homepage
Open menu

SANS NewsBites

Australian Government Plans to Respond to Cyberattacks on Critical Infrastructure; Apache Struts Vulnerabilities; Credential Stuffing

August 18, 2020  |  Volume XXII - Issue #65

Top of the NewsThe Rest of the Week's NewsInternet Storm Center Tech Corner

Top of the News

2020-08-14

Australian Government Seeks Powers to Respond to Active Cyberattacks Against Critical Infrastructure

Australia's Cybersecurity Strategy 2020 will require operators of critical infrastructure to report cyber incidents to ASD in real time and potentially allow ASD into their networks to monitor and defend the networks against cyberattacks. Directors will be help legally responsible for ensuring a certain level of cybersecurity. The plan expands the critical infrastructure designation to include universities, the financial sector, the health sector, and food and grocery sector. The government has released a Consultation Paper regarding these issues.

Editor's Note

A strong proactive relationship like this can be a win-win, much like hiring a skilled managed security service provider. The first challenge, once data is flowing, will be defining normal, from connections, to accepted risks of discovered vulnerabilities, which is required to eliminate false positives and cement the working relationship. This process may identify areas for improvement, in which case the third party, in this case ASD, needs to understand not only how improvements can be made, but also how the current state was achieved, to neither jeopardize mission objectives nor resource and budget constraints.

Lee Neely
Lee Neely

I know of few organizations in the cybersecurity world as effective as ASD in identifying what needs to be done and following through to do it. I am betting initiative this will lead to a model for other nations to follow.

Alan Paller
Alan Paller

Australia seems intent on being proactive, while much of the world is reactive.

William Hugh Murray
William Hugh Murray

2020-08-17

Apache Struts Vulnerabilities

Vulnerabilities detected in Apache Struts can be exploited to execute remote code and to create denial-of-service conditions. The issues affect Apache Struts versions 2.0.0 through 2.5.20. Users are urged to upgrade to Apache Struts version 2.5.22.

Editor's Note

Apache has a mitigation to proactively protect from OGNL expression attack (https://struts.apache.org/security/#proactively-protect-from-ognl-expression-injections-attacks-if-easily-applicable) which utilizes the Java Security Manager to run them in a sandbox without permissions. This is disabled by default, and is enabled by adding Dognl.security.manager to your JVM arguments. Test this before rolling the change to production. Additionally use the Struts configuration key struts.ognl.esxpressionMaxLengh to limit expressions those valid for your application, generally between 200 and 400 characters.

Lee Neely
Lee Neely

The 2017 Equifax breach (CVE-2017-5638) is a good example of the danger of not patching/upgrading Struts. The vulnerability and exploit code were out in March 2017, Equifax was compromised in May, didn't notice until July - and in 2019 stated that the total cost of dealing with the breach was $1.4B and resulted in the CEO and top cybersecurity staff leaving the company. That cost is about $10 per record exposed and Equifax's cybersecurity insurance paid out less than 10% of the incident cost. Post-mortem investigations conclude the incident was entirely preventable.

John Pescatore
John Pescatore

Websites are intended to be attached to the public networks and often must also have some access to enterprise data, application services, or even networks. They constitute an attractive target. At a minimum, they should be built to OWASP standards and be subjected to the OWASP Application Security Verification Standard (ASVS). Access to the enterprise resources should be limited and carefully controlled. Development tools, libraries, and content managers (e.g., Apache Struts, WordPress) must be carefully chosen and kept current.

William Hugh Murray
William Hugh Murray

2020-08-17

Hackers Launched Credential Stuffing Attacks Against Canadian Government Website

Hackers used credential stuffing attacks to access thousands of accounts used by Canadian citizens to access various government services websites. The attacks targeted the Canada Revenue Agency (CRA) and the GCKey portal that provides single sign-on to multiple Canadian government services websites. The hackers used the compromised accounts to access government services and apply for COVID-19 relief payments. The Canada Revenue Agency has temporarily disabled the site. The attacks targeted the Canada Revenue Agency (CRA) and the GCKey portal that provides single sign-on to multiple Canadian government services websites suspended online services.

Editor's Note

Currently US Government websites are designed to resist such attacks. They require, not just offer, strong authentication with strict enrollment and verification procedures. (See login.gov). I say, well done.

William Hugh Murray
William Hugh Murray

2020-08-14

Update Available to Address Critical Flaws in WordPress Quiz and Survey Master Plugin

Two critical flaws in the Quiz and Survey Master WordPress plugin could be exploited to take control of vulnerable websites. The flaws are an arbitrary file upload vulnerability and an unauthenticated arbitrary file deletion error. Users are urged to update to Quiz and Survey Master version 7.0.1. The plugin is installed in more than 30,000 sites.

Editor's Note

These flaws leverage an unauthenticated AJAX action, irrespective of having a quiz which accepts file uploads. That's a good reason to uninstall the plugin if you're no longer using it. If you are retaining it, make sure that you're running WordPress 5.5 and you enable automatic updates. Wordfence released firewall rules for their paid version which will be available to the free version September 5th.

Lee Neely
Lee Neely

The Rest of the Week's News

2020-08-17

Cruise Line Operator Carnival Targeted in Ransomware Attack

Carnival Corporation, the world's largest cruise line operator, was the victim of a ransomware attack. The August 15 incident was disclosed in a US Securities and Exchange Commission (SEC) 8-K form filing. In the filing, Carnival writes, "We detected a ransomware attack that accessed and encrypted a portion of one brand's information technology systems. The unauthorized access also included the download of certain of our data files."

2020-08-14

R1 RCM Hit With Ransomware

Medical debt collection company R1 RCM was the target of a ransomware attack. The company says it took its systems offline in response to the attack. While it is not known how long the ransomware operators were inside R1 RCM's systems, the ransomware was activated earlier this month. R1 RCM was formerly known as Accretive Health Inc.

2020-08-15

Beverage Company Brown-Forman Suffers Cyberattack

Kentucky-based alcoholic beverage company Brown-Forman was the victim of an apparent ransomware attack. In communications with Bleeping Computer, Brown-Forman wrote, "Unfortunately, we believe some information, including employee data, was impacted. We are working closely with law enforcement, as well as world-class third-party data security experts, to mitigate and resolve this situation as soon as possible." The company is not actively negotiating with the attackers. The company also told Bleeping Computer that they managed to prevent their systems from being encrypted.

2021-01-21

Maze Ransomware Operators Publish File Allegedly Taken From Canon USA

Files allegedly stolen from electronics company Canon USA have been posted online by ransomware operators. Internal communications obtained by Bleeping Computer indicate that Canon USA was the victim of a ransomware attack earlier this month.

Editor's Note

A key component in making the decision to pay or not is the importance of the data exfiltrated. Beyond financial or personal data, imagine if your future strategic plans, or mergers and acquisitions candidates, or product roadmap were lost. Tracking sensitive data so you know which services contain sensitive data is important when assessing what was accessed during an incident.

Lee Neely
Lee Neely

2020-08-17

Ritz London Food and Beverage Reservation System Breached

London's Ritz Hotel is investigating a data breach of its food and beverage reservation system that compromised personal information belonging to some of its clients. Clients have reported being contacted by phone by people claiming to be Ritz Hotel staff seeking to confirm payment card details. The calls were spoofed to appear to be coming from the hotel.

2020-08-17

Microsoft Patch Tuesday Included Fix for Flaw First Reported in 2018

One of the vulnerabilities Microsoft patched in its monthly release last week was first reported to the company in August 2018. The Windows spoofing vulnerability affects all supported versions of Windows. The flaw could be exploited to "bypass security features intended to prevent improperly signed files from being loaded."

2020-08-14

The Value of Threat Intelligence Feeds

Researchers from universities in the Netherlands and Germany compared information provided by two commercial and four open source threat intelligence services. They found very little overlap between the six feeds, noting, "These findings raise questions on the coverage and timeliness of paid threat intelligence."

Internet Storm Center Tech Corner

SANS Data Incident 2020 - Indicators of Compromise

https://www.sans.org/blog/sans-data-incident-2020-indicators-of-compromise/


Large File Used to Obfuscate Malware

https://isc.sans.edu/forums/diary/Definition+of+overkill+using+130+MB+executable+to+hide+24+kB+malware/26464/


Apache Struts Patch and PoC Exploit

https://www.tenable.com/blog/cve-2019-0230-apache-struts-potential-remote-code-execution-vulnerability

https://cwiki.apache.org/confluence/display/WW/S2-059


Mac Malware Spreading via XCode

https://documents.trendmicro.com/assets/pdf/XCSSET_Technical_Brief.pdf


Citrix Broker Service Detected as Trojan by Windows Defender

https://support.citrix.com/article/CTX279897


Emotet Bug Used to Inoculate Systems

https://www.binarydefense.com/emocrash-exploiting-a-vulnerability-in-emotet-malware-for-defense/