The IT Nerd

New York City is the latest victim forced to take a city payroll website offline and remove it from public access for almost a week now after dealing with a smishing incident.

The website was partially taken offline following the smishing campaign that allegedly involved messages sent to city workers asking them to activate multi-factor authentication, with a link to a phishing domain.

It wasn’t till after being contacted by POLITICO, who first reported the incident last week, the city warned the roughly 300,000 full time workers of the phishing campaign, but they did not mention that access to the New York City Automated Personnel System, Employee Self Service (NYCAPS/ESS) website (including essential tax forms) would be limited.

That action also came after the city’s largest agency, the Department of Education, sent an email to its employees on March 23rd, warning about “a new smishing” or SMS phishing campaign “targeting users of NYCAPS/ESS.”

“This (is) a user education issue to not fall prey to these scams, but the real site is antique & easily cloned,” said Naveed Hasan, a technology consultant and member of the city’s Panel for Education Policy.

Dave Ratner, CEO, HYAS had this to say:

   “Smishing campaigns are becoming more commonplace, in part because of our increasing reliance and familiarity with automated systems that generate text messages, and in part because the rise of AI makes it so much easier to generate accurate-looking fakes. This trend will unfortunately continue and there are only two good ways to address it. The first involves increased training, education, and communication; the second involves the use of highly accurate Protective DNS systems which are capable of separating malicious from legitimate sites on the Internet and ensuring that individuals are not accidentally fooled.”

I have long argued for the use of either multi-factor authentication, or better yet password less authentication to stop this sort of thing from happening. But either has to be combined with user education and better checks to ensure “smishing” isn’t a successful attack vector.

Home Depot experienced a data breach by one of its SaaS vendors that inadvertently exposed employees’ data. The announcement came after increasingly notorious threat actor IntelBroker leaked the data of approximately 10,000 employees on BreachForum last Thursday. While the third-party vendor was testing their systems, the data exposed includes names, work email addresses and User IDs during.

“Today, I have uploaded the Homedepot.com database for you to download, thanks for reading and enjoy!” wrote IntelBroker on BreachForums.

Recently, IntelBroker has gained notoriety by breaching large organizations and government agencies such as DC Health Link, PandaBuy, Acuity, Hewlett Packard Enterprise and the Weee! grocery service, as well as an alleged breach of General Electric Aviation.

Stephen Gates, Principal Security SME, Horizon3.ai offered this comment:

   “It’s clear that traditional cybersecurity measures and approaches used in some third-party environments can fall short in identifying and mitigating exploitable risks effectively. Often, implementing and enforcing security best practices takes a back seat in smaller companies with smaller IT footprints. This is primarily due to not having dedicated security-focused personnel on staff, inadequate security budget, and leaders not fully understanding their risks.

   “Often, the mantra is, “We’re just a small software supplier. Why would anyone attack us?” These sorts of supply chain events are only going to grow, and today, supplier security posture management is becoming key to ensuring someone else’s risk does not transfer upstream to you.”

Dave Ratner, CEO, HYAS followed with this:

   “People need to realize that increasingly, the breach happens not because of lack of security in your organization but due to a breach in a SaaS application, third-party, or vendor in the supply chain.  It highlights the critical need for cyber resiliency approaches that not only assume breaches occur but have the visibility, capability, and controls to detect them early in the kill chain and stop them before data is leaked or damage occurs.”

Craig Harber, Security Evangelist: Open Systems had this comment:

   “The Home Depot data breach highlights the importance of companies implementing third-party risk management. To protect their customers, companies must implement consistent security standards across their entire business ecosystem to help mitigate cyber-attacks originating through partner and supplier systems.

   “Most modern businesses depend on third-party partners. Unfortunately, these partnerships introduce inherent risks because the resulting interconnected IT/business systems do not deliver the critical trust relationship to prevent supply chain attacks, data breaches, and reputation damage.

   “In this case, a SaaS vendor accidentally leaked the personally identifiable information (PII) of 10,000 employees. This information was exposed by a well-known threat actor, IntelBroker, on their data leak site. The attackers are likely to exploit this data for targeted phishing campaigns to gain credentials and infect Home Depot’s corporate network with ransomware.

   “To prevent further occurrences, security teams must implement consistent security standards across the entire business ecosystem, including all its subsidiaries’ IT/business systems. Consistent security practices include requiring prompt and regular patching of system vulnerabilities and implementing multi-factor authentication to prevent exploitation.”

Supply chain attacks are real and likely happen more often than you think. Thus you have to force the companies that you work with to be on the same page as you when it comes to security. Otherwise, pwnage through no fault of your own is never far away.

UPDATE: Paul Valente, CEO and Co-founder, VISO TRUST:

   “For many companies, third party risk is just a compliance checkbox.  Home Depot got lucky this time, but the incident highlights how companies need to do more to elevate third party risk management.  While some breaches are inevitable, using the latest AI-assisted TPRM approaches companies can avoid these types of breaches.”