The IT Nerd

Here’s a plot twist. London Police have arrested seven teens in relation to being the Lapsus$ hacking gang. That’s the gang that has pwned Nvidia, Microsoft, and Okta among others. The BBC has the details:

A 16-year-old from Oxford has been accused of being one of the leaders of cyber-crime gang Lapsus$.

The teenager, who is alleged to have amassed a $14m (£10.6m) fortune from hacking, has been named by rival hackers and researchers.

City of London Police say they have arrested seven teenagers in relation to the gang but will not say if he is one.

The boy’s father told the BBC his family was concerned and was trying to keep him away from his computers.

Under his online moniker “White” or “Breachbase” the teenager, who has autism, is said to be behind the prolific Lapsus$ hacker crew, which is believed to be based in South America.

Lapsus$ is relatively new but has become one of the most talked about and feared hacker cyber-crime gangs, after successfully breaching major firms like Microsoft and then bragging about it online.

The teenager, who can’t be named for legal reasons, attends a special educational school in Oxford.

City of London Police said: “Seven people between the ages of 16 and 21 have been arrested in connection with an investigation into a hacking group. They have all been released under investigation. Our inquiries remain ongoing.”

And what’s interesting is this:

“White” was outed – or “doxxed” – on a hacker website, after an apparent falling out with business partners.

The hackers revealed his name, address, and social media pictures.

They also posted a biography of his hacking career, saying: “After a few years his net worth accumulated to well over 300BTC [close to $14m]… [he is] now is affiliated with a wannabe ransomware group known as ‘Lapsus$’, who has been extorting & ‘hacking’ several organisations.”

No honour among thieves I guess. But it does mesh with a story that I posted earlier today. In any case, they have been released and are under investigation. So we may hear more about this in the coming days.

Here’s a plot twist in the whole Lapsus$ saga. Bloomberg is reporting that a Teen is suspected by Cyber researchers of being Lapsus$ mastermind. Cybersecurity researchers investigating the hacking group, on behalf of the companies that were attacked, said they believe the teenager, who lives at home with his mother in Oxford, England, is a mastermind. Cybesecurity expert Brian Krebs has posted a story that speaks to this as well, along with further details about the Lapsus$ group.

Based on this, I have a fair amount of commentary from a variety of experts. The first being Lucas Budman, CEO of TruU:

This is yet another example of bad actors continuing to exploit the vulnerabilities of the password.  As an industry we need to decide do we want to continue to try to “plug the proverbial hole in damn” by resetting passwords and/or adding 2FA (which is effectively a single factor at this point as the password is likely compromised already) in response to these events.  Or, are we ready to “use a new damn” and move on to passwordless MFA.

Peter Stelzhammer, Co-Founder of AV-Comparatives is next with this commentary:

“Hackers are no longer pupils, just doing it for fun. While pupils are eager to learn the ways of hacking, what must be understood is that if taken out of hand, it becomes online, organized crime. While hackers are sometimes hired as someone to do their job of their own accord, usually, it is always for the money.”

“Often it starts with social engineering and ends with a successful breach. Cybercriminals are most of the time well educated and geniuses in their field. The money made in cybercrime is much more than in the global drug market.”

Finally, we have Darren Williams, Founder and CEO, BlackFog with his perspective:

“So far this month we’ve seen Lapsus$ claim attacks on Okta, Samsung, Vodafone and Microsoft to name a few, so you’d easily be forgiven thinking there is a gang of cybercriminal masterminds behind these attacks. The ‘gang’ or potentially the teenager working from his mother’s house, made their mark in the ransomware world with the attack on Portuguese media conglomerate Impresa. Lapsus$ demonstrated a sense of humor following the incident when they tweeted that “Lapsus$ is the new president of Portugal”. Whether a criminal gang or a teenager from Oxford it’s clear that the ‘organization’ has the ability to infiltrate some of the world’s largest organizations at a speed that makes these attacks impossible to prevent using traditional perimeter defence tools. More than 84% of all attacks involve data exfiltration, exposing data on the Dark Web and/or public web sites. By refocusing security efforts on anti-data exfiltration, organizations are able to mitigate extortion attempts, regulatory fines, reports and ultimately the loss of trust in the business.”

Regardless who runs this hacking group, the main thing that you have to know is that they are dangerous because they are extremely effective. You need to take action in terms of strengthening your security posture so that you don’t become the next victim of Lapsus$.

You might recall that threat actor group Lapsus$ posted screenshots in their Telegram channel of what they claim to be Okta customer data. Okta is a leading provider of authentication services and Identity and Access Management (IAM) solutions. They’re used by organizations worldwide as a single sign-on (SSO) provider, allowing employees to securely access a company’s internal systems, such as email accounts, calendars, applications and more. Okta has responded with their version of events as well.

Lapsus$ has previously claimed responsibility for the leaked proprietary data of companies such as NVIDIA and Samsung. Unlike ransomware groups, Lapsus$ does not encrypt data once they gain access. Instead, they exfiltrate the data and threaten to publish what they’ve gathered if demands are not met. The group began by focusing on Latin American victims and some security researchers suspect the group is based in Latin America.

In the interest of helping customers of Okta since it is said that over 300 customers might be affected by this, I reached out to managed security provider Nuspire and JR Cunningham, CSO at Nuspire was kind enough to provide these recommendations:

• Review your Okta audit logs for suspicious activity focused on superuser/admin Okta accounts.
• Rotate passwords for high-privileged accounts.
• Check for privileged accounts created around the time of the suspected breach. (January 21, 2022).

Hopefully that helps companies take a security posture that help to protect them from being the next victim of Lapsus$.

A new report from Splunk has warned that network defenders have only 43 minutes to mitigate ransomware attacks once an attacker has begun encryption. Splunk measured known ransomware strains including Ryuk, REvil, BlackMatter, DarkSide, Conti, LockBit and more, with LockBit being the fastest attacking and encrypting ransomware, 86% faster than the median of 43 minutes. The report requires you to register to see it as I did, but it is very much worth reading.

Peter Stelzhammer, Co-Founder, AV-Comparatives had this comment:

“In our common ransomware testing we saw that not only the ransomware itself is code optimized, but also the endpoint protection products do a very good job protecting against those threats. However, it is also fact that the performance of the computer, especially of the CPU, has an impact on the ransomware. Usually the faster CPU is, the more files are getting encrypted, if it’s only about ransomware protection. The best thing is to block the threat is the threat itself before it can start its behavior.”

Mitigating ransomware attacks in 43 minutes or less sounds like a tall order. And it can be. But it shouldn’t stop companies from doing everything possible to make sure that they are not a victim of ransomware. Because prevention may not be easy. But it is possible.

UPDATE: I have two more comments. Chris Olson, CEO of The Media Trust had this to say:

 “Ultimately, these findings demonstrate the futility of responding to ransomware and encryption attacks after the fact. To protect themselves, organizations must pivot to prevention over treatment. The first step is to monitor IT and digital infrastructure in real time, while working to harden entry points which malicious actors can use to gain a foothold before they do.”

“Importantly, today’s businesses must work to gain a detailed understanding of the way that ransomware attackers compromise their systems, from the reconnaissance phase through to execution. It’s easy to overlook the importance of digital attack surfaces such as the Web and mobile devices – but this is exactly where many ransomware incidents begin.”

Darren Williams, CEO and Founder of BlackFog offers this perspective:

 “One of the challenges with traditional defensive approaches to cybersecurity is that they require too much time to adequately protect organizations from these types of attacks. The focus on encryption speed should be irrelevant for modern cybersecurity software.  Instead of focusing on encryption we should be focused on preventing the exfiltration of data from the device and the resulting breach. By looking at the mechanism of action across various ransomware gangs it is possible to stop these attacks at many stages of the attack life cycle and ultimately stop the data exfiltration from the device itself.”