Penetration Testing

Cyber Criminals Are Pressuring Your Customers

Summary
Over the past few years, cybercriminals have brought more sophisticated ransomware attacks against organizations leading to potentially catastrophic damages. Generally, an attacker gains access to an internal network, performs network reconnaissance, elevates their privileges, and deploys ransomware across the network, which encrypts the data rendering it unusable. The attacker then demands the organization pay a large sum of money for the keys to decrypt the data. This makes it critical for organizations to increase security awareness, perform regular offsite backups of critical systems, have properly configured network monitoring and endpoint protection, and a mature incident response program.

Criminals are now taking their extortion attempts to the next level. Security researchers have noticed a spike in emails sent to end customers of companies that have fallen victim to network breaches. These emails notify customers that their data has been compromised due to a security breach. It asks the customer to reach out and demand that the company pay the cybercriminal’s ransom request in order to prevent their personal data from being leaked online. Here is an example of the type of emails end customers are receiving:

Most security professionals will tell you, if possible, avoid paying the ransom when your company falls victim to data leaks or ransomware attacks. Increased pressure from customers receiving these emails only makes the decision to not pay more difficult. Additionally, these emails notifying customers of a data breach can lead to reputational damage and lost business.

What can be done?
It is important for companies to put an emphasis on security before they fall victim to these types of attacks. Performing regular external penetration testing can prevent attackers from compromising systems and pivoting into the internal network. Additionally, performing internal penetration testing can stop an attacker in their tracks. If an attacker gains a foothold, it will be difficult for them to elevate privileges and compromise critical internal systems allowing the deployment of ransomware. nGuard provides an abundance of tactical and strategic security assessments that will boost the overall security posture of an organization. This will reduce the chances of a successful attack and further minimize the damages that stem from a breach.

Cybersecurity is National Security

Summary
With the recent breach of the Oldsmar Florida Water Treatment Plant, China warning India they have the ability to turn the lights out, the United States and Russia going back and forth with probes into each other’s power grids, and research showing just how easy it is to gain unauthorized access to Industrial Control Systems, it comes at no better time that the US is releasing three new programs. These programs aim to help protect and secure our energy grid. CESER Acting Assistant, Secretary Patricia Hoffman, said “Securing U.S. critical infrastructure, particularly in the energy sector, is one our most important and complex national security challenges.” The three new programs are:

Secure against vulnerabilities in globally-sourced technologies
Develop solutions to electromagnetic and geomagnetic interference
Cultivate research on cybersecurity solutions and new talent needed to deploy

At critical infrastructure facilities, much attention is put into physical security. Hiring security guards, placing cameras everywhere, gates, fences, and barbed wire is common place. However, much is left to do to properly secure the online, connected systems that are most vulnerable to attack. With limited budget, scarce support, and outdated systems, organizations are left with a daunting task of properly securing this infrastructure from attack while maintaining accessibility and availability.

The Department of Homeland Security has published the Seven Strategies to Defend Industrial Control Systems (ICS).

Implement Application Whitelisting
Ensure Proper Configuration / Patch Management
Reduce Your Attack Surface
Build a Defendable Environment
Manage Authentication
Implement Secure Remote Access
Monitor & Respond

Following these strategies will help secure critical infrastructure to a better place, but that is not where it ends.

What else can you do?
nGuard has a wide array of experience helping energy and all types of critical infrastructure organizations secure their networks and meet security compliance goals via penetration testing, managed security solutions, and Cybersecurity Incident Response (CSIR) and we can help you too.

Critical Exchange Zero-Day

Summary
This month, Microsoft released security patches for multiple zero-day exploits targeting on-premise Exchange servers. CVE-2021-26855 allows a malicious attacker to bypass authentication and impersonate users. Not only does this vulnerability allow an attacker to compromise email accounts, but the ability to install malware for persistent access or ransomware is also available. Microsoft has labeled this as a critical vulnerability that must be patched immediately.

As of this week, full proof-of-concept exploits are popping up online. This allows the exploit to become more widely exploited by malicious actors with little to no technical expertise. Check out the video below to see just how easy it is to gain a high-privilege shell with the public proof-of-concept code. It is estimated that nearly 80,000 Exchange servers exposed to the internet are still vulnerable to this exploit. If your organization is utilizing Microsoft’s on-premise Exchange service, it is essential that it be patched right away to avoid compromise.

What to do?
Microsoft has released their Exchange On-premises Mitigation Tool (EOMT) to address CVE-2021-26855 which is the most effective way to protect and mitigate exchange servers prior to patching. If you need to check if your exchange servers are vulnerable, use this handy script from Microsoft which is formerly known as the HAFNIUM script. The United States CISA is recommending all organizations use this script to determine if their exchange servers have been compromised. Stay updated with alerts from US-CERT.

Florida Water Treatment Plant Hack

Summary
Earlier this month, hackers successfully carried out an attack against an Oldsmar, Florida water treatment facility, coming awfully close to poisoning the water supply. Attackers were able to access the water treatment plant’s Supervisory Control and Data Acquisition (SCADA) systems remotely and increase the levels of sodium hydroxide that is added to the water from 100 parts per million to 11,100 parts per million. In small doses this chemical is safe to consume. Fortunately, the change was discovered immediately by an employee and they were able to reverse the change, prior to any modifications in the levels of sodium hydroxide.

How did they do it?
The water treatment plant is running Windows 7 operating system on its computers. This is an outdated, unsupported operating system which had not received any updates in over a year. Attackers were able to compromise the computers due to the outdated systems which are affected by multiple known vulnerabilities. This resulted in unauthorized access to the systems. The computers had also been utilizing TeamViewer, a remote access software, to administer the machines as needed and respond to alerts. All the computers on the network that used TeamViewer utilized the same password and allowed anyone from the internet to access these systems. A recent data breach database that was leaked in 2017 contained passwords that matched the domain of ci.oldsmar.fl.us. It is believed the attackers used these passwords to gain access via TeamViewer. Once attackers had gained access via the outdated operating system, they used this software to remotely access the desktop and modify the sodium hydroxide levels.

What to do?
If your organization is hosting critical infrastructure, like SCADA or Cardholder Data Environments (CDE) for PCI, it’s crucial to:

Properly segment these systems from non-critical networks.
Ensure all operating systems in use, across all networks, are supported by the vendor and receiving and applying regular security patches.
Regular testing to check for proper segmentation should be done to validate the security access controls in place are sufficient to limit access to critical infrastructure.
Limit the types of software allowed on your systems.
Eliminate all local administrator accounts to enforce the principle of least privilege.
Have a strong password policy that is strictly enforced for all types of accounts.

nGuard has broad experience helping to secure all types of critical infrastructure organizations, including energy. By leveraging penetration testing, managed security solutions and Cyber Security Incident Response, we can help your organization become secure and meet your compliance goals.

February SolarWinds Update

As security researchers continue to delve into the issues surrounding the SolarWinds breach, additional implications and vulnerabilities are coming to light.

Last week researchers discovered 3 additional SolarWinds vulnerabilities that at worst, allow an attacker to achieve remote code execution with elevated privileges.

CVE-2021-25274 affects the SolarWinds Orion platform through the Microsoft Message Queue. The Collector Service doesn’t set permissions on private queues which may allow an attacker to send specially crafted packets to the service to gain remote code execution.
CVE-2021-25275 also affects the Orion platform and may allow an attacker to gain unauthorized access to the back-end database. This vulnerability would likely allow an attacker to gain administrator privileges for the application which can cause a world of trouble.
CVE-2021-25276 affects the SolarWinds Serv-U FTP server. A directory that contains user’s password hashes is accessible to any Windows User that has access to the server’s filesystem. A malicious user could quickly add a user profile that would give them persistent access to the FTP server.

SolarWinds has since addressed these issues that were responsibly disclosed to them. While these vulnerabilities have not been found to be exploited in the wild and appear to be missing from the supply chain attack that we have been so closely following, it is highly recommended that users of the platform install the latest versions. Users of the SolarWinds Orion platform can find information related to the recent update here. Additionally, organizations utilizing the Serv-U FTP functionality can find a hotfix here (ServU-FTP 15.2.2 Hotfix 1). This is a direct .zip download. nGuard has been responding to many requests for services related to this massive SolarWinds breach. From incident response to preventative penetration testing assessments, nGuard is helping our clients to secure their data and protect their customers.

GDPR Fines On The Rise

Since the introduction of the European Union’s General Data Protection Regulation (GDPR) in May of 2018, they have handed out $330.5 million in fines with $192 million in the past year alone. As the GDPR regulation grows in maturity, regulators are growing tougher with their fines. Breach notifications are on the rise, as they have increased 19 percent over the past 12 months. Germany leads the way with 66,527 breach notifications and Italy has had the least with 3,460. Germany, France, and Italy are the top 3 countries that have imposed fines, with a combined $234 million since GDPR was enacted.

With the impact of COVID-19, organizations have been fortunate to have their fines drop significantly with the promise to improve their security posture. Marriott saw their fine reduced to $25 million from the original $123 million during a breach that lasted over 4 years and resulted in the compromise of 339 million guest’s information. British Airways saw their fine reduced to $27 million from the original $230 million as a result of personal data of over 400 thousand customers being stolen when their website redirected to a fraudulent one which collected personal details of customers. This went undetected for over 2 months. The pandemic has provided temporary relief on some fines, but this isn’t permanent. Organizations need to ensure they are following GDPR regulations or it is going to cost them in large-scale fines.

The 4 potential sources of privacy protection are markets, technology, self or co-regulation, and law. GDPR has taken the traditional approach of law to enforce privacy and data protection. With GDPR fines only increasing and being strictly enforced, it does show that laws do not necessarily mean the result will be increased privacy and security. The best piece of advice for organizations having to follow GDPR guidelines is to err on the side of caution, as fines and cumulative damage claims are only going to rise. As GDPR matures and evolves, there may be new, stricter regulations released in the future.