The IT Nerd

You might recall that thousands of car dealerships have been shut down by their SaaS provider CDK Global not being available to them. Now BleepingComputer is reporting that a ransomware group called BlackSuit is apparently responsible for all of this:

The BlackSuit ransomware gang is behind CDK Global’s massive IT outage and disruption to car dealerships across North America, according to multiple sources familiar with the matter.

The same sources, who provided information on condition of anonymity, told BleepingComputer that CDK is currently negotiating with the ransomware gang to receive a decryptor and not leak stolen data.

While BleepingComputer is the first to report that BlackSuit is behind the attack, the news that CDK is negotiating with threat actors was revealed by Bloomberg yesterday.

If this is true and CDK Global is actually in negotiations with BlackSuit, then that’s bad. I’ve been consistent in saying that threat actors should never profit from their crimes. So by extension, negotiating with threat actors is bad. I guess we’ll find out if this is true or not if dealerships across the US are suddenly able to conduct business normally in the coming days.

Remember the Change Healthcare hack? It’s now gotten worse. According to TechCrunch, American’s medical records have been leaked:

In a statement Thursday, Change Healthcare said it has begun the process of notifying affected individuals whose information was stolen during the cyberattack. 

The health tech giant, owned by U.S. insurance conglomerate UnitedHealth Group, processes patient insurance and billing for thousands of hospitals, pharmacies and medical practices across the U.S. healthcare sector. As such, the company has access to massive amounts of health information on about a third of all Americans. 

The cyberattack prompted the company to shut down its systems, resulting in outages and delays to thousands of healthcare providers who rely on Change, and affecting countless patients who could not obtain prescriptions or had medical care or procedures delayed. 

Change said in its latest statement that it “cannot confirm exactly” what data was stolen about each individual, and that the information may vary from person to person. 

The affected information includes personal information, such as names and addresses, dates of birth, phone numbers and email addresses, as well as government identity documents, such as Social Security numbers, driver’s licenses and passport numbers.

The data also includes medical records and health information, such as diagnoses, medications, test results, medications, imaging, and care and treatment plans, said Change. The hackers stole health insurance information, including plan and policy details, as well as billing, claims and payment information, which Change said includes financial and banking information.

This is bad. This is really bad. This illustrates what can happen when an organization doesn’t properly secure their network. In short, people suffer. And in this case a whole lot of people are going to suffer because their personal information is out there. Change Healthcare really needs to be taken to the woodshed over this and be made an example of to show that this is unacceptable and companies need to do much better.

Tuesday night, car dealership Saas provider CDK Global was hit by a cyberattack, causing the company to shut down its IT systems, phones, and applications leaving its 15,000 clients unable to operate normally.

The company’s SaaS product provides auto industry clients with a platform that handles all aspects of a car dealership’s operations, including CRM, financing, payroll, support and service, inventory, and back-office operations.

To use CDK’s services, car dealerships configure an always-on VPN to the SaaS provider’s data centers, allowing their locally installed applications to access the platform. Also, the software has administrative privileges used to deploy updates. CDK has recommended disconnecting from the data centers.

Some dealerships appear to have gotten creative to continue doing business during the outage, logging in with old credentials on old CDK platforms, and sharing that they were simply relying on spreadsheets and sticky notes to sell customers small parts and make repairs, but that they weren’t making any large transactions. 

CDK’s systems first went down around 2:00 a.m. EDT and some functions began to come back online by Wednesday afternoon.

Ted Miracco, CEO, Approov Mobile Security had this to say:
 
   “This incident highlights a common vulnerability that is especially impacting the automotive supply chain and CDK’s breach exemplifies this risk. These apps provide extensive mobile tools for dealership management, offering functionalities such as real-time inventory management, customer relationship management, repair tracking, and mobile access to critical business information. However, without proper API security measures, these features can expose sensitive data and backend systems to potential breaches and malicious attacks. Many companies do not adequately secure their APIs, especially for mobile applications. API protection for web access does not adequately protect mobile interfaces, creating an easy target for hackers and ransomware attacks. These API attacks increasingly target the automotive supply chain, exploiting the lack of security in mobile interfaces.”

One of the reasons why I tend to warn my clients about using SaaS solutions is that you have to be able to trust that their security is top shelf. Because if they get pwned, you get pwned. And then your business is down for however long it takes for the SaaS provider to address their issues. Your organization has to ask if they want to take that risk.