Phishing continues to evolve

 

Phishing has been one of the more profitable ventures for attackers. This is especially true when phishing is coupled with other attacks, such as ransomware. Since phishing is so useful and potentially a revenue-producing activity, it is no wonder a new method has been devised to further the reach. One well-used method to lure the unsuspecting victim has been the landing page which looks to be perfectly legitimate, however, is full of malware and/or malicious links. This spoofing may also include a login page, to further gather data. With the latest tools in place, the malicious website closed, are easier to find. As this has been known, the attackers have thought through a nuance to the age-old attack-creating a landing page for AV and an alternative, malicious version for the unsuspecting user. The AV version has the appropriate background image. The primary difference is the colors are inverted. This is done due to the AV coded to focus on the landing page’s shapes, not colors. The second step involves the user. The user sees the odd coloration and moves on to the alternative version of the landing page. The other landing page has the correct colors with a little something added for the attacker’s benefit. This attack continues to show the need for user vigilance. If something looks odd, don’t keep clicking. If you click something once that doesn’t look right, don’t click the same thing three times. There probably is a problem. Advise your users not to click on provided links, but type them in.

 

PLEASE contact us when we may be of assistance with embedded systems cybersecurity architecture, validation, and penetration testing. We have a full lab ready to perform.

Charles Parker, II; Principal Scientist; MBA/MSA/JD/LLM/PhD/DCS (IP)

charlesparkerii@gmail.com

810-701-5511

Even Hunger-Relief Groups are not Off-Limits

 

With the economy not doing exceptionally well, people’s wages for the year generally decreasing significantly, and the pandemic continuing at least for the short-term, not-for-profit budgets can be stretched rather thin. As these provide services based on their mission, these may need to be re-evaluated. One form of service desperately needed is food relief and pantries. One of these organizations is Philabundance. Of all the targets available across the vast expanse of the internet, the attackers chose this one.

 

Philabundance is a food relief organization located in the Philadelphia area. This is the region’s largest hunger-relief group. The organization feeds over 100k people per week in the areas it has a presence. With the economic downturn, it shouldn’t be a big surprise this number of people served is almost double last year’s.

 

The attack itself took a widely used, yet simple, attack method. The attackers used phishing as a tool in the summer of 2020 to execute the attack. The organization is constructing a new building. The budget for this is $12M. This new building will house the Philabundance Community Kitchen. The attackers tied into this for the attack. They infiltrated the target system through a phishing campaign. Once in, a rule in the email system was set to block legitimate emails. The attackers were able to then spoof the construction company’s email with a fake invoice for $923,533. The organization paid the fake invoice on July 6, 2020. They discovered the problem when the construction company called for their money on July 24, 2020. After detecting the issue, the investigation began with full force. The effort indicated this was a one-time event. There was no staff information or data accessed. One area the organization specifically noted as not being affected was the online donation platform. There needed to be confidence in the system, so people would continue to donate.

 

Fortunately, the organization was able to cover the debt with its reserves. The hope is the insurance company will assist the organization in replenishing the lost funds. The FBI was contacted and is investigating. The organization hired a cybersecurity subject matter expert to review the incident. Internally, they have begun to update their security system with increased controls and more employee training.

 

Phishing can be tough to defend against. Yes, there are easy instances to detect. These include emails with the misspelled words, grammar not quite making sense, and 85 people being emailed for a late arrival package, all with the same tracking number. More often, the emails encountered have become so much more sophisticated. To maintain the pace with these phishing email advances, the training needs to be updated. With how fast the industry continues to advance, this cannot be overlooked. Of course, the appropriate systems in place to monitor for these.

  

Resources

6abc Digital Staff. (2020, December 1). Philabundance loses nearly $1 million in cyberattack. Retrieved from https://6abc.com/philabundance-cyberattack-hack-phishing-scam-philly-fbi/8425984/

 

6abc Digital Staff. (2020, December 2). Philabundance loses nearly $1 million in cyberattack. Retrieved from https://www.newsbreak.com/pennsylvania/philadelphia/news/2116820862556/philabundance-loses-nearly-1-million-in-cyberattack

 

Associated Press. (2020, December 3). Philadelphia hunger group loses nearly $1M in cyberattack. Retrieved from https://www.insurancejournal.com/news/east/2020/12/03/592596.htm#:~:text=The%20Philadelphia%20region's%20largest%20hunger,Jones%20told%20The%20Philadelphia%20Inquirer

 

Brubaker, H. (2020, December 1). Philly hunger relief group philabundance lost nearly $1 million in cyberattack. Retrieved from https://www.inquirer.com/business/philabundance-cybertheft-nearly-1-million-20201201.html

 

Fox29.com. (2020, December 1). Philabundance loses nearly $1M in cyberattack. Retrieved from https://www.newsbreak.com/pennsylvania/philadelphia/news/2116586100406/philabundance-loses-nearly-1m-in-cyberattack

 

Philadelphia Sun Staff. (2020, December 11). Philadelphia hunger group loses nearly $1M in cyberattack. Retrieved from https://www.philasun.com/local/philadelphia-hunger-group-loses-nearly-1m-in-cyberattack/

 

Ralph, P. (2020, December 1). Philabundance falls victim to cyberattack, loses almost $1 million. Retrieved from https://www.phillyvoice.com/philabundance-cyberattack-theft-1-million-dollars/

 

Schratwieser, D. (2020, December 1). Philabundance loses nearly $1M in cyberattack. Retrieved from https://www.fox29.com/news/philabundance-loses-nearly-1m-in-cyberattack

Municipalities targeted: City of Florence pwned!

Municipalities have a very distinct problem. They are frequently targeted for ransomware and other attacks, as the attackers know their systems generally are not fully secure unless they been recently successfully attacked and have corrected and mitigated the issues. This is driven by budgetary constraints, not allowing the city, county, etc. to be able to hire exceptional talent, purchase the tools needed in a timely manner, and other requisite uses for cybersecurity. While this is a Catch-22, it leaves these organizations in the wind, hoping to be obscure enough so that they are not noticed and attacked. Even a failed attack can have negative effects on the operations for many reasons.

 

One of these targeted was the city of Florence, located in Alabama. Florence, much like the city in Italy, sounds like an amazing place to live, located on the banks of the Tennessee River with many festivals and other attractions. This is not a massive metropolis, with nearly 40k residents. Of all the places to target, you have to wonder why Florence?

 

Attack

As you can guess, the city’s computer system had been successfully attacked. The entry points were through the email system. Specifically, this was a phishing attack, and the unfortunate phishee was Steve Price, the IT Manager. His credentials were acquired as part of the attack. The phishing email was one of the many samples of the DHL email, where there are dozens of email recipients, all receiving the same package with the same tracking number on the same day. These emails are pretty obvious as to what they really are there for.

 

The illustrious, yet distinguished Brian Krebs notified the mayor’s office of their system’s compromise on May 26. From the published accounts, the city somehow did not know of the breach prior to this. This is odd, as seemingly someone in the IT Department maybe should have noticed a strange IP address accessing the system and pulling data from the network. The following day the System Administrator did contact Mr. Krebs to let him know the computer and network account affected has been isolated and is not in service. It appears the SysAdmin did not quite understand the capabilities of the attackers at this point. On June 5, 2020, the attackers finished deploying the ransomware and began their demand for the ransom payment. The city has 12 days to fully defend against the attack, however, unfortunately only did a part of the work required to address the issue.

 

When the city began to review the situation, it did not appear any of the affected system’s data had been deleted or exfiltrated. This was probably a little too optimistic for the city.

 

On a side note, the attack occurred while the IT department was attempting to have the City Council approved the expense for a third party to do a penetration test of the IT systems.

 

Ransom

The attackers are not going to work through the attack cycle for practice and their mental gymnastics in an attack. The system has been operationalized into a business, and a rather profitable one measured by the return on investment (ROI). In this case, the attackers were DoppelPaymer. The attackers have demanded the ransom $378k in bitcoin. The amount was negotiated down to $330k by a third-party firm, still in bitcoin. This does seem like a rather large sum, given the size of the city. The attackers, however, have realized the power of their leverage on the systems.

 

Post-Attack

Once the city had the opportunity for a quick review, the city’s IT department and a third-party, contracted by the city (Arete Advisors), began to adequately investigate the issue. As time had passed and more effort was placed into the investigation, the city realized the attackers may have at least a portion of the data on the affected systems. The city noted they just don’t know. One would presume they had sufficient access, such that if they wanted, they could have taken the data they wanted to. On this note, the investigation noted the attackers had access beginning in early May 2020 and continued this for nearly the remainder of the month. During this time, the attackers had free access to roam about and check out the network. They did borrow without authorization the personal information on the city’s employees and customers.

 

As the city saw the writing on the wall, the city council voted unanimously to pay the ransom. The funds were to be paid from the insurance fund available for these types of issues.

 

A curious point with this is the city required the attackers, DoppelPaymer, to provide proof they will delete the stolen information they have. The curiosity is, other than promising or a pinky-swear, there really isn’t a way to prove they will delete the data. This is one of the many problems with paying the ransom. The organization is depending on the attackers to follow through and not leave a back-door or recurring malware on the system. Historically, the attackers have followed through and have not left any surprises behind for later easier attacks. They say there is honor among thieves, however, I would not bet on it. The city naturally is also working with law enforcement in the matter.

 

Update

As of June 13, 2020 (10:46 EST), the online network was down. While the website did note an apology, no reason was given.

 

Afterthought

If you are management, SysAdmin, or on the cybersecurity team, please consider this occurrence or any of the thousands of other successful ransomware attacks as examples of why training and an adequate SIEM is so important. While cybersecurity is the focus of the cybersecurity department or team, it is still everyone’s job to be vigilant and not be click-happy. If they aren’t expecting an email, don’t know the person or organization it is from, or it simply leaves them wondering if the link or attachment is appropriate, don’t do it. This will save so much time, energy, frustration, etc. for the staff and budget.

 

Resources

Associated Press. (2020, June 11). Alabama city to pay $300,000 ransom in computer system hack. Retrieved from https://www.newsobserver.com/news/business/article243452091.html

 

Associated Press. (2020, June 12). Alabama city to pay $30,000 ransom in computer system hack. Retrieved from https://www.securityweek.com/alabama-city-pay-300000-ransom-computer-system-hack

 

Brown, M., & Delinski, B. (2020, June 11). City of Florence out nearly $300,000 after ransomware hack. Retrieved from https://www.waff.com/2020/06/11/city-florence-out-nearly-after-ransomware-hack/

 

City of Florence. (n.d.). Florence, alabama. Retrieved from https://florenceal.org/

 

Delinski, B. (2020, June 11). Florence pays nearly $300,000 in bitcoin ransom. Retrieved from https://www.timesdaily.com/news/local/florence-pays-nearly-300-000-in-bitcoin-ransom/article_5dd1200e-58f6-53a5-a3e1-5d7b90edf179.html

 

Erazo, F. (2020, June 10). Alabama city plans to pay ransomware group despite warnings. Retrieved from https://cointelegraph.com/news/alabama-city-plans-to-pay-ransomware-group-despite-warnings

 

Freedman, L. (2020, June 12). Alabama city hit with ransomware. Retrieved from https://www.jdsupra.com/legalnews/alabama-city-hit-with-ransomware-40970/

 

Goud, N. (2020, June). Ransomware attackers demanding $300,000 from florence city of alabama. Retrieved from https://www.cybersecurity-insiders.com/ransomware-attackers-demanding-300000-from-florence-city-of-alabama/

 

Jackson, J. (2020, June 10). City of Florence agrees to pay nearly $300,000 ransom after cyberattack. Retrieved from  https://whnt.com/news/shoals/city-of-florence-agrees-to-pay-nearly-300000-ransom-after-cyberattack/

 

Krebs, B. (2020, June 9). Florence, Ala. Hit by ransomware 12 days after being alerted by KrebsOnSecurity. Retrieved from https://krebsonsecurity.com/2020/06/florence-ala-hit-by-ransomware-12-days-after-being-alerted-by-krebsonsecurity/

 

Lincoln Journal Star. (2020, June 11). Alabama city to pay $300,000 ransom in computer system hack. Retrieved from https://journalstar.com/business/alabama-city-to-pay-300-000-ransom-in-computer-system-hack/article_70114db5-92bd-5ecb-9a5e-edf5f3cf3b24.html

 

Paganini, P. (2020, June 12). City of Florence to pay $300,000 ransom after ransomware attack. Retrieved from  https://securityaffairs.co/wordpress/104666/breaking-news/city-of-florence-ransomware.html

 

SANS. (2020, June 12). Newsletters: Newsbites. Retrieved from https://www.sans.org/newsletters/newsbites/xxii/47

 

Schwartz, M.J. (2020, June 12). City pays ransom despite pre-ransomware outbreak hack alert. Retrieved from https://www.bankinfosecurity.com/city-pays-ransom-despite-pre-ransomware-outbreak-hack-alert-a-14427

 

 

 

This doesn’t add up: Chartered Professional Accountants Canada Breached!

With most industries, there is a trade association or group. The focus with these is to bring together leaders and members to discuss issues, communicate messages to the membership and be a portal for the industry. Accounting is no different. In the US, we have the AICPA which functions to administer these tasks. This is accomplished is a timely, exceptionally professional manner. Canada is no different in that the accounting industry likewise has this for our northern friends. Another commonality is these are generally targets due to the data they hold for their clients. The Chartered Professional Accountants Canada (CPA Canada) recently found this out, as they were breached.

CPA Canada

Just as the name implies, the organization is involved with Canadian accountants, representing the over 210k members. The organization provides accounting and guidance for its membership. This service is vital for business, accounting firms, and the stock market.

 

Attack

 The organization was unfortunately the victim of a successful phishing attack. The organization on June 3, 2020 notified the affected parties of the breach. Curiously, the organization was aware of the attack on April 24^th, meaning it took over a month to notify the persons. The organization will not be disclosing the methodology used in the attack. On a level, this is understandable. The organization may not want the details published as these may be used in other attacks as indications of their security posture. After the issue is corrected though, this could be used as a learning tool or use case for others.

 

Data

CPA Canada definitely held useful information for the attackers to focus on. This included the member's personal information. This included their contact details (names, addresses, email addresses, and employer name). The passwords and credit card numbers, fortunately, were encrypted. The list of persons was primarily composed of the CPA Magazine subscribers. This wasn’t just on the members, but also the stakeholders, totaling over 329k persons.  Granted the data involved was confidential. However, this could have been much worse if the other data was not encrypted, or if the attackers were able to pivot from this point and gain access elsewhere.

 

Post-Breach

The organization has notified its members and others whose data was affected, of the breach. The members and stakeholders were recommended to change their passwords. The organization is also working with cybersecurity personnel to verify the system is secure and exactly what data was copied from them. In addition, they naturally also contact the appropriate law enforcement, the Canadian Anti-Fraud Centre, and other privacy authorities.

 

One point from this to be used is phishing continues to and will be for the foreseeable future, an absolutely viable attack. This has proven to be successful and will not slow down. The organizations need to continue training for this with their employees. The system may be completely secure, however, all it takes is the right person in the right department to click the link, attachment, etc., and we are off to the races.

 

References

Solomon, H. (2020, June 4). Canadian accounting association website gets hacked. Retrieved from https://www.itworldcanada.com/article/canadian-accounting-association-website-gets-hacked/431712

 

Solomon, H. (2020, June 8). Canadian accounting association website gets hacked. Retrieved from https://business.financialpost.com/technology/tech-news/canadian-accounting-association-website-gets-hacked

 

The Canadian Press. (2020, June 4). Canadian accountants’ association suffers cyberattack; data of nearly 330k affected. Retrieved from https://globalnews.ca/news/7025862/cpa-canada-accountants-cyberattack/

 

The IJ Staff. (2020, June 4). CPA Canada hacked, subscriber information exposed. Retrieved from https://insurance-portal.ca/article/cpa-canada-hacked-subscriber-information-exposed/

 

U of U Compromises-Uh Oh

The University system tends to focus on research in specific disciplines. These may be business, psychology, sociology, criminal justice, medical, or any of the other areas within the University system. While the staff is fulfilling their tasks, the IT area of operations is continuously working to detect attacks and put in place mitigations to reduce the opportunity for a breach. This is a daunting task for many reasons. One such target was the University of Utah Health system. The organization was unfortunately breached at least twice recently.

Attack

The system is deluged with attacks and the beginning stages of attacks, just like any other medical facility. Unfortunately, two of these recently were successful.

The first was from January 22 through February 27, 2020. This successful attack was focused on email accounts. During this period there was an unauthorized access to a portion of the University of Utah Health staff email accounts. This was accomplished through the infamous phishing attack. This attack vector is so successful with such little capital or effort, this is bound to not slow down.

The second known successful attack was in the form of malware on a system. This was detected on February 3, 2020. Once this was found, the University of Utah Health contacted a third-party cybersecurity organization to assist them with the investigation. This investigation noted the malware may have been able to access a portion of the patient’s data, which was located in the respective employee’s email.

Data

With both of these noted successful attacks, the commonality was an unauthorized access to patient data. With these breach instances, the patient data may have included the patient name, date of birth, medical record numbers, and a limited amount of treatment information.

Post-Attack Actions

The investigation into the attack was not a simple review of logs. The compromises were alleged of a complex nature and of a highly technical nature. This is not an unusual statement by the University of Utah Health. If they were to state the attack was exceptionally simple, the management would be having additional issues from many other parties, including potentially the federal government, attorneys, and others.

The organization is also mailing letters to the affected patients. This is the standard protocol. To lower the potential for this to occur again, the organization is updating InfoSec procedures with the employees. This may or may not be successful, based on the implementation. If after a few months, the management does not reinforce the idea of cybersecurity, any lessons learned will fall by the wayside.

Looking Forward

This is yet another case of where training needs to be done through the year, insightful, and have some level of entertainment. Without this in place, the organizations will continue to be reactive post-breach, instead of pro-active to minimize the potential for a breach. Having known the method for the phishing attack would have been a great step forward. The industry could have learned from this and tailored other’s training to avoid this issue.

Resources

Bennett, L. (2020, March 21). University of Utah health says some patients’ data compromised in ‘phishing’ security breach. Retrieved from https://www.ksl.com/article/46732931/university-of-utah-health-says-some-patients-data-compromised-in-phishing-security-breach

DeWitt, K. (2020, March 20). U of U health announces phishing schemes caused unauthorized access to some employee accounts. Retrieved from https://www.abc4.com/news/top-stories/u-of-u-health-announces-phishing-schemes-caused-unauthorized-access-to-some-employee-email-accounts/

Roberts, A. (2020, March 21). Hacked: Some patient information compromised in U of U Health breach. Retrieved from https://kutv.com/news/local/some-u-of-u-health-patient-information-may-be-compromised-in-data-breach

Hospital pwned!

Hospitals are located throughout the country, and now more than ever are especially operationally stressed. As part of the intake process, the hospitals have to take in patient data. This accumulates rapidly. The hospitals hold a mass amount of patient data. The data grows daily. This data, while it does take space on the servers, also holds value for the bad actors looking to act maliciously with this. There are various tools the attackers can use in order to compromise a system. Munson Healthcare found this out the hard way.

Munson Healthcare

 Munson Healthcare is based in Traverse City, MI. Munson Healthcare operates Munson Healthcare Charlevoix Hospital. This is northern Michigan’s largest health care system. In addition to the Munson Healthcare Charlevoix Hospital, the firm also operations hospitals in Cadillac, Grayling, Kalkaska, St. Ignace, Manistee, Gaylord, and Frankfort.

Attack

After some time, the IT department began to notice certain issues with the email system in January 2020. There was a bit of suspicious activity within the system, which led to further investigation. The IT department detected the root of the issue. The email system had been compromised.

The attackers used the tried and true phishing technique. The attack has such low overhead and ease of use, there is no surprise this was used and was successful. In this case, the victims were actually more than what may normally be encountered. Here, 29 employees took the hook and clicked on a link or opened an attachment they should not have.

As indicated, the phishing attack was successful. The attackers had their unauthorized access from July 31 to October 22, 2019, or over 2.5 months. During this time, the attackers had unfettered access and had the ability to access to patient data. It is surprising it took nearly three months for the IT department to detect the issue. Upon the detection, the healthcare organization contracted with third-party cybersecurity professionals to investigate the breach.

Data

The healthcare facility was not sure how many patients were affected by the breach. The actual number, per the estimate from Munson, is the number is in the hundreds for the affected patients. The patient data may have included the patient names, date of birth, health insurance information, and treatment. The patient data was in the affected employee’s email accounts.

In a limited number of the affected patients, there may also have leaked the financial account numbers, driver’s license numbers, and social security numbers. The limited sample from the overall breached records is much more serious as the data included is more useful when used with the other data.

Post-Attack Actions

Obviously, this is not the optimal circumstance for the healthcare organization. As this included patient data, they had the opportunity to learn from this and report the breach to the U.S. Department of Health and Human Services per HIPAA. In addition to reporting this, the organization also is providing a credit monitoring service for the patients whose social security numbers were included with the compromise.

Internally, Munson Healthcare also had their employees undergo additional cybersecurity training. While this is a step in the right direction, this is a false hope for the future if not implemented correctly. A one-off training this year, and returning to the same routine of the single, annual training where a portion of the employee’s eyes glaze over, while the remainder eyes are trained on their cell phone paying attention to everything except for the presentation.

As for the infrastructure, the IT department has implemented additional cybersecurity measures. Given what occurred, this is a natural extension.

Looking Forward

This is yet another case of where training needs to be done through the year, insightful, and have some level of entertainment. Without this in place, the organizations will continue to be reactive post-breach, instead of pro-active to minimize the potential for a breach.

Resources

Foley, S. (2020, February 29). Munson healthcare notifies patients of data security incident. Retrieved from https://www.cheboygannews.com/news/20200229/munson-healthcare-notifies-patients-of-data-security-incident

Garrity, M. (2020, February 27). 20 michigan Health system employees fall victim to phishing attack, exposing patient data. Retrieved from https://www.beckershospitalreview.com/cybersecurity/29-michigan-health-system-employees-fall-victim-to-phishing-attack-exposing-patient-data.html

Newsbreak. (2020). 20 michigan health system employees fall victim to phishing attack, exposing patient data. Retrieved from https://www.newsbreak.com/news/0OGRRIqF/29-michigan-health-system-employees-fall-victim-to-phishing-attack-exposing-patient-data

Usher, K.H. (2020, February 27). Data breach at munson leaks patient records. Retrieved from https://www.cadillacnews.com/news/data-breach-at-munson-leaks-patient-records/article_661d3882-0b76-51d2-a309-26b7f11eea4e.html

Winant, D. (2020, February 28). 29 michigan health system employees fall victim to phishing attack, exposing patient data. Retrieved from https://seclists.org/dataloss/2020/q1/176

Overlake Medical Center has more than phishing to deal with: Medical records leaked

Through our lifetimes, we will need to visit a hospital, medical center or clinic for one reason or another. This may consist of the obligatory annual physical, stitches after a fall, or to refill medications. For various reasons, the commonality is the persons are visiting the medical facility for medical services. Dependent on the individual needs, this may be critical or a standard appointment. With these, the patient requires the services. When there is an issue with providing the service, this affects the medical facility, but also every single patient that would have received medical care at the facility. We’ve seen the effects of phishing attacks on most industries. Dependent on the specific attack, this can be especially problematic for the medical facilities. The Overlake Medical Center & Clinics have experienced this recently.

Overlake Medical Center & Clinics

The Overlake Medical Center & Clinics is based in Bellevue, Washington. The facility is non-profit and has 364 beds. All was well until the issue was detected.

Attack

The medical facility was the victim of the infamous, yet uncomplicated, phishing attack. In early December 2019, a small number of employees had seen the phishing lure and decided the email was legitimate when it actually was not, clicking on the link, image, or whatever the attack tool used was in this case. It was noted the unauthorized party, who had harvested the credentials, had infected the accounts between December 6-9, 2019. This was detected once the attackers began to access the email accounts on December 9^th. Within hours, the medical center did secure the affected email accounts and began their investigation.

Data

For some reason, the patient data was stored in the email accounts for the 109k affected patients. This possibly included names, dates of birth, phone numbers, addresses, health insurance information, insurer number, diagnoses, and treatment information. This is a treasure trove for the attackers. This data may be sold in whole or sliced into usable sections for specific malicious parties.

Post-Attack

After the compromise was detected, the medical facility was required to notify the affected. This began on February 7, 2020, as they started to contact 109,000 patients. This is a rather arduous task due to the number of patients, and the subject matter. Even if a small ratio of the persons called the medical center seeking answers to their questions, there would still be a mass amount of labor to take the calls and talk to each proactive affected patient.

As of the notification date, this was the third-largest breach for the year.

The medical center did state there was no evidence the data had been used by the unauthorized parties. This is a hollow statement though. With the attackers having this, they or the purchasers, if applicable, could wait to use this, or if this was used, it may be difficult to pinpoint this compromise as the cause.

Additional Security Features

Due to the successful attack, the medical facility did reset the employee passwords and put into place additional security features (e.g. multi-factor authentication and email retention policies). The facility was also enhancing their staff education to attempt to assist them to better recognize and then avoid the phishing emails.

Questions

There is a question of the timing. They found the credentials had been compromised and used from December 6^th through the 9^th, 2019. They did not start to notify the affected parties until February 7, 2020. Granted the medical facility has to complete their investigation, including the attack vector analysis, and determining who was affected. If this were have taken a month, this still leaves a month for the medical practice to arrive at the data, which seems a bit long, even for a conservative approach to the forensic review.

Helpful Tips

While phishing attacks are an epidemic, there are measures which the medical facilities may put into place to reduce this issue to a reasonable level of acceptable risk. These include, however certainly are not limited to

·        Having secured storage in place and tested regularly. Simply having storage in place is not enough. This would need to be tested to ensure the storage is viable.

·        Log collection. This is a very useful tool. This allows the organization to periodically check activities, including attempted connections, and connections. There are several SIEMs in the market which will analyze these for the organizational, reducing significantly the labor overhead which would need to be expended otherwise. One such highly regarded tool to accomplish this is Splunk.

·        File integrity monitoring. This is coupled with the secured storage. If the files are lacking integrity, they are not exceptionally useful.

·        Event detection. In order to know there has been an issue, the event has to be detected. This is another situation where a SIEM would provide the organization with the data and analysis to show the compromise and begin the incident response protocol. Two SIEMs which could be used to accomplish this are Splunk or AlienVault.

Resources

Davis, J. (2020, February 20). 109k patient records impacted in overlake medical phishing attack. Retrieved from https://healthitsecurity.com/news/109k-patient-records-impacted-in-overlake-medical-phishing-attack

Garrity, M. (2020, February 4). 10 tips for hospitals to mitigate ransomware attacks. Retrieved from https://www.beckershospitalreview.com/cybersecurity/10-tips-for-hospitals-to-mitigate-ransomware-attacks.html

Garrity, M. (2020, February 20). 364-bed Washington community hospital notifies 109,000 patients of phishing attack. Retrieved from https://www.beckershospitalreview.com/cybersecurity/364-bed-washington-community-hospital-notifies-109-000-patients-of-phishing-attack.html

McGee, M.K. (2020, February 25). Phishing in healthcare: Yet another major incident. Retrieved from https://www.databreachtoday.com/phishing-in-healthcare-yet-another-major-incident-a-13767

Overlake Medical Center & Clinics. (2020, February 7). Notice of phishing incident. Retrieved from https://www.overlakehospital.org/notice-of-phishing-incident

Here comes the judge! Oregon Judicial Department Pwned

Throughout each state, county, and city, there are court systems in place. Oregon is no different. In this specific case, Oregon Judicial Department includes the Oregon Supreme Court, Court of Appeals, Tax Court, Circuit Courts in each of the counties, and the Office of the State Court Administrator.

Attack

Phishing attacks are the premier attack being used throughout many industries. With the low cost and tech involved with a phishing campaign, it is no wonder. The Oregon Judicial Department experienced a phishing attack and was not successful in defending itself. The attack began at 4:30am on July 15, 2019. The successful attack led to five email accounts being compromised. With any phishing attack, the level of success with the attack is dependent on who clicks the link, picture, or tool creating an attractive nuisance for the user to click. In this case, there were more than 6k persons affected. The affected parties had their personal data exposed.

Data

Each of the 6,607 affected persons, while individuals have the same issue. The data exposed included the affected person’s personal data. This included the name and full and partial dates of birth. There was also partial exposure to financial information, health information, and social security numbers. This is exactly what the attackers would need to use for identity theft or to sell on the dark web.

Remediation

The affected accounts were disabled within four hours of the issue being detected. The Oregon Judicial Department sent notices to the affected persons. The department will provide credit monitoring services to those affected by the breach. The department also did contact law enforcement and other agencies to assist with the forensic work.

Thoughts

Phishing and the subsequent associated issues (e.g. ransomware, viruses, backdoors, etc.) are a societal problem potentially affecting anyone connected to the internet. One aspect of the remediation which in theory is helpful, but may not be in the long-run regards the credit monitoring. This did not state how long with was to last. This is a bit of a moot issue. The data exfiltrated with the compromise is partially permanent (e.g. social security number). While the credit monitoring may last a year, for example, the issue will last well beyond this for the affected persons.

Resources

Associated Press. (2019, August 29). Oregon judicial department hit by phishing attack. Retrieved from https://www.seattletimes.com/seattle-news/northwest/oregon-judicial-department-hit-by-phishing-attack/

Associated Press. (2019, August 29). Oregon judicial department hit by phishing attack, personal information exposed. Retrieved from https://katu.com/news/local/oregon-judiciail-department-hit-by-phishing-attack-personal-information-exposed

Associated Press. (2019, August 29). Oregon judicial department hit by phishing attack. Retrieved from https://www.usnews.com/news/best-states/oregon/articles/2019-08-29/oregon-judicial-department-hit-by-phishing-attack

Associated Press. (2019, August 30). Oregon judicial department hit by phishing attack. Retrieved from https://democratherald.com/news/state-and-regional/oregon-judicial-department-hit-by-phishing-attack/

Breach Exchange. (2019, August 30). Oregon judicial  department hit by phishing attack. Retrieved from https://www.bradenton.com/news/business/technology/article234530047.html

Tivit's Breach

There are IT firms across the globe on every continent. Even on Antarctica there is an IT function for their networks and other technical equipment. Brazil is no different. Tivit is a Brazilian IT services provider. In addition to this line of business, they also provide other business processes.

Attack

Any attack generally is focused on the target’s data or money. This instance was no different. The attack focused on the Tivit client’s data. There were nine Tivit employees who fell victim to a phishing email campaign. This exposed the client’s credentials online. The successful attack was confirmed by Tivit. For this to be so successful, all it took were the nine employees clicking on a link. The attack was able to gain access to data from 19 other companies. These included the kitchen appliance manufacturer Faber, Swiss insurance company Zurich, Brazilian financial organization Banco Original, software firm SAP, and many more. The attackers were successful enough so that they had gained access to Tivit’s database. Fortunately, the attack scope was limited only to the nine systems breached. The datacenters and client networks were not affected.

Detection

One would think, an IT service provider would have some form of a SIEM present and actively managed. The logs would simply be too huge for a human to make much sense of it. There should be a staff sufficiently supported so when there is an issue, it may be detected and resolved. This was not the case apparently. The breach was not detected by Tivit, but was by DefCON Lab. The signs included this affected various databases and servers in the cloud. DefCON Lab found nearly one thousand lines of code contained internal company routines and credentials of different large enterprise clients. The data appears to have internal process documents for the organization.

Remediation

Tivit was working through the issue. The organization also contracted with legal resources and IT support firm to ensure this did not happen again.

Comment

It is interesting that an IT company fell victim to a phishing attack. The number of victims was also notable. This issue continues to emphasize the need for employee training, through the year, even for IT companies.

Resources

Cyware. (2018, December 17). Massive data breach hits Brazilian IT firm tivit. Retrieved from https://cyware.com/news/massive-data-breach-hits-brazilian-it-firm-tivit-d47dc056

Mari, A. (2018, December 14). Brazilian IT firm tivit suffers data breach. Retrieved from https://www.zdnet.com/article/brazilian-it-firm-tivit-suffers-data-leak

Not even games are safe!

Fortnite is an excessively popular video game manufactured by Epic Games. This is played online with other players. There are more than 80M users across the world. In this game, as with many others, the goal is to stay alive and survive.

Issue

While the game is widely played, there should have been a thorough security testing for this. It appears this was not the case, as a security flaw provided a vulnerability for the Fortnite users. This allowed the users to be recorded during play without their knowledge and access to other sensitive data. The issue was discovered by CheckPoint in November 2018.

Operation

The attackers appear to have leveraged an insecure webpage created in 2004, created by Epic Games. They sent phishing emails to Fortnite users using this old website. The phishing emails indeed did appear to be from Epic. The attackers made it very easy for the users, in that all the targets had to do is click a link. This would allow the attackers access to the user’s accounts. This did not require the user to login. This was done through the tried and true XSS attack.

Effects

When exploited, this vulnerability allowed the attackers to:

a)      Take over the Fortnite accounts,

b)      Make unauthorized purchases with the user’s game virtual currency,

c)       Eavesdrop on player’s chat, and record the player’s chat.

This may have also exposed the user’s credit card data and other personal information. Due to this, complaints were filed with the Better Business Bureau. The users alleged Epic Games did not protect the user’s data.

Remediation

Epic Games took down the 2004 website which caused these issues. The company also recommended the players not reuse passwords, use strong passwords, and not share account information with others, or basic security recommendations.

Lessons Learned

Our environment is not static. This changes all too often. We need to monitor this frequently to check for issues and updates. The company needs to know its web apps and endpoints, and scan these periodically.

Resources

Knoop, J. (2019, January 17). Epic patches fortnite security hack that may have exposed more than 200 million players’ accounts. Retrieved from https://finance.yahoo.com/news/epic-patches-fortnite-security-hack-210300634

Oliver, M. (2019, January 18) Fortnite security flaw exposed 80 million players to hacking risk. Retrieved from https://kslnewsradion.com/1896932

Silverstein, J. (2019, January 19). Fortnite security flaw exposed millions of users to being hacked. Retrieved from https://www.cbsnews.com/news/fortnite-security-flaw-exposed-millions-of-users-to-being-hacked/

Tribune Media Wire. (2019, January 18). Fortnite security flaw exposed 80 million accounts. Retrieved from https://wnep.com/2019/01/18/fortnite-security-flaw-exposed-80-million-accounts/

WGNWeb Desk. (2019, January 16). Fortnite security flaw exposed 80 million accounts. Retrieved from https://wentv.com/2019/01/16/fortnite-security-flaw-exposed-80-million-accounts/

Of all the targets, they chose a church!

The business email compromise (BEC) had been widely and wildly popular over the last three years. This is partially due to how very easy this is to execute, low technical skills required, low cost, and high reward when the attack is successful. This has been used as the attack method across many industries with varied success. The attack template is very simple. The attackers send the phishing email. One or more targets click the link or the other specific attack mechanism. Their system becomes infected, allowing unauthorized access. The emails sent to the appropriate parties, generally in finance or accounting, directing them to change the bank account information for payments. 

Target

The Saint Ambrose Catholic Parish was targeted in this case. This is the second-largest church in the Diocese of Cleveland. This is also the largest church in Brunswick, OH. There are 16,000 members and 5,000 families with the church. 

Attack

The attackers used the tried and true BEC attack, successfully. The attack was done with a phishing email. In this instance, two employee accounts had been compromised. The fraudulent email tricked the person into believing the contractor’s bank account information had changed and provided the new account information. This was discovered on April 17, 2019. The payments had been made, as they thought, for their Vision 2020 project. The payments were meant for one of the contractors (Marous Brothers Construction). There were not, obviously, received. The attackers were only focussed on the money and did not attempt to pivot from the BEC attack to access the parish database or other areas of the system. 

Post-Successful Attack 

Father Bob Stec sent a letter to the parish regarding the issue. This indicated the contacted him and informed him the payments had not been received for the prior two months. The total payments not received by the legitimate party totaled $1.75M. The parish did file a claim with their insurance company. They also contacted the FBI and continued to work with them. The church also contracted with IT consultants to review their security stance. They had the staff all also change their passwords, and verified the integrity of their database. 

Thoughts 

With the BEC, the primary social engineering tool which makes this so useful is the lack of communication and staff not wanting to bother management and the C-level. The BEC depends on the targetted user not communicating with the alleged user sending the email These maybe strongly-worded indicating the transfer has to be done right away, and there are financial implications if this is not done (e.g. significant lost discounts). All the person has to do is pick up their phone and call the other person for verification. This should be a standard operating procedure when working with the accounts payable, and especially when dealing with cash or other liquid assets. It’s curious why these two users, whose email accounts were compromised, did not notice anything wrong with the transaction. 

Resources 

Digital Munition. (2019, April 30). $1.75 million stolen by crooks in church BEC attack. Retrieved from https://www.digitalmunition.me/2019/04/1-75-million-stolen-by-crooks-in-church-bec-attack/ 

Gatlan, S. (2019, April 29). $1.75 million stolen by crooks in church BEC attack. Retrieved from https://www.bleepingcomputer.com/news/security/175-million-stolen-by-crooks-in-church-bec-attack/ 

Paginini, P. (2019, April 30). Saint ambrose catholic parish-crooks stole $1.75M in BEC attack. Retrieved from https://securityaffairs.co/wordpress/84689/cyber-crime/church-bec-attack.html 

San Diego USD Pwned Hard!

High schools are much like universities and colleges, in that these hold a mass amount of data which may easily be sold. This assists in making them more of a target. This coupled with their budgetary constraints makes InfoSec difficult at times, much like this recently especially was for the San Diego USD.

Attack

This compromise is a bit different than most of the others. The reports are the school district is not sure of the attack vector, however, they believe this was the effect of a relatively simple, yet effective, phishing attack. The attackers gained access through securing the authorized user’s credentials. For this case, the attackers gained and maintained their access for 11 months (January through November). This is odd. Seemingly, the school district’s SIEM would note the access from odd hours, the number of accesses being odd, the IP being unique to the other general log ins, and the amount of data being exfiltrated. This would be the case, unless the school district did not have one in place during the attack. The school district finally became aware of this in October 2018.

Data

Generally, data is the end goal for the attacker. With this, they are able to generate revenue through sales of the data, use this as leverage for the target, etc. Through the compromise and process, the attackers were able to exfiltrate a significant amount of data. This encompassed 10 years of data, from the 2008-2009 school year to 2019, when the attack was detected. There were approximately 500k of students and staff affected. In addition to the length the breach was open, and the number of years of data exfiltrated, there is also the depth of data per affected person. This includes the first name, last name, date of birth, mailing address, home address, telephone number, student enrollment information (schedule, discipline incident information, health information, schools of attendance, transfer information, legal notices on file attendance dates), social security number or state student number, emergency contact information, staff benefit information, and staff payroll and compensation data.

Notification

The notice for the affected parties was filed the Friday before Christmas in 2018. The breach would probably be one of the last things they would want to hear about just before the holiday. The post stated the school district had reason to believe their system was breached and the attackers may have accessed the data. This could not have been what the students and staff were hoping for as their Christmas gift!

Detection

With a phishing attack, the timing of the attack may be delayed based on the attacker’s code. The staff began to note emails that appeared to be odd. They naturally, and appropriately, reported these to their IT Department. As the next step should go, this was addressed by the IT Department as they recognized this really should not be happening. They ended up discovering the breach in October 2018.

The school district, once they knew of the breach, did not immediately shut down the attack. This does seem counter-intuitive. Once you know the attacker is in and exfiltrating a mass amount of data, seemingly prudence would dictate shutting down the attack vector. There was a rationale reason for this. The school district wanted not only to clear the access, but also identify the attacker and allow law enforcement to do their job. The did later reset the compromised accounts. From this point forward, they have been working to prevent unauthorized access.

Thoughts

The attacker had access for approximately 10 months. The SOC or in the least any SIEM they had in place should have noted some abnormal activity as the mass amount of data was being removed from their servers. Since the SIEM is automated, possibly the search parameters had not been put in place. This compromise emphasizes the need for phishing training for the staff. This should not be the once a year training where staff nod off while the canned presentation is playing. These need to be periodic (e.g. quarterly) and with current information. Without some form of connection, the staff will probably view this as yet another mandatory training session, and start working on other things instead of listening.

Resources

Allen, T. (2018, December 27). Notice of data breach. Retrieved from https://www.sandiegounified.org/sites/default/files_link/district/files/

Cimpanu, C. (2018, December 25). Hacker steals 10 years’ worth of data from san diego school district. Retrieved from https://www.zdnet.com/article/hacker-steals-10-years-worth-of-data-from-san-diego-school-district/

Lilly, P. (2018, December 26). Hacker exploits san diego school district school network, steals personal data on 500k students and staff. Retrieved from https://hothardware.com/news/hacker-exploits-san-diego-school-districts-network-steals-data

Malafronte, K. (2018, December 27). San diego USD hacked, 10 years’ worth of data stolen. Retrieved from https://www.campussafetymagazine.com/technology/san-diego-school-district-hacked/

San Diego Unified School District. (2018, December). Data safety. Retrieved from https://www.sandiegounified.org/datasafety

Security Woes Department. (2018, December 26). Hacker steals ten years’ worth of data from san diego school district. Retrieved from https://it.slashdot.org/story/18/12/26/1248222/hacker-steals-ten-years-worth-of-data-from-san-diego-school-district

Healthcare Pwned... Again

Healthcare continues to be a significant target. The healthcare institution’s budgets have been decreased due to a number of different issues. These include patient mobility as there are more options than ever and patient insurance payments. The latter, at best are stable however have probably been decreasing as new contracts are renegotiated. While this is occurring, the costs (direct labor, overhead, utilities, supplies, etc.) have increased.

As margins continue to be narrowed, the cuts have to be made somewhere. Cybersecurity, since the measurement of the success is elusive, may not receive the positive budgetary attention it really should. While more staff members may be needed, the positions may not be opened for applicants. This makes securing the perimeter, infrastructure, cloud, etc. difficult at best. This coupled with the attackers not being limited by geography, further complicates the InfoSec mission. All it takes is one person making the wrong choice one time to begin a cascading effect. Verity Health Systems and Medical Foundation had the opportunity to learn from a recent related issue.  

Incidents

Over the recent period, there were a number of incidents. The first was in late November 2018 and another in mid-January 2019. There are other reports indicating there were two incidents in November. The access was simple enough; through three employee’s web email accounts. This allowed access to any emails or attachments in the respective compromised email accounts.

What makes this unusual is not only the number of successful attacks but also the timing. There were three attacks in such a short period of time is clearly not a good thing. For these to be successful infers a problematic, systemic issue. This forces the conversation on the level of insecurity. It is distinctly possible the SOC did not monitor the logs and other activities related to the email.

Data

The patients “possibly” affected were from many facilities. These included the Verity Medical Foundation, and Verity hospitals (O’Connor Hospital, St. Louise Regional Hospital, Seton Medical Center (inclusive of the Seton Coast side campus), St. Francis Medical Center, and St. Vincent Medical Center.

The accessed emails contained health and medical data for the patients (names, treatment information, medical conditions, billing codes, and health insurance policy numbers). There were other email accounts accessed which contained personal information (names, health insurance policy number, subscriber numbers, dates of birth, patient ID numbers, phone numbers, and addresses). A portion of the attachments unfortunately also had social security and driver license numbers. To top it off, the emails may have included, for certain Verity employees and 3rd parties, their personal and health data.

Remediation

Within hours of learning of each incident, the Verity InfoSec Team ceased the unauthorized third-party access, disabled the affected email accounts, disconnected the devices from the network, and removed the unauthorized emails sent to the other employees. These actions were a positive show of the prudent steps implemented. The thought is the attackers were actually seeking the user names and passwords. Due to the compromise and the access records containing PII and PHI, the business is offering credit monitoring services for one year free to any individual whose social security number or driver’s license number was involved.

To limit the opportunity for this to occur again, the business is requiring mandatory training for the employees and improving and increasing the security measures. The business also put a call center in place for affected persons to call for questions and to get additional information.

Notification

Per the reports, there is no direct evidence of the unauthorized access or use of the patient’s individual health or personal information. Verity Health System of California, Inc. and Verity Medical Foundation have, however, notified patients who are potentially affected. These persons were informed their specific individual or a portion of their information may have been accessed without authorization. The attackers were still unknown.

Resources

Davis, J. (2019, March 26). Verity reports third data breach caused by employee email hack. Retrieved from https://healthitsecurity.com/news/verity-reports-third-data-breach-caused-by-employee-email-hack

Dissent. (2019, January 29). Verity health system of California, inc and verity medical foundation notify individuals and regulatory bodies of data security incident. Retrieved from https://www.databreaches.net/verity-health-system-of-california-inc-and-verity-medical-foundation-notify-individuals-and-regulatory-bodies-of-data-security-incident/

Spitzer, J. (2019, January 29). Verity health system reports 3 phishing attacks. Retrieved from https://www.beckershospitalreview.com/cyberseucrity/verity-health-system-reports-3-phishing-attacks.html