Woesnotgone Meadow; April 14, 2019

All is relatively well here at Woesnotgone Meadow, where everyone has above average bandwidth.

In the Meadow, the residents are generally healthy. At times, we have issues requiring surgery and later rehabilitation. Based on the injury, this could be a short or long journey. Regardless of the length of rehabilitation, the patient does need to provide certain data and information to the facility where the treatment will take place. This data is personal and confidential and should be protected with all appropriate levels of security. Unfortunately, a rehabilitation center in Michigan system was compromised.

This affected the Sacred Heart Rehabilitation Center. As noted, this is located in Michigan in Macomb County (Richmond) on Stoddard Road. The facility provides HIV/AIDS care. There is also substance abuse treatment services. This operates as a non-profit, beginning in 1967. As this is a non-profit, the last thing they needed was the expense of a compromise, incident response, and placing new controls and policies in place. This is only on the internal administrative side. There will be more issues with the US Department of HHS, as this involved HIPAA data and information.

Attack

The tool the attackers used is too familiar. This, unfortunately, has a great ROE (return on equity), and ease of use, which makes it a favorite choice. This successful compromise shows the phishing attack is alive and well and works well. The compromise was due to a simple, yet successful phishing campaign. The estimated attack period was between April 5-7, 2018. From the forensic work already done, it appears as though one employee’s email was compromised.

This significant, deep compromise is another example of what can go wrong when one employee’s email is compromised. All it takes is the right person in the right position and department to click once.

Data Exfiltrated

The compromised employee’s email account, unfortunately, contained the patient’s information. This included the patient’s full names, addresses, health insurance information, medical treatment information, medical diagnosis, and/or social security number. This is just the right combination of data to make someone’s life even more interesting. As the patients are exceptionally sick, they and their families did not need this stress. On the other side of the coin, the data and information is very valuable to the attackers and could be sold in a lot, or divided into sections and sold to many persons.

Remediation

Once the administration learned of the issue on November 16, 20118, the rehabilitation center began an investigation, which is a great idea. The rehabilitation center contracted with third parties to complete the cybersecurity forensic work. The Sacred Heart Rehabilitation Center noted the affected parties. The forensic work indicated the affected parties, thankfully, were limited. Letters were mailed to the affected parties on January 9, 2019. With the patients whose social security numbers were exposed, they were offered a credit monitoring service and identity theft restoration for a year, free of charge. The patients also have been given a best practices document to show them how to best defend their data. The rehabilitation center is also providing additional training for the staff.

???

The compromise itself brings up many issues. Since the successful attack and compromise took place in April, why did it take seven months for them to figure it out? If there was a SIEM in place, and being monitored, it seems as though this should have not taken nearly this long. Even if there was not a SIEM in place, which sounds odd, there should have still been a periodic log review. Surely the mass amount of data flowing to an odd IP address would not indicate something odd or unique was going on.

The credit monitoring sounds good to the consumer and patient, however, a year does not mean much. The data exfiltrated for the unfortunate patients is static for that point in time, and some of this is permanent. If the attackers were to attach a disclaimer onto the data as they sell it to the many people and organizations interested to wait one year and one week to do anything with it, the defensive measure would be an epic fail.

Thanks for visiting Woesnotgone Meadow, where the encryption is strong, and the O/Ss are always using the latest version.

Resources

Brown, B. (2019, January 10). Sacred heart rehabilitation center breach exposed patients’ information. Retrieved from https://nbc25news.com/news/local/sacred-heart-rehabilitation-center-breach-exposed-patient-information

Fox News. (2019, January 10). Breach exposes some michigan patient’s personal information. Retrieved from https://fox17online.com/2019/01/10/breach-exposes-some-michigan-patients-personal-information/

Laine, C. (2019, January 10). Security breach involved patients’ names, medical, information, social security numbers. Retrieved from https://www.whem.com/news/security-breach-involved-patients-names-medical-information-social-security-numbers/

Jordan, H. (2019, January 10). Security breach exposed patient information at sacred heart rehabilitation sites in michigan. Retrieved from https://www.mlive.com/news/saginaw-bay-city/2019/01/security-breach-exposed-patient-information-at-sacred-heart-rehabilitation-sites-in-michigan.html

Midland Daily News. (2019, January 10). Sacred heart rehabilitation center reports online security incident. Retrieved from https://www.ourmidland.com/news/article/Sacred-Heart-Rehabilitation-Center-reports-online-13523247.php

Voice News. (2019, January 10). Patient info breach at sacred heart rehabilitation center in richmond township. Retrieved from http://www.voicenews.com/news/patient-info-breach-at-sacred-heart-rehabilitation-center-in-richmond/

WWJ. (2019, January 10). Security breach exposes some michigan patients’ personal information. Retrieved from https://wwjnewsradio.rdio.com/articles/security-breach-exposes-some-michigan-patients-personal-information

Woesnotgone Meadow; April 5, 2019

In the Meadow, we are online quite frequently. One headache the residents have dealt with has been with passwords. Some of our residents have found it difficult to remember all the passwords they have for the different sites. Most of the residents have begun using a password manager. Margie from the library recommended using a password manager. Generally, these work fine. This was not the case, however, with Blur.

Abine is the corporate entity behind Blur, a password manager, and DeleteMe, an online privacy protection service. Abine functions to encrypt the user’s passwords used with Blur. Blur’s service is to improve the user’s privacy with its secure password management service.

There was a rather significant compromise recently. This was not actually an attack, but more of a case of negligence. A reasonably prudent person would secure the cloud platform where the data was located. If the person was not exactly secure on how to do this, they would then research this or hire a party to do this. After all, the company is the steward of the data and is responsible for it.

This did not exactly happen here. An Amazon S3 storage bucket contained the subject file. This was unfortunately misconfigured. On December 13, 2018, the business was notified by a security researcher there was an issue. The business had no idea. A server was accessible and exposed a file with sensitive client information. The business, post-notification, did examine this, as you would expect instead of just taking the word of a researcher, and found the assertion was correct. This was announced on their business blog.

Of all the potential companies to have an insecure file open and accessible, this was the one. This should not have been misconfigured and insecure, given what the company focused on.

In this specific instance, there were 2.4M Blur users affected. The affected users were the ones who registered prior to January 6, 2018. The user data was left exposed and accessible. This included the user’s email address, a portion of the user’s first and left name, the user’s password hints, the user’s last two IP addresses used to login for the Blur app, and the user’s encrypted password. In this case, no DeleteMe user data was involved.

As noted, this was not exactly an attack. The data was openly exposed and accessible, however, there was no direct evidence the data was exfiltrated.

This was another example of a misconfigured AWS bucket which was not configured correctly. There may have been a time issue, or other factors involved. One of the managers should have actually reviewed this, and not just checked the box.

Resources

Abrams, L. (2019, January 2). Abine blur password manager user data exposed online. Retrieved from https://www.bleepingcomputer.com/news/security/abine-blur-password-manager-user-data-exposed-online/

Cimpanu, C. (2019, January 2). Data of 2.4 million blur password manager users left exposed online. Retrieved from https://www.zdnet.com/article/data-of-2-4-million-blur-password-manager-users-left-exposed-online/

Smith, A. (2019, January 2). Data on 2.4M gbine blur user’s ‘potentially exposed’. Retrieved from https://www.pcmag.com/news/365672/blur-users-personal-details-potentially-exposed

Waqas. (2019, January 3). Abine blur password manager exposed data of 2.4M users. Retrieved from https://www.hackread.com/abine-clur-password-manager-exposed-data-of-users/

Woesnotgone Meadow; March 26, 2019

All is relatively well here at Woesnotgone Meadow, where everyone has above average bandwidth.

In the Meadow, we have our school system. This isn’t huge, however, is just-right-sized for the community. We have all the amenities of the larger schools and cater to the students. This can be a blessing and create an issue. Any school can be a target, as the Bridgeport schools in CT have found.

Public schools abound through the nation. These are located locally and in certain instances, even within the neighborhoods, their students live in. The schools provide a vital service to the residents and the children in the community. The subject school is the Bridgeport School District, located in Bridgeport, CT.

The attack was much like so many others experienced not only in the school districts but also across the different industries. The school district was targeted for a ransomware campaign. This was allegedly delivered via a phishing attack. This is presumed, as this is the general attack vector. This, however, was not directly stated.

Although no data was exfiltrated, the ransomware was successful. The general operation is for the PCs and/or servers (preferably servers) to be encrypted, and the decrypt key is supplied (hopefully) after the fee is paid, or if the back-ups are viable and current, use these. With this attack, a portion of the district’s data was indeed encrypted. The composition of the data was not detailed in the publications. The amount of the ransom was not listed either.

The school district’s superintendent stated no data was exfiltrated. The attackers were, however, able to access Power School, which was used to store the student’s data. A few of the teachers noted the data encrypted was primarily from their work efforts (e.g. lesson plans and teaching materials). The student’s work and student’s and teacher’s personal data were not affected by this issue.

Once the school district detected the issue they worked through the weekend to fix this. The plan was to limit the damage to the data. Subsequently, all district employees were required to change their passwords. The employees were also directed not to bring in their own equipment into the workplace. The school district was actively working with law enforcement.

This successful attack is an example of what to focus on with the users for the health, and cybersecurity of the organization. With BYOD (bring your own device), the business or entity when this is allowed, also allows any issues on the employee’s personal laptop or device into the network if it attached. The business is at the whim of the person’s level of cybersecurity hygiene, or lack of. Also, there should be substantial training on email and phishing, including what to look for and suspicious requests.

Thanks for visiting Woesnotgone Meadow, where the encryption is strong, and the O/Ss are always using the latest version.

Resources

Lambeck, K.C. (2019, January 8). Bridgeport schools computer network falls victim to cyberattack. Retrieved from https://www.ctpost.com/local/article/Bridgeport-Schools-computer-network-hit-by-113515819.php

Lambeck, K.C. (2019, January 9). Connecticut school district hit with ransomware attack. Retrieved from http://www.govtech.com/security/Connecticut-School-District-Hit-with-Ransomware-Attack.html

Olenick, D. (2019, January 8). Bridgeport, Conn., schools hit with ransomware. Retrieved from https://www.scmagazine.com/home/security-news/bridgeport-conn-schools-hit-with-ransomware/

Woesnotgone Meadow; March 21, 2019

All is relatively well here at Woesnotgone Meadow, where everyone has above average bandwidth.

Most towns of a certain size have some form of a Chamber of Commerce. Although the Meadow does not have a vast number of businesses, there are quite a few. Jerry is the president and keeps everything running smoothly. Our little municipality has not been targeted for an attack, thankfully. Other Chamber of Commerce departments have not been that lucky. The Ann Arbor/Ypsilanti Regional Chamber of Commerce is located in the southeastern section of the lower peninsula of Michigan. They manage all of the usual tasks a chamber of commerce would.

On January 8, 2019, their computer system was successfully attacked. The attackers used well-known Emotet malware. This iteration allowed the attackers access to customer names, mailing addresses, and emails. The attackers, fortunately, did not have access to banking information, accounts, credit cards, security codes, or passwords.

 Emotet is a curious piece of malware. This is coded to especially evade detection, embed itself into the system and multiply. If the malware detects it is in a sandbox, it is coded to remain dormant. This is also polymorphic, meaning each time it is downloaded, the malware changes slightly, to evade a standard anti-virus signature. As this was designed so well, it is no wonder this is still in use over the last five years.

To remediate the issue, and get the Chamber back up and running, they had to start somewhere. The Chamber began researching what happened with this and on January 24, 2019 sent a notice to its members regarding the successful attack and compromise. In the least, this is an opportunity to learn from this and improve training for the staff. As a reminder, any training does not need to be bland, and not encourage the users to become bored.

Thanks for visiting Woesnotgone Meadow, where the encryption is strong, and the O/Ss are always using the latest version.

Resources

Afana, D. (2019, January 24). Malware hits ann arbor/ypsilanti chamber, member information safe, officials say. Retrieved from https://www.mlive.com/news/ann-arbor/2019/01/malware-hits-ann-arborypsilanti-chamber-member-information-safe-officials-say.html

Stockley, M. (2019, January 25). Fighting emotet: Lessons from the front line. Retrieved from https://nakedsecuriyt.sophos.com/2019/01/25/fighting-emotet-lessons-from-the-front-line/

Woesnotgone Meadow; March 22, 2019

All is relatively well here at Woesnotgone Meadow, where everyone has above average bandwidth.

In the Meadow, our residents all have one of the many variants of the cell phone. We naturally have the iPhone and Android, and Margie has an old-school flip phone. Our residents use this for navigation, calling family, listening to music, and a variety of other uses. These, while useful, have tended to be a rather important tool in daily life. While these have grown in use and prominence, this has produced a negative bi-product. The phone, especially the Android platform, has become a target for the attackers. While unfortunate, this is our situation.

Across the globe, there are 5B cell phone users (aka targets). With this vast number of users to attack, it’s no wonder these devices are attacked and successfully compromised with regularity. One app available on the Android system is Android Auto. The user plugs their phone into the USB in the vehicle, and the head unit (or screen in the dash) begins to function as an extension of the phone. This acts to interact with the vehicle as a tenant, not as the host, meaning the vehicle is still in charge of the head units operations, and the app is working within it. The app connects to the head unit in the dash and allows the user access to the phone’s functions.

This is great for the user, as they can use the phone while in the vehicle. If the phone were to have malware or another issue, as this connects to the vehicle, could affect the vehicle's operations, if this were coded for the vehicle’s systems. Although this is still a proof of concept (PoC), since there has not been an active attack, there is still the future opportunity for a thorough compromise. Now is the time to address any potential vulnerabilities now, while it is still less costly to fix, versus being in the Sunday paper explaining why a compromise occurred and paying for immediate remediation.  

Thanks for visiting Woesnotgone Meadow, where the encryption is strong, and the O/Ss are always using the latest version.

Resources

Mandal, A.K., Cortesi, A., Ferrara, P., Panarotto, F., & Spoto, F. (2018). Vulnerability analysis of android auto infotainment apps. In Proceedings of the 15th ACM International Conference on Computing Frontier, 183-190. doi:10.1145/3203217.3203278

Woesnotgone Meadow; December 25, 2018

Woesnotgone Meadow has their own police department dedicated to our municipality. They maintain the peace and enforce the laws. Although the work they do is primarily manual, as this involves working directly with the public, face-to-face. There is also the back-end of the work, involving among other things the computer systems. While the vehicles are at risk mostly while on the road, the police department computer network may be attacked at any time, any day of the week. The Rockaway Township police department found this out the hard way.

The attack itself occurred on Thanksgiving. From the attacker’s view, the timing could not have been better. There were many officers, and especially admin staff, off for the holidays. The focus was on their computer system. The attack brought down the system. This wasn’t merely someone who wanted to quickly deface a website, but someone who wanted to hinder the operations. The attacker was good enough so that two weeks after the attack, the department did not know who conducted the attack. The police are still unsure of how this occurred, the vulnerabilities, or distinct exploits.

There are a few issues that are significant, and would worry me if I happened to live within their municipality. With the resources and budget, seemingly their computer system would have some form of an IDS/IPS to manage these occurrences. On a secondary note, the police were still unsure how this actually happened. From a rudimentary Incident Response (IR) view, they should have some idea of what happened.

 To assist with this, the police had contracted with a third party to assist the police department with remediation and data restoration services. But wait, there’s more! The township management is tasked with managing the township. The management team is unhappy with the lack of progress with the investigation. The investigation was still ongoing as of 12/10/2018.

Resources

Dissent. (2018, December 10). Rockaway twp. Police computer hacker still unknown; leaders want answers. Retrieved from https://www.databreaches.net/rockaway-twp-police-computer-hacker-still-unknown-leaders-want-answers/

Myers, G. (2018, December 8). Rockaway twp police computer hacker still unknown; leaders want answers. Retrieved from https://www.northjersey.com/story/news/local/morris-county/2018/12/08/rockaway-twp-police-computer-hacker-still-unknown-leaders-want-answers/2242543002/

Woesnotgone Meadow; December 24, 2018

All is relatively well here at Woesnotgone Meadow, where everyone has above average bandwidth.

Our residents regularly visit the doctors. Not that we are overly concerned to a fault, however, we do attend our regularly scheduled appointments. One area we pay particular attention to is our eyesight. Without our eyesight, we can’t read the menu at Margie’s Coney Island. The local eye clinic is managed by Gerry, who pays particular attention to detail. There was an eye clinic that has had issues though.

Redwood Eye Center is located in Vallejo, CA, and is an ophthalmology practice. The practice contracted with IT Lighthouse to host and store the electronic patient records.

Ransomware is a relatively easy tool to implement in an attack. The attackers are able to phish a list of targets without a mass amount of effort, in comparison with attacks on an enterprise system. Dependent on the tool, there is a limited success rate. Bearing this in mind, all it does take is a few people to click in the right department and the business functionality may be shut down.

In this case, the issue is with IT Lighthouse. This business hosts and stores Redwood Eye Center’s patient records. There certainly can be benefits to having a third party host the electronic health records (EHR), which is why this has become relatively popular. The eye clinic learned of the breach on September 20, 2018. Sometime during the evening of September 19^th the ransomware attack was detected. This was detected on the server which stored a portion of their patient’s records.

It appears the patient data was not exfiltrated. This affected 16,055 patients. This is, as noted and fortunately, only a portion of the office’s patient records. The data enclosed with this included the usual patient’s name, addresses, date of birth, health insurance information, and medical treatment information. Post detection, the clinic contracted with a computer forensic company to deconstruct the ransomware attack. The eye clinic also had the medical records company restore access to the patient’s information for the clinic.

This is another example of a third party being the weakest link. This has happened multiple times in recent years. Too often companies contract with a third party business and don’t check the other company’s cybersecurity practices. When the company allows the third party access to their system, the company allows everything with the system in also. All the issues accompany the third party when they access the system. This includes any malware they already have in their system. With any third party granted access, a due diligence should be completed to the company’s acceptance prior to any connection.

Thanks for visiting Woesnotgone Meadow, where the encryption is strong, and the O/Ss are always using the latest version.

Resources

Dissent. (2018, December 7). Redwood eye center notifies 16,000 patients after EMR vendor experiences ransomware attack. Retrieved from https://www.databreaches.net/redwood-eye-center-notifies-16000-patients-after-emr-vendor-experiences-ransomware-attack/

Leventhal, R. (2018, December 11). Eye center in california switches her vendor following ransomware incident. Retrieved from https://www.healthcare-informatics.com/news-item/cybersecurity/eye-center-california-switches-ehr-vendor-following-ransomware-incident

McGee, M.K. (2018, December 7). Another electronic health records vendor hacked. Retrieved from https://www.careersinfosecurity.com/another-electronic-health-records-vendor-hacked-a-11823