Advisory

Should We Pay The Ransom?

Summary
Has your organization been a target of ransomware? Did you pay the ransom? If so, did you get all your data back? Whenever an organization becomes a victim of a ransomware attack, paying the malicious attackers may seem like the only hope, especially for companies that don’t have proper backup procedures in place. Unfortunately, statistics are showing us that paying the ransom guarantees little in return. Here are some key data points collected from a large sample size of mid-sized organizations spread across the globe.

In 2021, 37% of organizations have experienced some type of ransomware attack.
The average costs of remediating against a ransomware attack grew in 2021 to $1.85 million.
The average cost of paying the ransom grew to $170,000.
32% of the organizations affected by a ransomware attacks decided to pay the malicious actors.
ONLY 8% WERE ABLE TO DECRYPT AND RECOVER ALL THEIR DATA AFTER PAYING THE RANSOM!

The last point truly brings reality into check. Paying the ransom rarely pays off. This can be attributed to many factors, but the overwhelming majority of organizations say that they received the ransom key after payment, but were unable to use it in an effective manner. This can be linked to poorly coded malware and IT teams with limited experience.

What Can You Do?
It is extremely important for organizations to take proper precautions to protect themselves against the increasing threat of ransomware.

Perform monthly or quarterly vulnerability scans against your external perimeter and internal networks to stay up to date with the latest vulnerabilities that could give an attacker their initial foothold.
Perform annual penetration testing to protect against advanced techniques that may allow an attacker to pivot once they have a foothold.
Create effective Incident Response policies and procedures.
Conduct tabletop exercises to validate and identify gaps in your Incident Response Plan.
Perform consistent security awareness training with employees to limit the chance of successful social engineering and phishing attacks.
Have proper onsite and offsite backup policies and procedures in place. If you fall victim to ransomware, you may be able to recover from backup, with limited, if any data loss, and not rely on paying a large sum of money for an 8% chance of getting your data back.

When it comes to protecting your organization’s critical data, it’s time to get serious. nGuard is ready and willing to discuss all these preventative solutions with you and your team.

FBI Is Removing Back Doors From Private Networks

The FBI was given permission last week by the United States Department of Justice (DOJ) to remove web shells that were maliciously placed as a result of the Microsoft Exchange Server vulnerabilities discovered in January. For more information on the Exchange Server vulnerabilities, check out our prior Security Advisory discussing them. If you have not applied the patch yet, it is urgent you do so immediately.

The FBI was able to identify hundreds of remote web shells that persist on networks even if the patch was applied. Attackers placed these shells there knowing the vulnerability would be fixed but wanted to maintain access for future attacks. The DOJ stated, “The FBI conducted the removal by issuing a command through the web shell to the server, which was designed to cause the server to delete only the web shell (identified by its unique file path).” The FBI is currently making attempts to contact the owners of the exchange servers they removed web shells from and notify them of the actions taken. Although the removal of these web shells is great news for the organizations where they existed, the FBI has not applied patches needed to remove the vulnerabilities or any malware remaining from attackers.

The impact of the court order issued to the FBI to allow these actions on future requests is still unknown, but this will set an interesting precedent going forward. Even though the intentions and actions of the FBI were for the betterment of the organizations, the government was accessing private networks without the owner’s permission. This could allow more intervention from the government on private networks. Opinions are split on the matter, but most believe this will not be the last time we see the government taking steps to remove threats on networks they do not own.

Cyber Criminals Are Pressuring Your Customers

Summary
Over the past few years, cybercriminals have brought more sophisticated ransomware attacks against organizations leading to potentially catastrophic damages. Generally, an attacker gains access to an internal network, performs network reconnaissance, elevates their privileges, and deploys ransomware across the network, which encrypts the data rendering it unusable. The attacker then demands the organization pay a large sum of money for the keys to decrypt the data. This makes it critical for organizations to increase security awareness, perform regular offsite backups of critical systems, have properly configured network monitoring and endpoint protection, and a mature incident response program.

Criminals are now taking their extortion attempts to the next level. Security researchers have noticed a spike in emails sent to end customers of companies that have fallen victim to network breaches. These emails notify customers that their data has been compromised due to a security breach. It asks the customer to reach out and demand that the company pay the cybercriminal’s ransom request in order to prevent their personal data from being leaked online. Here is an example of the type of emails end customers are receiving:

Most security professionals will tell you, if possible, avoid paying the ransom when your company falls victim to data leaks or ransomware attacks. Increased pressure from customers receiving these emails only makes the decision to not pay more difficult. Additionally, these emails notifying customers of a data breach can lead to reputational damage and lost business.

What can be done?
It is important for companies to put an emphasis on security before they fall victim to these types of attacks. Performing regular external penetration testing can prevent attackers from compromising systems and pivoting into the internal network. Additionally, performing internal penetration testing can stop an attacker in their tracks. If an attacker gains a foothold, it will be difficult for them to elevate privileges and compromise critical internal systems allowing the deployment of ransomware. nGuard provides an abundance of tactical and strategic security assessments that will boost the overall security posture of an organization. This will reduce the chances of a successful attack and further minimize the damages that stem from a breach.

Cybersecurity is National Security

Summary
With the recent breach of the Oldsmar Florida Water Treatment Plant, China warning India they have the ability to turn the lights out, the United States and Russia going back and forth with probes into each other’s power grids, and research showing just how easy it is to gain unauthorized access to Industrial Control Systems, it comes at no better time that the US is releasing three new programs. These programs aim to help protect and secure our energy grid. CESER Acting Assistant, Secretary Patricia Hoffman, said “Securing U.S. critical infrastructure, particularly in the energy sector, is one our most important and complex national security challenges.” The three new programs are:

Secure against vulnerabilities in globally-sourced technologies
Develop solutions to electromagnetic and geomagnetic interference
Cultivate research on cybersecurity solutions and new talent needed to deploy

At critical infrastructure facilities, much attention is put into physical security. Hiring security guards, placing cameras everywhere, gates, fences, and barbed wire is common place. However, much is left to do to properly secure the online, connected systems that are most vulnerable to attack. With limited budget, scarce support, and outdated systems, organizations are left with a daunting task of properly securing this infrastructure from attack while maintaining accessibility and availability.

The Department of Homeland Security has published the Seven Strategies to Defend Industrial Control Systems (ICS).

Implement Application Whitelisting
Ensure Proper Configuration / Patch Management
Reduce Your Attack Surface
Build a Defendable Environment
Manage Authentication
Implement Secure Remote Access
Monitor & Respond

Following these strategies will help secure critical infrastructure to a better place, but that is not where it ends.

What else can you do?
nGuard has a wide array of experience helping energy and all types of critical infrastructure organizations secure their networks and meet security compliance goals via penetration testing, managed security solutions, and Cybersecurity Incident Response (CSIR) and we can help you too.

Critical Exchange Zero-Day

Summary
This month, Microsoft released security patches for multiple zero-day exploits targeting on-premise Exchange servers. CVE-2021-26855 allows a malicious attacker to bypass authentication and impersonate users. Not only does this vulnerability allow an attacker to compromise email accounts, but the ability to install malware for persistent access or ransomware is also available. Microsoft has labeled this as a critical vulnerability that must be patched immediately.

As of this week, full proof-of-concept exploits are popping up online. This allows the exploit to become more widely exploited by malicious actors with little to no technical expertise. Check out the video below to see just how easy it is to gain a high-privilege shell with the public proof-of-concept code. It is estimated that nearly 80,000 Exchange servers exposed to the internet are still vulnerable to this exploit. If your organization is utilizing Microsoft’s on-premise Exchange service, it is essential that it be patched right away to avoid compromise.

What to do?
Microsoft has released their Exchange On-premises Mitigation Tool (EOMT) to address CVE-2021-26855 which is the most effective way to protect and mitigate exchange servers prior to patching. If you need to check if your exchange servers are vulnerable, use this handy script from Microsoft which is formerly known as the HAFNIUM script. The United States CISA is recommending all organizations use this script to determine if their exchange servers have been compromised. Stay updated with alerts from US-CERT.

Florida Water Treatment Plant Hack

Summary
Earlier this month, hackers successfully carried out an attack against an Oldsmar, Florida water treatment facility, coming awfully close to poisoning the water supply. Attackers were able to access the water treatment plant’s Supervisory Control and Data Acquisition (SCADA) systems remotely and increase the levels of sodium hydroxide that is added to the water from 100 parts per million to 11,100 parts per million. In small doses this chemical is safe to consume. Fortunately, the change was discovered immediately by an employee and they were able to reverse the change, prior to any modifications in the levels of sodium hydroxide.

How did they do it?
The water treatment plant is running Windows 7 operating system on its computers. This is an outdated, unsupported operating system which had not received any updates in over a year. Attackers were able to compromise the computers due to the outdated systems which are affected by multiple known vulnerabilities. This resulted in unauthorized access to the systems. The computers had also been utilizing TeamViewer, a remote access software, to administer the machines as needed and respond to alerts. All the computers on the network that used TeamViewer utilized the same password and allowed anyone from the internet to access these systems. A recent data breach database that was leaked in 2017 contained passwords that matched the domain of ci.oldsmar.fl.us. It is believed the attackers used these passwords to gain access via TeamViewer. Once attackers had gained access via the outdated operating system, they used this software to remotely access the desktop and modify the sodium hydroxide levels.

What to do?
If your organization is hosting critical infrastructure, like SCADA or Cardholder Data Environments (CDE) for PCI, it’s crucial to:

Properly segment these systems from non-critical networks.
Ensure all operating systems in use, across all networks, are supported by the vendor and receiving and applying regular security patches.
Regular testing to check for proper segmentation should be done to validate the security access controls in place are sufficient to limit access to critical infrastructure.
Limit the types of software allowed on your systems.
Eliminate all local administrator accounts to enforce the principle of least privilege.
Have a strong password policy that is strictly enforced for all types of accounts.

nGuard has broad experience helping to secure all types of critical infrastructure organizations, including energy. By leveraging penetration testing, managed security solutions and Cyber Security Incident Response, we can help your organization become secure and meet your compliance goals.