took attackers several years to begin targeting the application layer; however, it was only within the past two years that researchers noticed the types of exploits attackers used, and the layers they targeted “dramatically changed.”

Data-dense applications are hot targets. SaaS had the highest count of vulnerabilities seen trending with active exploits among ransomware families, researchers point out in their report.

Researchers noticed 18 CVEs tied to ransomware found across WordPress, Apache Struts, Java, PHP, Drupal, and ASP.net, all of which are major components of the Web and application framework space. Open source and related projects are also targets – 19 CVEs tied to ransomware exist in Jenkins, MySQL, OpenStack, TomCat, Elasticsearch, OpenShift, JBoss, and Nomad. Anything that holds a lot of data, or is responsible for the deployment of data, has become appealing to attackers. To Mukkamala, the shift “makes perfect sense.”

“Wherever there was data density, we started seeing ransomware go: CRM tools, open source tools that are used in your data pipelines, backup services, remote access services,” he adds. “Call it the work-from-home tech frenzy.”

How They’re Breaking In
Attackers are also looking for more severe vulnerabilities to reach these targets – namely, those that are capable of remote code execution (RCE) or privilege escalation (PE) when exploited.

Between 2018 and 2020, more than 25% of CVEs used in ransomware attacks were considered “dangerous,” meaning they were capable of RCE or PE and had weaponized exploits. While the number of weaponized vulnerabilities went down overall, the number of RCE/PE flaws increased. Researchers report more than 25% of newly published CVEs pose a higher risk to organizations due to these RCE/PE capabilities.

“They don’t need the human intervention anymore,” says Mukkamala of the preference for RCE and PE flaws. “They’re looking at vulnerabilities that can be remotely exploited – vulnerabilities that will allow them to escalate privileges. That’s a very interesting trend we have seen in the last year.”

Nearly all (96%) vulnerabilities used in ransomware attacks were reported in the US National Vulnerability Database (NVD) before 2019. Of these, 120 were actively used in ransomware attacks that trended in the past 10 years, and 87 are currently trending (2018-2020). The largest contributors in ransomware attacks are vulnerabilities disclosed in 2017, 2018, and 2019.

“What we really see is ransomware successfully using software weaknesses, misconfigurations, and coding errors that people are not paying attention to,” he explains. While some attackers use zero-days, these are growing rarer as known vulnerabilities continue to prove successful.

The Ransomware Family Tree Grows
Researchers identified 125 ransomware families using 223 CVEs. Some of the more prominent families include Crypwall, which uses 66 CVEs, Locky (64), Cerber (62), Cryptesla (56), GandCrab (51), Cryptomix (50), Reveton (46), and Waltrix (45). Of the ransomware families detected, 42 only use vulnerabilities reported in 2019 or earlier, with the oldest flaw reported in 2010.

The number of ransomware families has continued to grow as new players enter the scene, joining old groups that continue to operate. Some, such as Cobralocker and Lokibot, have been running since 2012 and don’t show any signs of retiring, researchers note.

Mukkamala says these groups continue to stay relevant by adding new vulnerabilities and exploits to their arsenals. The tremendous growth in ransomware families shows there are plenty of targets, and plenty of opportunities, for ransomware campaigns to succeed.

“There’s so much available,” he adds. “Everyone has a piece of the share … there’s still a lot of room for these guys, and people are paying. Why wouldn’t they stop?”

He advises organizations to defend against evolving ransomware threats by first understanding their exposure. Knowing where they are vulnerable is a key first step in ransomware defense.

“Understand your exposure, map it to your attack surface,” he explains. “What is your addressable attack surface, and what is your exposure to it? First do your external and then quickly move to your internal. Do not ignore internal.”

Based on this knowledge, IT and security teams will have a better idea of where they need to address areas of exposure to ransomware.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial … View Full Bio

Recommended Reading:

Comment |

Email This |

Print |

RSS

More Insights

Webcasts

Strategies for Success with Digital Transformation

More Webcasts

White Papers

How To Recon Like An Attacker

Building the SOC of the Future

More White Papers

Reports

Are Unprotected Cloud Databases Leaking Your Data?

Special Report: Understanding Your Cyber Attackers

More Reports

The post Ransomware Attackers Set Their Sights on SaaS appeared first on Malware Devil.

https://malwaredevil.com/2021/02/11/ransomware-attackers-set-their-sights-on-saas-2/?utm_source=rss&utm_medium=rss&utm_campaign=ransomware-attackers-set-their-sights-on-saas-2

Ransomware Attackers Set Their Sights on SaaS

Ransomware has begun to target data-heavy SaaS applications, open source, and Web and application frameworks.

The post Ransomware Attackers Set Their Sights on SaaS appeared first on Malware Devil.

https://malwaredevil.com/2021/02/11/ransomware-attackers-set-their-sights-on-saas/?utm_source=rss&utm_medium=rss&utm_campaign=ransomware-attackers-set-their-sights-on-saas

Growing Collaboration Among Criminal Groups Heightens Ransomware Threat for Healthcare Sector

Expect increase in ransomware and ‘triple extortion’ attacks, Cyber Threat Intelligence League says.

Increased communication and collaboration among cybercrime groups is heightening the ransomware threat for the healthcare sector, according to the Cyber Threat Intelligence League (CTI League), a group that since last March has been functioning as a global volunteer emergency response center for healthcare organizations.

In a report Thursday summarizing its efforts over the past year, the CTI League says it expects ransomware attacks and activities like the trading and selling of databases containing protected health information (PHI) to increase this year. The group also expects an increase in “triple extortion” attacks involving the use of ransomware, data theft, and distributed denial-of-service (DDoS) attacks as leverage to extort money from healthcare entities.

CTI League says it observed increased demand in 2020 for backdoor access to healthcare networks — usually in the form of vulnerable Remote Desktop Protocol (RDP) services — and also an increase in the number of brokers leaking, acquiring, and selling that access. COVID-19-themed lures were and will continue to be a central part of phishing, social engineering scams, and information campaigns that seek to exploit fear and curiosity over the pandemic.

The central role that healthcare services play in fighting the global COVID-19 pandemic — and therefore their perceived increased susceptibility to extortion attempts — will continue to make hospitals and other healthcare services prime targets for cybercriminals in 2021, according to the CTI League report.

Sean O’Connor, leader of the CTI League’s Dark team, says healthcare organizations should expect the ransomware landscape in 2021 to mirror last year’s landscape in terms of increasing attacks, number of new ransomware groups, and new variants that will surface.

A lot of the activity is being driven by what O’Connor describes as a confluence of events. Among them is the proliferation of dark markets and supply chains offering ransomware-as-a-service that have significantly lowered barriers to entry for cybercriminals. Another major factor is the growing communication and collaboration within the cybercriminal ecosystem on ransomware attacks targeting the healthcare sector.

Rather than just competing with each other, ransomware groups increasingly appear willing to observe and learn from each other and to adapt and apply tactics and extortion methods that have worked for other groups. As one example, O’Connor points to the operators of REvil, one of the most prolific ransomware strains targeting healthcare organizations, openly complimenting and then using the triple extortion tactics used by the operators of DarkSide, another major ransomware threat.

CTI League researchers have also observed collaboration between groups on the use of initial access brokers and money-laundering services — such as Russia’s Darknet market Hydra, O’Connor says. Groups have even begun copying each other’s ransom notes, and some are picking up where others are leaving off, he says. When the operators of the Maze and Sekhmet ransomware families began tapering off operations, the Egregor family began increasing its victim count, he says.

“Ransomware is a rapidly evolving threat due to the increased collaboration within the cybercriminal ecosystem,” O’Connor notes.

The CTI League’s analysis of ransomware data over the past year identified Maze, Conti, Netwalker, REvil, and Ryuk as the top ransomware variants that impacted healthcare organizations. In total, these ransomware families impacted over 100 healthcare organizations around the world, with over two-thirds of the victims located in North America and Europe.

A CERT of Sorts
The CTI League presently comprises more than 1,500 cybersecurity experts from around the world who are working on a volunteer basis to help healthcare organizations deal with cyberthreats in the midst of the pandemic. It acts like a hub for collecting and disseminating threat and threat actor info to organizations in the sector and others, including law enforcement, government agencies, and telcos. Group members also lend their expertise in threat takedown efforts.

“In one year of the CTI League, we understand how vulnerable and, accordingly, how targeted the healthcare sector is,” says Ohad Zaidenberg, founder and executive of CTI League.

Since launching last March, the CTI League has helped multiple healthcare organizations address ransomware threats, he says. As one example, he points to last October when a threat group encrypted computers belonging to 30 healthcare providers, causing severe disruptions in the process. CTI League volunteers used information on the attack released by the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) and its own intelligence to identify the adversary’s command-and-control infrastructure to track victims and warn potential targets. A 28-member task force also helped in lawful takedowns of the attacker’s infrastructure.

Zaidenberg compares the work his team is doing to that of a computer emergency response team (CERT) except that it is open to everyone. The goal is to “protect hospitals that can’t afford to pay for protection, for hospitals and emergency services that don’t know how to do it, and to assist law enforcement organization in their fight for the public safety,” he says.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Recommended Reading:

Comment |

Email This |

Print |

RSS

More Insights

Webcasts

Optimizing App Performance in the Cloud

More Webcasts

White Papers

How To Recon Like An Attacker

Buyer’s Guide to Next-Gen Cloud Security Posture Management (CSPM)

More White Papers

Reports

The State of Threat Detection and Response

2020 State of Cybersecurity Operations and Incident Response

More Reports

The post Growing Collaboration Among Criminal Groups Heightens Ransomware Threat for Healthcare Sector appeared first on Malware Devil.

https://malwaredevil.com/2021/02/11/growing-collaboration-among-criminal-groups-heightens-ransomware-threat-for-healthcare-sector-2/?utm_source=rss&utm_medium=rss&utm_campaign=growing-collaboration-among-criminal-groups-heightens-ransomware-threat-for-healthcare-sector-2

Pandemic Initially Led to Fewer Disclosed Vulnerabilities, Data Suggests

Vulnerability disclosure started off slow but caught up by the end of the year, according to a new report.

The number of vulnerabilities disclosed to the public initially declined in 2020 but, by the end of the year, caught up to within 1% of the total number of flaws reported in 2019, according to data published on Thursday by Risk Based Security, a vulnerability intelligence firm.

Overall, companies and researchers published information on at least 23,269 software flaws in 2020, but the number of reported vulnerabilities initially lagged behind the previous year’s numbers by more than 10% in the first quarter. While the reason for the initial disruption in the number of reported issues remains unclear, a variety of factors could have come into play — from layoffs of security researchers, to additional security work, to disruptions in the reporting process, says Brian Martin, vice president of vulnerability intelligence at Risk Based Security.

“The statistics support that COVID did influence disclosure to some degree,” Martin says. “We still do not know how, or in what ways — whether due to work from home or layoffs. There are a lot of things that could have affected vulnerability disclosures.”

In addition to documenting the effects of the pandemic on vulnerability disclosure, the annual report also found that researchers had increasingly focused on finding security issues in Microsoft’s core operating systems. In 2020, four versions of the Windows operating system made the top 10 list for reported vulnerabilities, a reversal from 2019, when no Windows products made the list.

“Windows was the real standout,” Martin says. “The increases are definitely in line with what we saw in terms of Patch Tuesdays getting bigger.”

Patch Tuesdays are the second Tuesday of the month, on which Microsoft has traditionally — since 2003 — regularly released patches. Other software vendors, such as Adobe and Oracle, often release on the same day. When a handful of vendors all release patches, security administrators may have to deal with applying updates to close hundreds of vulnerabilities. On April 14, 2020, for example, vendors released patches for 522 issues, according to Risk Based Security.

The increasing number of vulnerabilities raises concerns about how much security efforts have paid off, says Martin. Microsoft has implemented its Secure Development Lifecycle (SDLC), instituted bug bounties, and conducted more automated testing, but the consistently high number of vulnerabilities suggests that such processes aren’t having as much impact. An alternative explanation is that the codebase has expanded, so that even cleaner code results in an overall plateau in the number of issues.

“The question that many people are asking is: Where is this greener pasture, when all of our work pays off and we get fewer vulnerabilities?” he says.

The news is not all bad. Reported vulnerabilities are generally fixed more quickly and exploiting the issues has become more difficult, Martin says. “To some degree, it is working — usually, exploiting a single vulnerability is not enough. Instead, it takes chaining exploits for three vulnerabilities together, but the number of vulnerabilities has not declined,” he says.

Risk Based Security typically uncovers more issues than tracked in the National Vulnerability Database (NVD), an online collection — maintained by the US National Institute of Standards and Technology (NIST) — of information of software flaws that have been assigned a Common Vulnerability and Exposures (CVE) identifier.

In the past four years, driven by changes in the CVE process, the number of vulnerabilities added to the NVD shot up each year, more than doubling in 2017 to top 14,600 reported issues, up from nearly 6,500 issues the previous year. Since then, the volume of vulnerabilities has slowly climbed, reaching 18,353 published flaws in 2020.

Risk Based Security has published a roughly similar volume of vulnerabilities for the past four years, ranging from 22,665 in 2017 to a high of 23,508 in 2018.

The company notes that more vulnerabilities are being reported in mobile operating systems and applications. Android and Google mobile software have landed on the top 10 list of vulnerable operating systems.

“That little phone you are carrying in your pocket is now seeing as many vulnerabilities as the large software systems are,” Martin says. “It is becoming increasingly important that you patch your devices as soon as possible.”

For companies, the expanding vulnerability surface area means that, without prioritization, companies are now having a hard time focusing on the vulnerabilities that pose the most risk, he says.

“So, we are still left with a whack-a-mole game,” Martin says, “where you have to prioritize vulnerabilities and rely on defense in depth to make sure that any compromise is quickly stopped.”

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT’s Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline … View Full Bio

Recommended Reading:

Comment |

Email This |

Print |

RSS

More Insights

Webcasts

Strategies for Success with Digital Transformation

More Webcasts

White Papers

How To Recon Like An Attacker

More White Papers

Reports

Building the SOC of the Future

DNS Network Traffic Volumes During the 2020 Pandemic

More Reports

The post Pandemic Initially Led to Fewer Disclosed Vulnerabilities, Data Suggests appeared first on Malware Devil.

https://malwaredevil.com/2021/02/11/pandemic-initially-led-to-fewer-disclosed-vulnerabilities-data-suggests-2/?utm_source=rss&utm_medium=rss&utm_campaign=pandemic-initially-led-to-fewer-disclosed-vulnerabilities-data-suggests-2

Pre-Valentine’s Day Malware Attack Mimics Flower, Lingerie Stores

Emails pretending to confirm hefty orders from lingerie shop Ajour Lingerie and flower store Rose World are actually spreading the BazaLoader malware.
Read More

The post Pre-Valentine’s Day Malware Attack Mimics Flower, Lingerie Stores appeared first on Malware Devil.

https://malwaredevil.com/2021/02/11/pre-valentines-day-malware-attack-mimics-flower-lingerie-stores/?utm_source=rss&utm_medium=rss&utm_campaign=pre-valentines-day-malware-attack-mimics-flower-lingerie-stores

Growing Collaboration Among Criminal Groups Heightens Ransomware Threat for Healthcare Sector

Expect increase in ransomware and ‘triple extortion’ attacks, Cyber Threat Intelligence League says.

The post Growing Collaboration Among Criminal Groups Heightens Ransomware Threat for Healthcare Sector appeared first on Malware Devil.

https://malwaredevil.com/2021/02/11/growing-collaboration-among-criminal-groups-heightens-ransomware-threat-for-healthcare-sector/?utm_source=rss&utm_medium=rss&utm_campaign=growing-collaboration-among-criminal-groups-heightens-ransomware-threat-for-healthcare-sector

Pandemic Initially Led to Fewer Disclosed Vulnerabilities, Data Suggests

Vulnerability disclosure started off slow but caught up by the end of the year, according to a new report.

The post Pandemic Initially Led to Fewer Disclosed Vulnerabilities, Data Suggests appeared first on Malware Devil.

https://malwaredevil.com/2021/02/11/pandemic-initially-led-to-fewer-disclosed-vulnerabilities-data-suggests/?utm_source=rss&utm_medium=rss&utm_campaign=pandemic-initially-led-to-fewer-disclosed-vulnerabilities-data-suggests

AA21-042A: Compromise of U.S. Water Treatment Facility

Original release date: February 11, 2021

Summary

On February 5, 2021, unidentified cyber actors obtained unauthorized access to the supervisory control and data acquisition (SCADA) system at a U.S. drinking water treatment plant. The unidentified actors used the SCADA system’s software to increase the amount of sodium hydroxide, also known as lye, a caustic chemical, as part of the water treatment process. Water treatment plant personnel immediately noticed the change in dosing amounts and corrected the issue before the SCADA system’s software detected the manipulation and alarmed due to the unauthorized change. As a result, the water treatment process remained unaffected and continued to operate as normal. The cyber actors likely accessed the system by exploiting cybersecurity weaknesses, including poor password security, and an outdated operating system. Early information indicates it is possible that a desktop sharing software, such as TeamViewer, may have been used to gain unauthorized access to the system. Onsite response to the incident included Pinellas County Sheriff Office (PCSO), U.S. Secret Service (USSS), and the Federal Bureau of Investigation (FBI).

The FBI, the Cybersecurity and Infrastructure Security Agency (CISA), the Environmental Protection Agency (EPA), and the Multi-State Information Sharing and Analysis Center (MS-ISAC) have observed cyber criminals targeting and exploiting desktop sharing software and computer networks running operating systems with end of life status to gain unauthorized access to systems. Desktop sharing software, which has multiple legitimate uses—such as enabling telework, remote technical support, and file transfers—can also be exploited through malicious actors’ use of social engineering tactics and other illicit measures. Windows 7 will become more susceptible to exploitation due to lack of security updates and the discovery of new vulnerabilities. Microsoft and other industry professionals strongly recommend upgrading computer systems to an actively supported operating system. Continuing to use any operating system within an enterprise beyond the end of life status may provide cyber criminals access into computer systems.

Click here for a PDF version of this report.

Technical Details

Desktop Sharing Software

The FBI, CISA, EPA, and MS-ISAC have observed corrupt insiders and outside cyber actors using desktop sharing software to victimize targets in a range of organizations, including those in the critical infrastructure sectors. In addition to adjusting system operations, cyber actors also use the following techniques:

Use access granted by desktop sharing software to perform fraudulent wire transfers.
Inject malicious code that allows the cyber actors to
- Hide desktop sharing software windows,
- Protect malicious files from being detected, and
- Control desktop sharing software startup parameters to obfuscate their activity.
Move laterally across a network to increase the scope of activity.

TeamViewer, a desktop sharing software, is a legitimate popular tool that has been exploited by cyber actors engaged in targeted social engineering attacks, as well as large scale, indiscriminate phishing campaigns. Desktop sharing software can also be used by employees with vindictive and/or larcenous motivations against employers.

Beyond its legitimate uses, TeamViewer allows cyber actors to exercise remote control over computer systems and drop files onto victim computers, making it functionally similar to Remote Access Trojans (RATs). TeamViewer’s legitimate use, however, makes anomalous activity less suspicious to end users and system administrators compared to RATs.

Windows 7 End of Life

On January 14, 2020, Microsoft ended support for the Windows 7 operating system, which includes security updates and technical support unless certain customers purchased an Extended Security Update (ESU) plan. The ESU plan is paid per-device and available for Windows 7 Professional and Enterprise versions, with an increasing price the longer a customer continues use. Microsoft will only offer the ESU plan until January 2023. Continued use of Windows 7 increases the risk of cyber actor exploitation of a computer system.

Cyber actors continue to find entry points into legacy Windows operating systems and leverage Remote Desktop Protocol (RDP) exploits. Microsoft released an emergency patch for its older operating systems, including Windows 7, after an information security researcher discovered an RDP vulnerability in May 2019. Since the end of July 2019, malicious RDP activity has increased with the development of a working commercial exploit for the vulnerability. Cyber actors often use misconfigured or improperly secured RDP access controls to conduct cyberattacks. The xDedic Marketplace, taken down by law enforcement in 2019, flourished by compromising RDP vulnerabilities around the world.

Mitigations

General Recommendations

The following cyber hygiene measures may help protect against the aforementioned scheme:

Update to the latest version of the operating system (e.g., Windows 10).
Use multiple-factor authentication.
Use strong passwords to protect Remote Desktop Protocol (RDP) credentials.
Ensure anti-virus, spam filters, and firewalls are up to date, properly configured, and secure.
Audit network configurations and isolate computer systems that cannot be updated.
Audit your network for systems using RDP, closing unused RDP ports, applying multiple-factor authentication wherever possible, and logging RDP login attempts.
Audit logs for all remote connection protocols.
Train users to identify and report attempts at social engineering.
Identify and suspend access of users exhibiting unusual activity.

Water and Wastewater Systems Security Recommendations

The following physical security measures serve as additional protective measures:

Install independent cyber-physical safety systems. These are systems that physically prevent dangerous conditions from occurring if the control system is compromised by a threat actor.
Examples of cyber-physical safety system controls include:
- Size of the chemical pump
- Size of the chemical reservoir
- Gearing on valves
- Pressure switches, etc.

The benefit of these types of controls in the water sector is that smaller systems, with limited cybersecurity capability, can assess their system from a worst-case scenario. The operators can take physical steps to limit the damage. If, for example, cyber actors gain control of a sodium hydroxide pump, they will be unable to raise the pH to dangerous levels.

TeamViewer Software Recommendations

For a more secured implementation of TeamViewer software:

Do not use unattended access features, such as “Start TeamViewer with Windows” and “Grant easy access.”
Configure TeamViewer service to “manual start,” so that the application and associated background services are stopped when not in use.
Set random passwords to generate 10-character alphanumeric passwords.
If using personal passwords, utilize complex rotating passwords of varying lengths. Note: TeamViewer allows users to change connection passwords for each new session. If an end user chooses this option, never save connection passwords as an option as they can be leveraged for persistence.
When configuring access control for a host, utilize custom settings to tier the access a remote party may attempt to acquire.
Require remote party to receive confirmation from the host to gain any access other than “view only.” Doing so will ensure that, if an unauthorized party is able to connect via TeamViewer, they will only see a locked screen and will not have keyboard control.
Utilize the ‘Block and Allow’ list which enables a user to control which other organizational users of TeamViewer may request access to the system. This list can also be used to block users suspected of unauthorized access.

Contact Information

To report suspicious or criminal activity related to information found in this Joint Cybersecurity Advisory, contact your local FBI field office at www.fbi.gov/contact-us/field, or the FBI’s 24/7 Cyber Watch (CyWatch) at (855) 292-3937 or by e-mail at CyWatch@fbi.gov or your local WMD Coordinator. When available, please include the following information regarding the incident: date, time, and location of the incident; type of activity; number of people affected; type of equipment used for the activity; the name of the submitting company or organization; and a designated point of contact.

To request incident response resources or technical assistance related to these threats, contact CISA at Central@cisa.dhs.gov.

Revisions

February 11, 2021: Initial Version

This product is provided subject to this Notification and this Privacy & Use policy.

The post AA21-042A: Compromise of U.S. Water Treatment Facility appeared first on Malware Devil.

https://malwaredevil.com/2021/02/11/aa21-042a-compromise-of-u-s-water-treatment-facility-2/?utm_source=rss&utm_medium=rss&utm_campaign=aa21-042a-compromise-of-u-s-water-treatment-facility-2

AA21-042A: Compromise of U.S. Water Treatment Facility

Original release date: February 11, 2021SummaryOn February 5, 2021, unidentified cyber actors obtained unauthorized access to the supervisory control and data acquisition (SCADA) system at a U.S. drinking water treatment plant. The unidentified actors used the SCADA system’s software to increase the amount of sodium hydroxide, also known as lye, a caustic chemical, as part of the water treatment process. Water treatment plant personnel immediately noticed the change in dosing amounts and corrected the issue before the SCADA system’s software detected the manipulation and alarmed due to the unauthorized change. As a result, the water treatment process remained unaffected and continued to operate as normal. The cyber actors likely accessed the system by exploiting cybersecurity weaknesses, including poor password security, and an outdated operating system. Early information indicates it is possible that a desktop sharing software, such as TeamViewer, may have been used to gain unauthorized access to the system. Onsite response to the incident included Pinellas County Sheriff Office (PCSO), U.S. Secret Service (USSS), and the Federal Bureau of Investigation (FBI).

Click here for a PDF version of this report.
Technical DetailsDesktop Sharing Software

Use access granted by desktop sharing software to perform fraudulent wire transfers.
Inject malicious code that allows the cyber actors to

Hide desktop sharing software windows,
Protect malicious files from being detected, and
Control desktop sharing software startup parameters to obfuscate their activity.

Move laterally across a network to increase the scope of activity.

Windows 7 End of Life

The following cyber hygiene measures may help protect against the aforementioned scheme:

Update to the latest version of the operating system (e.g., Windows 10).
Use multiple-factor authentication.
Use strong passwords to protect Remote Desktop Protocol (RDP) credentials.
Ensure anti-virus, spam filters, and firewalls are up to date, properly configured, and secure.
Audit network configurations and isolate computer systems that cannot be updated.
Audit your network for systems using RDP, closing unused RDP ports, applying multiple-factor authentication wherever possible, and logging RDP login attempts.
Audit logs for all remote connection protocols.
Train users to identify and report attempts at social engineering.
Identify and suspend access of users exhibiting unusual activity.

Water and Wastewater Systems Security Recommendations

The following physical security measures serve as additional protective measures:

Install independent cyber-physical safety systems. These are systems that physically prevent dangerous conditions from occurring if the control system is compromised by a threat actor.
Examples of cyber-physical safety system controls include:

Size of the chemical pump
Size of the chemical reservoir
Gearing on valves
Pressure switches, etc.

TeamViewer Software Recommendations

For a more secured implementation of TeamViewer software:

Do not use unattended access features, such as “Start TeamViewer with Windows” and “Grant easy access.”
Configure TeamViewer service to “manual start,” so that the application and associated background services are stopped when not in use.
Set random passwords to generate 10-character alphanumeric passwords.
If using personal passwords, utilize complex rotating passwords of varying lengths. Note: TeamViewer allows users to change connection passwords for each new session. If an end user chooses this option, never save connection passwords as an option as they can be leveraged for persistence.
When configuring access control for a host, utilize custom settings to tier the access a remote party may attempt to acquire.
Require remote party to receive confirmation from the host to gain any access other than “view only.” Doing so will ensure that, if an unauthorized party is able to connect via TeamViewer, they will only see a locked screen and will not have keyboard control.
Utilize the ‘Block and Allow’ list which enables a user to control which other organizational users of TeamViewer may request access to the system. This list can also be used to block users suspected of unauthorized access.

Contact InformationTo report suspicious or criminal activity related to information found in this Joint Cybersecurity Advisory, contact your local FBI field office at www.fbi.gov/contact-us/field, or the FBI’s 24/7 Cyber Watch (CyWatch) at (855) 292-3937 or by e-mail at CyWatch@fbi.gov or your local WMD Coordinator. When available, please include the following information regarding the incident: date, time, and location of the incident; type of activity; number of people affected; type of equipment used for the activity; the name of the submitting company or organization; and a designated point of contact.

To request incident response resources or technical assistance related to these threats, contact CISA at Central@cisa.dhs.gov.
Revisions
February 11, 2021: Initial Version

This product is provided subject to this Notification and this Privacy & Use policy.
Read More

The post AA21-042A: Compromise of U.S. Water Treatment Facility appeared first on Malware Devil.

https://malwaredevil.com/2021/02/11/aa21-042a-compromise-of-u-s-water-treatment-facility/?utm_source=rss&utm_medium=rss&utm_campaign=aa21-042a-compromise-of-u-s-water-treatment-facility

Zombie Accounts Can Take a Bite Out of Your Business

Do you have old online accounts that you never use? Those zombie accounts can put your company in danger. Here’s how to stop it.

The post Zombie Accounts Can Take a Bite Out of Your Business appeared first on Security Boulevard.

The post Zombie Accounts Can Take a Bite Out of Your Business appeared first on Malware Devil.

https://malwaredevil.com/2021/02/11/zombie-accounts-can-take-a-bite-out-of-your-business/?utm_source=rss&utm_medium=rss&utm_campaign=zombie-accounts-can-take-a-bite-out-of-your-business

BSidesSF 2020 – Dylan Ayrey’s, Allison Donovan’s ‘The GCP Metadata API’

Our thanks to BSidesSF and Conference Speakers for publishing their outstanding presentations; which originally appeared at the group’s BSidesSF 2020 Conference, and on the Organization’s YouTube Channel. Additionally, the BSidesSF 2021 Conference will take place on March 6 – 9, 2021 – with no cost to participate. Enjoy!

Permalink

The post BSidesSF 2020 – Dylan Ayrey’s, Allison Donovan’s ‘The GCP Metadata API’ appeared first on Security Boulevard.

The post BSidesSF 2020 – Dylan Ayrey’s, Allison Donovan’s ‘The GCP Metadata API’ appeared first on Malware Devil.

https://malwaredevil.com/2021/02/11/bsidessf-2020-dylan-ayreys-allison-donovans-the-gcp-metadata-api/?utm_source=rss&utm_medium=rss&utm_campaign=bsidessf-2020-dylan-ayreys-allison-donovans-the-gcp-metadata-api

Microsoft Launches Phase 2 Mitigation for Zerologon Flaw

The Netlogon remote code execution vulnerability, disclosed last August, has been weaponized by APT groups.

The post Microsoft Launches Phase 2 Mitigation for Zerologon Flaw appeared first on Malware Devil.

https://malwaredevil.com/2021/02/11/microsoft-launches-phase-2-mitigation-for-zerologon-flaw-2/?utm_source=rss&utm_medium=rss&utm_campaign=microsoft-launches-phase-2-mitigation-for-zerologon-flaw-2

Microsoft Launches Phase 2 Mitigation for Zerologon Flaw

Subscribe to Newsletters

Communications & Collaboration: 2024 (March 9-10)

More Informa Tech Live Events

White Papers

Improve MITRE ATT&CK Test Results for Endpoint Security Using Deception

Balancing Hybrid Storage as Part of a Hybrid Cloud Data Management Strategy

2021 Top Enterprise IT Trends – Network Computing

7 Experts on Implementing Microsoft Defender for Endpoint

More White Papers

Video

All Videos

Cartoon

🔴 LIVE: Paul’s Security Weekly #683

This week, first we welcome Peter Smith, VP of Secure Workload Communications at ZScaler, then we dive straight into the Security News, and we wrap up the show with a special pre-recorded interview with ‘Wheel’, a Qualys researcher who was part of the team that uncovered the infamous “Baron Samedi” SUDO vuln!

→Full Show Notes: https://securityweekly.com/psw683
→Join the Security Weekly Discord Server: https://discord.gg/pqSwWm4
→Visit our website: https://www.securityweekly.com
→Follow us on Twitter: https://www.twitter.com/securityweekly

The post 🔴 LIVE: Paul’s Security Weekly #683 appeared first on Malware Devil.

https://malwaredevil.com/2021/02/11/%f0%9f%94%b4-live-pauls-security-weekly-683/?utm_source=rss&utm_medium=rss&utm_campaign=%25f0%259f%2594%25b4-live-pauls-security-weekly-683

🔴 LIVE: Paul’s Security Weekly #683

The post 🔴 LIVE: Paul’s Security Weekly #683 appeared first on Malware Devil.

https://malwaredevil.com/2021/02/11/%f0%9f%94%b4-live-pauls-security-weekly-683-2/?utm_source=rss&utm_medium=rss&utm_campaign=%25f0%259f%2594%25b4-live-pauls-security-weekly-683-2

Malware Devil

Malware Devil

Friday, February 12, 2021

Network Security News Summary for Friday February 12nd, 2021

When Organizations Take a Risk-First Approach to IT Compliance, They’re Better at Avoiding Security Incidents

ITOM: hacia una gestión de operaciones de última generación

Harvard’s Mandatory Course on Race and Racism in America

Thursday, February 11, 2021

Buffalo Soldiers: America’s First Park Rangers

Ransomware Attackers Set Their Sights on SaaS

Ransomware Attackers Set Their Sights on SaaS

Growing Collaboration Among Criminal Groups Heightens Ransomware Threat for Healthcare Sector

Pandemic Initially Led to Fewer Disclosed Vulnerabilities, Data Suggests

Pre-Valentine’s Day Malware Attack Mimics Flower, Lingerie Stores

Growing Collaboration Among Criminal Groups Heightens Ransomware Threat for Healthcare Sector

Pandemic Initially Led to Fewer Disclosed Vulnerabilities, Data Suggests

AA21-042A: Compromise of U.S. Water Treatment Facility

Summary

Technical Details

Desktop Sharing Software

Windows 7 End of Life

Mitigations

General Recommendations

Water and Wastewater Systems Security Recommendations

TeamViewer Software Recommendations

Contact Information

Revisions

AA21-042A: Compromise of U.S. Water Treatment Facility

Zombie Accounts Can Take a Bite Out of Your Business

BSidesSF 2020 – Dylan Ayrey’s, Allison Donovan’s ‘The GCP Metadata API’

Microsoft Launches Phase 2 Mitigation for Zerologon Flaw

Microsoft Launches Phase 2 Mitigation for Zerologon Flaw

🔴 LIVE: Paul’s Security Weekly #683

🔴 LIVE: Paul’s Security Weekly #683

Barbary Pirates and Russian Cybercrime

Blog Archive

About Me