Australian Parliament Attacked!

With local municipalities, there is a local government managing the business for the town, city, village, etc. Dependent on the size of the municipality, the required governance may be significant, or lower. As each of these grows, there tends to be more staffing required, larger networks, and more responsibility to go around.

National governments are no different. As these have grown, the infrastructure to support these likewise has grown to a critical mass. As these agencies grow larger, they also tend to be more of a target. The Australian parliamentary recently found this out, the hard way, or gave them the opportunity to review their defensive cybersecurity posture.

As with any national government, there is a substantial network infrastructure in place to support the computing activities. This was recently attacked or as they put it, there was a “security incident on the parliamentary computing network.” While some are calling this an attack, others are also calling this a breach. The timing for this was curious. This occurred merely three months prior to the Australian election.

This was not a substantial or prolonged attack. This was focused on the parliamentary computer network. This includes database and email systems. The attack occurred overnight. The initial incident response indicated no data had been exfiltrated. This was still being investigated after the attack. The authorities are also reviewing if a state actor had been involved.

Unfortunately, the attack methods have not been elaborated on. This will prove to be the more interesting part. This could also be used as a teaching tool, so that there would at least be some form of a benefit.

To be conservative and as an abundance of caution, all of the passwords had to be reset. There were also other measures being worked on to further secure the network.

This was not a new target. The US government has been hacked several times over the years, with many different agencies, including the IRS, OPM, and FDIC, to name a few. The week before the attack the British government experienced a bit of this when their email and phone contact lists were attacked. Also, the Scottish parliament email accounts were attacked unsuccessfully in 2017. This list is not extensive by any means. There have been many more attacks. Some known, most probably not published.

This exemplifies the need to have exercises for computer cybersecurity. This requires regular audits and examinations to ensure the system’s cybersecurity is up to date.

Resources

BeauHD. (2019, February 8). Australian parliamentary network hacked in possible foreign government attack. Retrieved from https://it.slashdot.org/story/19/02/08/073241/austrailia-parliamentary-network-hacked-in-possible-foreign-government-attack

BBC. (2019, February 8). Australian parliament hit by cyber-hack attempt. Retrieved from https://www.bbc.com/news/world-australia-47166590

Borys, S. (2019, February 7). China link possible in cyber attack on Australian parliament computer system, ABC understands. Retrieved from https://www.abc.net.au/news/2019-02-08/china-government-cyber-security-breach-parliament-hackers/10792938

Central Telegraph. (2019, February 8). China probed in parliament hack attack. Retrieved from https://www.centraltelegraph.com.au/news/breach-of-federal-parliamentary-computing-network-/3642837/

Moderc, M. (2019, February 8). Australian parliamentary network hacked; no sign data stolen. Retrieved from https://www.cnbc.com/2019/02/08/australian-parliamentary-network-hacked-no-sign-data-stolen.html

Remeikis, A. (2019, February 7). Australian security services investigate attempted cyber attack on parliament. Retrieved from https://www.theguardian.com/australian-news/2019/feb/08/asio-australian-security-services-hack-data-breach-investigate-attempted-cyber-attack-parliament

Schwartz, M.J. (2019, February 8). Hack attack breaches Australian parliament network. Retrieved from https://www.bankinfosecurity.com/hack-attack-breaches-australian-parliament-network-a-12012

The Associated Press. (2019, February 8). Australian parliamentary network hacked; no sign of data stolen. Retrieved from https://abcnews.go.com/Technology/wireStory/australian-parliamentary-network-hacked-sign-data-stolen-60930659

Wroe, D., & Uhlmann, C. (2019, February 8). Federal MPs’ computer network hacked in possible foreign government attack. Retrieved from https://www.smh.com.au/politics/federal/federal-mps-computer-network-hacked-forcing-passwords-to-be-changed-20190208-p50wgm.html

Physician's Office Forced to Close Due to Ransomware

Ransomware’s Long-Reaching Effects: Physician’s Office Shut done

Physicians are located throughout the nation. These all have their specialties. As these practices vary in size, their budgets spent on cybersecurity vary greatly. The rule of thumb, for better or worse, has been the greater amount spent on cybersecurity the more intricate and hardened the system is. This, however, has not always been the case.

Recently Brookside ENT and Hearing Center had the pleasure of managing a successful cybersecurity attack and compromise. This doctor’s office was located in Michigan. The successful attack initially encrypted the files and complete computer system for the Brookside ENT and Hearing Center. The attacker demanded a $6,500 ransom for the decrypt key. The ransom was refused, which normally is a good route to follow if you have viable backups and/or are able to recreate the data without a significant issue. Naturally, the attackers were not exceptionally happy with this response. As a direct result from this, the entirety of the practice’s computer network was erased. This included all of the patient files and records. This was, to say the least, a bad situation.

Effect

The medical practice was owned by John Bizon, MD, and William Scalf, MD. After all the records were erased, the owners decided to retire and close the practice. Rebuilding the practice’s data and other pertinent information was simply not worth it for the owners/doctors. This adversely affected the patients.

The data affected was rather expansive. This included all the appointment schedules, payment data, and other patient information. On the bright side, it appears no patient data was accessed and the electronic health records (EHR) were encrypted. The potential issue with this is the encryption protocol in place was not published. It is presumed this an industry standard and not home-rolled or an outdated version.

Incident Response

The FBI was actively investigating the successful attack. Unfortunately, the attack vector and tools had not been published yet. The data for this could have been used as a learning tool and case study for others. The attack could have been a simple phishing attack with the right staff members clicking on an image or link.

This illustrates the need for purposeful training for the staff members on the various cybersecurity topics. It is by far too late for this practice; however, others may learn from this.

Resources

Davis, J. (2019, April 1). Michigan practice to shutter after hackers delete patient files. Retrieved from https://healthitsecurity.com/news/michigan-practice-to-shutter-after-hackers-delete-patient-files

Genesee County Pwned!

Genesee County under attack!

-Charles Parker, II

There are vast numbers of municipalities of various sizes adjacent to each other throughout each state in the nation. Each of these obviously has a computer network, of varying sizes, in place for the day to day operations. One of these counties, in Michigan, also recently had an interesting issue. Genesee County has had much written about it, as the city of Flint is at the center of the media storm. In this county, there was recently a successful ransomware attack, unfortunately.

Attack

Ransomware has been over the last few years been exceptionally successful as an attack. The trend continues, as published repeatedly across many industries. One of these was the municipal offices of Genesee County, located in Michigan. The successful attack used one of the ransomware tools. The Genesee County Clerk stated the county servers were shut down due to this. The ransomware followed its standard protocol and encrypted the files. There naturally was a demand for money with this. Once received the attackers would provide the decrypt key. The initial forensic work indicated no files were exfiltrated, which was a good thing.

What to do?

This was a rather significant issue for the county. There were a few options for the county to follow, given the parameters of the attack. They could pay the fee and hope they would provide the decrypt key. The county would also have to hope the attackers did not leave any malware or back doors in the network. As an alternative, they could not pay the fee and use back-ups, which would require time and accurate and viable back-ups being in place prior to the attack. As the third option, do nothing and hope for the best.

The county ended up not paying the ransom. This was the safest bet as long as the county had up to date recent back-ups, which had been tested, in place. Fortunately for the county and their general fund, and their insurance company, there were adequate back-ups in place. The back-ups had been done the evening before at midnight. This indicated the data replication would be minimal. There would still be al mass amount of time, as the back-ups needed to be used to replace the encrypted data and files.

Affected

The attacks can vary in depth and width across the network, depending on the network itself and the form of ransomware. This could affect one system or the complete set of servers. In this case, nearly all of the networks in the system were affected. The county had signs in the window of the offices that the computer system was down, they were using manual systems, and the computer systems had been down for several days. The one relatively pertinent system for payroll was not, however, affected.

Forensic Work

This was a rather large project. The county contacted and had been working with the Michigan State Police and the FBI for their expertise. They may have been other third-party contractors involved.

Lessons Learned

Ransomware is a curious tool. While very devastating, it may also be viewed as being modular, in that the malicious tool may be adjusted according to the end result needed. All it takes is one employee in the wrong department to click on the wrong link. This issue did, however, show the importance of back-ups and testing them to ensure these really are backing up. This also shows there still is the distinct need for the employees to be trained.

Resources

Acosta, R. (2019, April 4). Ransomware computer virus hits county network. The Flint Journal, A1.

Ciak, M. (2019, April 4). Genesee county hacking incident ‘more extensive than initially thought’. Retrieved from Genesee County hacking incident 'more extensive than initially thought'

Dissent. (2019, April 3). Genesee county’s email system not functional after ransomware attack. Retrieved from https://www.databreaches.net/genesee-countys-email-system-not-funcitonal-after-ransomware-hack/

Olenick, D. (2019, April 5). Genesee county ransomware attack more severe than originally thought. Retrieved from Genesee County ransomware attack more severe than originally thought | SC Media

Pierret, A. (2019, April 3). Genesee county’s email system not functional after ransomware attack. Retrieved from Genesee County's email system not functional after ransomware hack

Winant, D. (2019, April 4). Servers in genesee county were hacked. Retrieved from https://www.wnem.com/news/breaking-servers-hacked-in-gen-co/

Securing Connected Cars

Securing Connected Cars

Charles Parker, II

Vehicles abound in society and culture. These vary in age, color, manufacturer, and the amount of tire and brake wear. One topic which has been in the news and talked about commonly has been securing these vehicles, especially the connected vehicles now and the future autonomous vehicles. Seemingly, there are new articles with these are the story focus. With these vehicles, due to the other assets the vehicle connects to (e.g. V2X, V2I, V2V, V2G, etc.), a successful attack has the potential to have a really bad day.

Vehicles are becoming increasingly connected. At some point in the near future, the vehicles we have grown with will become autonomous. With all of these iterations with vehicle advancing in technology, one aspect becomes increasingly pertinent. The vehicles have to incorporate security into the vehicle’s infrastructure. The functionality requires it. As these vehicles control a greater extent of the operations, previously managed manually, the risk increases. When the vehicles are autonomous, the risk is rather significant. For instance, when the sensors are connected, the risk is for a false positive. If there is a tire pressure monitoring system (TPMS), the risk is for the equipment to read more or less than the actual air pressure reading in the tire. An attacker could successfully force the system to register an exceptionally low-pressure reading forcing the driver to pull over to the side of the road.

With the advanced autonomous drive vehicle, the risk is magnified. This is due to the attacker having the opportunity to take full control of the vehicle. The auto could be re-routed to a totally different location or turn into traffic during rush hour. This series of use cases illustrate the necessity and requirement for a secure vehicle infrastructure. These attacks absolutely do not have to be by someone located in or within a few feet of the car, or physically connected to it with a patch cord. These attacks may be done from anywhere across the globe with a fair internet connection. This makes the connected and autonomous drive vehicle even more potentially devastating. These attacks occur unfortunately with the present fleets. These may initially take the form of a proof of concept (PoC) at this point. The jump to a fully mature attack from this point is not that great of a stretch for the adequately trained attacker. These hypothesized compromises have been demonstrated by cybersecurity researchers on the Tesla, BMW, Nissan, Mitsubishi, FCA, and other manufacturer vehicles.

To address this growing germane issue, Mitsubishi Electric developed a cyber-defense system to defend vehicles. The new system incorporates multiple cybersecurity layers into one defense in depth tool. This works by improving the head unit’s (HU’s) ability to defend the vehicle. The vehicle’s connected function has allowed for an in-depth attack vector and path to the vehicle’s crown jewels, or the attacker’s targets to exfiltrate.

As noted, there are multiple layers of defense. This acts much like an intrusion detection/protection system (IDS/IPS). This is intended to decrease the potential for a successful attack. The more difficult is would be for the attacker to succeed, the greater the chance the attacker will move onto the next target, looking for an easier target. The attackers would not spend weeks or months on a random target when they would be able to successfully compromise another vehicle in days or a week. This is simple economics and algorithm.

This works by identifying attempted attacks in the HU and modules controlling the vehicle. This detects attack methods for the vehicle. This was designed for a faster boot-up. This is estimated to take less than 10% of the time for a conventional boot-up process. For this cybersecurity system, the HU is the focus for the defensive operating system. This is an appropriate central point as the HU is attached to the internet, and the researchers analyzed the defense-in-depth used by critical infrastructure and applied the theory to the vehicle.

The new system verifies the software in the vehicle’s operations integrity during the boot-up process. The system completes the task while not being over-bearing on the processing time and power. The direct effect on the system is paramount. The vehicle’s cybersecurity has to be fully addressed prior to the more connected vehicles being placed on the road. The drivers across the freeways would rather not have a rogue vehicle careening through traffic during rush hour on a Tuesday morning.

This cybersecurity feature is a great first step. This tool addresses one vector for an attack. There are others which focus on the other aspects of the vehicle’s functions and communications to address in the future.

Resources

Green Cars Congress. (2019, January 22). Mitsubishi electric develops cyber defense technology for connected cars. Retrieved from https://www.greencarcongress.com/2019/01/20190122.html

Kovacs, E. (2019, January 22). Mitsubishi develops cybersecurity technology for cars. Retrieved from https://www.securyweek.com/mitsubishi-develops-cybersecurity-technology-cars

Market Watch. (2019, January 21). Mitsubishi electric develops cyber defense technology for connected cars. Retrieved from https://www.marketwatch.com/press-release/mitsubishi-electric-develops-cyber-defense-technology-for-connected-cars-2019-01-21

R., J. (2019, January 22). Mitsubishi electric develops auto cyber security. Retrieved from https://www.universitymitsubishi.com/mitsubishi-electric-develops-auto-cyber-security/

Rajan, P. (2019, January 23). Mitsubishi electric develops cybersecurity technology for connected cars. Retrieved from https://www.telematicswire.net/automotive-security/mitsubishi-electric-develops-cybersecurity-technology-for-connected-cars/

Operation Sharpshooter

Operation Sharpshooter has you targeted
-Charles Parker, II

One aspect of our lives is impacted by a particular industry. Without this in place, our lives would be drastically, significantly different. This industry would be the defense industry. Another pertinent function involves the government, which is likewise integral to our society. In the past, these have been attacked successfully and compromised several times over the years. As targets, these continue to be ripe with data and information useful and able to be sold. To accomplish this end, there has been a campaign to breach the government and defense firms. The data held in these two organizations is very useful to many parties across the globe.

Operation Sharpshooter
This campaign was recently in use. The focus was to target defense businesses and government agencies. The attackers were able to compromise dozens of these organizations across the world. The operation was active from October to November 2018. There were 87 companies targeted. These were geographically located in 24 countries. These were primarily in the nuclear, defense, energy, and finance industries. These were located in the US, South America, Europe, Middle East, India, Australia, and Japan. The attackers used as their tool an openly accessible tool used by consumers and businesses every single day. The attackers used social media to send their messages. These were disguised as recruitment documents when these were actually documents with a little malicious intent sprinkled in.

Once the target opened the attachment, the "Rising Sun" malware was installed and the hilarity ensued. This appears to be an updated Trojan Duuzer, which was previously used in the Sony attack from years ago. This would send the data to its command & control (C&C) server via http POST requests. Typically, this would access and exfiltrate the usernames, IP addresses, network configurations, and system settings. Oher sensitive data would also been attacked, if possible. All of this was done with the 14 distinct capabilities this was coded with, summarized as intelligence gathering, encryption, exfiltration, and terminating processes. This could be used as the first step of a larger attack. This was another example of a successful social engineering attack.

This successful campaign emphasizes the need to provide adequate training for the staff on phishing and what to look for in these.


Resources
Barth, B. (2018, December 12). 'Sharpshooter' cyberespionage campaign scopes out defense, critical infrastructure sectors. Retrieved from https://www.scmagazine.com/home/security-news/sharpshooter-espionage-campaign-scopes-out-defense-critical-infrastructure-sectors/

Browne, R. (2018, December 12). Hackers hit global government and defense firms with cyberspying campaign, McAfee says. Retrieved from https://www.cnbc.com/2018/12/12/mcafee-operation-sharpshooter-hack-hit-government-defense-firms.html

EHacking News. (2018, December 12). Malware 'operation sharpshooter' hits government and defense firms: McAfee. Retrieved from https://www.ehackingnews.com/2018/12/malware-operation-sharpshooter-hits.html

IBS Intelligence. (2018, December 12). New malware 'operation sharpshooter' hits global defense, finance and critical infrastructure claims mcafee. Retrieved from https://ibsintelligence.com/ibs-journal/new-malware-peration-sharpshooter-hits-global-defense-finance-and-critical-infrastructure-claims-mcafee/

Muncaster, P. (2018, December). Operation sharpshooter targets nue and defene firms. Retrieved from https://www.infosecurity-magazine.com/news/operation-sharpshooter-targets/

Palmer, D. (2018, December 12). Global hacking campaign takes aim at finance, defence and engery companies. Retrieved from https://www.zdnet.com/article/global-hacking-campaign-takes-aim-at-finance-defence-and-energy-companies/

Sherstobitoff, R., & Malhotra, A. (2018, December 12). 'Operation sharpshooter' targets global defense, critical infrastructure. Retrieved from https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/operation-sharpshooter-targets-global-defense-critical-infrastructure/

2019 6 13 Cisco routers targeted again

Cisco Routers Targeted ... Again
-Charles Parker, II

The Cisco name is known across the globe and is highly regarded. A massive amount of engineering has been applied to the product line, and in this case their routers.

Targets
There were security researchers who detected the Cisco RV 320 and RV 325 WAN routers being scanned and the vulnerabilities attempted to be exploited. Specifically, this was aimed at the RV 320 with versions 1.4.2.15 through 1.4.2.19, and RV 325 versions 1.4.2.15 through 1.4.2.17. These hardware instances are used commonly with internet service providers (ISP) and large enterprises.

Attacks
The attacks started in earnest in January 2019. This just happened to coincide with researcher David Davidson releasing a proof-of-concept exploit for the targeted routers.

Vulnerabilities
The vulnerabilities driving these exploits were CVE-2019-1653 and CVE-2019-1652. The vulnerability cited in -1653 allows a remote attacker to get sensitive device configuration details without requiring a password. This allows the attacker to obtain hashed credentials. The vulnerability noted in -1652 allows the remote attacker to inject and run admin commands on the device without a password and control the targeted device.

Earlier, 6,247 RV 320 and 3,410 RV 325 routers were vulnerable. These were in 122 countries and 1,619 distinct ISPs. These were both reported to Cisco by RedTeam Pentesting from Germany.

Remediation
After the notification, naturally, the Cisco engineers worked on this. The end result was the patches were created and released in January 2019. This may have been fine, however, the attackers were using Davidson's PoC attack and adding other commands. This allowed the attackers to take full control over the noted Cisco devices. To alleviate the issue, users were recommended to upgrade to the firmware version 1.4.2.20. The users were also recommended to change their passwords. It was pertinent for the users to do this, or they may have an unwelcome surprise.


Resources
0x27. (2019, January 24). CVE-2019-1652/CVE-2019-165B exploits for dumping cisco rv320 configurations & debugging data and remote root exploit. Retrieved from https://githumb.com/0x27/CiscoRV320Dump

Cimpanu, C. (2019, January 27). Hackers are going after cisco RV320/RV325 routers using a new exploit. Retrieved from https://www.zdnet.com/article/hackers-are-going-after-cisco-rv320rv325-routers-using-a-new-exploit

Cisco. (2019, January 25). Cisco small business rv320 and rv 325 routers command injection vulnerability. Retrieved from https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-rv-inject

Kumar, M. (2019, January 28). New exploit threatens over 9,000 hackable cisco rv320/rv325 routers worldwide. Retrieved from https://thehackernews.com/2019/01/hacking-cisco-routers.html

Hacking the blockchain-It's not just for breakfast anymore

No longer impregnable-Hacking the blockchain
-Charles  Parker, II


Blockchain seems to have been over the last few years one of the words attracting quite a bit of attention. As the functional attribute providing the backbone for cryptocurrency several new protocols were popping up. A handful was prepared for their introduction, while too many others were not. This was to provide a promise for those investing and using cryptocurrency. With this in place, the cryptocurrency was safe.

This was heralded as the one application of computer science engineering which was not vulnerable to a successful attack. By all accords for those directly, intrinsically involved in the industry, this was nothing to worry about due to the structure and framework used by the blockchain.

Not Merely a Theory-Coinbase
It would be easy enough to spout on how the blockchain apps could be hacked. There are many theories on how this could be done. A portion of these is exceptionally complicated, while others are relatively more simple.

In January 2019, the theory became reality. The security team at Coinbase was working through the day, just like any other. At some point, they began to note strange occurrences focussed on Ethereum Classic. This exchange platform is generally used to purchase and sell cryptocurrency. The attackers had control of over half of the Coinbase network. The attacker's efforts allowed them to rewrite the transaction history.

The rewriting of the transaction logs allowed the group to double-spend. Gate.io lost approximately $200k. This was not the only successful attack. Since 2017, there has been nearly $2B of cryptocurrency stolen, and this is the publicly revealed amount.

Market's Attitude
Honestly, the market should not be shocked by this turn of events. There is a mass amount of cryptocurrency in these platforms waiting to be attacked. These attacks are not easy to complete successfully. This being said, as long as there is money or assets to steal, there will be targets.