Check Mobile Devices for Heliconia Spyware; Update NVIDIA Drivers; Transparency Around Incidents is a Responsibility

As Google points out “ …the commercial surveillance industry is thriving and has expanded significantly in recent years, creating risk for Internet users around the globe.” I’d like to see Google publish the list of the 30 or so commercial spyware vendors they are tracking, to make it easier for companies to both avoid buying from them and detect when attackers are using the tools. But you can find most of Google’s TAG reports to get the names of the companies and the indicators of use.

John Pescatore

These tools are designed to attack specific vulnerabilities which have been patched. As such, you need to make sure that you've deployed the updates to Chrome, Firefox and Defender. Don't overlook Chromium based browsers. This is a good time to see if you've been procrastinating deploying other updates and run that to ground. Don't let impact deter you from finding a path: work with your business units to find how and when, then support their efforts to senior management.

Lee Neely

The vulnerabilities are on both Linux and Windows systems, so you need to deploy the update to both platforms. The Linux updates address weaknesses in the kernel mode layer of the driver which could be leveraged for DOS, code execution, data tampering or information disclosure.

Lee Neely

NIST, CISA and ENISA all have good guidelines for best practices in incident reporting. They all recommend what ENISA calls “…quick dissemination of information among interested parties.” That doesn’t mean telling the world you are vulnerable before you have stemmed the bleeding, but lack of transparency usually just increases the amount of blood spilled.

John Pescatore

I repeatedly say, “Today you will not be judged for being the victim of a security incident, but you will be judged on how you respond.” It is vitally important that organisations ensure their incident response plans include how they clearly and transparently communicate details of a security incident to various stakeholders such as management, regulators, media, staff, and the public. It is also important that as defenders we share our experiences so that together we can all work to make our systems more robust and secure.

Brian Honan

While sharing can be scary, your peers really do want to know if what happened to you can happen to them, and this is not about making you look bad. Establish communication channels, leveraging your sector ISAC, CISA or other organization, to include agreements on disclosure, anonymization and retention. Remember this is a two-way street: all parties will benefit, not just by information sharing but also potential resources, tools and references you will need.

Lee Neely

Liability concerns are likely part of the reason for lack of transparency in sharing attack details. That said, cyber defenders benefit from understanding attack details; to include the defenses that were in place at time of attack.

Curtis Dukes

Better to be criticized for lack of transparency than to put others at risk by premature disclosure. That said, one should be able to share safely with one's peers and colleagues. That is what ISACs are for. Most of these are doing a good job of sharing safely. Belong.

William Hugh Murray

The RansomBoggs ransomware is Monsters Inc. (Disney, 2001) themed, and while announcing it's using AES 128 encryption, actually encrypts files with AES 256 and appends the .chsch extension to those files. The key is stored in a file called aes.bin with the public key either passed as an argument to the ransomware or it's hard coded. The ransomware is distributed via a PowerShell script, and written in .NET. The primary purpose of this attack appears to be disruption versus extorting money, even so, make sure your users are trained to be cautious with unknown attachments/scripts which come bearing gifts. Check with your EDR provider for detection capabilities.

Lee Neely

For more on the Sandworm threat actor, I highly recommend Andy Greenberg’s book, Sandworm: A New Era of Cyberwar and the Hunt for the Kremlin's Most Dangerous Hackers.

Jorge Orchilles

This botnet operates on Windows and Linux systems, and is targeted towards gaming firms, technology companies, and luxury car manufacturers. Systems are infected using SSH to account with default or weak connections. As it's not persistent, a crash or other interruption to the process means that nodes have to be re-acquired. While the crash resulted because of a lack of error handling, don't assume malware operators aren't including error handling, most do. Making sure that default passwords are changed, and passwords, where they remain, are sufficiently strong, has to be SOP. Make sure that you're checking for re-introduction of these after updates or upgrades.

Lee Neely

Your business units are going to want to regression test updates to Fusion Middleware. While appropriate, time bound those activities so you can get the updates deployed. The update includes 39 security patches, 35 of which may be remotely exploitable without authentication, so make sure you prioritize any Internet facing applications. Updates are also tied to the version of Oracle Database used, so make sure to also apply the November database CPU.

Lee Neely

While disappointing that cyber criminals targeted a small island nation, it serves as reminder for organizations to regularly exercise their recovery plans for service disruptions that impact both business and government operations. Also, don’t forget those third party support relationships, as they form part of the cybersecurity chain of trust.

Curtis Dukes

The Vanuatu government called in help from Australia. I remember visiting Tahiti years back and at that time their governor was not interested in any resources outside his islands. Ask yourself, what resources would you need, "off your island" to respond to an incident, then make connections with them. Make sure you know how to initiate an engagement, what their capabilities are and what costs will be incurred. Now is the time to refine your list, expectations and understanding, rather than when the chips are down.

Lee Neely

Are the cybersecurity requirements for both the pipeline and rail sectors really that unique? Each of the critical infrastructure sectors share more in common when it comes to developing cybersecurity best practices. What’s needed is a common and prioritized set of safeguards to achieve a baseline cybersecurity posture. The good news, one exists [CIS Critical Security Controls] and is measurably effective against the top five attack types.

Curtis Dukes

Note that comments can only be accepted via the Federal eRulemaking Portal, US Mail, or Fax and must be submitted by January 17th, 2023. The eRulemaking portal is going to be your best bet here. The proposed rulemaking includes goals such as common security frameworks, segmentation, patching and access controls; the need is for those with experience in the field to review and make sure they can be accomplished.

Lee Neely

Publishing for comment is good practice for regulators.

William Hugh Murray

This is just another issue in a long list of issues that point out most virtual “currencies” don’t meet the definition of what it takes to be called a currency. It is kind of like the difference between a bottle of miracle pills and actual medicine.

John Pescatore

As Crypto continues to become "mainstream" disclosures and other regulatory practices from the banking industry are needed to protect the "average" consumer, particularly when they are seeking lost funds. This ruling leverages a UK update to civil procedure law from October 2022 which streamlined information disclosure against foreign entities, in fraud cases, where they are intended to be prosecuted in English or Welsh courts.

Lee Neely

Two things come to mind. First, when redacting information, make sure that it cannot be restored. Better still, don't capture information you don't want shared in the first place. Second, beware of social engineering, just as there is no Nigerian Prince offering you millions for your help, (sorry, there is not), these apps don't unfilter anything. They do, however; install malware such as the WASP stealer malware. There are multiple malicious Python packages and other lures, such as one aimed at Discord users, with the same intent. Aside from cautioning users to not fall for scams to reveal the "person behind the mask," remind them that what goes online stays online and really is controlled by the service hosting the content.

Lee Neely

While the focus is on the open source app and shift in attacker tactics, this is really about capitalizing on human frailty to lure users into downloading the malicious app. Ingenious!

Curtis Dukes