FBI Warning: eMail Forwarding Exploited; Phishing COVID Cold Chain; Oracle WebLogic Flaw Actively Exploited

Compromising credentials of internet-accessible email accounts continues to be a target, and in many cases, low-hanging fruit. Implement multi-factor authentication on all internet-accessible services. If you must enable password access, ensure passwords are sufficiently robust; review NIST SP 800-63-3 (https://pages.nist.gov/800-63-3/) for guidance. Make sure that account lock-out and misuse detection on those services are enabled and actively monitored to detect malicious activities.

Lee Neely

These types of attacks have been around for several years; many SIEM products have rules to detect and alarm on mail forwarding changes. Microsoft, SecureSky, and the Center for Internet Security have updated the Microsoft 365 Foundation Benchmark to v1.2 that also addresses mitigating the forwarding risk.

John Pescatore

This is an important warning from the FBI. We've been involved in several email hijacking cases where forwarding rules were set by the criminals at the server side, be that an on-premise or cloud based solution. However, the criminals have made the changes noted by the FBI which have been overlooked by the clients in their initial investigation. Also, be aware this vulnerability can be exploited on older installations of Microsoft Outlook which we have seen in several cases. https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/detect-and-remediate-outlook-rules-forms-attack?view=o365-worldwide

Brian Honan

As vaccines are approved and distribution begins, expect increased occurrence of attempts to redirect or otherwise disrupt the supply chain, particularly as the viability depends on proper refrigeration. Distributors need to be prepared for aggressive social engineering, including impersonation of officials, intended to redirect supplies.

Lee Neely

The DarkIRC bot is available for $75 through hacker forums; it ultimately installs itself as an auto-run version of chrome.exe leveraging powershell scripts and obfuscated downloads. Use the cost of obtaining an exploit as compared to the cost of the data included in your WebLogic instance when calculating the risk or ROI for this update.

Lee Neely

I am old enough to remember when schools closed for snow days, not ransomware days.

Brian Honan

This attack involved the Ryuk ransomware actors who not only encrypt systems but also exfiltrate data and demand payment for that as well, sometimes called "double-extortion." K12 did isolate the attack and restore those systems; the data exposure threat drove the decision to pay. Make sure your ransomware response process includes decision trees related to exfiltrated data exposure as well as identification of critical and sensitive data. If you are relying on cyber insurance to negotiate payment, make sure your expectations are aligned with the services contracted before needed.

Lee Neely

The decision as to whether or not to pay extortion should be made before the demand and should be documented, for example, in a business resumption plan.

William Hugh Murray

The think-tanks are being targeted because they are often involved in shaping future policies for the new administration. Mitigations build on existing UAT for spear-phishing campaigns. Focus on unwanted and unexpected emails & attachments. Make sure users are operating with least-privilege. Also make sure systems are properly secured, updated, and isolated to prevent lateral movement.

Lee Neely

The list of "mitigations" is long and daunting but is mostly things that should be done in any case. The list is ordered by role (who should do what) but errs on the side of completeness. Given the number of items, it would have been nice if, within role, the list had been ordered by efficiency or effectiveness. Strong authentication, by far our most necessary, effective, and efficient measure, is way down the list, as though it were peer with many less important measures.

William Hugh Murray

This should be interesting to watch. Cell location data to be sold to third-party data aggregators by carriers and "anonymized" for research processes. This case is about data from applications which use the on-device location services, on the premise the user can disable location services negating the need for a warrant. You can opt out by disabling location services, and the reality is opting out is no longer trivial or viable for most users due to the number of applications and services which leverage location services.

Lee Neely

If anyone else can buy it, why not the government? The issue here may not be so much the role of the government as that of the data brokers. This measure results in a public record. It is not the kind of secret surveillance for which a warrant is required.

William Hugh Murray

Cases like this reinforce the recent Schrems II judgment by the Court of Justice of the European Union (CJEU) which invalidated Privacy Shield and now requires much more stringent controls for the transfer of personal data belonging to those resident in the EU to the US.

Brian Honan

The flaws were addressed in Apple's May updates for iOS, iPadOS, and watchOS, which included unexpected updates for older devices. Make sure they were applied, replace devices which cannot run the current OS releases. Ian Beer describes the flaw and research in a 30,000 word Project Zero article (https://googleprojectzero.blogspot.com/2020/12/an-ios-zero-click-radio-proximity.html) which is worth reading. His key takeaway is not to conclude nobody would spend six months to hack your phone, but rather that one person, working alone, in isolation, was able to build a capability to seriously compromise devices in close proximity. His recommendations, while iOS focused, should be considered for any system where legacy code and compromises, often driven by time to market, exist.

Lee Neely

This is another one of those safety vs. privacy issues that require finding a middle ground. I would rather see focus on the federal government requiring ISPs and all telecom providers to stop delivering known attack traffic to their customers. The pandemic has re-emphasized that internet connectivity is a necessary utility, just like drinking water and electricity. We do not allow water providers to deliver toxic water and the power companies aren't allowed to electrocute their customers. The common conduits of known dangerous content are much higher leverage points for legislative efforts.

John Pescatore