Taiwan Reports DDoS Attacks Following Pelosi Visit; Researchers Break Post-Quantum Encryption Candidate; Patch Critical VMware Flaw

The scale of these attacks, and their targets, point to hacktivists. It looked like recovery was swift, and I doubt it significantly affected operations at these organizations. But remember that DDoS attacks can also be used as a smoke screen to cover more sophisticated attacks.

Johannes Ullrich

The group Anonymous group jumped into the mix, retaliating for the attacks and taking credit for hacking into government website of China's Heilongjiang Society Scientific Community Federation. The hacked site was taken down but lives on in the Internet Archive. The point is that beyond being prepared for DDoS attacks, you also need to watch for sympathetic actions, possibly retaliating on your behalf, resulting in unplanned escalation of tensions.

Lee Neely

This is exactly why we need to look for new encryption standards long before they are actually needed. The NIST process is slow and deliberate. It does allow for sufficient time and it does give these proposed standards exposure to encourage review.

Johannes Ullrich

Three of the new schemes rely on new, less understood assumptions, which could really raise the bar, or be subject to an old-school attack not accounted for. Now is the time to find issues with the new candidates, not after we've moved to them. I give a lot of credit for all the candidates who effectively signed up for a multi-round, public, murder board. Once the process completes, vendors will need time to both produce products which implement them, and come up with best practices so you can then discuss moving to Post-Quantum Encryption effectively.

Lee Neely

I hope I do not need to remind anybody to not expose these systems to the open internet. This isn't the first critical VMWare flaw this year.

Johannes Ullrich

Take a deep breath, grab your coffee, and scan the VMware advisory page for your specific product to find actions needed. It includes a table of criticality, CVE's and links to KB articles for each. While not actively exploited, the criticality should be used as an indicator of how likely that is to change. There is only one workaround listed for one out all of these issues, frankly, plan to patch all the affected things.

Lee Neely

The top strains include RATs, banking Trojans, information stealers and ransomware. If the names Tesla, Formbook, AZORult, LokiBot, etc. aren't well known to you, read the CISA bulletin to learn about them. The mitigations remain the same: implement (comprehensive) MFA, keep systems patched and updated, don't expose RDP to the internet, have good (offline) backups and train users. When I say comprehensive MFA, I mean don’t skip any externally facing services, and don’t exclude any users from having to use it.

Lee Neely

The vulnerability is now public knowledge, which means participants have to patch PDQ. Some of the Monroe Electronics components of the system had flaws which couldn't be patched previously due to a lack of updates for the last few years. Ken Pyle, who discovered those flaws, will be presenting more information at the DEFCON 30 IoT village.

Lee Neely

An instance where false positives more tolerable than false negatives, short of so frequent as to destroy trust in true positives.

William Hugh Murray

Often, sensitive OT devices are (wisely!) disconnected from the internet, it's probably a good idea to isolate the most sensitive documents. Putting them on paper makes them much less accessible by foreign adversaries!

Christopher Elgee

The downside of paperless is that you need to make sure the protections are appropriate for your most sensitive paper based processes. When assessing the process think of how we handled paper. While we are familiar with locked filing cabinets, offices and storage rooms, you still have transport concerns, even registered mail can get waylaid. Even so, the risks of the old processes may be lower than the online process for certain use cases. Document gaps and make deliberate decisions to accept the risk or require alternate processes in those scenarios.

Lee Neely

The course is conducted through the local US Secret Service field office and is available to active full time employees (law enforcement, judges and prosecutors) of state or local government agency. If you fit into one of those categories, this should be a great opportunity to hone your skills around digital evidence, network intrusion, and computer/mobile device forensic issues.

Lee Neely

Translation - we don't know the scope of the attack; turn it all off, check everything, only enabling known-good services. This is a tough call, particularly with 79 chambers and over three million members who use their services. They are using the DIHK web site and LinkedIn to post updates. Are you prepared to communicate in a similar situation? Make the call? And do you have multiple communication paths for users and partners?

Lee Neely

Don't get caught up in buzzwords and new shiny terms, make sure that you're using secure practices with software you're producing, paying attention to internet sourced components, make sure software installed is the genuine product from your vendor, with sufficient regression testing prior to production deployment. Make sure that you're watching your threat feeds for software and services you use so you can follow up on possible areas of concern. After that, rely on your existing processes for detection and monitoring of malfeasance.

Lee Neely

The SEC has a red flags rule, which requires financial institutions and some "creditors" to conduct a risk assessment to determine if they have covered (in scope) accounts. If so, they are required to implement a program for the relevant red flags to protect those accounts from identity theft. If you are a FI or creditor, review the rule to make sure that your risk-assessment meets the current criteria there, and address any shortcomings post-haste.

Lee Neely

It is not clear from the report cited below whether this punishment is more about IAM or the traditional requirement that banks know their customer, authentication, or new account.

William Hugh Murray