Blog

Sucks to be a polar bear

Protect yourself! Visit www.cyberprosconsulting.com today! A lot of social engineering draws its plausibility from current events. Some of these are as predictable as the calendar. Valentine’s Day? Here’s a quick link to get you those flowers and candy you forgot about. Tax season? Hey, it’s us, the IRS. March Madness? Click here to share your bracket (come on, it’ll be fun). We’ve warned about all of these elsewhere. But other, more serious and less predictable events also shape phishbait. International conflict increasingly plays out in cyberspace as well as physical space. And nation-state hacking units work social engineering as much as any common criminal. The hackers, probably Russian, who intruded into the Winter Olympics networks got there by phishing. Other Russian hackers who’ve taken down sections of the Ukrainian power grid over the last few years got into the utilities’ networks by phishing. Currently an Iranian threat group, called variously “MuddyWater” or “TEMP.Zagros,” is phishing targets in the Middle East and Asia. The goal appears to be strategic intelligence. The means by which MuddyWater accomplishes its cyberespionage is a phishing email baited with a plausible, malicious Word document. When gullible recipients open the email and click the attachment, they install the spyware payload. It pays for any business to keep abreast of geopolitical events if only for this reason: they can help keep their employees aware of some likely forms social engineering will take. You may not be interested in geopolitics, but geopolitics is interested in you. One of the larger crises with significant implications for cyberspace is the current conflict between the UK and Russia over Russia’s apparent attempt to assassinate a spy and his daughter in England. Both sides are threatening cyber retaliation. Security awareness training should be as realistic and timely as possible. KnowBe4 has a Current Events phishing template category that is kept up to date with today’s breaking news items. See Comodo’s take on the correlation of attacks with current events here:

Protect yourself! Visit www.cyberprosconsulting.com today! Last summer, a petrochemical plant in Saudi Arabia was the target of a cyber attack that investigators believe was designed to sabotage the plant’s operations and cause an explosion. Iran is probably behind it. Bug in code prevents deaths The only reason the explosion did not occur was that there was a bug in the attack code. The incident is being investigated by Mandiant, Schneider Electric, the NSA, the FBI, the US Department of Homeland Security (DHS) and the Pentagon’s Defense Advanced Research Projects Agency (DARPA). Generally the Iranians use spear phishing attacks to get into their targets. The story is in the NY Times and a recommended read. Also excellent to send to your management because stories like this illustrate the need for increased IT security budget: https://goo.gl/uNs7JD

Found this article on canadianunderwriter.ca and found it very interesting thought I’d share.

The potential for “destruction of service” (DeOS) attacks is greatly concerning and organizations would be well-advised to adopt a proactive cyber stance in their protection efforts to combat increasingly sophisticated attackers, warns a new report from Cisco.

Cyber security concept businessman Lock on digital screen, contrast, virtual screen with a consultant doing presentation in the background Closed Padlock on digital, cyber security, key

“Cyber incidents such as WannaCry and Nyetya show the rapid spread and wide impact of attacks that look like traditional ransomware, but are much more destructive,” the firm cautioned Thursday in releasing the Cisco 2017 Midyear Cybersecurity Report.

“These events foreshadow what Cisco is calling destruction of service attacks, which can be far more damaging, leaving businesses with no way to recover,” the company notes. “These could eliminate organizations’ back-ups and safety nets, required to restore systems and data after an attack,” it explains.

The WannaCry and Nyetya attacks show “adversaries are becoming more and more creative in how they architect their attacks,” Steve Martino, vice president and chief information security officer at Cisco, says in the statement.

“How DeOS attacks will play out and what they will look like depends on the threat actors’ core motivations and the limits of their creativity and capabilities,” the latest report adds.

“While the majority of organizations took steps to improve security following a breach, businesses across industries are in a constant race against the attackers. Security effectiveness starts with closing the obvious gaps and making security a business priority,” Martino comments in the statement.

Examining the latest threat intelligence gathered by Cisco Collective Security Intelligence, it offers data-driven industry insights and cyber security trends from the first six months of 2017, along with recommendations to improve security posture.

Cisco recommends that organizations take a proactive stance in their protection efforts, by doing the following:

• keeping infrastructure and applications up to date, so attackers cannot exploit publicly known weaknesses;
• battle complexity through an integrated defence and limit siloed investments;
• engage executive leadership early to ensure complete understanding of risks, rewards and budgetary constraints;
• establish clear metrics and use them to validate and improve security practices;
• examine staff security training with role-based training versus one-size-fits-all; and
• balance defence with an active response (do not “set and forget” security controls or processes).

Experience in the first half of the years shows that use of malware is evolving, with Cisco security researchers identifying “shifts in how adversaries are tailoring their delivery, obfuscation and evasion techniques. Specifically, Cisco saw they increasingly require victims to activate threats by clicking on links or opening files,” the statement explains.

“They are developing fileless malware that lives in memory and is harder to detect or investigate as it is wiped out when a device restarts.”

Related: One in four hide cybersecurity incidents from employers, global Kaspersky survey finds

Also of concern are developments around the Internet of Things (IoT), which could put certain key industries in harm’s way if steps are not taken to “improve security posture as information technology and operational technology converge,” the statement notes.

With IoT, Cisco reports key industries are bringing more operations online, thereby increasing attack surfaces and the potential scale and impact of these threats.

IoT “continues to offer new opportunities for cyber criminals, and its security weaknesses, ripe for exploitation, will play a central role in enabling these campaigns with escalating impact,” the statement notes.

“Recent IoT botnet activity already suggests that some attackers may be laying the foundation for a wide-reaching, high-impact cyber-threat event that could potentially disrupt the Internet itself,” it continues.

The report also identifies other threats that are on the rise:

• spam volumes are significantly increasing, as adversaries turn to other tried-and-true methods, like email, to distribute malware and generate revenue – the expectation is the volume of spam with malicious attachments will continue to rise while the exploit kit landscape remains in flux;
• spyware and adware bring risks to corporate environments, including stealing user and company information, weakening the security posture of devices and increasing malware infections;
• growth of ransomware-as-a-service make it easier for criminals, regardless of skill set, to carry out attacks; and
• business email compromise (BEC), a social engineering attack, involves an email designed to trick organizations into transferring money to attackers and is becoming highly lucrative.

“Revenue generation is still the top objective of most threat actors,” the report notes. “However, some adversaries now have the ability – and often now, it seems, the inclination – to lock systems and destroy data as part of their attack process.”

Related: Less than half of polled respondents confident in their company’s IT security: Cisco

“The dramatic increases in cyber attack frequency, complexity and size over the past year suggests that the economics of hacking have turned a corner,” the report notes.

Citing observations from Radware, the modern hacking community is benefiting from the following:

• quick and easy access to a range of useful and low-cost resources;
• a dramatic increase in the number of high-value, increasingly vulnerable targets putting more and more valuable information online;
• a level of maturity in the shadow economy, and with the Internet, that provides malicious actors with efficiency, security, and anonymity.

“As criminals continue to increase the sophistication and intensity of attacks, businesses across industries are challenged to keep up with even foundational cybersecurity requirements,” the statement notes.

“Malicious actors are taking advantage of that ever-expanding attack surface. The breadth and depth of recent ransomware attacks alone demonstrate how adept adversaries are at exploiting security gaps and vulnerabilities across devices and networks for maximum impact,” the report states.

“It is important for defenders to understand changes in adversaries’ tactics so that they can, in turn, adapt their security practices and educate users,” the report further advises.

Cisco’s Security Capabilities Benchmark Study – which involved surveying almost 3,000 security leaders across 13 countries – found that “across industries, security teams are increasingly overwhelmed by the volume of attacks. This leads many to become more reactive in their protection efforts,” the statement notes.

Even in the most responsive industries (such as finance and healthcare), businesses are mitigating less than 50% of attacks they know are legitimate, the findings show.

Related: Cyber-related disruption as business advantage developing in manufacturing sector: Verizon

Across most industries, breaches drove at least modest security improvements in at least 90% of organizations, the survey found. That said, some industries (such as transportation) are less responsive, falling slightly more than 80%.

Other findings include the following:

• for the public sector, 32% of the threats investigated were identified as legitimate threats, but only 47% of those legitimate threats are eventually remediated;
• for the retail sector, 32% of respondents report they had lost revenue as a result of attacks in the past year with about a quarter losing customers or business opportunities;
• for the manufacturing sector, 40% of security professionals there say they do not have a formal security strategy, nor do they follow standardized information security policy practices; and
• for the utilities sector, security professionals note that targeted attacks (42%) and advanced persistent threats (40%) were the most critical security risks to their organizations.

“Complexity continues to hinder many organizations’ security efforts,” suggests David Ulevitch, Cisco’s senior vice president and general manager of its Security Business Group.

Related: Employee awareness, training key to building a solid cyber security culture: Echols

“To effectively reduce time to detection and limit the impact of an attack, the industry must move to a more integrated, architectural approach that increases visibility and manageability, empowering security teams to close gaps,” Ulevitch advises.

Found this Great post from cnet.com

WannaCry only demanded $300 from each victim. These hackers extorted $1 million from one South Korean company.

Hackers appear to have pulled off a $1 million heist with ransom-ware in South Korea.

The ransom-ware attacked more than 153 Linux servers that South Korean web provider Nayana hosted, locking up more than 3,400 websites on June 10. In Nayana’s first announcement a few days later, it said the hackers demanded 550 bitcoins to free up all the servers — about $1.62 million.

Four days later, Nayana said it’d negotiated with the attackers and got the payment reduced to 397 bitcoins, or about $1 million. This is the single largest-known payout for a ransom-ware attack, and it was an attack on one company. For comparison, the WannaCry ransom-ware attacked 200,000 computers across 150 countries, and has only pooled $127,142 in bitcoins since it surfaced.

Ransom-ware demands have risen rapidly over the past year, tripling in price from 2015 to 2016. But even then, the highest cost of a single ransom-ware attack was $28,730.

Nayana agreed to pay the ransom-ware in three installments, and said Saturday it’s already paid two-thirds of the $1 million demand.

“It is very frustrating and difficult, but I am really doing my best and I will do my best to make sure all servers are normalized,” a Nayana administrator said, according to a Google translation of the blog post.

The company is expected to make the final payment once all the servers from the first and second payouts have been restored.

Trend Micro, a cyber-security research firm, identified the ransom-ware as Erebus, which targets Linux servers for attacks. It first surfaced in September through web ads, and popped up again in February.

“It’s worth noting that this ransomware is limited in terms of coverage, and is, in fact, heavily concentrated in South Korea,” Trend Micro researchers said Monday in a blog post.

Paying ransom-ware is at the victim’s discretion, but nearly all organizations, including government agencies and security researchers, advise against it.