Home Blog Page 127

“The battle for the vaccine market to launch cyberattacks has already begun”

Dmitry Volkov interview

As a first-year student at Russia’s leading engineering university, the Moscow State Technical University of N.E. Bauman, Dmitry Volkov co-founded Group-IB, a cyber investigations startup back then. Seventeen years on, the company has evolved into one of the cybersecurity leaders known for its engineering innovations. Group-IB now protects banks, industrial enterprises, and eCommerce giants in 60 countries around the world, and offers solutions in Threat and Fraud Hunting, Threat Intelligence & Attribution, and Digital Risk Protection categories. The company’s services, however, continue to play an important role in feeding the Group-IB Threat Hunting ecosystem, distributed across Singapore, Amsterdam, Hanoi, Moscow, Bahrain, and other locations, with unique battlefield cyberthreat intel.

Volkov is the mastermind behind most of Group-IB’s products. From day one, he has been a prominent voice leading Group-IB toward becoming the go-to expert in threat hunting and intelligence. His team successfully conducted the first and later on the most complicated cyber investigations and DFIR engagements. They have helped identify and track the most notorious threat actors, including Cobalt, Silence, MoneyTaker, Lazarus, etc.

Volkov is a recognized visionary leader. In 2015, he was listed by Business Insider as one of the top 7 professionals behind influential security companies. Dmitry is a great believer in the idea of engineering neutrality and advocate of cyber weapon non-proliferation. In 2013, Volkov became a member of the UN Open-ended Intergovernmental Expert Group aimed at conducting a comprehensive study on the problem of global cybercrime. Since 2016 he is a member of the Europol EC3 Advisory Group on Internet Security.

In a recent interview with Augustin Kurian from CISO MAG, Volkov talks about cybersecurity trends in 2021, espionage attacks, and how various scammers are discussing these topics like vaccines on the dark web.

What according to you will continue to be a cybersecurity trend even in 2021?

I’m sure that next year we will see even more ransomware operators joining Big Game Hunting, which refers to the attacks on big companies with huge assets that are more likely to pay the ransom. With large companies continuing to make some primitive errors, like failure to promptly update the software to patch vulnerabilities or the use of weak passwords, they are still an easy target for ransomware operators. The above also explains the continuous growth of the market for the sale of access to corporate networks, which, according to Group-IB forecasts, will continue increasing the following year.

Next year, in the light of rising tensions in MEA, Group-IB expects to see more sabotage campaigns by state-sponsored threat actors in the region. This might lead to dire consequences since intelligence agencies are attacking more aggressively. Their goal is now not only to spy on targets covertly but also to destroy critical infrastructure facilities.

The year 2021 is also likely to bring more attacks with the use of JS-sniffers and POS malware, intending to gather bank card data (text data and data of bank card magnetic strips) that pose a major threat to online retail, especially in the U.S. JS-sniffers, which once were a seldom-studied type of malware, has become a mainstream tool for cybercriminals who make their living selling stolen textual data from bank cards. Only from H2 2019 to H1 2020, the number of known JS-sniffer families has grown from 38 to 96, while the techniques that prevent JS-sniffers from being detected on web resources have improved greatly.

It is safe to say that the COVID-19 vaccine may take a fair share of the limelight in 2021. Do you think there would be an uptick in the number of phishing and ransomware attacks surrounding the same?

Threat actors always exploit hot topics in their attacks and the vaccine will be no exception. Therefore, we are likely to see a lot of phishing emails and scams surrounding this subject. Already, we see various scammers discussing these topics on the dark web, though, not very actively.

This year, several countries, including the U.S., admitted they were being targeted by state-sponsored espionage attacks surrounding vaccine development. With the varying success rate of different vaccines across the world, do you anticipate a surge in corporate espionage in 2021?

Espionage is always on the rise: new groups appear every year and old groups whose activities remained undetected are uncovered; tools and instruments to carry out the attacks are constantly being improved, and we see that state-sponsored attackers are only getting stronger. In the future, state-sponsored threat actors are likely to engage ordinary cybercriminals purchasing access to corporate networks from them or recruiting them for espionage activities, which will lead to an even greater increase in spying. As I’ve already mentioned, the battle for the vaccine market has already begun, and we expect espionage around vaccine-related organizations to grow further.

In your recent report on cybercrime, Group-IB stated that it identified a continuing trend where physical destruction of infrastructure is replacing espionage. It also highlighted that seven new APT groups joined the global intelligence service stand-off. Can you share more details about it? And how big of a concern is it?

It would be correct to say that the attackers’ focus has shifted from only espionage to spying with subsequent sabotage, or physical destruction of infrastructure. To sabotage effectively, one must first gain access to a target network, do reconnaissance in the victim network, and obtain desirable resources. Only advanced nation-state attackers can carry out effective sabotage operations, with such campaigns being prepared for years. Since the results of sabotage campaigns become visible immediately, attackers normally reveal themselves as a last resort and only in hot spots. It’s not worth explaining that such attacks can lead to colossal losses. Sabotage campaigns that we see today should be regarded as only a rehearsal, and judging from it, critical infrastructure facilities are not ready for a situation where such attacks become a general problem, given the constant growth of the number of state-sponsored Advanced Persistent Threat (APT) groups. It is noteworthy that sometimes cybersecurity researchers notice new APT groups only several years after it began their activity, which underlines how sophisticated these threat actors are.

By 2021, 5G will be widely available, and the floodgates will open, and both the white hats and black hats of the world will experience a swift learning curve in navigating the mass distribution and interconnectivity of 5G. What strategies should companies deploy to circumvent this impending threat landscape?

The architectural features of 5G (compared to 1/2/3/4G), such as superfast data transfers and other advantages of the new technology, are mainly implemented using software rather than hardware platforms. It means that all threats to server and software solutions are becoming relevant to 5G network operators. Such threats, including traffic manipulation and DDoS attacks, might become much more frequent and effective due to the large number of insecure devices connected and wide bandwidth. I would, therefore, highlight three main points regarding the issue by the priority. The first one is research: it is necessary to invest as much as possible in 5G security research. The second one is the inventory. Connected devices are very often vulnerable, and it is necessary to create a system to identify all new devices and monitor their status. Currently, existing solutions do not solve this problem well. The third one is protection. I would keep this issue open because this is a necessary phase, but it is unique for each organization.

From the standpoint of a zero-trust model, do you think it should be standard and by-design for the future?

This model can and must become the standard. We see more and more companies in the corporate sector building their cybersecurity in accordance with the zero-trust model, which confirms its viability.

Augustin Kurian

About the Author 

Augustin Kurian is part of the editorial team at CISO MAG and writes interviews and features.

This interview first appeared in the January 2021 issue of CISO MAG. Get your preview here.
Subscribe now!

Strengthen Your Cloud! CISA Warns Organizations Amid Rising Attacks

Misconfigured Cloud Storage Services Led to Over 200 Breaches in Past Two Years

The Cybersecurity and Infrastructure Security Agency (CISA) has advised users and organizations to strengthen their cloud security configurations after detecting multiple attacks targeting cloud services. In a security advisory, the agency stated that cybercriminals used advanced phishing and other attack vectors to exploit poorly configured cloud services.

Brute Force and Pass-the-Cookie Attacks

CISA claimed that attackers leveraged a variety of tactics and techniques, including phishing, brute force login attempts, and pass-the-cookie attacks to exploit loopholes in an organization’s cloud security practices.

In Pass-the-Cookie attack technique, the attacker compromises the cookies to gain unrestricted access to the victim’s resources. Even multi-factor authentication can be bypassed using this technique.

“These types of attacks frequently occurred when victim organizations’ employees worked remotely and used a mixture of corporate laptops and personal devices to access their respective cloud services. Despite the use of security tools, affected organizations typically had weak cyber hygiene practices that allowed threat actors to conduct successful attacks,” CISA said.

CISA’s Observations

  • In several engagements, CISA observed threat actors collecting sensitive information by taking advantage of email forwarding rules, which users had set up to forward work emails to their personal email accounts.
  • CISA determined that the malicious actors modified an existing email rule on a user’s account—originally set by the user to forward emails sent from a certain sender to a personal account—to redirect the emails to an account controlled by the actors. The adversaries updated the rule to forward all email to their accounts.
  • Attackers also modified existing rules to search users’ email messages (subject and body) for several finance-related keywords (which contained spelling mistakes) and forward the emails to their accounts.
  • In addition to modifying existing user email rules, they created new mailbox rules that forwarded certain messages received by the users (specifically, messages with certain phishing-related keywords) to the legitimate users’ Really Simple Syndication (RSS) Feeds or RSS Subscriptions folder in a bid to prevent legitimate users from seeing the warnings.

How to Mitigate?

CISA also recommended certain security steps for organizations to strengthen their cloud security practices. These include:

  • Implement conditional access (CA) policies based upon your organization’s needs.
  • Establish a baseline for normal network activity within your environment.
  • Routinely review both Active Directory sign-in logs and unified audit logs for anomalous activity.
  • Have a mitigation plan or procedures in place; understand when, how, and why to reset passwords and to revoke session tokens.
  • Verify that all cloud-based virtual machine instances with a public IP do not have open Remote Desktop Protocol (RDP) ports. Place any system with an open RDP port behind a firewall and require users to use a VPN to access it through the firewall.
  • Focus on awareness and training. Make employees aware of the threats—such as phishing scams—and how they are delivered. Additionally, provide users training on information security principles and techniques as well as overall emerging cybersecurity risks and vulnerabilities.
  • Establish blame-free employee reporting and ensure that employees know who to contact when they see suspicious activity or when they believe they have been a victim of a cyberattack. This will ensure that the proper established mitigation strategy can be employed quickly and efficiently.

Nokia for U.S. Federal 5G Cybersecurity Project

5g security, 5G cybersecurity

Post Huawei’s ban from deploying 5G communications equipment in countries like the U.S., Australia, Taiwan, the U.K., and others, Nokia has now claimed the throne to become the main 5G solutions provider in NCCoE’s 5G Cybersecurity Project.

Someone’s Loss is Someone’s Gain

In July 2019, several researchers found evidence of Huawei’s involvement with Chinese state-sponsored attackers. The incident proved to be the last straw in its worldwide ban. Owing to the ban, Huawei had to forfeit its deals, which included providing 5G communications equipment to a majority of developed countries. The claim of malpractices on Huawei’s end further strained the relationship between the U.S. and China, which eventually culminated in the form of a trade war.

Related News:

Huawei employing China-sponsored hackers: Research

However, the incidents did not do any good to either of the parties. Scrapping the deal resulted in monetary losses to Huawei and China, as some of its equipment was already shipped to the U.S. and for the U.S., the end deal meant a huge delay in shifting from the 4G to 5G technology. But the entire fiasco was an eye-opener for the U.S. Federal agencies. They took the cybersecurity concerns of the 5G technology very seriously and have now announced a host of collaborators for their 5G Cybersecurity Project including Nokia.

The 5G Cybersecurity Project

In November 2020, the National Cybersecurity Center of Excellence (NCCoE), a sub-department of the NIST, invited technology providers and industry experts AMI, AT&T, CableLabs, Cisco, Dell Inc., Intel, Keysight, MiTAC, Nokia, Palo Alto Networks, and T-Mobile to collaborate on the 5G Cybersecurity Project. These companies will help NCCoE’s 5G team to identify 5G use case scenarios and show how 5G architecture can provide security capabilities to mitigate identified risks and meet the compliance requirements.

Related News:

5G Networks Present New Risks and Security Challenges

The scope of the project is to leverage the 5G standardized security features which are defined in 3GPP standards to provide enhanced cybersecurity capabilities built into network equipment and end-user devices. The 5G Cybersecurity Project is currently in build phase and is based out on the following building blocks:

  • 5G security
  • Adversarial machine learning
  • Applied cryptography
  • Data security
  • Derived PIV credentials
  • Internet of things (IoT)
  • Mobile device security
  • Patching the enterprise
  • Supply chain assurance
  • Trusted cloud
  • Zero trust architecture (ZTA)

The Baton is Passed to Nokia

Strengthening their trust in their collaborators, the NCCoE has announced that Nokia is their main 5G solutions provider and collaborator. Nokia will partner with NCCoE’s 5G experts and other vendors to ensure a safe and secure transition from 4G to 5G networks.

Raghav Sahgal, President, Cloud and Network Services at Nokia said, “Previous cellular technology generations have been industry-led whereas 5G development must evolve in collaboration with governments to ensure availability and access of secure trusted networks. The 5G Cybersecurity Project fills this role with a cross-section of government and industry collaborators on board. At Nokia, we embed security into every solution that we ship, and we are committed to enabling the secure shift to the cloud by working with government agencies and the industry to advance cybersecurity for 5G use cases that leverage both open and commercial components.”

For improved 5G security, Nokia is also reportedly deploying their 5G RAN software and core solution along with IP-Backhaul for the project.

Microsoft’s First Patch Tuesday of 2021 is Here! Know Which Flaws are Fixed

Microsoft November 2021 Patch Tuesday, Windows 10, Microsoft PrintNightmare

Microsoft released the official patches for over 83 newly discovered vulnerabilities as part of its Patch Tuesday security updates, marking the first of many for 2021. The technology giant stated that the latest security updates address flaws in around 11 of Microsoft’s products and services, including an actively exploited zero-day vulnerability. Out of 83 vulnerabilities, 10 were listed as critical, and 73 as important in severity.

The January 2021 security release consists of security updates for the following software:

  • Microsoft Windows
  • Microsoft Edge (EdgeHTML-based)
  • Microsoft Office and Microsoft Office Services and Web Apps
  • Microsoft Windows Codecs Library
  • Visual Studio
  • SQL Server
  • Microsoft Malware Protection Engine
  • .NET Core
  • .NET Repository
  • ASP .NET
  • Azure

According to the release, the Remote Code Execution (RCE) flaw in Microsoft Defender (CVE-2021-1647) is listed as the most severe bug which could enable threat actors to infect qualified units with arbitrary code.

“According to Microsoft, this vulnerability was exploited in the wild as a zero-day, though no further details have been shared. Considering how prevalent Microsoft Defender is, this flaw provides attackers with a large attack surface. Microsoft also patched CVE-2021-1648, an elevation of privilege vulnerability in the printer driver host, splwow64 due to improper validation of user-supplied data. The vulnerability is marked as publicly disclosed by researchers at Google Project Zero and through the Zero Day Initiative. While it is labelled as an elevation of privilege vulnerability, Microsoft states that it can also be used for information disclosure,” said Satnam Narang, Staff Research Engineer at Tenable.

The latest patches also fix other critical bugs like a memory corruption flaw in Microsoft Edge Browser (CVE-2021-1705), a Windows Remote Desktop Protocol Core Security feature bypass flaw (CVE-2021-1674), and five critical RCE flaws in Remote Procedure Call Runtime.

How to Install the Latest Security Updates

“It is important to install the latest servicing stack update. Updates for Windows RT 8.1 and Microsoft Office RT software are only available via Windows Update. In addition to security changes for the vulnerabilities, updates include defense-in-depth updates to help improve security-related features. Customers running Windows 7, Windows Server 2008 R2, or Windows Server 2008 need to purchase the Extended Security Update to continue receiving security updates,” Microsoft said in a release.

Unprotected Server Exposes Scraped Data of 214 Mn Social Media Users

106 million Thailand visitors

Socialarks, a Chinese social media management company, recently suffered a massive data breach that exposed over 400GB of users’ personally identifiable information (PII).

According to the researchers from Safety Detectives, an unsecured ElasticSearch database leaked the personal data of over 214 million social media users, globally, including celebrities and social media influencers. The database was left online without password protection, allowing anyone in possession of the server IP-address to access it.

The researchers found that the exposed data was illegally scraped from various social media profiles on Facebook, Instagram, and LinkedIn.

What Data are Exposed?

While the researchers found 318 million records in the exposed 408GB data dump, the exact number of affected users remains unknown. The leaked database contains:

  • More than 11 million Instagram user profiles, including names, phone numbers, usernames, profile pictures, email addresses, average comment count, number of followers and following count; country of location, frequently used hashtags, and locations
  • Nearly 82 million Facebook profiles including full names, contact details, email addresses, Messenger IDs, Like, Follow and Rating count; Facebook link with profile pictures, website link, profile description, and pictures
  • Around 66 million LinkedIn user profiles containing full names, email addresses, employment details, job profile including job title and seniority level, LinkedIn profile link, user tags, domain name, connected social media account login names, company name, and revenue margin

What’s the Impact?

Cybercriminals often exploit scraped or leaked content for various malicious operations.  “In some cases, scraped data can be weaponized to carry out a specific goal of extracting personal information for criminal purposes. Potential ramifications of exposing personal information include identity theft and financial fraud conducted across other platforms including online banking. Contact information can be harnessed to target people with targeted scams including sending personalized emails containing other personal information about the target, thereby gaining their trust, and setting the stage for a deeper intrusion into their privacy,” Safety Detectives said.

What is Data Scraping?

Data scraping is extracting users’ private information from a website or social media platform without their knowledge, which is against the data privacy policy.

Artificial Intelligence and Cybersecurity: A Double-Edged Sword

Artificial Intelligence

As artificial intelligence (AI) becomes a hot topic, there is also an increasing amount of misinformation and confusion about what it can do and the potential risks it presents. The cultural legacy of decades of literature and film has depicted dystopian visions of human downfall at the feet of omniscient machines. On the other hand, many people understand the beneficial potential of AI to speed up and help the evolution of our society. Although computer systems can learn, reason, and act, these behaviors are still in their early stages. Machine Learning (often abbreviated as ML) needs huge amounts of data even for just learning, translated into training or coaching depending on the function that is assigned to Artificial Intelligence. Allowing AI access to information and giving it full autonomy therefore carries serious risks that must be considered.

By Pierguido Iezzi, Cyber Security Director and co-founder of Swascan

The first risk of artificial intelligence is intrinsically linked to its creation. The human mind bears the ancestral burden of error. Accidental bias, or more simply, an error of the programmer or in the dataset, can generate a series of countless errors on the part of the AI. Incorrect design of artificial intelligence can also lead to over-or under-sizing of the computational system, with the effect of causing the machine to make unnecessarily complex decisions or bringing it to a halt. Providing for control systems such as human supervision and rigorously testing artificial intelligence systems can reduce these risks during the design stage. The decision-making capabilities of computing systems must be measured and evaluated to confirm that any biases or questionable decisions are quickly addressed and, if necessary, corrected. Although the risks described so far are based on unintentional errors and flaws in design and implementation, a different set of threats may arise if a person or an organization intentionally tries to exploit AI systems to their advantage as if they were a weapon in a crime.

Cybercrime perpetrators can ‘trick’ AI more easily than one might think, and ‘train’ it to use it to their advantage

Deceiving an AI system can be surprisingly easy. Cybercriminals can manipulate the data sets fed to the computer (data poisoning) to “train” the AI, making even minor changes to the control parameters. All in order to lead it in the desired direction. Using another approach, if the attackers are unable to access the datasets, tampering techniques could be exploited to force computational errors by the AI or to make it difficult to correctly identify the datasets. Even though checking the accuracy of data and inputs may not be feasible, if only for financial reasons, it would be desirable for professionals to make every effort to collect data from reliable and verified sources. Among the possible defensive countermeasures against possible hacking attempts, it is worth mentioning the addition of isolation functionalities of some segments or entire AI systems with automatic prevention mechanisms.

The power of Deepfakes

Cybercriminals can also use AI to make their attack or social engineering strategies more effective and efficient. Artificial intelligence can be provided with datasets on hacking activity in order to study which technique has proved most effective. All the strategies that cybercriminals are currently implementing could be dramatically improved by using AI. The other potential field of application of AI by criminal organizations consists of identifying new flaws in the code of software, apps, or sites. In this case, AI would provide criminal hackers with a list of potential points of attack, like a well-trained bloodhound.

And we should not forget the rising shadow of Deepfakes, maybe the next frontier of social engineering attacks. We should not forget what happened in 2019 in the U.K., where the CEO of a company was the victim of a purpose-built scam with a phone call based on an audio deepfake. Believing he was talking to his boss, the victim sent nearly $250,000 to the criminal hackers’ address without batting an eyelid. The phone call scam is, without a doubt, one of the most bizarre applications of deepfake technology.

However, as we have seen, it is one that can clearly be successfully and convincingly applied. So much so that the CEO who fell victim to the cyber-attack stated that he recognized his boss’ voice by its “slight German accent” and “melodic cadence.” As if that weren’t enough, sophisticated technology aside, the process behind building the fake audio is surprisingly simple. Criminal hackers need only modify machine learning technology to clone an individual’s voice, usually using spyware and devices that allow them to collect several hours of recordings of the victim speaking.

The more data they are able to collect — and the better the quality of the recordings — the more accurate and potentially damaging the voice cloning will be in practice. Once a voice pattern has been created, the AI goes to work “learning” to imitate the target. It will then use so-called generative adversary networks (GANs): those systems that continuously compete against each other where one creates a fake and the other tries to identify its flaws. With each new attempt, the algorithm is able to exponentially improve itself.

For high-profile targets this is not good news (think CEOs of large companies); their speeches are recorded online and shared via social media, while phone calls, interviews, and everyday conversations are relatively easy to obtain. With enough data, the level of accuracy achieved by deepfake audio files is as impressive as it is frightening, and criminals are able to make the AI say whatever they want.

The future of phishing?

Certainly, today phishing attacks remain very popular — and successful — with as many as 85% of organizations finding themselves targeted. However, one of the main reasons why deepfake audio could find the fertile ground is its ability to evade most classical security measures. On the other hand, these AI-generated calls depend solely on human error and trust… and that’s what makes them potentially so dangerous. If we add to this the fact that, even the smartphones we keep on hand at all times, are not as secure as we think, it is not hard to see a multitude of ways in which cyber attackers could bypass our defenses.

There are two main obstacles, in my opinion, to the massive spread of this technology at the moment. The first is that it hasn’t yet climbed to the top of the cost-benefit ratio: a botnet sending phishing emails is capable of sending millions of emails in a short period of time. Deepfake audio requires time to study the target and processing time. In the same time frame, classic criminal hacking methods are able to yield more. The second is that, although it is true that AI-driven cybersecurity measures capable of recognizing the patterns of a deepfake are still at an experimental stage, there is already a very analog method of defeating the threat: if you are not sure, just hang up.

Most deepfake scams are carried out with the use of a VoIP account, created to contact targets on behalf of criminal hackers. By calling back, victims should be able to tell immediately whether they were talking to a real person or not.

How to benefit from AI for corporate and personal security?

But it’s not all bad news, AI can be very effective in network monitoring and analysis. Such computational systems have proven to be surprisingly efficient in detecting ‘standard’ behavior and, consequently, in identifying possible anomalies. This capability could be employed, for example, in the analysis of server access logs or data traffic. By detecting intrusions in advance, there is a greater chance of minimizing damage. Initially, it may be useful to have AI systems report any anomalies and alert corporate IT departments for further investigation. AI continues on its path of constant improvement, and it is possible that in the near future it will have the capability to neutralize threats and prevent intrusions in real-time. Given the undeniable cybersecurity shortcomings of public and private sectors, AI can take over some of these oversight tasks, allowing qualified professionals (available in limited numbers) to focus on complex problems.

With companies constantly striving to cut costs, Artificial Intelligence is becoming more and more appealing, with the prospect of a not-too-distant replacement of “physical” cybersecurity staff. This transformation will bring undeniable benefits to businesses, in terms of results and cost-efficiency. But the most ambitious and knowledgeable operators in the industry need to plan a strategy now to reduce the potential risk of cyber-attacks using AI.

About the Author

Pierguido Iezzi Pierguido Iezzi is the Cyber Security Director and co-founder of Swascan with over 30 years of experience in the world of Cyber Security. With a degree in Information Sciences, he has had the opportunity to work nationally and internationally in large corporate contexts and in the largest multinationals as a Cyber Security representative. Author of several publications, he regularly collaborates as Author and Contributor to a number of newspapers and publications. Keynote speaker and testimonial at universities, national and international events.

Disclaimer

Views expressed in this article are personal. The facts, opinions, and language in the article do not reflect the views of CISO MAG and CISO MAG does not assume any responsibility or liability for the same.

What is an RDP attack?

remote desktop protocol (rdp)

Remote Desktop Protocol (RDP) attacks are becoming a nightmare for CISOs, CIOs, CTOs, and network administrators. They are an attack vector to enterprise networks. The year 2020 saw the biggest increase in RDP attacks, targeting U.S. companies. According to Cyware, RDP brute force attack attempts increased from 200,000 a day in January 2020 to 1.4 million a day by April 2020. Kaspersky Labs revealed that RDP attacks grew a massive 242% reaching 3.3 billion in 2020 compared to 2019. Blame the increase in RDP attacks on the Coronavirus and escalating cybercrime. As employees moved workstations from their offices to their homes in a short span of time, there wasn’t much time to reconfigure home networks and endpoints to establish multi-level security that’s inherent in enterprise networks. Knowing this, hackers took advantage and attacked remote endpoints to get into enterprise networks. According to Avast, ransomware attacks via RDP are increasing and often targeted at small and medium businesses.

What RDP attacks occurred in the past?

LabCorp (Laboratory Corp. of America) was hit by ransomware through an RDP attack in 2018. The ransomware infected thousands of PCs and almost 2,000 servers of this major medical testing facility. According to the Wall Street Journal report, the company was hit with a strain of ransomware known as SamSam. The hackers demanded $6,000 in bitcoin for each machine or $52,500 to unlock all encrypted devices, according to the alert from the National Health Information Sharing and Analysis Center, which coordinates health-industry responses to cyberattacks.

And earlier in the year, the Hartsfield-Jackson Atlanta International Airport, regarded as the world’s busiest by passenger traffic, was also hit by an attack involving SamSam.

In 2018, the Internet Crime Complaint Center (IC3) along with the U.S. Department of Homeland Security released an alert stating, “Remote administration tools, such as Remote Desktop Protocol (RDP), as an attack vector has been on the rise since mid-late 2016 with the rise of dark markets selling RDP Access.”

How do RDP attacks happen?

Microsoft software is used in over 90% of the world’s computers, and naturally, these have been widely targeted by hackers. We saw that with Internet Explorer, the Windows Operating systems released over the years, Windows Server software – and these days with Microsoft 365.

Microsoft introduced the Remote Desktop Protocol in 1996. Every Windows system since Windows XP uses RDP for remote connection. As employees became mobile and worked from different locations, there was a need to access corporate servers and workstations from remote locations. Two technologies emerged: VPN and RDP. But RDP is the more popular choice among users as it is built into Windows and offers more control of the host. An RDP client running on the user’s laptop or desktop (client) communicates with the RDP component on the server (host). And the communication between the two is encrypted (see illustration).

How does an RDP attack happen?

Ever since RDP was introduced, cybercriminals have been trying to hack into machines via this protocol – effectively launching a Windows RDP attack. RDP attacks continue to impact organizations worldwide to this day. Today, hackers are using RDP attacks to deploy ransomware and to lock up systems, severely crippling businesses – as in the LabCorp incident. These types of RDP attacks are becoming more common since they are lucrative.

RDP attacks occur through open RDP ports.

What is an RDP port?

A computer has hardware and software ports for communicating with other devices and services. Hardware ports are easier to understand as they are physical. Look at the sides of your laptop and you will see different hardware ports for connecting devices – USB ports, HDMI ports, the legacy VGA and Firewire (Apple);  Ethernet (network) port, display port, lightning connector (Apple), Thunderbolt (Apple), the power port, etc.

Software ports are logical channels to services on networks. For instance, websites are accessed through port 8080 (http), file transfer is port 20 or 21, and send email is port 25 (SMTP). These are defined by communication protocols that are followed by the industry – http, FTP, TCP/IP, and SMTP are protocols.

Here is an analogy. Cable TV offers hundreds of channels coming down to us on a single wire. But all these channels have separate communication paths in that wire. Those are like ports. Think of ports as communication channels.

There are thousands of services to access on networks – printing, FTP/file transfer, file sharing, remote access, etc. A port (and a unique port number) is designated for service.

You have ports for Remote Access as well, and often, these ports are unsecured and open for anyone to use. Hackers scan connected devices for open ports, and once they find these, they can access the endpoints. The endpoints are connected to the corporate network via TCP/IP and other protocols. So once the hacker gets into your connected endpoint (laptop, tablet, phone) – they can easily get into the corresponding network and deploy malware like ransomware.

Why use Remote Access?

The most common example of remote access today is your IT engineer logging into your laptop from a remote location to fix an issue. They would use remote connectivity software like AnyDesk or TeamViewer to do that. This is through RDP.

Another example is a traveling employee who may want to access some files stored on his office computer, which is thousands of miles away. The employee could use either VPN or RDP to do that.

How do you block an RDP attack?

Ports have default numbers. If you keep the RDP port to 3389 (default), then it is a security threat, since hackers know about this port. So, if you plan to open up RDP ports for Internet access, the first thing to do is change the default port number from 3389 to a number above 10000. Or, if you want to keep using port 3389, make sure the port is closed down after a remote access session.

Hackers use port scanning software to determine which ports are open on the targetted system. You can use this software to see all the open ports on your system — and close these ports. But the first thing to do is to change the default port number for RDP.

 Change the default port number

Follow these steps to change the RDP port:

  1. In Windows, go to Run –> Type: regedit to open the Registry Editor.
  2. Locate the following key:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\

3. In the right-hand pane, double-click on PortNumber.

4. Change the value to Decimal and specify the new port number between 1001 to 254535.

5. Click OK.

6. Close the registry editor and restart your computer.

Warning: Do not try this if you are unfamiliar with the Window Registry and registry editing. Get your system administrator to do this for you.

Check if port 3389 is open and listening

You may open port 3389 to connect to a computer remotely and may forget to close it after the session. Or another user may have done this on a shared device.

Here’s how you can check if the port is open and listening:

  1. Open PowerShell by going to Run –> powershell
  2. Run the following command: tnc 192.168.1.2 -port 3389
  3. In this command, replace the IP address 192.168.1.2 with your computer’s IP. Replace it with your router’s public IP if you have allowed public access to your computer through the router. The resulting value of TcpTestSucceeded should be True.

You can also check the port using the command prompt or CLI (command line interface), but we will not discuss this here, as it is beyond the scope of this article.

Alternately, use a port scanning or vulnerability scanning tool like CurrPorts (NirSoft) that will scan all ports and list which ones are open.

Close port 3389 (if open)

This can be done either through the command line or through a utility like CurrPorts (NirSoft).

RANSOMWARE

Exploiting RDP ports to deploy ransomware

If a hacker comprises your system via an open RDP Port 3389, to deploy malware or ransomware, they could do the following:

  • Install a process that starts encrypting all docs, pdf, jpg, and several other file formats into a secure RAR archive form. After that, they could delete the originals.
  • Install a Group Policy script that enables the Guest account, set an unknown password on it, and give it complete access to all administrative functions, including RDP.  The script can be set to run on any user’s login (all profiles), so disabling the Guest account would only hold until the next session when the admin logs in.
  • Lock the login screen for all users on the server with a ransomware scare tactic screen claiming to be from an authority like the FBI.  The ransom fee, an email address, and the mode of payment will be shown on that screen.
  • Uninstalled anti-virus and other security products.
  • Delete all backups online or on the system.
  • Disabled the F8 startup key to prevent booting into safe mode.
  • Turn off Shadow Copies on all shares – and delete the historical stored revisions of files.
  • Change other system configuration settings to make the system more vulnerable to attacks.

Well, this might shake one up, if they did not already know this! So, what are you waiting for? Close your open RDP port now!

Security policies & Best Practices

We also suggest a few more things to secure your systems:

  1. Use a secure VPN connection instead of RDP to access desktops remotely.
  2. Enforce the use of strong passwords and password change every 60 – 90 days.
  3. Set a threshold for password tries – the system should lock out the user after three failed login attempts (failed passwords).
  4. Change the default name of your Administrator account.
  5. Check your Group Policies frequently.
  6. Install all server patches and pay attention to Microsoft Patch Tuesday (Update Tuesday) announcements (and similar advisories).

Brian Pereira, CISO MAGAbout the Author

Brian Pereira is the Editor-in-Chief of CISO MAG. He has been writing on business technology concepts for the past 26 years and has achieved basic certifications in cloud computing (IBM) and cybersecurity (EC-Council).

What the Automotive Industry Needs to Learn from Nissan’s Cybersecurity Error

Nissan data breach

Flooring the accelerator of a secure vehicle is still a pipedream for many automakers. And the newest to join the bandwagon of data breaches due to frivolous errors was Nissan North America, when multiple code repositories became public, after the company left an exposed Git server protected with default credentials (Username: admin, Password: admin).

By Augustin Kurian

The trove contained 20 gigabytes of Git data, including data from:

  • Nissan NA Mobile apps
  • Nissan ASIST diagnostics tool
  • Dealer Business Systems / Dealer Portal
  • Internal core mobile library
  • Nissan/Infiniti NCAR/ICAR services
  • Client acquisition and retention tools
  • Market research tools
  • Vehicle logistics portal
  • NissanConnect

The code was discovered by a Swiss IT consultant and developer Tillie Kottmann, who also highlighted that the data was being offered on torrent links and Telegram groups.

Following the Tweets, Nissan acknowledged the exposure and said that an investigation was underway. “Nissan conducted an immediate investigation regarding improper access to proprietary company source code,” the company said. “We take this matter seriously and are confident that no personal data from consumers, dealers or employees were accessible with this security incident. The affected system has been secured, and we are confident that there is no information in the exposed source code that would put consumers or their vehicles at risk.” Nissan also stated that it took down the Git server, though certain reports indicated otherwise.

For the most part, the entire incident was an embarrassing security failure. And it is not just the fault of Nissan. Tillie Kottmann had earlier found a vulnerability with Mercedes when he could download more than 580 Git repositories containing the source code of onboard logic units (OLUs) installed in Mercedes vans. That’s not it. Earlier this year, a data breach affected 384,319 BMW customers in the U.K. The stolen database contained over 500,000 customer records dated between 2016 and 2018, affecting U.K. owners of other car manufacturers, including Honda, Mercedes, SEAT, and Hyundai in the U.K. The exposed information included surnames, email IDs, vehicle registration numbers, residential address, dealer names, car registration information, names of dealerships.

Habitual Offence for Automakers

Most of these incidents, and several others that haven’t been mentioned here, highlight the dire straits of cybersecurity among automakers. “Carmakers have sacrificed the security of scores of modern cars for the sake of convenience. And, with other methods of car theft also rife and the number of cars being stolen on the rise, manufacturers must do more to make their cars more secure,” suggests an earlier CISO MAG report.

Several manufacturers are desensitized toward cybersecurity. What several of them fail to understand is that cybersecurity is essential in the road ahead. Cyber hacks might cost the auto industry $24 billion within five years.

According to a study by Ponemon, nearly 30% of companies in the automotive segment do not have a proper cybersecurity team to handle their technology and security infrastructure, let alone secure smart cars. The state is so dire that many do not even engage a third-party vendor to secure the software in the connected cars.

“As more connected vehicles hit the roads, software vulnerabilities are becoming accessible to malicious hackers using cellular networks, Wi-Fi, and physical connections to exploit them,” data protection research group the Ponemon Institute said in the report. “Failure to address these risks might be a costly mistake, including the impact they may have on consumer confidence, personal privacy, and brand reputation.”

The study also pointed out that nearly 63% of all vehicle manufacturers do not even test half of their software, hardware, and other technology deployed in their vehicles. The study sampled 15,900 IT security practitioners and engineers in the automotive industry.

Connected Cars: An Insider Threat

In a time where cars are predicted to generate 25 gigabytes of data per hour, enterprises may need to consider connected cars as an insider threat due to their vulnerability to data theft. Cars come with connected features to pair your personal device for several purposes like hands-free driving, access to infotainment, GPS, and maps. Pairing devices like smartphones that carry sensitive data to a car’s network may pose a serious threat. The data under threat can be personal or belong to an enterprise because of COVID-19 and several employees accessing official emails on personal devices.

And often, information security heads are oblivious to the number of cloud apps in employee’s personal devices. In fact, according to a 2017 Symantec report, when most CISO/CIOs assumed employees in their organizations use up to 40 cloud apps on their devices (smartphones, tablets, laptops), in reality, the number neared 1,000. The volume of exposed data is massive. CISOs need to be more vigilant; else, they may see a shift in the ways data breaches occur. To ensure the prevention of data theft from insider threats through connected cars, organizations can do the following:

  • Train employees on safe pairing techniques of devices and cars.
  • Encourage employees to charge mobile devices through cigarette lighter and not the USB.
  • Encourage employees to implement various security measures like installing firewall, antivirus, and encryption software on employees’ devices.
  • Company-owned devices should be issued with mobile device management (MDM) software.
  • In case the device is lost, there should be a way to locate and lock the device, and if necessary, the device should be implanted with a kill switch.

Augustin Kurian

About the Author 

Augustin Kurian is part of the editorial team at CISO MAG and writes interviews and features.

 

EMA Cyberattack Update: Data Compromised Last Month Appears on the Dark Web

healthcare cybersecurity, Nucleus:13

Earlier in December 2020, the European Medicines Agency had reported a cyberattack that was targeted towards the COVID-19 vaccination data, which was submitted to the EU drugs regulator for emergency approval. EMA stated, “A limited number of documents belonging to third parties were unlawfully accessed.” However, the investigation was ongoing and in the latest update, EMA has notified that a certain set of documents breached during the cyberattack have now been leaked online on the dark web forums, potentially for sale.

The Breach Victims – Pfizer and BioNTech

In the official statement given by the EMA, it did not mention the third parties whose data was breached in the cyberattack but said: “The concerned companies have been informed.” However, a day later, Pfizer and BioNTech, in a joint statement, stated that EMA did inform them about the breach and alerted them of an “unlawful access” to their regulatory submission documents stored on EMA’s server. Back then, the drug manufacturer had said that no personal data of the participants taking part in the vaccine trial was compromised in the cyberattack.

Related News:

COVID Vaccine Frontrunner AstraZeneca Targeted by Suspected North Korean Threat Actors

EMA Admits Data Leak

Ever since the cyberattack took place in December 2020, EMA has been on the lookout for any markers and has thoroughly been investigating the extent of the leak. But Italian cybersecurity firm, Yarix, has now broken the news that the data leaked during the cyberattack was put on sale on the dark web.

The cyber intelligence team at Yarix has found the following piece of information:

  • The post entitled “Astonishing fraud! Evil Pfffizer! Fake vaccines!” was first published on a well-known underground forum on December 30, 2020, at 7:30 pm. (This was subsequently removed by the forum directors).
  • In addition to the link to download the leaked documents (which no longer is available), the post refers to a thread posted in another forum, which is published in the Russian language.
  • Having been removed, the post was re-posted at 15:25 hrs and to date is available on the dark web forum with new links and search files.
  • The leaked files are contained in a zip folder called “EMA_LEAKS.zip.” The total data is worth 4MB and has two archives and a text file, which has the zip files extraction password.
  • The two archives individually contain confidential documents divided into five folders and 50 files. The material in these files has references of the staff from EMA, Pfizer-BioNTech, and the European Commission.
  • It has extracts of confidential conversations between EMA staff and members of the European Commission, relating to the vaccine production, validation, and marketing process.
  • Additionally, the cybercriminal who has leaked the information has provided several screenshots and PDF documents that refer to EMA’s Eudralink portal, which is used for internal secure communications.

Yarix, however, stated, “There are no certain elements that allow confirming that the data recovered is only a part of the leak or if it actually includes all the data stolen in the breach. On the other hand, the intention behind the leak by cybercriminals is certain: that of causing significant damage to the reputation and credibility of EMA and Pfizer.”

Based on these new findings, EMA also stated,

Some of the unlawfully accessed documents related to COVID-19 medicines and vaccines belonging to third parties have been leaked on the internet. Necessary action is being taken by the law enforcement authorities. The Agency continues to fully support the criminal investigation into the data breach and to notify any additional entities and individuals whose documents and personal data may have been subject to unauthorized access.

Rolling out the COVID-19 vaccine is the need of the hour. The drug regulator was quick to inform that the European medicines regulatory network remained fully functional and timelines related to the evaluation and approval of COVID-19 medicines and vaccines are not being affected.

Related News:

Dr. Reddy’s Lab Attacked Days After India Approves Russia’s COVID-19 Vaccine Trial

Beware! Fake COVID-19 Vaccines Circulating on Dark Web

Five Phishing Baits You Need to Know [INFOGRAPHIC]

Phishing Campaign on FINRA

Protecting sensitive information from threat actors is a concern for both individuals and organizations. Despite their continuous efforts to secure digital assets, cybercriminals are outsmarting the security perimeters to break into corporate networks. A thoughtless action of a single employee can cost the company a fortune.

Apart from sending malicious email attachments, tricking users to click on fraudulent URLs, or making them enter login credentials in a fake form, adversaries are utilizing different phishing techniques to target unwitting users.

While threat actors are using advanced techniques in their phishing campaigns, individuals or employees must know about various other phishing scams and attack procedures.

About the Author

 

Rudra Srinivas is a Feature Writer and part of the editorial team at CISO MAG. He writes news and feature stories on cybersecurity trends.

1...126127128...410Page 127 of 410