Home Blog Page 274

RAT Attack: Double Whammy

A new malware recently surfaced with a very low detection rate and capability of delivering multiple Trojans to infect computers. The researchers from Fortinet found a sample file of a dropper that was flagged suspicious. Upon research, it was found that the new malware has the capability to drop both RevengeRAT and WSHRAT on systems running Windows.

This is double trouble in every sense. The dropper gets in action with a JavaScript code which contained a URL-encoded data, which the researchers later uncovered as VBScript code. According to Fortinet, “The author of this malware used simple character replacement when calling the “Chr()” function in an attempt to hide the actual strings (“shell.application” and “cmd /c cd %temp%”, respectively.”

According to the researchers, the objectives of the VBScript code are:

  1. Create a new Shell.Application object
  2. Call the ShellExecute() function, which eventually generates a new file with the hardcoded filename of “A6p.vbs”
  3. Execute the newly-created script file “A6p.vbs”
  4. Pause the CMD command execution for 13 seconds (by calling the timeout.exe program)
  5. Delete the script file “A6p.vbs”
  6. Execute the downloaded script file “Microsoft.vbs”
  7. Close the current/active window

The VBScript code then summons a Shell.Application which generates a new script file, which then fetches another payload (VBScript code) from an external source. The new string pulls a script Microsoft.vbs from a remote server and saves itself in the temp folder. The code is composed of the main class called “th3m41n” using three methods “dugh41r,” “t01l3t,” and “b3st1n”.

“Once the aforementioned code is executed, it creates a new WScript.Shell object and collects OS environment and hardcoded data, which will eventually end in running the newly created script (GXxdZDvzyH.vbs) by calling the VBScript interpreter with the “//B” parameter. This enables “batch-mode” and disables any potential warnings or alerts that can occur during execution,” researchers wrote. As the code is executed, a new key is added which is called Microsoft which stores the malformed base64-encoded data.

With the new key into the registry, commands are executed to bypass execution policies and the RAT payload is then deployed. Following the RevengeRAT attack IP addresses, usernames, machine data, CPU data, webcam access, information on firewall installations and antivirus are stolen. RevengeRAT is infamous and has been earlier deployed to steal data from financial firms, governments, and IT companies. But the buck doesn’t stop there.

The dropper also deploys another payload, a WSHRAT on the same script with a few changes. The second attack is the double whammy. The second payload which is the newest version of the WSHRAT, an infamous phishing tool, is capable of stealing information stored in browsers. It is also capable of remotely installing and uninstalling programs and several other methods of keylogging.

 

Symantec Fixes Code Execution Vulnerability

Symantec

A recent research conducted by Peleg Hadar, a Security Researcher at SafeBreach Labs, exposed a local code execution vulnerability in Symantec’s Endpoint Protection service. As per Hadar, this vulnerability allowed an attacker “to bypass Symantec’s self-defense mechanism and perform defense evasion, persistence and privilege escalation by loading an arbitrary unsigned DLL into a process that is signed by Symantec and that runs as NT AUTHORITY\SYSTEM.”

Symantec Endpoint Protection has a host of security software solutions on offer as per various business needs. At present, it has the largest market-share for any endpoint security product. Thus, to avoid vulnerability exploitation and subsequent monetary losses, Symantec was quick to fix this issue.

The vulnerability can now be tracked as CVE-2019-12758. It requires an attacker to have Administrator rights to successfully exploit the issue reported. The overall severity of these type of issues is generally set from medium to high. Symantec has ranked it as a medium severity problem with a CVSS base score of 3.4. In its description of this vulnerability, Symantec also said that failed attempts to execute this arbitrary code may lead to denial-of-service conditions. As a source of information to all its customers, Symantec listed the technologies affected by this vulnerability. Following is the complete list issued:

  • Symantec Endpoint Protection 11.0
  • Symantec Endpoint Protection 12.0
  • Symantec Endpoint Protection 12.1
  • Symantec Endpoint Protection 12.1.1
  • Symantec Endpoint Protection 12.1.2
  • Symantec Endpoint Protection 12.1.3
  • Symantec Endpoint Protection 12.1.4
  • Symantec Endpoint Protection 12.1.5
  • Symantec Endpoint Protection 12.1.6
  • Symantec Endpoint Protection 14.0
  • Symantec Endpoint Protection 14.2
  • Symantec Endpoint Protection 14.2 RU1

To remediate this issue, it has recommended all its customers to upgrade to Symantec Endpoint Protection 14.2 RU2. Symantec also issued a list of other precautionary measures to avoid attacks.

  • Restrict administrative access to authorized/privileged users.
  • Restrict remote access to trusted/authorized systems only.
  • Run under the principle of least privilege, wherever possible, limit the access privileges.
  • Keep all operating systems and applications updates with latest vendor patches.
  • Follow a multi-layered approach to security. At a minimum, run both firewall and anti-malware applications to provide multiple points of detection and protection for both inbound and outbound threats.
  • Deploy network and host-based intrusion detection systems (IDS) to monitor network traffic for signs of anomalous or suspicious activity. This may aid in the detection of attacks or malicious activity related to the exploitation of latent vulnerabilities.

“Observe the trinity of cybersecurity crisis communications: Forensics, Legal, Communications”

Michael Estevez, Executive Vice President, Managing Director and Cybersecurity Crisis Team Lead, BCW

In his role as an executive vice president/managing director in BCW’s New York Public Affairs & Crisis practice, Michael Estevez advises clients on crisis communications, issues management, litigation communications, and cybersecurity. Michael’s cybersecurity and privacy communications experience includes engagements on behalf of corporations, a U.S. defense contractor, an ivy league university, and government entities. He has advised organizations on matters related to cybersecurity crisis communications including media relations, employee communications, customer and stakeholder engagement, and public affairs.

Michael helps clients navigate complex crisis communications situations, enabling them to regain trust, repair stakeholder relationships and return focus to their core organizational mission. Drawing upon his experience in traditional public relations, political communications and digital media, he has extensive experience in helping clients to develop their reputational risk profile, anticipate crisis and risk scenarios, proactively stake out positions on critical issues and respond to crises. Michael has counseled corporate clients on CEO transitions, workplace health and safety issues, international intellectual property litigation, high-profile workplace violence incidents, unionization campaigns, and activist campaigns. His clients have included financial institutions, private equity firms, energy firms, pharmaceutical companies, medical device manufacturers, quick-serve restaurants, and consumer package goods companies.

Before joining BCW, Michael held a succession of positions with a specialization in public affairs and crisis communications. He was most recently with a boutique public affairs firm based in New Jersey, where he was Executive Vice President in charge of the firm’s operations. Prior to this, Michael held successive positions with firms based in New York City, where managed multinational crisis and issues management engagements for organizations including Samsung Electronics, Starbucks, PepsiCo, General Electric, Unilever, Yale University, Western Union and others.

In an email interview with Brian Pereira of CISO MAG Michael talks about strategies for managing cybersecurity reputation risk and communications best practices for handling breaches. He outlines what organizations need to do to be cybersecurity resilient. He also talks about BCW CyberTREE, a crisis communications and reputation management framework.

Cybersecurity threats continue to grow in volume and sophistication. However, managing cybersecurity reputation risk has not kept pace with the evolution of threats. What are you observing?

Nearly every relevant industry has rapidly evolved to meet the challenges of cybersecurity risk. In addition to information technology, insurance and law have most notably adopted industry best practices and standards.

We developed BCW CyberTREE because we saw a need for a crisis communications and reputation management framework that can align with any company’s incident response plan. It’s based on a careful review and analysis of our own cybersecurity crisis engagements with clients, as well as studying a cohort of high-profile cyber events.

The focus is to be an effective communications partner with the full CSIRT, especially forensics, legal and a company’s executive leadership team.

This is important because stakeholder opinions about how well a company managed a cyber event can be critical to resilience and recovery. This can include whether customers choose to continue doing business with you, how investment analysts view your ability to manage risk and whether prospective employees pursue career opportunities with you or a competitor.

What are the mistakes that most breached organizations are making? What are the gaps in communication and how does BCW CyberTREE help?

BCW CyberTREE is based upon three core principles that directly address the main gaps we’ve seen:

First, corporate reputation is essential to cybersecurity resilience. This means perceptions about how well a company responds to an incident can be as important as the technical response itself. It’s not enough to only restore your network’s integrity. You need to maintain – or rebuild – stakeholder trust. A client CEO once told me, ‘My network has no value if I lose all my customers.’

Second, cybersecurity crisis communications is a cross-functional CSIRT responsibility. Communications do its job effectively without cooperation from the CSIRT, and everyone – not only communications – should be focused on maintaining stakeholder trust and confidence throughout the incident.

And third, cybersecurity crisis communications strategy must account for facts and speculation. While the CSIRT is mainly focused on resilience and recovery, the communications team needs to focus on that as well as myriad hypothetical potential scenarios that may emerge.

What are the top 3 or 5 things that a breached organization should immediately do?

The cybersecurity crisis situations that I’ve seen end with the best outcomes have all been guided by a written plan that had been practiced by the full CSIRT using an interactive simulation platform like BCW PressurePoint.

Most plans have similar initial steps: (1) Send an internal alert from legal notifying CSIRT members that a legally privileged investigation is being initiated – this is also a signal to avoid using specific terms like “breach” that can have legal, and ultimately reputational, implications. (2) Call your cyber insurer. (3) Retain outside cybersecurity legal counsel. (4) Retain an independent forensic consultant. (5) Retain cyber crisis communications counsel.

The first things your cyber crisis communications consultant will do are to begin monitoring news and social media for chatter or potential leaks; prepare initial statements for news media in case of any inquiries and adapt them for social media in case of questions or comments; and, in the case of BCW, we will begin assessing the situation based on the 25+ specific considerations that span the four domains of BCW CyberTREE: Threat, Response, Expectations and Engagement and build out a full crisis communications strategy.

Most countries have laws and regulations that make it mandatory to report cybersecurity incidents— especially in regulated industries such as banking and finance. For instance, Canada has PIEPDA. But are there any provisions/clauses for crisis communications?

There are no specific provisions for crisis communications and reputation management. The laws and regulations you mention require certain details in reporting and notifications, and they can provide essential information that’s needed for effective crisis communications. But they don’t take into account the importance of communications to rebuild or maintain trust among customers/clients/patients/ investors/employees and other stakeholders. This is the critical gap BCW CyberTREE was created to fill.

What best practices and strategies do you recommend for handling the crisis communications in the wake of a cybersecurity incident?

The most important best practice is to observe “the trinity of cybersecurity crisis communications”: Forensics, Legal, Communications.

Forensic consultants need time to complete their analysis. Legal provides advice and counsel based on that analysis and communications provides an integrated communications strategy based on the forensics and legal guidance. The communications strategy should include news and social media engagement as well as employee communications, investor relations and communications with key customers and other stakeholders.

Can you elaborate on BCW CyberTREE, your strategic communications model for cybersecurity crisis communications response and planning?

The foundation of BCW CyberTREE is a set of more than 25 strategic considerations that, when fully, create a crisis communications roadmap for managing a cybersecurity incident.

For example, the first consideration is, “Who is the threat actor?” A threat actor can be a nation-state, an organized criminal network, a “lone wolf” (external), or an insider (or, there can be no threat actor).

Nation-states are often clandestine about their activities, whereas some organized networks may use social media to exert pressure on an organization to comply with ransom demands. Organized networks oftentimes have a pattern of behavior, while a “lone wolf” can be entirely unpredictable. So you can see, based on this single decision point, how your communications strategy would have to shift dramatically.

There are currently 28 additional considerations inside of CyberTREE which we will continually update and evolve as the threat landscape evolves.

Brian Pereira is the Principal Editor of CISO MAG. Apart from his editorial responsibilities, he enjoys writing features, interviews and technical articles.

LA Attorney Urges People to Avoid Public Charging Stations

USB charging stations

The Los Angeles District Attorney urged travelers to avoid public USB power charging stations in hotels, airports, and other public locations. In a security alert published recently, the attorney stated that public charging points may contain dangerous malware that might bring threats to mobile devices.

The LA officials stated that USB connections are designed to work as both data and power transfer mediums without a strong barrier between the two. They also highlighted that attacks can abuse USB connections to hide and deliver secret data payloads, which is referred to as “Juice Jacking” attack.

The Attorney’s warning described many attack vectors that cybercriminals use to abuse USB wall chargers. And the most common way is via “pluggable” USB wall chargers that can be plugged into an AC socket by attackers to leave malware at public charging stations.

The officials also recommended a few security tips for travelers to follow, which include:

  • Use an AC power outlet, not a USB charging station
  • Take AC and car chargers for your devices when traveling
  • Consider buying a portable charger for emergencies

In a similar research, cybersecurity experts stated that using someone else charging cable might bring threats to mobile devices. Attackers could exploit charging cables/cords to access sensitive information from the victim’s mobile.

Hackers could implant Malware into charging cords or cables to hack mobile devices. The USB chargers can be turned into potential hacking devices by inserting a malicious chip that allegedly allows attackers to access a mobile’s data over open Wi-Fi networks. The surprising part here is that the person who’s lending the charger might not be aware that his/her charger is infected.

In-Built Design Flaw Makes Bluetooth Devices Vulnerable

BrakTooth Flaws

A recent discovery revealed that mobile applications that work with Bluetooth devices have a built-in design flaw that makes them vulnerable to hacks.

According to the academic researcher Zhiqiang Lin from the Ohio State University, the vulnerability lies in the way Bluetooth Low Energy devices, a type of Bluetooth used in modern gadgets, communicate with mobile apps.

It’s said that wearable devices like smart speakers, health and fitness trackers or smart home assistants communicate with the apps on mobile devices by broadcasting UUID (Universally Unique Identifier), which allows the mobile apps to recognize the Bluetooth device.

The researcher stated that UUIDs in mobile apps make the devices vulnerable to a fingerprinting attack.

Presenting his findings recently at the Association for Computing Machinery’s Conference on Computer and Communications Security (ACM CCS 2019), Lin said, “There is a fundamental flaw that leaves these devices vulnerable – first when they are initially paired to a mobile app, and then again when they are operating. And while the magnitude of that vulnerability varies, we found it to be a consistent problem among Bluetooth low energy devices when communicating with mobile apps.”

“At a minimum, a hacker could determine whether you have a particular Bluetooth device, such as a smart speaker, at your home, by identifying whether or not your smart device is broadcasting the particular UUIDs identified from the corresponding mobile apps. But in some cases, in which no encryption is involved, or encryption is used improperly between mobile apps and devices, the attacker would be able to ‘listen in’ on your conversation and collect that data,” Lin added.

As part of their research, Lin and his team built a “sniffer”, a hacking device that can identify Bluetooth devices based on the broadcasting messages sent by the devices. After testing the device, the team found more than 5,800 Bluetooth Low Energy devices, in which 5,500 were able to be “fingerprinted” (or identified) by an attack. The team has identified 1,434 vulnerable mobile apps in Google Play that allowed unauthorized access.

Zhiqiang Lin and his research team reported their findings to developers of vulnerable apps and to the Bluetooth Special Interest Group. “It was in the initial app-level authentication, the initial pairing of the phone app with the device, where that vulnerability existed. If app developers tightened defenses in that initial authentication, he said, the problem could be resolved,” Lin concluded.

You will be breached! [INFOGRAPHIC]

(It’s only a matter of time.)

84% of CISOs in North America believe cybersecurity breaches are inevitable. And when you do get breached it will result in severe financial losses, loss of customers, and loss of reputation.

Identity theft is the biggest concern for customers, in the aftermath of a breach. It impacts your customers’ mental health and wellbeing, financial situation, and even their personal relationships.

So how do organizations become resilient after a breach? How can they reduce the impact of a breach?

According to the Ponemon 2018 ‘Cost of Data Breach’ study, organizations that offer data breach victims identity protection in the aftermath are more successful in reducing churn.

To do this you need to add ID theft monitoring to your breach readiness plan.

You need an early warning system that alerts your customers to signs of trouble.

A solution like ID Assist will help your customers limit the fallout of identity theft and financial fraud and restore their identity to a pre-breach state.

 

Intel Fixes 77 Vulnerabilities in Patch Tuesday, Announces New Appointment to Top Suite

intel

Intel has stated that it fixed 77 vulnerabilities in its recently released November Patch Tuesday. It also said that, “67 of the 77 vulnerabilities we are addressing were internally found”. The company maintained that even though the internally found vulnerabilities could have been handled without going public, but Intel believes in transparency. It has also assigned CVE IDs to all internally found vulnerabilities which will help customers assess risks involved, prioritize, and deploy updates.

Intel gave the news via a new security blog which intends to serve as a resource for security updates, bug bounty topics, and latest security research among the cybersecurity community. The blog contains a detailed list of 18 security advisories. All the affected Intel products and corresponding remedial recommendations are mentioned at the end of every advisory. In the following table, updates are ordered from highest to lowest severity rating:

Advisory ID

 Title Internally Found CVSS Range

INTEL-SA-00241

 Intel® CSME, Intel® SPS, Intel® TXE, Intel® AMT, Intel® PTT and Intel® DAL Advisory

22 of 24

2.3 – 9.6
INTEL-SA-00313 Intel® BMC Advisory

12 of 12

3.7 – 9.0
INTEL-SA-00255 Intel® Ethernet 700 Series Controllers Advisory

10 of 11

 5.6 – 8.8

INTEL-SA-00242

 Intel® Graphics Driver for Windows* Advisory

5 of 8

 4.0 – 8.8

INTEL-SA-00287

 Intel® WIFI Drivers and Intel® PROSet/Wireless WiFi Software extension DLL Advisory

3 of 3

8.2 – 8.7
INTEL-SA-00288 Intel® PROSet/Wireless WiFi Software Security Advisory

3 of 3

5.3 – 8.5
INTEL-SA-00220 Intel® SGX and TXT Advisory

2 of 2

 8.2 – 8.2

INTEL-SA-00240

 Intel® CPU Security Advisory

2 of 2

7.5 – 8.2
INTEL-SA-00293 Intel® SGX Advisory

1 of 2

7.0 – 7.8
INTEL-SA-00280 IPU UEFI Advisory

1 of 2

7.5 – 7.5
INTEL-SA-00309 Nuvoton* CIR Driver for Windows® 8 for Intel® NUC Advisory

0 of 1

6.7
INTEL-SA-00210 Intel® Processor Machine Check Error Advisory

1 of 1

6.5
INTEL-SA-00260 Intel® Processor Graphics Update Advisory

1 of 1

6.5
INTEL-SA-00270 TSX Transaction Asynchronous Abort Advisory

0 of 1

6.5
INTEL-SA-00164 Intel® TXT Advisory

1 of 1

6
INTEL-SA-00219 Intel® SGX with Intel® Processor Graphics Update Advisory

1 of 1

6
INTEL-SA-00254 Intel® SMM Advisory

1 of 1

6
INTEL-SA-00271 Intel® Xeon® Scalable Processors Voltage Setting Modulation Advisory

1 of 1

5.8

(Above list of advisories is as per the original list published in Intel’s Security Blog and not an independent research of CISO MAG)

James J Goetz joins Intel’s Board of Directors

Intel also announced the onboarding of James (Jim) J. Goetz to its Board of Directors’ list. The company in a recent release stated that it is “very happy to have Goetz on the board,” who has served as a partner of Sequoia Capital since 2004. He comes in with a vast knowledge of working in technology and innovation domain and currently serves on the boards of several privately held companies including Palo Alto Networks Inc.

“Jim has a keen understanding of how technology is evolving and a strong track record helping technology companies capitalize on disruptive innovation,” said Intel Chairman Andy Bryant. “Jim has helped create and grow a number of technology companies and product lines to market-leading positions, both as an entrepreneur and as an investor. Jim’s technical insight, substantial operating experience, growth mindset, and deep private and public company board experience, all will further strengthen Intel’s board.”

Hacker Group “Lizard Squad” Claim Responsibility for Attack on Labour Party

Lizard Squad

An infamous hacking group “Lizard Squad” claimed responsibility for the recent cyber-attack on the Labour Party. The hackers also warned that they are planning to launch a slew of such attacks, the Independent reported.

Lizard Squad stated that it has used a Distributed Denial of Service (DDoS) tool to take down the party’s digital platforms.

“Today’s DDoS attack on the Labour Party is to show that no terrorist-supporting government should allow to rule a country. Our botnet is connected to millions of devices around the world to enable more power to process such attacks,” Lizard Group said in a Twitter post.

The hackers also threatened that they will take down the Leader of the Labour Party Jeremy Bernard Corbyn’s and his family’s accounts. “Jeremy Corbyn’s family members’ personal accounts have been compromised and their home internet is under a DDoS attack as we speak,” the hackers said.

On November 12, 2019, the officials of the Labour Party stated that it sustained a cyber-attack that targeted its digital platforms. Describing it as a “sophisticated and large-scale cyber-attack,” the party officials stated the attack affected the party’s website and online campaigning tools temporarily.

The Party clarified that no data breach had occurred as they’re maintaining a strong security system. It’s believed that the attacks came from computers linked to Russia and Brazil.

“Yesterday afternoon our security systems identified that, in a very short period of time, there were large-scale and sophisticated attacks on Labour Party platforms, which had the intention of taking our systems entirely offline,” said Niall Sookoo, the party’s executive director of elections and campaigns.

“The integrity of all our platforms was maintained and we are confident that no data breach occurred,” Our security procedures have slowed down some of our campaign activities, but these were restored this morning and we are back up to full speed,” Sookoo added.

The party officials stated that they’ve notified the incident to the National Cyber Security Centre for further investigation. The attack comes ahead of the General Election campaign, with the UK set to go to the polls on December 12, 2019.

Election campaigns have always been a primary target for cybercriminals. The attackers try to steal sensitive information and even manipulate election advertisements online.

“Pipka” JavaScript Skimmer Targets Ecommerce Websites

Skimming-Attack

Visa, in a security alert rung alarm bells for eCommerce websites. Researchers at Visa’s eCommerce Threat Disruption (eTD) program found a new JavaScript skimmer called “Pipka”. It has already affected 16 eCommerce websites.

eTD is a proprietary Visa solution under its Payment Fraud Disruption (PFD) program. It scans the internet to identify malicious code on merchant payment pages and provides threat notification so that affected merchants can quickly take remedial measures. During one such routine scanning procedure carried out in September, researchers stumbled upon Pipka JavaScript skimmer on a North American merchant website. According to Visa, this merchant website was earlier infected with another JavaScript skimmer Inter – and hence was specifically under eTD’s scanner.

What’s New?

After its execution, Pipka JavaScript skimmer can remove itself from the HTML code of the compromised website, thereby decreasing the likelihood of detection. Visa says that it has not seen anything like this before and it’s a proof that cybercriminals are getting more sophisticated in the way they are carrying out attacks by the day.

What does it extract?

Pipka enables configuration of form fields that allows extraction of payment card details such as payment account number, expiration date, CVV, and cardholder name and address, from the checkout pages of the targeted eCommerce website.

How does it extract?

According to PFD, the skimmer checks the payment account number form field and injects Pipka in various locations of the targeted website. Once executed, it collects the data from the configured form fields and perform a base64 encoding on it. This encoded data is further encrypted using ROT13 cipher. The ROT13 cipher is a substitution cipher with a specific key where the letters of the alphabet are offset 13 places.

For example, all ‘A’s are replaced with ‘N’s, all ‘B’s are replaced with ‘O’s, and so on. For more clarification refer the below substitution key:

ABCDEFGHIJKLMNOPQRSTUVWXYZ

↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓

NOPQRSTUVWXYZABCDEFGHIJKLM

It can also be thought of as a Caesar cipher with a shift of 13.

Further, Pipka checks if the data string was previously sent to avoid data duplication. If the data string is unique, then data is fetched and sent to a command and control (C2) server. Pipka’s self-cleaning begins as soon as the initial script loads. This is exactly the reason why it is so difficult to detect its presence on a compromised web page.

What are its effects?

Sam Cleveland, senior analyst at Visa’s PFD team, says Visa presently is unable to provide any information on payment card fraud or theft related to Pipka. “Visa does not have this information to share due to this being an ongoing investigation,” Cleveland says. But as per the payment card information harvested, cybercriminals can carry out financial frauds and identity theft related crimes.

What mitigation measures can be taken?

Visa has listed the following measures and asked eCommerce websites to strictly adhere to it:

  • Implement recurring checks in eCommerce environments for potential communications with the C2 servers
  • Be vigilant about the code integrated into eCommerce environments via service providers.
  • Keep a close eye on the Content Delivery Networks (CDN)
  • Regularly scan and test eCommerce sites for vulnerabilities or malware
  • Ensure third-party services and other integrations are all upgraded and patched
  • Exercise access control to Admin users

Visa also informed its merchants to contact them immediately in case the Pipka JavaScript skimmer does infect their website even after taking preventive measures.

7 Times Ransomware Became a Major Healthcare Hazard

Cyberattack on Ireland's Health care

By Rudra Srinivas

Cyber-attacks on healthcare organizations has become a trend in the last few years. With sensitive information of their patients with them, healthcare providers have become a hot favorite for attackers. According to Beazley Breach Insights Report, healthcare organizations have suffered the highest number of data breaches in 2018 than any sector in the U.S. economy.

In 2019, healthcare firms continued to be primary targets of cyber-attacks with several data breaches and ransomware attacks taking major headlines again. The financial health of the healthcare industry might get even worse with data breaches expected to cost US$ 4 billion by the end of the year.

The recent outbreak of ransomware attacks on hospitals and healthcare providers shows the serious threat these attacks vectors can pose. Here are seven times when ransomware attacks took a toll on the healthcare sector.

DCH Medical Center:

DCH Health System in Alabama paid an undisclosed ransom to hackers to unlock its IT system, after three of its hospitals were attacked in October this year. According to reports, the attack affected the IT systems of the DCH Regional Medical Center, Northport Medical Center, and Fayette Medical Center from West Alabama’s Tuscaloosa, Northport, and Fayette.

The affected hospitals turned away new patients and even canceled several surgeries. The government authorities later stated that they’re working with the affected health services and cybersecurity professionals to investigate the incident.

 Multiple Hospitals in Australia:

Network systems at several hospitals and healthcare services in Gippsland and south-west Victoria were targeted by a ransomware attack. The attack blocked access to several systems including financial management and led to the deletion of several patients’ records, as well as booking and management systems, which may have impacted patient contact and scheduling. However, the Victorian government clarified that there was no sign of patients’ data being stolen.

Premier Family Medical at Utah

Protected Health Information (PHI) of more than 300,000 patients of the physician group named Premier Family Medical at Utah was compromised in a ransomware attack in September. The group confirmed the attack but didn’t disclose the number of patients affected.

According to an official statement, the incident occurred on July 8, 2019, that barred access to patients’ data and other network systems. The physician group stated that it notified law enforcement authorities about the attack and appointed a technical team to investigate the issue and regain access to its systems and patient data.

 NEO Urology

NEO Urology in Boardman, Ohio suffered a ransomware attack after hackers breached its entire IT system and left all its data encrypted. According to an official statement, the hospital authorities paid US$ 75,000 ransom to hackers to unlock their data. An investigation by the company revealed the attack had likely originated from Russia.

Harbor Medical Group

Hackers infected Grays Harbor Community Hospital and Harbor Medical Group with ransomware and demanded a payment of US$ 1 million to unlock patients’ files. Washington-based hospitals also faced downtime issues. According to the reports, the attack had triggered after an employee clicked on a malicious link containing ransomware.

Wood Ranch Medical

Wood Ranch Medical decided to permanently close its services after it failed to recover patients’ records that were encrypted in a ransomware attack on August 10, 2019. The California-based health services provider stated that it would be impossible to rebuild its medical records and will close its practice and cease operations on December 17, 2019.

Health Alliance Plan

Around 120,000 Health Alliance Plan patients were affected in a ransomware attack. The health service provider stated their personal and medical data were breached after a ransomware attack hit its third-party vendor Wolverine Solutions Group. The compromised data included patients’ names, addresses, dates of birth, Social Security numbers, insurance contact details and numbers, medical data, and phone numbers.

Rudra Srinivas is part of the editorial team at CISO MAG and writes on cybersecurity trends and news features. 

1...273274275...410Page 274 of 410