Sturdy Memorial Hospital-Not so much

 

Hospitals continue to be targeted at an inappropriate rate over the last five years. Other industries have just as valuable data as the medical field, however, hospitals are in the news at a higher rate. One aspect of this driving the attacks is the criticality of the services. The hospitals require access to the data (e.g., patient charts) and networks to perform the operations, both planned and emergency, procedures, and simply to see patients. The high-level data flow for this is quite simple. In the alternative, the system may be breached, and patient data exfiltrated. The ransom may be demanded as a promise to not distribute or sell this data to other unauthorized parties.

Therefore ransomware, in this circumstance is so potent. Also, the patient data is very important to both parties, the hospital and patient. The hospital must report the breach in most instances. The patient, depending on the data itself, may have the pleasure of monitoring their accounts and credit report for decades.

With the exfiltrated data, the hospital generally has two options. They may or may not pay the ransom to keep the data from being sold to other unauthorized parties. Paying the ransom usually is not recommended. The thought, in this case, after the money is received, they would release it anyway. While this has occurred in a limited number of times over the last few years, this is a detriment to the business model and the malware industry. If the organization is reasonably certain the data will be published anyway, there is absolutely no reason to pay a penny. In this instance Sturdy Memorial Hospital did pay the ransom or fee. The amount was not disclosed. As a result of the breach, the hospital mailed letters to the effected parties. As part of the response, the incident was reported to the FBI.

While the attack vector was not noted, the incident is representative of the reach ransomware has. Dependent on the malware strain, all it can take is one person clicking the wrong link. We still need additional training to limit the potential for this to happen elsewhere.

UF; UH-OH

 

Hospital systems are a treasure trove of data. You know the patient’s name, social security number, address, medical records and identifiers, and other information that can be sold in mass, or divided into section for separate sales. With this area of operations, the data is critical for patient care. This provides leverage for any attacker. If they can remove access to the data and network, through an example of ransomware, the facility would be desperate to get this back online and may be more likely to pay a ransom if there is no access to viable back-ups.

The University of Florida Health System recently had the opportunity to work through this portion of their incident response plan. This did affect the services at the two locations targeted and successfully attached. The two locations of UF Health were Leesburg and The Villages. The attackers were able to shut down their systems. Other than the successful attack itself, it is surprising this is not the first time in recent history this occurred, with the prior occurrence last August.

With two events of this nature occurring within one year, it appears there needs to be additional training for staff or the network needs to be improved.

That was an expensive click

 

Everyone needs or is required to have insurance. This may take the form of auto, health, dental, short- or long-term disability care, or any of the other types of insurance. It seems as though if there is a need, you can find insurance for it. One of the largest commercial insurance carriers in the US is CAN. While being one of the largest insurance carriers in the nation certainly is a success to be applauded, this also has the tendency to put a target on you. After all, when a company is this huge, there is a literal mountain of data to target, and the company certainly has deep pockets to pay a ransom, if they so choose.

Recently CNA had the pleasure of working through an incident much like this. Ironically, CNA sells cyber insurance. In this case, the attackers were able to compromise CNA’s system. Post-breach, they were able to encrypt over 15K of the company’s devices using Phoenix Crypto Locker, a variant of Hades. This variant is engineered to encrypt the files on the compromised machines and demand a ransom for the decrypt key. The group, Evil Corp, was paid the ransom by CNA.

For everyone and organizations that believe “This can’t happen to me!”, yes it can. If CNA who has a vast number of resources and even sells the insurance for this type of incident can be successfully attacked, you certainly can also.

Military vehicle manufacturer hacking

 

The Department of Defense (DoD) business contractors continue to be regularly targeted. These organizations tend to work with secret and top-secret data and information as they develop new systems for use in the military. These could be ground vehicles, jets, ships, and other projects. One contractor, Navistar, was targeted and successfully breached. This was published with their Form 8-K filing with the Securities and Exchange Commission (SEC). The company detected the compromise on May 20, 2021.

With the data involved, the company could not be affected by paralysis by analysis, and immediately went into action to contain the breach, and work towards mitigating the effects from this. After these steps, Navistar began investigating the attack. This was done with security and forensic subject matter experts. They also contacted law enforcement.

As a result, from this, the organization took steps with its infrastructure to strengthen its structure and protect the data from unauthorized parties. Through the attack, the systems continued to be operational. While they aggressively worked to minimize any damage, on May 31 they did receive a communication that data had been exfiltrated during the attack. Considering the updated information, they continue dot investigate the issue and determine the scope of the data involved.

This is another example of what could happen. While you continuously work towards securing the enterprise, there is always a vector available. Arriving at this may be difficult, but it is still there.

Tesla; still targeted

 

Over the years since that fateful day in 2015, there have been many people who have made their name with vehicle hacks. The attacks can be mundane or affect critical systems. Disabling the A/C is by far different than the engine or braking system.

Any vehicle system will have vulnerabilities. The researcher just must find them. One auto manufacturer targeted in the last approximately three years has been Tesla. The vulnerabilities found have required physical access and others have not. In this instance, the vulnerability was found by a Canadian software developer from Quebec (Shankar Gomare). Normally the vulnerabilities are found by cybersecurity researchers. In this case, he was working on his “Voice for Tesla” iOS app early in 2021 and noted the significant vulnerability with Tesla’s Bluetooth key technology. The developer’s app functions much like Amazon’s Alexa providing reminders via voice. The difference with this is the application would not require a specific word or phrase, as Alexa does.

Through developing the application, the developer noted Tesla uses two different forms of Bluetooth sensors in the vehicle. These are Bluetooth Basic Rate/Enhanced Data Rate (BR/EDR). This is used generally for streaming music. The other is Bluetooth Low Energy (BLE). The phone key uses this method. You would use this as a convenience as this use allows the keyholder to unlock the vehicle by being proximate to the vehicle with the connected mobile device (e.g., phone).

As you can figure, the exploit involves Bluetooth. The vehicle’s sensors are coded to detect the strongest Bluetooth signal for connected devices within its range prior to the execute unlock function. This occurs generally with the owner’s mobile device. Here is the issue. The researcher noted the BLE connection did not require authentication to connect to the vehicle. This ends up allowing the researcher to unlock any Tesla by acting as the phone key by forcing the vehicle the request the key from the actual mobile device-by pulling on the door handle.

For this to work, the actual owner’s mobile device would still need to be within 200m-400m for the BLE range. This may seem a bit risky if the owner were walking to their vehicle at the end of the day and saw the person. Where this would work much better would be if the Tesla were parked in the driveway in the evening. Yes, this was patched with an over-the-air (OTA) update.

This is another example of the importance of allowing legitimate cybersecurity researchers to act. The researcher conducted himself appropriately and worked with Tesla for a responsible disclosure. Think through what could have happened if the bad actor had this method and went another route.

Community college in Iowa breached

 

Colleges and universities are much like medical facilities in the eyes of the attackers. They both may not have the best defenses in place and hold a mass amount of data on their clients (i.e. students and patients). Also, for both, there have been many, many breaches in the last three years, as noted by the published compromises.

The colleges in Iowa are no different and have been targeted. This time, the Des Moines Area Community College was targeted and breached. An unfortunate side effect of this was for the students the school needing to be shut down for a few days.

The issue began on a Friday as the incident became known, and the school had to partially shut down its network. This continued through Tuesday. Fortunately, the in-person classes resumed on the Wednesday. A date for the online classes to start back-up had not been around.

To assist with the forensic investigation, the FBI was contacted and is involved. Unfortunately, there have been no published details of the attack. The breach again shows us anyone is a target, and your defenses have to be kept up to date.

6/21/2021 Update: The community college does have cybersecurity insurance. The insurance company was negotiating with the attackers. This was indeed yet another ransomware attack. As part of the forensic review the SME did check over 6K of the college’s computer.

Yet another medical facility pwned

 

Medical facilities continue to be pwned by the attackers, week after week, month after month. The latest victim is Scripps Health. May 2, 2021 Scripps was the victim of an attack, which successfully breached its system. The method of malware being placed on the information system has not been published yet. The malware was not trivial, as the administrator was forced to suspend access to a large portion of the network. Scripps posted on Twitter (May 20^th) that most of the functions of their website, scripps.org, were operational again. The other functions were still being worked on. One function still be addressed was the patient portal, which as of May 20, was still offline. Scripps was still researching the breach as of the May 20 date and weren’t completely sure whether the patient data was affected. If this was, the organization would go through the standard notification process. With any institution, but especially those who are stewards of valuable data, cybersecurity can’t be ignored or placed in a situation of just checking the box. As the attacks continue to ramp up and become yet more common, breaches like this and much worse are going to continue.