homepage
Open menu

SANS NewsBites

Hackers are Hijacking Smart Buildings for DDoS Attacks; Pentagon Sets Cybersecurity Benchmark for Contractors

February 4, 2020  |  Volume XXII - Issue #10

Top of the NewsThe Rest of the Week's NewsInternet Storm Center Tech Corner

Top of the News

2020-02-03

Hackers are Hijacking Vulnerable Smart Building Access Systems to Launch DDoS Attacks

Attackers are hijacking vulnerable smart building access systems and using them to launch distributed denial-of-service (DDoS) attacks. There has been increased scanning for Nortek Security & Control (NSC) Linear eMerge E3 systems that are vulnerable to a known critical command injection flaw.

Editor's Note

Back in late 2013, SANS held an Internet of Things Security Summit where we pointed out smart building systems as the most likely future attack path for real business damage, vs. other attacks. The growth of commercial real estate being developed with wired and wireless networks built in, and with elevator, HVAC systems on the network with remote access to all those systems means many companies are putting their internal systems onto building networks that are being run quite often at very low levels of security hygiene.

John Pescatore
John Pescatore

2020-02-03

Pentagon Releases Cybersecurity Maturity Model Certification Standard

The US Defense Department (DoD) has released the Cybersecurity Maturity Model Certification version 1.0. The framework describes the cybersecurity standards that DoD contractors must meet if they want to win contracts. CMMC will be applied to some contracts starting later this year; by 2026, all DoD contracts are expected to include CMMC.

The Rest of the Week's News

2020-02-03

EKANS Ransomware Also Kills ICS Processes

Ransomware known as EKANS not only encrypts data on infected systems, it also interrupts Industrial Control Systems (ICS) applications. Prior to encrypting data, EKANS kills 64 different ICS processes named in a static list. Some versions of MegaCortex ransomware target the same list of ICS processes.

Editor's Note

Given the frequency and success of "Ransomware" attacks, it is essential that we increase the cost of attack and improve our resilience in the face of such attacks. It is a myth that the advantage is always to the attacker. We can get a ten-fold increase in cost of attack for a relatively small increase in one's cost of security. Keep in mind that most of these victims are targets of opportunity. One does not have to "outrun the bear."

William Hugh Murray
William Hugh Murray

2020-02-03

Maze Ransomware Hits French Construction Company

A French construction company was hit with Maze ransomware on January 30. Bouygues Construction has shut down its network to prevent the ransomware from encryption additional data. The operators of Maze ransomware have gained a reputation for stealing data from targeted organizations and uploading it if the victims do not pay the ransom.

2020-01-31

Tillamook County Will Negotiate with Hackers for Decryption Key

Tillamook (Oregon) County Commissioners have voted unanimously to negotiate with hackers for the decryption key to regain access to the county's computer systems. Tillamook County systems were with with ransomware on January 22, 2020.

Editor's Note

This case illustrates the factors that have to be balanced: (1) The need for both public and private meetings to keep the public informed, including the appointment of communication officers and selection of communication means; (2) the complexity of a transition from old to new update information systems; (3) getting professional help where needed; and (4) keeping as much of business as usual operating smoothly while (5) informing the public of alternate mechanisms for offline components. The complexity shows why a verified thorough disaster recovery plan is so important.

Lee Neely
Lee Neely

It appears to be the consensus among the NewsBites editors that the decision to pay ransom is a business, not a security, decision. However, the failure to make this decision in advance of an attack is a security decision. There should be accountability.

William Hugh Murray
William Hugh Murray

2020-02-03

City of Racine, Wisconsin Hit with Ransomware

Computer systems belonging to the city of Racine, Wisconsin were infected with ransomware on January 31. As of February 3, the city's website, email, and online payment systems were still down. The attack did not affect 911 and public safety systems. Tax collection systems are also operating as usual.

2020-01-31

TVEyes Target of Ransomware Attack

Broadcast media monitoring company TVEyes was hit with ransomware early on Thursday, January 30. The company's CEO said on Friday, January 31 that they had restored servers from backups.

Editor's Note

At last a good news story relating to ransomware and evidence that reliable backups are an effective measure against ransomware.

Brian Honan
Brian Honan

Note that this may only be successful to the extent that one has addressed the vulnerabilities that led to the breach in the first place. We have seen reinfections.

William Hugh Murray
William Hugh Murray

2020-02-03

Prosecutors Drop Burglary Charges Against Coalfire Pentesters

Prosecutors in Iowa have dropped burglary charges against two people who broke into a county courthouse after hours as part of a penetration test. The two are employees of Coalfire labs, which had been hired by Iowa's State Court Administration to test the security of its IT systems and its buildings. Gary DeMercurio and Justin Wynn were arrested in September 2019 and held for hours before being released on bail. The case illustrates the need for establishing pen testing best practices.

Editor's Note

This is awesome news. An important lesson from this case is that security contractors, and especially penetration testers, have the responsibility to educate their customers on all aspects of authorized permission including specific actions and timing and to ensure a common understanding so that they have the pen tester's back when something goes awry.

Lee Neely
Lee Neely

The case illustrates the need for well documented and agreed terms of service.

William Hugh Murray
William Hugh Murray

2020-02-03

Australian Freight Company Suffers Cyberattack

Australian freight and logistics company Toll Group has shut down several of its IT systems to contain damage from a cybersecurity incident. Toll customers have experienced problems tracking shipments. The company has not released details about the nature of the cyberattack.

2020-02-03

Six Arrested in Connection with Maltese Bank Cyberattack

The UK's National Crime Agency (NCA) has arrested six people in connection with a cyberattack against Malta's Bank of Valletta. The suspects allegedly gained access to the bank's IT systems in February 2019 and made several large transfers totaling [euro]13 million (US $14.4 million). The Bank of Valletta said in May 2019 that it had recovered [euro]10 million (US $11.1 million) of the stolen funds.

Editor's Note

Prevention is easier than recovery. That said, early (within hours) reporting of fraudulent transfers to the FBI will greatly improve the chances of recovery. Do you know who to call?

William Hugh Murray
William Hugh Murray

2020-02-03

Raytheon Engineer Arrested for Taking Laptop with Missile Data to China

US federal law enforcement agents have arrested a Raytheon engineer after he took a work laptop containing missile defense systems information to China. Wei Sun has worked at Raytheon since December 2008. In December 2018, Sun traveled abroad with his work laptop in defiance of Raytheon's exhortations not to bring it on his travels. In January 2019, Sun emailed Raytheon and informed them he was resigning his position so he could study and work abroad. Sun returned to the US later that month. He initially told Raytheon security officials that he had traveled to Singapore and the Philippines, but eventually admitted that he had traveled to China, Cambodia, and Hong Kong.

Editor's Note

Mechanisms to limit sensitive data exposure include specific laptops configured for foreign travel, DLP solutions which limit data storage and access, and location-aware device management which could be used to remotely wipe a device. Even so, the employee is the critical most challenging link in the security chain. In support of the human factor, appropriate consequences with visible actions may act as a deterrent.

Lee Neely
Lee Neely

2020-01-31

Hackers Insert Themselves in eMail Conversation, Steal Payment in Fine Art Sale

The ownership of a 200-year-old painting by British artist John Constable is in question after hackers infiltrated email conversations regarding payment for the artwork. A museum in the Netherlands had agreed to purchase the painting from a British art dealer for #2.4 million ($3.1 million). Hackers sent a spoofed message directing the museum to transfer the payment into a bank account they controlled. Each party blames the other: the museum maintains that the dealer should have known that spoofed messages were sent, while the dealer maintains that the museum should have verified the details of the bank transfer.

Editor's Note

Non-routine payments must be verified out of band prior to paying: "Pick up the telephone." This the responsibility of the payer. Transfers should be confirmed out of band; this is the responsibility of the paying agent (usually the bank.) The role of reconciling confirmations should be separate from that of authorizing payments in the first place.

William Hugh Murray
William Hugh Murray

This is a classic invoice/payment redirection scam, also known as Business Email Compromise. Technical controls such DMARC, DKIM, and SPF, and also using effective email filtering solutions can help minimise the risk of this type of attack. However, as demonstrated by the blame game in this example, the human factor plays a significant part. Basic manual verification processes can often be the most effective prevention measures. Europol provides some excellent guides on how to protect against scams targeting employees https://www.europol.europa.eu/activities-services/public-awareness-and-prevention-guides/infographic-fraud-scams-targeting-employees: Infographic: Fraud Scams Targeting Employees

Brian Honan
Brian Honan

2020-01-31

NEC Acknowledges December 2016 Breach

Japan's NEC Corp. has disclosed that its systems were breached in December 2016. The company did not detect the breach until June 2017, when it noticed encrypted traffic being sent from a company server. NEC decrypted the traffic in July 2018, and found that the attackers had exfiltrated data from the company's defense business division.

Editor's Note

Mean time to detection (MTTD) of a breach needs to go from months in 2017 to days in 2020. Many companies that take cybersecurity seriously have or have nearly accomplished that goal. For others, it will never happen because they have not yet established MTTD as a key cybersecurity objective and thus they are not measuring it.

Alan Paller
Alan Paller

2020-01-31

APT34 Targeting US Company Through Spear Phishing eMail

A hacker group with ties to Iran has been sending spear phishing emails to customers and employees of a company that works with US federal, state, and local governments. The phony messages sent to Westat employees contain malicious Excel spreadsheet attachments. The spreadsheets appear to be black; if recipients enable macros, the content - a phony job satisfaction survey - appears and malware that installs the TONEDEAF backdoor is downloaded in the background.

2020-01-27

Some US Emergency Alert Systems Remain Unpatched Years After Fix Released

A vulnerability in certain emergency alert systems (EAS) that was disclosed in 2013 remains unpatched on at least 50 systems across the US. The issue lies in the web interfaces for Monroe/Digital Alert Systems EAS hardware.

Editor's Note

These systems are effectively appliances that are configured to accept and forward emergency messages. The challenge with appliance-type systems is not only monitoring them for security vulnerabilities, but also having appropriate processes in place, with accountability, to keep them updated and secure.

Lee Neely
Lee Neely

Internet Storm Center Tech Corner