The IT Nerd

Another day. Another case of pwnage via supply chain attack.

Friday, a consulting firm working with the Department of Justice, Greylock McKinnon Associates, reported a data breach to regulators in Maine, telling 341,000 victims that personal information such as Medicare, Social Security numbers and more were accessed during an incident last May.

The company which provides “litigation support services in civil litigation matters”, said those affected by the breach originally had information obtained by the DOJ “as part of a civil litigation matter.” Information accessed by the hackers included:

• Names
• Dates of birth
• Addresses
• Medicare Health Insurance Claim Numbers
• Social Security numbers
• Some medical or health insurance info

The consulting firm says it “deleted DOJ data from its systems after the incident.”

Meanwhile, Sunday, threat actors claimed to have hacked the Environmental Protection Agency allegedly compromising the data of over 8.5 million customers and contractors.

The EPA hasn’t yet confirmed the breach, but various reports confirm the legitimacy of the hacker’s claims. The leaked database was found to contain three zipped files with 500MB of data. The files are named: Contact (3,726,130 records), Inter_Contact (9,952,374 records), and Staff (3,325,973 records). Some of the fields included:

• Full names
• Phone numbers
• Email addresses
• Mailing Addresses
• Company name
• Company address

After filtering the duplicate records, the total accounts breached amounted to 8,460,182.

Corey Brunkow, Dir of Eng Operations, Horizon3.ai:

The DOJ data breach is a great use-case example of Supplier Security Posture Management. Supplier Security Posture Management is the concept that your large organization’s exploitable attack surface is not just your own IT infrastructure any longer, but the IT infrastructure of your suppliers and your distributors too.  Forward thinking organizations like the Cyber Collaboration Center at NSA are running pilot programs to manage this risk among their defense industrial base suppliers – See Link to info here:  https://www.nsa.gov/About/Cybersecurity-Collaboration-Center/DIB-Cybersecurity-Services/

   “In this case, the US DOJ utilized a consultant (Labor Supplier) whose cyber security was not able to prevent this 3rd party attack, despite the regulations and bureaucracy of government contracting.  TheRecord reports that the consulting firm deleted the data AFTER the hacking incident.  This may be the case, but based on the breach notification, the consultants failed to verify that the data was either deleted or sufficiently protected prior to attackers gaining access to it. This is a common Supplier Security Risk Management risk for large organizations and should be prevented to avoid risk to brand and reputation of both suppliers and large organizations in both the commercial and government sectors. “

The EPA hack is pretty bad because of the scale. But the DoJ hack is worse because it’s another supply chain attack. How long will it take for organizations to get the message that supply chain attacks are real and defending against them has to move up the list of priorities? I ask because the amount of supply chain attacks that I report on seems to be greater than the amount of ransomware attacks that I report on. Which is insane and shows how bad this problem is.

New York City is the latest victim forced to take a city payroll website offline and remove it from public access for almost a week now after dealing with a smishing incident.

The website was partially taken offline following the smishing campaign that allegedly involved messages sent to city workers asking them to activate multi-factor authentication, with a link to a phishing domain.

It wasn’t till after being contacted by POLITICO, who first reported the incident last week, the city warned the roughly 300,000 full time workers of the phishing campaign, but they did not mention that access to the New York City Automated Personnel System, Employee Self Service (NYCAPS/ESS) website (including essential tax forms) would be limited.

That action also came after the city’s largest agency, the Department of Education, sent an email to its employees on March 23rd, warning about “a new smishing” or SMS phishing campaign “targeting users of NYCAPS/ESS.”

“This (is) a user education issue to not fall prey to these scams, but the real site is antique & easily cloned,” said Naveed Hasan, a technology consultant and member of the city’s Panel for Education Policy.

Dave Ratner, CEO, HYAS had this to say:

   “Smishing campaigns are becoming more commonplace, in part because of our increasing reliance and familiarity with automated systems that generate text messages, and in part because the rise of AI makes it so much easier to generate accurate-looking fakes. This trend will unfortunately continue and there are only two good ways to address it. The first involves increased training, education, and communication; the second involves the use of highly accurate Protective DNS systems which are capable of separating malicious from legitimate sites on the Internet and ensuring that individuals are not accidentally fooled.”

I have long argued for the use of either multi-factor authentication, or better yet password less authentication to stop this sort of thing from happening. But either has to be combined with user education and better checks to ensure “smishing” isn’t a successful attack vector.