Week 8 - Malware Attacks Target Winter Olympics in South Korea

At the start of this year in 2018, about a month before the Winter Olympics begins in South Korea, email infected with malware have been targeting organizations associated with this big event. Initially, the infected emails were targeting groups related to air hockey but have since expanded to all businesses related to the Olympics. The goal of the malware campaign is to steal personal and financial information.

The methodology behind delivering malware through email has greatly improved and is harder than ever to be detected. Companies are aware of the dangers of phishing emails and have enacted security campaigns to counter this threat, but these malware emails are even more difficult to differentiate from regular mail. The spoofed email is in Korean and claims that it is from South Korea's National Counter Terrorism Center (NCTC) even though it originated from an address in Singapore. The emails were also timed to be delivered when the NCTC were conducting their security drills, so businesses were inclined to believe it came from them.

Last year in December, a new method of hiding malware in images were introduced. With this new tool released to the public, Invoke-PSImage allows PowerShell scripts to be hidden in a PNG image. With this ability to hide malware components, the image could be delivered through email.  The recipients would open the image and execute the malware on their computers.

It’s more important than ever to be wary of opening images or text in emails. Even though the file does not seem to be malicious, it can still contain malware. Before opening attachments in emails, it is advised to review the header information and confirm the identity of the sender. If something looks off in the email, report it to the local administrator or delete the email. Phishing emails are becoming difficult to spot, and we must be extra cautious against these malware attacks.

References


AFP. (2018, Jan 6). Hackers Already Targeting Pyeongchang Olympics: Researchers. Retrieved from http://www.securityweek.com/hackers-already-targeting-pyeongchang-olympics-researchers


Riley, D. (2018, Jan 7). Hackers are already targeting the PyeongChang Winter Olympics. Retrieved from https://siliconangle.com/blog/2018/01/07/hackers-already-targeting-yeongchang-winter-olympics/


Samani, R. (2018, Jan 9). Pyeongchang Olympics Hack: Attackers Evolve Beyond Zero Days. Retrieved from https://www.forbes.com/sites/ciocentral/2018/01/09/pyeongchang-olympics-hack-attackers-evolve-beyond-zero-days/#39e00134ef61

Week 7 - RubyMiner Takes Control of Web Servers

On the week of January 8th, many web servers were hit by the malware, RubyMiner which attempted to take control of servers and install the Crypto mining software. Using vulnerabilities from PHP, Microsoft IIS, or Ruby on Rails, the malware could install the Monero miner (XMRig). Since the popularity and rise of cryptocurrency, attackers have been looking for computers to mine crypto coins. Initially, desktop machines were used, but more recently, web servers were targeted for their CPU power. In just one day on Jan 11th, about 700 servers were enslaved to make $540 (Checkpoint Research, 2018).

The malware can be executed on Windows or Linux systems, and has affected web servers in the United States, Germany, United Kingdom, Norway, and Sweden. On vulnerable web servers, the malware downloads and runs the robots.txt file which installs the crypto mining software. Since the malware is instructed to run hourly, the attackers can issue a kill command at any time by modifying the robots.txt file. So far, the compromised domain, lochjol.com is being used for attacks. The Monero miner usually sends 5% of the proceeds to the author of the code, but the attackers have removed that piece of the code to retain all the currency.

Since attackers are utilizing known vulnerabilities that were patched in 2012 and 2013, web server owners should quickly review and update their servers. Also, the incident of compromises should be reviewed so that intrusion detection system can be updated to catch the malware. As the crypto mining software continues to run, it will use up all the resources for the web server and decrease its performance. Also, the attackers are making currency for free with no overhead expenses. Go and update your web servers today!

References

Arghire, I. (2018, Jan 17). Crypto-Mining Attack Targets Web Servers Globally. Retrieved from http://www.securityweek.com/crypto-mining-attack-targets-web-servers-globally

Checkpoint Research. (2018, Jan 11). ‘RubyMiner’ Cryptominer Affects 30% of WW Networks. Retrieved from https://research.checkpoint.com/rubyminer-cryptominer-affects-30-ww-networks/

Week 6 - Equifax's Massive Data Breach

How do you feel safe when one of the three largest credit reporting agencies is compromised? On September 2017, Equifax reports that they discovered a data breach of 143 million accounts which exposed names, social security numbers, birth dates, bank accounts, addresses, and driver licenses. About 209,000 credit cards were also stolen. The information not only impacted US citizens but people in the UK and Canada. The data breach was discovered in July 2017, but it was reported six weeks later. To make matters shadier, three senior executives sold almost 1.8 million shares of Equifax before and after the security breach. It is believed that the attacker used a website application vulnerability to steal the data (Yurieff, 2017).

The Equifax breach was one of the largest data breaches in history. Now, half of all American information is probably on the dark web. Equifax is trusted to record all credit activities and to report on them. We should have confidence that they will also secure that vital information. I’m glad to see that Equifax created a website for the breach. The site at https://www.equifaxsecurity2017.com checks if a person is impacted by the attack. Since many people were compromised, don’t be alarmed if your name appears on the site. Equifax is offering a one-year credit monitoring service to people who might have their information exposed. However, usage of the service also forfeits any legal action against Equifax.

How to protect your credit? From time to time, check the credit reports and look for suspicious activities such as new credit cards and bank accounts. Report any suspicious activities. For more credit protection, it’s possible to freeze an account. Then new accounts can only be opened with the account holder’s approval. You can never be too safe.

References

Gressin, S. (2017, Sept 8). The Equifax Data Breach: What to Do. Retrieved from https://www.consumer.ftc.gov/blog/2017/09/equifax-data-breach-what-do

 

USA today. (2017, Sept 12). At Equifax, a Category 5 data breach. Retrieved from https://www.usatoday.com/story/opinion/2017/09/12/equifax-category-5-data-breach-editorials-debates/657362001/

 

Yurieff, K. (2017, Sept 10. Equifax data breach: What you need to know. Retrieved from http://money.cnn.com/2017/09/08/technology/equifax-hack-qa/index.html

Week 5 - Former Employee of Homeland Security Exposes Employee Records

On January 3rd, the Department of Homeland Security (DHS) announced that they had a data breach of 257,167 former and current employees. The breach was discovered on May 10, 2017, and it affected employees who were working in 2014. The exposed data included names, social security numbers, birth dates, positions, grades, and duty stations. Also, the exposure affected people who were part of the DHS Office of Inspector General’s investigations from 2002 to 2014. DHS states the data breach was not an external attack and the personal information was not the primary target (Kaplan, 2018). The cause of the exposure was a former employee of the DHS who accessed unauthorized information.  In December, the DHS notified employees who might have been affected. They waited about seven months for notification because there was a criminal investigation that was going on during that period.


This incident was unusual because it was not an external actor that caused the data breach, but a former employee who did not have authorized access. Still, a dangerous case because the former employee could have sold the information to a third party. Also, these are employees of DHS who protect the security of the citizens of the United States. Some of the personnel could be targets of social engineering to obtain privileged information, or important cases could be put at risk because identities were exposed.


I’m glad to hear that DHS is taking extra steps to secure the employee data, and that access will be restricted to select individuals. Also, unusual behavior patterns by authorized users will be monitored (Kaplan, 2018). DHS is offering credit monitoring to those that are affected by the data breach. For those who were part of the OIG’s investigations between 2002 to 2014, they can contact AllClear ID for free credit monitoring at 855-260-2767.

References


Arghire, I. (2018, Jan 4). 247,000 DHS Employees Affected by Data Breach. Retrieved from http://www.securityweek.com/247000-dhs-employees-affected-data-breach

Cameron, D. (2018, Jan 3). Homeland Security Data Breach Affects 240,000 Federal Employees, Plus Witnesses and Interviewees. Retrieved from https://gizmodo.com/homeland-security-data-breach-affects-240-000-federal-e-1821755817

Kaplan, P. (2018, Jan 3). Privacy Incident Involving DHS Office of Inspector General Case Management System. Retrieved from https://www.dhs.gov/news/2018/01/03/privacy-incident-involving-dhs-oig-case-management-system

Week 4 - Nissan Canada Notifies Customers of a Data Breach During the Holidays

This holiday season, Nissan Canada Finance and Infiniti Financial Services Canada were not so lucky and reported a data breach on December 21st. The automaker is not sure how many customers were affected by the breach and notified all 1.13 million of them by email or letter. Nissan found out about the attack on December 11th which included the loss of information such as customer’s name, address, vehicle model, vehicle identification number, credit score, loan amount, and monthly payment. It seems that no payment or contact information (email address, phone number) were taken (Spring, 2017). Nissan is working with law enforcement, security analysts, and Canadian privacy regulators to find out the cause of the breach and who was affected. This incident was not the first time that Nissan has come under attack by hackers. Their websites were attacked in 2016 and malware was detected on their infrastructure network in 2002.

It’s alarming that so much information could be taken from customers of Nissan. The automaker had previous encounters with hackers and should bolster their security technology and teams. Performing vulnerability scans and addressing issues could make systems more resilience to hackers. Also, perhaps, the data could be separated into different systems, so a compromise of one system will not impact the others.

As we head to 2018, it seems that personal information is all over the dark web. There have been a countless number of data breaches, and it has affected all industries. It seems to be one of the risks of doing online business. Nissan has offered Transunion, a fraud monitoring tool for one year to all their customers. If you are affected, please take advantage of the service and be aware of suspicious activities.

References

Kovacs, E. (2017, Dec 22). Nissan Canada Informs 1.1 Million Customers of Data Breach. Retrieved from http://www.securityweek.com/nissan-canada-informs-11-million-customers-data-breach

Nissan. (2017, Dec 21). Nissan Canada Finance informs customers of possible data breach. Retrieved from http://nissannews.com/en-CA/nissan/canada/releases/nissan-canada-finance-informs-customers-of-possible-data-breach

Spring, T. (2017, Dec 22). Nissan Canada Finance Notifies 1.1 Million of Data Breach. Retrieved from https://threatpost.com/nissan-canada-finance-notifies-1-1-million-of-data-breach/129233/

Week 3 - Uber’s Big Secret

On November 21st, Uber disclosed that they hid a security breach that occurred a year ago, and that they paid the hacker who did it $100,000 to keep quiet. The breach exposed 57 million driver and rider accounts, which included driver licenses, telephones, email addresses, and names. It seems that Uber’s coding site was compromised and the credentials were taken to access an Amazon Web Services account which had the account information.

This incident not only broke federal and state laws but further ruin the reputation of Uber who plan to go public in 2019. It seems the company has not learned their lesson after their data breach in 2014. It’s also surprising because Uber has Joe Sullivan, a seasoned chief security officer who used to head up security at Facebook for seven years. From words of former employees, it seems that Mr. Sullivan and his chief executive Travis Kalanick decided made the decision to pay the hacker (Isaac, Benner, & Frenkel, 2017).

As outlined in FBI’s news article, paying the hackers is never the right move (2016). Even when paid, the attackers might not honor the agreement. In Uber’s case, the hacker allowed Uber access to his computer and signed a non-disclosure agreement. However, he might not have destroyed all the copies of the data and could have passed the data to another party. Also, paying off a hacker means also funding criminal activities. The hacker could use the funds to start another attack.

For drivers that had their data compromised, Uber will provide free credit and identity theft protection (Newcomer, 2017). For the rest of us, this is a learning experience. If you are the target of a ransomware attack, do not pay the ransom. No good would come out of the payment. Remember to routinely back up your data and be on the lookout for malicious links or attachment in emails. Stay vigilance, and you won’t be the next victim of an attack.

References

FBI News. (2016, April 29). Incidents of Ransomware on the Rise. Retrieved from
https://www.fbi.gov/news/stories/incidents-of-ransomware-on-the-rise/incidents-of-ransomware-on-the-rise

Issac, M., Benner, K., & Frenkel, S. (2017, Nov 21). Uber Hid 2016 Breach, Paying Hackers to Delete Stolen Data. Retrieved from https://www.nytimes.com/2017/11/21/technology/uber-hack.html

Newcomer, E. (2017, Nov 21). Uber Paid Hackers to Delete Stolen Data on 57 Million People. Retrieved from https://www.bloomberg.com/news/articles/2017-11-21/uber-concealed-cyberattack-that-exposed-57-million-people-s-data

Week 2 - PayPal's Subsidiary TIO Security Breach

It was recently announced that TIO Networks, owned by PayPal was breached on November 10th exposing 1.6 million customer's personal information. In this modern age, companies have to protect not only themselves but also all their subsidiaries. It is a lot of responsibility. Luckily, PayPal's data was not affected, because they were not using the TIO system of processing bill payments.  It is unknown what personal information was stolen, but credit cards and social security numbers were said to be compromised (Kovacs, 2017). TIO suspended its operation on November 10th because of security vulnerabilities in their system, but their parent company, PayPal did not issue a statement until December 1st. Since TIO is not a well-known company, PayPal should have announced the news earlier so it could bring attention to consumers who might be affected.

If you are a PayPal customer, it seems that you are safe. None of the personal data on the PayPal network were compromised. However, if your password has not changed for a while, it’s time to change it. Customers of TIO Networks who were infected by the breach will be contacted by email. They will receive a free year subscription to Experian. If their social security were compromised, they would receive two years of service (TIO Networks, 2017). The notification of the free service is just a notification, nothing more. Registering for the service is essential. Experian will provide a free credit report, active monitoring for fraud/identity theft, and theft insurance. It’s a great deal, but action needs to be taken to join the service. Don’t put it off for another day.

It must be frustrating for a publicly traded company such as TIO to have their daily business indefinitely suspended, all because of a security compromise.  Today, it's more important than ever to manage security data effectively.

References

Kovacs, E. (2017, Dec 4). Breach at PayPal Subsidiary Affects 1.6 Million Customers. Retrieved from http://www.securityweek.com/breach-paypal-subsidiary-affects-16-million-customers

TIO Networks. (2017, Dec 1). TIO Networks Provides Update on Suspension of Operations. Retrieved from http://tio.com/#consumerfaq

Zacks Equity Research. (2017, Dec 4). PayPal's Newly Acquired Unit TIO Networks Suffers Data Breach. Retrieved from https://finance.yahoo.com/news/paypal-apos-newly-acquired-unit-150303417.html

Week 1 - Imgur Data Breach of 1.7 Million Accounts

This Thanksgiving, when people were enjoying their turkey feast, Imgur, a popular image sharing site found out their data was compromised in 2014. This breach affected 1.7 million accounts which exposed email addresses and passwords. Fortunately, it seems that personal information such as real name, addresses, and phone numbers was not exposed. Imgur does not require private information for account registration. The breach was reported by an industry expert, Troy Hunt, from the website HaveIBeenPwned.com on Nov 23^rd (Spring, 2017).The next day, Imgur sent out an email to all users to change their password, and the organization was applauded for its quick response to the situation.

If you have an account with Imgur, it’s important to log in to the website and change your password. The account could have been potentially compromised, and be used for malicious activity. Large image sharing sites such as Imgur can reach a broad audience. Compromised accounts could be used to spread propaganda or criminal mischiefs. Once the password is changed, the account will be secured. In 2014, passwords were stored using an old SHA-256 hashing algorithm which could be cracked by the MD5Decrypt service (Kovacs, 2017). Since then, Imgur has changed their hashing algorithm to a more secure bcrypt algorithm.

When creating an account on websites, it is important to use strong passwords which makes it tougher for brute force attacks. Take the time, and use passwords that are 8-12 characters with a mix of upper/lower case characters, numbers, and special characters. It’s okay not to be able to remember the password. The secure password can be stored in an encrypted password software. Thankfully, this data breach did not disclose personal information.

References

Kovacs, E. (2017, Nov 27). Imgur Discloses 2014 Breach Affecting 1.7 Million Users.  Retrieved from http://www.securityweek.com/imgur-discloses-2014-breach-affecting-17-million-users

Sehgal, R. (2017, Nov 24). Notice of Data Breach. Retrieved from https://blog.imgur.com/2017/11/24/notice-of-data-breach/

Spring, T. (2017, Nov 27). Imgur Confirms 2014 Breach of 1.7 Million User Accounts. Retrieved from https://threatpost.com/imgur-confirms-2014-breach-of-1-7-million-user-accounts/129006/