Home Blog Page 214

UK’s Electricity Body Elexon Suffers Cyberattack

Elexon Cyberattack

The U.K.’s electricity middleman Elexon got a massive shock after the company suffered a cyberattack. The company’s internal systems were targeted in the attack. Elexon plays a key role in the balancing and settlement of the U.K. power system and has close ties with core power system programs and processes with the U.K. system operator.

The company in a statement said, “ELEXON’s internal IT systems have been impacted by a cyber-attack. BSC Central Systems and EMR are currently unaffected and working as normal. The attack is to our internal IT systems and ELEXON’s laptops only. We are currently working hard to resolve this. However, please be aware that at the moment we are unable to send or receive any emails.” In an ensuing statement, it added,  “We have now identified the root cause and we are taking steps to restore our internal IT systems.  BSC Central Systems (and their data) and EMR remain unaffected and are continuing to work as normal.”

The incident can be classified under the umbrella of an attack on the critical sector, as Elexon is also responsible for settling payments between generators, suppliers and traders, as well as handles EMR payments – government contracts for difference (CfDs) for renewable generators. It also works very closely with the National Grid ESO. In simpler words, Elexon is among the key companies that ensure the lights in the U.K. stay on.

To detail, Elexon calculates the volume of electricity produced by a certain power station against the quantity sold by the electricity suppliers. These are then compared with the organizations contractual numbers of production and selling of electricity.

Since Elexon’s operations have nothing to do with the actual power grid functioning, zero impact to power supplies was registered. This was also later confirmed by the National Grid ESO’s tweet, “We’re aware of a cyber-attack on ELEXON’s internal IT systems. We’re investigating any potential impact on our own IT networks. Electricity supply is not affected. We have robust cybersecurity measures across our IT and operational infrastructure to protect against cyber threats.”

This is not the first incident where critical U.K. body has been affected by a cyberattack. Earlier this year, the U.K.’s Financial Conduct Authority (FCA) apologized after it accidentally exposed the confidential details of around 1,600 consumers who complained against it.

U.K. Suffers Cyber Readiness Deficiency

Both the incidents highlight a trend of lack of cyber readiness among U.K. organizations. According to a survey from data security firm Clearswift, around 70% of financial firms in the U.K. reported security incidents in 2019, in which half of the incidents occurred due to internal errors. The research, which surveyed 100 senior business decision-makers from financial organizations in the U.K., highlighted that most of the attacks have originated due to employees who failed to follow proper data protection policies. Apart from employees’ errors, the survey also revealed other reasons that led to attacks, including downloads of malware or viruses from third-party devices like USBs, and file transfers to unsecured sources.

A Joint Analysis Reveals APT Group Spying Activities

Compromised Email Accounts

A joint analysis by digital security products provider Avast and internet security company ESET evaluated the samples used by an APT threat group targeting Central Asian companies and institutions. It found that the APT group allegedly spied on a telecommunications company, a gas company, and a governmental agency in Central Asia.

The analysis revealed that the group planted backdoors to gain access to corporate networks. It is suspected that the APT group was also behind the attacks in Mongolia, Russia, and Belarus. The implanted backdoors permitted threat actors to manipulate and delete files, take screenshots, alter processes, services, execute console commands, and exfiltrate data to a C&C server.

According to Avast, the group also used backdoor tools like Gh0st RAT and management instrumentation to move laterally within infiltrated networks. Gh0st RAT is a popular backdoor associated with East-Asian attackers. “It is commonly assumed that Gh0st RAT source code is widely available. Its presence is often indicated by a file named rastls.dll, using an export DLL name svchost.dll and containing a string Gh0st. A string uwqixgze} is used as a placeholder for the C&C domain,” Avast said in a report.

“Avast believes the group is from China, which has been known to be used by Chinese APT groups in the past and similarities in the code Avast analyzed and code recently analyzed in a campaign attributed to Chinese actors,” the report added.

Luigino Camastra, malware researcher at Avast, said, “The group behind the attack frequently recompiled their custom tools to avoid antivirus detection, which, in addition to the backdoors, included Mimikatz and Gh0st RAT. This has led to a large number of samples, with binaries often protected by VMProtect, making analysis more difficult. Based on what we have discovered and the fact that we were able to tie elements of these attacks back to attacks carried out on other countries, we assume this group is also targeting further countries.”

In a similar research, a threat intelligence team from Avast revealed that Adware (advertising-supported software) is responsible for 72% of all mobile malware and the remaining 28% related to banking Trojans, fake apps, lockers, and downloaders. Adware is a kind of software that hijacks mobile devices to spam the victim with unwanted ads.

Avast stated that Android adware is a rising issue with its number increased by 38% in the past year alone. Adware disguises itself in the form of gaming and entertainment apps to infect the devices when a user clicks on ads. These apps appear genuine while installing, but once opened, they start spamming the user with ads (mostly with malicious content). This happens when a user downloads apps that run stealthy activities without the user’s knowledge like downloading an encrypted .dex file in the background of a device.

 

Survey Finds 41% of Employees Use Personal Apps to Access Sensitive Company Data

Remote Work

Research by work management platform Wrike revealed that 41% of employees working remotely are accessing sensitive and confidential company information through unsecured personal applications, leaving valuable corporate data and trade secrets to cyber risks.

The research 2020 Remote Work Security Survey stated that while most companies are investing in remote work, security measures are not being communicated or used. Several remote workers are still taking risks while accessing corporate IP, primarily by using personal apps to share company data with clients and colleagues. This is adding further security concerns as many of these are likely to be less secure than corporate-issued ones.

According to research findings, 49% of employees don’t use a corporate VPN to access company data. One third (31%) of employees aren’t sure how their home network is encrypted. And 84% of respondents admitted that they understand common cybersecurity risks, while working with the company’s information. Employees at a young age are more likely to neglect guidelines than older ones when it comes to using personal apps to share corporate data, the survey revealed.

“Remote workers shouldn’t take security lightly during shelter-in-place initiatives. Even during challenging times, it’s important for companies to continue investing in secure collaborative platforms that protect corporate assets while keeping employees engaged, efficient, and safe,” said Andrew Filev, Wrike’s Founder and CEO.

Remote Workers Lack Cybersecurity Training

The surge in remote work brought a new wave of cyberattacks targeting remote workers. Several industry experts stated that the lack of cybersecurity training may increase cyber risks. A research from cybersecurity firm Promon found that 66% of remote workers in the U.K. haven’t been trained on cybersecurity in the past 12 months, whereas 77% said that they aren’t worried about the security while working remotely.

Around 61% said they are using personal devices when working from home. Cybercriminals are exploiting the current working conditions by carrying out COVID-19-related phishing campaigns and other malicious activities, the research stated. The findings are based on the responses from 2,000 remote workers in the U.K.

 

7 In 10 Financial Organizations Globally Have Suffered a Cyberattack

Financial Sector

A research from cybersecurity firm Keeper Security revealed that lack of cybersecurity resources and strategies lead to an increase in the number of cyberattacks on financial institutions. It is found that 69% of financial organizations globally have suffered a cyberattack in their lifetime. While half of the organizations reported experiencing an attack in the last 12 months.

In its report, “The Global State of Cybersecurity in Small and Medium-Sized Businesses,” Keeper Security revealed that security incidents on financial firms are increasing because most of the firms do not  have proper resources and strategies in place to protect themselves against cyber risks. Nearly 50% of organizations believe that they do not have sufficient budget to support strong cybersecurity posture and 47% do  not have a plan in place for responding to an attack. Only 39% of financial services firms believe their IT security posture is very effective.

Survey respondents admitted that cyberattacks are becoming more targeted (77%), severe (64%) and sophisticated (63%). According to the survey, data breaches in financial services resulted in an average of 7,095 customer and employee records lost or stolen and came with an average price tag of $1.06 million from the disruption of normal business operations. The findings are based on the responses from 2,391 IT security professionals in the U.S., U.K., and regions like DACH, Benelux and Scandinavia.

“The financial services sector is in the midst of a pivotal era of disruption, but transformation should not come at the expense of cybersecurity. As a highly regulated industry, it’s imperative that firms don’t let cybercriminals fill the gaps. Unfortunately, the majority of these businesses have already experienced a cyberattack and our research shows they’re still not going far enough to prevent the next one. The good news is there are easily-implemented solutions and strategies that enable financial institutions to transform securely,” said Darren Guccione, CEO and Co-Founder of Keeper.

Banking and Financial Sectors are Prime Target

A recent study from the cybersecurity firm Intsights revealed that the banking and financial sectors were hit with a constant stream of cyberattacks when compared to other sectors. According to the Intsights report titled, “Banking & Financial Services Cyber Threat Landscape”, around 25.7% of all malware attacks last year was targeted on banks and financial organizations. The study also exposed that the number of data breaches reported in Q1 2019 doubled to any of the quarters of 2018.

 

WeLeakData.Com Compromised, Hackers’ Private Messages Leaked

99% of Websites Are Prone to Cyberattacks Via JavaScript Plug-Ins: Report

A database of an infamous darknet forum called WeLeakData.com was breached, exposing private messages of malicious actors who used the site. Cybercriminals used WeLeakData.com for discussing, trading, and selling databases that are stolen during breaches and combo lists used in credential stuffing attacks.

According to cybersecurity firm Cyble, WeLeakData.com site was suddenly brought offline for unknown reasons in January 2020. It was rumored that the operator of this platform got arrested and that the forum database had been stolen or sold to another hacking group. A month after WeLeakData.com was closed, the content of its database, including hackers’ private messages were kept for sale on the dark web.

“Cyble researchers got the intelligence from the members of the forum that it was not the case though. The reputation of the forum is undoubtedly there and is seen as a competitor to RaidForums. The business model of the forum was quite straightforward- it was mainly a criminal forum that specializes in the trade of leaked databases and uses the third-party e-commerce platform Shoppy for membership upgrades,” Cyble said in a statement.

Cyble stated that its researchers managed to gain access to the WeLeakData.com’s database in April 2020, from a darknet market seller and identified information that belonged to forum’s members, which are mostly researchers, hackers, cybercriminals, and crackers. The researchers found information like email addresses, usernames, passwords, private messages, and IP addresses.

Cyble believes that the site was sold to a new member of the forum, however it was operated under a different domain name – leaksmarket.com, with the same content.

Earlier this year, the authorities of the FBI and the U.S. Department of Justice seized the domain “weleakinfo.com” for selling sensitive information that was hacked from other sources for the past three years. According to the official notice, WeLeakInfo sold more than 12 billion user records that included: names, usernames email addresses, phone numbers, and passwords for online accounts. The notice also claimed that WeLeakInfo provided its users with a search engine to access the data that was illicitly obtained from over 10,000 data breaches. The U.S. Department of Justice urged the public to help them in finding the website’s owners.

 

In a Sea of COVID-19 Tracer Apps Where Does Apple-Google Stand?

Apple and Google COVID tracing app

Toward the end of his recent webinar with CISO MAG, hacker, security researcher and CISO, Chris Roberts took questions from the audience on the security needs for contact-tracing apps surrounding the COVID-19 cases. He said, “I want to believe tracing apps will be amazing because it has a bigger purpose to serve. But it should also be clearly stated, what will be done to the data afterwards — post the COVID-19 situation.” His statement reverberates to the entire Apple cloud platform iCloud versus the FBI fiasco — privacy norms vs governance, and even the latest revision to Apple and Google’s latest automatic contact tracing proposal. Both Apple and Google have pledged to shut down the tracer apps as soon as the pandemic ends, after several complaints citing privacy concerns.

In the last joint COVID-19 notification effort, the technology giants refined its technical details along with the FAQ and have elaborated on the cryptography, Bluetooth communications, as well as the API framework for developers. According to the notification, among the methods used to contact trace is a system called exposure notification, where users will be informed if they have been exposed to an infected person. Exposure notification is part of the companies’ joint standard to accelerate adoption and interoperability. The companies have shared a library of reference code for both Android and iOS devices.

On the encryption front, Apple has stated that they have migrated to AES-based encryption, instead of the earlier used HMAC encryption. Apple noted that AES performed better in this application of the technology. Apart from that, both the companies also stressed on using temporary tracing keys, which are now randomly generated, making it difficult for attackers to reverse engineer how keys are derived. One of the other key advantages of the tracker apps by Apple and Google is faster rollout to the maximum number of people.

Several countries have touted for Apple-Google to be the staple format for contact tracing due to the reasons including:

  • Explicit user consent required
  • Doesn’t collect or use location data from your phone
  • Bluetooth beacons and keys don’t reveal user identity or location
  • User controls all data they want to share, and the decision to share it
  • People who test positive are not identified to other users, Google, or Apple
  • Will only be used for exposure notification by public health authorities for
  • COVID-19 pandemic management

Other reasons why Apple and Google appear to be the better ones in a sea of Coronavirus tracing apps are the transparency and quality. Currently, one of the largest downloaded COVID tracing app in the world is India’s Aarogya Setu app, which crossed the 100 million mark. However, the app received a skimpy two out of five points by the MIT Technology Review.

The review, which judges tracing apps on several parameters, gave two points to Aarogya Setu on benefits like useful data and deletion of data on time, while it lost on parameters like voluntary use, and transparency. The review also noted that India was the only democracy that has made the app mandatory for millions of people. Austria’s Stopp Corona App, Czech’s eRouska, Iceland’s Rakning C-19, Israel’s HaMagen, Italy’s Immuni, and Singapore’s Trace Together were among the apps that scored a perfect 5.

Uncertain Data Sharing Practices Keep Educational Organizations at Risk: Research

Uncertain Data Sharing Practices Keep Educational Organizations at Risk: Research

Weak data sharing security controls are keeping several organizations in the education sector at risk of data security incidents. A research from cybersecurity firm Netwrix revealed that the ongoing remote learning due to the COVID-19 pandemic is increasing the rate of cyberthreats.

The research, “2020 Data Risk & Security Report,” found that 82% of educational organizations don’t track data sharing. It is also found that employees at more than half of companies in the education sector use cloud applications to share sensitive data outside of IT control and knowledge.

Nearly 63% of organizations do not review data access permissions regularly and 24% of system administrators admitted to granting direct access upon user request. Around 28% of surveyed educational organizations had data outside of secure locations, which was left exposed for days (40%) or months (33%). The research stated that majority of educational organizations had weak data security controls even before the COVID-19 pandemic.

“The data storage stage turned out to be the most challenging stage for ensuring data protection. Nearly a quarter (24%) of organizations reported they had discovered data outside of secure locations, and it took them days (43%) or weeks (23%) to discover the incident. These figures represent the highest incident rate and the slowest detection time of all the stages,” a statement read from the research report.

Other Notable Findings include:

  • 61%of organizations that are subject to the GDPR collect more customer data than the law permits.
  • 100% of organizations that have hired a Chief Data Officer (CDO) have implemented data discovery and classification processes.
  • 91% of organizations claim they store sensitive and regulated data only in secure locations, but 24% of them admitted they had discovered such data outside of designated locations in the past year.
  • 54% of organizations said that they do not follow the security best practice of reviewing user access rights to data on a regular basis
  • 46% of organizations that had an unauthorized data sharing incident are subject to the GDPR. However, 38% of them are confident that employees don’t bypass IT control to share data.
  • 30% of system administrators granted direct access to sensitive and regulated data based only on a user request in the past 12 months.
  • 66% of CIOs don’t have cybersecurity and risk KPIs that are regularly reported to their executives.
  • 82% of educational organizations don’t track data sharing at all or do it manually, and 50% of them suffered a data breach due to unauthorized data sharing last year.
  • 63% of educational organizations don’t review permissions regularly, and 24% of system administrators admitted to granting direct access rights upon user request.
  • 28% of respondents discovered data outside of secure locations, which is the highest number of all industries surveyed. This data was left exposed for days (40%) or months (33%).
  • Only 8% of respondents have developed cybersecurity and risk KPIs to evaluate their security posture and track success.

“Organizations are investing more than ever in cybersecurity, yet data breaches and other security incidents are continuing to increase in both number and size. First, while security professionals successfully mitigate security issues at some of the six stages of data lifecycle, they often overlook other stages, leaving their organization’s content vulnerable. In addition, security professionals generally know very little about what data they have, how sensitive it is, where it is stored, and who has access to it,” the statement added.

Top 5 CyberTech Trends in India in Times of COVID-19 [INFOGRAPHIC]

cybersecurity pressure

Cybersecurity news: While the world struggles with the impacts of COVID-19, cybercriminals see it as an opportunity. Since February, IBM X-Force has observed a 4,300 percent increase in coronavirus-themed spam. While organizations worry about newly pressing concerns—workforce well-being, shift to remote work, finance availability,  and the resiliency of operations and supply chains—cybersecurity focus is being overshadowed and risks are rising. IBM has identified 5 CyberTech trends that will impact India in times of COVID-19.

The tendency toward ad hoc decision making during crisis only accelerates the opportunity to exfiltrate data or compromise business operations. The potential impacts are more dangerous, too. A distributed denial-of-service (DDoS) attack, for instance, can be far more damaging in an operational environment that is already strained for capacity than one launched when additional capacity is readily available.

Security leaders from SMBs to large enterprises need to continue their focus on the entire threat lifecycle which constitutes planning and detection, in-the-moment response and remediation –recovery. This will help to prepare for additional unforeseen scenarios.

Prashant Bhatkal, Security Software Leader, IBM India South Asia, says, “As an organization we have been working  with our clients even before the pandemic to build their Cybersecurity Incident Response Plan.  With COVID-19, organizations who were prepared managed to sail through while organizations that were insufficiently prepared in normal times have been caught completely off guard. With threat landscape evolving every day and work from home being the new normal, threat actors are finding newer ways to disrupt businesses. Clients today are looking for CyberTech which can help protect their data, provide end-to-end security across multiple environments, new authentication methods, monitoring services and most importantly re-imagine their risk assessment.”

IBM India identified 5 CyberTech trends which will help security experts maintain constant vigilance and organizational agility across sectors like Manufacturing, BFSI, Telecom, Government, Healthcare, Auto, Retail etc.

Top 5 CyberTech trends in India in times of COVID-19
Source: IBM India

Research Finds Changes in Adversarial Cyber Activity

4 in 10 Organizations Struggle with SOC Staff Shortages: Report

Nuspire, a Managed Security Services Provider (MSSP), recently announced its “Quarterly Threat Landscape Report Q1 2020” that detailed the cybercriminal activities, tactics, techniques, and procedures (TTPs) during the first quarter of 2020. The research found that cybercriminals have been targeting known exploits in VPN, IoT, and authentication technologies. It also revealed that the vulnerability exploitation increased by 6.3% over the quarter and phishing attempts doubled to reach 141% over the last three months.

According to the research, there is a 7% increase in malware activity, with several dramatic spikes throughout the quarter. “As the world closed its doors and embraced the new normal, cybercriminals quickly adjusted their strategies to capitalize on the world’s changing behaviors, which has, undoubtedly, created new security challenges,” the research report said.

Other notable findings include:

  • A sharp increase in Executable and Linkable Format (ELF) variants targeting Internet of Things (IoT) devices with an attempt to further spread the Mirai Botnet this quarter. At its peak in Week 11, Nuspire observed an 86% increase in activity.
  • DoublePulsar, the exploit developed by the NSA and leaked by Shadow Brokers, continues to be the most utilized exploit (15,275,010 hits to be exact).
  • Emotet malware activity surged in Q1, peaking from March 1-7, a 1,317% increase in activity from its lowest point.
  • Necurs botnet activity sharply decreased after Microsoft disrupted the botnet in March. By March 8-15, the Necurs botnet went completely silent, as zero traffic was observed.
  • Although the command and control servers the Andromeda botnet operated on were shut down in 2017, it still remains the most frequently observed botnet. However, activity began to decrease at the beginning of Q1, decreasing by 58% by the end of the quarter.
  • Common themes of phishing campaigns seen throughout the quarter include IRS Tax documents, financial invoices, and COVID-19 information.
  • After the disclosure of the GhostCat exploit in Tomcat AJP protocol, Nuspire observed an uptick in exploit attempts demonstrating the importance of swift and responsive patching practices.

Top 10 Commonly Exploited Vulnerabilities Between 2016-2019

microsoft, flaws in SonicWall SRA SMA

The Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and the broader U.S. government released a list of the top ten commonly exploited security vulnerabilities between 2016 and 2019. The agencies issued a security alert (AA20-133A) through the National Cyber Awareness System (NCAS) to help security professionals in public and private organizations prioritize patching the most common vulnerabilities in their security environments. The alert provides details on Common Vulnerabilities and Exposures (CVEs) that are routinely exploited by foreign threat actors.

“The public and private sectors could degrade some foreign cyber threats to U.S. interests through an increased effort to patch their systems and implement programs to keep system patching up to date,” CISA said.

“A concerted campaign to patch these vulnerabilities would introduce friction into foreign adversaries’ operational tradecraft and force them to develop or acquire exploits that are more costly and less widely effective. A concerted patching campaign would also bolster network security by focusing scarce defensive resources on the observed activities of foreign adversaries,” CISA added.

The CVE list includes:

Vulnerability  

Associated Malware

 
CVE-2017-11882 Loki, FormBook, Pony/FAREIT
CVE-2017-0199

 

 FINSPY, LATENTBOT, Dridex
CVE-2017-5638

 

 JexBoss
CVE-2012-0158 Dridex
CVE-2019-0604 China Chopper
CVE-2017-0143 Multiple using the EternalSynergy and EternalBlue Exploit Kit
CVE-2018-4878 DOGCALL
CVE-2017-8759 FINSPY, FinFisher, WingBird
CVE-2015-1641 Toshliph, Uwarrior
CVE-2018-7600 Kitty

Data Source: us-cert.gov

Most Exploited Bugs

The alert stated that threat actors often exploited bugs in Microsoft’s Object Linking and Embedding (OLE) technology, with Apache Struts web framework being the second-most-reported vulnerable technology. “Of the top 10, the three vulnerabilities used most frequently across state-sponsored cyber actors from China, Iran, North Korea, and Russia are CVE-2017-11882, CVE-2017-0199, and CVE-2012-0158. All three of these vulnerabilities are related to Microsoft’s OLE technology,” CISA said.

Vulnerabilities Exploited in 2020

The U.S. government also reported vulnerabilities that are routinely exploited by state-sponsored actors in 2020, which include:

  • CVE-2019-19781 – An arbitrary code execution vulnerability in Citrix VPN appliances
  • CVE-2019-11510 – An arbitrary file reading vulnerability in Pulse Secure VPN servers, continues to be an attractive target for malicious actors.

Cybersecurity weaknesses like poor employee education on social engineering attacks and a lack of system recovery and contingency plans continue to make organizations susceptible to ransomware attacks in 2020.

“March 2020 brought an abrupt shift to work-from-home that necessitated, for many organizations, rapid deployment of cloud collaboration services, such as Microsoft Office 365 (O365). Malicious cyber actors are targeting organizations whose hasty deployment of Microsoft O365 may have led to oversights in security configurations and vulnerable to attack,” CISA added.

CISA and NCSC Release Joint Advisory

In a recent development, the cybersecurity officials in the U.K. National Cyber Security Centre (NCSC), the U.S. Department of Homeland Security (DHS), and the CISA stated that cybercriminals and advanced persistent threat (APT) groups are targeting individuals and organizations with a variety of ransomware and malware attacks, thereby exploiting the COVID-19 outbreak for their personal gain. The security agencies have released a joint advisory describing the growing number of attackers and other malicious groups in the U.K. and the U.S.

1...213214215...410Page 214 of 410