Could you be the Next Bait for a Phishing Attack?

/in /by

By:
Krystal Rennie, Director of Corporate Communications,
and Brittany Demendi, Corporate Communications Manager

Have you ever received an email informing you that you’ve won an all-expense paid trip to the Bahamas in a raffle you never entered? Or received an email from a streaming service notifying you that your credit card was rejected and to click on the link to update your payment method? You’ve been exposed to a form of phishing. These are examples of email phishing, which use tactics that are untargeted but appear everywhere. By comparison, more targeted versions of phishing are more dangerous and can lead to identity theft, unauthorized access to sensitive data, or the defrauding of funds.

To an organization, phishing is always a severe risk. Phishing is an early-stage and reliable tactic used by hackers to gain access to networks as a part of a larger attack. For example, if you’ve been mentoring a graduate student for weeks and they send you an academic survey would you open it? If your CFO receives formal notification of a lawsuit from a competitor, would you contact the law firm? If your IT department sends a message about service upgrades that require a new log in, would you follow the instructions? These can all examples be examples of phishing.

Cybercriminals commonly use phishing to lure potential victims into performing harmful actions that could put your organization’s data at risk. This technique is the art of manipulating people to give up confidential information by either typing their login credentials to a fake company website or clicking a malicious attachment they thought was an invoice. Because phishing is effective and straightforward, cybercriminals launch thousands of attacks daily and can often be successful.

Five Most Common Types of Phishing Attacks

Regardless of the type of organization, large or small, they will be targeted by cybercriminals attempting a phishing attack. Phishing attacks are getting more difficult to spot, as some attacks will even surpass the most observant employees. Education on these different types of phishing attacks is essential. Below are five common types of phishing attacks:

  1. Spear-Phishing is a targeted attack that aims to steal sensitive data from a specific organization or individual. Cybercriminals lure in the victims with personal information specific to the organization or the employee to seem more legitimate.
  2. Vishing is a phishing attack that occurs over the phone. Calls are usually made using a spoofed ID to make it seem safe to answer. As an example, a hacker could pose as a representative at your bank or credit union and call to alert you that there has been questionable activity on your account. Once they’ve gained your trust, the hacker will ask for your personal account information and can use that information to commit identity fraud.
  3. Whaling is a cyberattack that includes a high-level choice of target in an attempt to steal and misuse private, personal information of senior management at a company/organization. Whaling occurs in the form of emails that are more sophisticated than phishing and are often harder to recognize due to their use of elite corporate language. The email will include personalized information about the target or organization.
  4. Smishing uses SMS to text personal information like credit card information, passwords, and more to appear legitimate and acquire additional information. The text message usually includes a call to action to demand an immediate response or reaction.
  5. Clone Phishing involves receiving a spoofed email that looks identical to one sent by someone you already received emails from. The spoofed email is malicious however, and contains new information along with malicious links or attachments.

Consequences of a Successful Attack

Although the types of phishing attacks vary regarding risk levels, one thing they all have in common is the power to damage a business. Below are a few possible results of a successful phishing attack:

  • Unauthorized transactions
  • Password and username manipulation
  • Account takeovers
  • Identity theft
  • Credit card theft
  • Stolen data
  • Stolen funds
  • Sensitive data sold to third parties

These are just a few examples of what could become compromised when these attacks occur. Companies must invest in the proper Managed Detection and Response platform and Proactive Defense Program to help protect sensitive information and train employees on security awareness.

Be Proactive Against Phishing Attacks, Not Reactive

Equipping employees with the proper knowledge is the best defense when protecting an organization’s data and assets from phishing attacks. In 2019, a major healthcare company reported that one of its employees stopped a phishing attack within 19 minutes, according to Comparitech. Their employee said that they received suspicious emails, and their Security Operations Center was able to take care of it immediately. Creating a security culture within every department, not just IT, is vital.

As phishing emails become harder to detect, investing in security awareness training like a Proactive Defense Program will be the main differentiator between robust risk management plans from the weak ones. The truth is that phishing attacks’ future depends on many factors. Cybercriminals are discovering new ways to step their game up daily and have become more sophisticated with their attacks. That said, it is up to the rest of us to find new ways to combat their tactics. At the end of the day, there is too much at stake if we do not think multiple steps ahead of cybercriminals.

Five Unique Tactics of Social Engineering Attacks

/in /by

By: Krystal Rennie, Director of Corporate Communications, and Brittany Demendi, Corporate Communications Manager

Five Unique Tactics of Social Engineering Attacks is a part of Adlumin’s Cyber Blog content series. For more information about how your organization can protect itself from cybercriminals, browse more from our knowledge-rich series here.

Social Engineering Adlumin Stats

As cybercriminal organizations and state-sponsored actors grow in sophistication and capability, they remain loyal to the simple tactics and techniques that deliver results. “Social Engineering” might not carry the glamor of a technical zero-day malware attack, but it works. Social engineering works so well that 90% of cyberattacks on organizations involve some form of the tactic, according to KnowBe4. Employees are then vulnerable to influence and often become unwitting accomplices in a cybercrime.

Social Engineering is when “an attacker uses human interaction (social skills) to obtain or compromise information about an organization or its computer systems. An attacker may seem unassuming and respectable, possibly claiming to be a new employee, repair person, or researcher and even offering credentials to support that identity.”

Cybersecurity & Infrastructure Security Agency (CISA).

Social engineering tactics can take multiple forms, from collecting publicly available information on social media to conducting search engine analysis. Fundamentally, these tactics identify valuable tools and information that potential victims might seek and be more likely to interact with. Social Engineering is about gaining a user’s trust.

Social engineering strategies can involve fake emails and websites that look authentic and can fool the entire spectrum of employees. Everyone can be a target, from engineers to sales and marketers, finance admins, and senior executives. Social engineering aims to manipulate a target user into revealing sensitive data about their business or personal information. This stolen information can create a phishing campaign that looks authentic. These attacks seek to gain information and can take many different forms, making it harder to pinpoint the cybercriminal’s entry point.

Five Common Tactics of Social Engineering

  1. Scareware: An attack that bombards victims with false alarms and fictitious threats about their devices. Victims are misled to think that their systems are infected with malware, prompting them to install malicious software or malware itself. In one of the most extreme cases, following a massive credit theft from a major retailer, cardholders were contacted through phone calls and asked to update their security measures. Of course, the calls came from cybercriminals collecting victims’ PINs and passwords.
  2. Baiting: A form of social engineering that incentivizes users to take action the attacker wants. These attacks often include offers of gifts, exclusive offers, courier packages, and other well-known “lures.” Engaged users give up their personal information or sign up for fictitious accounts, exposing their passwords. Since passwords are often recycled across multiple accounts, this can create a severe breach and risk to the organization. Rarely can baiting even use physical media like flash drives. Dropped in the employee parking lot, an unassuming individual may accidentally release malware once installed on a company computer.
  3. Pretexting: In this form of social engineering, attackers approach victims requesting sensitive information necessary to complete a critical task or service. Appearing as friendly actors, these criminals solicit data about the victim using various motivators like tax refunds, payments, deliveries, or business-related projects.
  4. Spear Phishing: These attacks target individuals with roles within the company, seniority, rank, authority, and access to critical systems. They often target professionals such as lawyers, doctors, or engineers presented with fake license complaints and lawsuits. In other cases, executives were targeted with emails and branded file shares containing lawsuit filings, the basis of which was stolen from publicly available court filings and stolen litigation material. Spear Phishing is perhaps one of the most challenging forms of engineering because it is extremely difficult to distinguish from legitimate traffic and communications.
  5. Quid Pro Quo: This type of attack centers around an exchange of service or information convincing the victim to act. Typically, the cybercriminal will promise rewards or leverage implicit work motivations to the victim for information that can be used to steal money or take control of a company account or data. One of the most common examples is when the cybercriminal poses as an IT employee asking for or offering technical support.

Many social engineering schemes happen daily. Like all strategies, some techniques are more well-known than others. However, unlike other cyberattacks, human interaction is a critical component of social engineering, which should make you think more carefully about your daily interactions on the internet. These attacks underline the importance of understanding that attacks are much harder to identify and often dupe employees in the early stages of a much larger cyber campaign.

Training is Key to Proactive Defense Against Social Engineering

Employees are your organization’s first line of defense regarding protection from social engineering methods. If employees are not appropriately trained against these tactics, your security software can only defend you until someone clicks on a malicious link.

Yes, there are ways to hunt these threats before they take over your IT network, but it’s best to think proactively and put the fire out at the source.  Finding and implementing the right Proactive Defense Program will empower employees with skills to find and report suspicious activity. These are not just one-off sessions that overwhelm employees with the information they soon will forget. It’s consistent training that creates a positive cybersecurity culture within the organization.

Training needs to be persistent and delivered in small doses throughout the year for information retention. Proactive Defense Programs use real-life de-weaponized attack campaigns to test employees. In addition, implementing training ensures your organization complies with set industry regulations and set policies and tracks and trains high-risk users.

What’s Next?

Now that you have this new information, you might wonder, what’s next? The best advice when attempting to combat social engineering threats is to know the signs and prioritize implementing a Proactive Defense Program throughout your company. Social engineers manipulate feelings and human logic to lure victims into their traps. As a result, we must be wary of what we open, click, and interact with while navigating our online experiences. Always remain alert and trust your gut instinct; if something doesn’t feel right, nine times out of ten, it isn’t right.

Smart Manufacturing: Industry 4.0 Meets Cybersecurity

/in /by

Smart Manufacturing: Industry 4.0 Meets Cybersecurity is a part of  Adlumin’s Cyber Blog content series. For more information about how your organization can protect itself from cybercriminals, browse more from our knowledge-rich series here.

Manufacturing sectors have changed significantly over the past decade with the adoption of IT-based automation. Embedded sensors, cloud computing, centralized management systems, and even artificial intelligence have all made significant impacts. The “Fourth Industrial Revolution” (or “Industry 4.0”) now connects factory floors and supply chain elements through industrial IoT and execution systems. In turn, these  tied to enterprise resource management and critical business intelligence services.  

In previous years, cyber threats have mostly ignored manufacturing systems. Instead, hackers have been focused on many other industries, and manufacturing has rarely been a part of the conversation. In the past, manufacturers were only connected within a single network of one organization with limited internet. This made it difficult to connect with other organizations and people, but also protected them from cyber attacks.

The Challenge: Digital Transformation

This digital disruption in manufacturing expands both opportunity and risk. Industry 4.0 offers streamlined operations and optimized production. Still, industry 4.0 offers parallel risks in that cyber threats are also more streamlined and can do more damage. The result of a cyber attack can yield massive criminal payoffs, orders of magnitude more than they could even five years ago.

Headline-grabbing breaches and massive operational shutdowns demonstrate that all manufacturing sectors are vulnerable. Criminal groups like Sodin (REvil) regularly target manufacturers with ransomware designed to cause total operational disruptions and sell stolen data (financial records and proprietary intellectual property) on the Dark Web. Let’s look at one of the biggest cyber-attacks in manufacturing as an example:

The Renault-Nissan Cyber Attack

In 2017, the WannaCry ransomware attacks stole headlines for being one of the first worldwide cyber-attacks- affecting computers in hundreds of countries. WannaCry ransomware is a worm that exploits vulnerabilities in the Windows operating system. France’s Renault and the Japanese partner Nissan were temporarily forced to pause manufacturing at some of their European plants. Some speculate that losses were as high as $4 billion. The attack was triggered by phishing emails containing attachments with job offers, invoices, and other variations. The WannaCry attack targeted computers within organizations with older software versions with known security flaws. Microsoft released a patch (MS17-010) to remedy the situation to mitigate the vulnerability. To shed the proper light on risks within an IT environment, organizations should move towards continuous vulnerability management (CVM) practices.

Illuminating Tip: Often, remediating vulnerabilities requires expertise beyond the deployment of a simple patch. Explore what Adlumin’s cybersecurity experts say about >>> Continuous Vulnerability Management – Complexities of the Remediation Process.

The Solution: Build Resilience in the Age of Industry 4.0

It is essential for manufacturers to properly assess their cyber risk, especially when embracing Industry 4.0. Industry 4.0 comes with risks and opportunities, making manufacturers a hot target for cybercriminals. There is not one single product, patch, or quick fix that a manufacturer can apply to address the threats and risks. That is why vulnerability management is continuous and takes a proactive approach to find and fixing any vulnerabilities. Here is what CVM steps look like for manufacturers:

CVM Lifecycle for Manufacturers

  1. Discover and identify security vulnerabilities on a regular automated schedule. Take inventory of all assets across the network and identify host details, including an operating system and open services.
  2. Categorize and prioritize assets into business units or groups.
  3. Assess and determine the risk profile to eliminate risks based on vulnerability threat.
  4. Measure and report the level of business risk associated with your assets concerning your set security policies.
  5. Prioritize and remediate the vulnerabilities identified by prioritization to risk.
  6. Verify that the threats have been eliminated via follow-up audits.

Many organizations turn to third-party vendors to help and facilitate CVM, as it is vital for any manufacturer to run smoothly and avoid ransomware attacks like WannaCry. The digital processes presented by Industry 4.0 will only grow more connected, vulnerable, and integrated in the future. Manufacturers must rethink their disaster recovery and response plans by taking a proactive approach. The need to address the cyber risk landscape has never been greater.

Additional Resources

The Importance of Proactive Security

Download this white paper to understand the difference between proactive and reactive security measures, discover the business benefits of being proactive, learn how to advance both your bottom line and your information security, and more.

CTA: Download Now

Link: https://adlumin.com/resource/the-importance-of-proactive-security/

The Ultimate Guide to Malware

With malware attacks increasing yearly, it is imperative to arm your network with proactive solutions coinciding with reactive solutions. Take the first steps, download this ultimate guide, and learn about 13 of the most common types of malware and how to be proactive. 

CTA: Download Now

Link: https://adlumin.com/resources/download-form/the-ultimate-guide-to-malware/

Zero-Day Vulnerability Discovered: Google Chrome’s Fifth Zero-Day Exploit This Year

/in /by

*Update Chrome now to patch actively exploited zero-day*

Google announced an update on Wednesday to the Stable channel of its Chrome browser that includes a fix for an exploit that exists in the wild. It’s the fifth Chrome zero-day patched by Google this year.

What You Need to Know

CVE-2022-2856 is a fix for “insufficient validation of untrusted input in Intents,” according to Google’s advisory. Intents are typically a way to pass data from inside Chrome to another application, such as the share button on Chrome’s address bar. Google says the update—104.0.5112.101 for Mac and Linux and 104.0.5112.102/101 for Windows—will “roll out over the coming days/weeks.” There are 10 other security fixes included in the update, and Dark Reading notes that this is Chrome’s fifth zero-day vulnerability disclosed in 2022.

With an un-patched version of Google Chrome, the CVE-2022-2856 exploit can ultimately lead to arbitrary code executions from malicious websites. As noted by the MITRE Corporation, “When software does not validate input properly, an attacker can craft the input in a form that is not expected by the rest of the application.” The practicality of this leads to altered control flow. The malicious site could then retrieve sensitive data/files from the user’s system or even tamper with application components to contaminate arguments. For example, an un-patched browser can be tricked into displaying fake or corrupted files to the end-user, who believes it is their own legitimate file URI and opens/uploads data which is then sent to the attacker.

A similar exploit, designated as CVE-2019-13707, was first published on 11/25/2019 and was yet another Google Chrome vulnerability, affecting Android devices prior to 78.0.3904.70. Carrying the “Insufficient validation of untrusted input in intents” description, this exploit acted in the same manner as CVE-2022-2856. Google’s solution to this included a simple update of the Chrome browser.

Continuous Monitoring is Critical

Adlumin recommends using a Continuous Vulnerability Management (CVM) product to collect the needed data from endpoints to determine if they are running vulnerable versions of Microsoft Windows and Office. CVM software can also be used to identify those assets which have or do not have the official Microsoft mitigation in place. Adlumin also recommends leveraging the business’s SIEM product to continually search and alert for suspicious executions which may be a result of the exploitation of the vulnerability.

Understanding Supply Chain Attack Vulnerabilities and Attack Surface

/in /by

In 537 A.D., while laying siege to Rome, the Ostrogoths cut the aqueducts supplying the ancient city with the water and power needed to run grain mills that kept the city fed. During World War II, German U-boat campaigns damaged America and her allies by limiting the free movement of goods needed to fuel the continued war effort. More recently, the United States has placed sanctions and embargos on Russia to limit the country’s ability to acquire goods abroad in order to hinder their efforts and help end Russia’s war against Ukraine.

These examples from across history are called Supply Chain Attacks. Supply Chain Attacks are aggressions meant to harm a target by attacking their network of organizations, people, activities, information, and resources used in creating and delivering goods or services. With the transformation to the digital age, supply chain attacks have become harder to defend against cyber-attackers.

The key to a cyber supply chain attack is to target upstream IT services, where the victim has less control and insight over a system’s security attributes. Targeting upstream digital resources is also attractive because third-party vendors, software, and other systems might be considered less valuable to an organization and, therefore, less protected targets. Targeting the upstream supply chain can also provide the aggressor with efficient methods of attack, by offering multiple ways to access victims through targeting a common shared vendor, source, or technology.

The Adlumin Threat Research Team categorizes supply chain threats and cyber-attacks into multiple categories depending on the TTPs and the apparent operational objectives of the attacker. In this article, we’ll walk through some of the most common and dangerous types of supply chain attacks.

Vendor Access Attack: Target Data Breach

An upstream vendor access attack is when an attacker engages in cyber supply chain operations to gain access to a target through a partner, vendor, client, or anyone outside the company with access to enterprise resources.

A commonly cited example of a modern cyber supply chain attack was conducted against Target in 2013. As part of the data breach, attackers compromised an upstream provider servicing Target’s HVAC system. A “Kill Chain” Analysis report of the 2013 Target Data Breach was released by the U.S. Senate’s Committee on Commerce, Science, and Transportation. The report found that the financial and personal information of as many as 110 million target customers was compromised ([1] Committee on Commerce, Science, and Transportation).

The attack began when hackers stole security credentials from a Pennsylvania-based HVAC company that services refrigeration systems in the mid-Atlantic region. These credentials were likely used as part of Target’s billing system. Target initially failed to respond to multiple automated Intrusion Detection Systems (IDS) warnings, which indicated they were installing malware and exfiltrating data. Hackers applied lateral movement during the attack and compromised Target’s connected financial systems, which stored customer data such as payment information and other Personally Identifiable Information (PII). The malware was a tailored version of BlackPOS and was installed on Point-of-Sale (POS) terminals at U.S.-based Target stores.

BlackPOS utilizes a RAM scraping technique which allows for the collection of unencrypted plaintext data. As a result, the data of Target customers passed through theses infected POS devices before transferring to the company’s more secure payment processing provider. Malware was also installed on a Target server and was designed to move stolen data through Target’s network and firewalls. Attackers collected over 11GB of stolen information using a Russia-based server

Adlumin Patch Management Blog Graph

Figure 1: Target Breach Timeline – Source: U.S. Senate Committee on Commerce Science and Transportation https://www.commerce.senate.gov/services/files/24d3c229-4f2f-405d-b8db-a3a67f183883

Target failed to properly isolate their most sensitive network assets from those used by less secure or multi-access systems. They also failed to respond to automated detection alerts based on the reported breach timeline. Attackers had access to Target’s internal network for more than a month before the operation was at full scale.

A prominent defense to this kind of supply chain attack is using a full-service MDR security platform that integrates logging, alerts, and detections across multiple products and security vendors to provide one interface for assessing, tracking, and responding to alerts. Proper use of such a system could have cut off the attackers before they spread throughout Target’s POS systems. Adlumin provides a multi-vendor compatible MDR platform to help manage and centralize alerts and logging. Importantly, Adlumin provides an interface to observe the connections and directionality of access for network endpoints that could’ve helped uncover the flow of malicious traffic.

Vendor Backdoor Access: Solar Winds

In 2020 one of the most serious, menacing, and impactful supply chain attack operations ever  identified was discovered. The Solar Winds attack is the exemplar of a Vendor Backdoor Access attack.

SolarWinds is an American company that provides different products typically used for Information Technology (IT) network provisioning, management, and monitoring. Beginning with a breach in at least 2019, attackers began infiltrating the company’s infrastructure, breaching a server used to build software for distribution. Attackers moved from proof of concept to operational exploitation. By March 2020, attackers had planted a fully functional remote access tool into Solar Wind’s Orion product software updates ([2] Timberg, C., & Nakashima, E..). Hackers used to access this upstream software vendor (Solar Winds) to insert malicious code into otherwise benign software to gain backdoor access to customer systems where it was deployed.

The undetected, trusted, but malicious updates were installed on SolarWind’s customers across the globe. Once the user had installed the update, the malware would reach out to command and control (C&C) servers mimicking legitimate SolarWinds traffic after an initial dormancy period.

When the malware was successfully installed on SolarWinds systems, it would call back to the attackers, giving them back door access to the Orion hosting device. It also gave hackers access to customer networks. It appears only a small portion of these malware deployments were taken advantage of by attackers, mainly traditionally hardened targets like federal government agencies such as the Department of Treasury, Commerce, and Justice.

Of its 33,000 SolarWind’s Orion customers, 18,000 government and private users downloaded hacked versions allowing for remote access. Leveraging follow-on exploitation and pivoting throughout networks, the attackers could conduct activities such as manipulating Department of Treasure software keys to enable access to the email used by the department’s highest-ranking officials.

The SolarWinds breach demonstrates both the clear impact and potential sophistication of supply chain attacks. Trusted vendors can have security environments that are unseen to customers and may serve as a weakened link in the ATT&CK chain of exploitation. Government and industry regulation, along with customer requirements, might help push vendor’s towards a more secure system – but until then, the best defense is a zero-trust architecture and strong logging, monitoring, and auditing environment. Using products such as an MDR security platform can help aggregate logging data from multiple sources and vendors and provide an overview capability for the entire network. Such capability can help expose actors as they laterally move from the initially backdoored system to others through exploitation giving access to sensitive information and valuable digital assets.

Open Source Library Attacks

A less concerning cyber supply chain attack is an open source library attack. These attacks come in two primary varieties:

  1. Malicious Commits: Attempt to trick developers into using malicious code
  2. Availability Attack: Targets software updates and packages

Both can cause harm to a business, but the latter has typically been self-driven by authors for political or personal reasons. In an open source library attack, the goal for an attacker is to either modify the code of a public opensource library or affect the library’s availability. In the first case, when an actor commits malicious code to an open-source repository and is approved and merged with the software, the attack can look like SolarWind’s Orion breach. In addition to backdoors, malicious actors can also insert intentional vulnerabilities which allow for later exploitation. GitHub, the world leading open source code repository system, found that 17% of all vulnerabilities in software were malicious ([3] Tung, L.). Almost a fifth of all bugs reported was placed into the code by attackers.

A second notable way open-source libraries are targets in the cyber supply chain is through attacks on library availability through package managers such as NPM, the JavaScript node package manager, or PyPI, The Python Package Index. In these attacks the actor, potentially a project owner, delists or modifies a popular library used as a dependency for thousands of downstream software projects and products.

One Availability Attack involved the open source JavaScript libraries, colors, and faker, which were hosted on NPM and were downloaded millions of times daily with thousands of projects using them, such as Amazon’s popular AWS Cloud Development Kit ([4]Sharma, A.). In this case, the “attacker” was the library’s owner and founder. They intentionally caused infinite loops or removed the code used in downstream software, affecting customers and end-users by causing availability and runtime issues. The author did so in relation to corporations and commercial consumers of open-source projects who rely on the software for their business.

Old Tactics, Made Digital

Supply chain attacks are an ancient and reliable tactic of striking the target upstream, where targets are typically weaker. Today, this has evolved into a reliable method for compromising IT business systems. Businesses must consider supply chain attacks’ risks on their networks, products, and operations. Implementing best-case solutions such as MDR security, as well as Vulnerability and Patch Management Systems can help mitigate these risks by providing a smaller attack surface and better visibility into attacks to help prevent data breaches and business loss.

  1. Committee on Commerce, Science, and Transportation. (2014, March 26). A “Kill Chain” Analysis of the 2013 Target Data Breach. Target Kill Chain Analysis. Retrieved July 19, 2022, from https://www.commerce.senate.gov/services/files/24d3c229-4f2f-405d-b8db-a3a67f183883
  2. Timberg, C., & Nakashima, E. (2020, December 16). Russian hack was ‘classic espionage’ with stealthy, targeted tactics. The Washington Post. Retrieved July 21, 2022, from https://www.washingtonpost.com/technology/2020/12/14/russia-hack-us-government/
  3. Tung, L. (2020, December 23). Open source: Almost one in five bugs are planted for malicious purposes. ZDNet. Retrieved July 19, 2022, from https://www.zdnet.com/article/open-source-software-how-many-bugs-are-hidden-there-on-purpose/
  4. Sharma, A. (2020, December 3). Dev corrupts npm libs’ colors’ and ‘faker’ breaking thousands of apps. Dev corrupts NPM libs’ colors’ and ‘faker’ breaking thousands of apps. Retrieved July 19, 2022, from https://www.bleepingcomputer.com/news/security/dev-corrupts-npm-libs-colors-and-faker-breaking-thousands-of-apps/

Zero-Day Vulnerability Discovered: Microsoft August Patch Tuesday

/in /by

This month’s Patch Tuesday from Microsoft had a surprise patch for a vulnerability in the Microsoft Windows Support Diagnostic Tool (MSDT); you may remember this exploit from the recent Follina exploit (CVE-2022-30190). This vulnerability, however, takes a different exploit path than Follina.

What You Need to Know

CVE-2022-34713, nicknamed “DogWalk,” is an arbitrary file write vulnerability in MSDT, exploited via .diagcab files, which can lead to code execution. The vulnerability allows an attacker to send a file to a victim that, if double-clicked and opened, could drop an exploit in the user’s Startup folder (or any file anywhere else on the system that the user has permissions to write to). The exploit could be compounded by the fact that most web browsers and email clients do not warn the user of the risk of running a .diagcab file. The .diagcab is not identified with the web zone identifier property, which would otherwise help prevent accidental execution by a user.

The original Dogwalk vulnerability was found and reported to Microsoft by security researcher Imre Rad in December 2019. According to Rad, Microsoft initially decided Dogwalk was not a vulnerability and, at that point, allowed him to publish a blog post on the subject. Due to increased scrutiny of MSDT, Microsoft re-assessed the case this year and has now classified Dogwalk as a vulnerability.

Microsoft began blocking .diagcab file downloads in Microsoft Edge in July of this year. Google is also doing the same. It is now worthwhile to stop .diagcab files received via email altogether. 

The Importance of Continuous Vulnerability Monitoring

Microsoft’s August Patch Tuesday includes a patch for the now publicly disclosed, two-year-old Dogwalk vulnerability (CVE-2022-34713). Adlumin’s Continuous Vulnerability Management (CVM) team took the proactive critical steps to examine this patch for now identified zero-day security threat and to alert customers of their potential vulnerability risk. Adlumin determined potential threats to Microsoft Office users, so they deployed the fix. 

Adlumin’s CVM team created jobs to test customers’ Microsoft August Patch Tuesday patch and remediation (registry modification). Once Adlumin completed the test, the CVM team continued the deployment to the production environment. Once all was complete and remedied, Adlumin sent a report to the customer to notify them they were now clean of the vulnerability for their records. Adlumin recommends using its Continuous Vulnerability Management service to collect the needed data from endpoints to determine if they are running vulnerable .diagcab files in their versions of Microsoft Windows and Office. Adlumin’s managed detection and response security and services platform will proactively search for suspicious activity and possible vulnerability exploitation 24x7x365 days of the year. 

Patch Management Mania: What, Why, and How

/in /by

Patch Management Mania: What, Why, and How is a part of our “Cybersecurity Basics” content series. For more information about how your organization can protect itself from cybercriminals, browse more from this knowledge-rich series here.

Cybercrime and recent geopolitical instability assure that ransomware gangs and state-sponsored actors will continue their escapades against businesses and critical infrastructure. The preferred tactics of cybercriminals involve attacks against IT infrastructure vendors. These cyberattacks are accomplished by “poisoning the digital well” at the source.

As the cyberattack on the Colonial Pipeline demonstrated, we depend on national infrastructure for our basic utilities. The same holds true when it comes to IT utilities like internet connections, network management, and email communication tools. Just as our assumption that water will pour from the tap or the lights will come on at the flip of a switch, we assume our IT backbone will be there, quietly doing its job in the background.

It’s no wonder cybercriminals target these systems. Taking down or infecting a major IT player means downstream access to their customer base. Additionally, attacking IT vendors reduces the cybercriminals’ exposure profile, thereby reducing the risk of detection. Hence, it’s far easier to “poison the digital well” at the source of these services than to affect each house in the village. As Solar Winds, Kesaya, Microsoft HAFNIUM, and Log4J vulnerabilities demonstrated, criminals have these tactics down to a science. For hackers, these kinds of attacks present a viable business model with a sustainable revenue model. Unfortunately, it’s not going anywhere anytime soon.

So what can IT teams do in the face of a malicious threat? The best cybersecurity strategy is to keep systems patched, up-to-date and to adopt a Managed Detection and Response (MDR) platform to aircover above systems exposed to unpatched vulnerabilities.

However, the problem is that the practical application of this strategy deals with hundreds if not thousands of different patches. There are countless updates for these systems, and few companies have the bandwidth to keep up with the constant flow of demands. This blog post will discuss patching, prioritizing, and automating the process to manage workloads and protect your organization from systemic attacks.

What is Patch Management?

Patch Management is the process and service that keeps network devices and software on computers up to date by identifying and deploying patches to all an organization’s endpoints, including servers and mobile devices. Patches can include new functions or features to an application and are short-term solutions until a new software release exists. Any software is bound to technical vulnerabilities, and once exposed and shared, it can be targeted by cybercriminals.

“60% of breach victims said they were breached due to an unpatched known vulnerability where the patch was not applied,”

Ponemon Institute Vulnerability Survey

The downside to patches is that they alert criminals to the vulnerability. This is because when a new patch is released, cybercriminals quickly identify what the underlying vulnerability was within the application. The goal for IT teams are to implement the patch to limit exposure, and before the cybercriminal can exploit it. Patching applies to IT vendors as well as their customers—everyone needs to do it. According to Comparitech, the US government’s National Vulnerability Database (NVD) published over 8,000 vulnerabilities in Q1 of 2022. Bulletproof security is impossible to create, but that doesn’t mean organizations are defenseless to all the current and new vulnerabilities.

Who performs the Patch Management Process?

The patch management process can be carried out by an organization’s IT team or an MDR platform. MDR platforms are cloud services that help you efficiently remediate vulnerabilities and patch systems. A timely patching strategy is essential because software updates are based on active vulnerabilities, which can be found at any time. The risk of outdated software grows with time as attackers can more easily identify weaknesses within systems.

An effective patch management process includes the following features:

  • Cloud-based tools that are easy to use and deploy
    • There is no need to install software on-premises or configure VPNs or open ports. Transitioning to the cloud will allow you to immediately scan for missing patches and patch any workstation, server, or work-from-home (WFH) device. This significantly optimizes bandwidth usage by caching patches locally on your network.
  • Remote patching endpoints and everyday company or employee devices
    • Companies that give their employees the option to WFH can install and scan any device within their network for missing patches from the cloud.
  • Automated patching of endpoints
    • There are patch management services where you can automate patching based on prioritized vulnerability data to address the most critical threats first. Teams can routinely automate patches to free up their time for higher-priority security tasks.
  • Automated vulnerability correlations and patching
    • Automatically correlating and mapping vulnerabilities with patches and necessary configuration changes decreases the remediation response time. This creates ready-to-deploy “patch jobs” that can be scheduled automatically. From this process, a report is usually made that lets IT, and security teams share a priority list of applications and systems to patch regularly.

Why Do You Need Patch Management?

As cyberattacks continue to rise, organizations must take proactive steps to maintain a healthy cybersecurity posture. One of the leading causes of data breaches is unpatched operating systems and software applications, making it critical to implement a timely patch management process. Strengthening your IT security with patches can help improve overall functionality and performance by minimizing downtime caused by unsupported or outdated software. The patch management process can help customers deploy new benefits and features, helping your organization run more productively.

How Do You Benefit from Patch Management?

Here are some of the many benefits from adding patch management to your cybersecurity plan:

  • Satisfied Endpoint Customers – If your organization distributes a service or product where customers use your technology, you know how imperative it is for it to work. Patch management keeps your systems running by continuously fixing software bugs and improving your software’s stability.
  • Secured IT Landscape – When consistently patching vulnerabilities, you significantly reduce the risks within your environment- protecting your organization from data breaches.
  • No Fines from Compliance Issues – If your organization is not practicing patch management and not meeting compliance regulations, you can be hit with a hefty fine. Successfully managing vulnerabilities ensures you are up to date with compliance regulations.
  • Cybersecurity Innovation – Sometimes, organizations use patch management deployment to release new features. This provides a way to update your technology at scale while improving functionality.

Learn More:

The Importance of Proactive Cybersecurity

Download our white paper to understand the difference between proactive and reactive cybersecurity measures, the organizational benefits of being proactive, and how to advance your bottom line and information security.

Download Now

Threat Intelligence: The Human Element of Cybersecurity

Threat Intelligence is actionable, timely, and provides context to threats. Explore the benefits of investing in threat intelligence and gain insight into what it’s all about.

Read More

Detecting Suspicious Network Access With Machine Learning

/in /by

Adlumin Data Science offers two main categories of anomaly detection – single-event, based on information collected from a single security log, and multi-event, which uses information extracted from an aggregation of individual logs. Since anomaly detection tends to have a higher false-positive-rate (FPR) than signature-based methods, it is often helpful to intersect detections from both approaches, which can reduce the total FPR while maintaining an acceptable true positive rate (TPR). The logic is that truly anomalous behavior is likely to appear anomalous from multiple independent perspectives.

An excellent example of this is the intersection between Lateral Movement (LM) and the Access-Events (AE), which are multi-event and single-event ML models, respectively, on the Adlumin security platform. Both models look at Windows “successful logon” events (event ID 4624). Still, LM looks at directed graphs based on an entire day’s worth of activity and draws attention to individual machines. In contrast, AE simply draws attention to individual access events between machines. Another important distinction is that LM individually models privileged users with enough historical data, whereas AE models all windows access events together, regardless of the user involved.

The LM detection shown below features a directed graph flagged by LM and the individual access events that make up the graph, some of which were also flagged by AE, indicated by the ‘Anomaly Score’ column.

This LM detection would not have occurred if none of the comprised events were flagged by AE, which highlights the mechanism for reducing false positives in these detections. If a user’s behavior is determined to be anomalous by LM, but none of the individual access events are considered anomalous, this is likely grounds to throttle the detection.

Aggregating Single-Event Detections

One of the pitfalls of LM is that it only models privileged users with sufficient access history. A recent penetration test performed on a customer by the Adlumin SOC team has highlighted the potential utility in aggregating AE detections to look for a specific behavior that is invisible to LM. During this penetration test, the actor gained access to a machine that allowed them to enumerate the domain and access many other machines. Below are all the customer’s AE detections on the day of the penetration test.

The “NODEZERO” machine used in the Adlumin SOC penetration test involves many anomalous logons to other machines. LM is blind to this behavior because it’s associated with the “anonymous logon” user, so we must rely on AE to create an alert in this case. Sending a separate alert for each detection would be problematic from a user-experience standpoint. However, calling for an aggregation strategy to be used here. One idea is to count the number of unique logons associated with each “remote_workstation_name.” An alert is sent to the customer if that number exceeds a predetermined threshold. In this case, “NODEZERO” is associated with seven unique anomalous logons to other machines, so setting the threshold to 6 would be sufficient for an alert.

While this example shows a blind spot for LM, aggregating AE detections is nonetheless not a sufficient replacement for LM detections. LM can detect much more subtle and complicated behavior associated with moving through a network, so AE aggregate detections should be related to their alert, possibly for targeting domain enumeration attacks. Sometimes these two alerts will describe the same behavior, validating the need for further investigation. As the Adlumin ML model suite grows, these alert intersections will become more sophisticated and widely deployed.

Modernizing Healthcare: Your Proactive Cyber Defense

/in /by

Modernizing Healthcare: Your Proactive Defense is a part of Adlumin’s Cyber Blog and industry-specific content series. For more information about how your organization can protect itself from cybercriminals, browse more from our knowledge-rich series here.  

This past year cyberattacks have continuously stolen headlines as cybercriminals target large corporations. Specifically, the healthcare sector leads by industry with the most breaches. HIPPA Journal reported on IBM Security’s Data Breach Report stating that healthcare data breaches are the most expensive compared to any other sector averaging $9.42 million per incident. Healthcare providers are forced to cancel surgeries, outpatient procedures, and other critical patient care because of forced operation disruptions—emphasizing the severity of damage that these breaches cause. In fact, a study by Vanderbilt (2019) found an increase in negative patient outcomes (typically in time-sensitive treatments) following ransomware service outages.

When health records are exposed, patient privacy is at risk. Healthcare records are the most valuable data set on the dark web and, as such, are lucrative targets for criminals. Moreover, medical data breaches can lead to monumental penalties under HIPPA’s Privacy and Security Rules. The best proactive defense is to equip your frontline workers with the skills to recognize and report suspicious activity. A comprehensive and actionable cybersecurity framework requires a robust and tailored cybersecurity training program for all employees.

The Value of Healthcare Data

Healthcare data has a high black market value because it typically contains multiple pieces of sensitive (financial, insurance claims, etc.) information for one individual instead of one piece of information found in other industry breaches (like an email address). Due to the desirability of individuals’ profiles, there is a substantial monetary gain for cybercriminals. One report values stolen healthcare records at $250 compared to $5 for a stolen credit card.

What Makes the Healthcare Industry Vulnerable?

While lucrative records attract criminal activity, the data-sharing, transient nature of healthcare providers creates an additional opportunity for exploitation. Traditionally patient records reside in several clinical information systems, including electronic medical records (EMR) or healthcare records (EHR), and PACS, DICOM, or RIS systems in medical imagery, often operated on legacy systems.

HIoT/IoMT internet-connected devices such as patient telemetry, dosage metering, and other patient wearable devices have grown in adoption year over year. And the next phase of digital disruption is ushering in machine learning-assisted detection and even predictive roles in the evaluation of tumors, robot-assisted surgery is on the rise in remote communities, drug management and dispensaries are connected to CIS systems, and even non-medical systems like automated facilities management pose a threat.

Vulnerability 1: Outdated Legacy Systems

The leading causes of data breaches within the healthcare industry are outdated legacy systems and cybersecurity unawareness, which go hand in hand. While replacing legacy systems is the safest option and improves practitioner and patient experiences, it’s often impractical or out of budget. These legacy systems (often no longer supported by the vendor) leave organizations vulnerable to cyberattacks through easily accessed “back-door entry” into systems holding patient information and medical data. These legacy systems often lack third-party support. Finding the essential support to fix or address issues can be challenging when technology is outdated or cannot be updated without causing a domino effect disruption to other services.

Solution:

Healthcare organizations must prioritize and align with a Managed Detection and Response (MDR) platform. These platforms detect, anticipate, and prevent malicious threats across a healthcare organization’s network. Not only do they anticipate threats, but features such as a User Entity and Behavior Analytics (UEBA) within an MDR platform take data from individual users and entities such as servers, workstations, and endpoints and ingest it into the platform for baselining expected behavior. This allows for total network visibility when tracking behavioral patterns.

In addition, MDR platforms can offer Continuous Vulnerability Management (CVM) to close the gaps between security assessments and significantly reduce risk. This cloud-based service gives organizations immediate visibility globally into where their IT systems are vulnerable to the latest threats and how to protect against them.

Vulnerability 2: Cybersecurity Unawareness

Employees who use devices without adequate training on cybersecurity protocols immediately put your organization at risk for a data breach. Human error is deemed one of the top reasons for breaches as employees face increasing threats in their email inboxes, web browsers, and networks. Everyone who handles patient data needs to understand their responsibility and role in recognizing a cyberattack.

Solution:

Implementing a proactive defense program, typically with third-party providers, empowers employees with the proper skills to identify and report suspicious activity. A proactive defense program is fully managed security awareness testing and training designed to reduce the risk posed by cybercriminals. Training is vital within the healthcare sector to comply with set policies and industry regulations by the Health Insurance Portability and Accountability Act (HIPPA) of 1996. Conducting simulated phishing campaigns to employees can dramatically improve your cybersecurity posture.

Prioritizing Proactive Defense

Healthcare data breaches are destructive and impact patient outcomes. Implementing proper cybersecurity standards across your organization goes a long way to shutting down dangerous opportunities without sacrificing services. Ramping up your cybersecurity proactive defense program doesn’t have to be daunting and is usually outsourced to a third party for cost-effectiveness.

Modernizing healthcare systems improves communications between doctors and patients through protected and monitored smartphone apps, telehealth software, and texting. Additionally, it improves operations, resulting in better healthcare delivery, lower costs, and a more efficient workforce. By actively addressing your healthcare organization’s vulnerabilities, you can enhance the quality of care and advance in the industry. To succeed in this effort, you must create a cybersecurity culture to ensure that employees and staff members are an asset instead of a vulnerability.

Adlumin Cybersecurity

1140 3rd St. NE, Suite 340
Washington, DC 20002
(202) 570-7907

Get a Demo Free Trial Contact Adlumin
Adlumin Inc 5000

Privacy Policy  Sitemap  GDPR Privacy Notice

GDPR Data Processing Addendum  GDPR Privacy Request Form

Copyright 2024 Adlumin, Inc. All Rights Reserved