Port of Seattle Won't Pay Ransomware Demand; CISA Election Cybersecurity Checklist; D-Link Patches

Two points: (1) This is a decision that needs to be made in advance of any incident; and (2) It is a decision that is above the grade of the CISO. When decisions are made to take a risk (like not patching critical vulnerabilities or not moving to phishing resistant authentication), it is time to reach agreement on what will be done if the risk is realized As a minimum, a table-top exercise each year to walk through reaction/communication/restoration plans and costs should be done.

John Pescatore

The Port of Seattle has brought many systems back online, but some remain offline, such as their website, SEA Visitor Pass, TSA wait times, and the flySEA app. The port is keeping their site updated with status and FAQs, as well as contact guidance to help those impacted by the offline services.

Lee Neely

Not surprising that a state government agency chose not to pay the ransom demand. That'd just be a bad, bad look if they had. It would be helpful in any after-action report to know what led to the compromise so others can learn from this event. Said another way, what defenses were in place and what did the ransomware gang exploit to gain access?

Curtis Dukes

Without suggesting that mitigation after a ransomware attack is more efficient than prevention, continued success of ransomware attacks suggests a mitigation strategy that provides for the backup and recovery of mission critical applications in hours to days. The traditional 3-2-1 copy strategy does not facilitate this. Think hot backups.

William Hugh Murray

If you're hosting/managing election infrastructure, you need to run down this checklist quickly so you have time to remediate any deficiencies. The rest of us need to use this to make sure we're securing our critical infrastructure. This checklist (and resources list) is not specific to election systems, encapsulating what has to become table stakes for any internet facing services.

Lee Neely

A reasonable set of questions, in the form of a checklist, that every information security manager should be asking. Or you could just implement group one of the CIS Critical Security Controls. In other words, nothing new here, just repackaging of good practical cybersecurity advice.

Curtis Dukes

CVE-2024-45694, stack-based buffer overflow, CVSS score 9.8, CVE-2024-45695, stack-based buffer overflow, CVSS score 9.8, CVE-2024-45696, force enablement of telnet service, CVSS score 8.8, CVE-2024-45697, Telnet enabled when WAN connected/hard coded credentials, CVSS score 9.8 and CVE-2024-45698, improper input on telnet daemon, CVSS score 8.8 are attention grabbing. D-Link has not reported exploitation in the wild, but D-Link is a common target, so you want to treat these as if they have targeted/active exploit attempts. It's 2024; we really need suppliers to knock off the hard-coded credentials and unsecure services like Telnet and FTP.

Lee Neely

If you have a D-Link router, no time like the present to download and install the software update, as several of the vulnerabilities are unauthenticated remote access. What's disappointing is that hardcoded credentials exist in the device.

Curtis Dukes

If one has only one or two of these devices, one may find it more efficient to just replace them.

William Hugh Murray

The cat is out of the bag, Ivanti CSA is being actively exploited. Check for IOC's on your CSA device, and if found, build a new one, otherwise update to 5.0 now. Also make sure that the management interface is not internet accessible. The KEV gives agencies until 10/4 to update. Don't wait that long.

Lee Neely

Every organization should plan and budget for HW/SW obsolescence. You simply cannot count on the vendor to backport a fix, as was done this time, for end-of-life software. If the software is necessary for business continuity, document the exception, with mitigating controls as part of the risk management process.

Curtis Dukes

Note that ARM 2024.3.1 SR is the same update, it's a service release. SolarWinds highly recommends ARM be installed on a server which is NOT Internet facing. This is a good time to review their best practices for securing SolarWinds Products. https://support.solarwinds.com/SuccessCenter/s/article/Best-practices-to-secure-SolarWinds-products

Lee Neely

The takeaway for the rest of us is that we need to keep an eye on our ability to detect attacks and reduce dwell times. This is unlikely to be the last lawsuit on lost personal data, and the long term effects beyond cyber improvements and scrutiny are not just on stock prices but also on market share. Something to factor into the cyber conversation with the board.

Lee Neely

At this point KME has restored in excess of 90% of their services, prioritizing systems which support dealers, business administration and third-party suppliers. RansomHub is a ransomware-as-a-service (RaaS) variant and has been active since February and has attacked more than 210 victims by the end of August. RansomHub is described, with mitigations and IOC's, in CISA Alert AA24-0242A (https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-242a). Core mitigations are phishing-resistant MFA, keeping systems patched/updated, and training users to recognize/report phishing attempts.

Lee Neely

This flaw was reported to Google on January 18th and was fixed by Google in May. Google also updated their documentation, recommending developers use the "--index-url" argument instead of the "--extra-index-url" as well as making use of an Artifact Registry virtual repository when requiring multiple repositories. The "--index-url" argument forces the package to be searched for (and downloaded) from the named repository, reducing the risk of dependency confusion.

Lee Neely

Apple released both iOS/iPadOS 18 and 17.7. You may want to push 17.7 vs 18 while the first couple of updates to 18 are delivered. 17.7 addresses 16 vulnerabilities, while 18 addresses about 36. Both 17.7 and 18 address a kernel vulnerability which allows VPN bypass, Bluetooth unauthorized access, and Safari private browsing and sandbox bypass. None of these flaws were marked as actively being exploited. iOS 18 introduces Apple Intelligence, Apple's entry into GenAI and requires iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later. Apple also released macOS 15,macOS 14.7, macOS 13.78, tvOS 18, watchOS 11, visionOS 2, Safari 18 and Xcode 16.

Lee Neely

Apple also released iOS 17.7 to addresses security issues for some devices that do not support iOS 18. Installation of iOS 18 on my iPhone 12 required 14G of free storage and three tries, while upgrade to iOS 17.7 required far less.

William Hugh Murray

In addition to the attacks being fileless/in-memory and hard to detect, they were also using living off the land mechanisms, so scans for installed tools would have not have yielded results. This is a good scenario to mention to your EDR provider to see if they can detect and respond/block this behavior.

Lee Neely

This is a case of the ROI of the lawsuit, vs. the risk of information about their security disclosed in the course of the suit, which the court may or may not be able to adequately protect. Apple is also now claiming their anti-spyware program is the best in the world, and NSO/Pegasus have a corner on this market. Be careful claiming your solution is the best in the world. Remember unbreakable Linux, or LifeLock's CEO's SSN on bulletin boards? Not the target you want to wear.

Lee Neely