Final Week: Get an iPad (32 G), Galaxy Tab A, or Take $250 Off OnDemand Training - Ends Jan 27

Newsletters: NewsBites

Subscribe to SANS Newsletters

Join the SANS Community to receive the latest curated cyber security news, vulnerabilities and mitigations, training opportunities, and our webcast schedule.

SANS NewsBites
@Risk: Security Alert
OUCH! Security Awareness
Case Leads DFIR Digest
Industrial Control Systems
Industrials & Infrastructure

SANS NewsBites is a semiweekly high-level executive summary of the most important news articles that have been published on computer security during the last week. Each news item is very briefly summarized and includes a reference on the web for detailed information, if possible.

Spend five minutes per week to keep up with the high-level perspective of all the latest security news. New issues are delivered free every Tuesday and Friday.

Volume XXIII - Issue #1

January 5, 2021

SolarWinds Started Earlier and is Looking Worse Than Previously Thought


SANS NewsBites               January 5, 2021                Vol. 23, Num. 001



  SolarWinds: Attack May Have Started Earlier and is Looking Worse

  SolarWinds: Hackers Accessed Microsoft Source Code

  SolarWinds: CISA Updates Guidance - Update SolarWinds Orion Now


  TransLink Ransomware Update: Most Systems are Still Down

  Zyxel Releases Fixes for Hardcoded Backdoor

  T-Mobile Discloses Fourth Breach in Three Years

  FBI: Smart Home Devices are Being Hijacked for Swatting Attacks

  Kawasaki Aerospace Company Discloses Breach, Reports of Phony Recruiting eMails

  Ticketmaster to Pay $10M Fine for Hacking Competitor

  Citrix Offers Feature Enhancement to Block DDoS Amplification Attacks

  Bye-bye, Flash

  Apex Laboratory Patient Data Stolen


***********************  Sponsored By AWS Marketplace  **************************

Virtual event: Enhance remote workforce security | Dispersed workforces require changes in security parameters and requirements for connecting business-critical resources. In this virtual event, remote workforce security thought leaders, strategists, and technologists will discuss key innovations enabling AWS customers to transform their security for a remote and hybrid workforce.





--SolarWinds: Attack May Have Started Earlier and is Looking Worse

(December 30, 2020 & January 2 & 4, 2021)

More details about the SolarWinds supply chain attack are coming to light. It is now believed that at least 250 US government agencies and private businesses were affected. US Senator Mark Warner (D-Virginia), who serves as Vice-Chair of the Senate Intelligence Committee said that the attackers may have begun even earlier than March/April 2020. Warner also noted that "if FireEye had not come forward, I'm not sure we would be fully aware of [the attack] to this day."

[Editor Comments]

[Honan] Throughout this whole story kudos have to be given to FireEye for their open and transparent way in dealing with this incident. It is a great example of why sharing and being transparent about incidents helps the overall community at large.

Read more in:

ZDNet: SolarWinds: The more we learn, the worse it looks

The Register: SolarWinds mess that flared in the holidays: Biz confirms malware targeted crocked Orion product

NYT: As Understanding of Russian Hacking Grows, So Does Alarm

The Verge: SolarWinds hack may be much worse than originally feared

Reuters: Cyber attack on U.S. government may have started earlier than initially thought - U.S. senator


--SolarWinds: Hackers Accessed Microsoft Source Code

(December 31, 2020 & January 4, 2021)

Microsoft says that the hackers behind the SolarWinds supply chain attack accessed Microsoft source code repositories. Microsoft said that the hackers did not alter the code because the compromised account they used to access the repositories had read-only permission. Microsoft is not concerned that the source code was viewed. In a December 31 blog post, the MSRC Team writes, "We do not rely on the secrecy of source code for the security of products, and our threat models assume that attackers have knowledge of source code. So viewing source code isn't tied to elevation of risk."

[Editor Comments]

[Neely] Kudos to Microsoft for being transparent on the impact of the SolarWinds attack in their environment. Keep source code repositories mostly read-only, audit updates, and use multi-person processes, including security reviews, for promoting code to reduce the likelihood of unauthorized updates or injection of malware.

Read more in:

MSRC Blog: Microsoft Internal Solorigate Investigation Update

ZDNet: SolarWinds hackers accessed Microsoft source code

Duo: SolarWinds Attackers Accessed, But Did Not Modify, Microsoft Source Code


--SolarWinds: CISA Updates Guidance - Update SolarWinds Orion Now

(December 26, 29, 30, & 31, 2020 & January 4, 2021)

The US Cybersecurity and Infrastructure Security Agency (CISA) has updated its guidance regarding the SolarWinds supply chain attack. The update comes in response to the discovery of a new vulnerability in SolarWinds Orion - an authentication bypass flaw in the SolarWinds Orion API. Government agencies were instructed to update their SolarWinds Orion platforms to version 2020.2.1HF2 by the end of 2020. Agencies unable to update by the deadline were instructed to take all their Orion systems offline.

[Editor Comments]

[Neely] SolarWinds has been actively producing updates to mitigate the discovered vulnerabilities used to launch attacks via their Orion software. If you are installing the update, be sure to also follow the guidance on the CERT KB article below to harden your IIS server by installing and configuring the IIS URL Rewrite extension on your Orion polling engines. Given that more is still being learned, it's prudent to investigate alternative solutions.

Read more in:

KB.CERT: SolarWinds Orion API authentication bypass allows remote command execution

CISA: Emergency Directive 21-01 - Supplemental Guidance v2 - Mitigate SolarWinds Orion Code Compromise

ZDNet: CISA updates SolarWinds guidance, tells US govt agencies to update right away


SANS Holiday Hack Challenge

There's still time left to play the SANS Holiday Hack Challenge from now through January 11 -- even if you only have 15 minutes, you should hop in and see what it's all about. Over 18,000 people have played so far, and the reviews have been wonderful. You can learn how to scan for S3 buckets, clone wireless badges, build regular expression skills, and analyze blockchain information.  

"When I have to turn down young job interview candidates and they ask me for pointers on how to get better, I suggest to them to play SANS Holiday Hack Challenge. To me, they are always welcome back in the future." -- @Reedphish

*****************************  SPONSORED LINKS  *****************************

1) Webcast | Join SANS Senior Instructor, Jake Williams for "How to Stay Ahead of Cyberthreats." This webcast and associated whitepaper reviews Deep Instinct, the deep learning cybersecurity software for zero-time prevention | January 13th @ 1:00 PM ET


2) Product Review | Join SANS Instructor, Matt Bromiley for our upcoming webcast, "Automated Testing Against an Ever-Changing Landscape."  Bromiley will review Cymulate Continuous Validation, a highly integrated, customizable platform built to challenge, assess, and optimize the security posture of your organization | January 12th @ 10:30 AM ET


3) Webcast | Tune in for our upcoming webcast, "Security stories from the field: a fireside chat with Barak Engel and Brian Ahern." Engel and Ahern will share real-world stories and lessons learned from their decades of experience in the technology and cybersecurity space | January 12th @ 1:00 PM ET





--TransLink Ransomware Update: Most Systems are Still Down

(January 4, 2021)

Vancouver, BC, transportation agency TransLink says that as of January 4, most of its IT systems are still unavailable a month after they suffered a ransomware attack. Employees have been receiving pay advances rather than their regular paychecks. TransLink has acknowledged that the ransomware operators also compromised employee data.

[Editor Comments]

[Neely] This is an instance of the Egregor ransomware, which many Maze affiliates switched to when Maze shut down their operation last September. Egregor operations include data exfiltration prior to encryption to support a double-extortion option. They also leverage affiliates to hack into the targeted network to drop the ransomware for a 70/30 revenue split. The pay advances used by TransLink replaces the old model of simply repeating the last payroll during a COOP event as banks will reject a duplicate payroll submission. Make sure that you have verified your COOP plans to pay employees and continue benefits with your service providers and financial institutions.

Read more in:

Bleeping Computer: TransLink confirms ransomware data theft, still restoring systems

Vancouver Sun: Some transit employees tighten belts after payroll hit by TransLink ransomware attack


--Zyxel Releases Fixes for Hardcoded Backdoor

(December 23, 2020 & January 2 & 4, 2021)

Researchers from Eye Control discovered an undocumented user account with administrative rights hardcoded in the firmware of Zyxel firewall and AP controller devices. The account can be accessed via SSH or web interface. Eye Control reported the vulnerability to Zyxel in late November. Zyxel has released updated firmware for affected devices.

Read more in:

Ars Technica: Hackers are exploiting a backdoor built into Zyxel devices. Are you patched?

Security Week: Hardcoded Credentials Expose Zyxel Firewalls and WLAN Controllers to Remote Attacks

Bleeping Computer: Secret backdoor discovered in Zyxel firewalls and AP controllers

ZDNet: Backdoor account discovered in more than 100,000 Zyxel firewalls, VPN gateways

Business Forum: ZLD v4.60 Revoke and WK48 Firmware release

Zyxel: Zyxel security advisory for hardcoded credential vulnerability

EyeControl: Undocumented user account in Zyxel products (CVE-2020-29583)


--T-Mobile Discloses Fourth Breach in Three Years

(January 4, 2021)

T-Mobile has disclosed a data breach that exposed some customers' call-related information. This is the fourth breach T-Mobile has acknowledged in the past three years. T-Mobile did not provide specifics about the attack, except to say its "cybersecurity team recently discovered and shut down malicious, unauthorized access to some" customer proprietary network information (CPNI).

[Editor Comments]

[Neely] The breached information could be used to conduct SMS phishing attacks as it includes customer phone numbers and call records. Beware of spurious texts claiming to be from T-Mobile sending you to non-T-Mobile sites to collect additional identity or account information from consumers.

Read more in:

Cyberscoop: T-Mobile: Breach exposed call information for some customers

Threatpost: T-Mobile Faces Yet Another Data Breach

ZDNet: T-Mobile discloses its fourth data breach in three years

T-Mobile: Notice of Security Incident


--FBI: Smart Home Devices are Being Hijacked for Swatting Attacks

(December 29, 30, & 31, 2020)

The FBI has released a public service announcement warning that vulnerable smart home security devices are being hijacked by attackers to use in swatting attacks. By hijacking devices with voice and camera features, the attackers can watch the arrival of law enforcement teams and interact with them. The FBI's announcement urges people "to use complex, unique passwords and enable two-factor authentication to help protect against "swatting" attacks."

[Editor Comments]

[Neely] This attack leverages password re-use. Use different passwords for smart home device services. Enable multi-factor authentication where available. As the attackers are leveraging stolen email account credentials, don't select email processes for second-factor authentication; choose option such as TOTP, aka mobile authenticator app, or SMS.

Read more in:

IC3: Recent Swatting Attacks Targeting Residents With Camera and Voice-Capable Smart Devices

Threatpost: FBI Warn Hackers are Using Hijacked Home Security Devices for 'Swatting'

Security Week: FBI: Home Surveillance Devices Hacked to Record Swatting Attacks

Gov Infosecurity: FBI Warns Of Swatting Attacks Targeting Smart Home Devices


--Kawasaki Aerospace Company Discloses Breach, Reports of Phony Recruiting eMails

(December 29, 2020)

Japanese aerospace company Kawasaki Heavy Industries has disclosed that its network was hit by a data breach in June 2020. Kawasaki says that intruders may have accessed customer data. Separately, Kawasaki has warned that it has received reports of phony emails pretending to be from recruiters from Kawasaki heavy Industries Group in the US.

Read more in:

Threatpost: Japanese Aerospace Firm Kawasaki Warns of Data Breach

Portswigger: Kawasaki Heavy Industries reports data breach as attackers found with year-long network access

Kawasaki: Notice Regarding Fraudulent Emails Pretending to be Recruiters from Kawasaki Heavy Industries Group


--Ticketmaster to Pay $10M Fine for Hacking Competitor

(December 31 & January 4, 2021)

Ticketmaster has agreed to pay a $10 million fine for accessing a competitor's computer systems without authorization. A Ticketmaster employee who formerly worked at the rival company retained access credentials, which were used to snoop on that company's activity with the intent of stealing business.

[Editor Comments]

[Neely] Deleting or disabling accounts for former employees has to be done immediately, particularly for privileged accounts. Include privileged accounts within applications, services and OS. User behavior analytics tools can help monitor for this type of activity as well as help detect insider threats.

[Pescatore] There are large ethical issues around this one (this DoJ action appears to stem from a $110 million anti-trust action settlement by Ticketmaster in response to legal action by Songkick). The cybersecurity lessons: (1) detect hidden backdoors and undocumented URLs in your software and services before they are used against you; and (2) have automated and frequently audited processes to remove access when employees leave the company.

Read more in:

Ars Technica: Ticketmaster admits it hacked rival company before it went out of business

Threatpost: Ticketmaster Coughs Up $10 Million Fine After Hacking Rival Business

ZDNet: Ticketmaster fined $10 million after staff hacked competitor to 'choke off' presale ticket business

Bleeping Computer: Ticketmaster fined $10 million for breaking into rival's systems

Cyberscoop: Ticketmaster pays $10M fine to settle charges of using stolen passwords to spy on rival company

Justice: Ticketmaster Pays $10 Million Criminal Fine for Intrusions into Competitor's Computer Systems


--Citrix Offers Feature Enhancement to Block DDoS Amplification Attacks

(January 4, 2021)

Citrix has released an enhancement to prevent the Datagram Transport Layer Security (DTLS) feature in its ADC and Gateway devices from being used to amplify distributed denial-of-service (DDoS) attacks. Reports emerged last month about attacks taking advantage of vulnerable devices.

Read more in:

Bleeping Computer: Citrix adds NetScaler ADC setting to block recent DDoS attacks

Citrix: Threat Advisory - DTLS Amplification Distributed Denial of Service Attack on Citrix ADC and Citrix Gateway


--Bye-bye, Flash

(December 30 & 31, 2020 & January 5, 2021)

Adobe Flash Player reached end-of-life status as of January 1, 2021. Windows users have begun receiving alerts from Adobe urging them to uninstall Flash. Adobe will block Flash from running as of January 12, 2021. Chrome 88 and Firefox 85, both scheduled for release this month, will remove support for Flash. Microsoft plans to release an update for Windows 10 that will permanently remove Flash. An  optional Windows 10 update, released in October 2020, removes Flash Player that was installed by Windows in Internet Explorer, Edge, and Chrome; users who installed Flash Player manually can remove it using Adobe's uninstall instructions.

[Editor Comments]

[Neely] Monitor for Flash use to discover any remaining processes or services which still rely on it. If you must create an environment which will still run Flash after January 12, isolate that environment carefully as you will need to run older browser and plugin versions which have not disabled Flash and will also contain unpatched vulnerabilities. Deploy your Flash uninstall scripts for the rest of your environment this month and monitor for unauthorized re-introduction.

Read more in:

ZDNet: Adobe Flash: It's finally over (well, almost)

Bleeping Computer: Adobe Flash Player is officially dead tomorrow

Bleeping Computer: Adobe now shows alerts in Windows 10 to uninstall Flash Player

Adobe: Uninstall Flash Player | Windows


--Apex Laboratory Patient Data Stolen

(December 31, 2020 & January 4, 2021)

New York-based medical testing company Apex Laboratory has disclosed that the operators responsible for a July 2020 ransomware attack against the company's network stole patient data. The compromised information includes patient names, dates of birth, test results, and in some cases, Social Security numbers.

[Editor Comments]

[Pescatore] A good reminder that if an attacker encrypted sensitive data, a breach has occurred - it is not just a denial of service event. HIPAA was the first compliance regime to make this distinction; most have moved in that direction.

Read more in:

Security Week: Apex Laboratory Says Patient Data Stolen in Ransomware Attack

Apex Lab Inc: Notice of Data Event




Traffic Analysis Quiz


From a Small BAT File to Mass Logger Infostealer


Accessing Restricted Directory Listings via Your AV Solution


Zyxel Backdoor


Citrix Releases Updates Addressing DTLS Flaw


Microsoft Source Code Accessed As a Result of SolarWinds Backdoor


Zend Framework Deserialization Flaw


Coin Miner Malware Written in Go


AutoHotKey Credential Stealer



The Editorial Board of SANS NewsBites


John Pescatore was Vice President at Gartner Inc. for fourteen years. He became a director of the SANS Institute in 2013. He has worked in computer and network security since 1978 including time at the NSA and the U.S. Secret Service.

Shawn Henry is president of CrowdStrike Services. He retired as FBI Executive Assistant Director responsible for all criminal and cyber programs and investigations worldwide, as well as international operations and the FBI's critical incident response.

Suzanne Vautrinot was Commander of the 24th Air Force (AF Cyber) and now sits on the board of directors of Wells Fargo and several other major organizations.

Ed Skoudis is co-founder of CounterHack, the nation's top producer of cyber ranges, simulations, and competitive challenges, now used from high schools to the Air Force. He is also author and lead instructor of the SANS Hacker Exploits and Incident Handling course, and Penetration Testing course.

Mark Weatherford is Global Information Security Strategist for Booking Holdings and the former Deputy Under Secretary of Cybersecurity at the US Department of Homeland Security.

Stephen Northcutt teaches advanced courses in cyber security management; he founded the GIAC certification and was the founding President of STI, the premier skills-based cyber security graduate school,

Dr. Johannes Ullrich is Chief Technology Officer of the Internet Storm Center and Dean of the Faculty of the graduate school at the SANS Technology Institute.

William Hugh Murray is an executive consultant and trainer in Information Assurance and Associate Professor at the Naval Postgraduate School.

Lee Neely is a Senior Cyber Analyst at Lawrence Livermore National Laboratory, SANS Analyst and Mentor. He has worked in computer security since 1989.

Rob Lee is the SANS Institute's top forensics instructor and director of the digital forensics and incident response research and education program at SANS (

Tom Liston is member of the Cyber Network Defense team at UAE-based Dark Matter. He is a Handler for the SANS Institute's Internet Storm Center and co-author of the book Counter Hack Reloaded.

Jake Williams is a SANS course author and the founder of Rendition Infosec, with experience securing DoD, healthcare, and ICS environments.

David Hoelzer is the director of research & principal examiner for Enclave Forensics and a senior fellow with the SANS Technology Institute.

Gal Shpantzer is a trusted advisor to CSOs of large corporations, technology startups, Ivy League universities and non-profits specializing in critical infrastructure protection. Gal created the Security Outliers project in 2009, focusing on the role of culture in risk management outcomes and contributes to the Infosec Burnout project.

Alan Paller is director of research at the SANS Institute.