Check Backup Processes If Outsourced/Cloud Services Are Compromised; A New Command-and-Control Framework Detected; Physicians Can Be Prosecuted for HIPAA Violations

Years ago, all businesses learned that if the power went out in the data center, business stopped. Backup power or facilities were required and became common. Once those were in place, the first power outage pointed out another important requirement: regular testing of switching over to back up mechanisms. These days outsourced (mostly cloud) services are the “new electricity” and those backup processes *and* testing of those processes are needed to reduce the impact that Common Spirit’s customers are reporting.

John Pescatore

Are you prepared to selectively take affected systems offline after an attack to rebuild them? Do you know the interdependencies of such actions? Can you reconcile transactions on connected systems? Dependency mapping, particularly in mature environments can be incredibly difficult, and may necessitate a response posture of taking large numbers of components offline rather than surgically addressing one at a time. Take a lead from actions taken during maintenance windows, typically based on lessons learned, for planning your approach.

Lee Neely

Kudos to Talos as this is the second C2 they identify in the wild. We have added them to the C2 Matrix which now tracking 110 C2s: https://www.thec2matrix.com/

Jorge Orchilles

The Alchimist C2 servers pass instructions to the Insekt implant to execute them on Windows and Linux systems. macOS systems must have a previously installed Mach-O file contains the exploit for CVE-2021-4034 (Polkit's pkexec utility), noted the flawed version must pre-exist for the exploit to work. Alchemist is intended as an all-in-one attack framework which avoids detection, is high-quality, rich in features and is good for dropping implants on targets. These frameworks also make it easier for attackers to hide by blending in with other malicious traffic avoiding specific attribution.

Lee Neely

Two issues of note with this one: (1) This was essentially undetected insider fraud – the physician allowed the sales rep to use his account for a long time to access sensitive information in a way that was probably well outside normal behavior profile of physician access. This should have been a low false positive detection for any user behavior analysis. (2) Direct criminal prosecution of HIPAA violations has not happened often but can and does. Making sure management is aware of (2) can help justify the need for being able to do (1) in healthcare systems.

John Pescatore

The information was leveraged to determine which patients had insurance that would cover the non-FDA approved compound medications sold by Riston’s company, and when authorized, Alario received commissions and other benefits. Alario granted access to patient records, beyond levels allowed to staff as well as introducing Riston to patients as an affiliate or employee of the practice. While it’s not clear if Riston was simply allowed to use the computer with Alario’s credentials, it is clear that he was permitted free access to digital and physical records beyond regular office hours. While it’s tough to stop someone surrendering their credentials, or just handing over control once logged it, it is possible to monitor access for anomalous patterns. Track access to sensitive information, particularly outside business hours. Make sure that you have sufficient separation of duties, limiting who can grant permission to information, consider multi-person rules. Closely monitor changes to access controls on sensitive information.

Lee Neely

One would hope that the Exchange patch would have been included. At least Microsoft has added an RSS feed to their Security Update Guide to facilitate tracking this particular issue (see story below). As to the monthly update, most of the flaws there are elevation of privilege bugs. Don’t forget to look to your Adobe security feeds as well. They just released updates to address 29 vulnerabilities in Acrobat and Reader, Commerce, Magento, and Cold Fusion.

Lee Neely

Not a routine fix. Likely to be distributed out of cycle when ready.

William Hugh Murray

The RSS feed for the SUG is https://api.msrc.microsoft.com/update-guide/rss (which is also on the SUG web page) and is available now. The move to the new SUG from the old email advisory system finished in September; follow the instructions to create your profile to join the new system. Incorporate your RSS feed into systems where you want realtime information. You'll need a RSS Feed reader - either a desktop app, mobile app or browser plugin. No account is needed to follow the RSS feed.

Lee Neely

Many good initiatives listed, but of course press releases are like sailboats – progress takes powerful wind to see actual progress. Two good things in there: (1) I would really like to see this statement lived up to by the US government: “Strengthening the Federal Government’s cybersecurity requirements, and raising the bar through the purchasing power of government. ” The government demanding higher levels of security in the products and services they procure is the single most powerful way they can drive a major reduction in vulnerabilities; and (2) There is a long history around fire resistant material standards where independent organizations like UL Labs worked with government agencies like NIST and industry associations to make sure that a wide variety of flammable “things” were much safer. This all succeeded because the government didn’t try to dictate standards, it worked with private industry to make sure that procurements and use of flammable “things” had to include compliance with the industry standards. Today, in the Internet of Things, there are already some meaningful standards efforts, like Connectivity Standards Alliance-IoT which have some big names on board: Amazon, Apple, Google, Samsung, etc. If the US government put its buying power behind some consensus standards, the bar for IoT security will be raised.

John Pescatore

My concern with the IoT label is that it may not remain compliant continuously; what’s needed is a code users can scan to verify current status online, as other countries have done.

Lee Neely

Labeling will be a great help. One of the things that a label should include is the environment in which the device is intended to be used, and specifically whether it is intended to be attached to the public networks. Devices like cameras and some medical devices, that are intended to attach directly to the public networks have different requirements than those like baby monitors or smartTVs that are intended to be connected only to local area networks.

William Hugh Murray

Medibank has set up a status page with information and updates for customers (first link below) and has sent over 2.8 million email and text messages (where preferred) to Medibank and ahm customers. They have engaged the Australian Cyber Security Centre, regulators, and others to assist with the agency and comms. Keep an eye on the status page as things progress and services are restored.

Lee Neely

While not a lot about the Fortigate flaw is disclosed, note that not only should you apply their provided update, but also limit access to administration interfaces. Make sure that you’re not exposing any management interfaces directly to the Internet. If you don’t find them, Shodan will.

Lee Neely

The Symantec blog includes IoC's you can incorporate into your system to find components of this attack, preferably before any damage is done. Review the CISA aa22-277a bulletin (https://www.cisa.gov/uscert/ncas/alerts/aa22-277a) for MITRE ATT&CK techniques. CISA’s mitigations are not new ideas; they include network segmentation based on function, managing vulnerabilities and configurations, leveraging segmentation, anomalous behavior detection, and restricting use of remote administration tools.

Lee Neely

As China continues to hone their skills, raising the bar, we need to also keep an eye on our prevention, detection and response capability. Prevention requires your CISO to review your supply chain resilience, strengthen information sharing with other (federal) agencies who can help in the event of a breach, conduct executive level exercises training for response, and continuously audit for threat actor activities.

Lee Neely