1.888.900.DRIZ (3749)
The Driz Group
  • Managed Services
    • Web Application Security >
      • Schedule WAF Demo
    • Virtual CISO
    • Compliance >
      • SOC1 & SOC2
      • GDPR
    • Third-Party Risk Management
    • Vulnerability Assessment >
      • Free Vulnerability Assessment
  • About us
    • Testimonials
    • Meet The Team
    • Resources
    • In the news
    • Careers
    • Subsidiaries
  • Contact
    • Newsletter
  • How WAF Works
  • Blog
  • Managed Services
    • Web Application Security >
      • Schedule WAF Demo
    • Virtual CISO
    • Compliance >
      • SOC1 & SOC2
      • GDPR
    • Third-Party Risk Management
    • Vulnerability Assessment >
      • Free Vulnerability Assessment
  • About us
    • Testimonials
    • Meet The Team
    • Resources
    • In the news
    • Careers
    • Subsidiaries
  • Contact
    • Newsletter
  • How WAF Works
  • Blog

Cybersecurity Blog

Thought leadership. Threat analysis. Cybersecurity news and alerts.

1/26/2018

0 Comments

New Variant of SamSam Ransomware Targets Health Sector

 
SamSam ransomware

New Variant of SamSam Ransomware Targets Health Sector

​Since the beginning of 2018, several organizations in the health sector have publicly acknowledged that they’ve been hit by the new variant of the ransomware called “SamSam”.
 
Cloud-based electronic health records (EHR) provider Allscripts, Hancock Health Hospital in Greenfield, Indiana; and Adams Memorial Hospital in Decatur, Indiana acknowledged that they’ve been a target by the new variant of SamSam ransomware.
 
Only Hancock Health Hospital admitted that it paid ransom money to the SamSam attackers. The hospital paid the attackers 4 Bitcoins (approximately $55,000 at the time).
 
“The hospital’s leadership, upon consideration of many factors, made the determination to pay the ransom of four bitcoin demanded by the attackers, in order to retrieve the private encryption keys,” Hancock Health CEO Steve Long said in a statement. “We were in a very precarious situation at the time of the attack. With the ice and snow storm at hand, coupled with the one of the worst flu seasons in memory, we wanted to recover our systems in the quickest way possible and avoid extending the burden toward other hospitals of diverting patients. Restoring from backup was considered, though we made the deliberate decision to pay the ransom to expedite our return to full operations.”

​What is SamSam Ransomware?

​SamSam, also known as Samas or Samsa, is a malicious software (malware) that’s categorized as a ransomware. Like other ransomware it encrypts files, locks out users from using their computers and from accessing files, and demands ransom payment in the form of Bitcoin to unlock the encrypted files.
 
Below is a sample of the ransom note of the new SamSam variant prominently displayed on the infected computer.
SamSam ransomware screen
Image by Cisco
​The original version of SamSam ransomware uses JexBoss, a tool that scours the internet for unpatched servers running Red Hat’s JBoss enterprise products. Once attackers gain entry via an unpatched server, they then use other open-sourced tools to collect information on networked computers. This open-sourced tools include the use of widely-used, weak and reuse passwords.
 
Once a computer is infected with SamSam ransomware, this malware proceeds to encrypt files and then demand a ransom. Once the server is infected by SamSam, all the other computers connected to the server are infected as well by the ransomware.
 
The first SamSam ransomware attack was first observed on March 2, 2016. On March 31, 2016, the United States Department of Homeland Security (DHS), in collaboration with Canadian Cyber Incident Response Centre (CCIRC) issued a joint security alert warning about the dangers of ransomware, including SamSam or Samas.
 
"In early 2016, destructive ransomware variants such as … Samas were observed infecting computers belonging to individuals and businesses, which included healthcare facilities and hospitals worldwide,” said DHS and CCIRC.
 
According to Symantec, what sets the original SamSam ransomware from other ransomware is the way this malware reaches its intended targets via unpatched server-side software.
 
“The big takeaway here is the growing trend that criminals are directly targeting organizations in ransomware attacks,” Symantec said. “The success of these recent attacks signals a shift for cybercriminals as they seek to maximize profits by setting their sights on vulnerable businesses.”
 
Attackers using the older version of Samsam ransomware initially asked a payment option of 1 Bitcoin for each PC that has been infected. The ransom payment demand later went up to 1.5 Bitcoin and 1.7 Bitcoin. According to security researchers at Cisco, as of March 23, 2016, SamSam victims paid nearly 275 Bitcoins (approximately $115,000 as one Bitcoin at the time costs $418).
 
Cisco researchers said that one Bitcoin wallet used by attackers to receive ransom payment for the new SamSam ransomware variant started receiving payments since December 25, 2018 and received 26 Bitcoins, valued nearly $300,000 as of January 19, 2018.
 
According to Cisco, there’s a possibility that compromised Remote Desktop Protocol (RDP) servers have played a role in allowing the attackers of the new SamSam variant to obtain an initial foothold.
 
“The point of entry of the attack was a hospital server on which the Remote Desktop Protocol (RDP) service was enabled and accessible via the Internet,” Hancock Health Hospital said in a statement. “Forensic analysis determined that an administrative account setup by a vendor of the hospital was compromised and used to gain unauthorized access to a specific system managed by that vendor.”
 
“Given SamSam's victimology, its impacts are not just felt within the business world, they are also impacting people, especially if we consider the Healthcare sector,” Cisco researchers said. “Non-urgent surgeries can always be rescheduled but if we take as an example patients where the medical history and former medical treatment are crucial the impact may be more severe.”
 
Ransomware results in the following negative consequences:
  • Permanent or temporary loss of critical data
  • Disruption of regular business operations
  • Financial losses as a result of restoring systems and files
  • Potential damage to the organization’s reputation
 
Ransom payment only guarantees that the attackers get their money; it doesn’t guarantee that the encrypted files will be unlocked. File decryption also doesn’t guarantee the removal of malware infection.

How to Prevent SamSam Ransomware Attacks

1. Backup and Have a Recovery Plan

Perform and test regular data backup and employ a recovery plan that expedites the recovery process.

2. Update All Software

Keep all software up-to-date with the latest security updates or patches. Attackers are always on the lookout for vulnerable computers, especially those with unpatched software. If your organization is using JBoss enterprise products, check to see if these are running unpatched versions and if so, patch them immediately.

3. Network Segmentation

In the event that security update isn’t possible, network segmentation is a good way to stop cyberattack or limit the possible impact of a successful cyberattack to the rest of the organization's information systems.

3. Restrict Users’ Ability to Install Software

Limit the ability of users to install and run unwanted software applications. User’s restriction may prevent malware installation or limit its capability to spread through the network.

0 Comments

1/11/2018

0 Comments

Huawei IoT Exploit Code Meant for DDoS Attack Released to the Public

 
Huawei exploit code DDoS attack

Huawei IoT Exploit Code Meant for DDoS Attack Released to the Public

Another malware code that’s meant to cause distributed denial-of-service (DDoS) has recently been made public on Pastebin website.

The publication of the code of a DDoS threat can’t be taken lightly. Whenever new cyberexploits become publicly available, cybercriminals are quick to add these to their attack arsenal.

When the Mirai malware code – another DDoS threat was made public – it unleashed unprecedented DDoS attacks.

The newly published malware code is a Mirai variant and particularly targets the vulnerability in Huawei home router model HG532. According to security researchers at NewSky Security, the newly published malware has already been used in cyberattacks, including the Satori DDoS attack.

With the release of the full working code of this Mirai variant, security researchers at NewSky Security said that “we expect its usage in more cases by script kiddies and copy-paste botnet masters.”

Considering that Huawei retains a significant share of the router market, exploitation of these IoT devices can have a significant effect. According to IDC, Huawei's total router market share increased from 18.9% in the 2nd quarter of 2016 to 25.2% in the 2nd quarter of 2017.

What is Satori?

Satori is an updated variant of the Mirai malware. It particularly exploits the vulnerability in Huawei home router model HG532. The vulnerability allows remote code execution, enabling attackers to access and make changes to Huawei home routers found in different parts of the world.

Unlike the Mirai malware which relies on default usernames and passwords to infect IoT devices, Satori doesn’t need usernames and passwords. Security researchers at Qihoo 360 Netlab said, “The bot [Satori] itself now does NOT rely on loader/scanner mechanism to perform remote planting, instead, bot itself performs the scan activity. This worm like behavior is quite significant.”

According to the security researchers at Qihoo 360 Netlab, in December 2017, the Satori malware was able to infect over 280,000 Huawei routers in just 12 hours.

In November 2017, security researchers at Check Point reported that hundreds of thousands of Satori exploits have already been found in the wild. Check Point discreetly informed Huawei about the security vulnerability and soon thereafter the company issued a security update.

“An authenticated attacker could send malicious packets to port 37215 to launch attacks,” Huawei said in acknowledging the Satori exploit. “Successful exploit could lead to the remote execution of arbitrary code.”

What is Mirai?

Satori’s code is based on Mirai malware code. In late September 2016, the hacker simply known as “Anna-senpai” made public the Mirai code.

What the original Mirai does was used the internet to search for IoT devices (including wireless cameras and routers) with weak security – particularly those with default usernames and passwords, control these devices and use them to attack targets such as other computers and websites. According to Anna-senpai, 380,000 IoT devices were infected with the Mirai malware to stage a DDoS attack against the Krebs on Security website.

Barely a month after the Mirai was published online, the DDoS attacks against Dyn happened. Dyn is a domain name service (DNS) provider which many websites rely upon. The DDoS attacks against Dyn resulted in temporarily shutting down popular websites like Amazon, Twitter and Netflix.

“We are able to confirm that a significant volume of attack traffic originated from Mirai-based botnets,” Dyn said in a statement. According to the company, 100,000 IoT devices were infected with the Mirai malware to attack its infrastructure.

In early December last year, three men, Paras Jha, Josiah White and Dalton Norman, pleaded guilty in creating and operating the Mirai malware in violation of the US Computer Fraud and Abuse Act.

“In the summer and fall of 2016, White, Jha, and Norman created a powerful botnet – a collection of computers infected with malicious software and controlled as a group without the knowledge or permission of the computers’ owners,” the US Department of Justice said in a statement.

The US Department of Justice added, “The defendants used the botnet to conduct a number of powerful distributed denial-of-service, or ‘DDOS’ attacks, which occur when multiple computers, acting in unison, flood the Internet connection of a targeted computer or computers.”

Jha, in particular, pleaded guilty in conducting a series of DDoS attacks against networks of Rutgers University from November 2014 to September 2016. The DDoS attack on Rutgers University, according to the Department of Defense, temporarily shut down the university’s central authentication server, which maintained the gateway portal through which students, faculty and staff deliver assignments and assessments.

According to the US Department of Justice, White, Jha and Norman’s involvement with the original Mirai ended in the fall of 2016, when Jha publicly released the source code of Mirai. The Justice Department said, “Since then, other criminal actors have used Mirai variants in a variety of other attacks.”

US Acting Assistant Attorney General Cronan said that the Mirai is a powerful reminder that “as we continue on a path of a more interconnected world, we must guard against the threats posed by cybercriminals that can quickly weaponize technological developments to cause vast and varied types of harm.”

Since the release of the Mirai code, there has also been a noticeable increase in DDoS-for-hire – a group of cybercriminals that provides paying customers with distributed denial of service (DDoS) attack service to anonymously attack any internet-connected target.

Imperva Incapsula reported that in the third quarter of 2017, majority or 90.2% of DDoS attacks were under 10 Mpps and were predominantly the result of DDoS-for-hire activity.

DDoS attacks are costly. They can make your organization’s website slow or inaccessible. They can disrupt business activities, prevent customers from accessing online accounts and bring about significant costs in remedying the DDoS effects.

Prevention

Huawei recommends the following measures to circumvent or prevent your Huawei routers from being infected by Satori malware:

  • Configure the built-in firewall function
  • Change the default password
  • Deploy a firewall at the carrier side
  • Deploy Huawei NGFWs (Next Generation Firewall) or data center firewalls
  • Upgrade the IPS signature database to the latest version IPS_H20011000_2017120100 released on December 1, 2017

Contact us at The Driz Group if you want more information on how to protect your business from DDoS attacks in under an hour, with no hardware to buy, and no resources or ongoing maintenance.

0 Comments

    Author

    Steve E. Driz, I.S.P., ITCP

    Picture
    View my profile on LinkedIn

    Archives

    January 2023
    December 2022
    June 2022
    May 2022
    February 2022
    December 2021
    November 2021
    October 2021
    September 2021
    August 2021
    July 2021
    June 2021
    May 2021
    April 2021
    March 2021
    February 2021
    January 2021
    December 2020
    November 2020
    October 2020
    September 2020
    August 2020
    July 2020
    June 2020
    May 2020
    April 2020
    March 2020
    February 2020
    January 2020
    December 2019
    November 2019
    October 2019
    September 2019
    August 2019
    July 2019
    June 2019
    May 2019
    April 2019
    March 2019
    February 2019
    January 2019
    December 2018
    November 2018
    October 2018
    September 2018
    August 2018
    July 2018
    June 2018
    May 2018
    April 2018
    March 2018
    February 2018
    January 2018
    December 2017
    November 2017
    October 2017
    September 2017
    August 2017
    July 2017
    June 2017
    May 2017
    April 2017
    March 2017
    February 2017
    January 2017
    December 2016
    October 2016
    August 2016
    May 2016
    March 2016
    January 2016
    November 2015
    October 2015
    August 2015
    June 2015

    Categories

    All
    0-Day
    2FA
    Access Control
    Advanced Persistent Threat
    AI
    Artificial Intelligence
    ATP
    Awareness Training
    Botnet
    Bots
    Brute Force Attack
    CASL
    Cloud Security
    Compliance
    COVID 19
    COVID-19
    Cryptocurrency
    Cyber Attack
    Cyberattack Surface
    Cyber Awareness
    Cyber Espionage
    Cybersecurity
    Cyber Security
    Cyber Security Consulting
    Cyber Security Insurance
    Cyber Security Risk
    Cyber Security Threats
    Data Breach
    Data Governance
    Data Leak
    Data Leak Prevention
    DDoS
    Email Security
    Fraud
    GDPR
    Hacking
    IoT
    Malware
    MFA
    Microsoft Office
    Mobile Security
    Network Security Threats
    Phishing Attack
    Privacy
    Ransomware
    Remote Access
    SaaS Security
    Social Engineering
    Supply Chain Attack
    Supply-Chain Attack
    Third-Party Risk
    Virtual CISO
    Vulnerability
    Vulnerability Assessment
    Web Applcation Security
    Web-applcation-security
    Web Application Firewall
    Web Application Protection
    Web Application Security
    Web Protection
    Windows Security
    Zero Trust

    RSS Feed

Picture

1.888.900.DRIZ (3749)

Managed Services

Picture
Web Application Security
​Virtual CISO
Compliance
​Vulnerability Assessment
Free Vulnerability Assessment
Privacy Policy | CASL

About us

Picture
Testimonials
​Meet the Team
​Subsidiaries
​Contact us
​Blog
​
Jobs

Resources & Tools

Picture
​Incident Management Playbook
Sophos authorized partner logo
Picture
© 2023 Driz Group Inc. All rights reserved.
Photo used under Creative Commons from GotCredit