Woesnotgone Meadow; June 6, 2019

All is well here at Woesnotgone Meadow, where everyone has above average bandwidth.

In the Meadow, the residents and families may need to use county resources every now and again. These various services are readily available. In the Grand Rapids, MI area there is an agency providing mental health services. The services are provided by the Kent County Community Mental Health Authority. The organization is also known as Network 180.

Attack Method

The system was breached on October 28, 2018. The breach was open for approximately 9 days. The county agency was targeted for a phishing campaign.  This has been seen in abundant numbers over the last few years as more phishers come online, and users continue to be click-happy. The phishing emails were above average in composition and form, as these were created from a legitimate source. Three employees, lured by the emails, clicked the link or attachment.

Once detected, there was a full investigation. The investigation was managed by the HIPAA Privacy Officer, HIPAA Security Officer, IT Department, and HIPAA Legal Counsel. The issue was reported to HHS. The investigating team, through their efforts, could not definitely state whether the data was viewed or accessed.

Data

The attackers focused on data and other valuable points in the system. With this attack, the subject data was encrypted email accounts (names, addresses, dates of birth, Medicaid, and Medicare ID numbers, Network 180 internal ID numbers, waiver support application ID numbers, provider names, schools attending or attended, demographic data, names of the patient’s relatives, ethnicity or race, and patient’s health care provider(s). For approximately 20 of the 2284 patients, the social security numbers were also compromised.

Thanks for visiting Woesnotgone Meadow, where the encryption is strong, and the O/Ss are always using the latest version.

Remediation

The successful attack required a mass password reset. The organization also needed to update their cybersecurity measures.

Resources

Davis, J. (2019, January 10). Phishing attack hits kent county community mental health. Retrieved from https://healthitsecurity.com/news/phishing-attack-hits-kent-county-community-health

Dissent. (2019, January 8). MI: Kent county community mental health authority notifies 2,284 patients after phishing attack. Retrieved from https://www.databreaches.net/mi-kent-county-community-mental-health-authority-notifies-2284-patients-after-phishing-attack/

Hackbusters. (2019, January). Phishing attacks at mental health organization affects 2284 clients. Retrieved from http://www.hackbusters.com/news/stories/4248385-phishing-attacks-at-mental-health-organization-affects-2284-clients-health-data-management

Woesnotgone Meadow; June 4, 2019

All is well here at Woesnotgone Meadow, where everyone has above average bandwidth.

In the Meadow, we have our municipal office, which manages the Meadow’s business and works with our citizens. The Meadow has maintained its presence under the radar and has been fortunate to not have been attacked. Akron, OH, however, has not been this lucky.

The city’s computers were the targets for the attack. As this was successful, ransomware was applied to their system. Curiously, this was the 2^nd time the city was successfully attacked. The first was in 2013.

Effect

Once the successful attack was detected, the city knew there was a significant issue. The attack shut down a majority of Akron’s 311 system. This also affected other critical software and hardware systems. Fortunately for the city, the attack wasn’t nearly as in-depth and devastating as it could have been.

Demand!

The attackers demanded a six-figure sum for the decrypt key. Without the funds, the decrypt key would not be provided. This potentially would have been devastating. The city’s data and information being encrypted could have crippled the workflow, recordkeeping, and had operations pushed back into the 1950s with paper and pencil.

Response

The city did not respond to the attackers. The city had the foresight to have daily back-ups done. Without this in place, the attackers would have had significantly more leverage on the city. The city ended up restoring the files from the day before, so the workers only had to enter one day’s worth of work.

From the legal aspect, the city did contact the FBI and Ohio Highway Patrol. The Akron mayor also requested assistance from the governor in the form of the Ohio National Guard’s help from the 172^nd Cyber Security Protection Team.

Take-Away

The attack shows the importance of not only active monitoring for the system but also back-ups. The back-ups were integral to de-escalating the attacker’s leverage. These allowed the city to restore the data from the day before, without spending the money to attempt to secure the decrypt key. Without this, the city would have the opportunity to make a large payment and hope the decrypt was provided. These were also done on a daily rotation, which allowed for the not only the restore but also for a minimal amount of data having to be rekeyed in or otherwise incorporated into the data.

With this case and many others, the rule to apply is back-up and check the back-ups to ensure they are not corrupted.

Thanks for visiting Woesnotgone Meadow, where the encryption is strong, and the O/Ss are always using the latest version.

Resources

Ashworth, A. (2019, January 25). Akron combats ‘financially motivated’ cyberattack on city servers. Retrieved from https://www.ohio.com/news/20190125/akron-combats-financially-motivated-cyberattacks-on-city-servers

Houston Chronicle. (2019, January 26). Akron says cyberattack forced shutdowns of city help line. Retrieved from https://www.houstonchronicle.com/news/article/Akron-says-cyberattack-forced-shutdown-of-city-13564123.php

Scofield, D. (2019, January 25). Multiple local and state agencies investigating cyberattack on akron’s city servers. Retrieved from https://www.news5cleveland.com/news/local-news/akron-canton-news/multiple-local-and-state-agencies-investigating-cyber-attack-on-akrons-city-servers

Woesnotgone Meadow; May 31, 2019

All is well here at Woesnotgone Meadow, where everyone has above average bandwidth.

In the Meadow, we certainly play video games. Sometimes by ourselves, other times with our children or grandchildren. We play racing games, zombie games, and many others. We expect to have a great time with this. What we don’t expect is to be a victim of ransomware.

Ransomware

The new ransomware, Anatova, has been detected. This was originally detected by McAfee. The research indicates this was released on January 1, 2019. The ransomware has been noted as infecting others in a private peer to peer networks. This has been analyzed. The ransomware curiously was engineered to be modular in nature. This allows the ransomware to be updated for new functions. This also makes the ransomware more difficult to detect. While this is the case, it has been detected across the globe in Belgium, Germany, France, and the UK, among other European countries.

Code

This version of ransomware was engineered with a slight twist. This does encrypt files just like the other ransomware tools already do. This ransomware also checks for connected network shares and encrypts these files.

It is not known who or what group coded this ransomware. Curiously, the malware does not infect systems located in Syria, Egypt, Morocco, Iraq, and India.

How it Works

 This uses an old social engineering trick/method. Anatova has an icon of a game or application. This fools the user into believing they will be double-clicking on the game. Post-double click, the system shows a request for admin rights. If the user just clicks this for convenience or believes this is a requirement, their (not-so much) fun begins.

This encrypts their system and files, on the PC and servers. The ransomware uses strong encryption, using a pair of RSA keys. The malware retrieves the username of the logged in party and/or active user. These names are compared with default usernames used with sandboxes. If this is found, the ransomware will not work.

Demands

Once the infection is in place and the user has the “uh-oh” moment, the system notifies the user of the ransomware. The system then demands a payment to unlock the files, just as with the other ransomware samples.

Lessons

This is another example of the additional training needed by the staff. There are very limited occasions when downloading a game is required at work. The equipment really should be used for work.

Thanks for visiting Woesnotgone Meadow, where the encryption is strong, and the O/Ss are always using the latest encryption.

Resources

Allen, D. (2019, January 23). Anatova is a nasty new ransomware that targets gamers. Retrieved from https://www.techradar.com/news/anatova-is-a-nasty-ransomware-that-targets-gamers

Bhatnagar, V. (2019). Anatova ransomware is targeting gamers. Retrieved from http://www.hackbusters.com/news/stories/4297915-anatova-ransomware-is-targetting-gamers

Digital Trends. (n.d.). Latest ransomware targets gamers with a malicious sophistication. Retrieved from https://www.digitaltrends.com/computing/anatova-ransomware-targets-gamers-malicious/

EHacking News.(2019, January 26). Anatova ransomware is targeting gamers. Retrieved from http://www.ehackinghews.com/2019/01/anatova-ransomware-is-targeting-gamers.html

Fire-Ball Cyber Security. (2019, January 26). Anatova ransomware is targeting gamers. Retrieved from https://fireballcybersecurity.blogspot.com/2019/01/anatova-ransomware-is-targeting-gamers.html

Palmer, D. (2019, January 24). New ransomware poses as gamers and software to trick you into downloading it. Retrieved from https://www.zdnet.com/article/new-ransomware-poses-as-gamers-and-software-to-trick-you-into-downloading-it/

Salim, S. (2019, January 25). Alert: Ransomware found in free games and software. Retrieved from https://www.digitalinformationworld.com/2019/01/anatova-ransomware-targeting-gamers-skilled-hackers.html

Scammell, R. (2019, January 23). Watch out for anatova, a new ransomware targeting gamers. Retrieved from https://www.verdict.co.uk/anatova-ransomware-gamers/

Woesnotgone Meadow; May 21, 2019

All is well here at Woesnotgone Meadow, where everyone has above average bandwidth.

In the Meadow, we don’t have any significant manufacturing industries or facilities. The closest we have is a factory which assembles vehicle air fresheners. Although we don’t have much in the way of heavy industry within our bounds, our residents certainly are aware of these facilities.

Within these large facilities, robots abound, lifting the heavy or size-awkward parts in a precision ballet. To watch the process is an amazing feat of science. These robots, while completing these tasks as more of a science than art, also present endpoints to attack. To acquire a list of these to probe and attack, could take a bit of time, and could be hit and miss. Fortunately, there’s a tool for this.

Aztarna

To save time and energy, and effort, Alias Robotics coded, in Python, the open source tool Aztarna. Alias Robotics, while a start-up, did create this valuable tool. The term Aztarna is “footprint” in Basque. In short, this is a port scanning tool and compares its scanning results with its database of fingerprints for individual controls and robotic technology and its components. The tool does robot foot printing, auditing of internet connected robots, and identifying/locating robots and their components. This was engineered to operate in different modes, dependent on the different pen testing use cases.

Uses

As described, this is a robot scanning tool, which seeks robots and the components open on the internet. This is used to track the robotics connected to the internet and powered by any robotic technology (e.g. ROS (Robot Operating System) and SROS (Secure ROS)). The primary focus of the tool are industrial robots and robots used as a part of daily operations. They may be used in the manufacturing industries on the production floor to assemble, for instance.

Targets

The tool begins by seeking specific routers. Within the robotics field, there are a limited number of manufacturers whose routers are used. These historically have been Siena Wireless, Ewon, Moxa, and Westermo.

Initially, the tool was used to scan globally, not only in the US. This scan detected 9000 insecure industrial routers hosting the targeted robots. Of the 9000, 1586 routers were in Europe. These were detected as they were misconfigured. Of this Europe sub-population, France and Spain had the most routers. In comparison the US and Canada had far fewer.

A later scan of 26801 routers identified 8958, or approximately 33%, were insecure. These were using default or weak credentials, or not requiring authentication. Of these, Columbia had the greatest number of misconfigured and insecure devices with 26 each and all of these were using default credentials.

The researchers also scanned for open ROS Master in port 11311. Aztarna was configured to verify if the hosts were corresponding to ROS running machines. The tool detected 106 ROS systems. Of these 52 were located in the US and 16 in South Korea. A portion of these were noted as being connected to simulations or not connected to actual robots.

Vulnerability

The robots were the end target. The insecurities are the clear threat to the manufacturer’s cybersecurity. These manufacturers may not be giving this as much attention as needed. As too many of these have no, default, or weak authentication in place, there is a problem. When these systems are down, as when an attacker would successfully breach one of these systems and shut down one or more robots, every second is revenue and money lost to the company. Dependent on the size of the manufacturer, this could be hundreds of thousands a day to millions. The amount of lost revenue, depending also on the workflow and orders being worked on, is amazing, to the detriment to those with compromised systems, or when ransomware is applied to the robots. To say the least, it is prudent for the manufacturers to review this.

Responsible Disclosure

The researchers noted the vulnerable robots and components from the scans. After the scan results, the researchers did not just hold the results and not do anything positive with this. They did not want the manufacturers to continue with their security by obscurity. This approach in the long-term has never worked well. The manufacturers were notified of the vulnerabilities.

Thanks for visiting Woesnotgone Meadow, where the encryption is strong, and the O/Ss are always using the latest encryption.

Resources

Alias Robotics. (2019, January 16). Researchers publish a tool to hunt for hackable robots connected to the internet. Retrieved from https://news.aliarobots.com/researhcers-publish-a-tool-to-hunt-for-hackable-robots-connected-to-the-internet/

Happich, J. (2019, January 22). Open-source scanning tool can find vulnerable robots. Retrieved from https://www.eenewsembedded.com/news/open-source-scanning-tool-can-find-vulnerable-robots#

Kumar, M. (2019, January 28). Researchers release tool that finds vulnerable robots on the internet. Retrieved from https://thehackernews.com/2019/01/robot-cybersecurity-tool.html

Waqas. (2019, January 28). Meet aztarna, a tool to find vulnerable internet connected robots. Retrieved from https://www.hackread.com/aztarna-tools-find-vulnerable-internet-connected-robots/

Woesnotgone Meadow; May 21, 2019

All is well here at Woesnotgone Meadow, where everyone has above average bandwidth.

At times, the citizens of the Meadow may bet the flu or another virus. With a certain portion of the population, the flu or pneumonia has the potential to be very serious. At this point, the resident is transported to a hospital and becomes a patient. At this point, the patient provides their personal information, including their name, social security number, and insurance information. The hospital then becomes responsible for your personal, confidential data. Generally, this is not an issue and the hospital have your data secured. At times, however, this is not the case.

Pawnee County Hospital is located in Nebraska. The hospital conducts business just as most hospitals do. Most of their days on the administrative side are not all too exciting. Things were about to change for the administrators. The subject attack was rather passive, yet in this case, very effective. On November 29, 2018, the hospital discovered the issue. A hospital staff member has received and opened an email. This happens dozens and dozens of times a day for most of the hospital’s staff members. In this case, as with the others, the employee thought (mistakenly) this was from a tested source. Unfortunately, the staff member opened the attachment and began the infection. The attacker had access from November 16 through 24. The employee’s email account contained reports for the business clinic reports, clinical summaries, and other pertinent internal documents. Post-discover, the hospital did contract with a third party for the forensic work.

As this is a hospital, the data they have been entrusted with contains primarily the patient’s confidential data and information (PHI & PII). The compromise allowed unauthorized access to this. The data the attacker’s had access to was the patient’s full name and at least one of the following (address, date of birth, date(s) of service, medical record number, clinical information, insurance information, and driver’s license/state ID numbers). The patient’s social security number may also have been involved.

Due to the compromise, the hospital was required to notify 7,038 to 7,175 patients of the issue. This was the direct result of the malware infecting the system. The compromise created quite an issue for the hospital. As for the remediation, the hospital did agree to provide for one year of their credit monitoring service. The IT department also began to update their systems. All of the staff members were required to reset their email passwords. There were additional security features involved.

This issue also continues to show the importance of employee training. With appropriate training perhaps there would be fewer of these types of issues.

Thanks for visiting Woesnotgone Meadow, where the encryption is strong, and the O/Ss are always using the latest encryption.

Resources

Dissent. (2019; February 9). Pawnee county memorial hospital notifies 7,038 patients after employee email account compromised by phishing attack. Retrieved from https://www.databreaches.net/pawnee-county-data-breaches.net/pawnee-county-memorial-hospital-notifies-7038-patients-after-employee-email-account-compromised-by-phishing-attack/

Garrity, M. (2019, February 11). Nebraska hospital notifies 7,000 patients of phishing attack. Retrieved from https://www.beckershospitalreview.com/cybersecurity/nebraska-hospital-notifies-7-000-patients-of-phishing-attack.html

HIPAA Journal. (2019, February 11). 7,000 patients notified about pawnee county memorial hospital malware attack. Retrieved from https://www.hipaajournal.com/7000-patients-notified-about-pawnee-county-memorial-hospital-malware-attack/

Woesnotgone Meadow; May 16, 2019

All is relatively well here at Woesnotgone Meadow, where everyone has above average bandwidth.

In the Meadow, we are working towards more of a green future. We are recycling, and starting to use solar panels. There are other projects in the works. We do use electricity from the grid to power our computers, lights, stoves, microwaves, and other services at home and work. Margie is the local manager for the power company, and she generally manages all of the things we need to be done individually and for the Meadow, so we know it is done right and timely. Fortunately, we have not had a problem with this. Another electricity provider appears to not have been so lucky.

Eskom is the largest electricity utility in South Africa. In this case, when a third party detects an issue on your system, and reports this vulnerability to you, seemingly someone in the company would thank the researcher and start working on closing the issue. This does not seem too outlandish or out of the realm of reality. This did not quite happen in a recent case with Eskom.

The security researcher detected the vulnerability. This was located in Eskom’s information system with its database. This issue had been open for weeks. A company may not listen to someone without evidence. This issue was documented to other parties with a screenshot. The specific vulnerability operations at that time had not been disclosed. This may be from the Trojan Azorult, downloaded from a game. With this specific issue, the user who “allegedly” downloaded the Trojan had also been identified. The end result and detectable issue was the vulnerability was leaking customer data.

The researcher informed them multiple times of the vulnerability and its effects. A news organization also had informed Eskom. There also had been direct messages on Twitter to Eskom. Still no action on this significant issue. After everything else failed, the issue was posted in a public forum (Twitter).

The user’s data being exposed was the alarm for the researcher to focus on. The vulnerability was leaking the customer’s full name, type of credit card, partial credit card number, and credit card CVV.

When you receive a gift, generally you don’t ignore this, especially the ones of this type. To receive this data early before the industry at large would have saved them a mass amount of time, money, overhead if they would have acted upon this. This also highlights the need for more user education. It should be obvious, however, the users should not load games on business computers.

Thanks for visiting Woesnotgone Meadow, where the encryption is strong, and the O/Ss are always using the latest version.

Resources

Abrams, L. (2019, February 9). Power company has breach due to downloaded game. Retrieved from https://www.bleepingcomputer.com/news/security/power-company-has-security-breach-due-to-downloaded-game/  

Dissent. (2019, February 6). Eskom data leak exposes sensitive customer information-security researcher. Retrieved from https://www.databreaches.net/eskom-data-leak-exposes-sensitive-customer-information-security-researcher/

Finnegan, C. (2019, February 7). Eskom data leak may have exposed personal details of a number of customers. Retrieved from http://thechiefobserver.com/1304/eskom-database-flaw-may-have-exposed-personal-details-of-a-number-of-instances/

NAVVA. (2019). Eskom data leak exposes sensitive customer information-security researcher. Retrieved from https://navva.org/africa/africa/eskom-data-leak-exposes-sensitive-customer-information-security-researcher/

Vermeulen, J. (2019, February 6). Eskom data leak exposes sensitive customer information-security researcher. Retrieved from https://mybroadband.co.za/news/energy/295030-eskom-data-leak-exposes-sensitive-customer-information-security-researcher.html

Woesnotgone Meadow; May 8, 2019

All is relatively well here at Woesnotgone Meadow, where everyone has above average bandwidth.

In the Meadow, the residents are a bit located off the beaten path. Our highlight for the week tends to be driving to Margie’s Ice Cream Parlor on Friday night. On a special occasion, we may see turkeys in the field on the way there. Although we may seem not to be on the leading edge of technology, we certainly try and use the latest smartphones and laptops. With these devices, there have been various issues with antennas, batteries, and other hardware. A recent vulnerability involved the firmware on WiFi chips.

WiFi chips are used in numerous devices we use in the Meadow on a daily basis. These include gaming equipment, personal computers, business equipment, communications, IoT devices, and many other examples.

With the hardware WiFi process for the individual piece of equipment, the device beacons out, seeking the WiFi points the device is familiar with, with no regard as to the access password. In effect, it is seeking to know what is local and proximate it may connect with. This feature/vulnerability may allow the device to attach to the attacker’s device without any interaction.

Other attacks involve rewriting the pointer to the next free block of memory and controlling the allocation for the next memory block to be used. This may prima facie appears to be mundane and not very exciting. By being able to have the ability to change the pointer for the next block, the attacker could adjust the flow to an out-of-process run-time pointer. The attacker could tell the target/victim computer to alter its normal operation, without authorization. This could run the attacker’s code or process. There are also other vulnerabilities with this.

Vulnerability

The firmware on these devices varies greatly. These, unfortunately, have various levels of security applied to them through the development process. In this particular instance, a vulnerability was detected in Thread X. Thread X is a real-time operating system (RTOS) created by ExpressLogic.

This is not a low usage RTOS, as there are over 6.2B deployments. This makes the vulnerability one of the most widely used software packages. One vulnerability detected involved the block and pool overflow. This issue could be initiated when the chip scans for networks to connect with. The process is done every five minutes, regardless if the device is connected or not.

Uses

The firmware is more expansive in numbers and device usage. This is found in the Avastar 88W 8897 SOC (system on chip), WiFi, Bluetooth, and near field communications (NFC) in Marvell, Sonly Playstation 4 and Pro, Microsoft Surface and Pro tablets, Xbox One, Samsung Chromebook, Galaxy J1 smartphone, and Valve Steam Link.

Thanks for visiting Woesnotgone Meadow, where the encryption is strong, and the O/Ss are always using the latest version.

Resources

BeauHD. (2019, January 18). Firmware vulnerability in popular wi-fi chipset affects laptops, smartphones, routers, gaming devices. Retrieved from https://it.slashdot.org/story/19/01/18/2333237/firmware-vulnerability-in-popular-wi-fi-chipset-affects-laptops-smartphones-routers-gaming-devices

Ilascu, I. (2019, January 18). Vulnerabilities found in highly popular firmware for wifi chips. Retrieved from https://www.bleepingcomputer.comnews/security/vulnerabilities-found-in-highly-pupular-fimrware-for-wifi-chips/

Information Security Newspaper. (2019, January 18). Vulnerabilities found in wifi chips firmware. Retrieved from https://www.securitynewspaper.com/2019/01/18/vulnerabilities-found-in-wifi-chips-firmware/