Data theft-It’s not just for medical facilities

 There’s been volumes written about data theft in medical facilities, methods, and effects. This is no

wonder given the mountain of data created daily from the patient care and operations. Another viable

target would be auto dealerships. This hold much the same data hospital would generally. When a

person purchases their vehicle, as a course of the process, they provide their name, address, data of

birth, SSN, financial information, and other data. The hospital or medical care facility collects much the

same, with additional data for the patient care.

In this case an automotive dealership was compromised. On or about May 27, 2023, the Jeff Wyler

Automotive Family an unauthorized party compromised their perimeter security and was able to access

the consumer information (e.g., name, date of birth, SSN, driver’s license or state ID #, medical

information, health insurance information, and financial information). This was detected on January 29,

2024.

The method of attack unfortunately was not detailed. Anytime this event occurs, there’s something to

learn and use to build up your defenses. This experience does highlight the need for regular

cybersecurity assessments. This, depending on the environment and budget, may consist of vulnerability

scans, per tests, and threat feeds for your equipment. This also includes working on the vulnerabilities to

remove these and secure your system.

SSH Tool Weaponized

 One of the more interesting facets of this industry is there’s always something new to learn. The

creativeness and inventive nature shine with the new tools introduced for attacks and subsequently to

improve defenses. One area that hasn’t seen many new tools created has been with SSH. This is widely

used and continue to be a primary security method.

The new security tool is SSH-Snake. This is an open-source tool. Originally released in January 2024, the

design was to work through a network using SSH private keys. This is done automatically. The program

through its work then creates a thorough network map and its dependencies. The result allows the

security staff to understand vulnerable points where an attacker could use SSH and private keys.

You can see the usefulness of this for the company. Like any tool, there are positive and negative uses.

The negative side of the coin here is the tool was weaponized. This was modified to self-modify and

replicate itself through the network. The upgraded tool has been coded to find locations where

credentials are generally kept and analyzes the shell history files.

As an additional aspect to circumvent security, the tool is fileless. While this is newer, it allows for an

increased level of difficulty in detecting the tool and allows it a greater level of flexibility. This is still a

tool to be used to improve your network security stance. The weaponized version should be on your

radar.

Oil Pipeline Targeted

 Companies are targeted for attack for various reasons. One predominant reason continues to be

revenue. Without the possibility of a payout, there isn’t much reason for a group to spend the resources

to attack the target.

One set of high value targets are pipelines. A few years ago, there was an issue with a pipeline in the US

(i.e., Colonial Pipeline in 2021). Another pipeline has been compromised with the same form of attack,

but in Canada. In this case, the Alpha V group successfully compromised the Trans-Northern Pipeline’s

systems in three provinces and applied the standard ransomware. They were able to exfiltrate

approximately 190GB of data. The successful attack occurred in 2023.

Unlike the US attack, there were no unplanned interruption for the pipeline’s operations. Unfortunately,

not much has been published as to the attack method used, depth of network penetration, and type of

data. Portions of this information could be helpful as to how best to secure other’s networks. If any

nuances would occur with this attack.

We must continue to be ever vigilant. This includes having internal systems checked more than once

over time.

Supply Chain Lesson #587

 Bank of America is massive with branches throughout most of the nation and other countries. Being

such a large operation, the bank could not reasonably maintain all aspects of their operations from a

central hub. The vast expanse of this would increase their FTEs significantly. This standard operating

procedure is used in most industries.

One area BoA uses this is with their service providers. Infosys McCamish Systems (IMS) was

compromised on or around November 3, 2023. The next day in the chronology was November 24 when

IMS notified BoA the data with their deferred compensation plans may have been compromised. This

included for the individuals their name, address, social security number, date of birth, and financial

information (account number, credit card number, etc.). For this compromise, approximately 57,028

clients were impacted. This ransomware attacked was claimed by LockBit.

This set of data is perfect to sell and be abused. With this the attackers or whomever purchases the data

has ample people to attack.

Authentication became much more difficult

 We all understand the issues phishing has caused over the last few years. There have been countless

compromises targeting email systems and pivoting off these into other areas. When we thought, this

was starting to get controlled at some level, there’s a new wrinkle.

A finance worker of a multi-national firm attended a video conference call, just as so many of us do

every day. With this conference call, the finance worker was directed by the Hong Kong company’s

“Chief Financial Officer” to pay $25M. There were other “staff” in the call also. The message prior to the

meeting was a bit suspicious as it asked for the meeting to discuss a secret transaction.

Since other staff, who the finance worker recognized, were in the meeting, it seemed legitimate. The

$25M USD or $200M Hong Kong dollars were transferred. Well, not everything was as it seemed. The

CFO and other staff in the meeting were actually deep fakes. On the bright side, the police had arrested

six others with scams much like this.

Technology will find a way around the defenses and detection tools we put in place. We’ll improve the

defenses and tools only for the cycle to continue. In these instances where the transaction may not

quite feel right, the suspicious mind should overrule natural tendency of “It should be fine.” Our staff

training needs to be updated regularly to keep us with the new technology and attacks. Granted this

nuance is difficult to filter, but the human factor is there to apply common sense.

New Attack Focused on AV (autonomous vehicle) Sensors

 Attacks on AV sensors are popular at regional conferences and at the fountain of knowledge (aka

DEFCON). The different attacks are always interesting (e.g., SQL injection to gain access, creating a fake

object point in LiDAR, and others). Earlier this year a new attack emerged. The MadRadar is designed to

mask actual objects from the sensor or create fake/phantom objects for the sensor. Specifically, the

attack can provide the vehicle’s sensors with false positives, false negatives, and translation attacks.

The attack, created by a team at Duke University, is agnostic and may be used against any vehicle’s radar

system, making this exceptionally useful. The demonstration for this has shown the radar being tricked

into detecting a vehicle driving towards it instead of the vehicle driving away from the targeted vehicle.

Other demonstrations have created a vehicle where there was none. The attack is also flexible and can

adjust to different types of radar. This is done via the tool learning about the radar from the transmitted

signals. This ability to adjust is based on the target radar’s bandwidth, chirp time, and frame times.

This would be a viable attack against the different functions for vehicles using radar, as with adaptive

cruise control. With vehicles depending on sensors for autonomous driving, this is especially

problematic. This may also effect park assist, blind spot detection, and rear collision warming.

While this is from researchers, this is a viable attack to complicate AV operations.

Autonomous Vehicles (AVs) have a Substantial Attack Surface

 This is a fantastic age to live in. We have vehicles that notify us when another vehicle is near us, when we’re too close to the vehicle in front of us or the side of the road, when we are sliding inadvertently into the next lane, and log our activities. This is a massive step from the vehicles of 10-15 years ago. The sensors installed within the vehicle offer cutting edge technology for the driver. These also have improved safety for the occupants along with others on the roadmap. Have pentested an AV, I can attest this is a delight.

While I sing the praise of the AVs, there are issues. This has potential threats to the AVs due to the platform, sensors, and OS. These are all new attack surfaces and vulnerabilities. If exploited, these provide an opportunity for disaster. The new threats come from various sources. These new machines, as they are heavily dependent on software, are open to remote attacks. If successful, modules could be compromised. Depending on which one is targeted and breached, there are varying levels of criticality. For instance, steering or brake ECUs are relatively serious.

Data is the new gold and oil. This is especially the case with vehicles. Each collects a mass amount of data from general operations and the sensors. The data may be used in multiple scenarios.

While sensors have improved vehicle operations and safety, there are potential issues here also. The sensors could be spoofed, providing false data to the vehicle and data processing. The fake data could provide a false set of data for the surroundings. This could lead the vehicle on the wrong path.

While this could provide for issues, there are preventive measures to the taken. The software may be hardened, making these more robust. Patching is also pertinent. This occurring regularly limits the attack surface. Encryption should be used with vehicles data and communication. This limits the weak points which are targets.

  

Services 

Enterprise and Embedded System Cybersecurity Engineering & Architecture

Red Team Product Pentesting   |   HW & SW BoMs  |   CBoM  | 

Vulnerability Management   |   Tabletop Exercises (TTX)   | 

Embedded Systems Architecture   |   Threat Intelligence   | 

TARA (Threat Assessment and Remediation Analysis) |

Supply Chain Cybersecurity Review 

Reverse Engineering

 charles.parker@mielcybersecurity.net 810-701-5511