An Epidemic of Healthcare Breaches

Isn’t it ironic? Following the massive Equifax breach of 2017, and the fallout from the OPM breach in 2016, how is that there are still monolithic breaches in 2018?  How the #@*^&$ does this keep happening? I started charting a breakdown by sector and severity here. And I’ll also show disclosure dates because the time discovered vs the time revealed has huge impact to those caught up in a breach. It’s time used by the bad guys to sell the data and use that data for fraud. Victims deserve to know as soon as possible so they can choose what action they take to protect themselves, rather then rely on someone else to do that – badly – for them. A year of credit monitoring just doesn’t cut it.

What disturbs me is the amount of healthcare data out there, and the number of breaches, which exposes some very sensitive information of some very vulnerable victims. I’m going to continue to dig into this and show what I find. A special shout out to folks who are working hard to secure healthcare: I am the Cavalry, @JoshCorman, @_j3lena_, @_odddie_, @beauwoods to name but a few.

Here is the link to the spreadsheet Breach Report I am keeping and you are welcome to use what I share with the reminder to always be sure to cite your sources   This is just the tip of the iceberg. I’ll do my best to share updates and links.

Where should you look if you have been breached or suspect you have? I recommend “Have I Been Pwned” by Troy Hunt, and there are other resources out there. Lots of people are doing great work in this field to whom I give all credit. I like to check DataBreaches.net

The Diana Initiative 2018

diana banner

Like many, I am counting the sleeps until Hacker Summer Camp happens this year in Vegas. I am more excited for this than my kids ever were for sleep away camp!  Cons are where we reconnect with each other and do some major facetime irl. As someone special has told me, each year it becomes more about attending to see our people than to learn the things.

This year, I am volunteering at 3 events, speaking at 3 events, and trying to see all the events lol! (alas not Blackhat since I can’t pay my way there and am not a speaker). Most of all, I’ll be helping host an event for the second year. The Diana Initiative  is a two day conference where we celebrate diversity, women in InfoSec, and help attendees pursue a career in information security and technology.  The conference is all-inclusive, because we want everyone to learn to work better together.  If you want to attend please do – be sure to register online because we won’t be able to accept walk-ins.

Our theme this year is “Hacker Family: Our Diversity Unifies Us” which resonates with me the more I get to know our community. I think of our hacker family dinners – because as many of us will attest, this community has become our family. Each of us brings something unique to the table, and when we share that knowledge and experience, there is a feast of learning and growth.  I didn’t get here without some help and support along the way, and this is how I get to repay that and pay it forward. We build our future by nurturing and growing the next generation and those to come.

This year we have expanded our talks to two speaking tracks, featuring technical as well as non-technical so that our attendees can show all they know! The submissions were outstanding and I give huge congratulations to everyone – our list of talks is fantastic! Exploits, imposter syndrome, IoT, CFPs, python and cryptography to name some of the topics covered. Here is our Diana Initiative Schedule so you can see the list of talent.

But wait – there’s more.  We are thrilled to announce we are featuring four incredible keynote speakers:

Thursday 9:45 am Shannon Morse @snubbs  “Personal Branding as an Infosec Influencer – Building a Career from Scratch”.  Shannon is Hak5’s host, producer and lead editor, and and actively promotes security and women in tech.

Thursday 5:00 pm Elizabeth Wharton @LawyerLiz “The Skirt Shoots, Scores and Soars”. Liz actively speaks on IoT, drone, and aviation cyber security issues, as well as hosting the Lawyer Liz podcast.

Friday 9:45 am  Keirsten Brager @KeirstenBrager “Seconomics: How to Earn More Money and Influence in the Next 5 Years”. Keirsten is well respected as an author and speaker promoting strategies for success and helping to change the game.

Friday 6:00 pm Amanda Berlin @InfoSystir “Hackers, Hugs and Drugs – Mental Health in Infosec”. Amanda is well known for her involvement in the community, on the Braking Down Security podcast, and for her book with Lee Brotherston,  “The Defensive Security Handbook”.

Support and goodwill from the community has been more than we could wish for. Huge thanks to Risky Business Podcast host Patrick Gray and sponsors Signal Sciences, Remediant and Bugcrowd who are hosting a special mentorship cocktail hour from 6-7 pm at Alexxa’s Bar @ Paris on the Las Vegas Strip Tuesday, August 7th. They have invited Diana Initiative attendees along with Risky Business listeners who identify as women; registration details are on the Diana Initiative registration form.

earrings

Once again, Lockpick Extreme has offered to host our Lockpick Village, which was a tremendous success last year. This year, they will also be offering a lock pinning workshop, which you must pre-register for on our online form.

We want to help attendees follow their passion for infosec and build their careers so we’ll be holding a Career Fair with resume workshops, mock interviews and the opportunity for professional headshots. Some of the most talented and experienced folks in infosec will be giving their time in individual sessions to help our attendees who have registered online.

And this is Summer Camp so yes, it will be all fun and games for a little while. We are hosting a Quiet Party on Thursday night and a Loud Party on Friday night, with board games, challenges and opportunities to meet people and talk about our diverse interests in a relaxed, comfortable setting.

It takes a village. I am moved beyond words by the support, encouragement and caring expressed by our volunteers and sponsors – this would not be happening without you. Each of you is making a real difference, and helping us to build something that goes far beyond a two-day event. That is why we chose the word “initiative” – to embody the spirit of a movement, and represent change and progress as ongoing. And I am honoured to be part of this dedicated, talented team who have put their whole hearts and countless hours into doing the multitude of things required to bring our event to life. We are here because we share a belief in what we do, and we answered a call to help make things better.

Let’s make this happen again! Can’t wait to see you in Vegas!

sponsors

2018: The rise of Cryptominers

They’re everywhere. Really. Everywhere. And if you don’t think they’re on your systems, think again. In the first 3 months of 2018, unique cryptominer types increased from 93,750 to over 127,000.  Compare that to ransomware, which was doing a booming business from 2016 into 2017.  New ransomware variants actually declined from 124,320 to 71,540.  Exploit kits are also down. That’s significant, because cybercrime is all about efficiency and profit. Illegal or malicious cyrptominers have evolved from a nuisance infecting individual systems to a pervasive threat on enterprise systems.

Per researchers at Cisco TALOS

“The number of ways adversaries are delivering miners to end users is staggering. It is reminiscent of the explosion of ransomware we saw several years ago. This is indicative of a major shift in the types of payloads adversaries are trying to deliver. It helps show that the effectiveness of ransomware as a payload is limited. It will always be effective to ransom specific organizations or to use in targeted attacks, but as a payload to compromise random victims its reach definitely has limits. At some point the pool of potential victims becomes too small to generate the revenue expected.”

The lure of easy money is unmistakable. Cryptominers offer “continuous passive income” versus the risk of not getting a ransom with ransomware.  And you can’t beat the return on investment. It’s pretty much pure profit, since the miners use somebody else’s resources.

The trend actually took hold in 2017, and has not stopped escalating. ZScaler reports it blocked more than 2.5 billion attempts over the past 6 months. On April 12, Infosecurity Magazine reported that cryptomining spiked 500% on corporate networks.  This is no longer a single-machine effort, but a massive, coordinated hunt by botnets for vulnerable systems. Researchers report that within the space of 24 hours, attackers tried to compromise 30% of networks globally using botnets to find vulnerable servers and web applications. PATCH people!

Mining is resource-intensive.   Monero has moved past what standard user systems can supply. Now, it requires graphics cards or preferably application specific integrated circuit ASIC chips.  We’re seeing miners shift to mining alternative currencies to Monero that can be mined using any CPU.

The impact is significant in terms of wear and tear on hardware. Miners usurp corporate bandwidth. They cause performance issues, and we know that uptime must be all the time. What enterprises should also take note of is that they could be at risk of compliance violations because of the unidentified activity on their corporate systems.

PIVOTS:  In 2016, we saw ransomware pivot and morph from attacking individuals to leveraging vulnerabilities on servers and networks and attacking institutions. We’re seeing the same thing happen with cryptominers, as criminals discover how to make better money, faster. They are hunting for web servers and applications they can exploit via unpatched vulnerabilities, both old and new.  Once they can compromise a system, they install the mining software.

Now, it appears that criminals are repurposing malware as miners, which is not a good thing when that malware happens to be ransomware. Case in point: XiaoBa. Researchers at Trend Micro report this new variation was not modified well, so that it is destructive. The sloppy code destroys files and crashes PCs. While his isn’t widespread, and will likely be reworked, the damage has been done to numerous systems. And raises the bigger issue: what will attackers rework next, and whose systems will be at risk?

MINERS: The one to watch for is Coinhive, as the most impact and pervasive.

BOTNETS:  Smominru: this is one of the biggest, most successful cryptojacking botnets active. So far, it’s netted $2.3 billion by leveraging the EternalBlue exploit to infect and enslave computers as part of the botnet. At more than half a million bots, the system is massive, and had evaded sinkhole attempts against it.

TARGETS: Because browsing time by users is high, nudity/porn sites, or those with streaming media, offer the most value for miners. However professional and marketing services are also rating high, bringing miners onto corporate networks.

Android and mobile systems: Kaspersky reports they found malicious mining apps in the Google Play store, imitating legitimate apps like games and VPNs, and notably sports streaming apps.  Some of these were downloaded over 100,000 times.  The criminals know this is a numbers game, because mobiles aren’t high performance and the risk of detection is higher.   Mining has become a frequent topic on darkweb forums, as members share knowledge, experiences and advice to improve their success.

Coinhive has evolved over time. Numerous compromised sites use JavaScript obfuscation and the final code presents itself as Google Analytics JS to viewers.

ATTACKS:  ZEALOT was discovered by researchers at F5 in late 2017.  This Monero cryptominer installed itself on vulnerable Apache Struts systems, leveraging the EternalBlue and EternalSynergy exploits.  PATCH, people!

A recent attack is leveraging an older ISS vulnerability on Windows servers. Microsoft was going to let IIS Internet Information Services 6.0 run its course and die. But there was a WebDAV exploit posted on GitHub in March 2017.  The vulnerability, CVE-2017-7269, is very similar to the NSA “Explodingcan” exploit that was part of the infamous Shadow Broker’s Good Friday dump. Attackers used that flaw to install cryptominers.  We all know that once a vulnerability is made known, attackers pounce and exploits follow.  In this case, the exploits has a new ASCII shellcode that contains a return ortiented programming ROP chain. This uses instructions that are already loaded in memory, so there is no need to write or execute further external code.  This enables the attackers to bypass security mechanisms, like executable space protections and code signing.

Lateral movement. Those two words should scare every security analyst. It’s what we fight to prevent. We don’t want the attacker to get to move through our networks and gather data. But this is the hallmark of sophisticated ransomware attacks on enterprises, and it’s now part of cryptominers.  In a report by Red Canary, they detail how an adversary mixed lateral movement with cryptomining on a Windows system. We know there are processes to watch over very, very carefully in Windows. In this case, they found numerous Windows command shells that were spawning from the Local Security Authority Subsystem process, lsass.exe.  This process handles user authentication for a system and typically does not have child processes. Authentication is a crown jewel so anything impacting this is critical.  The child processes that would spawn would inherit major privilege and have unrestricted access to the local system. Hello, lateral movement. This is the threat to enterprise systems we need to be monitoring.

PROTECTION:  Set up a web application firewall infront of all applications.  Keep your system patched and up to date. And monitor system performance for even small impacts.  There are numerous threat intel teams now tracking the mining bots and sharing IOCs, as in the link below from Proofpoint. That is the beauty of the security community at work.  Security teams can use this info to ensure their networks are not communicating with mining bots. Because all that glitters is not gold – it’s bitcoin.

 

ZDNet 04/05/2018 D. Palmer
Red Canary:  T. Lambert April 4
darkreading 4/5/2018 T. Kreikemeier
Comodo Cybersecurity Threat Research Labs Q1 Global Malware Report
https://www.tripwire.com/state-of-security/featured/smominru-half-million-pcs-hit-cryptomining-botnet/
https://www.proofpoint.com/us/threat-insight/post/smominru-monero-mining-botnet-making-millions-operators
https://www.bleepingcomputer.com/news/security/xiaoba-ransomware-retooled-as-coinminer-but-manages-to-ruin-your-files-anyway/
https://www.helpnetsecurity.com/2018/04/12/cryptomining-enterprise/

 

Quickhits: Friday Dec 29 2017

2018 is wrapping up. Here are a couple things to watch over.

Bitcoin mining: Coinhive malware has been found on the Movistar website, who are a major telecom unit owned by telefonica in Spain. Cryptojackers are using Google Tag Manager to mine the bitcoin currency Monero on hi-jacked machines. Tag Manager enables marketers or anyone who has a website to create code that then lets them inject JavaScript snippets dynamically. So since it isn’t hard-coded in source files on a webserver, it doesn’t get detected. And affected users do not know these tags are serving up malware. But good news: most ad blockers and many A: tools can id and shutdown Coin Hive code.

http://www.zdnet.com/article/opera-just-added-a-bitcoin-mining-blocker-to-its-browser/

https://www.theregister.co.uk/2017/11/22/cryptojackers_google_tag_manager_coin_hive/

Ransomware Updates: Tastylock Cryptomix has been discovered by Michael Gillespie. It appends “.tastylock” as an extension to encrypted files and changes contact emails used by the ransomware.

Recommendations to protect your files: current, offline backups; malware detection software that looks for behavioural changes over signature detection; scan attachments before you open them using tools like VirusTotal.

Per Lawrence Abrams

https://www.bleepingcomputer.com/news/security/tastylock-cryptomix-ransomware-variant-released/

Quickhits: Thursday Dec 21 2017

Emotet Malware Sightings: Emotet originated as a banking trojan, and has continued to evolve into more pernicious malware.  It goes after banking credentials and sensitive information. Remember, data is the new gold.  Typically, the malware is conveyed via a malicious macro hidden in attachments that are very well disguised as legitimate business communications like invoices. Once Emotet is downloaded, it gets activated, goes looking for the data to harvest, and then exfiltrates that back to the command and control servers. This follows each step in the Cyber Kill Chain: Recon, Weaponize, Deliver, Exploit, Install, Command and control. Followed by Actions, meaning the attacker’s true intent. In this case, that can involve the sale of information and the continued spread of Emotet across systems to harvest more.

emotet

https://www.cylance.com/en_us/blog/threat-spotlight-emotet-infostealer-malware.html

GoAhead Remote Exploit:  This is a biggie. CVE-2017-17562: Remote LD_PRELOAD exploitation of GoAhead web server. Remote exploitation of anything isn’t good, but as it happens GoAhead runs a hell of a lot of things: printers, network gear, CC cameras. Users of telecoms hosting stuff. I took a look on Shodan to see how many connections there are and found over 400K.

goaheadserver

Per their website:

GoAhead is the world’s most popular, tiny embedded web server. It is compact, secure and simple to use. GoAhead is deployed in hundreds of millions of devices and is ideal for the smallest of embedded devices.

goahead1

Welcome to our security nightmare of convenience without proper configuration.  This isn’t something new, however. It’s been around awhile. And there is a patch here: https://www.elttam.com.au/blog/goahead/

Botnets and Bitcoins:  Bitcoin mining has become an issue, given the rapid rise in value of this volatile commodity.  Because it takes so much energy to produce this intangible product, miners resort to harnessing other people’s equipment through sketchy downloads not from the Apple or Google playstores, via keyloggers through malware, and via botnets. At the moment, organized cybercrime is going after database services using a new botnet in the “Hex-Men” attacks.  These are based out of China, and the reach is global. Why you should care: according to GuardiCore researcher Daniel Goldberg, these boxes are sensitive production Web servers, running MS SQL, ElasticSearch etc. Daniel has co-authored a report for GuardiCore on this with Ofri Ziv, who warns:

The fact that they are targeting databases is pretty amazing to me and it’s something that people need to really, really pay more attention to

https://www.darkreading.com/attacks-breaches/new-database-botnet-leveraged-for-bitcoin-mining/d/d-id/1330674

https://www.guardicore.com/2017/12/beware-the-hex-men/

Quickhits: Tuesday Dec. 19 2018

Lexmark Printers: Well this can’t be good. Apparently there are over a thousand Lexmark printers ready for the taking, due to misconfiguration. They are sitting open and acessible on public internet. Researchers from Newsky Security reported finding these printers in businesses, universities and government offices. These printers have no passwords.  Which makes them easy pickings for a variety of attacks. A remote attackers can

” view the printer’s firmware version, ink levels, and network configuration that allows them to enable proxies, change administrator passwords, modify sound volume, contact information, device status, time, and date, create a self-signed certificate and private key and even upload documents and send jobs to the printer.”

Android Malware:  We know Android is the choice of attackers everywhere. Recommendations to purchase appas solely through Google Playstore don’t guarantee safety, but at least they lower the odds of infection. Now there’s anew trojan in town. Loapi hides behind adult content sites or antivirus solutions. The trojan forces users into a loop seeking device admin istrator privileges. It’s also equipped to defend itself against removal and blocks attempts.  According to Kaspersky, the malware creators

“have implemented almost the entire spectrum of techniques for attacking devices: the Trojan can subscribe users to paid services, send SMS messages to any number, generate traffic and make money from showing advertisements, use the computing power of a device to mine cryptocurrencies, as well as perform a variety of actions on the internet on behalf of the user/device. The only thing missing is user espionage, but the modular architecture of this Trojan means it’s possible to add this sort of functionality at any time.”