Cyber News Roundup for August 26, 2024

/by

Start this week in the know on the latest in cyber news. We’ve got headlines from around the globe to keep you informed, from the Justice Department taking the Georgia Institute of Technology to court over cybersecurity breaches related to Pentagon contracts, amateur radio enthusiasts reeling from a million-dollar ransomware attack, and Chinese hackers exploiting a zero-day flaw in Cisco appliances. Additionally, Halliburton faces operational disruptions following a cyberattack, and the Kremlin deals with a contentious DDoS incident affecting multiple digital platforms.

Discover more about these incidents and other pressing cybersecurity challenges in today’s update.

 

The Justice Department is suing the Georgia Institute of Technology and an affiliated company for allegedly failing to meet required cybersecurity standards for Pentagon contracts

The Justice Department is suing the Georgia Institute of Technology and an affiliated company for allegedly failing to meet required cybersecurity standards for Pentagon contracts. The lawsuit, backed by the False Claims Act, purports that Georgia Tech’s Astrolavos Lab did not develop a proper system security plan as mandated by the Department of Defense, and falsely reported their cybersecurity assessment to the Pentagon. Despite implementing a plan in February 2020, the lab reportedly failed to cover all necessary devices. The whistleblower lawsuit, filed by two former Georgia Tech cybersecurity team members, alleges a lack of enforcement of cybersecurity regulations at the university. Georgia Tech disputes the claims, stating that the lawsuit misrepresents their commitment to innovation and integrity, and insists there was no breach or data leak involved. (Cyberscoop)

 

Ham radio enthusiasts pay a million dollar ransom

The ARRL (American Radio Relay League) is a national association for amateur radio enthusiasts in the United States. A letter to their members says that in early May 2024, ARRL’s network was compromised by threat actors (TAs) using dark web-purchased information. The attackers infiltrated both on-site and cloud-based systems, deploying ransomware across various devices, from desktops to servers. The highly coordinated attack took place on May 15, leading to significant disruption. Despite ARRL being a small non-profit, the attackers demanded a multi-million-dollar ransom. After tense negotiations, ARRL paid a $1 million ransom, largely covered by insurance. The organization quickly formed a crisis management team and involved the FBI, who categorized the attack as uniquely sophisticated. Most systems have been restored, with Logbook of The World (LoTW) back online within four days. ARRL is now simplifying its infrastructure and establishing an Information Technology Advisory Committee to guide future IT decisions. (ARRL)

 

Chinese threat actor exploited Cisco zero-day

Researchers at Sygnia warn that the China-aligned threat actor Velvet Ant exploited a zero-day vulnerability (CVE-2024-20399) affecting on-premises Cisco Switch appliances. The flaw, which was patched last month, “allows an attacker with valid administrator credentials to the Switch management console to escape the NX-OS command line interface (CLI) and execute arbitrary commands on the Linux underlying operating system.” Velvet Ant exploited the vulnerability to “deploy tailored malware, which runs on the underlying OS and is invisible to common security tools.” (Cisco)

 

Halliburton takes systems offline following cyberattack

The oil field services company informed regulators and the media on Friday about a recent cyberattack that “necessitated the shut-down of certain systems.” The attack happened on Wednesday and affected operations at its headquarters in Houston. According to the 8-K report submitted on Thursday to the SEC, the company said hackers “gained access to certain of its systems.” (The Record)

 

Kremlin complains of DDoS attack, digital experts not so sure

Disruptions that occurred on Wednesday for some Russian users of WhatsApp, Telegram, Skype, Discord, Twitch, Wikipedia, Steam and even PornHub, are being blamed by the Russian internet regulator Roskomnadzor on a DDoS incident targeting Russian telecom operators. Local digital experts disagree with this statement, arguing that it is impossible to organize a DDoS attack on all 2,000 Russian telecom operators simultaneously. Stanislav Shakirov, co-founder and technical director of the Russian digital rights organization Roskomsvoboda, suggested that the regulator “likely tried to block Telegram, which inadvertently impacted other services.” (The Record)

 

Windows Recall to reappear

Microsoft is deploying an updated version of its Recall feature, which had been initially announced this spring and immediately derided by industry analysts as keylogger or spyware. The idea behind Recall was to take snapshots of a user’s desktop every few seconds as tool for keeping track of things. It was removed from widespread Copilot+ PC release on June 13, but is now being deployed to testers in coming weeks. Microsoft has not fully clarified how the new version will differ but has said it will include “just in time” decryption and that Windows Insiders would need a Copilot+ PC. (The Register)

 

Two years later, Log4Shell still being exploited

This is according to researchers at Datadog Security Labs. “Cybercriminals are still finding targets for Log4Shell exploits that evade detection and plant malware scripts on unpatched corporate systems.” This is due to vulnerabilities that remain unpatched even though fixes have been made available. “Security experts have warned that eradicating the problem will be a long, laborious process because of software dependencies and so-called “transitive dependencies” that make patching very difficult.” Datadog for example has noted nation-state APT actors linked to China, Iran, North Korea and Turkey using obfuscated LDAP requests (that is an Active Directory protocol) to evade detection, leading to the execution of malicious scripts on compromised systems. (Security Week)

 

Mandiant uncovers a privilege escalation vulnerability in Microsoft Azure Kubernetes Services

A privilege escalation vulnerability in Microsoft Azure Kubernetes Services (AKS) could have allowed attackers to access sensitive information, such as service credentials used by the cluster, Mandiant reports. The issue affected AKS clusters using Azure CNI for network configuration and Azure for network policy. Attackers with command execution in a pod within the cluster could exploit this vulnerability to download cluster node configurations, extract TLS bootstrap tokens, and access all secrets in the cluster. The flaw could be exploited even without root privileges or hostNetwork enabled. Microsoft resolved the issue after being notified. Mandiant highlights the risk of Kubernetes clusters lacking proper configurations, as attackers could use this vulnerability to compromise the cluster, access resources, and even expose internal cloud services. The flaw also allowed attackers to use the TLS bootstrap token to gain broader access to cluster secrets. (SecurityWeek)

 

Configuration flaw may affect thousands of apps using AWS ALB

Miggo Research has discovered a critical configuration flaw potentially affecting up to 15,000 applications that use AWS Application Load Balancer (ALB) for authentication. The researchers explain, “First, the attacker creates their own ALB instance with authentication configured in their account. The attacker then uses this ALB to sign a token they fully control. Next, the attacker alters the ALB configuration and sets the issuer field to the victim’s expected issuer. AWS subsequently signs the attacker’s forged token with the victim’s issuer. Finally, the attacker uses this minted token against the victim’s application, bypassing both authentication and authorization.”

To mitigate this risk, Miggo says AWS customers should:

  1. “Verify that every application using the ALB authentication feature checks the token signer.
  2. “Restrict your targets to accept traffic only from your Application Load Balancer.”

AWS has updated its documentation to include this guidance, but it’s up to the customers to make the recommended changes. (miggo)

 

Feds tapping into encrypted messaging haul

According to a review of court records by 404 Media, US law enforcement agencies ramped up access to encrypted chat messages obtained as part of a trove of messages from European agencies from the phone company Sky back in 2021. Records show no indication US agencies have bulk access to this data, rather received from European partners for particular people under investigation. It’s unclear how authorities obtained this trove of messages, but Sky itself claimed someone created a fake version of the app and sold phones loaded with it on “unauthorized channels.” The cases profiled by 404 Media all involved prosecutions involving narcotics smuggling and distribution.  (404 Media)

 

Microchip Technology hit by cyberattack

The US chipmaker reported to the Securities and Exchange Commission that “potentially suspicious activity” over the weekend inhibited the use of “certain servers and some business operations.” As of this recording, it says it’s still operating “at less than normal levels,” with order volume impacted.  Its response to the incident sounds bog-standard: isolating impacted systems, shutting down services, and calling in third-party experts to help investigate. No other specific on who orchestrated the attack, but we’ll follow up as more details come to light. (The Record)

 

Poisoning LLMs to create insecure code

At the USENIX Security Symposium, a team of academic researchers presented details CodeBreaker, a set of techniques to poison large language model training sets to make them more likely to suggest vulnerable code. This saw the researchers systematically create code samples that don’t register as malicious with static analysis tools. This builds on previous research that used malicious code in comments and split workloads to introduce vulnerabilities to the training set. Of course, this kind of poisoning isn’t new. Research has previously found malicious code popping up in StackOverflow tutorials. And given the lack of quality control when ingesting code scraped from the internet, vulnerable code suggestions are already a reality in these training sets. (Dark Reading)

 

Have questions? Reach out to RedSeal today to chat with one of our cybersecurity experts.

Embracing Continuous Threat Exposure Management (CTEM)

/by

With new vulnerabilities emerging daily and cyber threats becoming more sophisticated, organizations must evolve their cybersecurity strategies to protect their digital assets. One such strategy endorsed by a leading industry analyst firm is gaining traction with forward-thinking CISOs: Continuous Threat Exposure Management (CTEM). In this blog, we’ll explore the basics of CTEM, its benefits, and how it fits into modern cybersecurity strategies. 

What is Continuous Threat Exposure Management (CTEM)? 

Continuous Threat Exposure Management (CTEM) is a comprehensive framework or process designed to provide ongoing visibility and management of cybersecurity threats and vulnerabilities, putting greater priority on those that have greater business impact. No network will ever be perfect, and you can’t prevent or fix every single issue. CTEM emphasizes practical scoping, proactive threat discovery, continuous risk assessment and validation, and cross-team collaboration—to reduce both existing and future exposures. 

It’s important to note that with CTEM, “threat exposure” is not limited to vulnerabilities or external threats. An exposure is anything that puts an organization’s assets at risk. It could be an outdated password or firewall rule, a misconfigured router or gateway, an unknown device, a known vulnerability, or an unintended connection. It could be in on-premises, private cloud, public cloud, OT, or IoT environments. The sheer type and volume of exposures in today’s complex, hybrid networks are too many for overwhelmed teams to manage.   

A Fundamental Shift in Cybersecurity

Traditional cybersecurity strategies focus on event-based vulnerability management and periodic assessments. However, this type of episodic, reactive approach can leave significant gaps in protection, as threats evolve faster than many organizations can respond. 

CTEM represents a fundamental shift away from managing vulnerabilities based solely on severity or Common Vulnerability Scoring System (CVSS) scores. Instead of simply identifying and patching vulnerabilities, it takes into consideration the entire context of the exposure, including its exploitability, blast radius, and verified business impact to prioritize remediation efforts within the context of the business. As the term implies, Continuous Threat Exposure Management is a more continuous, holistic approach that encompasses dynamic threat assessment and response. 

The Five Stages of CTEM

Continuous Threat Exposure Management is a structured approach with five key stages, each critical to managing and mitigating cybersecurity threats effectively.

Stage 1 – Scoping (of business risks and relevant attack surfaces): This stage involves identifying the mission-critical priorities for the business, understanding the systems and processes involved, and determining risk owners and appetites. Scopes don’t limit the CTEM program’s reach but rather provide a means of organizing, reporting, and communicating exposure management work and results to senior leadership and business teams. Understanding the organization’s full attack surface, as well as that of individual scopes, helps put the broader concept of threat exposure management into meaningful business context. 

Stage 2 – Discovery (of all assets and threat exposures): This stage involves identifying all assets and connectivity (hidden and visible) and continuously assessing them for vulnerabilities and other exposures (known, unknown, and emerging). Running discovery against scopes outlined in the previous stage helps increase awareness of risks among relevant business teams and makes exposure management successes more impactful in later stages.  

Stage 3 – Prioritization (of exposure management work): In this stage, threat exposures of all types are prioritized, considering internal, external, business, and technical factors. Prioritization must go beyond CVSS scores and severity to include concepts of visibility, exploitability, asset criticality, and potential impact. Again, prioritization within and across defined scopes helps teams focus on high-business-value issues. 

Stage 4 – Validation (of exposure—and exposure management—viability/impact): In this stage, thinking like an attacker and verifying suggested remediation are key. Validating the exploitability of an exposure through virtual pentesting, red teaming, and attack path analysis—including the blast radius and further lateral movement—helps refine prioritization. Validating that proposed changes are feasible and won’t conflict with existing policies helps build the business case for remediation and collaboration. 

Stage 5 – Mobilization (of teams and stakeholders): While automated remediation makes sense for certain types of black-and-white issues, there is a lot of gray area in which stakeholders across teams must make decisions about how to address an exposure, whether that exposure is fixable or not. In this stage, communication and collaboration are key to documenting and operationalizing exposure management work for the (present and future) benefit of the entire organization. 

How RedSeal Supports the CTEM Process 

While the CTEM term might be relatively new or unfamiliar, the framework’s core principles have been at the heart of RedSeal’s approach for two decades. Since 2004, RedSeal has been pioneering network exposure management to close gaps in cybersecurity defenses on premises and in the cloud. Our hybrid network modeling technology is key to helping our customers know their networks better than their adversaries do.   

RedSeal integrates with hundreds of networking and security tools to simplify and accelerate the CTEM process, delivering a unique combination of capabilities from a single platform: 

  1. Scoping: RedSeal models the entire connected network across public cloud, private cloud, and on-prem environments; then, it maps resources into physical/logical/custom topology groups to help organizations understand and organize their attack surface. This visualization helps stakeholders easily identify business-critical systems and assets and define scopes within their business context.
  2. Discovery: RedSeal continuously identifies all assets and exposures, including those due to hidden assets, misconfigurations, unintended connections (direct and indirect), firewall rules, and policy violations, as well as known and unknown vulnerabilities. It also runs automated attack path analysis and compliance checks against external regulations/standards, internal policies, and best practices to keep exposure assessments current.
  3. Prioritization: RedSeal considers a range of internal, external, business, and technical factors to assess risk and prioritize all exposures. Risk scores are calculated based on security controls, asset criticality, and vulnerability data—combined with unmatched network context, which includes the visibility, exploitability, exploitation potential, and potential impact of the exposure. Exposures with greater business impact take higher priority.
  4. Validation: RedSeal runs virtual penetration tests to confirm the viability of exposure exploitation, analyze lateral movement (blast radius), and measure the impact of exposures. It validates vulnerability scans and security controls such as network segmentation and device configurations. Simulating what-if scenarios, the platform minimizes unforeseen complications when making changes to live environments.
  5. Mobilization: Unlike any other platform on the market, RedSeal serves as the single source of truth for teams collaborating on CTEM. It delivers detailed remediation guidance, including an asset’s precise logical and physical location as well as access paths for containing unpatchable exposures. It also sends alerts directly to stakeholders when policy violations are detected and provides an executive-level dashboard and score to measure the CTEM program over time.  

Overall, the RedSeal network exposure management platform embodies the proactive, continuous cybersecurity model that CTEM advocates—and includes a comprehensive set of technical capabilities to accelerate the process. 

Accelerate CTEM with RedSeal 

Ultimately, Continuous Threat Exposure Management is about proactively mitigating threats and reducing risk. CTEM is not a standalone solution or any single tool but rather a comprehensive, coordinated process to enhance an organization’s overall protection and security posture. With the right level of visibility and collaboration among teams, a CTEM strategy can also inform and support more reactive and longer-term initiatives, such as incident response and digital resilience programs. 

By leveraging the capabilities of the RedSeal platform, organizations can significantly enhance their CTEM process, ensuring they stay ahead of cyber threats, mitigate risks efficiently, and safeguard their digital assets in an increasingly complex cyber environment. Contact us for a demo today. 

 

Updated Monday, August 26, 2024

The Critical Role of Asset Inventory in Modern Network Security

/by

Accurate asset inventory is not just a good practice—it’s a necessity. With increasing frequency, news headlines reveal the fallout from data breaches, ransomware attacks, and other cyber threats that exploit gaps in network visibility. We’ve found that 76% of organizations believe they have an accurate understanding of their network infrastructure, however through RedSeal deployment, 100% of the time we find network devices, subnets, or paths that aren’t on a model. Security professionals know they need to be aware of assets within their environment, but how?

Bringing all assets and connections into a cohesive interactive model

Proper asset inventory is the backbone of effective network security. It ensures that every device, endpoint, and resource within your network is documented, tracked, and assessed for risk. RedSeal provides meticulous documentation of a network’s assets, while keeping the information current and complete. Without a comprehensive and up-to-date inventory, you risk vulnerabilities that can be exploited by attackers.

What can you do with RedSeal?

  • Comprehensive discovery: RedSeal actively discovers and inventories all Layer 2 and Layer 3 network devices and endpoints, covering both IPv4 and IPv6 connected assets. This broad scope ensures that no device is left unaccounted for.
  • Cloud and SDN integration: In a world where cloud platforms and Software-Defined Networks (SDNs) are prevalent, RedSeal extends its reach to discover and inventory resources across multiple cloud environments and SDNs.
  • Business value assignment: RedSeal allows you to assign business value to assets, which can be done either automatically or manually. This feature is crucial for prioritizing risk analysis and understanding the potential impact of asset-related vulnerabilities.
  • Stale device identification: RedSeal helps identify stale devices, hosts, and credentials that may pose security risks, ensuring that your network remains clean and secure.
  • Data consolidation: Import, consolidate, deconflict, and store host data from various sources, including name, location, OS, access, installed patches, and applications. This consolidated view simplifies management and improves accuracy.
  • Missing device detection: RedSeal detects potentially missing devices and hosts not reflected in the current network model, helping you maintain an accurate and complete inventory.

Recent insights

Recent reports highlight how companies have faced severe security breaches due to incomplete asset inventories. For instance, MOVEit cyberattacks, one of the largest data thefts of 2023, underscores the urgent need for robust asset management practices, as more than 2,000 organizations including New York City’s public school system, and payroll solutions used by British Airways and BBC saw themselves at the center of the widespread attack.

The RedSeal advantage

In an era where cyber threats are becoming more sophisticated, maintaining an accurate and comprehensive asset inventory is non-negotiable. From automatically discovering devices and creating a network inventory to continuously monitoring of the completeness and health of your inventory and with ability to accelerate capacity planning, disaster recovery, and new security design, RedSeal provides the tools necessary to ensure your network model reflects the full extent of your assets, helping you stay secure and resilient in a challenging landscape. Reach out to RedSeal or schedule a demo today to learn how to bolster your cybersecurity efforts and make the strategic move that promises long-term benefits and peace of mind.

Cyber News Roundup for August 16, 2024

/by

This week, CISA issues warnings about Cisco device vulnerabilities, while APT42 targets U.S. presidential campaigns. A Tennessee man is arrested for aiding North Korean IT schemes, and a severe CPU flaw from AMD raises alarms. Plus, GPS spoofing hacks are grounding commercial airliners, researchers uncover flaws in Georgia’s voter portal, and ransomware operators exploit ESXi hypervisors for mass encryption. We’ve rounded up the highlights from this week’s headlines on critical issues shaping the digital security landscape.

 

CISA warns of actively exploited Cisco devices

CISA has warned organizations about threat actors exploiting improperly configured Cisco devices, specifically targeting the legacy Cisco Smart Install (SMI) feature. Malicious hackers are acquiring system configuration files, which can lead to network compromises. CISA noted the continued use of weak password types on Cisco devices, making them vulnerable to password cracking attacks. Additionally, Cisco disclosed critical vulnerabilities in their end-of-life Small Business SPA IP phones, which can be remotely exploited but will not receive patches. (SecurityWeek)

 

Iran’s APT42 targets US presidential campaigns

Google’s Threat Analysis Group (TAG) has published a report on the Iran-aligned threat actor APT42’s targeting of US presidential campaigns. Google confirms that APT42 has targeted both the Trump and Biden-Harris campaigns with spearphishing attacks: “In May and June, APT42 targets included the personal email accounts of roughly a dozen individuals affiliated with President Biden and with former President Trump, including current and former officials in the U.S. government and individuals associated with the respective campaigns. We blocked numerous APT42 attempts to log in to the personal email accounts of targeted individuals.” TAG adds that the group “successfully gained access to the personal Gmail account of a high-profile political consultant.” The researchers note that APT42 has also ramped up its phishing attacks against users in Israel, targeting “people with connections to the Israeli military and defense sector, as well as diplomats, academics, and NGOs.” (Google)

 

Tennessee man arrested for alleged participation in North Korean employment scheme

The US Justice Department has arrested a man in Nashville, Tennessee, for allegedly helping North Korean IT workers get remote jobs at companies in the US and the UK. Matthew Isaac Knoot is accused of running a “laptop farm” to make the North Korean workers appear as if they were located in the US. The Justice Department stated, “The victim companies shipped laptops addressed to ‘Andrew M.’ to Knoot’s residences. Following receipt of the laptops, and without authorization, Knoot logged on to the laptops, downloaded and installed unauthorized remote desktop applications, and accessed the victim companies’ networks, causing damage tqqq o the computers. The remote desktop applications enabled the North Korean IT workers to work from locations in China, while appearing to the victim companies that ‘Andrew M.’ was working from Knoot’s residences in Nashville. For his participation in the scheme, Knoot was paid a monthly fee for his services by a foreign-based facilitator who went by the name Yang Di.”

The Justice Department says North Korea’s remote IT workers “have been known individually earn up to $300,000 annually, generating hundreds of millions of dollars collectively each year, on behalf of designated entities, such as the North Korean Ministry of Defense and others directly involved in the DPRK’s UN-prohibited WMD programs.” (DOJ)

 

Researchers find flaws in Georgia voter portal

Security researcher Jason Parker alerted ProPublica and Atlanta News First of a flaw in a portal run by the Georgia Secretary of State’s Office. This would allow someone to submit a voter cancellation request for anyone in the state. Parker said they attempted to contact the Secretary of State’s Office but did not receive a response. The portal launched on July 29th and already garnered attention for exposing driver’s license numbers.  Parker found that by inspecting the portal’s source HTML, anyone could delete code requiring them to submit a driver’s license number and proceed to request a voter cancellation. The state eventually patched the issues, but security researcher Zach Edwards told ProPublica “It’s shocking to have one of these bugs occur on a serious website.” (ProPublica)

 

AMD SinkClose flaw helps install nearly undetectable malware

A warning from chip maker AMD about a high-severity CPU vulnerability which has been named SinkClose. The vulnerability affects multiple generations of its EPYC, Ryzen, and Threadripper processors, and allows attackers with Kernel-level (Ring 0) privileges to gain Ring -2 privileges and install malware that becomes nearly undetectable. For context, “Ring -2 is one of the highest privilege levels on a computer, running above Ring -1 (used for hypervisors and CPU virtualization) and Ring 0, which is the privilege level used by an operating system’s Kernel.” SinkClose has apparently passed undetected for almost 20 years.(BleepingComputer)

 

Ransomware operators exploit ESXi hypervisor vulnerability for mass encryption

Microsoft has also uncovered a vulnerability in ESXi hypervisors which it says is being exploited by “several ransomware operators to obtain full administrative permissions on domain-joined ESXi hypervisors.” The vulnerability “involves a domain group whose members are granted full administrative access to the ESXi hypervisor by default without proper validation.” Microsoft has disclosed the findings to VMware, and recommends that administrators apply the updates released by VMware. (Microsoft)

 

GPS spoofers hack clocks on commercial airliners

The relatively recent phenomenon of GPS spoofing involves hackers modifying GPS signals used by commercial airlines to navigate. The technique is also used to disorient drones and missiles in conflict zones. But now, according to Ken Munro, founder of British cybersecurity firm Pen Test Partners, and speaking recently at DEF CON, the technology is being used to change the times and dates on the clocks in aircraft cockpits, sometimes by years, Causing the plane to lose access to its digitally-encrypted communication systems, and requiring them to be grounded for weeks while engineers manually reset their onboard systems. (Reuters)

 

At Defcon, researchers reveal significant vulnerabilities in Google’s Quick Share

At Defcon 32, researchers Or Yair and Shmuel Cohen from SafeBreach revealed significant vulnerabilities in Google’s Quick Share, a peer-to-peer file transfer utility for Android, Windows, and Chrome OS. Quick Share uses various protocols like Bluetooth and Wi-Fi Direct, but these were not originally designed for file transfers. The researchers identified ten vulnerabilities, including a critical Remote Code Execution (RCE) flaw on Windows systems, dubbed QuickShell. This RCE exploit combines five of the vulnerabilities, allowing attackers to bypass security controls and take full control of target devices. The flaws also enable attackers to force file downloads and hijack Wi-Fi connections. Google has acknowledged the seriousness of these issues, assigning CVEs to two of the vulnerabilities. (Hack Read)

 

U.S. operation of “laptop farm” for North Korea shutdown

Tennessee resident Matthew Isaac Knoot has been arrested for allegedly running a ‘laptop farm’ to help North Korean IT workers secure remote jobs with American companies. Here’s how the scheme worked: Knoot would steal the identities of U.S. citizens and pose as U.S.-based IT professionals. Once hired, the company would send the work laptop to Knoot’s home, which he then gave the North Koreans access to, allowing them to log in remotely. If convicted, Knoot could face up to 20 years in prison, including a mandatory minimum of two years for aggravated identity theft. (Security Week)

 

Millions on the line as AI Teams advance in security challenge

Ninety teams competed at DEF CON over the weekend in the Artificial Intelligence Cyber Challenge hosted by the U.S. government’s Defense Advanced Research Projects Agency (DARPA) to develop autonomous tools that can find and fix vulnerabilities in open-source software. Twenty-two unique vulnerabilities were discovered in major open-source programs like the Linux kernel, with 15 automatically patched.  The seven finalists are now tasked with building out their AI systems before the final competition at the 2025 DEF CON, with nearly $30 million up for grabs in prize money. (CyberScoop)

 

South Korean government says North Korean hackers stole tank and spy plane information

The South Korean government says North Korean hackers stole sensitive information on South Korea’s tanks and spy planes, BleepingComputer reports. The spy plane data was reportedly stolen from a South Korean defense contractor that produces operating manuals for military equipment. BleepingComputer cites local media reports as saying that “the leakage of the K2 tank data occurred when engineers working on one of the tank’s part makers moved to a competing company, taking along with them in external storage drives design blueprints, development reports, and details about the tank’s overpressure system.” (People Power Party, Bleepingcomputer)

 

NIST finalizes post-quantum encryption standards 

On Tuesday, the National Institute of Standards and Technology (NIST) published three new encryption algorithms to bolster global cybersecurity efforts against future attacks using quantum technologies. The new standards are designed for general encryption and digital signatures. The algorithms, called FIPS 203, FIPS 204, and FIPS 205, are published to NIST’s post-quantum cryptography (PQC) project website. Head of the PQC project, Dustin Moody, urges security practitioners to immediately begin using the new algorithms to keep their data secure. (Dark Reading)

 

Orion loses $60 million in BEC scam

Luxembourg-based company, Orion, who is a leading supplier of carbon black, a material used to make tires, ink, batteries, and plastics was tricked into making several wire transfers through a Business Email Compromise (BEC) attack. According to documents filed with the Securities and Exchange Commission (SEC), a non-executive employee “was the target of a criminal scheme that resulted in multiple fraudulently induced outbound wire transfers to accounts controlled by unknown third parties.” Orion expects to record “a one-time pre-tax charge of approximately $60 million.” if the funds are not recovered. (The Record)

 

Azure AI health bot infected with critical vulnerabilities

Multiple privilege escalation issues in Microsoft Azure’s cloud-based Health Bot service exposed the platform to server-side request forgery (SSRF) and access to cross-tenant resources. The Azure AI Health Bot Service enables healthcare organizations to build their own virtual health assistants to interact with patients and manage administrative workloads. Depending on the nature of the integration, the chatbots could potentially have privileged access to extremely sensitive health information. Researchers at Tenable, who identified the issues said, though Microsoft quickly patched the vulns, they showcase inherent concerns about chatbot risks. (Dark Reading)

 

Palo Alto Networks patches several vulnerabilities

Palo Alto Networks has issued patches for several vulnerabilities, including the high-severity CVE-2024-5914, which affects the Cortex XSOAR product. This flaw allows unauthenticated attackers to execute commands within certain configurations. Patches are available starting with version 1.12.33. Additionally, updates were released for Prisma Access Browser, addressing over 30 vulnerabilities in the Chromium-based browser. Two medium-severity flaws were also patched, impacting PAN-OS and the GlobalProtect app. Palo Alto Networks is not aware of any active exploitation of these vulnerabilities. (SecurityWeek)

 

Microsoft patches zero-click RCE vulnerability

Microsoft has issued a patch for a zero-click remote code execution vulnerability (CVE-2024-38063) that affects all Windows machines using IPv6, which is enabled by default, BleepingComputer reports. Microsoft says “[a]n unauthenticated attacker could repeatedly send IPv6 packets, that include specially crafted packets, to a Windows machine which could enable remote code execution.” The vulnerability was discovered by a researcher at Kunlun Lab, who noted that the bug is triggered before the packet reaches the Windows firewall. There’s no evidence of exploitation so far, but Microsoft has given the flaw its “Exploitation more likely” label. Users are urged to update Windows as soon as possible or disable IPv6 until patches can be applied. (Bleepingcomputer)

 

Massive cyberattack hits Central Bank of Iran and other Iranian banks

News agency Iran International has reported a massive cyberattack that has disrupted the operations of the Central Bank of Iran (CBI) along with several other banks in the country, disabling the computer systems of many banks in the country. As reported in Security Affairs, “this incident coincides with intensified international scrutiny of Iran’s operations in the Middle East,” amid announcement from Tehran regarding attacks on Israel as well as its widely reported attempts to influence the upcoming U.S. Presidential election. According to the news agency, this is one of the largest cyberattacks on Iran’s state infrastructure to date. (Security Affairs)

 

Kim Dotcom to be extradited from New Zealand

After a 12-year fight, the infamous Kit Dotcom is being extradited to the U.S. to face criminal charges relating to the operations of his now closed file-sharing website Megaupload. Dotcom, whose real name is Kim Schmitz, holds Finnish and German nationalities and has been living in New Zealand, and has faced numerous charges since the mid-1990s for computer fraud, data espionage, and many other nefarious activities. U.S. authorities say, “Dotcom and three other Megaupload executives cost film studios and record companies more than $500 million by encouraging paying users to store and share copyrighted material, which generated more than $175 million in revenue for the website.” (Reuters)

 

Have questions? Reach out to RedSeal today to chat with one of our cybersecurity experts.

Analyst Report: Using RedSeal Hybrid Network Security and Compliance in Healthcare

/by

The cyber threat landscape and regulatory compliance requirements in healthcare continue to grow. This report from the analysts at TAG Infosphere offers an in-depth look at how healthcare organizations can minimize complexity, enhance security controls, and reduce risk in their hybrid networks.

Inside, you’ll learn:

  • 10 questions to ask when evaluating commercial platforms for use in a healthcare network—and how RedSeal scores
  • What healthcare cyber practitioners think about using network models to make security decisions
  • How RedSeal works to continuously validate inventory, configurations, and segmentation and provide a quantitative measurement of enterprise risk

Click here to download the full report and schedule a demo today.

Cyber News Roundup for August 5, 2024

/by

Start your week in the know.

Last week’s cyber headlines bring news from Delta Air Lines CEO Ed Bastian stating the recent CrowdStrike outage cost the company $500 million in damages plus CrowdStrike is also being sued by shareholders over the outage. In healthcare news—OneBlood, a major blood donation nonprofit, sustained a ransomware attack disrupting its operations, and has asked hospitals to activate critical blood shortage protocols. Additionally, researchers in the Netherlands report a significant increase in cyberattacks on the shipping industry, with 64 incidents in 2023 compared to just three in 2013. HealthEquity is notifying 4.3 million people of a data breach that compromised personal and health information due to a third-party vendor. A phishing campaign dubbed “EchoSpoofing” exploited weak permissions in Proofpoint’s email protection service, sending millions of fake emails impersonating Fortune 100 companies.

All this and more on this week’s Cyber News Roundup.

 

South Korea investigates reported military intelligence leak

South Korea is investigating a leak that reportedly exposed the identities of its military intelligence agents, the New York Times reports. South Korean media reported that the leak, which includes the identities of agents operating under civilian cover, may have reached North Korea. NK News cites sources as saying the leak is believed to have occurred “through a personal laptop belonging to a military-civilian public servant in the DIC’s overseas operations department.” The owner of the laptop claims the device was hacked, in which case they would still be guilty of storing classified information on a personal device. Seoul’s defense ministry said in a statement, “[T]he matter is currently under investigation by military authorities, so we cannot provide detailed explanations. Based on the investigation results, the military will handle the matter strictly according to the law and regulations.” (NYT)

 

Cyberattacks in the shipping industry

Researchers at the Netherlands’ NHL Stenden University of Applied Sciences warn that the shipping industry is facing a significant increase in cyberattacks, the Financial Times reports. The sector saw sixty-four attacks in 2023, compared to just three a decade earlier in 2013. More than 80 percent of cyberattacks since 2001 were tied to a known threat actor tied to Russia, China, North Korea, or Iran. (FT)

 

4.3 million impacted by HealthEquity data breach

One of the largest HSA providers in the U.S., HealthEquity, is in the process of notifying 4.3 million people that their personal and health information was compromised. The company disclosed that the breach was attributed to a third-party vendor and that threat actors stole PII, including names, social security numbers, and payment information. While HealthEquity did not name the compromised vendor, those impacted should expect to be notified early next month. (Security Week), (Bleeping Computer)

 

Proofpoint exploit allows for millions of fake emails 

This phishing campaign was reeling in the big boys. Dubbed “EchoSpoofing,” this massive phishing campaign exploited now-fixed weak permissions in Proofpoint’s email protection service. The emails impersonated Fortune 100 companies like Disney, Nike, IBM, and Coke, with an average of 3 million fake emails sent daily. It wasn’t easy deciphering these fake emails; they included properly configured Sender Policy Framework and DomainKeys Identified Mail signatures to make the emails look authentic. The sec urity gap was discovered in May and has since been fixed, though Bleeping Computer reports the campaign reached a peak of 14 million emails in early June. (Bleeping Computer)

 

PatchNow: CISA adds two ServiceNow critical RCE bugs to catalog

A threat actor has claimed to have harvested email addresses and associated hashes from over 105 ServiceNow databases by exploiting two critical vulnerabilities,  (CVE-2024-4879 and CVE-2024-5217). These vulnerabilities, with CVSS scores of 9.3 and 9.2, respectively, have been actively exploited and are now being sold for $5,000. The US Cybersecurity and Infrastructure Security Agency (CISA) has added these flaws to its known exploited vulnerabilities catalog, mandating federal agencies patch it by August 19. (Dark Reading)

 

WhatsApp for Windows allows Python to run wild

A security flaw in the latest version of WhatsApp for Windows allows execution of Python and PHP attachments without warning when opened, Bleeping Computer reports.  This primarily affects users with Python already installed, like developers and researchers. The issue is similar to a previous Telegram vulnerability. Despite blocking several risky file types, WhatsApp does not block Python scripts, which can be executed directly from the app. Security researcher Saumyajeet Das discovered this vulnerability and reported it to Meta, but the issue was dismissed as non-applicable. Das criticized this decision, suggesting that simply adding the relevant file extensions to WhatsApp’s blocklist could prevent exploitation. WhatsApp advises users not to open files from unknown sources and has no current plans to fix the issue, leaving users vulnerable to potential attacks. (Bleepingcomputer)

 

Dark Angels receives record-breaking ransom payment

A new report from Zscaler ThreatLabz has revealed that an unnamed company paid a record-breaking $75 million ransom payment to the Dark Angels ransomware gang. Zscaler did share that the company was in the Fortune 50 and that the attack occurred in early 2024. The record-breaking ransom payment was further confirmed on X by crypto intel company, Chainalysis. One Fortune 50 company that suffered a cyberattack back in February is pharmaceutical giant Cencora, ranked #10 on the list. Cencora has not confirmed it made this particular payment. DarkAngels launched in May 2022 and is known for “big game hunting” and using Windows and VMware ESXi ransomware encryptors. Previously, the largest known ransom payment was $40 million shelled out back in 2021 by insurance giant, CNA. (Bleeping Computer)

 

Microsoft services go down… again

On Tuesday, Microsoft once again found itself grappling with service outages, this time seemingly unrelated to Crowdstrike. These issues appear to have affected Microsoft 365 admin center, Intune, Entra, Power Platform, and Power BI in addition to reports of lagging authentication requests taking up to 10 minutes to complete. The company acknowledged the issues and said the outage was caused by an “unexpected usage spike” that “resulted in Azure Front Door (AFD) and Azure Content Delivery Network (CDN) components performing below acceptable thresholds.” Security expert Kevin Beaumont speculated that the issues may have been caused by a botnet-generated, distributed denial of service (DDoS) attack. (ZDNet and Bleeping Computer)

 

CISA warns of actively exploited ServiceNow vulnerabilities

CISA has also added two critical ServiceNow vulnerabilities (CVE-2024-4879 and CVE-2024-5217) to its KEV Catalog, requiring FCEB agencies to patch the flaws by August 19th, the Record reports. ServiceNow issued patches for the vulnerabilities in May and June, and threat actors have been attempting to exploit them since a proof-of-concept exploit was released earlier this month. According to Resecurity, the vulnerabilities “enable unauthenticated remote attackers to execute arbitrary code within the Now Platform, potentially leading to compromise, data theft, and disruption of business operations.” (The Record)

 

Ransomware gangs are exploiting VMware ESXi flaws

Microsoft has warned that several ransomware actors are exploiting a vulnerability (CVE-2024-37085) in ESXi hypervisors that can be used to obtain full administrative permissions. VMware has issued patches for the flaw. Microsoft stated, “Microsoft security researchers identified a new post-compromise technique utilized by ransomware operators like Storm-0506, Storm-1175, Octo Tempest, and Manatee Tempest in numerous attacks. In several cases, the use of this technique has led to Akira and Black Basta ransomware deployments. The technique includes running the following commands, which results in the creation of a group named ‘ESX Admins’ in the domain and adding a user to it.” The US Cybersecurity and Infrastructure Security Agency (CISA) has added the vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, ordering Federal Civilian Executive Branch (FCEB) agencies to apply patches by August 20th. (Broadcom)

 

Delta dishes on CrowdStrike damages

Just yesterday we mentioned that Delta Air Lines began lawyering up for legal action against CrowdStrike. In an update, Delta CEO Ed Bastian laid out the stakes on CNBC for any potential legal action, saying it cost the company $500 million in damages. This accounts for the lost revenue from the outage as well as compensation and hotels for stranded passengers. Delta canceled over 5,000 flights over a five-day period due to the outage, more than all cancelations in 2019. The outage also sparked an investigation by the US Department of Transportation. Bastian said the company has “no choice” but to seek damages from CrowdStrike. (CNBC)

 

CrowdStrike sued by shareholders over outage

CrowdStrike’s shareholders have filed a lawsuit against the company over last week’s outage, accusing CrowdStrike of making “false and misleading” statements about its software testing, the BBC reports. CrowdStrike has denied the allegations and says it will defend itself. Delta Air Lines is also planning to sue CrowdStrike for compensation, CNBC reports. Delta estimates that the outage cost the airline up to $500 million after 7,000 flights were canceled. The company has hired high-profile attorney David Boies to handle the suit. (BBC, CNBC)

 

Ransomware attack disrupts US blood donation nonprofit

OneBlood, a major nonprofit blood donation organization operating in the southeastern US, has sustained a ransomware attack that’s disrupting its ability to provide blood to hospitals, the Record reports. Susan Forbes, OneBlood’s senior vice president of corporate communications, said in a statement, “We have implemented manual processes and procedures to remain operational. Manual processes take significantly longer to perform and impacts inventory availability. In an effort to further manage the blood supply we have asked the more than 250 hospitals we serve to activate their critical blood shortage protocols and to remain in that status for the time being.”

OneBlood added, “To help augment their supply the national blood community is rallying to assist OneBlood and the hospitals and patients it serves. Blood centers across the country are sending blood and platelets to OneBlood, and the AABB Disaster Task Force is coordinating national resources to assist with additional blood products being sent to OneBlood. All blood types are needed, but there is an urgent need for O Positive, O Negative and Platelet donations.” According to CBS News, OneBlood serves 355 hospitals across Florida, Georgia, and the Carolinas. (The Record, CBS)

 

Have questions? Reach out to RedSeal today to chat with one of our cybersecurity experts.

Cyber News Roundup for July 29, 2024

/by

In this week’s cybersecurity news, the U.S. government is probing CrowdStrike following a massive outage that disrupted critical services and led to numerous Delta Air Lines flight cancellations. In Ukraine, Russian-linked malware caused a heating outage in Lviv. Security awareness and compliance training and testing organization, KnowBe4, discovered a North Korean operative posing as an IT worker, while Check Point identified a malicious network on GitHub. Meta cracked down on Nigerian scammers targeting U.S. victims. U.S. intelligence agencies warned of foreign investment risks, and Israel intervened in a lawsuit to protect state secrets involving NSO Group.

 

U.S. government looking for answers amidst CrowdStrike aftermath

In the wake of the defective CrowdStrike update that disrupted airlines, banks, hospitals and other critical services last Friday, U.S. House leaders are calling on CrowdStrike CEO George Kurtz to testify to Congress about the company’s role in the widespread outage. Republicans who lead the House Homeland Security committee said Monday, “While we appreciate CrowdStrike’s response and coordination with stakeholders, we cannot ignore the magnitude of this incident, which some have claimed is the largest IT outage in history.”

Meanwhile on Tuesday the U.S. Transportation Department said it was opening an investigation into Delta Air Lines after the carrier canceled more than 5,000 flights since Friday due to the CrowdStrike incident. While other carriers have been able to resume normal operations, Delta canceled 30% or more of its flights daily through Monday and axed or delayed over 1,000 more flights as of mid-day on Tuesday. Transportation secretary, Pete Buttigieg, said the department “will leverage the full extent” of its investigative and enforcement power “to ensure the rights of Delta’s passengers are upheld.” (SecurityWeek and The Guardian)

 

Hackers shut down heat in Ukrainian city

Ukraine’s Cyber Security Situation Center (CSSC) announced that Windows-based malware, dubbed FrostyGoop, has been linked to a heating outage in Lviv, Ukraine back in January. The Russian-linked malware was used to attack a municipal district energy company and cut off heat to over 600 apartment buildings for two days during sub-zero temperatures. FrostyGoop is designed to target Modbus TCP communications, a standard industrial control systems (ICS) protocol. An investigation showed that attackers likely gained access to the network nine months earlier by exploiting a vulnerability in an Internet-exposed Mikrotik router. From there, attackers were able to access four management servers and the district’s heating system controllers which were not properly segmented. (Bleeping Computer and TechCrunch)

 

KnowBe4 hires fake North Korean IT worker

On Tuesday, security awareness training firm KnowBe4 said a North Korean operative posing as a software engineer slipped past its hiring background checks. The new hire spent the first 25 minutes on the job using their new Mac to download malware, manipulate session history files, and execute unauthorized software on company systems. KnowBe4 said its security team quickly detected the suspicious activity and contained the infected workstation. The worker’s identity was revealed as an AI deepfake and is one of hundreds of cases of North Korean nation-state operatives posing as an IT worker to infiltrate US companies. (SecurityWeek)

 

Stargazer Goblin hosts malicious code repositories on GitHub

A secret network of around 3,000 “ghost” accounts on GitHub has been manipulating the platform to promote malware and phishing links, as revealed by research from cybersecurity firm Check Point. Operating since at least June last year, a cybercriminal group, dubbed “Stargazer Goblin” by Check Point, has been hosting malicious code repositories on GitHub, the world’s largest open-source code site. Antonis Terefos, a malware reverse engineer at Check Point, discovered that these fake accounts “star,” “fork,” and “watch” malicious repositories to make them appear popular and legitimate. This tactic leverages GitHub’s community tools to boost the visibility and credibility of harmful pages. The network’s activities are coordinated through a cybercrime-linked Telegram channel and criminal marketplaces.

The “Stargazers Ghost Network” spreads malicious repositories offering fake downloads for social media, gaming, and cryptocurrency tools, targeting Windows users. They claim to provide tools like VPNs or licensed software but instead deliver malware The operator behind this network charges other hackers to distribute their malicious content, a service Check Point terms “distribution as a service.” GitHub has responded by disabling user accounts violating their policies against supporting unlawful activities. With over 100 million users and 420 million repositories, GitHub continues to face challenges from cybercriminals exploiting its platform for malicious purposes. (Wired)

 

Meta cracks down on the Nigerian Yahoo Boys

Meta has banned 63,000 accounts linked to Nigerian cybercriminals known as the Yahoo Boys, targeting users in the U.S. with sextortion scams. These scammers, primarily targeting adult men, coerced victims into sharing explicit images, then threatened to release them unless paid in gift cards, mobile payments, wire transfers, or cryptocurrency. Some attempts targeted minors, reported to NCMEC. Meta’s crackdown follows FBI warnings about the growing threat of financial extortion targeting children. A smaller network of 2,500 accounts, linked to 20 individuals in Nigeria, was also uncovered. These scammers used fake accounts and shared resources for scamming, including scripts and guides. Meta designated the Yahoo Boys as a banned entity under its strict Dangerous Organizations and Individuals policy. The company is improving detection tactics and sharing information with other tech companies through the Tech Coalition’s Lantern program. (The Record)

 

US warns venture firms about foreign investments

The US National Counterintelligence and Security Center issued a joint bulletin with several other US intelligence agencies, warning tech startups and venture firms about foreign investment fronts. These investors look to use early-stage investments as a way to gather data and technology to eventually undermine US businesses. The bulletin warned firms to be on the lookout for funding from complex ownership “incorporated in offshore locations lacking transparency.” The NCSC also weaned that startups with these investors could impact government contracts down the road.  (Bloomberg)

 

Israel’s secret shield in spyware saga

Israel has intervened in the ongoing lawsuit between WhatsApp and NSO Group to prevent the disclosure of state secrets. WhatsApp alleges that NSO Group’s Pegasus spyware targeted 1,400 users, including activists and journalists. NSO claims it acted on behalf of foreign governments, seeking immunity, but this defense has been rejected by U.S. courts. The U.S. Supreme Court recently allowed WhatsApp’s lawsuit to proceed, marking a significant step towards accountability. Despite this, Israel’s involvement aims to protect sensitive national security information from being exposed during the legal proceedings. (Forbidden Stories)

 

Columbus, Ohio suffers cyber incident

The city is working to restore its systems following a cyberattack that forced it to sever its connection to the internet. Officials stated that “while its 911 and employee payroll systems remain operational, several resident-facing IT services are dealing with outages that may take time to restore. City employees were unable to send or receive emails, and the 911 service, although operational, had its staff working with pen and paper. No comments were made as to whether a ransom is involved. (The Record)

 

Ukraine launches cyberattack on Russian ATMs

Updating a story we covered on Thursday, the attack, which started on July 23, and described as unprecedented in its scope, affected debit and credit cards of at least 10 major Russian banking organizations, freezing customer credit and debit cards, bank payment systems and mobile applications, causing outages in personal offices, and preventing payments for services like public transport. The attack also disrupted services from Russian mobile and internet popular online messengers and major Russian social networks. The Kyiv Post also states that nation-state hackers gained access to the databases of major banks. (Security Affairs)

 

Have questions? Reach out to RedSeal today to chat with one of our cybersecurity experts.

RedSeal: The Key to Comprehensive Attack Surface Management

/by

In today’s rapidly evolving digital landscape, organizations face an ever-increasing number of cyber threats. As highlighted by recent industry reports, traditional network operations solutions often fall short in providing the necessary visibility and control to manage and mitigate these threats effectively. This gap underscores the critical importance of comprehensive attack surface management (ASM) solutions.

Why Network Operation Solutions Fall Short

Limited Visibility and Context

Traditional network management tools are primarily designed to monitor and maintain network performance. While they excel at identifying performance bottlenecks and ensuring operational uptime, they often lack the ability to provide a complete and continuous view of an organization’s attack surface. This limitation becomes especially pronounced in complex, multi-cloud environments where assets are dispersed across various platforms and locations.

Incomplete Asset Inventories

Effective attack surface management begins with a comprehensive and up-to-date inventory of all digital assets. This includes not only the assets themselves but also their locations, the software they run, access permissions, and associated security controls. Traditional tools frequently struggle to maintain such detailed inventories, particularly in dynamic environments where assets and configurations are continually changing.

Inadequate Risk Prioritization

Identifying vulnerabilities is only the first step in securing an organization’s digital environment. The real challenge lies in prioritizing these vulnerabilities based on their potential impact. Traditional network management solutions often lack the advanced analytics required to assess and prioritize risks effectively. This can lead to inefficient use of resources and leave critical vulnerabilities unaddressed.

Performance Over Security

Many network operations solutions are primarily focused on ensuring network performance and availability. While these are important aspects of IT management, they do not address the dynamic and evolving nature of cyber threats. Effective cybersecurity requires a proactive approach that includes continuous monitoring, risk assessment, and the implementation of robust security measures.

The RedSeal Advantage

At RedSeal, we understand the complexities and challenges associated with managing an organization’s attack surface. Our platform provides the comprehensive visibility and contextual intelligence needed to secure your digital environment effectively.

Comprehensive Network Visualization

RedSeal offers detailed network visualization, allowing organizations to see their entire network, including cloud and on-premises environments. This holistic view is crucial for identifying and managing all assets, understanding access paths, and ensuring that security controls are properly implemented.

Continuous Monitoring and Risk Assessment

Our platform continuously monitors the network for changes and potential vulnerabilities. By maintaining an up-to-date inventory of all assets and their configurations, RedSeal keeps organizations ahead of evolving threats. Advanced analytics enable the prioritization of vulnerabilities based on their potential impact, ensuring that resources are used efficiently to address the most critical risks first.

Proactive Security Measures

At RedSeal, we proactively implement and maintain robust security measures for customers, including network segmentation, access control, and the continuous monitoring of security policies. This proactive stance reduces the attack surface and mitigates the risk of cyberattacks.

Continuous Compliance

RedSeal safeguards a full range of critical compliance and governance requirements with over 125 built-in integrations, ensuring adherence to external requirements, internal policies, and best practices.

In the face of increasingly sophisticated cyber threats, traditional network operations solutions are often inadequate for comprehensive attack surface management. RedSeal is the advanced and critical platform needed to visualize, monitor, and secure your entire digital environment effectively. By leveraging RedSeal’s platform, an organization’s cybersecurity posture is significantly enhanced, attack path surfaces are reduced, and critical assets are protected against cyber threat.

Cyber News Roundup for July 22, 2024

/by

Welcome to this week’s cybersecurity roundup. Key developments include Microsoft’s confirmation of a faulty CrowdStrike update impacting cloud PCs, CISA’s addition of major vulnerabilities to its KEV catalog, and the arrest of a teenage hacker linked to the MGM ransomware attack. Rite Aid disclosed a ransomware incident, and Alphabet is in talks to acquire Wiz for $23 billion. Additionally, Kaspersky is shutting down US operations, and a critical GeoServer flaw is under attack. Ransomware costs for critical infrastructure are spiking, North Korean malware targets Macs, and the GhostEmperor threat group resurfaces.

Start your week in the know!

 

Microsoft confirms CrowdStrike update also hit cloud Windows PCs

The faulty CrowdStrike update that continues to reverberate around the world also resulted in a number of Windows 365 Cloud PCs getting stuck in reboot loops, rendering them unusable. The standard fix suggested by Microsoft for rebooting Windows devices into Safe Mode or the Recovery Environment and manually removing the problematic kernel driver, does not apply to Windows 365 Cloud PCs being virtual machines running in the cloud. Instead, Microsoft recommends restarting the affected VMs as many as 15 times via the Azure Portal, or restoring from an Azure Backup before the time of the outage with the risk of possibly losing data created after the backup, or using the Azure CLI or Azure Shell to repair the OS disks offline. They also suggest reaching out to CrowdStrike itself. (BleepingComputer)

 

CISA adds some big names to its KEV catalog

The vulnerabilities in question are Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) Vulnerability, the SolarWinds Serv-U Path Traversal Vulnerability, and the VMware vCenter Server Incorrect Default File Permissions Vulnerability. CISA has ordered all Federal agencies to fix these vulnerabilities by August 7, and experts recommend that private organizations review the catalog as well. A link to a summary of the vulnerabilities is available in the show notes. (Security Affairs and CISA KEV catalog)

 

Teenage MGM hacker arrested in England

Police in the UK apprehended the 17-year old, who has not been named, for his “alleged role in the cybercriminal group that brought MGM Resorts casinos to a standstill last year in a ransomware attack.” The arrest was made as part of an ongoing FBI investigation into the incident that occurred last September and which has been attributed to the Scattered Spider gang, also known as Octo Tempest and 0ktapus. It should be noted that in reviewing this hack “MGM Resorts praised its own response to the incident, saying that its refusal to pay a ransom and decision to shut down all of its systems, as well as its coordination with law enforcement — had sent the message to criminals that “it’s not worth it.” (The Record)

 

Rite Aid discloses ransomware attack

US pharmacy giant Rite Aid sustained a ransomware attack last month that led to a breach of some customer data, BleepingComputer reports. The company said in a statement, “Rite Aid experienced a limited cybersecurity incident in June, and we are finalizing our investigation. We take our obligation to safeguard personal information very seriously, and this incident has been a top priority. Together with our third-party cybersecurity partner experts, we have restored our systems and are fully operational. We are sending notices to impacted consumers.” Rite Aid didn’t disclose what type of customer data was affected, but said it didn’t involve health or financial information. BleepingComputer notes that the RansomHub gang claimed responsibility for the attack and stole 10 GB of customer information, including “name, address, dl_id number, dob, [and] riteaid rewards number.” (Bleepingcomputer)

 

Alphabet in talks to acquire Wiz

The Wall Street Journal’s sources say Alphabet remains in advanced talks on the deal, reportedly valued at about $23 billion. If it goes through, it would become Alphabet’s biggest acquisition and dwarf its 2022 acquisition of Mandiant for $5.4 billion. The Wiz acquisition would significantly build out its cloud security offerings. It’s unclear what kind of regulatory hurdles the deal will see. In recent years big tech deals have seen unprecedented levels of antitrust scrutiny. But Google Cloud’s market share remains behind Amazon and Microsoft. Keep in mind, that these are just talks, so it’s not a done deal yet. (WSJ)

 

AT&T allegedly paid hacker to delete data

We may be getting some more details behind the recent AT&T data breach, which saw call records on millions of customers stolen through Snowflake cloud storage. A threat actor in the ShinyHunters hacking group told WIRED that AT&T paid a 5.7 bitcoin ransom, worth over $300,000, related to the attack back in May, in exchange for deleting the data. These transactions were confirmed by the crypto-tracing firm TRM Labs, and by the security researcher Reddington, who acted as a go-between in the deal. Reddington said an American hacker living in Turkey contacted him about the stolen data in mid-April 2024. 404 Media previously identified this individual as John Binns, and not the same threat actor that received payment from AT&T. Reddington notified Mandiant about the breach, which told AT&T. This timeline lines up with AT&T SEC filings. Binns was indicted on 12 counts related to a 2021 hack of T-Mobile back in May, allegedly arrested in Turkey. (Wired, 404 Media)

 

PoC turnaround time getting shorter

Cloudflare’s Application Security report documented how quickly threat actors can weaponize a proof-of-concept exploit. It observed one instance where an attacker deployed a PoC-based exploit for an authentication bypass flaw in JetBrains TeamCity 22 minutes after Rapid7 released it. This came less than six hours after Jetbrains released an update to resolve the patch and 5 hours after publicly disclosing the CVE. Cloudflare said this increased time pressure “led us to combine the human written signatures with an ML-based approach to achieve the best balance between low false positives and speed of response.” (Bleeping Computer)

 

Kaspersky Lab is shutting down US operations

Kaspersky Lab, a Russian cybersecurity firm, is shutting down its U.S. operations and laying off employees after the U.S. Commerce Department banned the sale of Kaspersky software starting July 20. The ban follows national security concerns that Kaspersky or the Russian government could exploit the software to spy on American customers. Kaspersky confirmed the shutdown, citing the ban’s impact on its U.S. business viability. The closure affects fewer than 50 U.S. employees, who will receive severance packages. The U.S. had previously banned Kaspersky software from federal and military systems due to security concerns. Despite denying any misuse of its software, Kaspersky faced allegations of extracting NSA hacking tools from an employee’s computer. U.S. officials stress the ban protects Americans from potential exploitation by foreign adversaries. (Zero Day)

 

CISA warns critical GeoServer flaw is under attack

​CISA said a 9.8 severity remote code execution flaw in GeoServer’s GeoTools plugin (CVE-2024-36401) is being actively exploited in the wild. GeoServer is an open-source server that allows users to share, process, and modify geospatial data. GeoServer disclosed the vulnerability on June 30th and said the flaw is caused by the GeoTools plugin unsafely evaluating property names. The project maintainers patched the flaw (in GeoServer versions 2.23.6, 2.24.4, and 2.25.2) and also offered workarounds but warned that the workarounds may break some GeoServer functionality. CISA now requires federal agencies to patch servers by August 5, 2024. (Bleeping Computer and SecurityWeek)

 

Cloud security and PowerShell expertise emerge as key SOC analyst skills

According to a survey conducted by the SANS Institute, a series of hard skills have emerged as key to success of analysts working in enterprise security operations centers (SOCs). These include a knowledge of cloud security issues, PowerShell expertise, and the ability to automate repetitive tasks and systems management functions. The SANS survey polled 400 respondents from small, medium, and large companies globally. The responses showed that many SOCs continue to struggle with a lack of automation and orchestration of key functions, high-staffing requirements, a shortage of skilled staff, and a lack of visibility. They also reported a pervasive silo mentality among security, incident response, and operations teams. On the positive side, SOC analyst retention improved with 30% of respondents indicating the average tenure is between three and five years, compared to the one-to-three year tenures reported in previous SANS surveys. (Dark Reading)

 

Critical infrastructure ransomware costs spike

A new report from Sophos found that the median ransom payment for attacks on critical national infrastructure organizations shot up from $62,500 in 2023 to over $2.5 million in 2024, while the average payment increased 6 times on the year to $3.225 million. Since this data only comes from victims willing to disclose payment details, it doesn’t give a comprehensive picture. Interestingly, average payments for IT and telecom victims saw a much lower payment at $330,000 compared to lower education and government organizations, which paid an average of $6.6 million. Attacks also showed more signs of sophistication, with the organizations able to recover within a week down from 50% to 41% in 2024, while those taking over a month rose from 36% in 2023 to 55%. (The Register)

 

North Korean malware comes to Macs

Security researcher Patrick Wardle found an updated variant of the North Korean-link infostealers BeaverTail that runs on macOS. This came spoofed as a DMG file for the legitimate Miro Talk video calling service. Palo Alto researchers originally found the Windows version of BeaverTail last November, used as part of a campaign targeting software developers with fake job interview requests. BeaverTail collects browser and crypto wallet data and can serve to install a Python backdoor to gain persistence. Wardle said that while these attacks are not very technically sophisticated, the operators often see success with social media lures. (The Hacker News)

 

The GhostEmpreror’s new groove

Kaspersky Lab first published details about the Chinese-linked threat group GhostEmperor in 2021. Since then, the group has been quiet. That changed with a new report from Sygnia, which found GhostEmperor attacking one of its clients in late 2023. Sygnia’s director of incident response research Amir Sadon said it went public with details to try to find out if the groups dark period was simply from inactivity or a lack of visibility. GhostEmperor uses a sophisticated kernel-level rootkit, a potential sign of state-sponsored activity. In 2021 it conducted supply-chain attacks against organizations in Southeast Asia.  (The Record)

 

Have questions? Reach out to RedSeal today to chat with one of our cybersecurity experts.

Cyber News Roundup for July 15, 2024

/by

Welcome to this week’s cybersecurity roundup, focusing on key developments in digital security. Start your week with the latest headlines from around the globe to keep you informed and ready to defend against evolving cyber threats.

We begin with a follow-up to last week’s blog on AT&T’s breach, which exposed metadata that cybercriminals could use for impersonation. NATO has announced a new cyber defense center in Belgium to combat state-sponsored threats. Microsoft is phasing out Android use for employees in China due to security concerns, and CISA has added a Cisco command injection vulnerability to its Known Exploited Vulnerabilities catalog, highlighting ongoing zero-day risks. Additionally, the U.S. Senate is introducing legislation to streamline cybersecurity regulations.

 

1. The personal security implications of the AT&T breach

The phone carrier’s data breach, which was announced on Friday, contained records of the phone numbers that were called to or texted to by customers between May 1, 2022 and October 31, 2022. The stolen data does not include any content of calls or texts, nor their time or date. In some instances cell site information was stolen, which might assist threat actors to triangulate customers’ locations as well as the people they interacted with, through the numbers themselves. According to Rachel Tobac, a social engineering expert and founder of cybersecurity firm SocialProof Security, quoted in TechCrunch, this type of data, referred to as metadata, “makes it easier for cybercriminals to impersonate people you trust, making it easier for them to craft more believable social engineering or phishing attacks against AT&T customers.” She continues, “the attackers know exactly who you’re likely to pick up a call from, who you’re likely to text back, how long you communicate with that person, and even potentially where you were located during that conversation due to the metadata that was stolen.” (TechCrunch)

Read our latest blog on network modeling to discover what RedSeal can do to bolster your cybersecurity efforts.

 

2. NATO will build a cyber defense center in Belgium

NATO members have agreed to establish the NATO Integrated Cyber Defence Centre (NICC) at the Supreme Headquarters Allied Powers Europe (SHAPE) in Belgium. Announced during NATO’s 75th-anniversary summit in Washington DC, the NICC aims to enhance resilience and respond to digital threats. The center will house civilian and military experts from member states and utilize advanced technology to improve situational awareness and collective cyber defense. Its primary role is to inform military commanders about offensive cyber threats and vulnerabilities, including those affecting civilian critical infrastructure. NATO has been bolstering its cyber capabilities, conducting defense exercises and developing rapid response strategies. The NICC and similar initiatives respond to rising threats from countries like Russia and China, emphasizing the alliance’s commitment to cybersecurity. (Infosecurity Magazine)

 

3. Microsoft is phasing out Android use for employees in China

Starting in September, Microsoft employees in China will be required to use iPhones for work, cutting off Android devices. An internal memo revealed that this move is part of Microsoft’s Secure Future Initiative, aiming to ensure all staff use Microsoft Authenticator and Identity Pass apps. The decision stems from the fragmented Android app market in China, where Google Play is unavailable, and local platforms by Huawei and Xiaomi prevail. Consequently, Microsoft has decided to block these devices from accessing its corporate resources. Affected employees will receive an iPhone 15 as a one-time replacement. The change is driven by security concerns, following multiple state-sponsored cyberattacks, including a significant breach linked to Russia earlier this year. Microsoft’s Executive Vice President, Charlie Bell, emphasized the company’s commitment to prioritizing security, pledging a major overhaul to address cloud vulnerabilities and enhance credential protection. (Bloomberg)

 

4. CISA adds a Cisco command injection vulnerability to its Known Exploited Vulnerabilities catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Cisco NX-OS Command Injection Vulnerability, CVE-2024-20399, to its Known Exploited Vulnerabilities catalog. This zero-day vulnerability, exploited by the China-linked group Velvet Ant, allows authenticated, local attackers with administrator credentials to execute arbitrary commands as root on affected devices. Cisco addressed the flaw, which affects several Nexus series switches, and recommended using the Cisco Software Checker to identify vulnerable devices. Federal agencies must fix this vulnerability by July 23, 2024. (Securityaffairs)

 

5. Top threats facing NATO ahead of major milestone 

Ahead of NATO’s 75th anniversary, analysts at Mandiant have outlined the greatest threats facing the organization and its allied countries. According to Mandiant Intelligence chief analyst John Hultquist, the primary adversaries remain Russia and China. The main threat actors identified include Russia’s APT29, COLDRIVER, and APT44, focusing on espionage, disinformation, and disruptive cyberattacks. China’s espionage efforts have become more stealthy, targeting government, military, and economic entities within NATO using sophisticated techniques like zero-day exploits and operational relay box (ORB) networks. Disinformation and hacktivism are increasing, with groups exploiting geopolitical tensions to undermine NATO’s stability and security. (Security Week)

 

6. Senate takes aim at ‘overly burdensome’ cybersecurity regs

The Senate has introduced new bi-partisan legislation called the “Streamlining Federal Cybersecurity Regulations Act.” The bill would create a committee tasked with harmonizing the “overly burdensome, inconsistent, or contradictory” cybersecurity requirements currently imposed on companies by federal regulatory agencies. The committee would include the national cyber director, the heads of each federal regulatory agency and other government leaders. The new bill comes a month after assistant national cyber director for cyber policy and programs, Nicholas Leiserson, warned lawmakers of increasing “fragmentation” of cybersecurity regulations. (CyberScoop)

 

7. Chinese threat actors exploit N-day vulns in mere hours

U.S. agencies including CISA, the FBI and NSA, as well as international law enforcement have issued a joint advisory warning that Chinese state-sponsored actor, APT40, is targeting newly discovered software vulnerabilities within hours. Rather than using techniques that require user interaction, the group is exploiting vulnerable, public-facing infrastructure to obtain valid credentials. The speed at which ATP40 is operating is setting up a “patching race” condition for organizations. This highlights the need for security teams to promptly patch internet-facing vulnerabilities and monitor for advisories from trusted sources.(Dark Reading)

 

8. Microsoft patches two zero-days

Microsoft yesterday issued patches for 142 vulnerabilities, including two actively exploited zero-days, Help Net Security reports. One of the zero-days (CVE-2024-38112) is a spoofing vulnerability in the Windows MSHTML Platform that can be triggered with a malicious HTML file. Researchers at Check Point found that threat actors have been exploiting the flaw since at least January 2023. Check Point explains, “Specifically, the attackers used special Windows Internet Shortcut files (.url extension name), which, when clicked, would call the retired Internet Explorer (IE) to visit the attacker-controlled URL. An additional trick on IE is used to hide the malicious .hta extension name. By opening the URL with IE instead of the modern and much more secure Chrome/Edge browser on Windows, the attacker gained significant advantages in exploiting the victim’s computer, although the computer is running the modern Windows 10/11 operating system.” (Help Net Security)

 

9. Australia targets government tech under foreign control

Australia’s Department of Home Affairs issued new instructions to all government agencies, ordering them to review their tech stacks for Foreign Ownership, Control or Influence risks. The agencies have until June 2025 to report these risks. A separate order requires developing a security risk management plan for any internet-facing services or systems that can be “directly accessed by untrusted or unknown entities.” A third order mandates government agencies using threat intelligence platforms to connect to a centralized sharing platform run by the Australian Signals Directorate. (The Record)

 

10. New group targets Veeam vulnerability

Researchers at Group-IB discovered a ransomware group known as EstateRansomware began exploiting a known flaw in Veeam Backup & Replication in early April 2024. Veeam patched this flaw in March 2023. The group gained initial access through Fortinet VPN appliances using dormant accounts. From there the attacks access a failover server. Once obtaining access, EstateRansomware created a rogue user account and established a command shell. Before dropping its ransomware payload, the group disabled Windows Defender. The Russian FIN7 cybercrime group exploited the same flaw last year. (The Hacker News)

 

11. Google expands security services

It’s always a good idea to keep abreast of changes to Google security services. Google introduced its  Advanced Protection Program back in 2017, designed to provide extra security for targeted users like journalists and politicians. Since launch, this required two physical security keys to set up, with users having to provide a password and one of those keys to log in. Now Google allows setting up the service with a single passkey using phone-based biometrics. The company also announced it will make its “Dark Web reports” available to all Google accounts later this month. Google previously limited these reports to Google One subscribers. As such, the reports will no longer show up in the Google One app, moving instead to general account settings. (The Verge, 9to5Google)

 

12. A massive phishing campaign is exploiting Microsoft SharePoint servers

A massive phishing campaign is exploiting Microsoft SharePoint servers to host malicious PDFs with phishing links. The attack, observed by malware hunting service ANY.RUN, has surged, with over 500 detections in the last 24 hours. This campaign uses trusted SharePoint services, making it hard to detect malicious intent. The phishing flow involves an email link directing to a SharePoint PDF, a CAPTCHA prompt, and a fake Microsoft login page. Users should verify email sources, check URLs, and enable multi-factor authentication. Indicators of phishing include unexpected SharePoint notifications, mismatched file types, urgent requests, and suspicious login pages. (Cyber Security News)

13. Germany strips Huawei and ZTE from 5G infrastructure

The German government has agreed with major telecom companies to phase out critical Huawei and ZTE components from their 5G infrastructure over the next five years. Interior Minister Nancy Faeser announced that Deutsche Telekom, Vodafone, and Telefonica would discontinue using Chinese-made components in core 5G network parts by the end of 2026 and from antennas, transmission lines, and towers by the end of 2029. This decision aims to protect Germany’s economy and communication systems from potential cybersecurity risks. Despite no specific evidence against Huawei, the move aligns Germany with other European countries and the US, which have already restricted Huawei and ZTE equipment. (NYT)

 

14. CDK Global reportedly pays $25M ransom following cyberattack

Following up on the story regarding CDK Global, the maker of specialized software for car dealerships, The Register reports that the company paid the $25 million ransom in bitcoin, to the group that runs BlackSuit ransomware. The consulting firm Anderson Economic Group suggests that the total financial damage to dealers in the first two weeks of the shutdown is just over $600 million, or 24 times the ransom. The problems for CDK and its customers are not yet over, with certain parts of the network still offline as restoration and rebuilding continues. (The Register and Anderson Economic Group)

 

15. CISA breaks into a U.S. federal agency, goes unnoticed for five months

As part of a red teaming exercise, named by CISA as SILENTSHIELD assessments, specialists exploiting an unpatched vulnerability in the Oracle Solaris enclave of an unnamed federal civilian executive branch agency, leading to what it said was a full compromise. The intrusion was made in January 2023, and for the following five months of the assessment, the target organization “failed to detect or remediate any of the SILENTSHIELD activity, raising concerns over its ability to spot genuine malicious activity.” As reported in The Register, “After gaining access to the Solaris enclave, the red team discovered they couldn’t pivot into the Windows part of the network because missing credentials blocked their path, despite enjoying months of access to sensitive web apps and databases. Undeterred, CISA managed to make its way into the Windows network after carrying out phishing attacks on unidentified members of the target agency, one of which was successful.” (The Register)

Have questions? Reach out to RedSeal today to chat with one of our cybersecurity experts.