Municipalities targeted: City of Florence pwned!

Municipalities have a very distinct problem. They are frequently targeted for ransomware and other attacks, as the attackers know their systems generally are not fully secure unless they been recently successfully attacked and have corrected and mitigated the issues. This is driven by budgetary constraints, not allowing the city, county, etc. to be able to hire exceptional talent, purchase the tools needed in a timely manner, and other requisite uses for cybersecurity. While this is a Catch-22, it leaves these organizations in the wind, hoping to be obscure enough so that they are not noticed and attacked. Even a failed attack can have negative effects on the operations for many reasons.

 

One of these targeted was the city of Florence, located in Alabama. Florence, much like the city in Italy, sounds like an amazing place to live, located on the banks of the Tennessee River with many festivals and other attractions. This is not a massive metropolis, with nearly 40k residents. Of all the places to target, you have to wonder why Florence?

 

Attack

As you can guess, the city’s computer system had been successfully attacked. The entry points were through the email system. Specifically, this was a phishing attack, and the unfortunate phishee was Steve Price, the IT Manager. His credentials were acquired as part of the attack. The phishing email was one of the many samples of the DHL email, where there are dozens of email recipients, all receiving the same package with the same tracking number on the same day. These emails are pretty obvious as to what they really are there for.

 

The illustrious, yet distinguished Brian Krebs notified the mayor’s office of their system’s compromise on May 26. From the published accounts, the city somehow did not know of the breach prior to this. This is odd, as seemingly someone in the IT Department maybe should have noticed a strange IP address accessing the system and pulling data from the network. The following day the System Administrator did contact Mr. Krebs to let him know the computer and network account affected has been isolated and is not in service. It appears the SysAdmin did not quite understand the capabilities of the attackers at this point. On June 5, 2020, the attackers finished deploying the ransomware and began their demand for the ransom payment. The city has 12 days to fully defend against the attack, however, unfortunately only did a part of the work required to address the issue.

 

When the city began to review the situation, it did not appear any of the affected system’s data had been deleted or exfiltrated. This was probably a little too optimistic for the city.

 

On a side note, the attack occurred while the IT department was attempting to have the City Council approved the expense for a third party to do a penetration test of the IT systems.

 

Ransom

The attackers are not going to work through the attack cycle for practice and their mental gymnastics in an attack. The system has been operationalized into a business, and a rather profitable one measured by the return on investment (ROI). In this case, the attackers were DoppelPaymer. The attackers have demanded the ransom $378k in bitcoin. The amount was negotiated down to $330k by a third-party firm, still in bitcoin. This does seem like a rather large sum, given the size of the city. The attackers, however, have realized the power of their leverage on the systems.

 

Post-Attack

Once the city had the opportunity for a quick review, the city’s IT department and a third-party, contracted by the city (Arete Advisors), began to adequately investigate the issue. As time had passed and more effort was placed into the investigation, the city realized the attackers may have at least a portion of the data on the affected systems. The city noted they just don’t know. One would presume they had sufficient access, such that if they wanted, they could have taken the data they wanted to. On this note, the investigation noted the attackers had access beginning in early May 2020 and continued this for nearly the remainder of the month. During this time, the attackers had free access to roam about and check out the network. They did borrow without authorization the personal information on the city’s employees and customers.

 

As the city saw the writing on the wall, the city council voted unanimously to pay the ransom. The funds were to be paid from the insurance fund available for these types of issues.

 

A curious point with this is the city required the attackers, DoppelPaymer, to provide proof they will delete the stolen information they have. The curiosity is, other than promising or a pinky-swear, there really isn’t a way to prove they will delete the data. This is one of the many problems with paying the ransom. The organization is depending on the attackers to follow through and not leave a back-door or recurring malware on the system. Historically, the attackers have followed through and have not left any surprises behind for later easier attacks. They say there is honor among thieves, however, I would not bet on it. The city naturally is also working with law enforcement in the matter.

 

Update

As of June 13, 2020 (10:46 EST), the online network was down. While the website did note an apology, no reason was given.

 

Afterthought

If you are management, SysAdmin, or on the cybersecurity team, please consider this occurrence or any of the thousands of other successful ransomware attacks as examples of why training and an adequate SIEM is so important. While cybersecurity is the focus of the cybersecurity department or team, it is still everyone’s job to be vigilant and not be click-happy. If they aren’t expecting an email, don’t know the person or organization it is from, or it simply leaves them wondering if the link or attachment is appropriate, don’t do it. This will save so much time, energy, frustration, etc. for the staff and budget.

 

Resources

Associated Press. (2020, June 11). Alabama city to pay $300,000 ransom in computer system hack. Retrieved from https://www.newsobserver.com/news/business/article243452091.html

 

Associated Press. (2020, June 12). Alabama city to pay $30,000 ransom in computer system hack. Retrieved from https://www.securityweek.com/alabama-city-pay-300000-ransom-computer-system-hack

 

Brown, M., & Delinski, B. (2020, June 11). City of Florence out nearly $300,000 after ransomware hack. Retrieved from https://www.waff.com/2020/06/11/city-florence-out-nearly-after-ransomware-hack/

 

City of Florence. (n.d.). Florence, alabama. Retrieved from https://florenceal.org/

 

Delinski, B. (2020, June 11). Florence pays nearly $300,000 in bitcoin ransom. Retrieved from https://www.timesdaily.com/news/local/florence-pays-nearly-300-000-in-bitcoin-ransom/article_5dd1200e-58f6-53a5-a3e1-5d7b90edf179.html

 

Erazo, F. (2020, June 10). Alabama city plans to pay ransomware group despite warnings. Retrieved from https://cointelegraph.com/news/alabama-city-plans-to-pay-ransomware-group-despite-warnings

 

Freedman, L. (2020, June 12). Alabama city hit with ransomware. Retrieved from https://www.jdsupra.com/legalnews/alabama-city-hit-with-ransomware-40970/

 

Goud, N. (2020, June). Ransomware attackers demanding $300,000 from florence city of alabama. Retrieved from https://www.cybersecurity-insiders.com/ransomware-attackers-demanding-300000-from-florence-city-of-alabama/

 

Jackson, J. (2020, June 10). City of Florence agrees to pay nearly $300,000 ransom after cyberattack. Retrieved from  https://whnt.com/news/shoals/city-of-florence-agrees-to-pay-nearly-300000-ransom-after-cyberattack/

 

Krebs, B. (2020, June 9). Florence, Ala. Hit by ransomware 12 days after being alerted by KrebsOnSecurity. Retrieved from https://krebsonsecurity.com/2020/06/florence-ala-hit-by-ransomware-12-days-after-being-alerted-by-krebsonsecurity/

 

Lincoln Journal Star. (2020, June 11). Alabama city to pay $300,000 ransom in computer system hack. Retrieved from https://journalstar.com/business/alabama-city-to-pay-300-000-ransom-in-computer-system-hack/article_70114db5-92bd-5ecb-9a5e-edf5f3cf3b24.html

 

Paganini, P. (2020, June 12). City of Florence to pay $300,000 ransom after ransomware attack. Retrieved from  https://securityaffairs.co/wordpress/104666/breaking-news/city-of-florence-ransomware.html

 

SANS. (2020, June 12). Newsletters: Newsbites. Retrieved from https://www.sans.org/newsletters/newsbites/xxii/47

 

Schwartz, M.J. (2020, June 12). City pays ransom despite pre-ransomware outbreak hack alert. Retrieved from https://www.bankinfosecurity.com/city-pays-ransom-despite-pre-ransomware-outbreak-hack-alert-a-14427

 

 

 

BaseCamp successful defense against credential stuffing

Many corporations use applications to track projects. These can be on-premises or in the cloud. These services tend to be very useful for the collaboration required for these projects. One such service is BaseCamp. While focused on helping with communication and collaboration, BaseCamp did experience an attack in early 2019.

Attack

It's not often that there is the opportunity to write about a successful defense. Either there is the breach/compromise, or the company breaks down and pays for new equipment or a ransom. In this case, the defense was successful. They defended the system against a massive credential stuffing attack. This occurred on January 30, 2019 @ 12:45p Central. The SOC was monitoring the systems and noticed a significant increase in login attempts. This continued as the attack focused on approximately 30k accounts. In an hour, there were more than 30k login attempts from a vast array of IP addresses.

Successful Defense Methods

The first step was to start to block the IPs associated with the attack. With this form of attack, depending solely on this was merely a folly. This acted only to start the process, not as a panacea. There would need to be a large number of people simply doing this activity for hours to have even an insignificant effect, given the attackers would just use new IPs. The second step was much more helpful. They enabled the CAPTCHA, which blocked further attacks. While this did work and was very useful in the defense, there were 124 users who did have their accounts breached. These were reset and the users were emailed.

Resources

Getlan, S. (2019, January 31). Basecamp successfully defends against credential stuffing attack. Retrieved from https://www.bleepingcomputer.com/news/security/basecamp-successfully-defends-against-credential-stuffing-attack/

Hashim, A. (2019, February 2). Basecamp endured a brute force attack. Retrieved from https://latesthackingnews.com/2019/02/02/basecamp-endured-a-brute-force-attack/ 

Newman, L.H. (2019, February 17). Hacker lexicon: What is credential stuffing? Retrieved from https://wired.com/story/what-is-credential-stuffing/

OWASP. (2019, February). Credential stuffing prevention cheat sheet. Retrieved from https:/github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Credential_Stuffing_Prevention_Cheat_Sheet.md

Toulas, B. (2019, February 1). Basecamp defends an hour-long credential stuffing attack. Retrieved from https://www.technadu.com/basecamp-credential-stuffing-attack/56537/

Watch for supply chain management vulnerabilities

Blue Cross Blue Shield of Michigan is a medical insurer located in MI. Their clients are varied, work for employers- small to large-sized, and are located through the state.

Issue

BCBS uses contractors for various roles throughout the company. One vendor is COBX Co. COBX is a wholly-owned subsidiary of BCBS. The subsidiary is tasked with the Medicare Advantage Services for its clients. An employee of COBX had their laptop stolen on October 26, 2018. BCBS of Michigan notified approximately 15,000 Medicare Advantage members of a potential breach. The notification was done via letter. While this is not a good thing, it is pertinent that at least the laptop was encrypted and did have the password required. Normally, this would be fine if the encryption was above a certain baseline protocol. The problem was the employee’s credentials could have been compromised, meaning the person with the laptop would still be able to access the data.

Data

The affected BCBS customer’s social security numbers and financial information was not accessible from the stolen laptop, fortunately. The data that was available was includes the customer’s first name, last name, date of birth, gender, medication, diagnosis, provider information, and enrollee identification numbers.

Remediation

There had been no direct evidence the customer’s data had been accessed. With this type of issue, although there is no direct type of evidence of this being used for malicious means, it does not mean it has not been used and no guaranty it won’t be used in the near future. BCBS of Michigan noted there is a low chance of identity theft due to the nature of the data involved. BCBS is offering the affected parties AllClearID identity protection services. The term for this service is two years and is free to the customers potentially at risk. The contractor involved did have his credentials changed once the issue came to light. BCBS of Michigan is working with COBX in reviewing its policies and procedures. They are also putting additional safeguards in place.

Comments, Concerns, etc.

The laptop required a password for access and was encrypted, which required another password. Normally, this may be a non-issue, as with most industry-accepted encryption protocols to brute force this or decrypt the data would require several lifetimes. Due to the announcement with the notice of the contractor’s credentials may have been compromised, this nearly leads me to believe the credentials may have been openly accessible as in written on a post-it note on the laptop or otherwise easily acquired.

Resources

BCBS of Michigan. (2019, January 2). Data breach affects 15,000 medicare customers of blue cross blue chield of Michigan. Retrieved from https://www.cisomag.com/data-breach-affects-15000-medicare-customers-of-blue-cross-blue-shield-of-michigan/

Dissent. (2019, January 3). Double whammy: BCBS of Michigan policyholders hit by two breaches in December. Retrieved from https://www.databreaches.net/double-whammy-bcbs-of-michigan-policyholders-hit-by-two-breaches-in-December/

Haefner, M. (2018, December 31). BCBS of Michigan: Data breach may have affected 15,000 medicare members. Retrieved from https://www.beckershospitalreview.com/player-issues/bcbs-of-michigan-data-breach-may-have-affected-15-000-medicare-members.html

HIPAA Journal. (2018, December 31). 15,000 customers notified about blue cross blue shield of Michigan data breach. Retrieved from https://www.hipaajournal.com/15000-customers-notified-about-blue-cross-blue-shield-of-michigan-data-breach/

Livengood, C. (2018, December 28). Blue cross alerts 15,000 medicare customers of potential data breach. Retrieved from https://www.crainsdetroit.com/insurance/blue-cross-alerts-15000-medicare-customers-potential-data-breach

Woesnotgone Meadow; December 5, 2018

Woesnotgone (Woes-not-gone) Meadow
December 5, 2018
#

All is relatively well here at Woesnotgone Meadow, where everyone has above average bandwidth. Today in the meadow we had a bit of excitement. Aunt Marjie, who really isn’t anyone’s aunt, had a visit to the town’s doctor. Although the doctor only accepts the local insurance, there are the usual patient files. A hospital outside of the Meadow had a little problem with this.

Valley Health is the parent company of a number of hospitals, including the Winchester Medical Center and five other regional hospitals. Valley Health had the opportunity to mail notifications to 857 patients of these medical facilities. This was to let them know their private, confidential data may have been compromised.  The data included the patient’s name, address, date of birth, social security number, the medical record number, and patient identification number.

This issue is related to a third party Valley Health contacted with to host the electronic medical records (EMR). The hospitals initiated a contract with Inova Health Systems in 2013 for a seven-year term. On October 24, 2018, Inova notified Valley Health that they had been notified by law enforcement of the underlying issue.

On September 5, 2018, an unauthorized person had accessed a portion of the patient records. After Inova had received the notice, the business initiated its own forensic review. Valley Health followed the course of action and launched their own forensic review. Valley Health’s investigations indicated 12,331 patient files were accessed.

The compromise was possible due to the unauthorized party using the credentials of an employee who no longer was with the business. The access was to the Inova billing system along with Valley Health’s electronic medical records in January 2017 and from July to November 2017. This unauthorized person had a relationship with the former Inova employee.

The circumstances of this lead to at least two germane questions. Did the former Inova employee write down and allow a third party, with whom there was a relationship, to see their credentials? In this junction, the employees and former employees should not do this, especially when password managers are readily available. Also, the unauthorized party accessed the system during two separate periods. The other person had to be logged in at suspicious times or while the authorized person was logged. Either way, the logs would have indicated an issue which should have been noted by the security team or SIEM. How was this missed by the humans and programs? Inova had to be warned by law enforcement after the second compromise.

With these and other issues, the situation certainly indicates an opportunity for growth and improvement with InfoSec.

Thanks for visiting Woesnotgone Meadow, where the encryption is strong, and the O/Ss are always using the latest version.


Resources
Merod, a. (2018, November 23). Valley health sending letters to 857 patients possibly affected by security breach. Retrieved from http://www.winchesterstar.com/winchester_star/valley-health-sending-letters-to-patitients-possibly-affected-by-security/