Archive for March 28, 2024

NHS Trust Confirms That Clinical Data Related To Patients Leaked As Part Of Getting Pwned

Posted in Commentary with tags on March 28, 2024 by itnerd

Yesterday, following the attack on its systems earlier this month, the Scottish NHS confirmed in an online statement that clinical data relating to a small number of patients has been published by a “recognized ransomware group.”

On March 14th, the original statement by the NHS confirmed that hackers had accessed “a significant amount of data including patient and staff-identifiable information.”

The ransomware group then followed with a threat on its leak site that it will soon publish 3TB of data relating to NHS Scotland patients and staff unless its demands are met. The threat actor posted a ‘proof pack’ which shows sensitive clinical documents, including genetics reports and letters between doctors discussing patient treatments.

NHS Dumfries and Galloway Chief Executive Jeff Ace acknowledged that the information has been released by the attackers to prove it is in their possession. He made no reference to any ransom demand made by the group.

Morten Gammelgard, EMEA, co-founder, BullWall had this to say:

   “Although the NHS is unlikely give into any ransom demands, the recent warning from Ransomware groups towards the healthcare industry should be taken very seriously as recent US events in healthcare in US and UK shows.

   “Private patient data is incredibly valuable to attackers. Hospitals store large amounts of patient data, often in an unencrypted format. This sensitive and confidential data can be sold on, or used for extortion as is the case with NHS Dumfries and Galloway.

   “Systems can always be breached and often you are fighting an invisible enemy unless you have the server intrusion tools to pick up the breach in the first place.

   “The Critical IT infrastructure is becoming the most desired target for the Ransomware gangs and hospitals are under immense pressure to pay the ransom to get the confidential personal records back and avoid the embarrassment and reputational damage following a breach like this.”

Healthcare continues to be a prime target for threat actors. This case should serve as another warning that those in this sector need to beef up detection and prevention so that they avoid being my next headline.

Elon Musk Appears To Get More Desperate As It Appears That Twitter Continues To Bleed Users

Posted in Commentary with tags on March 28, 2024 by itnerd

I haven’t written about the train wreck next to a dumpster fire that Twitter is in a while. But this Sky News article caught my interest. Let’s start with the desperation that is strong with Elon by him making this move:

Elon Musk has announced further changes to social media platform X that will see certain accounts get premium features for free.

The tech billionaire, writing on the platform formerly known as Twitter, said all accounts with more than 2,500 verified subscriber followers would be able to access features that usually cost $8 (£6.30) a month.

Premium features include the ability to edit and write longer posts, as well as reducing the number of adverts seen by the user. It also gives the account holder a blue tick next to their display name.

So this is interesting. I seem to recall that Elon argued that he had to charge $8 a month for certain features to allow Twitter to make money. But now he’s making said features free to a subset of users. Which means he’s not making as much money. I wonder why he’s doing that? Perhaps this is the reason:

It comes after the company denied reports that the number of people logging in to X has plummeted since Musk took over.

Worldwide daily users of X’s mobile app fell to 174 million in February, down 15% from a year earlier, according to research by data firm Sensor Tower.

X’s own figures also suggest a decline since November 2022, Sky’s US partner NBC News reported.

The company said earlier this month it had 250 million active daily users – which is down from the 258 million claimed by Musk at around the time when he took over the firm.

Other social media platforms, including InstagramFacebook and TikTok, have in contrast experienced “modest” increases in users over the past year, researchers said.

“This decline in X mobile app active users may have been driven by user frustration over flagrant content, general platform technical issues, and the growing threat of short-form video platforms,” Sensor Tower senior analyst Abe Yousef said.

A spokesperson for X described the research figures as “inaccurate” and added: “Both our own data and self-reported data from other platforms tells a different story.”

In short, my thinking is that Elon is making this move to try and stop users from leaving. And then if he can stop the bleeding, he’s going to go back to figuring out how to make a buck off of those users. It’s a strategy I suppose. But it highlights the fact that Twitter is a mess since Elon took over and Elon doesn’t know how to fix the damage that he has caused. Thus highlighting the fact that he’s not as smart as everyone thinks he is.

I’ve said it before and I will say it again. Sucks to be you Elon.

Approov & PreEmptive Partner For Comprehensive, Effective Mobile Security Regardless of App Store

Posted in Commentary with tags on March 28, 2024 by itnerd

Approov, a leader in mobile application and API security, and PreEmptive, a pioneering force in application security, today joined forces to provide comprehensive mobile application protection as the EU Digital Markets Act takes effect. The joint solution addresses the main challenges for mobile app security: protecting intellectual property and app shielding, as well as runtime threats to apps and the need for app attestation.

The EU DMA forces Google and Apple to allow side-loaded apps via alternative app stores which reduces the effectiveness of the security mechanisms provided by these vendors. For example, the theft of app intellectual property, creation of illegal copies of apps, and manipulation of apps at runtime are all harder for Google and Apple to prevent.

PreEmptive and Approov have partnered to effectively protect app intellectual property and prevent runtime tampering through a straightforward, cross-platform solution to these challenges that are compatible with both iOS and Android. This effective and easy-to-deploy security solution for mobile apps seamlessly integrates with the CI/CD pipeline and SAST/DAST solutions, and is not dependent on Apple or Google. It includes:

  • Comprehensive shielding of Android and iOS mobile app code from reverse engineering and intellectual property theft.
  • Runtime app attestation to prevent cloned and copied apps.
  • Anti-tampering checks to detect client OS manipulation and the presence of emulators and hostile frameworks at runtime.
  • API and communications channel protection by using dynamic certificate pinning.
  • Dynamic API Key and certificate management to prevent API abuse.

There are fundamental security challenges with mobile apps: they can be reverse engineered, analyzed, cloned, modified, or copied, and the environments they run in can be hacked, rooted, instrumented, and manipulated to interfere with the operation of an app. Apple and Google provide only basic app protection and attestation, but these are limited and are dependent on features of the Apple App Store and on Google Play. Stronger security measures are needed.

Approov and PreEmptive address these challenges with a joint solution that works across all platforms and application types — independent of the app store employed to distribute apps. This means users can future-proof your application security while continuously monitoring for and preventing app and API abuse.

Under terms of the partnership:

  • Approov can resell Dotfuscator and JSDefender, and the PreEmptive mobile shielding products: PreEmptive DashO for Android, and Defender for iOS.
  • Approov provides an extended 90-day trial period of Approov RASP and runtime analytics to PreEmptive customers.

April 24 Joint Web Seminar Explains It All

Approov will host a joint web seminar on the impact of the EU Digital Markets Act with PreEmptive on April 24, 2024, at 11am US Eastern Time (ET). The one-hour session will delve into mobile app vulnerabilities and demonstrate how PreEmptive and Approov effectively protect app intellectual property and prevent runtime tampering, with a straightforward approach compatible with both iOS and Android. Attendees will learn:

  • How the EU Digital Markets Act exposes the limitations of Google and Apple mobile security.
  • Why the two main challenges for mobile app security are: (1) The protection of intellectual property and the need for app shielding; and (2) Runtime threats to apps and the need for app attestation.
  • How to easily and effectively defend against these threats as the EU DMA takes effect
  • How PreEmptive and Approov together provide an effective and easy-to-deploy security solution for mobile apps that is not dependent on Apple or Google.

Register for the webinar here: https://approov.io/info/joint-webinar-comprehensive-and-effective-mobile-security

Quarter Of Industrial Enterprises Have Temporarily Shut Down Operations Due To A Cyber Attack: Palo Alto

Posted in Commentary with tags on March 28, 2024 by itnerd

Palo Alto Networks’ recently released The State of OT Security 2024 report. The report revealed the reality, extent, and changing nature of security threats to operational technology (OT) in industrial environments.

Spotlighting the frequency of cyberattacks and examining the struggles and implications organizations’ face when navigating these threats, the report found that within Canada:

  • Almost two-thirds industrial organizations have experienced cyberattacks in the past year.
  • 1 in 4 Canadian and global organizations had to shut down operations due to an attack.
  • IT is the main attack vector, with 71% of attacks originating there.
  • Nearly 75% reported that AI-enabled attacks on OT-infrastructure is currently a critical issue; 81% agreed that AI-enabled security solutions are critical in detecting and stopping OT-infrastructure attacks.
  • 82% of respondents believe Zero Trust is the right approach to OT security.

The full global report can be viewed here or downloaded here.

Ontario School Boards Suing TikTok, Meta, And Snapchat For $4.5 Billion

Posted in Commentary on March 28, 2024 by itnerd

Well, I must admit that I did not see this coming. CP24 and The Toronto Star are both reporting that Meta, Snapchat and TikTok are being sued by for Ontario school boards. This is what the Toronto Star had to say:

In four separate but similar cases filed Wednesday in Ontario’s Superior Court of Justice, the public boards in Toronto, Peel and Ottawa and the Toronto Catholic board allege the popular social media platforms were “designed for compulsive use (and) have rewired the way children think, behave, and learn” and are calling on the companies to make improvements, say their statements of claim. 

School boards have had to bring in staff, resources and programming to mitigate the “significant impacts that these addictive platforms are having on our students,” said Colleen Russell-Rawlins, director of education at the Toronto District School Board, the country’s largest. 

“We’re managing mental health challenges, loneliness and … discrimination — the slurs that we’re seeing students use, some of that emanates from what’s on social media,” she added.

“We really want to raise awareness and ultimately get these companies to acknowledge and to make these things safer,” added Brendan Browne, director of education for the Toronto Catholic District School Board.

The social media companies in question haven’t said anything to either The Toronto Star and CP24, but I can’t imagine that they aren’t going to be happy. If this succeeds, it’s likely to be copied by other school boards in other places. Which means that this could become a huge problem for all of these companies. It’s also bad press for these companies that I am pretty sure that they don’t need right now.

What I am watching for in the coming days or weeks is to see how the social media companies respond to this. Specifically how they delay or stop this from moving forward as that likely is going to be how they respond to these lawsuits.

Get the popcorn ready.

New Attack Path Exploits Microsoft SCCM: Researchers Discover Undocumented Way to Compromise Account Privileges

Posted in Commentary with tags on March 28, 2024 by itnerd

GuidePoint Security has unveiled the discovery of an undocumented way to compromise an account and elevate privileges inside an SCCM (System Center Configuration Manager) – aka Microsoft Endpoint Configuration Manager (MECM) – network. 

GuidePoint Security’s Threat & Attack Simulation (TAS) team detected SCCM exploitation for account compromise, finding the conditions that can compromise SCCM client push and machine accounts through automatic site-wide client push installation and Active Directory system discovery. 

Due to the permissions these accounts hold, this can lead to an SCCM site takeover or, in the case of the SCCM push account, administrative privileges over numerous computer objects within the domain.

The TAS researchers are the first to find this novel attack path across the industry in SCCM, an endpoint management tool. 

With certain conditions explained, an attacker may be able to retrieve the hashed credentials for all configured SCCM push accounts, meaning they may be able to access admin privileges.

You can read about this here.

CISA Seeks Input on Cyber Incident Reporting For Critical Infrastructure Act (CIRCIA)

Posted in Commentary with tags on March 28, 2024 by itnerd

The CISA has just published Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA), an unpublished Proposed Rule by the Homeland Security Department on 04/04/2024. 

CIRCIA speaks all the way back to the Presidential Policy Directive 21 (PPD-21) of 2013 which includes:

“This directive establishes national policy on critical infrastructure security and resilience. This endeavor is a shared responsibility among the Federal, state, local, tribal, and territorial (SLTT) entities, and public and private owners and operators of critical infrastructure (herein referred to as “critical infrastructure owners and operators”). This directive also refines and clarifies the critical infrastructure-related functions, roles, and responsibilities across the Federal Government, as well as enhances overall coordination and collaboration.”

And today’s comments from CISA Director Jen Easterly, in the announcement: 

“CIRCIA is a game changer for the whole cybersecurity community, including everyone invested in protecting our nation’s critical infrastructure, It will allow us to better understand the threats we face, spot adversary campaigns earlier, and take more coordinated action with our public and private sector partners in response to cyber threats.”

Ted Miracco, CEO, Approov had this comment:

   “CIRCIA marks a significant advancement in the collective cybersecurity effort, however what constitutes a “significant cyber incident” still presents an ambiguity that could lead to underreporting which is undesirable. Also, the tight reporting windows, while crucial for rapid response, may put pressure on entities to report before fully understanding the scope of an incident. 

   “Successful implementation will hinge on clear guidance, support mechanisms for covered entities, and ongoing dialogue between the public and private sectors. Overall CIRCIA could well set a precedent for cybersecurity collaboration and incident response, not just within the United States but globally.”

Craig Harber, Security Evangelist: Open Systems follows with this comment:

   “I believe the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA), if implemented correctly is a big deal, a significant step towards protecting the nation’s critical infrastructure. It is really a collective defense strategy that requires the owners and operators of critical infrastructure to share threat intelligence with CISA in real-time. CISA will use this information to assist all members of the critical infrastructure community. Frankly, this collective defense strategy allows for broader collaboration of a limited set of highly skilled resources across all industrial sectors to identify and defeat cyber threats.”

I’m all for having playbooks like these as it will start to ensure that incidents are handled in a consistent manner and everybody works together. Sure it’s not perfect, and it needs work, but let’s not let perfect be the enemy of good.