homepage
Open menu
Contact Sales

SANS NewsBites

SolarWinds Started Earlier and is Looking Worse Than Previously Thought

January 5, 2021  |  Volume XXIII - Issue #1

Top of the NewsThe Rest of the Week's NewsInternet Storm Center Tech Corner

Top of the News

2021-01-04

SolarWinds: Attack May Have Started Earlier and is Looking Worse

More details about the SolarWinds supply chain attack are coming to light. It is now believed that at least 250 US government agencies and private businesses were affected. US Senator Mark Warner (D-Virginia), who serves as Vice-Chair of the Senate Intelligence Committee said that the attackers may have begun even earlier than March/April 2020. Warner also noted that "if FireEye had not come forward, I'm not sure we would be fully aware of [the attack] to this day."

Editor's Note

Throughout this whole story kudos have to be given to FireEye for their open and transparent way in dealing with this incident. It is a great example of why sharing and being transparent about incidents helps the overall community at large.

Brian Honan
Brian Honan

2021-01-04

SolarWinds: Hackers Accessed Microsoft Source Code

Microsoft says that the hackers behind the SolarWinds supply chain attack accessed Microsoft source code repositories. Microsoft said that the hackers did not alter the code because the compromised account they used to access the repositories had read-only permission. Microsoft is not concerned that the source code was viewed. In a December 31 blog post, the MSRC Team writes, "We do not rely on the secrecy of source code for the security of products, and our threat models assume that attackers have knowledge of source code. So viewing source code isn't tied to elevation of risk."

Editor's Note

Kudos to Microsoft for being transparent on the impact of the SolarWinds attack in their environment. Keep source code repositories mostly read-only, audit updates, and use multi-person processes, including security reviews, for promoting code to reduce the likelihood of unauthorized updates or injection of malware.

Lee Neely
Lee Neely

2021-01-04

SolarWinds: CISA Updates Guidance - Update SolarWinds Orion Now

The US Cybersecurity and Infrastructure Security Agency (CISA) has updated its guidance regarding the SolarWinds supply chain attack. The update comes in response to the discovery of a new vulnerability in SolarWinds Orion - an authentication bypass flaw in the SolarWinds Orion API. Government agencies were instructed to update their SolarWinds Orion platforms to version 2020.2.1HF2 by the end of 2020. Agencies unable to update by the deadline were instructed to take all their Orion systems offline.

Editor's Note

SolarWinds has been actively producing updates to mitigate the discovered vulnerabilities used to launch attacks via their Orion software. If you are installing the update, be sure to also follow the guidance on the CERT KB article below to harden your IIS server by installing and configuring the IIS URL Rewrite extension on your Orion polling engines. Given that more is still being learned, it's prudent to investigate alternative solutions.

Lee Neely
Lee Neely

The Rest of the Week's News

2021-01-04

TransLink Ransomware Update: Most Systems are Still Down

Vancouver, BC, transportation agency TransLink says that as of January 4, most of its IT systems are still unavailable a month after they suffered a ransomware attack. Employees have been receiving pay advances rather than their regular paychecks. TransLink has acknowledged that the ransomware operators also compromised employee data.

Editor's Note

This is an instance of the Egregor ransomware, which many Maze affiliates switched to when Maze shut down their operation last September. Egregor operations include data exfiltration prior to encryption to support a double-extortion option. They also leverage affiliates to hack into the targeted network to drop the ransomware for a 70/30 revenue split. The pay advances used by TransLink replaces the old model of simply repeating the last payroll during a COOP event as banks will reject a duplicate payroll submission. Make sure that you have verified your COOP plans to pay employees and continue benefits with your service providers and financial institutions.

Lee Neely
Lee Neely

2021-01-04

Zyxel Releases Fixes for Hardcoded Backdoor

Researchers from Eye Control discovered an undocumented user account with administrative rights hardcoded in the firmware of Zyxel firewall and AP controller devices. The account can be accessed via SSH or web interface. Eye Control reported the vulnerability to Zyxel in late November. Zyxel has released updated firmware for affected devices.

2021-01-04

T-Mobile Discloses Fourth Breach in Three Years

T-Mobile has disclosed a data breach that exposed some customers' call-related information. This is the fourth breach T-Mobile has acknowledged in the past three years. T-Mobile did not provide specifics about the attack, except to say its "cybersecurity team recently discovered and shut down malicious, unauthorized access to some" customer proprietary network information (CPNI).

Editor's Note

The breached information could be used to conduct SMS phishing attacks as it includes customer phone numbers and call records. Beware of spurious texts claiming to be from T-Mobile sending you to non-T-Mobile sites to collect additional identity or account information from consumers.

Lee Neely
Lee Neely

2020-12-31

FBI: Smart Home Devices are Being Hijacked for Swatting Attacks

The FBI has released a public service announcement warning that vulnerable smart home security devices are being hijacked by attackers to use in swatting attacks. By hijacking devices with voice and camera features, the attackers can watch the arrival of law enforcement teams and interact with them. The FBI's announcement urges people "to use complex, unique passwords and enable two-factor authentication to help protect against "swatting" attacks."

Editor's Note

This attack leverages password re-use. Use different passwords for smart home device services. Enable multi-factor authentication where available. As the attackers are leveraging stolen email account credentials, don't select email processes for second-factor authentication; choose option such as TOTP, aka mobile authenticator app, or SMS.

Lee Neely
Lee Neely

2020-12-29

Kawasaki Aerospace Company Discloses Breach, Reports of Phony Recruiting eMails

Japanese aerospace company Kawasaki Heavy Industries has disclosed that its network was hit by a data breach in June 2020. Kawasaki says that intruders may have accessed customer data. Separately, Kawasaki has warned that it has received reports of phony emails pretending to be from recruiters from Kawasaki heavy Industries Group in the US.

2021-01-04

Ticketmaster to Pay $10M Fine for Hacking Competitor

Ticketmaster has agreed to pay a $10 million fine for accessing a competitor's computer systems without authorization. A Ticketmaster employee who formerly worked at the rival company retained access credentials, which were used to snoop on that company's activity with the intent of stealing business.

Editor's Note

Deleting or disabling accounts for former employees has to be done immediately, particularly for privileged accounts. Include privileged accounts within applications, services and OS. User behavior analytics tools can help monitor for this type of activity as well as help detect insider threats.

Lee Neely
Lee Neely

There are large ethical issues around this one (this DoJ action appears to stem from a $110 million anti-trust action settlement by Ticketmaster in response to legal action by Songkick). The cybersecurity lessons: (1) detect hidden backdoors and undocumented URLs in your software and services before they are used against you; and (2) have automated and frequently audited processes to remove access when employees leave the company.

John Pescatore
John Pescatore

2021-01-04

Citrix Offers Feature Enhancement to Block DDoS Amplification Attacks

Citrix has released an enhancement to prevent the Datagram Transport Layer Security (DTLS) feature in its ADC and Gateway devices from being used to amplify distributed denial-of-service (DDoS) attacks. Reports emerged last month about attacks taking advantage of vulnerable devices.

2021-01-05

Bye-bye, Flash

Adobe Flash Player reached end-of-life status as of January 1, 2021. Windows users have begun receiving alerts from Adobe urging them to uninstall Flash. Adobe will block Flash from running as of January 12, 2021. Chrome 88 and Firefox 85, both scheduled for release this month, will remove support for Flash. Microsoft plans to release an update for Windows 10 that will permanently remove Flash. An optional Windows 10 update, released in October 2020, removes Flash Player that was installed by Windows in Internet Explorer, Edge, and Chrome; users who installed Flash Player manually can remove it using Adobe's uninstall instructions.

Editor's Note

Monitor for Flash use to discover any remaining processes or services which still rely on it. If you must create an environment which will still run Flash after January 12, isolate that environment carefully as you will need to run older browser and plugin versions which have not disabled Flash and will also contain unpatched vulnerabilities. Deploy your Flash uninstall scripts for the rest of your environment this month and monitor for unauthorized re-introduction.

Lee Neely
Lee Neely

2021-01-04

Apex Laboratory Patient Data Stolen

New York-based medical testing company Apex Laboratory has disclosed that the operators responsible for a July 2020 ransomware attack against the company's network stole patient data. The compromised information includes patient names, dates of birth, test results, and in some cases, Social Security numbers.

Editor's Note

A good reminder that if an attacker encrypted sensitive data, a breach has occurred - it is not just a denial of service event. HIPAA was the first compliance regime to make this distinction; most have moved in that direction.

John Pescatore
John Pescatore

Internet Storm Center Tech Corner

Traffic Analysis Quiz

https://isc.sans.edu/forums/diary/End+of+Year+Traffic+Analysis+Quiz/26940/


From a Small BAT File to Mass Logger Infostealer

https://isc.sans.edu/forums/diary/From+a+small+BAT+file+to+Mass+Logger+infostealer/26946/


Accessing Restricted Directory Listings via Your AV Solution

https://isc.sans.edu/forums/diary/Want+to+know+whats+in+a+folder+you+dont+have+a+permission+to+access+Try+asking+your+AV+solution/26932/


Zyxel Backdoor

https://www.eyecontrol.nl/blog/undocumented-user-account-in-zyxel-products.html


Citrix Releases Updates Addressing DTLS Flaw

https://support.citrix.com/article/CTX289674


Microsoft Source Code Accessed As a Result of SolarWinds Backdoor

https://msrc-blog.microsoft.com/2020/12/31/microsoft-internal-solorigate-investigation-update/


Zend Framework Deserialization Flaw

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3007

https://github.com/Ling-Yizhou/zendframework3-/blob/main/zend%20framework3%20????%20rce.md


Coin Miner Malware Written in Go

https://www.intezer.com/blog/research/new-golang-worm-drops-xmrig-miner-on-servers/?fbclid=IwAR3eFiHCNoqr5mc2UAOcm8nocjUOjZn0cpcAiSoYmn__JtJfBbjqUUT1OwQ


AutoHotKey Credential Stealer

https://www.trendmicro.com/en_us/research/20/l/stealth-credential-stealer-targets-us-canadian-bank-customers.html