The IT Nerd

Github posted a security alert that warns its users of a social engineering campaign that is targeting developers:

GitHub has identified a low-volume social engineering campaign that targets the personal accounts of employees of technology firms, using a combination of repository invitations and malicious npm package dependencies. Many of these targeted accounts are connected to the blockchain, cryptocurrency, or online gambling sectors. A few targets were also associated with the cybersecurity sector. No GitHub or npm systems were compromised in this campaign.

And:

We assess with high confidence that this campaign is associated with a group operating in support of North Korean objectives, known as Jade Sleet by Microsoft Threat Intelligence and TraderTraitor by the U.S. Cybersecurity and Infrastructure Security Agency (CISA). Jade Sleet mostly targets users associated with cryptocurrency and other blockchain-related organizations, but also targets vendors used by those firms.

Ken Westin, Field CISO, Panther Labs has this comment:

As organizations move to the cloud, they are also building custom applications, this makes source code repositories as GitHub a hot target, as attackers can inject malicious code that enables them to not only compromise one organization, but multiple. 

It’s pretty clear that this is yet another new attack vector that threat actors are exploiting. Thus people who use GitHub and services like it need to be aware of this so that they aren’t compromised by said threat actors.

Mallox ransomware activities have seen a surge of almost 174% compared to the previous year. Unit 42 researchers have noticed this sharp increase, with the ransomware exploiting MS-SQL servers for distribution.

The group behind Mallox ransomware employs brute forcing, data exfiltration, and network scanners. Indications point to the group actively expanding its operations and recruiting affiliates on hacking forums.

Carol Volk, Executive with BullWall had this comment: 

Attackers will use all tools available to them, stacking every available vulnerability whether old or new as weapons to breach cyber defenses. Once in their sights a network breach is practically inevitable and we must prepare for it with a mindset of how to survive the breach, not simply defending against it.

The fact that this ransomware group is increasing their activities is yet another indicator of how dangerous the current threat landscape is. That means that anyone in the business of defending against these attacks needs to make sure that they are doing everything possible to make sure that they are not the next victim of this campaign.

The White House has announced U.S. Cyber Trust Mark, an Internet of Things (IoT) cybersecurity labeling program intended to provide consumers with measure of confidence when buying IOT devices. The FCC expects to roll out the program sometime in 2024.

The release said the initiative would “raise the bar for cybersecurity across common devices, including smart refrigerators, smart microwaves, smart televisions, smart climate control systems, smart fitness trackers, and more.” The U.S. Cyber Trust Mark will appear as a distinct shield logo on devices that meet specific cybersecurity criteria established by the National Institute of Standards and Technology (NIST). The NIST criteria will provide an extensive list of security criteria categories of protection and functionality that devices must meet to carry the Cyber Trust Mark, including requiring strong password, protecting stored data, allowing user configuration and offering regular security updates, to mention just a few requirements. The full list of standards is still being determined.

NIST will be prioritize high security risk devices such as home routers that are often abused by attackers to steal PII and construct botnets for launching DDoS attacks. These standards are expected to be completed in 2023.The FCC will also be providing a QR code that will link to a national registry of certified devices to provide security information for registered products.

I have two comments on this. The first is from George McGregor, VP, Approov:

 “This is a good initiative. Although the NIST guidelines make it clear that the IOT “product” must include all elements of the solution it would be good to see more specific security guidelines on the mobile apps which will almost always be part of an IOT solution. This is because mobile apps present specific security challenges which must be addressed in order to protect data and protect the device.”

The second comment is from David Mitchell, Chief Technical Officer, HYAS:

“The U.S. Cyber Trust Mark is a big step forward to deal with the ever-expanding market of sub-par IoT devices proliferating into our homes & businesses. It will be interesting to see how the vendors react and when and to what extent the EU and other allies participate. While there is no current language around retroactively certifying the millions of later model devices already in service, it is a key piece that needs to be understood.    

“Due to the additional workload required by the vendors to meet these criteria, it would not be surprising if there were cost increases for these devices — and hopefully not such a significant cost that consumers will decide to choose the non-certified devices.”

As always the Devil is in the detail. So I personally will wait until I see further detail on this before passing a final judgement. But this is a good move in my opinion. And I hope it forces companies to focus on making secure IoT products for consumers.

UPDATE: Allen Drennan, Co-Founder & Principal, Cordoniq adds this comment.

Many IoT devices were built using insecure protocols, and if they did implement transport layer security, these utilize outdated ciphers and hashes, or open source TLS modules that are also outdated and subject to hacking.  Ideally, as part of the cybersecurity initiatives it will be important to not only make sure all devices implement up to date TLS standards for communications, but are also required to frequently update their internal security stacks as new threats are discovered and need to be addressed. 

Another important aspect is the reliance on the UDP protocol for many IoT devices like thermostats, baby monitors, wireless cameras and more with most vendors not implementing current accepted security protocols such as DTLS for connectionless communications.  This area is seldomly addressed with most consumer products used today.

A recent article published by SC Magazine reported that cybercriminals have developed a generative AI tool called WormGPT which is designed to help grammatically challenged criminals craft convincing business email compromise (BEC) emails.

WormGPT promoters claim their product has zero ethical constraints and can spit out AI-created BEC content for urgently soliciting funds from targeted victims and also whip up customizable malware code, which makes it extremely nefarious.

Dan Shiebler, Head of Machine Learning at Abnormal Security had this comment:

“The most common Generative AI tools like ChatGPT, Google Bard, and Claude have explicit checks built in to prevent abuse and malicious use by threat actors. These checks cannot be avoided, because the tools work by sending users’ prompts to OpenAI (for ChatGPT), Google (for Bard) and Anthropic (for Claude), who then run the prompts through a series of checks in their models, before sending the output back to the user. Attackers can trick these checks, but it’s fairly difficult to do.Tools like WormGPT, on the other hand, use open source models like LLAMA and GPTJ. Users run these models by downloading them to their own computers, which allows them to remove the check process entirely – they don’t need to be particularly savvy or do any work to trick the checks, like they would with a tool like ChatGPT. This means there are no limits on the kind of content it could produce.GPTJ, which is what WormGPT is built on, has been around since 2021, so cybercriminals have likely already been using it for years.”

One of the ways that I teach people to spot BEC or phishing emails is to look out for the grammar. Or lack of it more precisely. With a tool like this, spotting BEC or phishing emails is going to get far harder. Which means that the success of these emails will go up which is bad for all of us.

In a study of 225 global financial services organizations, researchers with Comparitech found that ransomware attacks cost them in excess of $32.3 billion in downtime alone, over the past five years. Comparitech head of data research, Rebecca Moody explained that researchers used a 2017 study to calculate downtime costs of $8,662 per minute, noting however an ITIC 2017 study put estimated that figure in the millions per minute for the banking sector which would raise the estimate to over $581 billion.

• 225 confirmed ransomware attacks on financial organizations
• Ransom demands varied from $180,000 to $40 million w/ an average demand of $6.9 million
• Over 32.3 million individual records were breached
• Downtime varied from one day to 52 days – average downtime 10 to 14 days
• Insurance companies saw the highest number of attacks (65)

“If no specific figures were given for downtime, i.e. ‘several days,’ ‘one month’ or ‘back to 80% after 6 weeks’ were quoted, we created estimates from these figures based on the lowest figure they could be,” explained Moody.

Morten Gammelgard, EMEA, co-founder, BullWall had this comment:  

“It’s never just the amount of the ransom, but the overall cost of downtime and reputational loss that make ransomware so costly. Forewarned is forearmed and the expense of maintaining a solid cyber defense pales in comparison to the after-action cost of the entire event, whether the ransom is paid or not.  

“Data loss is one of the worst consequences of Ransomware and it is rare that companies are able to restore 100% of the data encrypted. This can lead to serious problems for businesses, such as the loss of customer data or confidential company information.”

The bottom line is that Ransomware is expensive. And the best way to not have to bear that expense is to pay whatever you have to to make sure that you have defences that mitigate the possibility that you will be the victim of ransomware.

The Biden-Harris Administration issued its National Cybersecurity Strategy Implementation Plan (NCSIP), which provides a detailed roadmap to achieving the National Cybersecurity Strategy. There’s a fact sheet available here that provides a brief outline:

President Biden has made clear that all Americans deserve the full benefits and potential of our digital future. The Biden-Harris Administration’s recently released National Cybersecurity Strategy calls for two fundamental shifts in how the United States allocates roles, responsibilities, and resources in cyberspace:

1. Ensuring that the biggest, most capable, and best-positioned entities – in the public and private sectors – assume a greater share of the burden for mitigating cyber risk
2. Increasing incentives to favor long-term investments into cybersecurity

Ani Chaudhuri, CEO, Dasera had this comment:

This new National Cybersecurity Strategy Implementation Plan (NCSIP) is a bold and essential step towards protecting our nation’s critical infrastructure, which is increasingly becoming the target of sophisticated cyber threats.

The NCSIP correctly places considerable emphasis on collaborative efforts between the public and private sectors. Such a partnership is absolutely necessary considering the crucial role that private corporations play in running vital components of our nation’s infrastructure, as well as housing a large share of our sensitive data.

However, I would like to challenge the primary emphasis on the responsibilities of the ‘biggest, most capable, and best-positioned entities.’ While these entities undoubtedly have a role to play, it’s crucial to remember that cybersecurity is not merely the domain of the large and powerful. Small and medium enterprises (SMEs), which constitute the vast majority of businesses and are often part of the supply chains of larger corporations, must also be equipped with the tools and knowledge to defend against cyber threats.

The plan also recognizes the importance of incentivizing long-term investments into cybersecurity. I wholeheartedly agree with this approach. Cybersecurity is not a one-time investment but an ongoing process that requires continuous updating, monitoring, and proactive measures. Long-term planning and investment will be more effective than reactive measures taken after an incident has already occurred.

Another crucial aspect of the plan I strongly agree with is the importance of training a skilled cyber workforce. Cybersecurity is not a static field. The nature of threats we face is continuously evolving, requiring us to constantly upgrade our knowledge and skills. Hence, it’s not just about creating more cybersecurity jobs, but about ensuring that those in these roles are equipped with the most up-to-date skills and knowledge.

However, despite the ambitious plan laid out, execution will be key. The question now is whether these policies will be implemented in a way that effectively reduces cyber risk. As a cybersecurity professional, I look forward to seeing these initiatives take shape and am hopeful about the impact they could have on our nation’s cyber defenses.

This plan moves the needle forward around critical infrastructure security and on efforts to disrupt threat actors.  However, from what I have read, it lacks any path to coordinated, standardized enforcement and leaves individual sector-specific agencies in control. But if that gets addressed, this plan will have significant value.

According to data collected by Recorded Future, the number of ransomware attacks targeting schools hit a record high in June, averaging more than one attack per day. There were 37 attacks against schools throughout June, compared to 24 attacks the previous month.

The surge was mostly the work of the Russia-based Clop ransomware group’s use of the vulnerability in the MOVEit file transfer tool. 

“Schools were really impacted by the Cl0P MOVEit attacks,” said Allan Liska, a ransomware expert at Recorded Future who is involved in tracking attacks. “Cl0p was responsible for 12 attacks against schools in June — almost one-in-three — and propelled school ransomware attacks to their worst month ever.”

Clop wasn’t the only active group ransomware group in June. Researchers noted that LockBit has been responsible for some of the worst recent attacks, including a major US dental insurance provider with 9 million leaked accounts, a water utility in Portugal, and the significant attack against U.K.’s Royal Mail.

“Clop accounts for a lot of the activity in June, but overall ransomware attacks have just been really bad,” Liska said. “There are more groups going after more targets and it is a never ending barrage of attacks.”

Willy Leichter, PV of Marketing, Cyware said this: 

   “Like many criminals, cyber attackers like to prey on the most vulnerable and least protected, such as schools, or small healthcare providers. Ransomware attacks on small organizations without robust security teams, or backup practices can be devastating. The bottom line is these groups will often pay ransoms out of necessity to keep their operations intact. As long as the financial incentive remains, ransomware will continue indefinitely.”

Hopefully schools and healthcare providers get the dollars that they need to protect themselves from ransomware attacks. Because there should not be any weak links to allow threat actors to flourish.

The CISA is warning of a severe (9.8 out of 10) vulnerability in Medtronic’s Paceart Optima software that runs on the healthcare organization’s Windows server which stores and retrieves cardiac device data from programmers and remote monitoring systems from all major cardiac device manufacturers.

Medtronic said the vulnerability is within the Paceart Optima software’s messaging service which allows healthcare organizations to send fax, email, and pager messages within the system.

Medtronic has not seen any exploitation of the bug so far but said in a security bulletin:  

“This vulnerability could result in a healthcare delivery organization’s Paceart Optima system’s cardiac device data being deleted, stolen, or modified, or the Paceart Optima system being used for further network penetration.”

Medtronic’s security bulletin includes immediate and temporary steps for healthcare delivery organizations and encourages those affected to work with Medtronic Paceart technical support to install an update to eliminate the vulnerability.

George McGregor, VP, Approov had this comment:

   “The Optima software aggregates and displays cardiac data collected from multiple sources so a vulnerability here can have major consequences.  But it is also important to evaluate the interplay of embedded devices such as insulin pumps, cardiac monitors and pacemakers and the associated mobile apps which are increasingly used to collect data and control the device.  A look at medical device manufacturer security advisories seems to suggest that this can be a major attack surface which must be protected.”

Roy Akerman, Co-Founder & CEO, Rezonate follows up with this:

   “Healthcare is constantly at the forefront dealing with an expanded attack surfaces – as in the case of the Optima software with a vulnerable MIoT (Medical Internet of Things). As RCE can be enabled if exploited, instant patching based on guidance provided by Medtronic is advised. Most often priority is defined based on exploitability, overall risk and impact, and access, in this case, when the risk may include deadly consequences, priority should be applied for an immediate patch and monitoring.”

Given how much we now rely on tech in healthcare, issues like these should not happen. Companies need to take more care to ensure that vulnerabilities like these aren’t threats to patient care.

Speaking at Infosecurity Europe, Munawar Valji, CISO of Trainline, Dr Emma Philpott, CEO at the IASME Consortium and Helen Rabe, CISO at the BBC were asked if there is an over reliance on security certifications. The panel agreed there are benefits but the processes designed to satisfy auditors or insurers potentially results in a less innovative and diverse workforce and can lead to organizations doing the bare minimum required to achieve certifications rather than improve security. 

“It can be time consuming and cumbersome to maintain,” says Rabe. “You have to figure out if controls are no longer relevant. It is not necessarily about certificates but obtaining the right outcomes,” Valji explained. 

In a separate panel, Charlie Sinclair, cyber security senior awareness and engagement manager at Unilever, and Tim Ward, CEO and co-founder at ThinkCyber explained the Nudge Theory, which uses easy, attractive, social and timely techniques to incentivize employees instead of punishing them for mistakes avoiding risky behavior and improving overall security. 

According to Ward, as many as 80% of security issues can come from just 10% of users. Sinclair pointed out that those users are usually “disconnected” from security issues, and they make mistakes and don’t tell anyone. “You need to focus on the psychology and how it works. You have to accept that humans bring risk and understand how to tackle that risk,” he said.

Willy Leichter, PV of Marketing, Cyware had this to say: 

   “Compliance requirements have been a major factor in making many organizations take security more seriously, but the typical check-box training program is out of date and inadequate. Rather than relying on online courses, real-world tests like mock phishing emails are more effective and impactful for users. But security teams can’t rely on training to keep them out of trouble – we have to assume there will always be susceptible users and design security that is resilient to insider mistakes.”

This kind of reminds me of the early 2000’s where everyone had a MCSE, but few people actually knew anything related to said MCSE. But employers would hire them anyway simply because of the fact that they had this certification. Given how high the stakes are when it comes to cybersecurity, we can’t afford to go back to those days because too much is on the line.

You’ve likely seen the news that threat actors are pwning people left and right via a vulnerability in the MOVEit file transfer software. But it now seems that there’s another vulnerability that is out there. This new vulnerability is tracked as CVE-2023-35708 and has put out a document on this vulnerability:

Progress has discovered a vulnerability in MOVEit Transfer that could lead to escalated privileges and potential unauthorized access to the environment. If you are a MOVEit Transfer customer, it is extremely important that you take immediate action as noted below in order to help protect your MOVEit Transfer environment. In Progress MOVEit Transfer versions released before 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6 (14.0.6), 2022.1.7 (14.1.7), 2023.0.3 (15.0.3), a SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an un-authenticated attacker to gain unauthorized access to the MOVEit Transfer database. An attacker could submit a crafted payload to a MOVEit Transfer application endpoint which could result in modification and disclosure of MOVEit database content.

And:

All MOVEit Transfer customers must take action and apply the patch to address the June 15th CVE-2023-35708 vulnerability discovered in MOVEit Transfer. 

So the good news is that patches are already out there that addresses this. But I’m going back to the bad news. If you use  MOVEit Cloud, this is the news that the company has for you:

Yesterday we reported the public posting of a new SQLi vulnerability that required us to take down HTTPs traffic for MOVEit Cloud and to ask MOVEit Transfer customers to take down their HTTP and HTTPs traffic to safeguard their environments. We have now tested and deployed a patch to MOVEit Cloud, returning it to full service across all cloud clusters. We have also shared this patch and the necessary deployment steps with all MOVEit Transfer customers. 

All MOVEit Transfer customers must apply the new patch, released on June 16. 2023. Details on steps to take can be found in the following Knowledge Base Article.

Yeah. This keeps getting better and better. It’s as if MOVEit is the gift that keeps on giving for threat actors.