Woesnotgone Meadow; May 7, 2019

All is relatively well here at Woesnotgone Meadow, where everyone has above average bandwidth.

In the Meadow, our residents generally are healthy. Occasionally, we have an issue when someone gets sick or hurt. Last May, Jerry slipped on ice and fractured his ankle. When these occur, there may be a brief or longer visit at a healthcare facility. These facilities over the last few years have been a target for attackers, as they attempt to breach their system. One such institution is the Roper St. Francis Healthcare facility.

The Roper St. Francis Healthcare facility is based in Charleston, SC. The healthcare facility was targeted for a phishing attack on a rather large scale. The types of attacks have been relatively steady and popular over the last five years. In this case, there were 13 employee email accounts that were successfully compromised. The successful attack was detected on November 30, 2018. In this case, it is fortunate that the hospital’s operations were not affected. Also, the hospital’s electronic medical records (EMR) were not accessed.

Once detected, the hospital responded quickly. One of the first moves was to block access to corporate accounts. They then began the forensic review. The review noted the compromise was open and active from November 1, 2018, through December 1, 2018. The end date is the day after this was discovered. The hospital also contracted with a third party for a thorough forensic review. The third party in-depth review indicated a number of the compromised email accounts did contain confidential data and information. This data included the patient’s name, medical record numbers, health insurance information, and medical record information. For a portion of these, the patient’s social security number and financial information were also exposed.

The affected patients were notified by mail on January 25, 2019. The hospital also posted a notice on its website on January 29, 2019. The affected patients were offered complimentary credit monitoring services. Internally the healthcare facility is strengthening the email cybersecurity and providing continuing education for this type of attack. These steps are prudent and necessary to prevent, as much as possible, for this to occur again.

This successful attack once again shows the weakest link, in general, is the use. There also needs to be better and regular training to watch for this, along with a more robust defense.

Thanks for visiting Woesnotgone Meadow, where the encryption is strong, and the O/Ss are always using the latest version.

Resources

Balchunas, C. (2019, February 4). Roper st. francis phishing attack: What did hackers get access to? Retrieved from https://abcnews4.com/news/local/roper-st-francis-phishing-attack

Davis, J. (2019, February 4). Roper st. francis, valley professionals phishing attacks breach patient data. Retrieved from https://healthitsecurity.com/news/roper-at-francis-valley-professionals-phishing-attack-breach-patient-data

Dissent. (2019, February 4). SC: Roper st. francis notifying patients after employee fall for phishing attack. Retrieved from https://www.databreaches.net/sc-roper-st-frances-notifying-partients-after-employees-fall-for-phishing-attack/

HIPAA Journal (2019, February 4). 13 accounts compromised in roper st. francis healthcare phishing attack. Retrieved from https://www.hipaajournal.com/13-accounts-compromised-in-roper-st-francs-healthcare-phishing-attack/

Phillips, P. (2019, January 29). Roper st. francis healthcare notifies patients after employee emails compromised. Retrieved from http:///www.live5news.com/2019/01/29/roper-st-frances-healthcare-notifies-patients-after-employee-emials-compromised/

Staff Report. (2019, February 5). Roper st. frances employee emails compromised. Retrieved from https://charlestonbusiness.com/news/health/75936/

Woesnotgone Meadow; May 4, 2019

All is relatively well here at Woesnotgone Meadow, where everyone has above average bandwidth.

In the Meadow, our residents don’t have many banking needs. We generally have the usual checking and deposit accounts, and mortgages. Occasionally, especially in the winter, our residents may not desire to visit Margie’s window at the bank. At this point, the residents may check their balances or if a check has cleared with an app on their smartphones, desktops, or laptops. When our residents have checked their accounts, they have used the two-factor authentication recommended by Margie. Generally, this has not been an issue. Current events have indicated there is an issue with this.

Banking is one of the industries where there should be an extra layer or two of security, just to ensure, as much as possible, there are no issues with the client's money being wired out to others by someone other than the bank’s client. To better secure transactions with mobile banking, an additional measure has been used for years. This two-factor authentication has been accepted as an additional layer of security for years. Recent events and attacks have indicated there is an unauthorized, malicious bypass for this cybersecurity feature due to flaws in the SS7 protocol.

SS7 (Signaling System 7)

The SS7 protocol is used by telecom companies to coordinate how they route texts and calls globally. There have been notably significant flaws in the SS7 protocol that have been known for years. The basic issue is the lack of authentication. The protocol does not authenticate who had sent the message. The attacker may gain access to the network and reroute the text message or call.

This may not only be used to intercept the SMS and 2FA codes, however, this also allows for unauthorized access to the user’s personal data. This has the potential for rather unpleasant circumstances for the users. Although known for years, this flaw/bug/feature is still viable. It’s curious as this is still an issue, as the phone companies spend billions upgrading their networks. Although this initially may have been a thought problem, the attack recently has been verified many times.

There have been recent reports indicating at least Metrobank, a UK bank had been targeted by the attackers. The attackers have been using this SS7 flaw to bypass the 2FA with mobile applications. With the banking targets, the attacker would acquire the user’s username and password. This could be accomplished through a simple phishing attack. When the user logs in, the bank may send a verification code to the user. With the SS7 attack, the message would be intercepted by the attackers. While this does appear to be a rather simple and straight-forward attack, this does take time to formulate and execute, and for the user to accept the phishing hook. The attack, while complicated, is still possible.

In the real world, the actual SS7 attacks began to empty the bank client’s accounts in 2017, primarily in Germany. This has spread and was being used throughout Europe. One bank confirming they were targeted and successfully attacked was MetroBank, the UK based bank. The bank did note, however, that only a small number of clients had been affected. This would be expected, as the first step involves a successful phishing attack.

This attack, while not designed for attacking the masses, reminds us even with the most current technology in use, if a third party which the business depends on has a faulty protocol or methodology, there is the direct opportunity for significant issues.

Thanks for visiting Woesnotgone Meadow, where the encryption is strong, and the O/Ss are always using the latest version.

Resources

Android Police. (2019, February 3). UK bank falls victim to ss7 attacks, allowing cybercriminals to drain accounts and reminding us why SMS two-factor authentication sucks. Retrieved from https://www.technologybreakingnews.com/2019/02/uk-bank-falls-victim-to-ss7-attacks-allowing-cybercriminals-to-drain-accounts-and-reminding-us-why-sms-two-factor-authentication-sucks/

Cox, J. (2019, January 31). Criminals are tapping into the phone network backbone to empty bank accounts. Retrieved from https://motherboard.vice.com/en-us/article/mbzvxv/criminals-hackers-ss7-uk-banks-metro-bank

Millman, R. (2019, February 4). Criminals hit metro bank with multi-factor authentication bypass ss7 attack. Retrieved from https://www.scmagazineuk.com/criminals-hit-metro-banks-multi-factor-authentication-bypass-ss7-attack/article/

Security Experts. (2019, February 4). Hackers targeting UK banks through ss7 banks. Retrieved from https://www.informationsecuritybuzz.com/expert-comments/hackers-targetting-uk-banks/

Telegraph. (2019, February 3). Metro bank hit by cyber attack used to empty customer accounts. Retrieved from https://fireballcybersecurity.blogspot.com/2019/02/metro-bank-hit-by-cyber-attack-used-to.html

Woesnotgone Meadow; May 2, 2019

All is relatively well here at Woesnotgone Meadow, where everyone has above average bandwidth.

Universities and colleges have been targeted for years by attackers across the globe. These are known for not necessarily having the most current technology, yet having a mass amount of PII, which is readily marketable.

Two Nigerian citizens, Olayinka Olaniyi and Damilola Soloman Ibiwoye, living in Kuala Lumpur, were targeting colleges and universities in the US. The focus was to steal paychecks and tax returns. To compromise the targeted systems, the two attackers were phishing 130-140 universities and colleges a day. The attackers took the time and effort to produce emails which appeared to be legitimate, including the actual logos.

To achieve the end goal, the attackers needed system credentials. The fraudulent emails would direct the user to a non-college or university website, which appeared again to be completely legitimate. Here, the user provided credentials would be harvested. With this data, the attackers were able to reroute paychecks and access certain financial documents. The attackers, unfortunately, were successful with 20 different schools. Specifically, with Georgia Tech, the attack was noted quickly. This quick detection was definitely a bonus. Due to the quick work, the FBI was notified and they were on-site the next day. They were able to monitor the attacker’s traffic once present.

To assist with the identification of the person(s) responsible for this unlawful endeavor, Georgia Tech continued to work with the authorities. The IP addresses were traced to Malaysia. The authorities secured search warrants for the “alleged” attackers’ email accounts to provide evidence for legal actions. From this evidence, the two suspects were clearly identified by their respective names.

It is notable the US does not have an extradition agreement with Malaysia. To work with this, the FBI’s legal attache’ contacted the Malaysian royal police. The local Malaysian authorities also confirmed the attacker’s individual identities. Curiously, the two attackers were living in Malaysia on expired visas. The two were arrested. The evidence gathered also indicated the attackers were using the PII to file fake tax returns.

The two were sentenced to federal prison. Ibiwoye pleaded guilty and received 39 months in January 2018. Olaniyi was convicted with a jury trial and received six years.

This case emphasizes two aspects of a breach. The breached party needs to be fully aware, as much as possible, of the breach and extent of the breach. There also needs to be a fully cooperative stance with a breach. Anything short of this merely adds more time to the open window for the attacker(s) to steal and use the data.

Thanks for visiting Woesnotgone Meadow, where the encryption is strong, and the O/Ss are always using the latest version.

Resources

11 Alive. (2019). Nigerian hackers convicted after trying to break into Georgia tech’s payroll system. Retrieved from https://www.11alive.com/article/news/nigerian-hackers-convicted-after-trying-to-break-into-georgia-techs-payrollsystem/

FBI. (2019, February 4). Hackers targeted universities. Retrieved from https://www.fbi.gov/news/stories/cyber-thieves-sentenced-for-hacking-scheme-targetting-universities-020419

Woesnotgone Meadow; April 29, 2019

All is relatively well here at Woesnotgone Meadow, where everyone has above average bandwidth.

In the Meadow, we have a mix of residents. One thing we all have in common is investments. The residents want to retire in luxury, eat caviar, and travel. To follow this dream takes one common element-money. Jerry has the Meadow’s investment firm and manages the funds and futures. Black Rock, Inc. is the world’s largest asset manager. With this title, it is no wonder the target on the firm.

Black Rock was not the victim of an attack, per se. This, however, was still an issue. The compromise was due to human error. Black Rock inadvertently published thousands of advisor’s confidential client data on its public website. This was in located in three spreadsheets. These were available via links on the company’s iShares exchange-traded funds. These links were dated December 5, 2018, however, these may have been posted earlier. Based on this, the issue was not truly an attack in the real-world sense, but more of an oversight.

These spreadsheets did not have an average, boring data. The three spreadsheets did include the financial advisor’s name and the email addresses for those who purchased Black Rock’s EFT for their clients. One of the three spreadsheets contained more than 12k advisors and their sales representative’s information. In another spreadsheet, the advisor’s were categorized as dabblers or power users. Another column indicated the financial advisor’s club level as being in the Patriot’s or Director’s Club, assumptively based on their sales level. Black Rock is reviewing what happened, which was primarily human error based.

This simple oversight will provide for many awkward moments in the upcoming months. This is much like the holidays when your off uncle stops by, and everyone looks. This does appear to be a simple case of unfortunate human error. When there are sensitive issues within documents or files, there should be some form of a check, even a short and simple one, in place. Without this in place, there is an opportunity for many not-fun future meetings and situations.

Thanks for visiting Woesnotgone Meadow, where the encryption is strong, and the O/Ss are always using the latest version.

Resources

Durden, T. (2019, January 19). Black rock accidentally exposes confidential sales data for thousands of financial advisors. Retrieved from https://www.zerohedge.com/news/201901-19/blackrock-accidentally-exposes-confidential-sales-data-thousands-financial-advisors

Massa, A. (2019, January 19). Black rock exposes confidential data on thousands of advisors on iShares suite. Retrieved from https://www.msn.com/en-us/money/companies/blackrock-exposes-confidential-data-on-thousands-of-advisors-on-ishares-site/ar-BBSrfx9

Woesnotgone Meadow; April 26,2019

All is relatively well here at Woesnotgone Meadow, where everyone has above average bandwidth.

Cebuana Lhuillier is located in the Philippines and is one of the leading and largest financial services firm. Cebuana Lhuillier is differentiated as this is not a bank. The firm has nearly 2,500 branches throughout the nation. The services include a pawn service, remittance, micro-insurance, and micro-loans.

With the business operations, the data held by the firm is exceptionally valuable to the attackers who successfully compromise the system. There were attempted connections to the business servers was detected on January 15, 2019. There was a previous attack that was successful, which led to unauthorized downloads from the business servers on August 5, 8, and 12, 2018. It is curious why the second compromise was not deterred. When there is a significant compromise, as a rule of thumb the cybersecurity staff or at least the IT staff harden the systems so the business is not compromised again.

We should persevere to learn from not only our mistakes but others. With at least the second compromise, the attack vector and method were not published.

More than 900,000 clients were affected by the breach. This is approximately 3% of the entire clientele. Although 3% is not that high of a percent relative to the entire clientele, this is still a rather large number of clients. The attackers may have accessed the client’s personal data, including the dates of birth, addresses, and sources of income. Thankfully, the details for the transactions were not included with the potentially compromised client data.

The firm was surprised by the compromise. The firm, as a result of the compromise, coordinated efforts with the National Privacy Commission (NPC). The firm also contracted with a third party to manage the compromise. The parties were investigating the issue. The company has already implemented safety measures to protect the client’s data. The firm did suggest to the clients for them to change their passwords.

This compromise emphasizes the need for a strong perimeter defense.

Thanks for visiting Woesnotgone Meadow, where the encryption is strong, and the O/Ss are always using the latest version.

References

Cyware Hacker News. (2019, January 22). Data breach at cebuana lhuillier affects over 900,000 clients. Retrieved from https://cyware.com/news/data-breach-at-cebuana-lhuillier-affects-over-900000-cleints-b247b34b

Langsdon, M. (2019, January 19). Philippine financial service firm flags data breach affecting 900,000 clients. Retrieved from https://www.reuters.com/article/us-hilippines-cebuana/huillier-data-idUSKCNIPD078

Merey, A. (2019, January 19). Over 900,000 affected by ceduana lhuillier data breach. Retrieved from https://news.abs-cbn.com/business/01/19/19/over-900000-affected-by-cebuana-lhuillier-data-breach

Philstar. (2019, January 19). Cebuana lhuillier hit by data breach. Retrieved from https://www.philstar.com/business/2019/01/19/1886427/cebuana-lhuillier-hit-data-breach

Woesnotgone Meadow; April 25, 2019; Vendor Cybersecurity Issues affecting Eye Institute!

All is relatively well here at Woesnotgone Meadow, where everyone has above average bandwidth.

The day started out like any other day. Get up, get ready, load the vehicle, work, return home, repeat. On this day though, I went to the mailbox, just as I have done for years. Today though, there was a letter from the Wolverine Solutions Group. Not recognizing the name, curiously I opened the letter. It seems as though my healthcare provider, Michigan Eye Institute, used Wolverine Solutions Group for mailing services. Wolverine Solutions Group happens to have had a minor, itsy issue with cybersecurity-they were successfully attacked with ransomware, locking up their servers along with workstations. But other than that, everything was fine.

There are three businesses involved with the cybersecurity oversight.

a.            Michigan Eye Institute. The medical practice focussing on the eye, located in Flint, MI.

b.            Client Financial Services. This was a vendor for the Michigan Eye Institute.

c.            Wolverine Solutions Group. They provide mailing services to the businesses in the health-related industry. This includes health-insurers and providers. The business is located in Detroit. They also provide billing services. A sample of their clients include Blue Cross Blue Shield of Michigan, Health Alliance Plan, McLaren Health Plan, Three Rivers Health, and North Ottawa Community Health System.

Timeline

On or about September 23, 2018, Wolverine Solutions Group (WSG) had the opportunity to experience a ransomware attack. The attack primarily focussed on encrypting their records. This locked up their servers and workstations, which was clearly bad. WSG hired on October 3, 2018 a forensic subject matter expert to review and analyze the events and attack. They began the decryption process and restoring files and other affected areas. The expert did not identify any evidence any data had been exfiltrated.

Due to the effort, most of the programs were restored by October 25, 2018. The critical operations were up and operating on November 5, 2018. WSG notified on November 28, 2018 Client Financial Services (CFS), who is a vendor to the Michigan Eye Institute, of the cybersecurity issue. WSG provided on February 5, 2019, Michigan Eye Institute the final list of affected users and the categories of data affected.

Ransomware is seen so often in nearly all industries. This is partially due to this being such a cost effect attack, with results. The operations of this involve encrypting the data and attempting to force the target, post-successful attack, to pay the fee. In this case, however, allegedly weak encryption was used.

Data

Unfortunately for the patients, it appears the data involved would be the patient’s name, address, date of birth, social security number, insurance contract information and numbers, and medical information. This is truly bad for the patient’s involved. This data is very saleable and marketable multiple times, depending on how it is bundled.

Help for the Patients

The patients are being offered identity theft protection through AllClear ID for 12 months. This also allows for an annual credit score and credit report, and a $1M identity theft insurance policy. Although this sounds good, the length honestly should be much longer. Any person with the patient’s data will probably wait for one year and one month before using this, to the patient’s detriment.

Questions/Concerns/Comments

In the review of the overall environment, there are a few questions. The business used WSG for mailing services. This is perfectly acceptable and a part of the natural operations. As WSG focus is mailing, why would they have access to medical records, and why were they on WSG’s system? The medical records are not associated with a list of people to mail information to. Possibly they were mailing bills, however, this would be the only circumstance for a viable reason.

It took the business over five months to notify the users/patients of the cybersecurity issue. The patients were exposed for over five months. During this time, they were unaware of the data being out there sold.

The forensic team did not believe any data was exfiltrated or “extracted” yet the patient’s information was affected. Thinking through the events, if the attacker is focused on the system and risking federal prison, is the attacker really going to not secure the data and walk away once they finally compromised the perimeter defense? This is not a viable option.

Thanks for visiting Woesnotgone Meadow, where the encryption is strong, and the O/Ss are always using the latest version.

Resources

1051 The Bounce. (2019, March 11). Are you one of the 600,00 michigan residents affected in data breach. Retrieved from https://1051thebounce.com/2019/03/11/are-you-one-of-600000-michigan-residents-affected-in-data-breach/

13ABC. (2019, March 11). Michigan residents warned about health care data breach. Retrieved from https://www.13abc.com/content/news/Michigan-residents-warned-about-health-care-data-brech-506985321.html

62CBS Detroit. (2019, March 11). Health care data breach affects 600k michigan residents. Retrieved from https://detroit.cbslocal.com/2019/03/11/health-care-data-breach-affects-600k-michigan-residents

Davis, J. (2019, March 12). More than 600,000 affected by michigan health care data breach. Retrieved from https://securitytoday.com/articles/2019/03/12/more-than-600000-affected-by-michigan-health-care-data-breach.aspx?m=1

Goedert, J. (2019, March 15). 600,000 affected by huge data breach in michigan. Retrieved from https://www.healthdatamanagement.com/news/600-000-affected-by-huge-data-breach-in-michigan

Scott. (2019, March 12). Data breach may have exposed 600,000 michigan residents. Retrieved from https://smallbusinessbigthreat.com/blog/2019/03/12/data-breach-may-have-exposed-600000-michigan-residents/

Strachan, J. (2019, March 11). More than 600,000 in Michigan Affected by health care data breach. Retrieved from https://patch.com/michigan/across-mi/more-600-000-michigan-affected-health-care-data-breach

The Associated Press. (2019, March 11). Michigan residents warned about health care data breach. Retrieved from https://www.kansas.com/news/business/article22740489.html

Wolverine Solutions Group. (2019, February 27). Notice of breach/cybersecurity incident-updated 02.27.2019. Retrieved from https://www.wolverinemail.com/cyber-security-event/

Wolverine Solutions Group. (2019, February 28). Letter signed by Robert Tokar.

Woesnotgone Meadow; April 18, 2019

All is relatively well here at Woesnotgone Meadow, where everyone has above average bandwidth.

In the Meadow, we occasionally have the storm roll through the area. There may be high winds, hail, and the power may occasionally go out. We have become so used to these harsh winters of the north, not much really bothers us anymore.

Just in case a large storm would come through, the council had an early warning device set up. We have never used it for an event yet. The police chief every three months on the first Tuesday tests the noisemakers (these are so loud) and the text service. Margie’s cats lose their minds during these two minutes of wonderment. Jerry’s dogs howl like it is the full moon. That’s about the only exercise they get these days though.

The Meadow’s system is basic, nothing like the warning network in Australia. The early warning system had a little issue earlier this year. Like numerous areas throughout the globe, there is the opportunity for a serious storm to affect an area. This could be manifested with heavy rains or snow, flooding, hail, tornado, or any other significant storm. So that the local residents are aware of the circumstances, an early warning system generally is put in place. These measures may not give hours of notice, however, some notice is better than none. The system may be audible based with the exceptionally loud horns. These may also send emails or texts to the residents to let them know of the issue. Both may be implemented also, in an attempt to reach everyone possible.

Australia has this service in place. This is offered by the Australian company Aeeris. In Queensland, the municipality uses an SMS system. This sends the emergency messages to those who have signed up for it. These messages may be oriented with extreme weather, fires, evacuations, information, and incident responders. The local citizens depend on this when there are significant weather issues.

Unfortunately, the warning system in Queensland, Australia was attacked. The attack vector involved the unauthorized parties using credentials secured through illicit means. They are not sure of the method used to steal the affected credentials. The attackers accessed without authorization the Queensland EWN (Early Warning Network) on 1/5/2019. The attackers on the successfully compromised system were able to send spam alerts to the service subscribers. These were sent with SMS, landlines, and email. The fake SMS message was moderately short with “EWN has been hacked. Your personal data is not safe.” The alerts also provided instructions on how to unsubscribe to the service. With this attack, it does not appear to be malicious, as the attack apparently did not access or exfiltrate any personal data.

The successful compromise was initially detected by the staff. They noted the unauthorized alerts rather quickly, which I would have hoped was the case. To immediately resolve the issue, the staff did turn off the system. This served to cease any potential further spam messages. This was done soon enough to limit the scope and exposure of the attack. They are also investigating the attack with the police and the Australian Cyber Security Centre.

This unfortunate attack further illustrates the need for a strong perimeter defense and staff training for attacks. Clearly, the tools and methods used to attack the system have not been identified. A strong defensive posture would include these measures. When these areas, and others, are ignored, certain mayhem follows.

Thanks for visiting Woesnotgone Meadow, where the encryption is strong, and the O/Ss are always using the latest version.

Resources

Abrams, L. (2019, January 7). Hacker uses Australian early warning network to send spam alerts. Retrieved from https://www.bleepingcomputer.com/news/security/hacker-uses-australian-early-warning-network-to-send-spam-alerts/

Crozier, R. (2019, January 7). Hack spam sent via Australian hazard alert service. Retrieved from https://www.itnews.com.au/news/hack-spam-sent-via-australian-hazard-alert-service-517552

Cyware. (2019, January 7). Cybercriminals hacked WEN’s systems and sent spam alerts to thousands of people across Australia. Retrieved from https://cyware.com/news/cybercriminals-hacked-wens-systems-and-sent-spam-alerts-to-thougsands-of-people-acrss-australia-0aae601e

McLean, A. (2019, January 7). Emergency warning network confirms breach. Retrieved from https://www.zdnet.com/article/emergency-warning-network-confirms-breach/

Wiggins, N., Hendry, M., McCoskor, A., et al. (2019, January 7). Emergency text and email service hacked, thousands receive warning message about their personal data. Retrieved from https://www.abc.net.au/news/2019-01-07/emergency-text-service-hacked-warning-about-personal-data-sent/10688748