homepage
Open menu

SANS NewsBites

Medical Research Center Pays Ransomware; Hackers Wiping Lenovo/Iomega NAS Devices, Demanding Ransom; Card Skimming Malware on Government Websites in Eight US Cities

June 30, 2020  |  Volume XXII - Issue #52

Top of the NewsThe Rest of the Week's NewsInternet Storm Center Tech Corner

Top of the News

2020-06-29

California's Top Medical Research University Pays Ransomware Actors

The University of California, San Francisco (USCF) has paid a ransomware demand of more than $1.4m. A "limited number of servers" at the public health research facility were encrypted by Netwalker ransomware. UCSF disclosed the incident on June 3. BBC News was able to observe a live chat on the dark web involving UCSF ransom negotiations.

Editor's Note

The Netwalker operators used multiple techniques to entice UCSF into paying the ransom, including making both samples of exfiltrated data and the ransom negotiations visible to the press. For UCSF reputation risk is key to continued support as they are working on research to support the public good including a cure for C-19. Sophos has published information about the tactics and tools used by Netwalker ransomware: https://news.sophos.com/en-us/2020/05/27/netwalker-ransomware-tools-give-insight-into-threat-actor/

Lee Neely
Lee Neely

Extortion attacks will continue as long as the value of success exceeds the cost of attack. Currently the excess of the value of success over the cost of attack is so high as to suggest that we need to increase the cost of attack perhaps ten-fold while reducing the value of success. The strategy of some enterprises of attempting to assign the risk to insurance underwriters is aggravating a problem that we have had years to fix.

William Hugh Murray
William Hugh Murray

2020-06-29

Hackers are Wiping Old Lenovo/Iomega NAS Devices and Demanding Ransom

Hackers have been breaking into old LenovoEMC/Iomega network-attached storage (NAS) devices, wiping them, and demanding between $200 and $275 in ransom for the return of the data. The attacks targeted NAS devices that exposed their management interface on the Internet with no password protection. Similar attacks were reported a year ago. The LenovoEMC and Iomega NAS lines were discontinued in 2018.

Editor's Note

These devices should not be exposed to the Internet. Refer to the Lenovo support page (https://support.lenovo.com/us/en/solutions/LEN_11575) on how to secure these devices. Then start taking steps to replace them. While they are still functional, Lenovo will no longer be releasing updates or fixes.

Lee Neely
Lee Neely

2020-06-29

Magecart Card Skimming Malware Found on Government Websites in Eight US Cities

Researchers at Trend Micro found that local government websites in eight US cities were infected with Magecart card skimming malware. The common factor appears to be that all the affected sites were using the Click2Gov municipal payment software. The attacks began on April 10 and appear to still be active. This is not the first time that Click2Gov has been the target of attacks.

Editor's Note

With past attacks, in 2018 and 2019, some cities took the added step of reverting to taking payments over the phone or US mail. The current attack, which may not be connected to the prior incidents, has been characterized as relatively easy. This would be a good time to investigate alternatives to Click2Gov. Include the cost of breach and transition timing in the research to understand your ongoing exposure and total costs.

Lee Neely
Lee Neely

Any enterprise providing checkout on a website is a potential target for these attacks and should behave accordingly. Click2Gov is used widely for municipal utility bill collection. You know who you are.

William Hugh Murray
William Hugh Murray

This style of attack has been going on for at least six years. If British Airways can get tagged via this threat vector, thinly staffed municipal IT staffs face a serious risk.

Stephen Northcutt
Stephen Northcutt

The Rest of the Week's News

2020-06-29

British Tech Companies Urge Reworking Computer Misuse Act

A group of British technology organizations and individuals have signed a letter to Prime Minister Boris Johnson, urging him to act to reform the Computer Misuse Act (CMA). The law was created 30 years ago, when less than one percent of the UK's population used the Internet and "the concept of cyber security and threat intelligence research did not exist." The letter also notes that "the CMA inadvertently criminalises a large proportion of modern cyber defence practices."

Editor's Note

Writing legislation that stands the test of time is challenging, particularly in this space where both technologies and practices evolve rapidly. As such, it is optimal to include a plan for review and updating cyber legislation at the outset.

Lee Neely
Lee Neely

We have often noted here that drafting legislation that has only the intended results while avoiding unintended consequences is difficult. On the other hand, we have a much better understanding of computer misuse and abuse than we did thirty years ago. It is time to undertake the task of replacing the CMA and CFAA.

William Hugh Murray
William Hugh Murray

2020-06-29

Michigan House of Representatives Passes Bill Prohibiting Employers From Requiring Implanted Microchips for Workers

The Michigan State House of Representatives has passed a bill that would prohibit employers from requiring workers to have RFID chips implanted. The measure is proactive; there have not been instances in which employers have actually imposed this requirement. A Wisconsin company has used implantable ID chips for their employees on a voluntary basis. The Microchip Protection Act now heads to the Michigan State Senate for consideration.

Editor's Note

I usually try to only comment on news items where there is a meaningful or interesting tie-in to real world enterprise security issues but this one was hard to pass up. Proactive-ness seems to be in short supply across politicians and legislators. I'd certainly rather see states focus that scarce resource more on increasing election security (where the Michigan Secretary of State has been taking steps) than on preemptive technology-specific laws.

John Pescatore
John Pescatore

2020-06-29

Magento 1.x EOL is June 30; Merchants Urged to Upgrade

Magento 1.x will no longer be supported after June 30, 2020. Payment processors are urging merchants to update; Visa informed merchants that failing to update to Magento 2.x will eventually cost them PCI DSS (Payment Card Industry Data Security Standard) compliance. Adobe's Security Bulletin for Magento updates last week included a reminder: "Support for Magento Commerce 1.14 and Magento Open Source 1 is ending in June 2020. This will be the final security patches available for these editions."

Editor's Note

Before upgrading to Magento 2.0, merchants should consider taking the opportunity to switch to the exclusive use of checkout proxies like PayPal, Apple Pay, and Click2Pay. Payment collection should be separate from order entry. We have known that to be true since the days of the Sears and Roebuck Catalog.

William Hugh Murray
William Hugh Murray

2020-06-29

Tax Software Required by Chinese Bank Installs Backdoor on Companies' Systems

At least two western companies opening offices in China were forced to install tax software on their systems; the software has been found to download and install a backdoor. The companies said that a bank in China "required that they install a software package called Intelligent Tax produced by the Golden Tax Department of Aisino Corporation, for paying local taxes." The backdoor, which has been named GoldenSpy, operates with SYSTEM-level privileges.

Editor's Note

This echoes the 2017 NotPetya ransomware and the Ukrainian M.E. Doc accounting software that enabled the initial backdoor. Another strong reminder about supply chain security overall and when testing can't be done, the need for the network security equivalent of "quarantining" any software or appliances that must be used but hasn't been tested. A few years ago, I did a Board of Director's briefing around the risks of travel to foreign countries and most CXOs and Boards these days understand the risks of using their corporate devices in foreign countries. I made a point of emphasizing the same risk existed in the company's IT operations in those countries - special effort towards whitelisting, isolation and segmentation has to be part of the cost of doing business in those countries.

John Pescatore
John Pescatore

When faced with a mandate like this, it is very hard to slow down and assess the security of the required software. Even so, testing and approving all installed software prior to general deployment is key to maintaining the integrity of your systems. Support that process with a transparent interface that anyone can use to request approval, and follow-up in a timely fashion to prevent an end-around.

Lee Neely
Lee Neely

2020-06-27

Cardplanet Operator Aleksei Burkov Sentenced to Nine Years in Prison

Aleksei Burkov has been sentenced to nine years in prison for his role in operating the Cardplanet carding website, which sold payment card information that was used to make millions of dollars in fraudulent transactions. Burkov was arrested in Israel in December 2015; he was extradited to the US in 2019. Earlier this year, he pleaded guilty to access device fraud, conspiracy to commit access device fraud, identity theft, computer intrusions, wire fraud, and money laundering.

2020-06-26

Medvedev Guilty Plea

Sergey Medvedev has pleaded guilty to RICO conspiracy for his role in "an Internet-based cybercriminal enterprise" known as Infraud. The group's activity resulted in more than $586m in losses. US authorities have indicted 36 people in connection with Infraud.

2020-06-25

Cyber Flag 20-2 Participants Used New Remote Cyber Training Tool

US Cyber Command's Cyber Flag 20-2 training exercise took place earlier this month. More than 500 people participated; there were 17 teams from five countries. For the first time, participants had access to a new remote access training tool. The Persistent Cyber Training Environment (PCTE) "is an online client that allows Cyber Command's cyber warriors, as well as partner nations, to log on from anywhere in the world to conduct individual or collective cyber training as well as mission rehearsal." The Cyber Flag exercise is run by US Cyber Command.

2020-06-29

Palo Alto Networks Fixes Critical Flaw in Firewall Operating System

Palo Alto Networks has released fixes for a critical authentication bypass vulnerability that affects PAN-OS, the operating system used in many its firewalls. According to the Palo Alto Advisory, "Security Assertion Markup Language (SAML) authentication is enabled and the 'Validate Identity Provider Certificate' option is disabled (unchecked), improper verification of signatures in PAN-OS SAML authentication enables an unauthenticated network-based attacker to access protected resources." If SAML authentication is not enabled, the flaw cannot be exploited. The affected versions of the operating system are PAN-OS 9.1 versions earlier than PAN-OS 9.1.3; PAN-OS 9.0 versions earlier than PAN-OS 9.0.9; PAN-OS 8.1 versions earlier than PAN-OS 8.1.15, and all versions of PAN-OS 8.0 (EOL). PAN-OS 7.1 is not affected.

Editor's Note

This was given a CVSSv3.1 base score of 10, which indicates rapid response is appropriate if you're using this configuration of SAML authentication. Verify your exposure per the Palo Alto KB article (https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000008UXK: Securing your SAML Deployments).Suggest verifying the update in your test firewall prior to production deployment.

Lee Neely
Lee Neely

Internet Storm Center Tech Corner