Email-Borne Threats Still Bypass Current Security System, Study Shows

Despite the advancement in current email security systems, a new study reveals that these security systems still miss a significant number of email-borne threats.

In the 3rd quarter of 2018, Mimecastretested 80 million emails that were considered “safe” by current email security systems. The Mimecast study found that out of the 80 million emails deemed to be “safe”, 42,350 emails were found to be impersonation attacks, 17,403 contained malicious software (malware) attachments, 16,581 emails contained dangerous file types and 205,363 malicious URLs were found.

Impersonation attacks refer to emails that attempt to impersonate a trusted individual or company in order to gain access to corporate finances or data.

Dangerous files, meanwhile, refer to files such as .jsp, .exe, .dll and .src – files that allow a program to run on a computer, exposing the computer to further cyber attacks. According to Mimecast, dangerous files bypassed current email security systems at an increased rate, showing a 25% increase from the last quarterly test. 

How Prevalent Are Email-Borne Threats? 

In the first half of 2018, over half-a-billion emails were analyzed by FireEye. It found that less than a third or 32% of email traffic was considered “clean” and delivered to an inbox. FireEye’s analysis found that 1 in every 101 emails had malicious intent.

FireEye further found that majority or 90% of the blocked emails contained no malware – 81% of which considered as phishing attacks and 19% considered as impersonation attacks.

Cyber criminals see the advantages of leveraging emails as a means to wage cyber-attacks as emails continue to be the preferred form of communication worldwide despite the growth of other technologies such as social networking, instant messaging and chat. Email also maintains its dominance as it’s an integral part of the overall internet experience. An email address is required if you want to use a social networking site or for your bank’s online service.

According to The Radicati Group(PDF), over half of the world population uses email in 2018, with the number of worldwide email users expected to top 3.8 billion in 2018 and expected to grow to over 4.2 billion by the end of 2022.

The following trends in email-borne threats were observed by FireEye and The Radicati Group:

Blended Attacks

The most common form of email-borne threat is the blended attack – a form of attack that combines an email and web access to deliver a malware to an

organization’s internal network. In blended attack, the email itself doesn’t contain a malware. The email only facilitates the delivery of the malware as it contains a link that when clicked goes directly to a malicious website and from there the malware is downloaded, then infecting the

organization’s internal network.

Impersonation Attacks Have Gone Mainstream

The cyber-attack called “business email compromise”, also known as BEC or CEO fraud, is an example of an impersonation attack.

In impersonation or BEC attack, an attacker or attackers send a bogus email purportedly from the CEO to a targeted employee, typically one who has access to company finances. Through the bogus email, the attackers request the targeted employee to make an urgent money transfer, usually to a trusted vendor’s new bank account.

Many profit and nonprofit organizations had been duped by BEC scammers in recent years. According to the Federal Bureau of Investigation (FBI), BEC scammers, between October 2013 and May 2018, defrauded different organizations worldwide of almost $12.5 million.

Email Attack Schedule

Malware-based attacks most likely occur during Mondays and Wednesdays. During Thursdays, malware-less attacks most likely happen. Impersonation attacks, meanwhile, most likely occur during Fridays.

One example of the malware-less email is the impersonation email, an email that spoofs domains or uses lookalike domains. Another example of a malware-less malicious email is the blended email, whereby the email contains a link to a malicious URL. An additional example of a malware-less malicious email is one that contains a dangerous file such as an .exe file.

One explanation why impersonation emails are sent during Fridays is that impersonation emails typically are bogus emails from an organization’s CEO. During Fridays, especially late Friday afternoon, it’s typically difficult to call or talk in person with the boss – a situation favored by scammers to buy time to trick a targeted employee.

How to Prevent Email Attacks?

Here are some security measures in order to block or detect email-borne threats:

Staff Training

In email-based attack, it only takes one click to infect your organization’s internal network. And your weakest link for this particular type of cyber-attack is your staff. Staff training isn’t just a one-shot deal. It needs to be continuous as well as effective.

It’s particularly important to train executives and employees dealing with finances to be vigilant against email-borne threats as they’re targeted by criminals, especially in BEC attacks. One way to train your organization's staff is by sending test emails to check their resilience against email-borne threats.

Use an Advanced Email Security Tools

Traditional email security tools only block emails that contain malware. An advanced email security tool, in addition to blocking emails laden with malware, blocks malicious emails containing spoofs domains, lookalike domains, emails containing malicious URLs and emails containing dangerous files.

Contact us today if you need assistance in protecting your organization’s network from email-borne threats.

Equifax Data Breach Was “Entirely Preventable”, Report Says

The U.S. House of Representatives Committee on Oversight has released a report that concludes that the massive Equifax data breach back in September 2017 was "entirely preventable".

On September 7, 2017, Equifax disclosed a massive data breach affecting 143 million consumers – majority of whom were from the U.S. and some from Canada and the U.K. – this number later rose to 148 million consumers.

Equifax is one of the largest consumer reporting agencies (CRAs) in the world. CRAs collect account information from various creditors, analyze this data to create credit scores and detailed reports, and then sell these to third parties. CRAs’ data collection activities make them a repository of large amount of personally identifiable information, which make them a high-value target for cyber criminals, this according to the report released by the U.S. House of Representatives Committee on Oversight(PDF).

Few weeks prior to the Equifax data breach, former Equifax Chief Executive Officer (CEO) Richard Smithsaid that Equifax was managing “almost 1,200 times” the amount of data held by the U.S. Library of Congress every day.

As a result of the massive data breach, Equifax held several of its officials accountable. Eight days after the data breach disclosure, the company’s Chief Information Officer and Chief Security Officer both took early retirements. Nineteen days after the data breach disclosure, the company’s then Chief Executive Officer Richard Smith left the company and 25 days after the breach, the company terminated its Senior Vice President and Chief Information Officer for Global Corporate Platforms.

Anatomy of the Equifax Data Breach

Based on the report released by the U.S. House of Representatives Committee on Oversight, the Equifax data breach was a result of a series of events that could have been prevented.

On March 7, 2017, Apache Software Foundation, an organization that oversees more than 350 leading open source projects, including Apache Struts, announced and patched on the same day the security vulnerability designated as CVE-2017-5638. This security vulnerability enables attackers to conduct remote code execution (RCE), a cyber attack in which the attacker takes over a computer by exploiting a vulnerability in the computer, regardless of where the computer is geographically located. A proof of conceptof CVE-2017-5638 attack scenario is publicly available on GitHub.

Apache Struts is a popular open source framework for creating web applications. Many of the world’s web applications use Apache Struts, including the web applications used by Equifax, financial institutions, government organizations and Fortune 100 companies. Equifax’s Automated Consumer Interview System (ACIS), a custom-built internet-facing consumer dispute portal, was running a version of Apache Struts containing the CVE-2017-5638 vulnerability.

According to the House Oversight Committee, 2 days after the release of the CVE-2017-5638 patch, Equifax’s Global Threat and Vulnerability Management (GTVM) team emailed over 400 Equifax employees who had Apache Struts running on their system to apply the necessary patch within 48 hours. The Equifax GTVM team also held a meeting about this vulnerability on March 16.

Despite the above-mentioned efforts, Equifax’s ACIS wasn't patched, leaving the company’s computer systems open to attacks. Just a few days after the release of the CVE-2017-5638 patch, that is, on May 13, 2017, attackers started their 76-day long cyber-attack on Equifax, the House Oversight Committee report said.

By exploiting the unpatched Apache Struts of the company’s ACIS, the report said, the attackers located a file containing unencrypted credentials, including usernames and passwords. These unencrypted credentials enabled the attackers to gain access to critical data outside Equifax’s ACIS, specifically access to the company’s 48 databases.

The report added that on these 48 databases, attackers accessed 265 times unencrypted personally identifiable information of Equifax’s consumers and said attackers transferred this data out of the company’s network. The report said Equifax wasn’t aware of this data transfer as the tool used to monitor ACIS network traffic had been inactive for 19 months as a result of an expired security certificate. It was only on July 29, 2017 that Equifax noticed the ACIS network traffic as this was the date that the company updated the expired certificate.

“Equifax failed to fully appreciate and mitigate its cybersecurity risks,” the House Oversight Committee report said. “Had the company taken action to address its observable security issues prior to this cyber attack, the data breach could have been prevented.”

Preventive Measures

Here are some of the cyber security measures that your organization can implement in order to prevent data breaches similar to the Equifax data breach:

Keep All Software Up-to-Date

Cyber attackers are quick to exploit publicly known security vulnerabilities. In the case of the Equifax data breach, attackers exploited a known security vulnerability on Apache Struts just a few days after Apache Software Foundation patched the vulnerability. It’s important to install critical patches in a timely manner so as not to leave your organization’s IT system vulnerable to cyber attacks.

Encrypt Critical Data

It’s a proactive approach to assume that one day your organization’s critical data could be accessed by an unauthorized party. It’s important to encrypt your organization’s critical data so that attackers won’t have a easy access to this high-value data. In encryption, data in plain text is converted into an unreadable form. The only way to read or unlock this encrypted data is via a decryption key – a time-consuming task on the part of the attackers. In the case of the Equifax data breach, the sensitive data of consumers wasn’t encrypted, making it easy for the attackers to locate the critical data.

Monitor Network Traffic

Monitoring your organization’s network traffic is one of the effective means of detecting intrusion. In the case of the Equifax data breach, at the time of the data breach, the company had no means to monitor its ACIS network traffic.

Look at deploying SIEM or MDRsolutions.

Network access during non-working hours and unusual volume of data transfer are signs of intrusion. A workable automated network monitoring tool is a must to protect your organization’s IT system.

What Can Organizations Learn from the Marriott Data Breach

The recent data breach disclosure by Marriott is an eye-opener to organizations, not only because of the extent of the breach – with up to half a billion guests affected, but also because of the length of time that the breach remained undetected – lasting nearly 4 years.

Marriott, currently the world's largest hotel chain, has over 6,700 properties in 129 countries and territories, including Canada. The company has attained the stature of being the world's largest hotel chain after it completed its acquisition of Starwood Hotels & Resorts Worldwide in September 2016.

Marriot, in a statement, said that from 2014 up to September 10, 2018, an “unauthorized party” accessed the Starwood guest reservation network affecting up to 500 million guests who made a reservation at Starwood properties. Out of the 500 million guests affected, the hotel chain said that data of 327 million of these guests was accessed without authority, including name, mailing address, phone number, email address, passport number, Starwood Preferred Guest (“SPG”) account information, date of birth, gender, arrival and departure information, reservation date, and communication preferences.

Financial data of an unspecified number of guests was also accessed by the unauthorized party, including payment card numbers and payment card expiration dates. While the payment card numbers were encrypted using Advanced Encryption Standard encryption (AES-128), the hotel chain said it won’t discount the possibility that the unauthorized party decrypted the payment card numbers.

Marriott didn’t specify what month or exact date in 2014 that the data breach started. It can be recalled that prior to the completion of Marriott’s acquisition of Starwood, in November 2015, Starwooddisclosed its own data breach, affecting nearly 100 Starwood hotels in North America.

Sergio Rivera, President of Starwood Americas, in a statement, said that point of sale systems at certain Starwood hotels were infected with a malicious software (malware), enabling “unauthorized parties” to access payment card data of some of the hotel customers.

Lessons from Marriott Data Breach

Here are some cyber security lessons from the recent Marriott data breach:

Implement Network Segmentation 

Marriott said that its own Marriott-branded hotels aren’t affected by the data breach at the Starwood guest reservation network as Marriott-branded hotels’ use a different network that wasn't breached.

Network segmentation is the practice of dividing a computer network into subnetworks, with each network having a different purpose or usage. Implementing network segmentation in your organization ensures that in case one of the networks is infected with a malware, the other subnetworks won’t be infected.

By implementing network segmentation, the data breach at the Starwood guest reservation network was contained to this network alone, preventing the spread of the intrusion to Marriott’s other properties, including Marriott-branded hotels.

Encrypt Important Data

While encryption alone isn’t enough to protect important data, encryption adds a security layer in data protection. Encryption also means that an unauthorized party has to undertake an extra step and extra time to get the decryption key to unlock the encrypted files.

In the case of the Marriott data breach, the only data that was encrypted was limited to payment card numbers. The hotel chain though doesn’t discount that the unauthorized party had gotten hold of the decryption key or keys to unlock the encrypted payment card numbers.

Encryption doesn’t have to be limited to payment card numbers. In the case of the Marriott data breach, important personally identifiable information, including passport numbers, wasn’t encrypted. What happened in the Marriott data breach was that instead of the company doing the encryption to add an additional layer of protection, the unauthorized party did the data encryption in order to avoid detection by any data-loss prevention tools.

Data decryption isn’t an easy thing to do. According to Marriott, while it discovered the data breach on September 8, 2018, it took the company until November 19, 2018 to decrypt the files encrypted by the unauthorized party.

Always Assume that an Intrusion Has Occurred

To date, the cause of the Marriott data breach is still unspecified. The hotel chain, however, identifies the culprit of the data breach as "unauthorized party", a phrase that could mean a malicious insider or a malicious outsider.

Network intrusion carried out by a malicious outsider could happen in many ways. This could happen via phishing attacks using malicious emails containing malicious links and malicious attachments or via unknown security vulnerabilities exploited by a malicious outsider.

Proactive organizations have adopted the assumption that their networks are vulnerable to intrusion. Many organizations today engage the services of “penetration testers”, also known as ethical hackers. These ethical hackers search for and exploit security vulnerabilities in web-based applications, networks and systems and report back to the organization for the organization to fix the security loopholes.

Monitoring any insider activities within the network is also important. Intrusion by a malicious insider should be assumed all the time. An insider has all the tools needed to abuse one’s access to the trove of data that your organization hold. Your organization must have an automated tool that flags unusual activities, such as abnormal working hours, abnormal access to voluminous data and most importantly unusual volume of data transfer.

Contact ustoday if you need assistance in protecting and detecting intrusions in your organization’s networks, resulting from the actions of a malicious insider or malicious outsider.

Hard Lessons from a Ransomware Attack

A regional county municipality in the province of Quebec, Canada has learned the hard lessons about cybersecurity after it suffered a paralyzing ransomware attack.

Bernard Thompson, reeve of Mekinac regional county municipality, told The Canadian Pressthat the ransomware attack that paralyzed the municipality’s servers gave the municipality hard lessons in cybersecurity. “In the end, in terms of the security of our system, [the ransomware attack] was actually positive,” Thompson said.

The cyberattack against Mekinac's servers highlights the importance of protecting your organization's servers against ransomware attacks.

How the Mekinac Cyberattack Unfolded

The Canadian Press reported that on September 10, this year, municipal employees, upon returning to work after a weekend break, found a ransomware notice on their working computers, informing them that their files are locked. The ransomware notices also specified that in order to unlock the files, a total of 8 Bitcoins, then equivalent to $65,000, must be paid to the attackers.

The municipality’s servers were disabled for nearly 2 weeks as a result of the ransomware attack. The attack ended when the municipality negotiated and paid $30,000-worth of Bitcoin as ransom payment to unlock the locked files.

“It was hard, clearly, on the moral side of things that we had to pay a bunch of bandits,” Thompson said. He said this was the road that the municipality took as choosing the other way could mean months of data re-entry, costing significantly more than $30,000.

Mekinac’s ransomware attackers are still unidentified and their location not determined to date.

What is a Ransomware Attack?

Ransomware is a malicious software (malware) that encrypts files. Encryption is traditionally used to prevent data theft. In encryption, plaintext or any other form of data is converted from a readable format into an encoded version – a format that can only be readable if one has access to a decryption key.

In a ransomware attack, attackers convert the victim’s data from a readable format into an encoded version and demand from the victim ransom payment in exchange for the decryption key.

Ransomware infects computers or servers in many ways. Here are some of the ways that ransomware infects computers or servers:

1. Email-Based Attack

In the case of the Mekinac ransomware attack, the municipality’s servers were infected by a ransomware after an employee opened and clicked on a link in a malicious email sent by the attackers. It wasn’t specified, however, what particular ransomware hit the Mekinac’s servers.

The ransomware called “Locky” is an example of a ransomware that’s spread via email spam campaigns. This ransomware arrives in a victim’s computer through a Microsoft Office email attachment that evades antispam filters and tricks the user to open the attachment. Once this malicious attachment is clicked, Locky encrypts computer files and then demands the victim to pay a ransom to unlock the encrypted or locked files.

2. Drive-By Attack

Drive-by attack is another way by which attackers infect computers or servers. Bad rabbit ransomware is an example of a ransomware that’s distributed via drive-by attacks.

In a drive-by attack, attackers insert a malicious code, in this case, a ransomware, into an insecure website. Once a user visits this compromised site, the malware may either directly download to the visitor’s computer or the visitor is redirected to another website controlled by the attackers and from there the malware is downloaded to the victim’s computer.

3. Unpatched Servers

The ransomware called “SamSam” is an example of a ransomware that infects servers when they’re in an unpatched state. An unpatched server is one that isn’t updated despite the availability of a security update.

Researchers at Cisco Talos, in a blog post, wrote, “Adversaries are exploiting known vulnerabilities in unpatched JBoss servers before installing a web shell, identifying further network connected systems, and installing SamSam ransomware to encrypt files on these devices.”

Lessons from Ransomware Attacks

Thompson, reeve of Mekinac regional county municipality, said that the ransomware attack on Mekinac’s servers taught the municipality to encrypt everything and to analyze every email. “Everything is encrypted now,” Thompson said. “Every email is analyzed before we even receive it. Every day, our system catches malicious emails trying to penetrate – but they are stopped. But the attacks keep coming.” 

In addition to encryption and email scanning, here are additional best practices in order to protect your organization’s servers from ransomware attacks:

Back Up Important Files

Back up files that are stored in safe storages that aren’t connected to your organization’s servers give your organization assurance that if anything happens with the servers, for instance, a ransomware attack, your organization will still have other copies of the important files. This eliminates the pressure of paying ransom to attackers for the decryption key to unlock the locked files.

Keep All Software Up-To-Date

Make sure that all your organization’s software, specifically the server operating system, are up-to-date. Every security update or patch issued by software vendors contains fixes of security vulnerabilities that cybercriminals are quick to exploit.

Implement Domain Whitelisting

Whitelisting certain domains won’t prevent drive-by download attacks, but it’ll prevent secondary malicious websites from loading.

Limit the Number of Users with Administrator Privileges

A computer user with administrator privileges can install and uninstall software and change configuration settings. Limiting this privilege to a limited number of personnel limits the exposure of your organization’s servers to drive-by attacks.

When your organization needs help, our experts are a phone call away. Contact ustoday to prevent ransomware attacks.

New Mirai Variant Hijacks Enterprise Linux Servers for DDoS Attacks

Researchers at Netscout have discovered a new variant of Mirai – a malicious software (malware) once known for hijacking hundreds of thousands of Internet of Things (IoT) devices, including wireless cameras, routers and digital video recorders, to conduct powerful distributed denial-of-service (DDoS) attacks.

Instead of infecting IoT devices, researchers at Netscoutsaid that the new Mirai variant infects non-IoT devices, in particular, enterprise Linux servers running Apache Hadoop YARN, to serve as DDoS bots.

The original Mirai malware, at its peak, infected hundreds of thousands of IoT devices, controlling these infected IoT devices as botnet to conduct high-impact DDoS attacks. Botnet refers to a group of computers controlled by attackers without the knowledge and consent of the owners to conduct malicious activities, including DDoS attacks. In a DDoS attack, the botnet or controlled computers act in unison, flooding the internet connection of a target, for instance, a particular website.

The original Mirai first came to public attention when it launched a DDoS attack against the website of journalist Brian Krebson September 20, 2016. A few days after, on September 30, the source code of Mirai was publicly released on the English-language hacking community Hackforums by a user using the screen name “Anna-senpai”.

Paras Jha, 22, the person behind Anna-senpai, pleaded guilty for co-creating Mirai. According to the U. S. Department of Justice, from December 2016 to February 2017, Jha along with his 2 college-age friends Josiah White and Dalton Norman, admitted that they successfully infected more than 100,000 IoT devices, such as home internet routers, with Mirai malware and used the hijacked IoT devices to form a powerful DDoS botnet.

Since the public release of the source code of Mirai, a number of Mirai variants have been created and released into the wild. According to Netscout researchers, this latest Mirai variant “is the first time we’ve seen non-IoT Mirai in the wild”.

How the Latest Mirai Variant Works?

To deliver the latest Mirai variant, attackers exploit the security vulnerability of Apache Hadoop YARN.

Apache Hadoop is an open source software framework that enables a cluster or group of computers to communicate and work together to store and process large amounts of data in a highly distributed manner. Meanwhile, YARN, which stands for Yet Another Resource Negotiator, is a key feature of Hadoop that helps in job scheduling of various applications and resource management in the cluster.

According to Netscout researchers, the latest Mirai malware will exploit unpatched Linux servers running on Apache Hadoop YARN, and will attempt to brute-force – attacks that systematically attempt to guess the correct username and password combination – the factory default username and password of the Hadoop YARN server.

DemonBot Vs. Latest Mirai Variant

Researchers at Radwaredetected last month another malware called “DemonBot” that infects Hadoop clusters by leveraging YARN’s unauthenticated remote command execution.

The main similarity between DemonBot and the latest Mirai variant is that both malware exploit the Hadoop YARN security vulnerability in order to infect computers. Both malware programs also turn infected computers as botnet for the purpose of launching DDoS attacks.

Enterprise Linux servers running Apache Hadoop YARN infected by DemonBot and the latest Mirai variant are dangerous as these servers account for large volumes of DDoS traffic.

The main difference between DemonBot and the latest Mirai variant is that DemonBot spreads only via central servers and doesn’t expose worm-like behavior exhibited by Mirai variants. Mirai’s worm-like behavior – its ability to spread itself within networks without user interaction – makes it a more dangerous malware than DemonBot.

According to Radware researchers, as of late October, this year, attackers attempted to exploit the Hadoop YARN vulnerability to deliver the DemonBot at an aggregated rate of over 1 million per day. 

Original Mirai Vs. Latest Mirai Variant

According to Netscout researchers, the latest Mira variant behaves much like the original Mirai. This means that both have worm-like behavior and enslaves infected computers for the purpose of launching DDoS attacks.

The main difference between the original Mirai and the latest Mirai variant is that while the original Mirai runs on IoT devices, the latest Mirai variant runs on Linux servers, in particular, those running Apache Hadoop YARN.

“Linux servers in datacenters have access to more bandwidth than IoT devices on residential networks, making them much more efficient DDoS bots,” researchers at Netscout said. ”A handful of well-resourced Linux servers can generate attacks that compete with a much larger IoT botnet.”

According to Netscout researchers, there are tens of thousands of attempts per day to exploit the Hadoop YARN vulnerability to deliver the latest Mirai variant.

Prevention

The risk of further cyberattacks is high for machines infected by malware like Mirai. To prevent attackers from hijacking your organization’s Linux servers running Apache Hadoop YARN for DDoS attacks, make sure to configure your YARN’s access control by using strong username and password combination.

Also, keep all your organization’s software up-to-date and prevent brute-force attacks by implementing an account lockout policy. For instance, after a certain number of failed login attempts, the account is locked out until an administrator unlocks it.

By leveraging the security vulnerability in enterprise Linux servers running Apache Hadoop YARN, attackers can generate much powerful DDoS attacks. Protect your organization’s online resources like websites from DDoS attacks by using an easy to use, cost-effective and comprehensive DDoS protection.

Contact us today if you need assistance in protecting your organization’s network from malware like Mirai and protecting your organization’s online resources from DDoS attacks.

How Cryptocurrency Mining Malware Evades Detection

The recent rise of cryptocurrency mining malware is driven not just because of its high-profit potential, but also because of its ability to remain undetected in a compromised system.

Early this month, Nova Scotia-based St. Francis Xavier University announced that it purposely shut down all its network systems in response to a cryptojacking attack, whereby attackers attempted to illicitly mine the cryptocurrency Bitcoin using the university’s collective computing power. 

The price of Bitcoin as of November 13, 2018 (8:30 AM GMT+7) is $6,370, way below the all-time high of nearly $20,000 in December 2017, but still way above the $317 price of Bitcoin way back in January 2015.

Mining Bitcoin, in order to be profitable, one needs to invest in a reasonable number of powerful computers and high electricity cost. Illicit cryptocurrency mining, also known as cryptojacking, hijacks the computing power of someone else’s without their consent to mine cryptocurrency such as Bitcoin.

Cryptocurrency Mining Malware Evasion Techniques

Many organizations continue with their usual IT operations without even realizing that the organization’s computers are illicitly used by cyberattackers for cryptocurrency mining.

Based on the combined data of several Cyber Threat Alliance (CTA)members, from 2017 to September 2018, illicit cryptocurrency mining increased by 459%.

Researchers at Trend Microrecently discovered a cryptocurrency mining malware that uses multiple techniques to evade detection. The cryptocurrency mining malware discovered by researchers at Trend Micro as Coinminer.Win32.MALXMR.TIAOODAM uses the following evasion techniques to make it harder for detection tools to discover it:

First, Coinminer.Win32.MALXMR.TIAOODAM evades detection as it arrives on the victim’s computer as Microsoft Windows Installer MSI file. Windows Installer is a software program that’s used for installing and uninstalling software. Using a real Windows component, researchers at Trend Micro said, makes the cryptocurrency mining malware looks less suspicious and potentially allows it to bypass certain security filters.

Second, Coinminer.Win32.MALXMR.TIAOODAM evades detection as it creates copies of the kernel file ntdll.dll and the Windows USER component user32.dll in %AppData%\Roaming\Microsoft\Windows\Template\FileZilla Server\{Random Numbers}. Researchers at Trend Micro theorized that this is done to prevent detection of the cryptocurrency mining malware’s application programming interface (API) – a set of programming instructions and standards for accessing a software application.

Third, Coinminer.Win32.MALXMR.TIAOODAM evades detection as it comes with a self-destruct mechanism, a feature that deletes every file under its installation directory and removes any trace of installation in the system.

Fourth, Coinminer.Win32.MALXMR.TIAOODAM evades detection as it comes with WiX, which stands for Windows Installer XML, a free software toolset for building Windows Installer packages from XML. Researchers at Trend Micro said that WiX is an added layer developed by the attackers to evade detection.

Initial infection of Coinminer.Win32.MALXMR.TIAOODAM could come from emails laden with malicious attachments and malicious URLs.

Early this year, attackers used multiple techniques in their cryptocurrency mining malware to evade detection, this time, in utilizing Tesla’s computing power to mine a cryptocurrency.

In February this year, RedLockreported that Tesla’s Amazon Web Services (AWS) cloud account was compromised by attackers through Kubernetes – an open source software used to deploy and manage cloud-based applications and resources. RedLock said that Tesla's Kubernetes wasn’t password protected, enabling attackers to execute from the Kubernetes a cryptomining command.

According to RedLock, the cryptocurrency mining malware used in the Tesla cryptojacking incident wasn’t initially detected as the attackers used the following evasion techniques:

First, the attackers configured the cryptomining malware to keep the CPU usage low to evade detection. CPU, which stands for central processing unit, is the component that performs most of the processing inside a computer. Unusual high CPU usage is a sign that computers are being used for cryptocurrency mining.

Illicit Bitcoin mining is typically discovered through unusual high CPU usage. It’s, however, not enough to check the CPU usage as guage for cryptocurrency mining as other cryptocurrencies have less CPU usage.

Aside from the illicit mining of Bitcoin, attackers are also drawn in hijacking the computing power of others to mine the cryptocurrency Monero (valued $105 as of November 13, 2018 at 10 AM GMT+7) as this cryptocurrency uses less computing power and anonymous compared to Bitcoin.

Second, attackers in the Tesla cryptojacking incident didn’t use a well-known public “mining pool” – a means by which cyrptominers share their computing power over a network and split the reward equally. By using an “unlisted” or semi-public mining pool, the attackers in the Tesla cyrptojacking incident was initially unnoticed.

Third, in addition to using an unlisted mining pool, the attackers in the Tesla cyrptojacking incident hid the true IP address of their mining pool server behind CloudFlare, a free content delivery network (CDN) service, making detection even more difficult.

Fourth, the attackers in the Tesla cryptojacking incident configured their cryptomining malware to listen on a non-standard port, making it difficult to detect unusual activity based on port traffic.

Prevention

Protecting your organization’s computers or network from cryptocurrency mining malware is important as this malware can damage your organization’s computers, negatively impact business operations and can lead to further cyberattacks.

Here are some measures to prevent attackers from using your organization’s computing power for cryptocurrency mining:

• Use email inspection tool that can detect malicious attachments and URLs.

• Monitor configurations. By monitoring configurations, exposed or unprotected software can be identified.

• Monitor traffic. By monitoring traffic, suspicious traffic can early on be identified.

Why the Pentagon Data Breach is a Wake-up Call for Better Screening of Third-party Vendors

On October 14 2018, news of a major data breach at the Pentagonhit the headlines.

This was a startling, even disturbing, reminder that even the most important, most secure institutions in the world are vulnerable when hackers identify a way into their systems. As the Department of Defense’s headquarters, the Pentagon plays a critical role in the United States military and national security: it oversees all aspects of the Air Force, Marines, Army, Coast Guard and Navy, ultimately helping to defend the country.

The very notion that a global symbol of security and power would fall prey to a data breach has surprised many,but it shouldn’t have. At a time when cyber-criminals continue to employ increasingly-sophisticated techniques to disrupt business and organizations of all kinds, this incident is proof positive that proper screening of third-party vendors is critical for effective cybersecurity.

What Data was Involved in The Pentagon Breach?

It’s believed as many as 30,000 employees’ travel records were compromised as a result of the data breach. This includes personal details and credit-card data pertaining to civilians and military personnel: all sensitive information that could have serious financial repercussions if acted upon.

The breach may have first occurred months before it was discovered, and it’s believed the actual number of people potentially affected could rise as the investigation continues. However, no classified information is said to have been compromised.

How Did the Pentagon Breach Happen?

The Pentagon breach was the result of workconducted by a ‘single commercial vendor’, delivering its service to a ‘very small percentage’ of the DoD’s employees. The vendor in question has remained anonymous and was, in the days after the announcement, still contracted to provide its services.

News of the breach struck after the U.S. Government Accountability Office confirmed that work had been undertaken to secure the Pentagon’s networks, though its weapons system security was under closer scrutiny. They claimed they face more and more challenges in keeping weapons systems secure, due to the rise of sophisticated cyber-crime tactics.

Pentagon personnel have faced similar issues before. A large attack on the federal Office of Personnel Managementin 2015 left the personal details of over 21 million individuals (including people at the Pentagon) compromised. As with this latest incident, the 2015 attack supposedly first occurred months before word of it reached the media.

Who was Responsible for The Pentagon Breach?

One or more attackers seized an opportunity to exploit the vendor’s access to the Pentagon’s network, ultimately stealing the travel records. Little else is known.

This incident, though, is a prime example of how ambitious (or, rather, brazen) cyber-criminals are in their choice of targets. While some may focus on distributing ransomware to small businesses in exchange for payment, others are clearly setting their sights a little higher.

The tools and technology available to such individuals empowers them to exploit weaknesses in even those systems that should be the most airtight in the world. While the exact circumstances surrounding the vulnerability created by the vendor remain secret, it’s no doubt the company responsible is determined to avoid such an oversight happening again.

It’s also highly likely that the vendor has a strong reputation and valuable experience to have even secured the contract with the Department of Defense in the first place.

This entire incident demonstrates why it’s so vital for businesses and organizations of all sizes, in all sectors, to perform thorough screening of any vendors they intend to work with.

Screening Vendors, Protecting Your Business

No business or organization should ever start working with a vendor without checking their credentials and their background.

Simply settling on the first firm on your radar may not deliver the results you expect — and any mistakes or general incompetence on their part could have major repercussions. You might not have data pertaining to thousands or even millions of civilians in your records, but you could still be risking your customers’ and employees’ privacy by choosing a sub-par team.

If a data breach were to rock your company or organization, the damage could be extensive. First and foremost, those customers whose details have been compromised would be incredibly unlikely to keep working with you in the future.

Fast, effective action can help to minimize the fallout and keep their finances safe from unauthorized access, but their perception of your brand would still be soured.

Your reputation would be affected too, making it more difficult to build trust with new customers or affiliates. That’s not to mention the sheer disruption a breach could cause to your everyday operations, leaving you unable to deliver the services your customers expect for hours, days or longer.

This equates to a potential loss of business and, sadly, income.

Undertaking effective, in-depth screening of your vendors is the smart choice.

Look into any reviews you can find online to learn more about the quality of service previous clients have received. Did they perform as required? Did they use the right processes and achieve the goals they set out to with respect for the client’s security needs?

You may consider approaching some of these clients to get a deeper insight into their experience.

Make sure to speak with prospective vendors at length, to get a better idea of how they work, what security measures they take to safeguard systems against breaches and more. You can only ask so many questions and ask for so many examples of their prior work before making your decision but doing your research will help ensure the safest choice for your business or organization.

At The Driz Group, we’re committed to helping our clients stay protected and compliant, minimizing the risk of cyber-attacks using the latest, automated third-party screening technologies. Want to learn more about what we can do for you? Just get in touch!

Look Back into the First Major Cyberattack: The Morris Worm

Thirty years ago, the Morris worm, dubbed as the first major cyberattack, was unleashed into the wild, crashing or slowing to a crawl 10% or 6,000 of the 60,000 computers then connected to the “Internet”. 

What Is Morris Worm?

Morris worm is named after its creator Robert Tappan Morris. A worm, meanwhile, refers to a type of malicious software (malware) that has the ability to spread itself within networks without user interaction.

Courtdocuments showed that Morris, then a first-year graduate student at Cornell University's computer science Ph.D. program, released the worm on November 2, 1988 through a computer at the Massachusetts Institute of Technology (MIT), which Morris hacked using a Cornell University's computer.

Morris worm was released into the wild a year before the world wide web came into existence. The term “Internet” then referred to a U.S. computer network, composed of connected computers from prestigious colleges, research centers, governmental and military agencies.

In less than 24 hours on November 2, 1988, Morris worm infected the computers of institutions, including Harvard, Princeton, Stanford, Johns Hopkins, National Aeronautics and Space Administration (NASA) and the Lawrence Livermore National Laboratory.

While the worm didn’t destroy or damage files, infected computers slowed to a crawl or ceased functioning and emails were delayed for days. The estimated cost of dealing with the Morris worm at each installation ranged from $200 to over $53,000.

The worm infected computers running a specific version of the Unix operating system in 4 ways:

First, via a security vulnerability in “SEND MAIL”, a computer program that transfers and receives electronic mail;

Second, via a security vulnerability in the "finger demon", a computer program that allows extraction of limited information about the users of another computer;

Third, via "trusted hosts" feature that allows a user with certain privileges on one computer to have equivalent privileges on another computer without using a password; and

Fourth, via a program that guesses passwords using various combinations of letters tried out in rapid succession, hoping that one will be an authorized user's password. When the correct password is entered, the intruder is allowed whatever level of activity that the user is authorized to perform.

Morris designed the worm to stay hidden. The worm was designed in such a way that it won’t copy itself onto a computer that already had a copy. The worm was also designed in such a way that it would be killed when a computer was shut down.

Consequences of the Morris Worm

For unleashing the worm into the wild, Morris became the first person convicted for violating the U.S. Computer Fraud and Abuse Act, which outlaws unauthorized access to protected computers. He was sentenced to 3 years of probation, 400 hours of community service, a fine of $10,050 and the costs of his supervision.

The first major cyberattack perpetrated by the Morris worm showed how vulnerable interconnected computers had become. Just days after the Morris worm attack, the U.S. Government created the country’s first computer emergency response team under the direction of the Department of Defense. Developers also began creating intrusion detection software.

On the flip side, the Morris worm inspired a new breed of malicious hackers, plaguing the digital age. In recent memory, the worm that resembles the devastation caused by Morris worm is the WannaCry worm, commonly known as WannaCry ransomware.

In less than 24 hours on May 12, 2017, more than 300,000 computers in 150 countries were infected by WannaCry, each demanding a ransom payment. WannaCry is categorized as a worm as similar to the Morris worm as it has the ability to spread itself within networks without user interaction.

WannaCry specifically exploited the security vulnerability in Server Message Block Protocol (SMB protocol) in some versions of Microsoft Windows. SMB protocol allows users to access files, printers and other resources on a network.

Prevention

Here are some cybersecurity measures to protect your organization’s computers or networks from worms similar to WannaCry and Morris worms:

Implement Network Segmentation

In network segmentation, vital computers that housed critical information and operations are separated or disconnected from computers connected to vulnerable systems like the public internet. Network segmentation ensures that when internet-facing computers are infected by a worm, these vital computers aren’t affected.

Keep All Software Up-to-Date

Make sure that software security updates are installed as timely as possible, not months or years after the release dates of the security updates.

Cyberattackers have automated the process of scanning the internet for finding vulnerable computers – those that fail to install security updates. This was the case for WannaCry victims as they failed to install the security update issued by Microsoft months before the WannaCry cyberattack.

Refrain from Using Legacy Hardware and Software

The term “legacy” refers to old and outdated computer hardware or software. Similar to computers that fail to timely install security updates, legacy hardware and software programs are similarly targetted by cyberattackers as these legacy hardware and software programs no longer receive security update from their vendors.

Some versions of the Microsoft Windows (Windows XP, Windows 8, and Windows Server 2003 operating systems) were targeted by WannaCry attackers as well as during the attack these software programs were no longer supported by Microsoft. A day after the WannaCry attack, however, Microsoft released security updates for Windows XP, Windows 8, and Windows Server 2003.

Protecting computers or networks from worms and other malicious software is important in order to prevent data breaches. Under Canada’s Digital Privacy Act, starting November 1 this year, private organizations are mandated to notify the Privacy Commissioner of Canada and the affected individual “as soon as feasible” in the event that a data breach poses a “real risk of significant harm” to any individual.

When you need help assessing and mitigating the cybersecurity risks, contact out team of expertsand minimize the likelihood of a data breach.

New Botnet Launches DDoS Attacks from Linux Computers

Researchers at SophosLabs have discovered a new botnet that launches a distributed denial-of-service (DDoS) attack from compromised Linux servers and IoT devices.

What is a DDoS Botnet? 

A botnet is a collection of computers compromised by a malicious software (malware) and controlled as a group without the owners' knowledge to conduct illegal activities, including DDoS attacks.

In a DDoS attack, hijacked or compromised computers are controlled as a group to attack a particular target, for instance, to overwhelm a particular website with traffic to render the site inaccessible to legitimate users. By leveraging the use of a botnet, attackers can carry out large-scale DDoS attacks. 

DDoS attacks don’t just target websites. They also target servers (web, email, DNS, file), web apps, banking, trading and e-commerce platforms, and VoIP systems.

Latest DDoS Botnet

SophosLabs researchers called the latest DDoS botnet that they’ve discovered “Chalubo”. The researchers said they first observed Chalubo in the wild in late August this year. On the 6th of September 2018, SophosLabs researchers said they first recorded how Chalubo works via a honeypot, a decoy computer system used in tracking new hacking methods.

According to the researchers, Chalubo attacks SSH servers, a software program used to remotely access Linux operating systems. There are currently a variety of Chalubo botnet versions for different processor architectures, including both 32- and 64-bit ARM, x86, x86_64, MIPS, MIPSEL and PowerPC.

Chalubo attackers gain access to a computer by using publicly known default and common username and password combinations. Once the attackers gain access to a computer, it issues commands that retrieve the Elknot, also known as Linux/BillGates malware, a notorious DDoS botnet family that runs on both Linux and Windows operating systems. Elknot, in turn, delivers the rest of the Chalubo botnet package.

This recently reported DDoS botnet incorporates the code of two other notorious DDoS botnets, the Mirai botnet and Xor.DDoS botnet.

In December last year, 3 college-age friends pleaded guilty for creating the Mirai botnet. According to the U.S. Department of Justice, the Mirai botnet, at its peak, consisted of hundreds of thousands of compromised IoT devices used to launch DDoS attacks.

Xor.DDoS botnet, meanwhile, was first observed in the wild in 2015. This botnet hijacks Linux computers for DDoS attacks. While Mirai uses 62 default username and password combinations to gain access to a computer or device, Xor.DDoS uses common or weak username and password combinations.

Chalubo, in particular, uses some of Mirai’s randomizing functions and what appears to be an extended form of the util_local_addr function. Chalubo also uses Xor.DDoS’ DelService & AddService functions, as well as Chalubo’s script gets dropped exactly in the same manner as Xor.DDoS. While Chalubo copies a few code snippets of Mirai and Xor.DDoS, it’s a different botnet taken as a whole, researchers at SophosLabs said.

“The majority of functional code in this bot is entirely new, with a focus on their own Lua handling for, primarily, performing DoS attacks with DNS, UDP, and SYN flavours,” SophosLabs researchers said. “The Lua script built into the bot is a basic control script for calling home to a C2 [command-and-control] server to inform the C2 about details of the infected machine.”

Chalubo’s Lua script communicates with the command-and-control server – a computer that’s controlled by attackers – to receive further instructions. The purpose of the script is to download, decrypt and then execute whatever the script finds.

Chalubo's main components, dropper (the Elknot), main bot and Lua script, are encrypted using the ChaCha stream cipher in an effort to prevent detection. SophosLabs researchers observed that Chalubo triggered the infected computer to conduct a DDoS attack against a single Chinese IP address over port 10100, without masking the local source IP.

According to SophosLabs researchers, the creator or creators of Chalubo botnet may be at the end of testing their botnet and we may see an increase in activity from this new botnet.

Prevention

A DDoS botnet negatively impacts the hijacked computers. In a similar manner, a DDoS attack negatively impacts a target.

Here are a few signs that the computer in your organization may be a part of a botnet:

-Computer fan kicks into overdrive even when it’s idle

-It takes a long time to shut down the computer or it won’t shut down properly

-Computer programs and internet access are slow

Here are some security measures to prevent attackers from turning the computers in your organization as part of the Chalubo, Mirai or Xor.DDoS botnets:

-Change default and common username and password combinations as these botnets hunt computers using default and common or weak username and password combinations

-In the case of the Chalubo botnet, use SSH keys instead of passwords for logins

-Keep all your software up-to-date

On the part of the DDoS botnet target, a successful DDoS attack against a website, server, e-commerce platform or VoIP system negatively impacts the target’s reputation and damages existing client relationships.

DDoS botnets can be prevented from attacking online resources by regularly monitoring traffic and by conducting a DDoS testing – called in the cybersecurity field as penetration or pen testing.

By monitoring the traffic of your organization’s online resources, abnormal and suspicious traffic can be flagged early on. In DDoS testing, simulated DDoS attacks are conducted against the online resources of your organization to check if they can withstand real DDoS attacks.

Contact ustoday if you need assistance in preventing attackers from hijacking your organization’s computers as part of a DDoS botnet or if you want assistance in protecting your organization’s online resources from DDoS attacks.

 

Search Engines Blacklist Fewer Sites, Study Shows

A study conducted by SiteLock showed that search engines are blacklisting fewer sites.

Blacklisting happens when a search engine removes a website from its results due to the presence of a malicious software (malware).

In the second quarter of 2018, SiteLockanalyzed over 6 million websites through the use of malware scanners. SiteLock’s analysis showed that search engines like Google and Bing only blacklisted 17.5% of infected websites with malware in the second quarter of 2018, a 6% decrease from the previous year.

Prevalence of Website Malware

Website visitors and website owners alike rely on search engine warnings. On the part of website visitors, they rely on search engines to flag malicious websites that may leave them unprotected as they surf the web.

According to SiteLock, when website owners rely mainly on search engine warnings and outwardly facing symptoms, they may be missing malware that’s attacking their website visitors.

Even as search engines are blacklisting fewer sites, malicious websites aren’t getting fewer. SiteLock’s study showed that 9% or as many as 1.7 million websites have a major security vulnerability that could allow attackers to embed malware on them. The 3 most common security vulnerabilities on websites identified by SiteLock are SQL injection (SQLi), cross-site scripting (XSS) and cross-site request forgery (CSRF).

SQLi security vulnerability allows attackers to inject malicious database code into website text fields or forms. In an SQL injection attack, an attacker can gain full access to the website’s MySQL database, administrative back end or the entire website. MySQL refers to an open source management system that makes it convenient to add, access and manage content in a website's database. 

XSS security vulnerability allows attackers to inject malicious code into a web form or web application. In a cross-site scripting attack, the web application is tricked into doing something that it isn’t supposed to do. CSRF, meanwhile, is often used with social engineering – tricking victims. In a cross-site request forgery attack, an attacker forces authenticated users to do unauthorized actions while logged into a vulnerable web application.

SiteLock’s sampled websites showed that 7.19% of sites have an SQLi vulnerability, 1.56% of sites have an XSS vulnerability and .19% of sites have a CSRF vulnerability.

Browser-Based Cryptojacking

SiteLock’s study also found that sampled websites experience an average of 58 attacks per day, with 1% of the sites infected with a malware. The study further found that website attacks are becoming increasingly sneaky and difficult to detect. An example of a symptomless attack on websites is the browser-based cryptojacking, which doubled (2%) in number compared to last year’s number (1%), according to SiteLock’s study. In browser-based cryptojacking, an attacker hijacks a browser to mine a cryptocurrency.

McAfee’s Blockchain Threat Reportshowed that nearly 30,000 websites host the Coinhive code for mining cryptocurrency with or without a user’s consent. This number, according to McAfee Labs, only accounts for non-obfuscated sites, which means that the actual number is likely much higher.

As it stands, Coinhive resides in a gray area of legitimacy. In an ideal world, both the website owner and website visitor must consent to Coinhive’s browser-based cryptocurrency mining. 

A website owner or, in the case of a cyberattack, an attacker may embed the Coinhive code into a website. When a user visits a website with an embedded Coinhive code, the cryptocurrency called “Monero” is then mined from the user's browser using the computing power or CPU of the website visitor. As of October 21, 2018, the price of one Monero coin is $103.

When the Coinhive code is embedded into the website by a website owner, the cryptomining income goes to the website owner. When the Coinhive code is embedded by a cyberattacker, the cryptomining income goes to the attacker.

Coinhive code made its way to YouTube. In January this year, Trend Microdiscovered that attackers abused Google's DoubleClick ad platform, enabling the attackers to display ads on YouTube that contain the Coinhive code. YouTube visitors in select countries, including Japan, France, Taiwan, Italy and Spain were affected, with 80% of the affected visitor's CPU resource was used to mine the cryptocurrency Monero.

"Mining cryptocurrency through ads is a relatively new form of abuse that violates our policies and one that we’ve been monitoring actively,” a Google representative said in a statement. “We enforce our policies through a multi-layered detection system across our platforms which we update as new threats emerge. In this case, the ads were blocked in less than two hours and the malicious actors were quickly removed from our platforms.”

Check Pointranked 3 browser-based cryptocurrency mining scripts Coinhive (ranked #1), Crypto-Loot (ranked #2) and JSEcoin (ranked #4) as “February 2018’s Top 10 ‘Most Wanted’ Malware”.

Prevention

Here are some of the security measures that need to be put in place in order to prevent attackers from installing malware into your website:

Use a Website Malware Scanner

A website malware scanner allows website owners to check their sites for web-based malware.

Keep All Website Applications Up-to-Date

Ensure that your web applications are up-to-date. Using outdated web applications with known security vulnerabilities can leave your website vulnerable to exploitation by cyberattackers.

Use Web Application Firewall (WAF) 

Filtering web traffic via WAF is one of the measures in protecting your website from a successful cyberattack. Your traditional perimeter firewalls don’t protect your website.

Contact ustoday if you need assistance in protecting your website against cyberattacks.