homepage
Open menu

SANS NewsBites

Details on North Korean and Iranian Hacker Infiltrations; 2016 Florida Elections System Ransomware Attack

February 18, 2020  |  Volume XXII - Issue #14

Top of the NewsThe Rest of the Week's NewsInternet Storm Center Tech Corner

Top of the News

2020-02-14

Exposing North Korea's Malicious Cyber Activity

The US Department of Homeland Security's (DHS's) Cybersecurity and Infrastructure Security Agency (CISA), the FBI, and the Department of Defense (DoD) have jointly disclosed a list of malware variants that are being used by hackers working on behalf of the North Korean government.

Editor's Note

This is part of a new approach by the federal government to publicly identify the activities of foreign-based hackers. Incorporate the information from these bulletins into your IOCs and supporting processes.

Lee Neely
Lee Neely

2020-02-16

Iranian Hackers Infiltrating VPN Servers to Plant Backdoors

Researchers from ClearSky say that hackers working on behalf of Iran's government have been exploiting vulnerabilities in VPN servers to install backdoors on networks at companies around the world. The hackers have targeted organizations in the IT, telecommunications, oil and gas, government, and security sectors.

Editor's Note

This is newsworthy because of political tension between the US and Iran, but it is basically just a story that says, "If you don't patch critical vulnerabilities quickly, attackers will find them and exploit them quickly." Many organizations have made great progress in accelerating Windows and Linux patches - this attack is a reminder to make that same progress in patching network and security equipment and other appliances.

John Pescatore
John Pescatore

The news here is that vulnerabilities are being actively attacked hours after disclosure - and exploited shortly thereafter. This raises the importance of actively monitoring perimeter defenses for malfeasance or other abnormal behavior, particularly to cover the period where the new vulnerabilities haven't been mitigated. Even so, keep regression testing of fixes or updates for perimeter defenses focused an on-track and timely.

Lee Neely
Lee Neely

One might infer that ClearSky had some indicators of attack or compromise, rather than of mere vulnerability, that they used in this work. Their blog does not say what they were. Perhaps they will disclose them at RSA.

William Hugh Murray
William Hugh Murray

2020-02-14

DHS Investigating 2016 Florida Elections System Ransomware Attack

The US Department of Homeland Security is investigating a ransomware attack that infected systems at the Palm Beach County (Florida) election office prior to the 2016 general election. The office's recently appointed Supervisor of Elections reported the incident to the FBI in November 2019, after learning about it from an IT employee. The incident was not disclosed in 2016.

The Rest of the Week's News

2020-02-17

Redcar and Cleveland Borough Systems Suffer Malware Attack

Computer systems belonging to the Redcar and Cleveland Borough Council (UK) were infected with malware. The attack occurred on February 8, and as of February 12, were still "working with a reduced capacity. The council has called in help from the National Cyber Security Centre (NCSC). The council has not said what type of malware infected its IT systems.

2020-02-12

Boston Children's Hospital Affiliates Experience Ransomware Attack

Ransomware has infected systems belonging to the Pediatric Physicians' Organization at Children's (PPOC), affecting more than 500 physicians, physician assistants, and nurse practitioners across Massachusetts. While PPOC is affiliated with Boston's Children's Hospital, its network is separate from the hospital's. The affected servers have been quarantines and the remainder have been taken offline as a precaution.

2020-02-14

Bitcoin Mixer Arrest

The US Department of Justice (DoJ) has charged an Ohio man in connection with a Darknet cryptocurrency laundering service. Larry Harmon allegedly ran the Helix service from 2014 until 2017. Helix operated as a Bitcoin mixer, allowing customers to mix their Bitcoin with others and obscure link between their Bitcoin addresses and their real-world identities.

2020-02-17

Coronavirus: IBM Says No to RSA, Facebook Cancels Marketing Meeting, Black Hat Asia Postponed

IBM said it will not attend the RSA Conference in San Francisco next week due to concerns about the coronavirus. RSA Conference executives say the event will go on as planned, from February 23-28. In related stories, Facebook has cancelled a marketing summit that was to have taken place in San Francisco in early March, and the organizers of Black Hat Asia have postponed a conference that was scheduled to be held in late March in Singapore.

2020-02-15

Microsoft Pulls Problematic Windows 10 Patches

Microsoft has pulled the standalone KB4524244 update and the related KB4502496 update from Windows Update servers "due to an issue affecting a sub-set of devices." Users reported installation issues, freezing, and boot problems. The patch was designed to address "an issue in which a third-party Unified Extensible Firmware Interface (UEFI) boot manager might expose UEFI-enabled computers to a security vulnerability."

2020-02-17

WordPress ThemeGrill Demo Importer Plugin Updated to Fix Critical Flaw

Developers of the ThemeGrill Demo Importer WordPress plugin have released an updated version to fix a critical flaw that could be exploited to wipe websites. The flaw could allow an attacker to obtain administrative privileges on vulnerable sites. The plugin is estimated to be installed on at least 200,000 websites. The vulnerability is addressed in version 1.6.2.

2020-02-14

Corp.com Domain For Sale, Raises Specter of Namespace Collision

The corp.com domain is for sale. Administrators running Active Directory in their networks are urged to check their network configuration to ensure that the domain is not being used internally; some versions of Windows have used corp and corp.com as the default path for internal sites. If a user tries to access an internal site from outside the organization's network, they could run into namespace collision, "a situation where domain names intended to be used exclusively on an internal company network end up overlapping with domains that can resolve normally on the open Internet." The danger of exposing sensitive information through namespace collision is not theoretical. Jeff Schmidt, founder and CEO of JAS Global Advisors LLC, analyzed eight months of traffic bound for corp.com and found more than 375,000 PCs attempting to send internal information to an external site. Schmidt briefly set up the domain to capture email and called the results "terrifying."

Editor's Note

While many lessons have been learned relating to using someone else's published domain name internally, there remains a preponderance of corp.com. The mitigation is to migrate to a new domain that you own before corp.com becomes a real domain associated with a third party, which may take advantage of the traffic "given" to them.

Lee Neely
Lee Neely

2020-02-17

Local Election in Wisconsin Will Be First to Use ElectionGuard

On Tuesday, February 18, voters in Fulton, Wisconsin will use machines running Microsoft's open source ElectionGuard software in a primary election for Wisconsin Supreme Court candidates. This election will mark the first time ElectionGuard has been used in a US election.

Editor's Note

This test will be in parallel with physical ballots, and Microsoft made the source code available previously in conjunction with a managed bug bounty program. Kudos to Wisconsin for taking the logical, measured approach. That approach should have been required of all new voting technology and software from the start.

John Pescatore
John Pescatore

Microsoft leveraged their resources and experience to build what should be a secure foundation for voting machine manufacturers to implement, and then open sourced it. ElectionGuard addresses the core concerns of security, accountability, and vote verifiability, which could provide the building blocks of a reference architecture for delivering electronic voting systems.

Lee Neely
Lee Neely

2020-02-17

US Department of Commerce OIG Report Says Weak Security Controls Allowed Foreign Nationals to Access Sensitive Data

According to a report from the US Department of Commerce Office of Inspector General (OIG), inadequate security controls on Department systems exposed "sensitive trade information to unvetted foreign nationals." People working as contractors outside the US could still access and modify the Department of Commerce's Enterprise Web Services (EWS) document management system after their contracts had ended. The Department "mishandled the response to unauthorized access [and] ... failed to account for sensitive data on its systems."

Editor's Note

A key component here is an automated identity management system that manages accounts centrally so that your authentication systems for internally facing, externally facing or even cloud-based information systems have near real time information on active, disabled and removed user accounts. That should be coupled with regular review of rights granted in applications to ensure only authorized staff have access, irrespective of citizenship or employment relationship.

Lee Neely
Lee Neely

Internet Storm Center Tech Corner