Blog

Archive for Monthly Security Brief

Scam of the Week: Department of Motor Vehicles Warns Drivers About Traffic Ticket Phishing

Online reporter Doug Olenick at SC Media was the first to point to a press release from the NY State Department of Motor Vehicles warning about a phishing scam where New York drivers are being targeted, stating they have 48 hours to pay a fine or have their driver’s license revoked.  This may happen in your state as well, so this is your heads-up.

The NY DMV alerted motorists that the scam is just bait to entice them to click on a “payment” link that will in turn infect their workstation with malware. The DMV does not know how many people have been affected, but Owen McShane, director of investigations at New York State DMV, said calls came in from New York City, Albany and Syracuse.

Olenick was able to get a bit more detail: “The malware being dropped came in two categories. The first simply placed a tracking tool on the victim’s computer to see what websites were visited; and the second, more nefarious, attempted to acquire a variety of personally identifiable information, such as names, Social Security numbers, date of birth and credit card information.”

There are several social engineering red flags that show the email is a scam. The supplied links lead to sites without an ny.gov URL, tied to the fact that the state would never make such a request. Here is how the phishing email reads:

License_Phish-Example.png

The Department of Motor Vehicles does not send emails urging motorists to pay traffic tickets within 48 hours or lose your license,” said Terri Egan, DMV deputy executive commissioner, in a statement.

McShane noted that this scam is similar to one that hit the state about 18 months ago. The DMV, he said, is often used as bait in phishing attacks. Most previous attacks only lasted for 24 to 48 hours and this attack seems to have wrapped up too at this point, he added. This means that the bad guys may have moved on to other states with this attack, so…

I suggest you send employees, friends and family an email about this Scam Of The Week.  Obviously, an end-user who was trained to spot social engineering red flags like this would have thought before they clicked.

 

Lean More about Security Awareness training for your entire company.

Share

Posted in: Monthly Security Brief, Newsletter Topics, Security Awareness Training

Leave a Comment (0) →

Scam of the Week: Massive DocuSign Phishing Attacks

DocuSign has admitted they were the victim of a data breach that has led to massive phishing attacks which used exfiltrated DocuSign information. Ouch. So here is your Scam Of The Week.

They discovered the data breach when on May 9, 15, and 17 DocuSign customers were being targeted with phishing campaigns. They now are advising customers to filter or delete any emails with subject lines like:

  • Completed: [domain name] – “Wire transfer for recipient-name Document Ready for Signature”
  • Completed [domain name/email address] – “Accounting Invoice [Number] Document Ready for Signature”
  • Subject: “Legal acknowledgement for [recipient username] Document is Ready for Signature”

The campaigns all have Word docs as attachments, and use social engineering to trick users into activating Word’s macro feature which will download and install malware on the user’s workstation.  DocuSign warned that highly likely there will be more campaigns in the future.  Here is an example, these emails look very real:

DocuSign_Example_Phishing_Email.png

I suggest you send the following to your employees, friends, and family. You’re welcome to copy, paste, and/or edit:

“Hackers have stolen the customer email database of DocuSign, the company that allows companies to electronically sign documents. These criminals are now sending phishing emails that look exactly like the real DocuSign ones, but they try to trick you into opening an attached Word file and click to enable editing.

But if you do that, malware may be installed on your workstation. So if you get emails that look like they come from DocuSign and have an attachment, be very careful. If there is any doubt, pick up the phone and verify before you electronically sign any DocuSign email. Remember: Think Before You Click.”

 

See How Sentree Systems, Corp. can Help!!


Learn More!

 

Share

Posted in: Monthly Security Brief, Newsletter Topics, Security Awareness Training, Tech News

Leave a Comment (0) →

[Alert] WannaCry Ransomware Attack Uses NSA 0-Day Exploits To Go On Worldwide Rampage

NHS Ransomware Attack

This screenshot is just one example: The IT systems of around 40 National Health System hospitals across the UK were affected by this ransomware attack. Non-emergency operations have been suspended and ambulances are being diverted as a result of the infection. Cybersecurity experts have long used the phrase “where bits and bytes meet flesh and blood,” which signifies a cyberattack in which someone is physically harmed.

Mikko Hypponen, chief research officer at the Helsinki-based cybersecurity company F-Secure, called the attack “the biggest ransomware outbreak in history.” This is a cyber pandemic caused by a ransomware weapon of mass destruction. In the Jan 3 issue of CyberheistNews, we predicted that 2017 would be the year where we’d see a ransomworm like this. Unfortunately, it’s here.

Banks, Trains and Automobiles

Hundreds of thousands of machines are infected worldwide, including FedEx Corp, Renault, Nissan, the German Railways, Russian banks, gas stations in China, and Spanish telecommunications firm Telefonica (which reported 85% of their systems being down as a result of the cyberattack), and in a case of poetic justice, Russia seems to have been hit the hardest up to now. The source is Kaspersky’s Securelist, note that this is just the early days, and their visibility is likely limited.

wannacry_03.png

The strain is called “Wana Decrypt0r” which asks $300 from victims to decrypt their computers. This monster has infected hundreds of thousands of systems in more than 150 countries. Monday morning when people get back to work, these numbers will only go up. Check out an early animated map created by the NYTimes.

Here is an infection map based on data from MalwareTech.com:

Wana_Infection_Map.png

…and the Wall Street Journal also created an InfoGraphic explaining the spread of Wana which is nice to show to management when you ask for more IT security budget to train your users – which would prevent this whole mess.

WSJ_Wana_Info.png

Bleepingcomputer said: “Whoever is behind this ransomware has invested heavy resources into Wana Decrypt0r’s operations. In the few hours this ransomware has been active, it has made many high-profile victims all over the world. “Affected machines have six hours to pay up and every few hours the ransom goes up,” said Kurt Baumgartner, the principal security researcher at security firm Kaspersky Lab. “Most folks that have paid up appear to have paid the initial $300 in the first few hours.”

Despite the fact that this strain is hyper-agressive, the criminals behind the code do not seem to be all that sophisticated, they are using only a limited amount of static bitcoin wallets. Could even be that they are relative newbies at ransomware, and that the NSA worm-code has run amock scaring the daylight out them, afraid to be caught.

The Ransom Deadline Is Short

The ransom starts at $300 for the first 6 hours, and you’ve got up to 3 days to pay before it doubles to $600. If you don’t pay within a week then the ransomware threatens to delete the files altogether. Note the social engineering aspect here too: a sense of urgency is created to prompt people into action. A sense of hope is granted by virtue of the ability to decrypt a sample selection of the files

The ransomware’s name is WCry, but is also referenced online under various names, such as WannaCry, WannaCrypt0r, WannaCrypt, or Wana Decrypt0r. As everybody keeps calling it “Wana Decrypt0r,” this is the name we’ll use in this article, but all are the same thing, which is version 2.0 of the lowly and unimpressive WCry ransomware that first appeared in March.”

Kaspersky Lab also reports that the Wana strain has numerous languages available and was designed to affect multiple countries.

wana-decrypt0r-2_0.png

Sky News Technology Correspondent Tom Cheshire described the attack as “unprecedented”. The ransomware is using originally NSA 0-day ETERNALBLUE and DOUBLEPULSAR exploits which were made public earlier this year by a group calling itself the ShadowBrokers. There are recent patches available but many have not applied them yet.

 

Former U.S. intelligence contractor turned whistleblower Edward Snowden pointed the finger at the NSA, implying the agency was responsible for exploiting a weakness in Windows. It is not clear yet how the ShadowBrokers first got their hands on the NSA tools – conspiracy theories range from a contractor leak to a Russian counter-espionage trying to hint American intelligence should back off.
The group ShadowBrokers first appeared in August, claiming it had stolen tools from the Equation Group, a legendary espionage operation rumored to be affiliated with the NSA. The Brokers announced they had the tools and offered to auction them off which did not go very far. In January, the group gave up, only to resurface in April dumping EternalBlue and other Windows hacking tools in the public domain, where criminal hackers were grateful recipients.

 

The Initial Infection Vector Is A Well-crafted Phishing Email.

 

According to CrowdStrike’s vice president of intelligence Adam Meyers, the initial spread of WannaCry is coming through phishing, in which fake invoices, job offers and other lures are being sent out to random email addresses. Within the emails is a password protected .zip file, so the email uses social engineering to persuade the victim to unlock the attachment with a password, and once clicked that initiates the WannaCry infection. Microsoft confirms this in a blog post.

But the most concerning aspect of WannaCry is its use of the worm-like EternalBlue exploit. “This is a weapon of mass destruction, a WMD of ransomware. Once it gets into an unpatched PC it spreads like wildfire,” CrowdStrike’s Meyers told Forbes. “It’s going through financials, energy companies, healthcare. It’s widespread.”

“We encourage all Americans to update your operating systems and implement vigorous cybersecurity practices at home, work, and school,” the U.S. Department of Homeland Security said in a statement released late Friday. “We are actively sharing information related to this event and stand ready to lend technical support and assistance as needed to our partners, both in the United States and internationally.” Here is a technical nosedive of the Wana malware.

If You Can, Apply This Patch Immediately.

After the initial infection, the malware spreads like a worm via SMB, that is the Server Message Block protocol used by Windows machines to communicate with file systems over a network. According to Cisco’s TALOS team:

The file tasksche.exe checks for disk drives, including network shares and removable storage devices mapped to a letter, such as ‘C:/’, ‘D:/’ etc. The malware then checks for files with a file extension as listed in the appendix and encrypts these using 2048-bit RSA encryption.

From what we have been able to learn, Wana spreads through SMB so when we’re talking about machines behind firewalls being impacted, it implies ports 139 and 445 being open and at-risk hosts listening to inbound connections. It’d only take one machine behind the firewall to become infected to then put all other workstations and servers at risk due to it being a true worm.

In the mean time, harden yourselves against this Windows Network Share vulnerability and ensure that all systems are fully patched with the “MS17-010” security update (link below) and remind all staff to Think Before They Click when they receive any out of the ordinary emails. https://technet.microsoft.com/en-us/library/security/ms17-010.aspx

Redmond Issues Emergency Patch For WinXP

Microsoft has also released out-of-band patches for older versions of Windows to protect against Wana, because the original patch did not include XP/Win8. “This decision was made based on an assessment of this situation, with the principle of protecting our customer ecosystem overall, firmly in mind,” the company told customers in a blog post.

Besides installing these out-of-band updates — available for download from here — Microsoft also advises companies and users to outright disable the SMBv1 protocol, as it’s an old and outdated protocol, already superseded by newer versions, such as SMBv2 and SMBv3. You can use Grooup Policy for Clients and Servers. Here is a script to check the complete Active Directory for systems that miss the WanaCry related hotfixes.

Here is how to remove SMBv1 on Windows 10:

Turn_Off_SMB.png

And here is how to turn if off on Windows Servers. Start with those…

SMBV1_win_server.png

Another option: Use DSC to enforce the SMBv1 removal. If you don’t have DSC in place, you can use DSC local on your servers as well. You can now download security updates for Windows Server 2003 SP2 x64, Windows Server 2003 SP2 x86,Windows XP SP2 x64, Windows XP SP3 x86, Windows XP Embedded SP3 x86, Windows 8 x86, and Windows 8 x64.

A Honeypot Server Got Infected With WanaCry 6 Times In 90 Minutes

As the original one, the second variant is automatically executed by “Microsoft Security Center (2.0) Service” and is trying to spread by creating SMB connections to random IP addresses, both internal and external.

According to an experiment carried out by a French security researcher that goes online by the name of Benkow. WanaCry infected the honeypot in a mere three minutes after it was reset, showing the aggressive nature of the ransomware’s scanning module, which helps it spread to new victims. Noteworthy: three minutes is about the same amount of time IoT malware will infect a vulnerable home router left connected to the Internet without patches.

How To Detect The Presence Of Wana And SMBv1 Servers On Your Network

One of the easiest ways to monitor what is happening on your network is to setup a SPANMirror port or use a network TAP. This will give you access to flows and packet payloads so you can see who is connecting to what and if there is anything suspicious moving around. Check out this blog post if you use Cisco switches, it explains how you can monitor multiple network segments without the need to remember what is connected to what switch port. If you don’t use Cisco switches there is an excellent resource on the Wireshark wiki site which looks at how to setup monitoring on other switches.

There is one caveat though, this infection moves out like lightning from patient zero, and all vulnerable machines are literally locked in less than two minutes so monitoring alone would not be enough to be stop this monster. Here is a video showing a machine on the left infected with MS17-010 worm, spreading WCry ransomware to machine on the right in real time.

There Are Four Things To Watch Out For When It Comes To Detecting Wana

  1. Check for SMBv1 use
  2. Check for an increase in the rate of file renames on your network
  3. Check for any instances of the file @Please_Read_Me@.txt on your file shares
  4. Check for any instances of files with these extensions
    • .wnry
    • .wcry
    • .wncry
    • .wncryt

If Your Network Has Been Infected, What To Do?

This ransomware strain cannot be decrypted with free tools. Research shows the encryption is done with RSA-2048 encryption. That means that decryption will be next to impossible, unless the coders have made a mistake has not been found yet.

Your best bet is to recover from backups, and if your backup failed or does not exist, try a program like Shadow Explorer to see if the ransomware did not properly delete your Shadow Volume Copies. If a user did not click Yes at the UAC prompt, then there is a chance those are still available to start the recovery. Here is How to recover files and folders using Shadow Volume Copies. As a last resort and all backups have failed, you could decide to pay and get the files decrypted. It appears to work.

uac-prompt.png

What Can Be Done To Stop These Bad Guys?

It’s possible but difficult. The money has reportedly been flooding into hackers’ accounts and investigators can track the money and see where the bitcoin ends up. “Despite what people tend to think, it’s highly traceable,” Clifford Neuman, who directs the University of Southern California’s Center for Computer Systems Security. told the Washington Post.

However, hackers are still able to hide and launder the bitcoins in many different ways. Investigators will also examine the code itself as hackers often leave identifiable traces of their work. You can watch as some of these wallets are receiving money in real time.

Here Are 8 Things To Do About It (apart from having weapons-grade backups)

  1. Check your firewall configuration and make sure no criminal network traffic is allowed out, and disable SMBv1 on all machines immediately
  2. From here on out with any ransomware infection, wipe the machine and re-image from bare metal
  3. If you have no Secure Email Gateway (SEG), get one that does URL filtering and make sure it’s tuned correctly
  4. Make sure your endpoints are patched religiously, OS and 3rd Party Apps
  5. Make sure your endpoints and web-gateway have next-gen, frequently updated (a few hours or shorter) security layers
  6. Identify users that handle sensitive information and enforce some form of higher-trust authentication (like 2FA)
  7. Review your internal security Policies and Procedures, specifically related to financial transactions to prevent CEO Fraud
  8. Deploy new-school security awareness training, which includes simulated social engineering tests via multiple channels, not just email.

See How Sentree Systems, Corp. can Help!!


Learn More!

 

Share

Posted in: Monthly Security Brief, Newsletter Topics, Security Awareness Training, Tech News, Tech Tips for Business Owners

Leave a Comment (0) →

[ALERT] Nasty New “Jaff” Ransomware demanding $3700

Another nasty variant of Locky ransomware “Jaff” has made its way into our email boxes.  This is a major malicious email campaign from the Necurs botnet spreading the Jaff ransomware with a rate of nearly 5 million emails per hour.  According to an April analysis by researchers from IBM Security, Necurs is made up of about 6 million infected computers and is capable of sending batches of millions of emails at a time. It is also indirectly responsible for a large percentage of the world’s cybercrime because it’s the main distribution channel for some of the worst banking Trojan and ransomware programs.  Unfortunately, since the Necurs Botnet is spreading the the Jaff ransomware you can be sure it will reach a lot of email boxes. 

The emails observed so far attempt to mimic the automated emails sent by printers: The subject line is simply one of the words Copy, Document, Scan, File or PDF, followed by a random number.

The attachment is a PDF file called nm.pdf that has a Word document embedded into it. This second document has malicious macros attached and contains instructions for users to allow the code to execute.

If the macros are allowed to run, they will download and install the Jaff ransomware, which immediately starts encrypting files that match a long list of targeted file extensions. After encryption, the affected files will get a .jaff extension appended to them.

The ransomware also creates two files with instructions for making a bitcoin payment in order to obtain a decryption program. The payment portal is hosted on the Tor network and is visually identical to the portal used by the Bart ransomware, suggesting a relationship between these two threats.

While there are some similarities with Locky and Bart, the Jaff ransomware uses a different code base, so it’s a separate program, according to the Malwarebytes researchers.

Another interesting aspect is the ransom amount of 2 bitcoins, or around $3,700, which is significantly higher than what most other ransomware programs ask for.

Users should always be suspicious of unsolicited documents sent to them by email and should never allow the execution of active content inside documents unless they can verify their source. The best protection against ransomware is having a good backup routine in place that makes copies to an external storage device that’s not always connected to the computer.

 

Learn how to FIGHT Ransomware and stop being a victim!!!

 

 

Share

Posted in: Monthly Security Brief, Newsletter Topics, Tech News

Leave a Comment (0) →

French Presidential Candidate Target Of Russian Hacker Phishing Attack

The French presidential election has been hit with a case of déjà vu. Emmanuel Macron’s campaign said its staff received phishing emails meant to steal their passwords.

Trend Micro said in a report set to be published today that they have found evidence of a phishing attack targeting French presidential candidate Emmanuel Macron. The emails and fake sites sites could have tricked campaign staff into entering their credentials and allow malware to infect their computers, their researchers stated. Candidate_Macron_campaign_phishing_attack.png

Macron, of the relatively new “En Marche” party which translates to “on the move”, will be in a runoff on May 7 against National Front candidate Marine Le Pen for the French presidency. Macron’s campaign confirmed to the Wall Street Journal that its staffers received emails leading to fraudulent websites, but that the attempts were blocked, but who knows if they really were.

The hacking group behind the phishing attempts was Russian APT28, a group tracked for years by many security researchers.  This group of criminal hackers is also known as Pawn Storm, Sofacy, Strontium, Fancy Bear, and SecureWorks calls them “IRON TWILIGHT“.  Here is a backgrounder on APT28.

As part of the attack, hackers set up multiple internet addresses that mimicked those of the campaign’s own servers in an attempt to lure Mr. Macron’s staffers into turning over their network passwords, said Feike Hacquebord, a senior threat researcher for Tokyo-based Trend Micro and the author of the report, a copy of which was reviewed by The Wall Street Journal.

Security researchers state it is highly likely APT28 are supported by the Russian Government, specifically the GRU which is the Russian military intelligence arm, the counterpart of the FSB (former KGB). APT28 “active measures” were trying to influence U.S. presidential elections and at the moment try to do the same thing in France and Germany.  Kremlin spokespeople deny everything vehemently. Yeah, sure.

What to do about It

SecureWorks recommends the following excellent best practices to prevent network compromise:

  1. Apply best-practice security controls such as regular vulnerability scanning and patching,
  2. Have network monitoring tools in place.
  3. User education reduces your susceptibility to compromise.
  4. Implement two-factor authentication (2FA) on internal and third-party webmail platforms.
  5. Encourage employees use 2FA on their personal accounts.
  6. Restrict work-related communication from personal email.

 

Get Your Security Audit Today, Tomorrow Could be Too Late!!!

Did you know that the average breach goes undetected for more than 200 days?


Get Your Data Security Audit

Share

Posted in: Monthly Security Brief, Newsletter Topics, Security Awareness Training, Tech News

Leave a Comment (0) →

This Week’s Top “In The Wild” Phishing Attacks

And here are this week’s Top 10 “In The Wild” phishing attacks that we received from our customers by employees clicking the Phish Alert Button and sending the email to us for analysis.

We “defang” these attacks and have them updated real-time in a campaign that customers can run regularly to test employees against the “real thing”. In_The_Wild_Phishing_Attacks.png

  • “Chase/JP Morgan: Online Access Restricted” – Spoofed bank email asks users to click malicious link to restore account access.
  • “WhatsApp: Missed Voicemail Notification” – Fake WhatsApp voicemail notification delivers malicious link.
  • “Uber: Update Your Account” – Fake Uber software update notification invites users to click malicious link.
  • “Sharepoint Security Alert – Action Required” – Spoofed Sharepoint email asks users to click malicious link to restore account access.
  • “ShareFile/Citrix: Urgent Info regarding your Sharefile Portal” – Fake Sharefile email offers malicious link for users to click.
  • “NatWest: You sent a payment of 2939.00 GBP to Best EBuyer Limited” – Spoofed bank email offers details on an alleged payment via a malicious link.
  • “De-activation of Email In Process” – Users are required by fake IT admin email to click a malicious link in order to preserve account.
  • “Payoff Authorization” – Email delivers malicious attachment presented as a mortgage payoff authorization.
  • “VAT Return and Payment Overdue” – Fake VAT return and payment form delivered as attachment to a spoofed bank email.
  • “FW: Confidential” – “Confidential” notification tells user to click a malicious link or open an HTML attachment to obtain a “secure” message.

Note that these have made it through all the filters and into the inbox of the employee. That is one of the reasons we continue to remind IT pros that creating a human firewall is an essential last line of defense which you cannot do without.

Today, your employees are frequently exposed to sophisticated phishing and ransomware attacks. Old-school Security Awareness Training doesn’t hack it anymore. More than ever, your users are the weak link in your network security. Get a product demonstration of the innovative KnowBe4 Security Awareness Training Platform. In this live one-on-one demo we will show you how you can:

checkmark NEW  Access to the world’s largest library of security awareness training.

checkmark NEW  Social Engineering Indicators technology, turns every simulated phishing email into a tool you can use to instantly train employees.

checkmark Send Simulated Phishing tests and drive down the Phish-prone percentage.

checkmark Advanced Features: EZXploit™ automated “human pentest”. USB Drive Test™ 

checkmark Active Directory Integration allows you to easily upload and manage users.

checkmark Reporting to watch your Phish-prone percentage drop, with great ROI.

 

Get Your Security Audit Today, Tomorrow Could be Too Late!!!

Did you know that the average breach goes undetected for more than 200 days?


Get Your Data Security Audit

Share

Posted in: Monthly Security Brief, Newsletter Topics, Security Awareness Training, Tech News

Leave a Comment (0) →

HIPAA Enforcement: A Look Ahead

HIPAA Enforcement: A Look Ahead
So, what’s next for the Trump administration’s handling of health data privacy and security issues now that the 100-day milestone has been reached?
So far, despite the overall anti-regulatory tone of the new administration, it appears that enforcement of HIPAA is moving along at the same or perhaps even a slightly more aggressive pace than what was taken by the Department of Health and Human Services under the Obama administration.

“Congress established OCR to adapt to new technology – and to protect it.”

In one of his first speeches, Roger Severino, who last month took on the job of director of HHS’s Office for Civil Rights, promised to keep HIPAA privacy and security enforcement a top priority.

“I came into this job with an enforcement mindset,” Severino said on April 27 during a session at the Health Datapalooza conference in Washington, according to HealthcareITNews. “Congress established OCR to adapt to new technology – and to protect it.”

Resource Hungry

But will that mindset continue? A lot likely depends on the resources OCR gets for fiscal 2018. The staff has been stretched thin in recent years, especially as OCR has been digesting the findings of more than 200 HIPAA compliance audits of covered entities and business associates. Plans to launch a smaller number of more comprehensive audits in early 2017 have already been delayed until later this year. And who knows if that will even happen?

Privacy attorney David Holtzman, the vice president of compliance at security consulting firm CynergisTek who formerly was a former senior policy adviser at OCR, notes that so far this year, in terms of enforcement actions taken by OCR, the agency could break its aggressive record of 2016, which included 12 settlements and one civil monetary action – not to mention the relaunch of audits.

“OCR has continued its stepped-up enforcement of the HIPAA privacy, security and breach notification rules. Thus far in 2017, the agency has announced negotiated settlements or levied penalties in seven cases that have resulted in covered entities and business associates paying over $14.3 million,” he says.

“In all but one of these cases, organizations have also been saddled with multiyear corrective action plans in which HHS will exercise oversight of their compliance with the HIPAA standards. At this pace, OCR will eclipse its record-setting performance of 2016, in which there were 13 formal enforcement actions that had covered entities and business associates paying $23.5 million in fines and penalties for HIPAA violations.”

But it’s still unclear how the Trump administration will handle bigger-picture health data privacy and security issues.

“I believe it is important to distinguish between broader policy decisions and the day-to-day operations of the department’s mission,” he says. “While we have not seen evidence of how administration policy on health data security and privacy issues will develop, there is ample evidence that it is business as usual in OCR’s administration of the HIPAA privacy and security standards.”

Beyond HIPAA

While meeting HIPAA compliance requirements doesn’t necessarily equal the kind of robust security efforts needed to effectively safeguard data – including data that goes beyond patients’ protected health information – OCR’s recent enforcement ramp-up likely will help nudge security laggards out of their complacency.

But it’s also important to remember that the OCR enforcement actions we’re seeing have been in the works for years. Looking ahead, will OCR be spending less time investigating major breaches that get reported now? Let’s hope not.

Here’s an updated look at the sobering breach stats: As of April 28, there were 1,921 major breaches affecting nearly 173.4 million individuals reported to OCR since September 2009, according to HHS’ “wall of shame.” And to date, OCR has issued 47 HIPAA settlements and two civil monetary penalties.

So, while there’s been an a slight uptick in the number of enforcement actions taken by OCR over the last year or two, the reality is that there are still slim odds that you’ll end being smacked with a financial penalty related to a breach.

And the odds could grow even slimmer if OCR finds itself with a barebones budget for fiscal 2018. President Trump has proposed big cuts to HHS’ overall budget for the next fiscal year beginning on Oct. 1, and he has also instructed federal agencies to plan reducing their workforces near term.

In the meantime, OCR likely will keep picking and choosing cases for settlements that highlight common mistakes entities make in safeguarding patient information. Plus, the HIPAA enforcement agency will continue to release guidance that addresses confusing and critical security and privacy issues.

Hopefully, the healthcare sector will continue to learn from these cases and guidance and make it a higher priority to bolster their overall risk management programs to better safeguard all data against evolving threats.

Article produced by DataBreachToday

 

Get your HIPAA Risk Assessment!!!

Click the image below!

 

Share

Posted in: Monthly Security Brief, Newsletter Topics, Tech News

Leave a Comment (0) →

Attackers Unleash OAuth Worm via ‘Google Docs’ App

Attackers Unleash OAuth Worm via ‘Google Docs’ App
Attackers Unleash OAuth Worm via 'Google Docs' AppThe malicious Google phishing email. (Source: Cisco Talos)Score another one for social engineering.

See Also:2017 Predictions on Data Security: Insights on Important Trends in Security for the Banking Industry

A malicious app named “Google Docs” by attackers has been making the rounds, attempting to trick Google users into logging in and giving the app access permissions to their account.

The phishing campaign began with an email to victims from an address they likely would have recognized, according to multiple analyses of the attack that have now been posted online by security researchers. But the campaign quickly turned into a worm, as users authorized the bogus app in droves, allowing it to spread to their own contacts.

Although Google neutered the attack shortly after it appeared, the technology giant – believed to boast about 1 billion users – said that about 0.1 percent of its users were affected. In other words, roughly 1 million individuals may have fallen victim to this phishing campaign.

“This attack was notable due to the sheer volume and velocity at which it was executed,” security researchers Sean Baird and Nick Biasini from Cisco Talos say in a blog post. “What started as a trickle of emails quickly became a deluge resulting in a prime area of focus on Twitter and in the security community. Due to its relentless nature it got everyone’s attention.”

How It Works

Here’s how the attacks begin: A user receives an email containing an “Open in Docs” button, which, when clicked, redirects the user to a legitimate Google site, requesting that they allow an app called “Google Docs” to “read, send, and manage your email” as well as to “manage your contacts.” If users click “allow,” the malicious app – and by extension an attacker – gains access to all of those features.

The malicious Google phishing email. (Source: Cisco Talos)The tricky part of the attack is that the app – like so many other sites and services online – uses Google’s legitimate, OAuth-based log-in system, meaning that it’s up to users to spot that someone is trying to scam them. “This is a legitimate request and is part of a lot of applications that make use of Google as an authentication mechanism,” Baird and Biasini say. “The portion that is not normal are the permissions that are being requested.”

As is typical with any security control that relies on humans to effectively differentiate legitimate requests from scams, users predictably failed in droves.

Related phishing email volumes reported to Cisco over lifespan of the roughly two-hour attack (U.S. Eastern Time)Fortunately, Google neutered the attack not long after it began. “We have taken action to protect users against an email impersonating Google Docs and have disabled offending accounts,” the Google Docs team says in a statement released via Twitter, just hours after the attack was first spotted on May 3. “We’ve removed the fake pages, pushed updates through Safe Browsing, and our abuse team is working to prevent this kind of spoofing from happening again. We encourage users to report phishing emails in Gmail.”

We’ve addressed the issue with a phishing email claiming to be Google Docs. If you think you were affected, visit https://t.co/O68nQjFhBL. pic.twitter.com/AtlX6oNZaf

— Google Docs (@googledocs) May 3, 2017

OAuth Worm

To be clear, Google wasn’t targeted with a phishing attack. “It’s not a Google ‘phish.’ It’s an OAuth worm,” says Sean Sullivan, a security adviser at Finnish security firm F-Secure, via Twitter.

The OAuth service named “Google Docs” requested permissions. (Source: Cisco Talos)

The attack centered on OAuth tokens provided by Google – other services also offer the feature – which allow a user to give a site or service persistent access to their Google account. One advantage is that users can then access the site or service without having to log in again. But that persistent access is regularly targeted by attackers, who create bogus apps and then send phishing emails to users, trying to get them to grant access. Such attacks also bypass two-factor authentication, because it’s the already authenticated user who’s granting access to the bogus app (see Hello! Can You Please Enable Macros?).

Thankfully, security researchers report, none of the “Google Docs” app attacks appear to have pushed malicious code onto victims’ PCs.

With any service that allows OAuth logins, security experts say users should regularly review which apps they’ve granted access. For Google users, visiting https://myaccount.google.com/permissions allows them to revoke permissions for any apps or sites that shouldn’t connect to their Google account.

Anyone who thinks they’ve fallen victim to an attack that targeted their OAuth credentials should also change their password, security experts recommend. But they note that doing so alone – without revoking permissions – won’t immediately block attackers’ access to their account, since existing OAuth tokens don’t get regularly invalidated.

Email Address Harvesting

While the May 3 “Google Docs” app attack campaign has not been traced to any individual or actor, and no one has claimed credit, this was likely just an opening move.

“The goal of this attack is likely two-fold. This instance acted as a potential proof-of-concept for a convincing Google phish via OAuth,” Cisco’s Baird and Biasini say. In addition, they note that attackers could have quickly harvested massive amounts of contact information from the Gmail accounts of anyone who gave access rights to the “Google Docs” app.

It’s not yet clear if stolen information has been put to use, says John Wilson, field CTO at email security firm Agari.

“While we haven’t seen reports of fraud yet, the cybercriminals who launched the attack have access to all of the victims’ emails until the app is disabled,” Wilson says in a blog post. “With that access, the criminals can use your identity to scam co-workers or relatives, reset your bank account password and steal money or harvest information to steal the victim’s identity. There are an infinite number of ways a cybercriminal can monetize this kind of access.”

When in Doubt: Don’t Click

Cisco’s Baird and Biasini says that based on the effectiveness of this attack, more are sure to follow, and it’s unclear if Google will be able to successfully shut them all down before more damage gets done.

Their main message to anyone who uses a service that relies on OAuth is to cultivate healthy amounts of skepticism and paranoia.

“Users must be very careful what they click on, particularly when it involves passwords or granting permissions or access of some kind,” the Cisco researchers say. “If in doubt, reach out to the sender of the attachment or link using a means other than email to verify the integrity of their email.”

 

 

Article produced by DataBreachToday

 

See How Sentree Systems, Corp. can Help!!


Learn More!

Share

Posted in: Monthly Security Brief, Newsletter Topics, Tech News

Leave a Comment (0) →

Ransomware Causes 90-day Downtime And 700K Damages For Law Firm Who Then Sues Their Insurer

Moses_Afonso_Ryan_Ltd.png

 

PROVIDENCE, R.I. — Cybercriminals held a Providence law firm hostage for months by encrypting its files and demanding $25,000 in ransom paid in Bitcoin to restore access, according to a lawsuit filed in U.S. District Court.

Moses Afonso Ryan Ltd. is suing its insurer, Sentinel Insurance Co., for breach of contract and bad faith after it denied its claim for lost billings over the three-month period the documents were frozen by the ransomware infection.

According to the lawsuit, during the time their files were inaccessible, the firm’s 10 lawyers were left unproductive and inefficient — amounting to $700,000 in lost billings.

After paying the Bitcoins, the firm then had to re-negotiate those terms after the initial key to de-crypt their files failed to work. They had to purchase more Bitcoins in exchange for other tools to recover their documents.

Ransomware Develops Into “Valet Thievery” Driven By Phishing Attacks

Attackers are tailoring their demands to their victims, in essence making it a brand of “valet thievery,” said cyber expert Doug White, director of forensics, applied networking and security at Roger Williams University. They might demand $800 from a household, and push that sum into the thousands if they realize they’ve hit a law firm or hospital, White said. They key to the infections are phishing attacks that use social engineering to trick an employee to open a malicious attachment.

It’s a crime, too, that is vastly underreported, law enforcement agencies say. “The shame of it keeps it from being reported,” White said, as businesses don’t want to sully their image or reveal weakness. “Usually they just pay them off. It’s the cost of doing business.”

 

Moses Afonso Ryan Ltd. is not alone in falling victim to such a crippling attack. Police departments, town halls, law firms, accounting firms and individuals have been hit across Rhode Island, according to Capt. John C. Alfred, head of the the Rhode Island State Police cyber-crimes unit.

Protecting a network involves everyone in it from a janitor to the CEO

“I never tell anyone to buy the ransomware key because it’s sponsoring illegal activity,” Alfred said. He added: “You have to back-up the data beforehand. That’s what you have to do. You’re not going to get that data back. Even if you pay, you might not get the key.” Protecting a network involves everyone in it from a janitor to the CEO, he added.

Dana M. Horton, representing Sentinel Insurance in the lawsuit, also did not immediately respond to an email and a phone call seeking comment. The company has not yet filed a response in U.S. District Court.

White questioned whether the law firm’s suit would succeed, saying it would “open a giant can of poison worms” for the insurance industry. Alfred, too, emphasized that cyber security insurance is a growing field. “Everybody is going to be insuring their data,” Alfred said.

Heads-Up: Cyber insurance Does Not Pay Out For Human Error

You need to read the fine print in your cyber insurance policy if you have one, or if you are negotiating one. These policies normally do not cover incidents caused by human error, they only pay out for software-related vulnerabilities. This is a gotcha you need to be aware of, because your organization might have a false sense of security.

Capt. John C. Alfred, head of the the Rhode Island State Police cyber-crimes unit is right. You do need to step all employees through new-school security awareness training, from the mail room to the board room!

Full story at Providence Journal.

 

See How Sentree Systems, Corp. can Help!!


Learn More!

 

Share

Posted in: Monthly Security Brief, Newsletter Topics, Security Awareness Training, Tech News

Leave a Comment (0) →

Northrop Grumman Can Make a Stealth Bomber – but Falls for W-2 Phishing Attack

America was the victim of 34 percent of global ransomware infections in 2016, while only being 4.4 percent of the world’s population.

The “why” is clear; a whopping 64 percent of Americans are willing to pay to get their files back, as opposed to only 34 percent of victims worldwide, per Symantec’s 2017 Internet Security Threat Report.

Surprisingly, Symantec’s results show paying ransom doesn’t guarantee universal results as just 47 percent of global victims who paid up in 2016 reported getting their files back, which is in direct contradiction with our own experience, where we helped dozens of victims with a 95% successful return of all their files.

Note, these were organizations at their wit’s end who found us on the internet and needed help to get their files back after an employee opened an infected attachment, not existing KnowBe4 customers calling us about our Ransomware Guarantee.

Newly discovered ransomware families jumped last year from 30 in 2015 to 101 in 2016. The number of new variants of existing ransomware code, however, dipped. “It suggests that more attackers are opting to start with a clean slate by creating a new family of ransomware rather than tweaking existing families by creating new variants,” the report said.

Infections of consumers at the house counted for 69 percent, but Symantec found that that some attackers are executing more sophisticated attacks against businesses, where they silently penetrate the network, move laterally and then encrypt all machines at the same time.

The ransoms themselves also skyrocketed, climbing 266 percent last year, from an average of 294 dollars in 2015 to 1,077 dollars in 2016 helped by a Bitcoin price which is over 1,300 dollars at the time of this writing. The report also showed that attackers have begun customizing individual ransom demands based on the type of data and the volume of files that were encrypted.

Symantec Report Confirmed by Verizon, SANS and NTT

Verizon’s vendor-neutral 2017 Data Breach Investigations Report (in which KnowBe4 participated as a data source) found that ransomware levels in 2016 were up 50 percent over 2015 figures. Verizon also found that the types of attacks targeting organizations vary from sector to sector. For instance, manufacturing has the lowest median level DDoS level, but the highest level of espionage-related breaches.

The SANS 2016 Threat Landscape survey reported: “Phishing and spearphishing were among the top ways threats enter organizations, which setup a perfect storm for ransomware to blossom. 75% of threats entered via email attachment, 46% malicious link. User education alone is not sufficient. At a corporate level, perimeter protections, including email screening and ext-gen firewalls can reduce the volume of malware that can trip up an end user. From there, the endpoint needs every advantage to remain secure – behavior based malware detection, whitelisting, access control and appropriate network segmentation.”

The growing threat was further confirmed by more research from NTTSecurity: 2017 Global Threat Intelligence Report which found that 22 percent of all global incident engagements were related to ransomware, more than any other category of attack.

Of the ransomware attacks observed via NTTSecurity’s intelligence network, 77 percent were concentrated among four industries – business and professional services (28 percent), government (19 percent), health care (15 percent), and retail (15 percent).

Half of all incidents affecting health care organizations involved ransomware. “This may indicate that attackers have identified health care institutions as a vulnerable target more willing to pay ransom than other sectors,” their report noted.

 

Get Your Security Audit Today, Tomorrow Could be Too Late!!!

Did you know that the average breach goes undetected for more than 200 days?


Get Your Data Security Audit

 

Share

Posted in: Monthly Security Brief, Newsletter Topics, Security Awareness Training, Tech News

Leave a Comment (0) →
Page 1 of 5 12345
Real Time Web Analytics