Industry Intel

DEF CON 25 has come and gone, but the cybersecurity world is still reeling from some of the research and advanced threats demonstrated at this annual convention of the world’s foremost hackers. Security professionals are more aware than ever of the increasing number of threats targeting everyday devices—from smart appliances to voting machines. Keep reading for insight into DEF CON from Webroot security experts.

Wreck the vote

Voting machines were hacked in about 90 minutes at DEF CON. Advanced Voting Solutions (AVS) WINVote was one of the 30 voting machines available to be hacked. The password was… wait for it… “abcde”. These are the same machines that were used for the 2004, 2008, and 2012 U.S. presidential elections. AVS went out of business years ago and stopped supporting the machines in 2007, yet Virginia was still using them in 2015! The implications are huge; not only does this confirm that voting machines are definitely hackable and voting tampering is entirely plausible, but also that government oversight for the security of these machines is grossly negligent.

DEF CON also displayed its notorious “Wall of Sheep,” where experts analyzed unencrypted network packets to show usernames and password, perfectly readable in plain text. We saw some IoT devices using unsecure protocols like FTP, POP3, IMAP, and HTTP, which were practically handing out the credentials people used to log into them. In particular, I saw more than a few smart doorbell devices on the Wall of Sheep while I was in the room. Makes you rethink your sense of home security.

– Tyler Moffitt, Sr. Threat Research Analyst

A CISO’s perspective

Hacking #ICS and #IoT @defcon tell me it’s not that easy? #Webroot #CISOapproved pic.twitter.com/OGQ4S9DNxu

— Gary Hayslip (@ghayslip) July 28, 2017

This year, I was amazed at the size of the crowds. DEF CON is truly becoming a must for security professionals to educate themselves on new threats and get hands-on experience in areas such as physical security, hacking and defending SCADA/ICS systems, and penetration testing on wearable devices.

One event I found especially interesting was by the company NXT Robotics, which offered up one of its security robots for hackers to attack. The bot withstood over 96 hours of continuous testing. When I questioned the founder of NXT, he said the robot was designed with a secured version of Linux from its initial design phase—their whole product life-cycle is focused on “security by design.” That impressed me. Given the growing number of IoT devices on the market today, the security of the device, its data, or how it integrates into larger infrastructures is not always accounted in the prerequisites for design. You can see that clearly in the large number of IoT devices that were on display at DEF CON, including cars, which were being stress-tested by many of the conference attendees.

One last point: many of the discussions centered on new attacks or new vulnerabilities enabled by our increasingly intertwined infrastructure. I hope to see more presentations on unique ways to defend and manage risk for organizations that have disparate networks and technologies. As DEF CON proves, hacking isn’t just for attacking; it can be about being creative in defending as well.

– Gary Hayslip, Chief Information Security Officer

Fresh threat research

Every year, without fail, security researcher Chris Domas of Battelle Memorial Institute has something really cool to share. At DEF CON this year, he presented Sandsifter, a project focused on fuzzing the x86 processor to reveal hidden processor bugs and undocumented instructions. Thanks to Sandsifter, a number of secret processor instructions have been uncovered in x86 chips from every major vendor, revealing both benign and security-critical hardware bugs.

Researcher Dimitry Snezhkov, a senior security consultant for X-Force Red at IBM, presented a tool that can offer command and control to penetrated environments via webhooks. In this way, hackers can use approved sites for communication, perform data transfers, and more without detection. (The idea is that HTTP accesses to GitHub are not likely to be filtered and will probably fly under the radar of network administrators.)

– Eric Klonowski, Sr. Advanced Threat Research Analyst

Last week, Black Hat USA 2017 brought an impressive 15,000+ cybersecurity professionals to Las Vegas to talk shop about the biggest issues facing businesses today. Here’s a recap from the perspective of the Webroot security experts who attended.

A hacker’s economy

Black Hat 2017 continued a recent trend of more corporate and business involvement than ever before. We are witnessing history-in-the-making as the threat landscape continues to evolve… and not for the better. Nation state-grade security tools, techniques, and vulnerabilities are increasingly more available to cybercriminals. The price of entry has dropped. It’s as if we’ve lost plans for the atom bomb, while plutonium is just a dollar a pound.

Fortunately, Black Hat continues to be an engaging forum for cross-pollination of security ideas, as well as some scary tactical discussions, but most of all it provides education for individuals and businesses who want to find out how to defend themselves and their employees. My advice to CTOs everywhere is to become conversant in security trends and best practices, whether it’s writing secure code, deploying secure apps, or making sure colleagues are aware of the risks they face every day.

– Hal Lonas, Chief Technology Officer

A CISO’s view

One thing I found interesting this year is that everyone seems to have acknowledged they need machine learning, artificial intelligence (AI), and analytics for their security platforms. Many of the security vendors were talking about using machine learning and AI to differentiate themselves, but I still thought something was missing: nobody was really talking about integration and automation. More vendors are now offering APIs to plug their products into an organization’s SIEM of choice, but from a CISO’s point of view, I want solutions that I can automate to perform specific functions and orchestrate into my security suite.

Unfortunately, I didn’t see much designed to fill that need. With small security teams and tight budget resources, I find CISOs want to implement solutions that can be integrated into their current security platform and exchange/provide data to create a more comprehensive view of the organization’s threat profile in real time. Black Hat has always showcased some amazing technologies, and this year was no different. But from a practical point of view, I was hard-pressed to understand how I would integrate these innovations without having to make major changes to my current security investments.

– Gary Hayslip, Chief Information Security Officer

Understanding machine learning

Industry confusion continues around machine learning and artificial intelligence with the terms being used synonymously. There is still ground to cover to eliminate misnomers when identifying these types of technologies.

That aside, savvy consumers are beginning to understand that machine learning has some limitations. It takes years of experience to properly implement and even more time to build and refine the models to achieve a high level of accuracy. It also isn’t a silver bullet to solve all security problems. Many companies in our space are new to machine learning and haven’t yet had the time to understand its nuances. With over 10 years of experience in machine learning, Webroot is in a unique position, both to provide machine learning technology, but also to educate organizations about how to make the best security decisions for their business.

– David Dufour, Senior Director Engineering

Cryptocurrency fueling ransomware

Ransomware will continue to be a pervasive threat, there is absolutely no questioning this. As long as blockchain payment systems remain (relatively) anonymous, attackers have a direct way to force victims to launder the ransom themselves. Ransomware operators can also shift payments between blockchains, creating another layer of obfuscation. At Black Hat, researchers presented a small glimmer of hope. While methods are far from perfect, they’re developing tactics for tracking payments as they move through the blockchain.

With regard to the malware development, authors are aware of the growing prevalence of machine learning throughout the cybersecurity industry. As such, we can expect to see ransomware developed with a specific emphasis on defeating these models.

– Eric Klonowski, Sr. Advanced Threat Research Analyst

Integrating FlowScape™ Analytics for comprehensive threat coverage

I spent a lot of time on the show floor with our new FlowScape solution, which is great to discuss and to demo, not only for the unique network anomaly and threat detection that it covers, but also for its integration with so much of our other technology. For example, it uses our BrightCloud® IP Reputation threat intelligence to detect communications with known bad IPs. It also enables alerts and monitoring of infected and unprotected hosts through our SecureAnywhere® Business Endpoint Protection management systems via our Unity API.

With FlowScape Analytics, users can clearly visualise the impact of an infection or other cyberattack throughout their network. Getting to demonstrate this solution to other professionals in the cybersecurity space, it was clear we weren’t the only ones excited about the implications of this kind of technology for business security worldwide.

– Matt Aldridge, Solutions Architect

This past May, Webroot surveyed more than 600 IT decision-makers at medium-sized companies (with between 100 and 499 employees) in the U.S., U.K., and Australia. The survey focused on how these small businesses perceived new threats facing their organizations. Were they prepared to manage fallout and recovery process after a cyberattack? Did they understand the costs to their organization if they were victimized by a cyberattack? Some of the answers were surprising.

Key survey statistics:

• 96% of those surveyed believe they are susceptible to cyber threats.
• 80% use third-party IT security resources (mixed-use IT and security teams).
• 94% are updating their security budgets to account for mitigating new threats.
• 29% think they are ready to handle a cybersecurity-related incident.
• 89% are confident they have the staff or resources necessary to manage a cyber incident if and when it happens.
• 65% believe their brand reputation will be the most difficult thing to restore after an incident.
• Those surveyed believe the average total cost to their organization for a breach of customer data records would be:
  • $580,000 U.S.
  • £738,000 U.K.
  • AUD 1,893,000

Why these numbers worry me

As a security professional with more than twenty years’ experience in the industry, I’m concerned about several issues these numbers bring to light. Let’s dive a little deeper into the statistics, and what they mean for small- and medium-sized businesses.

Almost all small businesses surveyed (96%) believe they’re susceptible to cyber threats, and 94% are adjusting their security budgets to mitigate these risks. In addition, more than 80% are using a third-party cybersecurity resource. Traditionally, small businesses expand their IT departments gradually and don’t have dedicated security staff. Many of these growing companies assign security duties to a senior IT technician or contract it out to a managed service provider (MSP). Often, cybersecurity is viewed as a drain on resources that doesn’t generate revenue. But whether you’re a home-based business with one employee or a large office with 450 endpoints, if your business connects to the internet, you’re a target. Simple as that.

Given that 80% of the small businesses we surveyed outsource their cybersecurity to trusted MSPs, I would expect that all 80% feel confident they have the resources necessary to manage a cybersecurity incident. That’s why the next number shocks me. Only 29% of those companies feel they’re ready to handle an incident. Why is that?

I believe it’s because they don’t feel their own staff is adequately trained to respond. As a small business, it makes sense to contract security and incident response services to an MSP rather than try to maintain in-house resources. However, as a business, you are still responsible for how you and your partners respond when you have a breach. You can’t contract away your accountability to your customers for due diligence. To me, these numbers indicate that many companies are paying for security resources, but still need to train their teams to improve confidence that they could triage a cybersecurity incident successfully.

The second survey point that concerns me is the estimated total costs respondents believe they will pay to resolve a data breach. In June of 2016, the Ponemon Institute published their global analysis on the cost of a data breach (Ponemon, 2016). This document estimated that the average cost of a breach was $158 per compromised record. This cost is based on numerous factors that impact the business as they try to recover from a successful breach, including:

• Notifying all customers that their data was compromised
• Hiring a Public Relations team to assist with the emergency
• Hiring forensics services to understand how the incident happened, what was compromised, and what needs to be restored
• Restoring data and cleaning up the enterprise networks that have been breached
• Recruiting legal services to deal with any lawsuits or government investigation
• Lost revenue due to reputation damage or loss of compliance certifications

Take a moment to imagine the cost if 10,000 records were compromised in a single breach. As you can imagine, the impact on any business could be devastating, particularly for smaller organizations with more limited budgets. But what can a business do to reduce their risk of exposure and prepare themselves for a cybersecurity-related incident?

Join us for part 2 in this blog series to learn three quick processes I recommend to help small businesses beat modern threats.

The Cyber News Rundown brings you the latest happenings in cyber news weekly. Who am I? I’m Connor Madsen, a Webroot Threat Research Analyst, and a guy with a passion for all things security. Any more questions? Just ask.

Mac Backdoor Just Discovered, Active For Years

Researchers have only recently discovered a previously undetectable backdoor for Mac® computers that has been active for several years. The infection itself remains silent while working to gain control of everything on the system, from webcams to the keyboard and mouse, Fruitfly has been found throughout. Unfortunately, researchers are still unclear on the actual intentions of the malware, as it continues to be updated for use on the latest MacOS versions, though in a lower capacity.

Banking Trojans Ramp up Sophistication

Recently, a new banking Trojan variant has been found with enhanced capabilities for determining whether it is being run by a regular user, or within a virtualized testing sandbox. By monitoring the mouse movements, this variant can detect if a person is actually interacting with the machine, or simply analyzing malicious samples. Another unusual feature of this latest variant: it focused more on Mozilla Thunderbird user data than on actual banking credentials, leaving researchers scratching their heads about what its next steps may be.

Third Party Android Chock Full of Malware

Over the past few months, a Turkish Android™ app store has come under fire for distributing malware with every app download. The app store, CepKutusu.com, has been redirecting users to a malicious download page that offers Adobe Flash Player, which has been unused by Android since 2012. Fortunately, the issue has been resolved by the app store itself, after receiving hundreds of reports for the misleading app downloads.

Italian Bank Faces Largest Financial Data Breach

Officials have been working tirelessly throughout the last month to resolve a data breach that affected nearly 400,000 Italian banking customers. These accounts were accessed illicitly via a third-party provider, and contain the affected customers’ full account details. This breach is a follow-up to the one that occurred last fall, spurring even further security efforts to prevent similar breaches in future. The bank is also undertaking changes among partners who haven’t adopted higher security standards.

Scottish IDs for Sale on Dark Web

Over 100,000 unique credentials have been posted for sale on the Dark Web, mainly those of Scottish citizens residing in Edinburgh. While the source of these credentials is still unknown, officials are warning anyone who feels they may be at risk of identity theft to contact local authorities. Included in the stolen data are email addresses, passwords, and credit card information. To make matters worse, the seller is offering a money-back guarantee that at least 80% of the data is accurate and usable, adding further enticement to anyone in the market to buy.

The Cyber News Rundown brings you the latest happenings in cyber news weekly. Who am I? I’m Connor Madsen, a Webroot Threat Research Analyst, and a guy with a passion for all things security. Any more questions? Just ask.

Malware Lurking in Game of Thrones Torrents

Viewers hoping to catch an illegal copy of the season 7 premier of Game of Thrones, released last Sunday evening, stumbled across something much more dangerous than White Walkers. The most pirated TV show in the last 5 years, Game of Thrones torrents often come with an extra side of malware, and have even released a Cerber ransomware variant onto unsuspecting viewers. While some lucky pirates have escaped with clean torrents, others haven’t been so fortunate. Use caution in all your internet activities, whatever they may be.

Twitter Porn Bot Shutdown

In the last few weeks, researchers have been attempting to bring down a Twitter botnet that took over 86,000 bot accounts to send out a relentless stream of porn ads to Twitter users across the globe. The botnet itself began by creating systematically generated Twitter accounts to send out a malicious URL payload to victims, which would then redirect them to a variety of porn sites controlled by the same network.

Adoption Data Leaked in Newcastle

Recently, officials of the Newcastle City Council have been attempting to resolve a data breach in which a spreadsheet of over 2,700 adopted children’s information was exposed through an online invitation for adoptive parents. The email was only sent to 77 individuals, who’ve all received contact regarding the leak. The council is still working to contact people whose data may have been affected. While this was yet another case of human error, the council are implementing new security measures in the hopes of decreasing the chances of another such breach in the future.

GhostCtrl Android Malware Taking Over Devices

A new variant of the OmniRAT malware, GhostCtrl, has been showing up on Android devices and it has a variety of capabilities. Able to spy, collect and steal data, and launch a ransomware attack, GhostCtrl also acts as a backdoor that enables hackers to gain further device control. Unfortunately for many users, researchers have already discovered three separate version of the malware, which is easy enough to avoid by keeping devices up to date and avoiding questionable apps.

Smart Toys Still Leave Security Concerns

Technology marches ever forward, bringing even the most innocent-seeming items with it: the toys we give our children. Unfortunately, many of these toys lack even simplest security measures, even as they gather a broad range of data from the users. Some forms of data collected by the toys are transferred back to the manufacturer and stored on servers for benign purposes, but these transfers often lack basic data encryption. Several government agencies have issued warnings for parents to do their homework extensively before purchasing a smart toy.

The world’s leading information security events, Black Hat USA and DEF CON, are happening next week in Las Vegas. In its 20^th year, Black Hat will bring over 15,000 IT and security pros together to discuss the latest information security research, development and trends. Among these attendees, you will find academics, researchers, as well as leaders in the public and private sectors addressing the security community needs.

While Black Hat’s corporate appeal means it is generally safer than DEF CON, it’s always smart to practice good habits while in the company of hackers, many of whom are looking to demonstrate their skills. Here are my top tips for the average attendee to consider in order to stay safe and secure at this year’s Black Hat and DEF CON events:

Don’t take the bait

Over the past two years, businesses have cited phishing attacks as the most common threat they faced. Beware of falling victim to tried-and-true tactics such as phishing. Watch out for standard phishing attempts, especially those that may resemble Outlook Web Access (OWA) or other login pages you typically use for work.

Goodbye, Wi-Fi

You’re going to a hacker conference … think twice before using public Wi-Fi. While the official network at the Mandalay Bay is presumed secure, public networks in the venue or surrounding area are a definite no-go. Potentially millions of Android and iOS devices are particularly vulnerable this year due to a recently revealed bug called Broadpwn in the ubiquitous Broadcom Wi-Fi chipsets. Google has released a patch as part of its July 2017 Android Security Bulletin, so verify that your Android device is indeed running the most-recent Android security patch level dated July 5, 2017.

The same goes for other data connections on your mobile devices such as Bluetooth and NFC. Consider putting your device in airplane mode or powering down while attending sessions at either event. Stick to your cell provider’s 4G network if you must be online while you’re on the show floors. It’s also a good idea to keep these connections off on the flight to Las Vegas, also.

Protect your plastic

RFID scanners were once a common threat at Black Hat, able to pull data off credit cards at range, even those left inside a wallet. Thankfully, most credit cards are now equipped with a chip that must be inserted for the card to function, eliminating the vulnerability posed by RFIDs. Double check your credit cards to insure they are indeed using an EMV chip, and if they aren’t, call your bank for a replacement (and definitely don’t bring them to Black Hat).

Remember, some items such as passports and employee badges are still using RFID chips. These should be left secured in your hotel room or kept in special RFID-proof sleeves. Also, don’t forget to thoroughly inspect ATMs in and around the event venue. Card skimmers will likely abound on the Vegas Strip throughout Black Hat and DEF CON.

Ahoy, Bus Pirates

When piloting the show floors, you may see people showing off hacking devices known as ‘bus pirates.’ These flexible multi-tools allow hackers to interface with a large range of electronic devices using common protocols such as I²C, SPI, and MIDI. For obvious reasons, don’t allow one of these tools to be demonstrated on your device(s). The same goes for the seemingly innocuous hardware, too. You may be compelled to use the charging stations or those free USB drives being given out as takeaway gifts, but just say no. Malware can be downloaded through these connections.

All Devices Left Behind

A safe rule of thumb: avoid bringing any unnecessary devices to Black Hat. This goes for smart watches, fitness trackers, and, yes, even your car. Hackers at nearby DEF CON are known to sell signal repeaters that can replicate the frequency from wireless key fobs to unlock and even start up vehicles.

Join us in winning the fight against advanced cyber attacks and modern malware. To learn more about Webroot and beyond, visit www.webroot.com/blackhat and follow us on Twitter. We look forward to seeing you at Black Hat 2017.

The Cyber News Rundown brings you the latest happenings in cyber news weekly. Who am I? I’m Connor Madsen, a Webroot Threat Research Analyst, and a guy with a passion for all things security. Any more questions? Just ask.

Verizon Call Logs Found Exposed Online

Over the past month, researchers have been learning more about the recent discovery of unsecured customer service call records for over 14 million individuals on an Amazon server. The server in question is controlled by Nice Systems, an enterprise software company based in Israel, and contained call logs from January through June of this year. In the unencrypted records were customers’ names and their Verizon account login credentials. Even after Verizon became aware of the server’s vulnerability, it took over a week to get it properly secured by Nice Systems.

Bupa Healthcare Services Breached

In the last week, international healthcare provider Bupa was the victim of a data breach that included basic customer information, such as names, birthdates, and nationalities. The breach originated with an employee incorrectly transferring data between systems of Bupa Global, which handles international health insurance for frequent travelers—around 108,000 customers in total. The affected branch of Bupa has contacted all affected customers, and has stated that no other branches worldwide have been compromised.

Botnets Distributing New Point-of-Sale Malware

With the recent influx of botnet-related cyberattacks in the last year, it’s hardly surprising that Point-of-Sale malware is now spreading through the same channels. A variant that currently only affects Brazilian companies, LockPOS, has proven difficult to track. It makes minimal noise on the systems it infects, and spreads quickly using the FlokiBot botnet. Researchers have found samples as recent as June 24^th that use the standard two-stage approach for downloading the LockPOS payload to the victim’s system.

Cryptocurrency Miner Nearly Tops Mac Malware List

In the past month, an old bitcoin miner that originally appeared in 2011 has been making a staggering reoccurrence across Mac® computers, and is involved in over 20% of all Mac malware detections in June. By spreading through malicious Mac torrent sites, it is likely being used to mine multiple different cryptocurrencies, while also stealing any cryptocurrency wallets it finds on the infected machines.

Ex-Employees Can be Major Data Security Concern

A recent study of IT-directors across the UK revealed nearly half of all ex-employees still have access to corporate networks and drives. Even worse, of the 600 companies surveyed, nearly 25% had experienced a data breach caused by a recently released employee. While the majority of survey participants have procedures in place for de-provisioning former employees, their processes are not automated, and must be completed manually. This leaves potentially lengthy (and dangerous) gaps between an employee’s departure and subsequent offboarding.

The Cyber News Rundown brings you the latest happenings in cyber news weekly. Who am I? I’m Connor Madsen, a Webroot Threat Research Analyst, and a guy with a passion for all things security. Any more questions? Just ask.

British Lawmakers’ Logins Targeted

Over the last week, multiple parliament members and other lawmakers in the UK have been the focus of cold-callers attempting to gain login credentials, following a successful brute force attack that compromised the credentials of several other officials. Passwords for the remainder of the parliamentary staff have received a force reset to avoid any further exploitation of their systems.

Banks Still Struggle with Security

The Online Trust Alliance recently conducted an anonymous study of 1,000 websites across many different sectors, to test for security, privacy, and consumer protection. Of the 100 largest US banks in the study, only 27% passed all 3 categories, while 65% failed in at least one category. Although the American Banking Association still believes that banks are the current standard for security, the long list of breaches throughout the last year alone leave many consumers questioning just how secure their banks really are.

Sabre Breach Exposes Google Employee Data

In the past few days, Google has been sending out notifications to employees after Sabre Hospitality Services experienced a breach in their reservation system. While the breach appears to have occurred between August 2016 and March 2017, most employees’ data should still be secure, since Sabre automatically deletes reservation details after 60 days. In addition to Google employees, this breach may affect anyone who has used Sabre booking services during the suspected breach period. Those who believe they may have been affected should check their billing statements regularly for discrepancies.

Feedback Scammers Pick 5,000 Companies to Extort Millions

Scammers are now using the .feedback top-level domain (TLD) to extort money from companies. The TLD exists so companies can invite their customers to provide comments on their services. Sounds pretty swell, but only if the company is the first to register the .feedback domain for their brand. A new group of scammers has created domains for 5,000 top companies, with the demand that companies either pay monthly to receive the feedback their customers submit, or pay a lump sum to have the site taken down entirely.

Mozilla Site Security Review Has Shocking Results

Mozilla just completed a study of the top 1 million websites to determine their overall ability to protect visitors from various types of cyberattacks. Unfortunately, nearly 94% of study participants received an “F” across the 13-point test. While an increasing number of sites continue to improve their security year-over-year, the majority still have a long way to go.

The Cyber News Rundown brings you the latest happenings in cyber news weekly. Who am I? I’m Connor Madsen, a Webroot Threat Research Analyst, and a guy with a passion for all things security. Any more questions? Just ask.

Ukraine Hit With Nationwide Cyberattack

In the past week, Ukrainian officials have been making announcements regarding a cyberattack that has affected nearly all of the nation’s industries and government sectors. Also affected is Ukraine’s main airport, creating significant delays. While it is still unclear who initiated the attack, officials are saying that the infection was targeted to cause destruction across a variety of the country’s essential systems.

Wind Farms Surprisingly Insecure

As we move get closer to mass-production of wind power, the security of the turbines themselves is coming under scrutiny. Over the past few years, researchers have been performing penetration tests on multiple wind farms across the US, and have discovered that most are only as secure as the tumbler lock on the turbine door. After accessing the interior of the rarely-manned turbine, researchers were able to gain full control of not only that individual turbine, but every other one connected to the network. In light of such tests, the industry will soon have to make significant improvements to the turbines’ physical security of the turbines, as well as the networks they use.

Petya Ransomware Destroys Data, Rather than Ransoming It Back

Following this week’s Petya cyberattacks, researchers have been working tirelessly to understand the exact circumstances involved. While some believed it to be a ransomware attack, it appears the malware author’s intent was purely destructive. Rather than the typical bitcoin ransom demand, the infection virtually destroys the hard drive in question by encrypting the Master File Table and removing any access to the remainder of the encrypted files.

8Tracks Music Social Network Hacked

Over the past few days, a hacker operating on the Dark Web has posted an offer for 18 million 8Tracks user accounts and passwords. A sample of the data was verified, and, although the usernames and passwords are all SHA-1 encrypted, several web tools are readily available to any buyers determined to crack it. 8Tracks has since confirmed the breach and recommended that all users change their login credentials, especially those that have been used for multiple sites.

South Korean Banks Face Large DDoS Ransom Demand

In the last few days, at least 5 major South Korean banks have been threatened with a large-scale DDoS attack unless they pay a ransom of $315,000 in bitcoins. It’s no coincidence that this attack comes just weeks after the successful ransom of a South Korean web hosting service, though it would appear that the attackers never followed through, as the banks’ sites have remained up and running past the Monday deadline.

[Updated June 29, 2017, 10:20 a.m. MDT]

A host of companies across industries have confirmed attacks today by a brutal wave of ransomware, including global law firm DLA Piper, U.S. pharmaceutical giant Merck, and the Danish shipping company Maersk. Although targets originally appeared in Ukraine—shutting down power plants, banking services and supermarkets—this latest cyberattack has quickly spanned critical economic sectors around the globe.

Webroot customers are protected against this variant. This cyberattack was first seen by our threat research team at roughly 10:00 a.m. UTC on June 27, 2017.

What we know

Webroot’s threat researchers have confirmed that this ransomware is a variant of an older attack dubbed Petya, except this time the attack uses EternalBlue to target Windows systems—the same exploit behind the infamous WannaCry attack. While this variant appears to be an upgraded version of Petya, there is no confirmation that this attack is from the same author.

This variant mirrors Petya in that it encrypts the Master File Table (MFT) by overwriting the bootloader code, though unlike previous versions, it encrypts files based on file extension. The system fails to boot as usual and the end user instead sees a screen that appears similar to DOS and demands payment. The shot below depicts the preparation of the EternalBlue triggering packet.

This is the same attack vector that made WannaCry so effective, but we have also observed additional techniques used to infect more machines.

Here we can see that the worm is also utilizing WMI (Windows Management Instrumentation) in a technique to further reach through the network using credentials siphoned from the local machine.

Once the machine is infected, the computer will immediately restart to what looks like a ‘chkdsk,’ but isn’t. Below is an image from Ukrainian Prime Minister Pavlo Rozenko’s Facebook showing the world what the ransomware looks like while it encrypted his computer during this fake chkdsk stage.

Vice Prime Minister of Ukraine, Павло Розенко (Pavlo Rozenko) on Facebook. This is what Petya looks like when it’s encrypting your drive. pic.twitter.com/RgPtfuWK7p

— Mikko Hypponen (@mikko) June 27, 2017

This stage is the ransomware encrypting files on your hard drive. We found that the ransomware doesn’t encrypt the entirety of your files with matching extensions, but instead encrypts up to the first mebibyte of data. This is done presumably to save time during the encryption process, but also ensures that enough of the file is encrypted to be unlikely to restore without paying the ransom.

Once the fake chkdsk is complete (or all the files on the computer are encrypted) the infection will reboot the computer once more to this screen:

There is no way for a victim to retrieve their files other than to email the cybercriminal after paying the bitcoin address listed in the ransom. In fact, the email address listed in the ransom has, as of now, been shut down by the email provider. Essentially, this means victims are unable to get their files back, even after paying the ransom, as the payload author is now prevented from checking this email.

It now seems the attack’s intended effect was not to generate ransom payments at all. In a detailed post on the Microsoft Malware Protection Center blog, the initial route of infection was revealed to be a malicious update to tax accounting software deployed by the Ukrainian company M.E.Doc.

Given the initial attack vector and level of sophistication, the underlying motive appears to be aimed at wreaking the maximum amount of disruption in Ukrainian infrastructure, while merely operating under the guise of ransomware. This suspicion is supported by the absence of a payment portal or functional email address to deliver the ransom payment.

Why it matters

The bottom line is that companies are still failing to adequately secure their IT systems from the EternalBlue vulnerability in the Windows Server Message Block (SMB) server.

Microsoft issued critical security updates to patch this vulnerability on March 14, 2017. To verify that the MS17-010 patch is installed, follow the directions in this Microsoft support article.

If you’d like to learn more about this Petya-based attack, catch the replay of my webinar: Deep Dive into Petya-based & WannaCry Ransomware Attacks.

An interesting tidbit

Our threat researchers have determined that this infection includes a check to see if a file named “perfc” or “perfc.dat” exists in the Windows root directory before executing (a kill switch of sorts). Of course, the best “kill switch” is to perform updates that patch known vulnerabilities such as EternalBlue.

The Cyber News Rundown brings you the latest happenings in cyber news weekly. Who am I? I’m Connor Madsen, a Webroot Threat Research Analyst, and a guy with a passion for all things security. Any more questions? Just ask.

WannaCry Shuts Down Honda Production Plant

Over the last few days, Honda officials have discovered a recurrence of WannaCry across multiple machines around the globe. This reinfection was enough to force the temporary closure of their Sayama plant in Japan. While Honda did implement several patches to ward off the initial attack in May, their efforts may not have been thorough enough, leading to their current predicament. Fortunately, the plant was able to reopen a day later, after the systems had been fully updated and cleaned.

Web Host Pays Out $1 Million Ransom

A South Korea-based web hosting service was recently hit with a Linux variant of Erebus ransomware, which affected over 150 unique servers for thousands of different business clients. While Linux systems haven’t traditionally been desirable targets for ransomware, attacks like this one are steadily increasing as more Linux exploits are discovered. Faced with the prospect of overwhelming fallout, the owner of the hosting company chose to pay the ransom, after negotiating with the attackers for a smaller sum.

NSA Malware Installing Cryptocurrency Miners

As further effects of the NSA leak continue to surface, one NSA hacking tool in particular is being used again as a backdoor to allow remote file execution on infected machines and install a cryptocurrency miner. In addition to using DOUBLEPULSAR—a backdoor that was also used in WannaCry attacks in May—to infect the machine, the Trojan also does a check for CPU usage to determine if the computer is suitable for mining Monero, a newer cryptocurrency that has been gaining market strength.

Mac® Computers Becoming Focal Point for Attackers

As more high-level employees use Macs for their daily operations, cybercriminals have more reasons to focus on Apple products when looking for valuable data to steal. By using service-based malware campaigns, criminals can now target entire networks of systems, rather than individual computers, giving them greater reward for less effort. Fortunately for Mac users, the same security rules for PC still apply: run the latest security updates, always back up your important files, and use some form of third-party security software to cover the remaining attack vectors.

WannaCry Found on Australian Traffic Cameras

In the past week, officials have discovered at least 55 traffic cameras in Victoria, Australia were compromised with WannaCry ransomware after being connected to an infected USB drive. While the cameras have continued to function normally, traffic officials are still monitoring the system to ensure no incorrect traffic citations are issued due to the camera tampering.

Popular third-party chat platforms like Slack, Discord, and Telegram are just a few of the many new productivity applications that are being hijacked by cybercriminals to create command-and-control (C&C) communications infrastructures for their malware campaigns. As corporate security teams become more aware of traditional malware threats and deploy new security solutions to defend against them, cybercriminals continue to innovate. Now they’ve turned to well-known chat and social media applications as platforms to communicate with their deployed malware.

Hiding in Plain Sight

The appeal of these chat programs for cybercriminals is born from the fact that many of them are free, easy to use, and incorporate application programming interface (API) components that simplify connections between the programs and custom-built applications. It’s this use of APIs that allows hackers to operate undetected on corporate networks. This clever technique enables hackers to entrench their access by camouflaging themselves with normal data flows. Plus, because this malware leverages software platforms and services that are readily available (and free), all hackers need to do in order to stay connected to their growing malware bot farm is set up an account on their chat platform of choice.

Granted, not all software using APIs is susceptible to this type of attack. However, these attacks are a clear demonstration that tools used by project management and software development teams can be compromised in ways that expose their organizations to significant risk. I predict that similar vulnerabilities in productivity services and applications used by corporate technology teams will continue to be exploited—at an even greater rate. In many ways, these attacks mirror what we’ve seen recently targeting core protocols that operate on the Internet.

Know Your Enemy

Luckily, knowing the enemy is half the battle. With this in mind, we can manage these types of threats, and some of the steps I recommend come down to basic cyber hygiene. I highly recommend security professionals deploy an antivirus solution that incorporates anti-malware and firewall services to all endpoints. A solid threat-intelligence service is also vital to educate security staff and business stakeholders on the current threats and threat actors targeting their business.

One final point: it’s a good idea to screen all outbound network traffic in order to verify that it’s going to legitimate destinations. Hopefully, you’ve already deployed these recommended security controls. If you are missing one or more of these elements, it’s time to shore up your cybersecurity efforts to protect yourself and your organization.