Phishing continues to evolve

 

Phishing has been one of the more profitable ventures for attackers. This is especially true when phishing is coupled with other attacks, such as ransomware. Since phishing is so useful and potentially a revenue-producing activity, it is no wonder a new method has been devised to further the reach. One well-used method to lure the unsuspecting victim has been the landing page which looks to be perfectly legitimate, however, is full of malware and/or malicious links. This spoofing may also include a login page, to further gather data. With the latest tools in place, the malicious website closed, are easier to find. As this has been known, the attackers have thought through a nuance to the age-old attack-creating a landing page for AV and an alternative, malicious version for the unsuspecting user. The AV version has the appropriate background image. The primary difference is the colors are inverted. This is done due to the AV coded to focus on the landing page’s shapes, not colors. The second step involves the user. The user sees the odd coloration and moves on to the alternative version of the landing page. The other landing page has the correct colors with a little something added for the attacker’s benefit. This attack continues to show the need for user vigilance. If something looks odd, don’t keep clicking. If you click something once that doesn’t look right, don’t click the same thing three times. There probably is a problem. Advise your users not to click on provided links, but type them in.

 

PLEASE contact us when we may be of assistance with embedded systems cybersecurity architecture, validation, and penetration testing. We have a full lab ready to perform.

Charles Parker, II; Principal Scientist; MBA/MSA/JD/LLM/PhD/DCS (IP)

charlesparkerii@gmail.com

810-701-5511

Even Hunger-Relief Groups are not Off-Limits

 

With the economy not doing exceptionally well, people’s wages for the year generally decreasing significantly, and the pandemic continuing at least for the short-term, not-for-profit budgets can be stretched rather thin. As these provide services based on their mission, these may need to be re-evaluated. One form of service desperately needed is food relief and pantries. One of these organizations is Philabundance. Of all the targets available across the vast expanse of the internet, the attackers chose this one.

 

Philabundance is a food relief organization located in the Philadelphia area. This is the region’s largest hunger-relief group. The organization feeds over 100k people per week in the areas it has a presence. With the economic downturn, it shouldn’t be a big surprise this number of people served is almost double last year’s.

 

The attack itself took a widely used, yet simple, attack method. The attackers used phishing as a tool in the summer of 2020 to execute the attack. The organization is constructing a new building. The budget for this is $12M. This new building will house the Philabundance Community Kitchen. The attackers tied into this for the attack. They infiltrated the target system through a phishing campaign. Once in, a rule in the email system was set to block legitimate emails. The attackers were able to then spoof the construction company’s email with a fake invoice for $923,533. The organization paid the fake invoice on July 6, 2020. They discovered the problem when the construction company called for their money on July 24, 2020. After detecting the issue, the investigation began with full force. The effort indicated this was a one-time event. There was no staff information or data accessed. One area the organization specifically noted as not being affected was the online donation platform. There needed to be confidence in the system, so people would continue to donate.

 

Fortunately, the organization was able to cover the debt with its reserves. The hope is the insurance company will assist the organization in replenishing the lost funds. The FBI was contacted and is investigating. The organization hired a cybersecurity subject matter expert to review the incident. Internally, they have begun to update their security system with increased controls and more employee training.

 

Phishing can be tough to defend against. Yes, there are easy instances to detect. These include emails with the misspelled words, grammar not quite making sense, and 85 people being emailed for a late arrival package, all with the same tracking number. More often, the emails encountered have become so much more sophisticated. To maintain the pace with these phishing email advances, the training needs to be updated. With how fast the industry continues to advance, this cannot be overlooked. Of course, the appropriate systems in place to monitor for these.

  

Resources

6abc Digital Staff. (2020, December 1). Philabundance loses nearly $1 million in cyberattack. Retrieved from https://6abc.com/philabundance-cyberattack-hack-phishing-scam-philly-fbi/8425984/

 

6abc Digital Staff. (2020, December 2). Philabundance loses nearly $1 million in cyberattack. Retrieved from https://www.newsbreak.com/pennsylvania/philadelphia/news/2116820862556/philabundance-loses-nearly-1-million-in-cyberattack

 

Associated Press. (2020, December 3). Philadelphia hunger group loses nearly $1M in cyberattack. Retrieved from https://www.insurancejournal.com/news/east/2020/12/03/592596.htm#:~:text=The%20Philadelphia%20region's%20largest%20hunger,Jones%20told%20The%20Philadelphia%20Inquirer

 

Brubaker, H. (2020, December 1). Philly hunger relief group philabundance lost nearly $1 million in cyberattack. Retrieved from https://www.inquirer.com/business/philabundance-cybertheft-nearly-1-million-20201201.html

 

Fox29.com. (2020, December 1). Philabundance loses nearly $1M in cyberattack. Retrieved from https://www.newsbreak.com/pennsylvania/philadelphia/news/2116586100406/philabundance-loses-nearly-1m-in-cyberattack

 

Philadelphia Sun Staff. (2020, December 11). Philadelphia hunger group loses nearly $1M in cyberattack. Retrieved from https://www.philasun.com/local/philadelphia-hunger-group-loses-nearly-1m-in-cyberattack/

 

Ralph, P. (2020, December 1). Philabundance falls victim to cyberattack, loses almost $1 million. Retrieved from https://www.phillyvoice.com/philabundance-cyberattack-theft-1-million-dollars/

 

Schratwieser, D. (2020, December 1). Philabundance loses nearly $1M in cyberattack. Retrieved from https://www.fox29.com/news/philabundance-loses-nearly-1m-in-cyberattack

UK flooring firm pwned

 

Attackers are always looking for new targets to attack. With the vast expanse of the internet, the field is ripe with people and businesses with data or operations to leverage for a fee. A company acknowledged its issue in late November 2020. Headlam Group, a UK flooring group distributor based in Birmingham, experienced a successful attack, acknowledged on November 24. The attackers were able to exfiltrate data as part of the attack. The attackers were able to access the system’s back end, including their email system. The company was able to restore its email system for usage. Fortunately, the company’s customer and supplier information was accessed. The company did not disclose the method the attackers used, however, this was effective. We can learn from their unfortunate issue. All the attackers need is one vulnerability or user to click on one link or picture, while the blue defensive team has to work to patch everywhere possible, monitor the threat feeds for the latest attacks, think through various attacks that could occur, and secure the data at rest.

 

 

PLEASE contact us when we may be of assistance with embedded systems cybersecurity architecture, validation, and penetration testing. We have a full lab ready to perform.

Charles Parker, II; Principal Scientist; MBA/MSA/JD/LLM/PhD/DCS (IP)

charlesparkerii@gmail.com

810-701-5511

Of all targets, you chose Sophos

 

You know it’s not going to be a good day when a cybersecurity company is breached. Cybersecurity companies are supposed to be the top tier and subject matter experts of cybersecurity. Since they are selling and marketing their services to other companies, one would infer their stance and defensive posture is without reproach. A recent issue with Sophos recently shown light on this. Sophos is a cybersecurity company, selling many services, located in the UK. The company is well-known in the industry, for good reasons. In mid-November of this year, the company experienced an attack and subsequent breach. The attackers were able to exfiltrate data during the attack, including user names, emails, and contact numbers. Fortunately, per Sophos, only a small number of customers were affected by the issue. This is an example of why we need to maintain vigilance with cybersecurity. This field changes frequently and is not static. The lack of regular updates and monitoring provides for too many viable attacks points to try.

 

PLEASE contact us when we may be of assistance with embedded systems cybersecurity architecture, validation, and penetration testing. We have a full lab ready to perform.

Charles Parker, II; Principal Scientist; MBA/MSA/JD/LLM/PhD/DCS (IP)

charlesparkerii@gmail.com

810-701-5511

Hope you don’t expect automobile connectivity to slow down anytime soon

 

Automobiles are becoming more connected with each innovation and year. This is an extension of consumer’s desires in functionality. These innovations haven’t been only mechanical or with efficiency, but with the electronics and software applications. These innovations, while increasing and improving the user experience, the connectivity as a bi-product has also allowed for more of an attack surface. There are more points to attack with this in place. This has been noticed by the automobile manufacturers. In response to the increased attack points and vulnerabilities, the OEMs and Tier 1 and 2 manufacturers have refocused on cybersecurity. This has included additional work from the beginning of the projects, focusing on software, hardware, and dependencies. For instance, it is not a general focus with software coding, validating the functionality, testing the software, and working to detect any vulnerabilities not previously addressed. Regarding the hardware, each vehicle has an increased number of ECUs (electronic control units) to accommodate the additional functions. These also represent more points for the attackers to address. Providing more points to explore is never a good thing. 

 

 

PLEASE contact us when we may be of assistance with embedded systems cybersecurity architecture, validation, and penetration testing. We have a full lab ready to perform.

Charles Parker, II; Principal Scientist; MBA/MSA/JD/LLM/PhD/DCS (IP)

charlesparkerii@gmail.com

810-701-5511

Not enough attention paid to industrial automated systems

 

Nearly all the products we purchase are processed by automated systems. If these were to stop working, or workflow maliciously adjusted, there would be a clear issue immediately as the products were assembled incorrectly or broken during the “adjusted” process. While this potential to wreck our way of life if implemented on a large scale, there has not been a sufficient amount of attention paid to it. Recently, a new vulnerability was uncovered with the equipment. This vulnerability, which is critical, is in the real-time automation’s (RTA) 499E5 EtherNet/IP (ENIP) stack. The stack is widely used and is the standard for factory floor I/O applications in North American plants. If the attacker is able to exploit this, the equipment could experience a DoS-type attack, and allow for remote code execution. This vulnerability, CVE-2020-25159, has the opportunity to not only shut down a line and part of a plant but also be instructed to do whatever the unauthorized third party directs it to. Based on the pertinence to society these automated processed play and the costs associated with these lines not being productive, more of a focus needs to be applied to this. There is even a tool available used to scour the internet seeking the robots used in these processes which are not properly secured. Without cybersecurity, in place, there is the potential for individual attacks and much worse with a concerted attack.

Please contact us when we may be of assistance with embedded systems cybersecurity architecture, validation, and penetration testing. We have a full lab ready to perform.

Charles Parker, II; Principal Scientist; MBA/MSA/JD/LLM/PhD/DCS (IP)

charlesparkerii@gmail.com

810-701-5511

Medical arts still targeted

 

The medical field has been targeted over the last few years for attacks. The focus has and continues to be the data being held. These attacks may take any of the many different forms of attack, dependent on the target’s equipment, configurations, and other factors. The data targeted by the attackers has value to them and for resale. A recent case directly involved this. UCSF experienced a successful attack on June 1, 2020, with its School of Medicine’s IT environment. While the method was not published, the data involved was. The attacker may have had access to the current and former employee’s names, social security number, government ID numbers, medical information, health insurance ID numbers, and possibly financial information.

After the attack was discovered, UCSF did contract with a cybersecurity consultant, and others to investigate the breach. The IT system was also analyzed for areas to harden, to minimize the opportunity for this to happen again.

The successful method used for the breach was not available. This could have been a simple phishing attack, or a more complex, multi-step attack on their system. This attack however does emphasize the need for a complete, defense in depth. This involves staff training, patch management, and updates.