homepage
Open menu

SANS NewsBites

Judge Says Insurance Company Must Pay for Ransomware Attack; Google Suspends Paid Chrome Extensions; Mozilla Bans Malicious Firefox Add-ons

January 28, 2020  |  Volume XXII - Issue #8

Top of the NewsThe Rest of the Week's NewsInternet Storm Center Tech Corner

Top of the News

2020-01-24

Judge Says Insurance Company Must Help Customer After Ransomware Attack

A US federal judge in Maryland has ordered State Auto Property & Casualty Insurance to cover the costs one of its customers incurred as the result of a ransomware attack. National Ink & Stitch had sought $310,000 in damages from the State Auto following the late 2016 attack that forced the screen printing company to replace its computer system.

Editor's Note

Good to see some rulings being made to serve as case law that may force cyber insurance policies to pay up more often. Sadly, a very likely outcome is insurance carriers changing the wording of their policies to make sure this ruling doesn't apply. Buyers' legal counsel review of all policy terms is very important.

John Pescatore
John Pescatore

2020-01-27

Google Temporarily Suspends Publishing Paid Chrome Extensions

All paid Chrome extensions have been suspended from being published or updated in the Google Chrome Web Store. Google cited a "significant increase in the number of fraudulent transactions involving paid Chrome extensions that aim to exploit users." The suspension is temporary while Google determines the best long-term solution to the issue.

Editor's Note

Kudos to Google for having the gumption to temporarily pull the plug. I'm beginning to feel that browser extensions are now what Flash has been for the past decade: nothing users really need, just vulnerable code to help advertisers and thieves trick users into questionable behavior. Going to software whitelists like the Apple App Store and Google Play got us away from an infinite number of executables down to just a very large number that had some level of testing and immensely raised the bar against malware on iOS and Android devices. But, browser extensions seem like going back to the bad old days. In the related item below, Mozilla is not suspending add-ons, just still at the "blocking more" stage.

John Pescatore
John Pescatore

Bravo on Google for calling a halt to the process while the long-term solution for paid extensions is found. Unlike the Mozilla ban below, installed paid extensions will continue to work, but no updates will be available until the long-term solution is determined, making it prudent to review extension use. This also ties back to the March 2019 announcement of policies for Project Strobe to strengthen their third-party extension auditing process.

Lee Neely
Lee Neely

2020-01-25

Mozilla Bans Malicious Firefox Add-ons

Mozilla has banned close to 200 Firefox add-ons over the past two weeks. The banned add-ons were found to be executing malicious code, stealing data, or hiding their source code. Not only have they been removed from Mozilla's add-on portal, they have also been disabled in browsers where they are already installed.

Editor's Note

The identified plugins don't follow Mozilla's rules for add-ons: https://extensionworkshop.com/documentation/publish/add-on-policies/: Add-on Policies. The rules are only recently being strictly enforced. Mozilla is not publishing the names of the banned plugins, only their IDs to support anonymity during the appeal process. The question remains, as John states, do we (still) need them? Have you evaluated the add-ons in use and determined which are absolutely needed, if any?

Lee Neely
Lee Neely

See comments on Google temporarily suspending browser extensions. Remember when the world would end if Flash was disabled?

John Pescatore
John Pescatore

The Rest of the Week's News

2020-01-23

State Department OIG Finds Cybersecurity Concerns

A report from the US State Department's Office of Inspector General (OIG) noted that an "assessment of the Department's information security program identified numerous control weaknesses that affected program effectiveness and increased the Department's vulnerability to cyberattacks and threats." The report comes just a week after Senator Mark Warner (D-Virginia) asked Secretary of State Mike Pompeo what he has done to address the security problems identified in the earlier reports. In the letter, Warner expressed concerns about the State Department's abilities to address increasing "offensive cyber activity by Iran," and referenced risks noted in earlier OIG audit reports.

2020-01-24

DHS Advisory Warns of Vulnerabilities in GE Medical Devices

The US Department of Homeland Security's (DHS's) Cybersecurity and Infrastructure Security Agency (CISA) has released an advisory warning about six critical vulnerabilities affecting GE CARESCAPE Telemetry Server, ApexPro Telemetry Server, CARESCAPE Central Station (CSCS) and Clinical Information Center (CIC) systems, CARESCAPE B450, B650, B850 monitors. GE is developing fixes for the vulnerabilities and has suggested mitigations to help protect vulnerable devices until the patches are available.

Editor's Note

The primary mitigation is network isolation. Allow only absolutely required communications to and from these devices, following GE's configuration guides such that a successful attack requires physical access. Access to those guides is available through their customer support portal and requires a valid support account. Additionally, the FDA has published medical device security guidance - https://www.fda.gov/medical-devices/digital-health/cybersecurity: Cybersecurity

Lee Neely
Lee Neely

2020-01-24

Researchers Say Hackers Targeted European Energy Sector

According to a report from Recorded Future, hackers targeted systems at "a key organization in the European energy sector." The report says that the attack likely began in late fall 2019 and continues through the beginning of January, 2020. The hackers used the Pupy remote access Trojan (RAT) in the attack.

2020-01-24

Factory Environment Honeypot

Researchers from Trend Micro created a honeypot that imitates a factory environment. The honeypot, which was launched in May 2019, drew a variety of attacks, including cryptominers and ransomware. The report notes that "organizations should ensure that their equipment and the components of their ICSs are not exposed online... [and should implement] strict authentication policies to minimize the possibility of intrusions.

Editor's Note

The trick with ICS, or other purpose-built equipment, remains allowing only appropriate access with monitoring, which may require implementing gateways or other border protections to limit access where embedded authentication is not sufficient or configurable. ICS components often use proprietary protocols, and while not every tool can decipher those, the presence of standard protocols on that network may be a sign of compromise.

Lee Neely
Lee Neely

2020-01-24

Mitsubishi Hit with Malware Attack

Last week, Mitsubishi Electric disclosed that it was the victim of a cyber attack in June 2019. The attackers appear to have exploited a then-unknown vulnerability in TrendMicro OfficeScan antivirus; they stole 200MB of company files. TrendMicro patched the flaw in October 2019, noting at the time that it was being actively exploited.

2020-01-27

Cisco Releases Fix for Webex Vulnerability

Cisco has released a fix for a vulnerability in its Webex video conferencing platform. The flaw could be exploited to access password protected meetings without authorization; attackers would need a valid meeting ID along with the Webex app on an Android or iOS device. Unauthorized attendees appear in the attendee list. The issue is fixed in Cisco Webex Meetings Suite sites version 39.11.5 and Cisco Webex Meetings Online sites version 40.1.3.

Editor's Note

Webex is often used for large (and sensitive) meetings where the participation of an unauthorized party might well go unnoticed.

William Hugh Murray
William Hugh Murray

2020-01-27

Relaxed Utility Cybersecurity Incident Reporting Rules Raise Concerns

New Federal Energy Regulatory Commission (FERC) rules for reporting cybersecurity incidents allow organizations to decide themselves whether or not an incident merits reporting. The president of the Utility Workers Union of America is concerned that utilities may place profits ahead of addressing cybersecurity issues. The new rules, which were introduced in June 2019, say that "Each responsible entity will be required to develop criteria for identifying an attempt to compromise a cyber asset and then apply those criteria during its cyber security incident identification process."

2020-01-25

Hackers Exploiting Citrix Flaw to Spread Ransomware

The recently patched flaw in Citrix products is being exploited to infect systems with Sodinokibi ransomware.

2020-01-23

German Automotive Parts Company Hit with Sodinokibi Ransomware

The hackers behind the ransomware attack on the Travelex international currency exchange have launched an attack against Gedia Automotive Group, a German automotive parts manufacturer, infecting its systems with the ransomware known as Sodinokibi. Gedia says it has shut down its IT systems and that its employees have been sent home. The hackers say they have taken data from Gedia's systems and plan to upload them if the company does not pay the ransom.

2020-01-24

Tillamook County, Oregon, Malware Attack

Tillamook County in Oregon is reporting that it was hit with a ransomware attack that prompted the county to take its computer and telephone systems offline as a precaution.

2020-01-27

Tampa Bay Times Hit with Ryuk Ransomware

The Tampa Bay Times was hit with Ryuk ransomware last week. The company did not pay a ransom, and it is working to restore systems from backups and cleaning malware from its systems.

2020-01-24

Potsdam Servers Offline After Cyberattack

Servers belonging to the city of Potsdam, Germany have been taken offline in the wake of a cyberattack.

2020-01-27

Galt Ransomware Recovery

Since a December 2019 ransomware attack, systems at the California city of Galt are roughly 85 percent rebuilt and restored.

2020-01-27

NIST Draft Ransomware Response Guidelines

The National Cybersecurity Center of Excellence (NCCoE) has released a National Institute of Standards and Technology (NIST) draft document aimed at helping "organizations detect and respond to data integrity events across multiple industries." NCCoE is accepting comments on Data Integrity: Detecting and Responding to Ransomware and Other Destructive Events through February 26.

Editor's Note

The guide identifies NIST 800-53, ISO 27001, and NIST 800-181 controls to aid with Ransomware preparedness and response. If you have experience with ransomware, or other security baselines which should be referenced, review the draft and provide input.

Lee Neely
Lee Neely

Internet Storm Center Tech Corner