If there was any doubt that ransomware actors are in full attack mode, here are just some of my top recent fire drills:
May as well disconnect from the internet on holidays as it seems that you’re likely to get pwned.
Emily Phelps, Director, Cyware offered up this comment:
“Cybercriminals are largely opportunistic, seeking the path of least resistance to execute an attack. They know that holidays can be a prime time to take advantage of potentially decreased defenses. Before the holidays, consider security awareness training and increase authentication and access controls. Patch and update systems and ensure incident response and recovery plans are current. Communicate with partners and vendors to ensure they are also maintaining strong security practices during the holiday season. Vigilance is critical year-round, and organizations must take additional steps before the holidays to safeguard against opportunistic threat actors. “
Stephen Gates, Principal Security SME, Horizon3.ai had this comment:
“In the context of recent headlines about massive data breaches, disruption of life-saving medical services, and successful ransomware attacks against government, healthcare, finance, education, and so on, it’s a clear indication that organizations of all sizes and across all industries are losing the battle against their adversaries. From a simple, high-level observation, never in history have so many organizations – and the public at large – been impacted by the current onslaught of recent criminal activity. At this point, most would agree that the layer upon layer of cyber defenses commonly deployed to protect everyone are simply not working.
“Almost all organizations today have no idea where their truly exploitable vulnerabilities exist, and due to this fact, it is supercharging attacker campaigns. If organizations cannot find that hidden chink in their armor, that crack in their layered walls of defense, that blind spot they didn’t even know existed, they will never be able to adequately defend themselves against a purposeful attacker with nothing but time on their side – and money on their mind. It’s time to go on the offensive and attack yourself with the same tactics, techniques, and procedures attackers use so you can see your networks through the eyes of an attacker – before they do.”
David Ratner, CEO, HYAS Infosec follows with this:
“Attacks on critical infrastructure don’t only cause reputational and financial damage but have the ability to impact human life as well. It’s vital that critical infrastructure providers everywhere follow the guidance of CISA and others and implement appropriate solutions for operational resiliency and business continuity — this is the only way they can ensure continual service, have the confidence to operate their businesses, and ultimately protect human lives.
“All too often bad actors leave themselves hidden backdoors to continue to exploit an organization even after restoration and cleanup. It’s why service-assurance and continual monitoring post cleanup is so important. The best way to accomplish this is with visibility into the various traffic streams coming out of the enterprise, to properly identify bad actors communicating with their malware via command-and-control and shut it down before damage ensues.”
The fact that there are this many ransomware events shows just how out of control ransomware actors are. Clearly something needs to be done or else there’s going to be no hope for any of us.
Remember The Okta Hack Where They Explained It Only Impacted 1% Of Customers? It Was Actually 100% Of Customers.
Posted in Commentary with tags Okta on November 29, 2023 by itnerdOkta has released a new statement in relation to that hack that they had a while ago. At the time, they said it only affected 1% of customers. Well, that statement that I referred to one sentence ago says something different:
We have determined that the threat actor ran and downloaded a report that contained the names and email addresses of all Okta customer support system users. All Okta Workforce Identity Cloud (WIC) and Customer Identity Solution (CIS) customers are impacted except customers in our FedRamp High and DoD IL4 environments (these environments use a separate support system NOT accessed by the threat actor). The Auth0/CIC support case management system was also not impacted by this incident.
The threat actor ran a report on September 28, 2023 at 15:06 UTC that contained the following fields for each user in Okta’s customer support system:
The majority of the fields in the report are blank and the report does not include user credentials or sensitive personal data. For 99.6% of users in the report, the only contact information recorded is full name and email address.
Okta has around 18,000 customers according to the company’s website. So that’s a major problem for Okta. And an equally major problem for any Okta customer. And the fact that there’s no credentials in this report that the threat actors ran is irrelevant. A threat actor could still use this information to launch phishing attacks against any Okta customer to pwn them. Even if only 1% of those customers get pwned via a phishing attack or some other attack, it’s 1% too many.
Now to be fair, Okta does suggest the following mitigations be implemented ASAP:
We recommend all customers immediately take the following actions to defend against potential attacks that target their Okta administrators.
While all of this is good advice, it doesn’t change the fact that this event really reflects poorly on Okta and I am not sure how any Okta customer could ever trust the company again. Which means that Okta really has to explain why customers should trust them going forward. And they need to do it fast.
Leave a comment »