SEC595: Applied Data Science and AI/Machine Learning for Cybersecurity Professionals
SEC595Cyber Defense, Artificial Intelligence
SANS Community Benefits
Connect, learn, and share with other cybersecurity professionals
Top of the News
Globe Life Says Threat Actor is Attempting to Extort Funds Following Data Breach
In an October 17 filing with the US Securities and Exchange Commission, Texas-based insurance company Globe Life disclosed that 'an unknown threat actor' contacted them, demanding payment in exchange for not releasing customer data. Globe Life believes the data Òcan be traced to the Company's subsidiary, American Income Life Insurance Company.'
Editor's Notes
- Slide 1 of 2
Most likely a ransomware attack on the subsidiary company. This reinforces the need for the parent, Globe Life in this case, to enforce and monitor a cybersecurity program across the entirety of the company and its subsidiaries. The cyber incident only adds fuel to the fire on lack of management controls.
- Slide 2 of 2
The threat actor is releasing personal and health data to short sellers and plaintiffs' attorneys in an attempt to impact claims and policies, rather than executing a traditional ransomware or extortion attack. This follows reports in June of improperly implemented access controls which would allow access to sensitive data; Globe Life is not commenting on their possible connection. Names, email addresses, phone numbers, addresses, SSNs and heath data were stolen, but no financial information was exfiltrated.
Slide 1 of 0- Slide 1 of 2
Fraudulent IT Employees Turn to Extortion
Analysts in the Secureworks Counter Threat Unit (CTU) have documented a pattern of fraudulent employment, data theft, and now extortion by alleged North Korean operatives posing as IT contractors. The structure of the scheme and certain technical details, including use of Astrill VPN IP addresses, align with previous efforts by a known threat group to "generate revenue for the North Korean regime" through "theft of intellectual property with the potential for additional monetary gain through extortion." One example timeline showed an employee being hired, exfiltrating proprietary information, being terminated for poor performance, and then sending evidence of the stolen data alongside demands for a "six-figure ransom." Investigators show how these agents interfere in the provision of equipment, either insisting on using personal machines or re-routing their company computers to be delivered to a facilitator at a laptop farm to provide a "credible IP address space." The report also suggests collaboration among agents: providing references, filling their conspirators' empty positions, potentially sharing the employee identities, and/or managing multiple identities each while avoiding or counterfeiting webcam use. CTU stresses caution and verification in companies' hiring processes, and asks employers to be on the lookout for unusual or frequent changes in addresses and banking details.
Editor's Notes
- Slide 1 of 2
KnowBe4 shed light on this set of TTPs back in July when it fell victim to fraudulent employment. One surefire way to avoid this scam is to require in-person interviews and do not deviate from well-established security practices for remote workers.
- Slide 2 of 2
This parallels fraud schemes associated with the Nickel Tapestry threat group, who are motivated to make money for North Korea. Consider carefully in-person validation of new-hires and/or applicants. Besides vetting, use restraint in granting access to sensitive data.
Slide 1 of 0- Slide 1 of 2
ESET Partner's Domain Spoofed to Send Wiper Malware
A domain belonging to one of ESET's partners based in Israel was spoofed and used to send malicious emails containing wiper malware. The impersonation attack claimed to be from ESET Advanced Threat Defense Team warning that state-sponsored threat actors were targeting the recipients' devices and offering advanced antivirus software to protect the recipients' devices. ESET said the malicious messages were blocked within 10 minutes; an investigation is underway.
Editor's Notes
This is what we need protective DNS for. Coupled with our existing attachment filtering/vetting, it's one more tool in our belt to thwart BEC. You still need EDR, blocking of bad/malicious sites, and even mechanisms for users to report suspicious email. In this case the stakes are high as the payload is a data wiper. Regardless of the impact, implement as many technical levels as possible to reduce the likelihood such a payload makes it to the targeted user.
The Rest of the Week's News
Microsoft Lost More Than Two Weeks of Cloud Customers' Security Logs
Microsoft has notified some customers that it has lost more than two weeks of security logs. The missing data are due to 'a bug in one of Microsoft's internal monitoring agents result[ing] in a malfunction in some of the agents when uploading log data to our internal logging platform.' The issue, which was first reported by Business Insider on October 4 (paywall), affects certain cloud products, including Microsoft Entra, Sentinel, Defender for Cloud, and Purview. The incident comes a year after Microsoft was criticized for withholding log information from some US federal government agencies; that information could have helped identify serious intrusions sooner. In September 2023, Microsoft began providing log data to customers with lower-cost cloud services.
Editor's Notes
- Slide 1 of 2
The lost data will make it harder to determine if you've had nefarious access to your resources during the two week window of September 2-19. Consider having monitoring that alerts when logs aren't flowing or there is a noticeable change in volume.
- Slide 2 of 2
In particular the missing Entra logs may be a problem for some organizations. Ask yourself why you didn't detect the missing logs and how to detect issues like this in the future.
Slide 1 of 0- Slide 1 of 2
Some Chrome Extensions Not Longer Supported Following Move to New Extension Specification
As part of its move to the Manifest V3 extension specification, Google has begun ending support for some older, albeit popular extensions, including the uBlock Origin ad blocker. The Chrome Web Store's uBlock Origin page reads, 'This extension may soon no longer be supported because it doesn't follow best practices for Chrome extensions.'
Editor's Notes
Some sites are claiming that uBlock Origin works best in Firefox, which is a bummer if you're looking to have the same ad block extension in both browsers. Consider an alternative, AdBlock plus, or installing a proxy such as Privproxy or Pi-Hole to provide the services you're used to.
Study Finds Vulnerabilities in E2EE Cloud Storage
Researchers at ETH Zurich have published a paper outlining serious flaws in the end-to-end-encrypted (E2EE) services of several major cloud storage providers, many of which are severe enough and simple enough to execute to "directly oppose the marketing promises of the platforms, [and] create a deceptive and false premise for customers." The study focuses on five companies: Sync, pCloud, Icedrive, Seafile, and Tresorit, which collectively serve about 22 million users. Given that threat actors control a malicious server, all studied providers are vulnerable to varying numbers of "attacks and leakages," including unauthenticated key material and public keys; protocol downgrade; link-sharing leakage; unauthenticated encryption and chunking; tampering with files, file names, and metadata; file and folder injection; and leakage of plaintext information, metadata, and directory structure. The companies were notified of the report in April, 2024, but uneven responses given to ETH Zurich and to journalists indicate only some intend to fix the vulnerabilities, and Icedrive openly has no plans to do so.
Editor's Notes
These vulnerabilities are no big surprise, and most "end-to-end" encrypted systems suffer from these issues. You often implicitly trust that code loaded from the trusted site is implementing the end-to-end encryption as intended. A malicious actor able to manipulate the endpoint will be able to alter the code to bypass the end-to-end encryption implementation.
Cisco DevHub Offline after Data Breach
Cisco has "disabled public access" to DevHub, an environment providing customers access to code and other developer resources, after claims of a data breach surfaced online. The data alleged to have been exfiltrated and posted for sale may include "source code, API tokens, hardcoded credentials, certificates, and other secrets belonging to some large companies, including Microsoft, Verizon, T-Mobile, AT&T, Barclays, and SAP," though the company's official report characterizes the contents of the breach as "a small number of files that were not authorized for public download," explicitly ruling out Personally Identifiable Information (PII) and financial data, barring further discoveries. Cybersecurity professionals commenting on the breach emphasize that any stolen data, no matter how apparently significant, can be leveraged in unpredictable ways for intelligence or exploitation in future attacks, potentially allowing attackers to "pivot to more sensitive systems" from public-facing ones.
Editor's Notes
Last week, threat actors were spotted offering this information for sale on the DarkWeb. The takeaway is to validate the security of your public facing services, not only ensuring they are patched and secure, but also that they can survive an attack.
Swiss Vocational School is Recovering from Ransomware Attack
A vocational school in the Swiss canton of Schaffhausen experienced a cyberattack on October 2. The Berufsbildungszentrum (BBZ) Schaffhausen said that the attackers gained initial access to the institution's systems through a gap in their firewall. BBZ Schaffhausen has not responded to the ransom demand. Officials are investigating the scope of the attack.
Editor's Notes
- Slide 1 of 2
A 'gap in their firewall' is mostly likely attributable to poor configuration management. The Center for Internet Security offers free benchmark guidance for several commercial firewalls (Cisco, Checkpoint, Fortinet, etc.), to help you configure to a known security standard.
- Slide 2 of 2
This is the latest in a string of attacks targeting German-speaking schools in the region, leveraging flaws in their perimeter. Make sure you're testing, validating, and updating ALL of your boundary control devices regularly.
Slide 1 of 0- Slide 1 of 2