Episode 25: Vice Admiral Mike McConnell – the former NSA director, an elite storyteller whose life resembles a Grisham novel, and an appreciator of formaldehyde-free beerEpisode 25: Vice Admiral Mike McConnell – the former NSA director, an elite storyteller whose life resembles a Grisham novel, and an appreciator of formaldehyde-free beer
- BONUS Episode 25: Vice Admiral Mike McConnell – the former NSA director, an elite storyteller whose life resembles a Grisham novel, and an appreciator of formaldehyde-free beer
BONUS Episode 25: Vice Admiral Mike McConnell – the former NSA director, an elite storyteller whose life resembles a Grisham novel, and an appreciator of formaldehyde-free beer
Microsoft Releases Workaround for Zero-Day Flaw
I. Targeted Entities
- Microsoft Office users
II. Introduction
Microsoft has recently established a workaround for a zero-day vulnerability, known as Follina, for Microsoft Office applications, such as Word, after being originally identified back in April. This vulnerability is a remote control execution (RCE) flaw, and if successfully exploited, threat actors have the ability to install programs, view, change, or delete data on targeted systems. The RCE is associated with the Microsoft Support Diagnostic Tool (MSDT) which, ironically, collects information about bugs in the company’s products and reports them to Microsoft Support.
III. Background Information
Microsoft explained that “a remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word…An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application”.[1] The workaround comes about six weeks after the vulnerability was first seen by researchers from Shadow Chaser Group on April 12th and reported to Microsoft on April 21st. The vulnerability was noticed in a bachelor’s thesis from August 2020, with attackers seemingly targeting Russian users.[2] A Malwarebytes Threat Intelligence analyst also found the flaw back in April but could not fully identify it. The company posted a tweet on the same day, April 12th.[2]
At first, when the flaw was first reported, Microsoft did not consider the flaw an issue. But now, it is clear that the vulnerability should be taken seriously, with Japanese security vendor Nao Sec tweeting a fresh warning, noting that the vulnerability was targeting users in Belarus. Security researcher Kevin Beaumont called the vulnerability Follina; the name comes from the zero-day code references to the Italy-based area code of Follina (0438).[2]
There is no fix for the flaw, but Microsoft recommends that affected users disable the MSDT URL to rectify the flaw for now. Disabling the MSDT URL, “prevents troubleshooters being launched as links including links throughout the operating system.”[2] To disable the MSDT URL, users should follow these steps:
- Run Command Prompt as Administrator
- Back up the registry key by executing the command “reg export HKEY_CLASSES_ROOTms-msdt filename”
- Execute the command “reg delete HKEY_CLASSES_ROOTms-msdt /f” [2]
Microsoft says that the troubleshooters can still be accessed using the Get Help application and by using the system settings. Microsoft also says that if the calling application is an Office program, Office will open the document in Protected View and Application Guard for Office, which Microsoft says will “prevent the current attack.” However, Beaumont refuted that assurance in his analysis of the bug.[2] Microsoft also plans on updating CVE-2022-3019 with further information but did not specify when it would do so.[2]
Meanwhile, the unpatched flaw poses a significant threat. One reason is that the flaw affects a large number of people, given that it exists in all currently supported Windows versions and can be exploited via Office versions 2013-2019, Office 2021, Office 365, and Office ProPlus.[2] Another reason is that the flaw poses a major threat in its execution without action from the end-user. Once the HTML is loaded from the calling application, an MSDT scheme is used to execute a PowerShell code to run a malicious code payload.[2] Since the flaw is abusing the remote template feature in Microsoft Word, it is not dependent on a typical macro-based exploit path, which are common within Office-based attacks.[2]
Researchers say that this flaw is similar to last year’s zero-click MSHTML bug (CVE-2021-40444), which was pummeled by attackers, including the Ryuk ransomware gang. In fact, threat actors already pounced on this vulnerability. Proofpoint Threat Insight tweeted that threat actors were using the vulnerability to target organizations in Tibet by impersonating the “Women Empowerments Desk” of the Central Tibetan Administration. Moreover, the workaround Microsoft currently offers itself has issues and won’t provide much of a long-term fix. It is not friendly for admins because the workaround requires users to change their Windows Registry, says Aviv Grafti, CTO and founder of Votiro.[2]
IV. MITRE ATT&CK
- T1219 – Remote Access Software
An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. - T1218 – System Binary Proxy Execution
Threat actors bypass signature-based defects by proxying the execution of malicious content with signed, or trusted binaries. This technique often involves Microsoft-signed files, which indicates that the binaries were either downloaded from Microsoft or already native to the operating system. - T1221 – Template Injection
Threat actors create or modify references in user document templates to conceal malicious code or force authentication attempts. - T1566 – Phishing
Adversaries may utilize methods like phishing that involve social engineering techniques, such as posing as a trusted source.
V. Recommendations
- Phishing Awareness Training
Users should be informed and educated about new kinds of phishing scams currently being used and ones that have been used in the past. Awareness training should instruct users to avoid suspicious emails, links, websites, attachments, etc. Users should also be educated about new types of attacks and schemes to mitigate risk. Recommended link: https://www.us-cert.gov/ncas/tips/ST04-014 - Set Antivirus Programs to Conduct Regular Scans
Ensure that antivirus and antimalware programs are scanning assets using up-to-date signatures. - Disable Microsoft Support Diagnostic Tool
Microsoft recommends the affected users disable the MSDT URL to mitigate this vulnerability, as no patch yet exists for the flaw. - Strong Cyber Hygiene
Enforce a strong password policy across all networks and subsystems. Remind users to be wary of any messages asking for immediate attention, links, downloads, etc. All sources should be verified. Recommended link: https://us-cert.cisa.gov/ncas/alerts/aa21-131a - Turn on Endpoint Protection
Enable endpoint detection and response (EDR) to stop unknown malware in the product you’re using.
VI. Indicators of Compromise (IOCs)
Because the HTTP GET request headers are out of order when compared to “typical” patterns, a custom-developed DDoS attack tool is assumed to be used, and it is possible that the values might change between campaigns. As such, Larry Cashdollar, a researcher at Akamai, says that writing signatures for these patterns may not benefit defenders from an IOC standpoint. More information can be found at the link below:
https://www.akamai.com/blog/security/revil-resurgence-or-copycat
VII. References
(1) Microsoft Security Response Center, ed. “Guidance for CVE-2022-30190 Microsoft Support Diagnostic Tool Vulnerability.” Microsoft Security Response Center, May 30, 2022. https://msrc-blog.microsoft.com/2022/05/30/guidance-for-cve-2022-30190-microsoft-support-diagnostic-tool-vulnerability/.
(2) Montalbano, Elizabeth. “Microsoft Releases Workaround for ‘One-Click’ 0Day Under Active Attack.” Threatpost English Global, June 1, 2022. https://threatpost.com/microsoft-workaround-0day-attack/179776/.Threat Advisory created by the Cyber Florida Security Operations Center.
Contributing Security Analysts: Dorian Pope, Sreten Dedic, EJ Bulut, Uday Bilakhiya, Tural Hagverdiyev.
REvil is Back and Executes DDoS Attacks
I. Targeted Entities
- Akami Technologies Incorporated and customers
II. Introduction
A recent denial of service (DDoS) campaign against a hospitality customer of Akamai, a cloud networking provider, and the defunct REvil ransomware gang claiming responsibility for it. It should be noted that researchers believe there is a high probability that the attack is not a resurgence of the infamous cybercriminal group but rather a copycat operation.
III. Background Information
Akamai researchers have been monitoring the DDoS attack since May 12th, when a customer alerted the company’s Security Incident Response Team (SIRT) of an attempted attack by a group purporting to be REvil. The requests contain demands for payment, a bitcoin wallet, and business/political demands.[1] While the attackers claim to be REvil, it is not clear if the defunct group is responsible for the attacks, given that the attacks seem smaller than previous attacks that the group claimed responsibility for. The apparent political motivation behind the DDoS campaign is also inconsistent with REvil’s M.O.
REvil, which hasn’t been seen since July 2021, was a Russia-based ransomware-as-a-service (RaaS) group well-known for its attacks against Kaseya, JBS Foods, and Apple.[2] The disruptive nature of their attacks caused international authorities to take measures against the group, with Europol arresting a number of cybercriminals in November of 2021.[2] In March 2022, Russia, who up until then had done little to stop REvil’s operations, claimed responsibility for fully toppling the group at the behest of the U.S. government, arresting its individual members. One person arrested was instrumental in helping the ransomware group DarkSide, the group responsible for the Colonial Pipeline attack in May of 2021.[2]
The recent DDoS attack, which would be a shift in strategy for REvil, was comprised of a HTTP GET request in which the request path contained a message to the target containing a 554-byte message demanding payment. The victim was directed to send the bitcoin payment to a wallet address that “currently has no history and is not tied to any previously known bitcoin.”[2] The attack also has an additional geospecific demand that requested the targeted company to cease business operations across an entire country. The attackers threatened to launch follow-up attacks that would affect global business operations if the demand was not met and the ransom not paid in a specific amount of time.[2]
There is a precedent for REvil using DDos in its previous attacks, but it does not appear that this attack is the work of REvil. REvil’s M.O. was to gain access to a target network or organization and encrypt or steal sensitive data, demanding payment to decrypt or prevent information leakage to the highest bidders or threatening public disclosure of sensitive or damaging information. The technique in this attack is different from their normal strategy. The political motivation tied to the attack, which is linked to a legal ruling about the targeted company’s business model, also goes against REvil’s normal tactics, with leaders in the past saying that they were purely profit-driven.[2] However, it is possible that REvil is seeking a resurgence by trying out a new business model of DDoS extortion. However, what is more likely is cybercriminals using the name of a notorious cybercriminal group to frighten the targeted organization into meeting their demands.[2]
IV. MITRE ATT&CK
- T1498– Network Denial of Service
This type of attack involves the adversary blocking the availability of targeted resources to users of a system. In this case, the adversary exhausted the network bandwidth that Akamai customers relied on and demanded payment to end this attack.
V. Recommendations
- Phishing Awareness Training
Users should be informed and educated about new kinds of phishing scams currently being used and ones that have been used in the past. Awareness training should instruct users to avoid suspicious emails, links, websites, attachments, etc. Users should also be educated about new types of attacks and schemes to mitigate risk. Recommended link: https://www.us-cert.gov/ncas/tips/ST04-014 - Set Antivirus Programs to Conduct Regular Scans
Ensure that antivirus and antimalware programs are scanning assets using up-to-date signatures. - Monitor Malware
Continuously monitor current and new types of malware. Stay up to date on intel and advancements to prevent, defend, and mitigate these types of threats. - Strong Cyber Hygiene
Enforce a strong password policy across all networks and subsystems. Remind users to be wary of any messages asking for immediate attention, links, downloads, etc. All sources should be verified. Recommended link: https://us-cert.cisa.gov/ncas/alerts/aa21-131a - Turn on Endpoint Protection
Enable endpoint detection and response (EDR) to stop unknown malware in the product you’re using.
VI. Indicators of Compromise (IOCs)
Because the HTTP GET request headers are out of order when compared to “typical” patterns, a custom-developed DDoS attack tool is assumed to be used, and it is possible that the values might change between campaigns. As such, Larry Cashdollar, a researcher at Akamai, says that writing signatures for these patterns may not benefit defenders from an IOC standpoint. More information can be found at the link below:
https://www.akamai.com/blog/security/revil-resurgence-or-copycat
VII. References
(1) Cashdollar, Larry. “REvil Resurgence? Or a Copycat?” Akamai Blog. Akamai Technologies, May 25, 2022. https://www.akamai.com/blog/security/revil-resurgence-or-copycat.
(2) Montalbano, Elizabeth. “Cybergang Claims Revil Is Back, Executes DDoS Attacks.” Threatpost English Global, May 26, 2022. https://threatpost.com/cybergang-claims-revil-is-back-executes-ddos-attacks/179734/.
Threat Advisory created by the Cyber Florida Security Operations Center.
Contributing Security Analysts: Dorian Pope, Sreten Dedic, EJ Bulut, Uday Bilakhiya, Tural Hagverdiyev.
Trojan Attacks Google Play Store Again
I. Targeted Entities
- iPhone users
II. Introduction
New attacks have been discovered on iPhones that can be executed despite the device being turned off. This is a direct result of how Apple implements wireless features in iPhones such as Bluetooth, Near Field Communications (NFC), and Ultra-wideband (UWB) technologies. These features remain active on iPhones when powered down, which makes attack scenarios, such as loading malware on an iPhone’s Bluetooth chip to be executed while powered off, possible.
III. Background Information
The features previously mentioned have access to the iPhone’s Secure Element (SE) which stores sensitive information, even when the iPhone is shut off, according to a team of researchers from Germany’s Technical University of Darmstadt.[1] Because of this, malware is able to be loaded onto a Bluetooth chip that is executed while the iPhone is off (Germans). By attacking these wireless features, cybercriminals can access secure information, including a user’s credit card data, banking details, and even digital car keys on the iPhone.[2] Although this threat is ever-present, exploiting the threat is not so easy, with the threat actors still having to load the malware when the iPhone is on for later execution when the iPhone is off. This would require system-level access or remote code execution (RCE).[3]
The researchers at Germany’s Technical University of Darmstadt say that the cause of the issue is the low power mode (LPM) for wireless chips on iPhones. The LPM issue is caused when the user turns off their iPhone or when iOS shuts down automatically due to low battery. The researchers say that this is different than the power-saving feature that can be enabled by the user in the Settings app or
the Control Center. Because LMP is based on the iPhone’s hardware, and a solution cannot be patched via software, “wireless chips can no longer be trusted to be turned off after shutdown. This poses a new threat model.”[1]
Researchers analyzed the security of LPM features in a layered approach, observing the impact of the feature on application-, firmware-, and hardware-level security. A potential threat scenario that the researchers outlined on the iPhone’s firmware assumes that an attacker either has system-level access or can gain RCE using a known Bluetooth vulnerability.[2] In this attack, a threat actor with system-level access could modify firmware of any component that supports LPM. This way, they maintain limited control of the iPhone, even when the user turns the iPhone off.[3] Even if all firmware would be protected against manipulation, an attacker with system-level access could still send custom commands to chips that allow for “very fine-grained configuration, including advertisement rotation intervals and contents.” This could allow an attacker to create settings that would allow them to locate a user’s device with higher accuracy than the legitimate user in the Find My app, for example. [4]
The researchers reported their research to Apple, which did not provide feedback on the issues raised. A potential solution, according to the researchers, is for Apple to add “a hardware-based switch to disconnect the battery” so these wireless elements wouldn’t have power while an iPhone is powered down.[5]
IV. MITRE ATT&CK
- T1204 – User Execution
Adversaries must have system-level access to iPhones to conduct this kind of attack. Thus, they may attempt to social engineer iPhone users to load malware into their devices to be later executed when powered off.
- T1569 – System Services
Adversaries that have system-level control over iPhones will be able to execute malware remotely. Having this kind of control would give adversaries the ability to modify firmware that control low power mode, Bluetooth, NFC, and other wireless communication protocols.
- T1644 – Out of Band Data
Adversaries are capable of executing previously loaded malware on iPhones that have been powered off. Out-of-band data streams, such as Bluetooth and NFC, allow adversaries to execute malware remotely without needing any power from the device’s battery.
V. Recommendations
- Set Antivirus Programs to Conduct Regular Scans
Ensure that antivirus and antimalware programs are scanning assets using up-to-date signatures. - Monitor Malware
Continuously monitor current and new types of malware. Stay up to date on intel and advancements to prevent, defend, and mitigate these types of threats. - Strong Cyber Hygiene
Enforce a strong password policy across all networks and subsystems. Remind users to be wary of any messages asking for immediate attention, links, downloads, etc. All sources should be verified.
Recommended link: https://us-cert.cisa.gov/ncas/alerts/aa21-131a - Turn on Endpoint Protection
Enable endpoint detection and response (EDR) to stop unknown malware in the product you’re using.
VI. Indicators of Compromise (IOCs)
The link below has been included to assist with the download of some identified IOCs related to this Threat Advisory report. Be on the lookout for these IOCs, as well as anything that looks similar.
https://usf.box.com/s/inzlsmaxpkn72bo64sv5wya7ythbftid
VII. References
(1) Cleafy Labs. “TeaBot Is Now Spreading across the Globe.” Cleafy Labs. Cleafy Labs, January 3, 2022. https://www.cleafy.com/cleafy-labs/teabot-is-now-spreading-across-the-globe.
(2) Nelson, Nate. “Teabot Trojan Haunts Google Play Store, Again.” Threatpost English Global, March 2, 2022. https://threatpost.com/teabot-trojan-haunts-google-play-store/178738/.
Threat Advisory created by the Cyber Florida Security Operations Center.
Contributing Security Analysts: Dorian Pope, Ipsa Bhatt, Sreten Dedic, EJ Bulut, Uday Bilakhiya, Tural Hagverdiyev.
UCF Professor’s Research Helps Inform Policy, Laws Surrounding Intimate Partner Cyber Abuse
There are various positive aspects to living in a time in which technology is more prevalent and accessible than ever, but there are also many shadows in the realm of the cyberspace.
This is why Erica Fissel’s goal is to illuminate the interpersonal victimization that occurs in cyberspace in hopes that her work will be used to help inform policy and help these victims.
Fissel, an assistant professor in the Department of Criminal Justice, doesn’t consider herself a particularly technology-savvy person but was fascinated with the way people behave online versus offline. From there, she began to look at what use or abuse of technology looks like in an intimate partner relationship. A member of UCF’s Violence Against Women faculty cluster, she focuses on the impact it has on women.
Although she didn’t intentionally seek to make women the focus of her research, Fissel says she quickly discovered that women are the most likely to experience such forms of interpersonal victimization. She also works with the Cybercrime Support Network to help serve those affected by the growing impacts of cybercrime.
“This area is so interesting to me because it’s so underdeveloped, and there are so many ways that people can use technology to abuse their partners that I would have never thought of,” she says.
Such technology can include smart-home systems like video doorbells, which can be used to track or monitor an intimate partner. Even reading a partner’s text messages without their permission can fall into the category of technology-based abuse under certain circumstances.
She adds that it’s important to realize that intimate partner cyber abuse is not illegal. There may be laws applicable to cyberstalking or cyber harassment, but intimate partner cyber abuse extends beyond those behaviors.
“Because of that, people don’t know what they’re experiencing is abusive or problematic,” Fissel says. “They don’t know that they should be able to get help for it. I want my work to be able to inform policies and laws. I want to help individuals experiencing these behaviors access helpful resources, realize that they’re experiencing problematic behavior and get out of those situations.”
In her Women and Crime course, Fissel often finds herself teaching survivors and others who have experienced intimate partner cyber abuse. She’s even had students realize through the class that they are either currently being victimized or have been in the past.
“It’s very heavy material for students, but what I try to do is have a very open dialogue and safe space within the class where people are able to share their ideas,” she says. “We can talk about these types of behaviors and experiences because they’re important to understand.”
Defining the Cyber Abuse Spectrum
Although statistics show that women are generally more likely to be victims of intimate partner violence, Fissel says she is seeing more parity between men and women engaging in cyber-based abuse.
One of the projects Fissel has been working on examines the normalization or societal acceptance of behaviors that could be considered cyber abuse. She and a team of researchers from other universities collaborated on the study, which was funded by a faculty enrichment grant from the University of Cincinnati’s Criminal Justice Research Center. They collected data from 1,500 adults currently in an intimate partner relationship and asked about their experiences with intimate partner cyber abuse, perpetration and victimization within the past six months.
“We did a pilot test, and 100% of people experienced intimate partner cyber abuse as we defined it in the past six months,” Fissel says. “We thought, ‘This is a much bigger problem than we thought or we’re measuring it wrong.’ We talked to people about it, and some of the behaviors that we were defining as abusive aren’t abusive in all contexts.”
For example, tracking a partner via GPS would be considered abusive if it was being done without consent. However, Fissel says, many participants later indicated they tracked each other’s locations for safety reasons.
“That’s one of the tricky things with intimate partner cyber abuse, because it’s totally relationship specific and dependent on whether the boundaries developed with your partner were agreed upon without coercion,” she says.
In addition to looking at intimate partner cyber abuse on the victimization side, Fissel also is working on it from the perpetration side. That entails trying to understand why people engage in such behaviors, which is vital to being able to prevent them from happening.
Fissel also is working on another study with Jackie Woerner, an assistant professor in UCF’s departments of sociology and psychology, that focuses on the perpetration side. The two surveyed 544 people and followed up with nearly 300 of them a month later to examine their intimate partner cyber abuse behaviors over time. Part of this research involved asking participants about the factors that motivate their behavior. Fissel says many cited personal insecurities such as lack of trust.
“There’s almost a range within intimate partner cyber abuse,” she says. “There are things like checking someone’s text messages without their permission, which I would say is probably on the lower end of the spectrum. Then you also have people who are opening bank accounts in your name and ruining your credit, or people who are sending you threatening text messages. We’re also trying to figure out where the line that society draws is, because that’s going to help with trying to determine laws, too.”
Fissel received her doctorate in criminal justice from the University of Cincinnati. Her primary research interests focus on various types of interpersonal victimization that take place online, including cyberstalking, intimate partner cyber abuse and cyberbullying. She joined UCF’s Department of Criminal Justice, part of the College of Community Innovation and Education, in 2019.
Retrieved from UCF.edu. To see the original article, visit: https://www.ucf.edu/news/ucf-professors-research-helps-inform-policy-laws-surrounding-intimate-partner-cyber-abuse/
Password Tips to Help Keep Your Information Secure
Passwords are an essential part of protecting your personal information from cybercriminals. We all know that passwords can be a source of endless frustration in the digital world, and you’ve probably asked yourself, “do I really need to set a different password for each of my accounts?” Well, the short answer is yes.
Imagine that you are the ruler of a village, and your enemies are making their way to attack. Would you employ a single guard to protect every building and person across the land? No! You would send out an army of guards, each with a specific post to protect to increase your chances of a successful defense.
Your passwords work in the same way. Each of your online accounts needs its own unique password to ensure that your personal information is protected from potential attacks. If you reuse the same password for every account, all your personal information is at risk in an instant if that password is exposed by a cybercriminal seeking to infiltrate your accounts. Using an individual unique password for each account helps ensure that even if one password is exposed, your other accounts will remain protected.
In honor of World Password Day today, consider the following suggestions to help ensure that your passwords are successfully protecting your personal and confidential data from prying eyes.
Tips for Good Password Hygiene
Passwords vs Passphrases
Passphrases are a form of a password that is composed of a sentence or a combination of words. Often, passphrases can be more secure than normal passwords because they are longer yet easier to remember, reducing the likelihood that you will reuse the same password across multiple accounts for convenience.
In contrast to passwords, passphrases are often created by using random words or phrases that are significant to the user but would hold no meaning to any other person. An easy way to create a passphrase that is simple to remember, yet secure enough to protect your account, is to select three to four words that are relevant and significant to you.
It’s recommended not to use common greetings that can be easily guessed by others, such as “LiveLaughLove,” and instead use a phrase or words that would mean nothing to someone other than yourself. For example, on my desk I currently have a flag, mug, coffee, and a book, so an appropriate passphrase for me could be “FlagMugCoffeeBook”.
While it may seem counterintuitive to use a series of random words for a credential, phrases like these are more memorable and far more secure than a password, which typically seeks security through a mix of numbers, special characters, and upper and lowercase letters.
According to an article from Impact Networking, “the benefit of passphrases is that they make it easier for a user to generate entropy and a lack of order—and thus more security—while still creating a memorable credential. Generating entropy through randomized characters can be difficult, but this also makes it more difficult to launch a cyberattack against you.”
Password Managers
So, now that you have created strong and unique passphrases for each of your individual accounts, how are you supposed to remember them?
This is perhaps one of the main reasons why so many people commonly reuse passwords across multiple accounts. The truth is, unless you’re a robot or have a supernatural photographic memory, it’s probably going to be impossible to remember all your passwords without keeping track of them somewhere, and that’s okay!
Luckily for us non-robots, there are plenty of password managers out there that can help you keep track of your credentials for all your accounts in a safe and secure way.
Malwarebytes Labs defines a password manager as “a software application designed to store and manage online credentials. It also generates passwords. Usually, these passwords are stored in an encrypted database and locked behind a master password.”
This means that once you enter your account usernames and credentials into the secure vault, the only password you need to remember is that master password, and the password manager will do the rest for you!
For a list of the top-rated free password managers available in 2022, visit: https://www.pcworld.com/article/394076/best-free-password-managers.html.
Password Tips
- Refrain from reusing passwords on multiple sites and applications.
- Add multi-factor authentication whenever possible for an added layer of security.
- Update your passwords regularly.
- Don’t text or email your passwords to anyone.
- Do not create passwords based on your personal information or details, such as birthdays, names of family members, Social Security or phone numbers, etc.
- See if any of your passwords have been exposed by entering your email address at https://haveibeenpwned.com/
Expert: North Korea’s $625M Crypto Hack Presents a New Threat
US authorities this week tied North Korean hackers to the historic $625 million Axie Infinity crypto swindle, with the massive hack signifying the emergence of a new type of national security threat, according to a blockchain expert.
On Thursday, the US Treasury Department added an Ethereum wallet address to its sanction list after the wallet facilitated transfers for more than $86 million of the stolen funds. The hacking outfits Lazarus and APT38, both linked to North Korea, were behind the theft, the FBI said in a statement, and the funds are generating revenue for Kim Jong Un’s regime. Ari Redbord, head of legal and government affairs at blockchain research firm TRM, says the attack shows that even a nation as isolated as North Korea can participate in new-age cyber-warfare.
H-ISAC Report Identifies Top Cyber Threats Concerning Healthcare Execs
H-ISAC and Booz Allen Hamilton released a report and survey outlining the top cyber threats concerning healthcare executives in today’s sophisticated cyber threat landscape.
H-ISAC surveyed cybersecurity, IT, and non-IT executives and found no significant differences between the disciplines when the experts were asked to rank the top five greatest cybersecurity concerns facing their organizations in 2021 and 2022.
Ransomware deployment was the top-rated concern, followed by phishing and spear-phishing, third-party breaches, data breaches, and insider threats.
The report noted that over the past decade, the healthcare industry has improved interconnectivity and data accessibility. However, those technological advancements came at the cost of security in many cases.
“The healthcare industry is especially at risk due to the value of sensitive personally identifiable information (PII) housed within systems, an increase on the Internet of Medical Things (IoMT), insufficient cybersecurity protection, the need for data transparency, and ineffective employee awareness training,” the report noted.
“Often, healthcare providers rely on legacy systems; outdated computer systems that are still in use and provide less protection and increased susceptibility for an attack.”
In addition, the COVID-19 pandemic heightened risk due to an increase in remote work and the value of vaccine research and data.
Meanwhile, nation-state threat actors are increasing their attacks in severity and scope. The report pointed to Chinese and Russian nation-state threat actors as top threats in 2021 and going into 2022.
“With many nations making efforts to move beyond the pandemic, we assess that nation-state activity against healthcare will increase, especially with changes in strategic priorities around the globe,” the report continued.
“Tensions between Russia and Ukraine, as well as Chinese activity regarding Taiwan, are examples of nation-states returning to standard geopolitical strategies, which will reflect in cyberspace.”
Researchers predicted that Ransomware-as-a-Service (RaaS) will continue to be used and will become the most popular operating model for cybercriminals. In addition, threat actors will continue to look for vulnerabilities in medical devices due to the fact that most are on legacy systems.
“Due to the huge growth in cybercrime and large ransomware payouts, sophisticated and organized criminal groups will be able to invest heavily into R&D and develop new ways to conduct automated and effective scams,” the report predicted.
“The criminals will leverage machine learning, artificial intelligence and deep fakes to perpetrate efficient and effective criminal campaigns.”
Additionally, H-ISAC and Booz Allen Hamilton predicted that supply chain attacks would continue to increase considering the successful breaches of Kaseya and SolarWinds.
To mitigate threats, H-ISAC recommended that healthcare organizations implement network segmentation, endpoint security, and access controls. Healthcare executives should also adopt a layered defense approach within their organizations and utilize data backups as well as prevention and detection technologies.
As seen in HealthITSecurity: https://healthitsecurity.com/news/h-isac-report-identifies-top-cyber-threats-concerning-healthcare-execs
FBI Warning – Cyber Actors Target U.S. Election Officials with Invoice-Themed Phishing Campaign
The Federal Bureau of Investigation (FBI) is warning U.S. election and other state and local governments about invoice-themed phishing emails that could be used to harvest officials’ login credentials. If successful, this activity may provide cyber actors with sustained, undetected access to a victim’s systems.
The FBI judges cyber actors will likely continue or increase their targeting of U.S. election officials with phishing campaigns in the lead-up to the 2022 U.S. midterm elections.
For more information about this threat and recommendations to reduce the risk of compromise, see the full alert from the FBI below.