The White House’s Office of Management and Budget (OMB) stated that the federal agencies reported fewer cybersecurity incidents, representing an 8% decrease in 2019 compared to the previous year.
According to the annual report from the Federal Information Security Modernization Act (FISMA), released by the White House, government agencies in the U.S. reported 28,581 security incidents, compared to the 31,107 incidents reported in FY 2018.
Image Courtesy: www.whitehouse.gov
The FISMA report also included the results of 71 security audits of High-Value Assets (HVAs), critical systems deployed in various federal agencies. It stated that several critical systems used at government entities remain susceptible to cyberthreats like spear-phishing attacks. It is also found that these systems have poor patch management, password reuse, insecure default configuration, and weak password policies.
Top Attacks Reported in 2019
Image Courtesy: www.whitehouse.gov
Agencies had not identified an attack vector for close to 25% of all security incidents. “These assessments revealed that the Federal Government continues to face challenges mitigating basic security vulnerabilities,” the report said.
Major Security Incidents
According to the report, three major categories accounted for most of the incidents reported each year. The federal agencies witnessed a rise in brute-force attacks, security incidents executed with removable media (USB devices, external hard drives), and incidents caused by the improper use of a federal agency service or device. The three incidents include,
In January 2019, the Federal Emergency Management Agency (FEMA) inadvertently shared personally identifiable information (PII) of around 895,000 disaster survivors with a third-party volunteer organization without authorization
In June 2019, a ransomware attack impacted a license plate reader contractor used by the U.S. Customs and Border Protection (CBP) agency Attackers exfiltrated license plate images and facial images of drivers in their cars
In December 2019, DHS found that the FEMA continued sharing sensitive information of over 2.5 million hurricane survivors with a third-party contractor providing temporary shelter to victims, even after it was no longer necessary
Experts stated that the U.S. federal agencies improved their cybersecurity practices last year. According to the report, the agencies received over $17 billion in cybersecurity budgets, with most of the funds going to the Department of Defense (DOD) and the Department of Homeland Security (DHS).
Trouble is brewing for Minnesota state even in the cyberworld. In the past few days, the state has seen massive protests and rampant destruction by protestors who are upset by the death of George Floyd in police custody. But now hackers have also started attacking the state’s digital assets. The Star Tribunereports that hackers forced the Minnesota State Senate website to go offline in a series of DoS cyberattacks targeting the state’s computer systems. Other websites also experienced outages due to cyberattacks. And many state agencies were targeted.
A denial of service (DoS) attack sends a high amount of traffic to a server, making it inaccessible and unresponsive to new requests.
The Star Tribune quoted Secretary of the Senate Cal Ludeman, who wrote an e-mail to staff that the Senate’s server was “hacked and accessed for several minutes” starting at 4:24 a.m. Tuesday.
The email said: To rectify the problem and prevent the spread of the attack Senate Information Technology employees “took down the server as a precaution” and are working with the Minnesota IT Services and the FBI to trace what was accessed.
The Senate Wi-Fi password was compromised but login information for senators and staff were not accessed. The Wi-Fi password has since been reset.
According to Ludeman, the same hacker group targeted 10 state agencies, including the governor’s office, in recent days.
City of Minneapolis websites also experienced outages due to a cyberattack early Thursday morning. A city spokeswoman said there was no evidence of a data breach and that most of the sites were back online by 9 a.m. that day.
It is yet to be determined whether these cyberattacks are directly linked to the protests fuelled by the death of George Floyd. But in a weekend news conference, Gov. Tim Walz said that “a very sophisticated denial-of-service attack on all state computers was executed” as the state readied its response to riots on Saturday.
Security experts from Kaspersky have warned about a series of attacks targeted at distributors of equipment and software for industrial enterprises globally to steal Windows credentials. It is found that attackers are using phishing scams and steganography methods to hide malware on legitimate image and file resources.
In its report, Kaspersky stated that it identified a series of targeted attacks on organizations located in Japan, Italy, Germany, and the U.K. from May 2020. Hackers used malicious Microsoft Office documents, PowerShell scripts, and other sophisticated techniques like steganography to escape detection. While the ultimate goal of the attackers is unknown, Kaspersky stated that hackers used Mimikatz utility to steal the authentication data of Windows accounts stored on a compromised system.
“Phishing emails, used as the initial attack vector, were tailored and customized under the specific language for each specific victim. The malware used in this attack performed destructive activity only if the operating system had a localization that matched the language used in the phishing email,” researchers said.
Steganography
Steganography is an ancient practice of hiding secret content and text messages inside non-suspicious messages. Cybercriminals use this technique to hide malicious code within the image/audio/text file that is mainly employed by exploiting kits to hide their malvertising traffic. If the victim clicks the document, the script will execute and downloads the image hosted online which contains the malicious code.
Attack Chain
The phishing emails from attackers contain an urgent request to open the malicious attachment. Hackers send an Excel spreadsheet with a malicious macro or a malicious image (using Steganography technique) and ask users to enable active content, which triggers the malicious PowerShell script. The hidden malware will be executed when the user downloads the malicious excel sheet or the image.
Image Courtesy: Kaspersky
“The data is hidden in the image using steganographic techniques and is extracted by the malware from pixels defined by the algorithm. Using steganography enables the attackers to evade some security tools, including network traffic scanners. The data extracted from the image is consecutively encoded using the Base64 algorithm, encrypted with the RSA algorithm and encoded using Base64 again,” researchers added.
Preventive Measures
Kaspersky has also listed certain preventive measures to mitigate these kinds of attacks, these include:
Train employees at enterprises in using email securely and, specifically, in identifying phishing messages
Restrict macros in Microsoft Office documents
Restrict PowerShell script execution
Pay special attention to events of launching PowerShell processes initiated by Microsoft Office applications
Restrict the ability of programs to gain SeDebugPrivilege privileges
Install antivirus software with support for centrally managing the security policy on all systems; keep the antivirus databases and program modules of security solutions up to date
Use accounts with domain administrator privileges only when necessary. After using such accounts, restart the system on which the authentication was performed
Implement a password policy with password strength and regular password change requirements
If it is suspected that some systems are infected, scan these systems with antivirus software and force a change of passwords for all accounts that have been used to log on to compromised systems
Security researchers from vpnMentor discovered a massive data breach (estimated 7.26 million), which exposed records connected to India’s mobile payments app BHIM (Bharat Interface for Money). The website in question (www.cscbhim.in.) was developed by developed by a company called CSC e-Governance Services LTD. in partnership with the Indian government.
In vpnMentor’s investigation report, the researchers stated that the website is used to promote BHIM usage across India and to sign up new merchant businesses. BHIM app was launched by the non-profit business consortium, the National Payments Corporation of India (NPCI), to increase cashless transactions in India.
The data was exposed through a misconfigured Amazon Web Services (AWS) S3 storage bucket containing 409 GB of data. The website leaked sensitive profile and financial data, including names, dates of birth, age, gender, home address, caste status, Aadhaar card details, biometric details, profile photos, fingerprint scans, photos used as proof of residence, professional certificates, PAN numbers, ID numbers for government programs and social security services.
“The scale of the exposed data is extraordinary, affecting millions of people all over India and exposing them to potentially devastating fraud, theft, and attack from hackers and cybercriminals,” the researchers said.
NPCI Denies Data Leak
In a statement, the NPCI clarified that there was no data breach through the BHIM app. “We have come across some news reports which suggest data breach at BHIM App. We would like to clarify that there has been no data compromise at BHIM App and request everyone to not fall prey to such speculations. NPCI follows high level of security and an integrated approach to protect its infrastructure and continue to provide a robust payments ecosystem,” the NPCI said.
Security Incidents on Indian Firms
Recently, India-based online learning platform Unacademy suffered a data breach that exposed details of 22 million users. It was also found that the unknown hackers kept 21,909,707 user records for sale at $2,000 on darknet forums. The compromised information included usernames, hashed passwords, date of joining, last login date, account status, email addresses, first and last names, and other account profile details. Hemesh Singh, Co-founder and CTO of Unacademy, confirmed the data breach and stated that only 11 million users were affected and no sensitive information like financial data, location or passwords were exposed.
The new survey report from Information Systems Audit and Control Association (ISACA) states that organizations with understaffed cybersecurity roles and teams are less confident in their ability to respond to threats and are exposed to a greater number of cyberattacks.
The survey “The State of Cybersecurity 2020 Survey Report” revealed that only 21% of significantly understaffed respondents admitted that they are confident in their organization’s ability to respond to threats, while respondents who indicated that their enterprise was appropriately staffed to face threats have 50% confidence level . The survey also revealed that enterprises are struggling to fill security roles due to the time it takes to hire, leaving a majority of organizations (62%) understaffed. Around 35% of enterperises that take three months to hire security personnel reported an increase in attacks and 38% from those taking six months or more. In addition, 42% of organizations that are unable to fill open security positions are experiencing more attacks.
Most Reported Attack Types
According to the survey findings, most respondents believe that their organization will be hit by a cyberattack soon, with 53% thinking it is likely they will experience one in the next 12 months. Cyberattacks are also continuing to increase, with 32% of respondents reporting an increase in the number of attacks relative to a year ago.
The survey also listed the top attack types, which include social engineering (15%), advanced persistent threat (10%) and ransomware and unpatched systems (9%). It also stated that a majority of respondents believe that cybercrime remains underreported, with 62% of security professionals believing that enterprises are failing to report cybercrimes, even when they have a legal or contractual obligation to do so.
Only 30% of those surveyed use artificial intelligence and machine learning solutions as a direct part of their security operations for fighting the cyberattacks.
“These survey results confirm what many cybersecurity professionals have known for some time and in particular during this health crisis—that attacks have been increasing and are likely to impact their enterprise in the near term. It also reveals some hard truths our profession needs to face around the need for greater transparency and communication around these attacks,” said Ed Moyle, lead writer of the report.
“Security controls come down to three things—people, process and technology—and this research spotlights just how essential people are to a cybersecurity team. It is evident that cybersecurity hiring, and retention can have a very real impact on the security of enterprises. Cybersecurity teams need to think differently about talent, including seeking non-traditional candidates with diverse educational levels and experience,” said Sandy Silk, CISSP, Director of IT Security Education & Consulting, Harvard University, and ISACA cybersecurity expert.
Researchers at Promon, a cybersecurity firm better known for its in-app security protection, had earlier discovered a vulnerability in the Android operating system named “StrandHogg”. This vulnerability enabled cybercriminals to hijack legitimate apps and perform malicious operations. But having learned from its shortfalls, the StrandHogg 2.0 vulnerability now enables cybercriminals to hijack nearly any app running on Android 9.0 devices and below.
StrandHogg 2.0 Vulnerability
The Promon researchers found a new elevation of privilege vulnerability classified as “critical severity” (CVE-2020-0096) by Google. One of the reasons for its severity being termed as “critical” is because it allows cybercriminals to gain access to almost all apps. The earlier version of StrandHogg exploited the Android control setting ‘TaskAffinity’, which hijacked Android’s multitasking feature and, as a result, left behind traceable markers. However, this was worked around in StrandHogg 2.0 as it does not exploit the Android control setting ‘TaskAffinity’ and thus difficult to detect.
Image Source: Promon
The StrandHogg 2.0 vulnerability allows potential cybercriminals to take app controls and:
Listen and record user and phone call conversations through the microphone
Unknowingly take camera controls and click photos
Read and send SMSs
Exfiltrate users’ login credentials used in different mobile apps and accounts
Access and exfiltrate data files and photos from the device
Track device location and gain GPS information
Access the contacts list on the device
Access phone logs
StrandHogg 2.0 vulnerability is a severe threat as it could be exploited without gaining root access, however, it has not yet been exploited in the wild. Meanwhile, Android has already rolled out security patches for its Android ecosystem partners in April 2020 and was expected to apply the same to the current Android versions 8.0, 8.1, and 9.0 soon after.
Cybercriminals are known to leverage global phenomena for personal gain, be it the elections or the Olympic Games. And COVID-19 is no different. Scammers are using the pandemic to capitalize on a public scare that is already dire.
By Pooja Tikekar, Feature Writer at CISO MAG
Hackers are using social engineering tools to formulate phishing emails in the name of the World Health Organization (WHO) and other regulatory bodies to target vulnerable victims. These phishing emails contain documents with embedded links that result in malware and ransomware attacks.
Here are some of the COVID-19-themed cyberthreats:
1. CovidLock
The security team at DomainTools discovered a domain (coronavirusapp[.]site), which claims to have a real-time Coronavirus Tracker. It poses as a download site for an Android app that maps the spread of the virus across the globe. However, the app has a hidden ransomware application named “CovidLock” that threatens to delete contacts, pictures and videos on the victims’ device if a ransom of $100 in Bitcoin is not paid within 48 hours.
Image source: DomainTools
2. Dharma (CrySIS)
Dharma belongs to the family of CrySIS malware and was first discovered in 2016. The malware is distributed in malicious email attachments to deliver the payload. The payload is attached as an executable file by name “1covid.exe,” which begins to encrypt files after it is downloaded. The encrypted files have an extension called “.ncov” (supposedly Novel Coronavirus). It also drops a ransom note prompting users to write an email to “[email protected]” to restore their files.
Image source: Quick Heal
3. Emotet
The Emotet malware spam (malspam) emails contain a warning note and call to action for downloading a malicious Word doc attachment, which is said to contain precautionary health measures and latest updates related to Coronavirus. On opening the attachment and enabling macros in Office 365, an obfuscated VBA macro script begins to run in the background, which further installs a Powershell script and downloads the Emotet malware. The Emotet script also downloads a few other malicious payloads to extract additional data from the targeted system.
4. Maze
Maze ransomware was discovered in 2019, however, amid the Coronavirus crisis, it is used to target health care organizations. It threatens to publish patient records online, thereby putting the health care organizations at risk of the immediate violation of the General Data Protection Regulation (GDPR). According to DataBreaches.net, the operators of Maze ransomware attacked the London-based clinical testing firm Hammersmith Medicines Research, as it has volunteered its services to the U.K.’s National Health Service (NHS) and local medical practices to help test medical frontline staff for COVID-19.
Image source: Wikimedia Commons
5. REvil
Also known as Sodinokibi, the REvil ransomware operators are targeting managed service providers (MSPs) and local governments amid the pandemic. The operators scan the internet for vulnerable machines to deploy the malware payload through a Virtual Private Network (VPN). The operators targeted and infected California-based biotechnology company 10x Genomics to steal sensitive information, as the firm is part of an international alliance sequencing cells from patients who have recovered from the Coronavirus.
6. NetWalker
A variant of Mailto, the NetWalker ransomware targets home and corporate computer networks to encrypt the files it finds. It targets victims by sending phishing emails attached to execute the payload of the ransomware. Further, the file name “CORONAVIRUS_COVID-19.vbs” tricks users into executing it. Once the “vbscript” is executed, the ransomware is dropped in “C:\Users\<UserName>\AppData\Local\Temp\qeSw.exe.” The shadow copies are erased from the system, making safe file recovery difficult.
Image source: McAfee
7. Ginp
Kaspersky researchers have discovered the Ginp Banking Trojan that takes advantage of Android users to steal credit card credentials of potential victims. Once the Ginp is downloaded on the victims’ phone, the attacker sends a special command to the Trojan to open a web page titled “Coronavirus Finder.” The Coronavirus Finder web page displays the number of people infected with the virus near the victim’s location. It then asks them to pay 0.75 Euros to see the location of the virus-infected persons. If the victims agree to pay, the Trojan redirects them to a payment page, where the payment details need to be entered. Once the details are entered, the victims are neither charged, nor do they receive any information about the location of the infected persons. Instead, the credit card details of the victims are accessed.
Conclusion
These are dark times and scammers are taking full advantage of the pandemic to lure ordinary people into clicking on links related to COVID-19. It is essential to be cautious because one downloaded attachment or one click on the wrong link could lead to a disaster.
About the Author
Pooja Tikekaris a Feature Writer, and part of the editorial team at CISO MAG. She writes news and feature stories on cybersecurity trends.
Microsoft has warned organizations globally about a new type of data stealing Java-based ransomware dubbed “PonyFinal”. The tech giant described the malware as human-operated ransomware, which is distributed in an automated way by attackers.
“PonyFinal is a Java-based ransomware that is deployed in human-operated ransomware attacks. While Java-based ransomware are not unheard of, they are not as common as other threat file types. However, organizations should focus less on this payload and more on how it’s delivered,” Microsoft said in a post.
How Ponyfinal Attacks
According to Microsoft’s security intelligence team, PonyFinal ransomware encrypts files at a particular date and time by encrypting the files with .enc extension. The ransom note is a simple text filewhich gain access to a targeted organization via brute force attacks against the systems management server. It then deploys a VBScript to run a PowerShell reverse shell to perform data dumps and a remote manipulator system to bypass event logging.
“The PonyFinal ransomware is delivered through an MSI file that contains two batch files and the ransomware payload. UVNC_Install.bat creates a scheduled task named “Java Updater” and calls RunTask.bat, which runs the payload, PonyFinal.JAR. In certain cases, the attackers deploy Java Runtime Environment (JRE), which the Java-based PonyFinal ransomware needs to run. However, evidence suggests that attackers use information stolen from the systems management server to target endpoints with JRE already installed,” Microsoft added.
Building Pro-Active Security Helps Preventing Ransomware Attacks
According to the Microsoft Threat Protection Intelligence Team, cybercriminals have been using the ongoing COVID-19 outbreak to gain information from organizations to plan future attacks. The team said that they have observed multiple hacking groups activating dozens of ransomware deployments in the first two weeks of April 2020. Threat actors have reinvented their attack approaches during the. “These attacks can even be fatal, given their impact on aid organizations, medical billing companies, manufacturing, transport, government institutions and educational software providers. However, despite this global crisis, ransomware groups seem to give little regard to the critical services they impact,” Microsoft said in a post.
Cybersecurity research firm Cyble recently disclosed that threat actors kept details of 80,000 credit cards on the darknet forum for sale in exchange for cryptocurrency. It was found that the stolen credit card details include both Visa and MasterCard users from various countries, which include:
33,000 credit card details from the U.S.
14,000 from France
5,000 from the U.K.
2,000 from Canada
1,200 from Singapore
1,300 from India
According to Cyble, the exposed information included the name of the cardholder, CVV code, billing details, and expiration date, which were selling at $5 per card, and the money was paid in cryptocurrency. While the source of this massive stolen credit card database was unknown, the researchers stated that hackers might have stolen these details via a phishing website or by compromising an online store.
Snapshot of the data leak of credit cards
Image Courtesy: Cyble
“We report these breaches so people could be made aware of the threats and risks using these applications, and perhaps do something about it,” the researchers said in a statement.
Hackers Flood Dark Web with Leaked Databases
The discovery comes after Cyble recently identified and reported another massive data breach, in which the members of the “Shiny Hunters” hacking group compromised 73.2 million user records from over 11 companies and kept them on the darknet for sale. The hackers are from the same group who are behind the Tokopedia data breach, in which 91 million user records were compromised and kept on sale on the hacking forums for $5,000. Later, the group breached India-based online learning platform Unacademy, which exposed details of 22 million users and kept the records for sale on the darknet forums for $2,000.
Several incidents have been reported in recent times on hackers selling stolen information on the darknet markets. According to Cyble, attackers were also selling over 267 million Facebook records for £500 (US$623) on dark websites and hacker forums. The records contain information that could allow attackers to perform spear phishing or SMS attacks to steal credentials.
A new survey report from the Canadian Internet Registration Authority (CIRA) revealed that most Canadians refuse to provide their personal information to access free online services.
The report “2020 Canadians Deserve a Better Internet Report” disclosed that except online banking services (52%), most Canadians stated that they are unwilling to share their sensitive data for better products and services online. Only 26% of respondents admitted that they are willing to give personal information in return for better video streaming services. Around 23% of Canadians stated that they disclose personal details to use social media services and 15% are willing to share personal data for access to internet-connected devices like baby monitors.
“The survey result shows Canadians growing anxiety about cybersecurity-related issues, including a significant drop in their willingness to disclose personal information for better content and services online. In 2019, 72% of Canadians said they were willing to disclose some or a little personal information in exchange for valuable content or service. One year later, with the exception of online banking services, the vast majority of Canadians say they are unwilling to share their personal data in exchange for better online services,” the report said.
83% believe it is important that government data, including the personal information of Canadians, be stored, and transmitted in Canada only.
Seven in 10 are concerned about potential cybersecurity risks from foreign-owned network technologies.
74% have privacy or security concerns related to connected-home devices like Amazon’s Alexa or Google Home.
82% support a change in the Officer of the Privacy Commissioner’s legal authority that would give it powers to make orders and issue fines for companies who fail to comply with Canadian privacy law.
Over half of Canadians (54%) indicate that they definitely or probably came across fake news stories about Canadian politics or politicians in the lead up to, or during, the 2019 federal election.
16% indicate that they have used a fax machine to send documents to a government department or agency in the past year because it would not accept scanned documents by email.
“Many Canadians worry that the dangers online outweigh the benefits – especially when it comes to privacy. COVID-19 has shown us that going off the grid is no longer an option; digital forces are knocking on the front doors of our homes through new smart, internet-enabled technologies, and digital surveillance tools. The entire sector can work together and strike the right balance that provides the assurances Canadians need to ensure the internet remains a trusted part of their everyday lives,” said Byron Holland, President and CEO, CIRA.
Canada’s COVID-19 Cyber Defense Force
SecDev Group in Canada initiated a volunteer-based program wherein it called upon Canada’s top cybersecurity and IT professionals to join the COVID-19 Cyber Defense Force in order to protect the country’s key services and critical infrastructure from cyberattacks. The Group’s vision and mission include: No ransomware attack should close hospital operations; no cyberattacks should affect any patients’ treatment; and no form of essential services should be affected by any cyberattack
SecDev Group also collaborated with Zeropoint to provide VPN strategies and access control to governments and companies and help them adapt to cybersecurity monitoring to accommodate a workforce that is majorly working on distributed remote desktops from home.
Ensuring that you get the best experience is our only purpose for using cookies. If you wish to continue, please accept. You are welcome to provide a controlled consent by visiting the cookie settings. For any further queries or information, please see our privacy policy.
This website uses cookies to improve your experience while you navigate through the website. Out of these, the cookies that are categorized as necessary are stored on your browser as they are essential for the working of basic functionalities of the website. We also use third-party cookies that help us analyze and understand how you use this website. These cookies will be stored in your browser only with your consent. You also have the option to opt-out of these cookies. But opting out of some of these cookies may affect your browsing experience.
Necessary cookies are absolutely essential for the website to function properly. These cookies ensure basic functionalities and security features of the website, anonymously.
Cookie
Duration
Description
cookielawinfo-checkbox-analytics
11 months
This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Analytics".
cookielawinfo-checkbox-functional
11 months
The cookie is set by GDPR cookie consent to record the user consent for the cookies in the category "Functional".
cookielawinfo-checkbox-necessary
11 months
This cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Necessary".
cookielawinfo-checkbox-others
11 months
This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Other.
cookielawinfo-checkbox-performance
11 months
This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Performance".
viewed_cookie_policy
11 months
The cookie is set by the GDPR Cookie Consent plugin and is used to store whether or not user has consented to the use of cookies. It does not store any personal data.
Functional cookies help to perform certain functionalities like sharing the content of the website on social media platforms, collect feedbacks, and other third-party features.
Performance cookies are used to understand and analyze the key performance indexes of the website which helps in delivering a better user experience for the visitors.
Analytical cookies are used to understand how visitors interact with the website. These cookies help provide information on metrics the number of visitors, bounce rate, traffic source, etc.
Advertisement cookies are used to provide visitors with relevant ads and marketing campaigns. These cookies track visitors across websites and collect information to provide customized ads.
