homepage
Open menu

SANS NewsBites

Ransomware Disables GA Elections Database; COVID Vaccine and US Government Targeted; Psychotherapy Patients Blackmailed after Breach

October 27, 2020  |  Volume XXII - Issue #85

Top of the NewsThe Rest of the Week's NewsInternet Storm Center Tech Corner

Top of the News

2020-10-24

Hackers Disable Georgia County Election Database with Ransomware

A ransomware attack earlier this month disabled a Hall County, Georgia, database that is used to verify voters' signatures on absentee ballots. While the attack did not affect the voting process, county employees have had to manually verify signatures from voter registration cards.

Editor's Note

It is verification of signatures that makes absentee voting secure. The signature must be used and validated twice: once when applying for the absentee ballot and once when submitting it. This is even more secure than in those jurisdictions that do not check a photo ID for in-person voting.

William Hugh Murray
William Hugh Murray

2020-10-23

CISA and FBI Warn Russian APT Actor is Targeting Government Networks

In a joint cybersecurity advisory, the US Cybersecurity and Infrastructure Security Agency (CISA) and the FBI warn that a Russian advanced persistent threat (APT) actor has targeted "US state, local, territorial, and tribal (SLTT) government networks, as well as aviation networks." The APT actor has "exfiltrated data from at least two victim servers."

Editor's Note

Even if you're not a US Government or APT target, the advisory offers good guidance on comprehensive account resets and network defenses. Review the Network Defense in Depth guidance for information on perimeter protections, monitoring, and user education to identify any gaps in your current practices.

Lee Neely
Lee Neely

2020-10-23

Cyberattack Hits COVID Vaccine Maker

A company that is manufacturing a COVID-19 vaccine for Russia has shut down operations in five countries following a cyberattack against its network. Dr. Reddy's is based in India and is about to enter Phase 2 human trials of the vaccine, which has been given the nickname Sputinik V. Dr. Reddy's has also isolated its data centers.

Editor's Note

It is likely the attack was targeting the IP behind the vaccine to give competition a leg up. Dr. Reddy's took immediate action to isolate their systems to remediate and prevent further harm. A side effect is their production of generic drugs in the US may be impacted causing some shortages. The lesson here is to verify security, particularly around key assets, in a scenario such as producing the COVID-19 vaccine which pushes the business to rapidly implement services, possibly leaving security behind.

Lee Neely
Lee Neely

2020-10-26

Finnish Psychotherapy Patients are Being Blackmailed After Vastaamo Data Breach

Patients of Finland's Vastaamo psychotherapy clinic are reporting that they are being contacted with blackmail demands. Last week, Vastaamo disclosed a data breach compromised patient data. The hackers have reportedly posted some patient information on the dark web; patients who have been contacted by the hackers say they have been asked to pay 200 EUR (236 USD) to prevent their information from being exposed.

The Rest of the Week's News

2020-10-24

US Treasury Sanctions Russian Research Institution Tied to Triton Malware

The US Department of the Treasury's Office of Foreign Assets Control (OFAC) has sanctioned "a Russian government research institution that is connected to the destructive Triton malware." The State Research Center of the Russian Federation FGUP Central Scientific Research Institute of Chemistry and Mechanics (CNIIHM or TsNIIKhM) supported threat actors' use of Triton, which has been described as "the most dangerous threat activity publicly known."

2020-10-23

Book Excerpt: SANDWORM: The Aurora Generator Test

In an excerpt from Andy Greenberg's book, "SANDWORM: A New Era of Cyberwar and the Hunt for the Kremlin's Most Dangerous Hackers," Michael Assante's 2007 Aurora demonstration proves the danger hackers could pose to the power grid by manipulating protective relays.

Editor's Note

Much has been learned since 2007 about the importance of segregating OT, not only from the Internet but also other systems which don't need to interact with it. Additionally, as we pass the ten-year anniversary of Stuxnet, we are reminded of the importance of OPSEC, that providing too much information about your OT to adversaries, e.g. PR photos with recognizable components in view, can be leveraged against you.

Lee Neely
Lee Neely

2020-10-26

Botnet Exploits CMS Weaknesses

Researchers from Imperva have detected a botnet that is exploiting vulnerabilities in various content management systems (CMS) to infect websites. The botnet, which has been given the nickname KashmirBlack, is being used for cryptomining and spam. It uses Dropbox for its command-and-control infrastructure and stores files on GitHub and Pastebin. Hundreds of thousands of sites are believed to have been infected since late 2019.

2020-10-26

Sopra Steria Confirms its Network was Hit with Ransomware

Sopra Steria, the French IT service company, has acknowledged the cyberattack that hit its network last week was actually a ransomware attack. The company says the infection was kept to "a limited part" of its IT systems. Sopra Steria predicts "it will take a few weeks for a return to normal."

Editor's Note

The claim is this is a never before seen strain of Ryuk which was activated after systems were infected, a couple of days previously, with either TrickBot or BazarLoader. The signature for the new version of Ryuk has been released for incorporation into detection tools. Even with an interval of a couple of days, assume data has been exfiltrated and fully analyze your logs to determine what systems have been accessed. In this case, Sopra Steria seems to have avoided customer data loss; others may not be so lucky.

Lee Neely
Lee Neely

Lessons include system-to-system isolation to resist lateral spread of ransomware, and the ability to restore mission-critical applications in hours.

William Hugh Murray
William Hugh Murray

2020-10-26

Microsoft is Beginning to Nudge Users Away from Internet Explorer

When users browsing in Internet Explorer attempt to access a website that is not IE-compatible, the site will launch in Microsoft Edge. Users will be notified that the site is not compatible with IE, and will be prompted to update to Edge, migrating their settings from IE. Microsoft plans to disable support for Internet Explorer in certain services starting in mid-November.

Editor's Note

If you have apps that require IE, or IE-specific plugins such as Silverlight, consider using an isolated hosted business (IE) browser only for use with those applications, while moving your systems to newer browsers such as Chrome, Firefox or Chromium Edge.

Lee Neely
Lee Neely

2020-10-23

Louisiana Calls in National Guard to Help Fight Cyberattacks

Officials in Louisiana have called in the state's National Guard to help handle cyberattacks against government systems. Multiple local government systems in Louisiana have reportedly been infected with a remote access Trojan (RAT) that has previously been linked to hackers with ties to North Korea's government.

2020-10-23

Former Century 21 Sysadmin Charged for Computer Tampering

A former systems administrator for the Century 21 department store has been indicted on several charges, including computer tampering and computer trespass. Prior to resigning from his position in November 2019, Hector Navarro allegedly stole employee data and created a superuser account that he used to access the system after he had left the company. Navarro allegedly deleted data to prevent people hired to replace him from accessing the network.

Editor's Note

Verification of all active accounts, particularly those not centrally managed, must be a regular activity - even more so on boundary protection devices. Additionally, make sure that you're monitoring privileged operations on those devices to include account creation and detect actions from previously unknown accounts.

Lee Neely
Lee Neely

It is essential to grant only those privileges that one can effectively withdraw upon termination. That includes the ability to terminate any accounts that the privileged user has created.

William Hugh Murray
William Hugh Murray

2020-10-26

Exposed Irrigation System Networks

An Israeli security company found more than 100 smart irrigation systems were left unprotected on the Internet. The vulnerable CC PRO systems were installed with the factory default settings unchanged, which means that the default account does not require a password. From there, malicious actors could access the system's control panel and change settings and delete other users from the system. The company notified CERT Israel of the situation, which contacted affected companies as well as Motorola, the manufacturer, and shared information with CERTs in other countries. The number of exposed systems is falling.

Editor's Note

In 2018, the International Society of Automation produced ISA/IEC 62443-4-1-2018 that focused on building security into industrial control systems. That same year a group of Israeli researchers presented a paper on vulnerabilities in connected irrigation systems at DEFCON. Since irrigation systems (and many other "smart systems") bring electricity into close proximity to water (and moving machinery into close proximity to living things) there have long been electrical code standards for safe installation of those systems. This is a good item to show to a COO around the cybersecurity aspect of safety of these systems.

John Pescatore
John Pescatore

Internet Storm Center Tech Corner

An Alternative to Shodan: Censys

https://isc.sans.edu/forums/diary/An+Alternative+to+Shodan+Censys+with+UserAgent+CensysInspect11/26718/


Sooty: SOC Analyst's All-in-One Tool

https://isc.sans.edu/forums/diary/Sooty+SOC+Analysts+AllinOne+Tool/26714/


Excel 4 Macros: "Abnormal Sheet Visibility"

https://isc.sans.edu/forums/diary/Excel+4+Macros+Abnormal+Sheet+Visibility/26726/


Adversarial ML Threat Matrix

https://github.com/mitre/advmlthreatmatrix


Samsung S20 RCE

https://labs.f-secure.com/blog/samsung-s20-rce-via-samsung-galaxy-store-app/


VMWare Advisory

https://www.vmware.com/security/advisories/VMSA-2020-0023.html


HP Printer Applications Certificate Revoked

https://eclecticlight.co/2020/10/23/why-have-my-hp-printers-stopped-working-how-to-check-their-software-signature/


Link Previews and Privacy

https://www.mysk.blog/2020/10/25/link-previews/