Week 8 - Malware Attacks Target Winter Olympics in South Korea

At the start of this year in 2018, about a month before the Winter Olympics begins in South Korea, email infected with malware have been targeting organizations associated with this big event. Initially, the infected emails were targeting groups related to air hockey but have since expanded to all businesses related to the Olympics. The goal of the malware campaign is to steal personal and financial information.

The methodology behind delivering malware through email has greatly improved and is harder than ever to be detected. Companies are aware of the dangers of phishing emails and have enacted security campaigns to counter this threat, but these malware emails are even more difficult to differentiate from regular mail. The spoofed email is in Korean and claims that it is from South Korea's National Counter Terrorism Center (NCTC) even though it originated from an address in Singapore. The emails were also timed to be delivered when the NCTC were conducting their security drills, so businesses were inclined to believe it came from them.

Last year in December, a new method of hiding malware in images were introduced. With this new tool released to the public, Invoke-PSImage allows PowerShell scripts to be hidden in a PNG image. With this ability to hide malware components, the image could be delivered through email.  The recipients would open the image and execute the malware on their computers.

It’s more important than ever to be wary of opening images or text in emails. Even though the file does not seem to be malicious, it can still contain malware. Before opening attachments in emails, it is advised to review the header information and confirm the identity of the sender. If something looks off in the email, report it to the local administrator or delete the email. Phishing emails are becoming difficult to spot, and we must be extra cautious against these malware attacks.

References


AFP. (2018, Jan 6). Hackers Already Targeting Pyeongchang Olympics: Researchers. Retrieved from http://www.securityweek.com/hackers-already-targeting-pyeongchang-olympics-researchers


Riley, D. (2018, Jan 7). Hackers are already targeting the PyeongChang Winter Olympics. Retrieved from https://siliconangle.com/blog/2018/01/07/hackers-already-targeting-yeongchang-winter-olympics/


Samani, R. (2018, Jan 9). Pyeongchang Olympics Hack: Attackers Evolve Beyond Zero Days. Retrieved from https://www.forbes.com/sites/ciocentral/2018/01/09/pyeongchang-olympics-hack-attackers-evolve-beyond-zero-days/#39e00134ef61

Week 7 - RubyMiner Takes Control of Web Servers

On the week of January 8th, many web servers were hit by the malware, RubyMiner which attempted to take control of servers and install the Crypto mining software. Using vulnerabilities from PHP, Microsoft IIS, or Ruby on Rails, the malware could install the Monero miner (XMRig). Since the popularity and rise of cryptocurrency, attackers have been looking for computers to mine crypto coins. Initially, desktop machines were used, but more recently, web servers were targeted for their CPU power. In just one day on Jan 11th, about 700 servers were enslaved to make $540 (Checkpoint Research, 2018).

The malware can be executed on Windows or Linux systems, and has affected web servers in the United States, Germany, United Kingdom, Norway, and Sweden. On vulnerable web servers, the malware downloads and runs the robots.txt file which installs the crypto mining software. Since the malware is instructed to run hourly, the attackers can issue a kill command at any time by modifying the robots.txt file. So far, the compromised domain, lochjol.com is being used for attacks. The Monero miner usually sends 5% of the proceeds to the author of the code, but the attackers have removed that piece of the code to retain all the currency.

Since attackers are utilizing known vulnerabilities that were patched in 2012 and 2013, web server owners should quickly review and update their servers. Also, the incident of compromises should be reviewed so that intrusion detection system can be updated to catch the malware. As the crypto mining software continues to run, it will use up all the resources for the web server and decrease its performance. Also, the attackers are making currency for free with no overhead expenses. Go and update your web servers today!

References

Arghire, I. (2018, Jan 17). Crypto-Mining Attack Targets Web Servers Globally. Retrieved from http://www.securityweek.com/crypto-mining-attack-targets-web-servers-globally

Checkpoint Research. (2018, Jan 11). ‘RubyMiner’ Cryptominer Affects 30% of WW Networks. Retrieved from https://research.checkpoint.com/rubyminer-cryptominer-affects-30-ww-networks/

Week 6 - Equifax's Massive Data Breach

How do you feel safe when one of the three largest credit reporting agencies is compromised? On September 2017, Equifax reports that they discovered a data breach of 143 million accounts which exposed names, social security numbers, birth dates, bank accounts, addresses, and driver licenses. About 209,000 credit cards were also stolen. The information not only impacted US citizens but people in the UK and Canada. The data breach was discovered in July 2017, but it was reported six weeks later. To make matters shadier, three senior executives sold almost 1.8 million shares of Equifax before and after the security breach. It is believed that the attacker used a website application vulnerability to steal the data (Yurieff, 2017).

The Equifax breach was one of the largest data breaches in history. Now, half of all American information is probably on the dark web. Equifax is trusted to record all credit activities and to report on them. We should have confidence that they will also secure that vital information. I’m glad to see that Equifax created a website for the breach. The site at https://www.equifaxsecurity2017.com checks if a person is impacted by the attack. Since many people were compromised, don’t be alarmed if your name appears on the site. Equifax is offering a one-year credit monitoring service to people who might have their information exposed. However, usage of the service also forfeits any legal action against Equifax.

How to protect your credit? From time to time, check the credit reports and look for suspicious activities such as new credit cards and bank accounts. Report any suspicious activities. For more credit protection, it’s possible to freeze an account. Then new accounts can only be opened with the account holder’s approval. You can never be too safe.

References

Gressin, S. (2017, Sept 8). The Equifax Data Breach: What to Do. Retrieved from https://www.consumer.ftc.gov/blog/2017/09/equifax-data-breach-what-do

 

USA today. (2017, Sept 12). At Equifax, a Category 5 data breach. Retrieved from https://www.usatoday.com/story/opinion/2017/09/12/equifax-category-5-data-breach-editorials-debates/657362001/

 

Yurieff, K. (2017, Sept 10. Equifax data breach: What you need to know. Retrieved from http://money.cnn.com/2017/09/08/technology/equifax-hack-qa/index.html

Week 5 - Former Employee of Homeland Security Exposes Employee Records

On January 3rd, the Department of Homeland Security (DHS) announced that they had a data breach of 257,167 former and current employees. The breach was discovered on May 10, 2017, and it affected employees who were working in 2014. The exposed data included names, social security numbers, birth dates, positions, grades, and duty stations. Also, the exposure affected people who were part of the DHS Office of Inspector General’s investigations from 2002 to 2014. DHS states the data breach was not an external attack and the personal information was not the primary target (Kaplan, 2018). The cause of the exposure was a former employee of the DHS who accessed unauthorized information.  In December, the DHS notified employees who might have been affected. They waited about seven months for notification because there was a criminal investigation that was going on during that period.


This incident was unusual because it was not an external actor that caused the data breach, but a former employee who did not have authorized access. Still, a dangerous case because the former employee could have sold the information to a third party. Also, these are employees of DHS who protect the security of the citizens of the United States. Some of the personnel could be targets of social engineering to obtain privileged information, or important cases could be put at risk because identities were exposed.


I’m glad to hear that DHS is taking extra steps to secure the employee data, and that access will be restricted to select individuals. Also, unusual behavior patterns by authorized users will be monitored (Kaplan, 2018). DHS is offering credit monitoring to those that are affected by the data breach. For those who were part of the OIG’s investigations between 2002 to 2014, they can contact AllClear ID for free credit monitoring at 855-260-2767.

References


Arghire, I. (2018, Jan 4). 247,000 DHS Employees Affected by Data Breach. Retrieved from http://www.securityweek.com/247000-dhs-employees-affected-data-breach

Cameron, D. (2018, Jan 3). Homeland Security Data Breach Affects 240,000 Federal Employees, Plus Witnesses and Interviewees. Retrieved from https://gizmodo.com/homeland-security-data-breach-affects-240-000-federal-e-1821755817

Kaplan, P. (2018, Jan 3). Privacy Incident Involving DHS Office of Inspector General Case Management System. Retrieved from https://www.dhs.gov/news/2018/01/03/privacy-incident-involving-dhs-oig-case-management-system

Week 4 - Nissan Canada Notifies Customers of a Data Breach During the Holidays

This holiday season, Nissan Canada Finance and Infiniti Financial Services Canada were not so lucky and reported a data breach on December 21st. The automaker is not sure how many customers were affected by the breach and notified all 1.13 million of them by email or letter. Nissan found out about the attack on December 11th which included the loss of information such as customer’s name, address, vehicle model, vehicle identification number, credit score, loan amount, and monthly payment. It seems that no payment or contact information (email address, phone number) were taken (Spring, 2017). Nissan is working with law enforcement, security analysts, and Canadian privacy regulators to find out the cause of the breach and who was affected. This incident was not the first time that Nissan has come under attack by hackers. Their websites were attacked in 2016 and malware was detected on their infrastructure network in 2002.

It’s alarming that so much information could be taken from customers of Nissan. The automaker had previous encounters with hackers and should bolster their security technology and teams. Performing vulnerability scans and addressing issues could make systems more resilience to hackers. Also, perhaps, the data could be separated into different systems, so a compromise of one system will not impact the others.

As we head to 2018, it seems that personal information is all over the dark web. There have been a countless number of data breaches, and it has affected all industries. It seems to be one of the risks of doing online business. Nissan has offered Transunion, a fraud monitoring tool for one year to all their customers. If you are affected, please take advantage of the service and be aware of suspicious activities.

References

Kovacs, E. (2017, Dec 22). Nissan Canada Informs 1.1 Million Customers of Data Breach. Retrieved from http://www.securityweek.com/nissan-canada-informs-11-million-customers-data-breach

Nissan. (2017, Dec 21). Nissan Canada Finance informs customers of possible data breach. Retrieved from http://nissannews.com/en-CA/nissan/canada/releases/nissan-canada-finance-informs-customers-of-possible-data-breach

Spring, T. (2017, Dec 22). Nissan Canada Finance Notifies 1.1 Million of Data Breach. Retrieved from https://threatpost.com/nissan-canada-finance-notifies-1-1-million-of-data-breach/129233/