Category: Information Security

Another County has been taken down by ransomware. The ransom demand here is $25-$30k via Bitcoin or Western union.

“Every department in the county is affected in some way,” “Phone systems, computer systems, everything. Some departments are handwriting documents.”  says Bingham County Commissioner Whitney Manwaring.

The IT staff thought the infection had been cleaned up, but a redundant, backup server was infected again, leading to the county going offline. “We had all kinds of firewalls in place to prevent these kinds of things from happening,” Manwaring told EastIdahoNews.com. “To prevent this from happening again there will likely be several more firewalls and more training for staff using county computers.”

More firewalls? Really? I’m not sure if this was misquoted by the press, or if the County Commish was just not familiar with the terms, but firewalls do very little to stop ransomware. Perhaps they are going to do a better job segmenting the network, and the staff training is a good idea though.

While not perfect, this is a nice little tool to have in the toolbox just in case. I haven’t tried it personally, but it is said to decrypt files infected from the list below. Keep in mind there are some issues with certain strains, such as CryptXXX V3 and CERBER, so be sure to read the instructions and notes before proceeding. Hopefully you will never need this, but if you do, good luck.

The tool will attempt to decrypt files encrypted by:

1. CryptXXX V1, V2, V3
2. CryptXXX V4, V5
3. Crysis
4. DemoTool
5. DXXD
6. TeslaCrypt V1
7. TeslaCrypt V2
8. TeslaCrypt V3
9. TeslaCrypt V4
10. SNSLocker
11. AutoLocky
12. BadBlock
13. 777
14. XORIST
15. Teamxrat/Xpan
16. XORBAT
17. CERBER V1
18. Stampado
19. Nemucod
20. Chimera
21. LECHIFFRE
22. MirCop
23. Jigsaw
24. Globe/Purge
25. V2:
26. V3:

So, I will unabashedly admit to failing miserably at making my weekly post the last couple of weeks. I’ve been traveling and webinaring and otherwise buried in stuff. Oh, and I was abducted by aliens. yeah, that’s it… aliens. Either way, my bad.

Careless Licking Gets a Nasty Ransomware Phishing Infection

Yeah, I totally took this headline from my employer. It was just too good to pass up. What happened is Licking County Ohio got hit by ransomware that took down about 1,000 machines and completely shut down the town government. The best quote I’ve seen for a while came from that when County Auditor Mike Smith commented: “Apparently, our clock still works”. Ouch!

 

Polish banks hit by malware sent through hacked financial regulator

Well, some smooth slick soul managed to upload malware to the Polish financial regular’s website which resulted in infections in some Polish banks. Not a good thing, not at all. Just goes to show, be cautious even when dealing with “trusted” sources.

 

There is a fake Netflix app that is ransomware

Trying to steal Netflix? It may cost you. Just pay the $8mo for crying out loud.

 

New campaign spreading ransomware and another trojan simultaneously

Because Locky doesn’t suck enough as it is, this campaign is also downloading a click-fraud trojan so they can make a few bucks on the side. Shameless.

 

Mirai is spreading via Windows malware

They have started spreading this via windows trojans as they work to build the largest, most terrifying IoT botnet ever known to man. When fridges revolt, nobody is safe!

 

Arby’s got breached

More than 350,000 credit and debit cards could be at risk after Arby’s POS systems were found to be malware laden. I’d say more, but I have no beef with them. (<- you see what I did there, right?)

 

Soda machines take down a university

A gaggle of  infected IoT devices, including vending machines, caused a lot of havoc at an unnamed university by flooding the DNS server with seafood-related lookups. Obviously something was fishy, so they took action and tracked it down.

 

That’s all I have this week. I’m going to work on doing more mini posts based on things I see during the week, so subscribe and you will get those notifications. Thanks

We hear the stories almost daily, we see the headlines in the news, but how worried should we be?

The answer really is, it depends. Today I have seen a few headlines including this whopper: “New ransomware could poison your town’s water supply if you don’t pay up“. Sounds very scary, and the idea is, however it is important to understand that this is based on a Proof of Concept (PoC) attack demonstrated at RSA. Is it possible that this can occur, I suppose it is, but the real question is if it is likely. The answer is, not right now. This makes it FUD, or “Fear, Uncertainty and Doubt”. There is a big difference between showing a PoC and doing it in the wild, so you can sleep well tonight.

but…

This is where it get’s a bit spooky. It is possible, and if the researchers that did this are thinking about it, you can bet our enemies and the bad guys just out for a big payout, are too. So research like this is important, but let’s not start stocking up on bottled water just yet.

What is the real threat RIGHT NOW?

The current threats deal more with making fast money and wreaking havoc on organizations by locking them out of records and data that is required to do business. Even that threat is expanding though as hackers are working to innovate. Before we see water supplies threatened, expect to see more and more attacks where the bad guys are threatening to, or actually publicly releasing, sensitive information. Imagine if your organizations “secret sauce” or proprietary information was made public. How much did it cost you to develop that, and how much of a competitive advantage would be lost if that happened? Take KFC’s “Secret Recipe” for example. Rumor is, it is guarded by eunuch Ninja cyborgs… or something like that.

The other real threat is CEO Fraud (aka BEC) and W2 scams that are happening right now. Just yesterday I spoke with an individual that signed up for our training because they sent all of their employees W2’s to some scammers. They were surprised to learn that they are not alone. Manatee County, FL (in my own back yard) was a victim, as was Argyle School District in Texas. Even Snapchat got caught in the crosshairs last year. This is real, this is in the wild, and it is happening to organizations of every size in every industry.

So, what do you about it?

The number 1 way to counter these attacks is through user training because the number 1 attack vector is via email phishing. You train your folks and phish them with non-malicious payloads and links. This way they get used to spotting these phishing emails before something real hits. Technical controls are just not reliable enough to catch and stop these targeted attacks, but making your users a “Human Firewall” is.

The number 2 thing is to have good backups. This really only matters for ransomware because once you send money or W2 info, backups won’t help. For those cases, number 2 is to have a plan to deal with it. Developing this plan will help you react quickly and help you develop policies to avoid these attacks (e.g. ALWAYS talk to the requestor on the phone BEFORE sending money or sensitive info). All should agree on this policy, and they will if you have trained them on the threats. Also, know who your local law enforcement contacts are, and how to contact them. Having a PR firm and/or lawyer in mind is also a good idea.

So, keep an eye on the new developments, but don’t get dragged in to the FUD. Focus on the real, current threats and you will do more to protect yourself than by chasing the possible (but not likely) ghosts of things to come.

This is what we in the business call, “Not good”.

This was the  “OSIRIS” variant of Locky and looked for about $4k in ransom. According to one article, the chief said. “Our automatic backup started after the infection, so it just backed up infected files” which sounds more like replication than backups. It could also be a gross misconfiguration of the backups, either way, the data is gone.

The press release states that this is the result of a phishing email, which is very typical of this sort of thing.

There is more info at the above links or here: https://blog.knowbe4.com/ransomware-infection-causes-loss-of-8-years-of-police-department-evidence

Lots of new stuff happening this week in the ransomware side of the house. In addition, you still need to be watching for W2 scams as they are starting to get reported. Having said that, here is my wrap up from the last week.

 

Facebook users hit with “You are in this video?” malware scam

Scammers are always looking for ways to get you to click on things. This one can prey on your fear of stupid things you may or may not have done on camera. Not saying this would get to me, but there might still be a video of me singing, “Any man of mine” during a tequila-fuel karaoke session a number of years ago. We all have that moment, right? Even if you don’t care to admit it, we are curious about what we may be in, and the scammers are using this to get to you click on malicious links, in this case phishing for credentials. Be careful folks.

 

Android Ransomware Locks Phone and Asks for Credit Card Number

Fortinet researcher Kai Lu, discovered this new threat. It appears to be targeting only Russian-speaking users, but it demands a HUGE ransom of about $9100 (545,000 Russian rubles) via credit card. I’m going to take a quick look in my crystal ball and say that I don’t expect this to actually work. You can buy a LOT of phones for $9100, and would you trust them with your credit card number? Yeah, no. Who knows though, perhaps it’s demonstrating a proof of concept.

 

Xiongmai messed up again, exposing installer passwords for a bunch of DVRs

Xionmai’s 2017 list of superuser passwords for certain DVRs was found on a LinkedIn page. This list is designed only for CCTV installers to access customer installations and is essentially a one-time pad or per-day superuser password for their DVR service. It appears to only impact versions sold in China, but it’s representative of the security practices of the org.

 

The St. Louis Public Library got hit by ransomware

They didn’t pay, but it messed things up for a couple of days. I can’t imagine the tension in the libraries over the couple of days this was going on. Hell hath no fury like a librarian slightly annoyed!

 

 

Delaware Blue Cross Blue Shield customer records got hit with ransomware

19,000 records were impacted. Because it’s healthcare, it’s considered a breach by the HHS. Not a fun thing. Reading between the lines, I would have to guess that the data was not encrypted when the ransomware hit, otherwise they could argue the breach classification down.

 

Houston, we have a problem… Data breach reported at Houston area Popeye’s

Popeye’s got, well… popped. Malware was found on computer systems at seven Houston area locations. It looks like it was there between May 5, 2016 and August 18, 2016.

 

New Satan Ransomware available through RaaS.

 A security researcher, Xylitol, discovered a new Ransomware as a Service, or RaaS, called Satan. This is a profit-sharing type of ransomware, kind of like a bad lawyer in the fact that if you don’t win, you don’t pay. RaaS developers take a 30% cut, and the scales slides down from there based on number of infections. RaaS means that scammers don’t have to have many skills to spread this sort of ransomware. We will start seeing a lot more of this moving forward.

 

Everyone’s least favorite ransomware is back and testing new infection tactics

One new Locky campaign is being called ‘Double Zipped Locky’ where the idea is to hide their malicious payload in a Zip file within a Zip file, hoping that the victim will think they’re opening a document. It also drops the Kovter Trojan which remains on the infected system and is used to run click-fraud and malvertising campaigns.

The second one is an email posing as a failed bank transaction with a .rar file containing a malicious Javascript file that downloads Locky and installs it.

 

USB Sticks Could Infect Your Network With New Spora Ransomware Worm

There is some interesting new info out about Spora. This ransomware offers an option of future immunity (for a fee), does not need a C&C server so blocking outbound communication doesn’t help, but the new stuff is, it adds the ‘hidden’ attribute to files and folders on the desktop, the root of USB drives and the system drive. These files and folders are now hidden by the standard folder options. It then makes Windows shortcuts with the same name and icon as the hidden files and folders. The .LNK files open the original file while also executing the malware and the worm. Pretty tricky.

It looks like Spora is the variant that hit a nursing school recently.  An instructors files were unreadable on home PC, so he brought them in on a USB drive to try it on a work machine. It did not end well.

 

Argyle School District Employees Hit with W2 Scam Data Breach

A school district in Argyle, TX got hit with a W2 scam that looked like it came from the District Superintendent. The email requested the 2016 W-2 information for all employees of the district and the employee sent it. This really happens folks, and now all of these people are at risk for fraudulently filed tax returns and identity theft. We need to spread the word about this, especially this time of year.

There is a new spam campaign spreading Sage 2.0 ransomware 

Sage 2.0 is demanding a $2000.00 ransom and is being spread by the RIG and Sundown exploit kits. This is also exfiltrating the data hidden inside a .png image by  steganography. I have been saying that I expect to see more strains doing data exfiltration, and this is an example of that.

Stay safe out there folks!

If you have been to any of my talks and/or read many of my posts, you know that I have been preaching heavily about W2 scams this time of year. Scammers are hitting up folks with spear phishing attacks asking for W2’s. these look legit and appear to be coming from a person high up in the food chain. I have seen this personally and only the training my people had, and my open door policy, saved our bacon.

This is what just happened in Argyle, Texas:

http://www.nbcdfw.com/news/local/Argyle-ISD-Employees-Hit-with-Data-Breach-411337825.html

“District leaders said Wednesday an employee got a “phishing” email that appeared to be from the district superintendent.

That email asked for the 2016 W-2 information for all employees of the district. The employee complied with the email, attaching and emailing all W-2 information.”

I have spoken with FBI Special Agents that tell me that they have seen tax returns filed within 2-3 days from an event like this. Don’t be that guy/gal that let’s all of your employees lose their PII like this. Teach your people about the threat ASAP!

Before we get started on this weeks wrap up of important things in the infosec world, in light of the inauguration tomorrow, I just wanted to remind people to treat each other kindly regardless of political opinions. Politics is no reason to treat others without respect. Let’s be good to one another and see how that makes you feel.

That being said, let’s see what the bad guys are up to:

 

Antivirus Detection Rates Are Tanking

While this doesn’t mean it’s time to yank all the AV off your machines, it is a reminder that endpoint protection should not be your only bacon-saving countermeasures. Many tears have fallen, and much bacon has not been saved due to the “all the eggs in one basket” mentality. Think of the bacon, think of the eggs, and incorporate a defense-in-depth approach that reduces the most risk with the least effort and cost. *cough* *cough* User security awareness training is a huge part of this and is known for it’s bacon-saving properties *cough* *cough*.  I must be hungry.

 

The Brit’s National Healthcare System (NHS) Has Been Walloped in 2016

about 1-in-3 NHS trusts have been hit with ransomware in 2016. 80 per cent if these were targeted by a phishing scheme and Imperial College Healthcare in London was smacked 19 times in just 12 months. This is not new, I have previously talked about this, but it’s a powerful reminder of just how prolific ransomware is, and the fact that most of it is being spread by email. This may be one of the biggest threats to hit the UK since Jeremy Clarkson. Stay safe out there.

 

IRS Issues Warning On New Tax Phishing Attack

Scammers are hitting up tax professionals in an effort to compromise their systems and then use the info to scam others in to sending their financial info, resulting in false returns being filed. This is a pretty interesting 2-part scam. There is a nice email blurb here that you can use to warn folks you know. Be safe and pick up the phone if your info is requested.

 

There is a Very Good Gmail Scam Going Around

Watch for this one. They use a traditional account credential phish to get started, then look through past emails to create new messages to your contacts. They are using email attachment names and subjects similar to ones that have been previously sent by the original victim, so the new victims trust where it came from. Simply teaching people to look at the address bar before they enter any credentials will keep you safe in this attack, sadly not everyone gets good quality awareness training.

 

Here is an Example of a Phishing Email Targeting Navy Federal Users

This shows an example of a .pdf with a malicious link. Keep in mind, the file is not infected so it will pass any AV tests, but following the link will make a person have a rather bad day. In this case a simple link hover shows it’s not legit. This is a simple skill that users really need to know about.

 

Fraud Attempts Around Christmas of 2016 up 31% 

Not a shocker mind you, but attempts at fraudulent digital retail sales was up 31% on an increase of 16% in e-commerce transactions over 2015.

 

The CIA dropped over 930k documents on it’s FOIA Reading Room

That’s over 12 million pages of data. I will not be reading them all, instead I will rely on the interwebs to let me know about the interesting bits, and will pass them along to you. So far, the most interesting thing I saw was a Dilbert cartoon that may have previously contained steganography. Stego fascinates me. It wasn’t even a particularly funny cartoon though.

 

Bad Guys Threaten to Contact Families of Cancer Patients When Ransomware Fails to Make Them $

There is a special place in the circles of Hell for people that mess with orgs like this. This is a cancer treatment org that provides free treatment for those unable to afford it. This was a $43,000 ransom, which can go a long way to providing treatments for folks. One thing to consider here though, I have mentioned before that I expect to see Doxxing and other behaviors like this increase. Since the software takes control of the files when it encrypts it and the bad guys have the keys, there is no reason the data cannot be exfiltrated and decrypted by the bad guys. This is why the HHS says it’s a breach by default. Sadly, I expect to see more of this behavior.

 

Elasticsearch is the Latest Target for Database Ransom Attacks

Like the recent MongoDb attacks, the bad guys are going after unsecured Elasticsearch databases, encrypting them and demanding .2 BTC (about $175) to get you back your data. If you run an Elasticsearch database, it’s time to lock it down. Here is some help to get you started.

 

Sometimes We Need to Rethink our Approach to Things

I have to admit, I LOL’ed at this video. It’s a bit mind boggling to watch, but entertaining. I even got to where I was rooting for the guy a bit.

 

My Brethren are not to be trifled with!

The Cyber Squirrel 1 project released the results of a study at Shmoocon, showing that squirrels top the list of power grid attackers, followed by birds then snakes. I personally have felt the effects of a rodent-related power outage at a previous job. It is rumored that only a smoking tail and pile of ash remained when a squirrel chewed through some wires as a substation, causing a pretty decent outage in Tucson. Furthermore, my brethren have been blamed for the deaths of six people, allegedly (they have not been convicted in a court of law) caused by squirrels downing power lines that then struck people on the ground. “Rodent-related airborne electrocution” would be a pretty crappy cause of death if you ask me. Fear the fur people, fear the fur!

 

I was honored to speak at BSides San Diego last weekend

I was able to present 2 sessions, one was on social engineering and the other specifically on ransomware. The crew did a great job putting the event together, even though the waffle truck broke down several blocks away. Waffles on Wheels, sounds right up my alley! 😀 This picture was taken a little before the social engineering session started. By the time we started, it was standing room only. Thanks everyone for attending.

Chelsea Manning’s sentence was commuted.

I’m not even getting in to the politics of this here. Just know, after a bit over 7 years, Manning is being set free.

I hope you enjoyed this weekly update. See you next week!