Archive for April 23, 2024

Fortra Advances Cybersecurity Defense with Expanded Threat Intelligence Capabilities

Posted in Commentary with tags on April 23, 2024 by itnerd

Today’s attackers are wiser to current cybersecurity defenses and therefore more sophisticated in their attacks. To this end, global cybersecurity software and services provider Fortra recently enhanced its Threat Intelligence offerings, adding high-fidelity threat intelligence with timely, curated data to level the playing field and provide cybersecurity analysts the edge needed to stay a step ahead of modern threat actors.

Fortra’s expanded Threat Intelligence services include:

  • Dark Web Compromised Credentials Monitoring – widens visibility into stolen credential intelligence uncovered from dark web sites that are designed to harvest and sell employee and customer logins as well as passwords stolen by infostealers and botnets. It also guards against future attacks by implementing countermeasures such as forced password resets and lockouts.
  • Threat Engagement and Disruption – covertly interacts with threat actors, on behalf of customers, to gain intelligence about the tactics, techniques, and procedures used. Enumerates threat actor infrastructure to disrupt Business Email Compromise (BEC) attacks and phishing sites.
  • Intelligence Feeds – enriches existing internal threat data and optimizes security controls with Fortra’s high-fidelity threat indicators sourced from proprietary collection technologies and curated by expert researchers, to better detect and mitigate credential theft, email, and money mule threats.
  • Intelligence Assessments – improves threat-based decision-making with supplemental, expanded insights from Fortra researchers on phishing incidents, email threats, and counterfeit threats.

With an expansive portfolio of cybersecurity technologies, Fortra has extensive visibility into the infrastructure and methods used by threat actors. Intelligence from these technologies is fed into the Fortra Threat Brain, where it is used to enrich its solutions and deliver intelligence services to customers.

Fortra is offering an in-depth review of the new threat intelligence services via webinar on Tuesday, April 30 at 11 a.m. Eastern, led by Cary Hudgins, Director of Product Management, and Michael Tyler, Senior Director, Security Operations at Fortra.

Leave a comment »

Review: ZIKE Smart Tracking Card

Posted in Products with tags on April 23, 2024 by itnerd

AirTags are great. But they aren’t perfect for every use case. That’s why third party tracking cards that are compatible with the FindMy Network are handy. Specifically the ones that are roughly as thin as a credit card as that broadens the use cases what you can track. There’s two problems with these third party tracking cards though. The first is none of them have UltraWideband support which would allow you to have the ability to precisely track the card like an AirTag. The second is that none of these cards allows you to replace the battery. The ZIKE Smart Tracking Card solves the second of those problems in an interesting way. Let’s have a look at the card:

This side of the card really doesn’t have anything interesting on it, other than the fact that it has a picture that implies that this card can help you find your stuff:

This side of the card has more pictograms that show all the use cases. A lot of them facilitated by the fact that this tracking card has a slot to allow you to have it hang off luggage or any other item. If you look at the top right corner, there’s a button that activates the card, but doesn’t seem to do anything else after that. For what it’s worth, the cards are IPX7 dust and water resistant. Which means that it expands the potential use cases.

The card is thin. ZIKE claims it’s 2mm and if you look at it relative to my PRESTO transit card, it’s slightly thicker than that card which is roughly the thickness of a credit card.

Adding it to your items on the FindMy app is stupid simple:

  1. Open the Find My app on your iPhone
  2. Go to Items and click on the plus sign
  3. Click on Add Other Item
  4. Press the button that’s located on the top right corner until it makes a sound
  5. Follow the onscreen prompts and agree to the fact that law enforcement will hunt you down if you use this for illegal purposes.
  6. Done! Declare victory and have a beer!

Now once you’ve added it you can track it. But only via Bluetooth as it has no UltraWideband support. Which means that you’re going to have to play a sound and play a game of “Marco Polo” until you find it. That brings me to how loud this card is. According to my Apple Watch Ultra, it puts out 76dB. By comparison, the Chipolo CARD Spot was 10dB louder. The sound it high pitched so you should be able to hear it, but it would have been nice if it were a bit louder. The one thing that it does that the CARD Spot does not have is the ability to recharge the built in battery via wireless charging:

If you look carefully at the word “ZIKE” in the top left corner, you will see a red light and a green light. The red light means that it is charging, and the green light means that it is charged. But you may have to fiddle with the placement of the card to get it to charge. Based on my testing with this wireless charger, the charging coils for the card are at the bottom of the card. I was also able to replicate that with a MagSafe Adapter (which it actually sticks to by the way). Larger wireless chargers like this wireless charger had no issue in terms of charging it. Likely because the charging coils are larger making placement less of an issue. In any case, 30 minutes of charge should get you a year of usage. I clearly haven’t had these for a year. But I can say that I charged them in about 30 minutes when I first got them, then a week later I was able to get a full charge into them in a couple of minutes. That suggests to me a year of battery life is plausible.

Now these cards aren’t exactly cheap. MSRP for each one is $66.89 CAD but they are currently going for $47.38 CAD at the moment. And there are discounts if you buy more than one. My thinking is that this price is based on the fact that ZIKE isn’t going to be selling you one of these cards every year when the battery runs out. Thus they have to get their cash up front. Regardless, The ZIKE Smart Tracking Card has earned a place in my Ekster Carbon Fibre Cardholder to make sure that I don’t lose it.

Leave a comment »

ALPHV Was In Change Healthcare’s Network For Days Before They Attacked

Posted in Commentary with tags on April 23, 2024 by itnerd

Not that I am surprised by this, The Wall Street Journal has just released data that the Change Healthcare attackers lurked in the network nine days ahead of them getting pwned:

The attackers, who represented themselves as the ALPHV ransomware gang or one of its affiliates, gained entry into Change’s network on Feb. 12, a person familiar with the cyber investigation said. They used compromised credentials on an application that allows staff to remotely access systems, the person said.

Multifactor authentication protocols are typically used to guard against such breaches, including the use of text-message codes or access tokens keyed to individual users. MFA wasn’t enabled on this particular application, the person said.

Steve Hahn, EVP of Americas, BullWall had this comment:

“That the threat actor used compromised credentials before launching their attack comes as no surprise. This same technique has been used in over 95% of the Ransomware events we analyzed in 2023. Interestingly, this is the same percentage that Sophos independently found. 

“Essentially the criminal gets low level credentials. It could be the exploitation of anyone in the company’s credentials.  From there they used tools originally used by the good guys in cyber to pentest networks to scrape server admin credentials. These tools are often Cobalt Strike or Mimikatz. 

“This is an incredibly simple and incredibly effective process. Once they have the same rights as the most trusted users in the organization, they can essentially do anything they want. These admins can shut off security products, whitelist pathways and applications that the bad guys can use, exfiltrate data and turn off their data loss tools, ultimately launching their Ransomware attack to encrypt every piece of data in the company — from patient records, medications, health history, credit card data and social links to blood types and even genetic testing. They gain access to the most sensitive data that exists. 

“Companies believe they are secure because they’ve enabled multi-factor authentication, meaning that the threat actor theoretically needs more than just the credentials, they also need the phone of that admin to receive the MFA code to remotely log in to that server via tools like RDP. 

“Most servers, shockingly, are not protected via MFA to every sign on session directly. Even if they are, the threat actor can bypass MFA by simply scheduling tasks on that server that don’t require a remote log-in to the server itself using tools called Schedule Task Managers. 

“hey can also use keyboard capture to intercept that MFA token or SIM swapping hacks that route the legitimate server admins phone number to the threat actor. The simple truth is prevention will NOT work against a determined threat actor focused on a single organization. It is a matter of when, not if, they launch their Ransomware attack. Prevention tools that exist today are not enough, as is evidenced by these attacks. 

“ALPHV (Blackcat) told the FBI, after the FBI claimed falsely that they “took down” the ALPHV group, that they would now focus all of their efforts on US healthcare organizations. This attack is the first of many we will see, as they seem determined to live up to that promise. 

“Organizations can no longer rely solely on prevention. They must have containment and mitigation strategies in place. They can continue to work to try to stop these threat actors, but they must also plan on the inevitable, and work out rapid Ransomware “containment” and mitigation strategies as well as plans for how to rebuild after the event. 

Emily Phelps, Director, Cyware follows with this:

“In the face of persistent cyber threats targeting the healthcare sector, the importance of threat intelligence sharing and its operationalization cannot be overstated. Healthcare organizations are attractive targets for cybercriminals, making it essential for these entities to adopt a proactive stance in combating these attacks efficiently and effectively.

“By participating in such intelligence-sharing communities like Health-ISAC, healthcare providers can access a wealth of intelligence that helps them identify and mitigate potential threats more effectively. This collaborative approach not only enhances individual organizations’ defensive capabilities but also strengthens the overall security posture of the healthcare industry.

“Operationalizing this intelligence involves integrating it into security operations to enable real-time responses and preventative strategies. By doing so, healthcare entities can safeguard their critical infrastructure, ensuring the continuity of vital services and protecting sensitive patient data.”

There’s two #fails here. The first is that MFA wasn’t used throughout the environment to mitigate the risk of an attack. But the bigger #fail is that ALPHV was in the environment, and were undetected for days. To be really secure, you have to keep the bad guys out. But at the same time, you have to make sure that if they get in, you can find them. And quickly. These days, there’s simply no other option.

Leave a comment »

D.C. Department of Insurance, Securities and Banking Admits That It Had A Data Breach After LockBit Claims That They Pwned Them

Posted in Commentary with tags on April 23, 2024 by itnerd

In a statement late last week, the D.C. Department of Insurance, Securities and Banking (DISB) confirmed it was notified by third-party software provider Tyler Technologies that it “has experienced a data breach related to securities data”  a week after the LockBit claimed it attacked the regulatory agency and stolen 800GB of data.

The Washington, D.C., government agency, designed to protect consumers from abuses by financial institutions, confirmed that data stolen and leaked by the LockBit ransomware gang was taken from a third-party technology provider, Tyler Technologies, a public company that serves government agencies and schools around the world.

“Tyler Technologies discovered unauthorized access to their cloud that stores DISB’s STAR system client data,” DISB said, directing people to an alert from Tyler Technologies.

On April 13, the LockBit ransomware gang claimed it attacked DISB and stole 800GB of data. Then on Thursday evening Lockbit said that negotiations had broken down and it planned to leak 1GB of data in order to further push the organization into paying a ransom.

Tyler Technologies says it is currently “working to identify which individuals’ personally identifiable information (PII) may have been acquired by the threat actor.”

Emily Phelps, Director, Cyware had this to say:

   “Third-party security attacks are common and represent a real cybersecurity risk. Organizations must not only protect their own environments but must also ensure their technology partners and agencies have effective security programs in place. By leveraging advanced threat intelligence and security orchestration, entities can improve their resilience against these ubiquitous cyber threats. This situation also highlights the importance of thorough due diligence and continuous monitoring of third-party vendors, particularly those handling sensitive data.”

Ted Miracco, CEO, Approov Mobile Security adds this comment:

   “Tyler Technologies’ engagement with law enforcement and a cybersecurity firm is a step in the right direction, given that personal identifiable information (PII) was likely stolen. However, this situation exemplifies the risks associated with third-party vendors, as Tyler Technologies experienced unauthorized access that compromised DISB’s data. Any delays in public acknowledgment and response from either the DISB or Tyler Technologies reflect upon shortcomings in their incident response strategies. The fact that Tyler Technologies had immutable backups and was able to focus on recovery is commendable, as having robust data backup and recovery processes is vital in ransomware mitigation strategies. The bottom-line is that there are many problems with this breach and a few encouraging elements in the response.”

Another day, another supply chain attack. Sigh. At this point, you have to wonder when the madness will end, and organizations get serious about securing themselves and their partners.

Leave a comment »