Category: Securitybreaches

Current Attacks Massive 1.6Mil unique addresses found hacked by “GoldBrute”

Internet Storm Center discusses an attack by the ‘GoldBrute’ botnet

They found 1.5mil servers being used by the botnet.

This means that a weakness in Microsoft (CVE-2019-0708)  May 14 Customer Guidance page:

Specifically:  CVE-2019-0708

A remote code execution vulnerability exists in Remote Desktop Services – formerly known as Terminal Services – when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests. This vulnerability is pre-authentication and requires no user interaction. An attacker who successfully exploited this vulnerability could execute arbitrary code on the target system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

To exploit this vulnerability, an attacker would need to send a specially crafted request to the target systems Remote Desktop Service via RDP.

So it seems GoldBrute is taking advantage of this Microsoft weakness to infect machines that have not been patched.  especially the older systems (with Windows7 and Windows Server 2008) You can solve this by downloading the patch and updating as soon as possible.

The other solution is to Disable Remote  Desktop Services  (as per https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708)

A workaround is also possible:

The following workarounds may be helpful in your situation. In all cases, Microsoft strongly recommends that you install the updates for this vulnerability as soon as possible even if you plan to leave these workarounds in place:

1. Enable Network Level Authentication (NLA) on systems running supported editions of Windows 7, Windows Server 2008, and Windows Server 2008 R2

You can enable Network Level Authentication to block unauthenticated attackers from exploiting this vulnerability. With NLA turned on, an attacker would first need to authenticate to Remote Desktop Services using a valid account on the target system before the attacker could exploit the vulnerability.

2. Block TCP port 3389 at the enterprise perimeter firewall.

 

Contact Us to discuss this latest possible attack and re-mediate your #cybersecurity risks

We are Never Going to Be Secure

I did not have to put 100% in the headline: i.e. “We are never going to be 100% Secure”

Whenever there is a device that is to be used for your purposes,  someone can find a way to use that purpose against you and fight you with it.

So it is my assertion: Do not state “We are secure”!, say “we are  ‘secure’  within our abilities and budget”.

The problem is that some tasks are so basic it is unbelievable when an attack is successful.  take a look at this informational message from a WordPress security company(Wordfence):

(and in text form):
XSS Vulnerability in Abandoned Cart Plugin Leads To WordPress Site Takeovers

Last month, a stored cross-site scripting (XSS)h, Vulnerabilities, WordPress Security on March 11, 2019 by Mikey Veenstra   0 Replies flaw was patched in version 5.2.0 of the popular WordPress “plugin Abandoned Cart Lite For WooCommerce”. The plugin, which we’ll be referring to by its slug woocommerce-abandoned-cart, allows the owners of WooCommerce sites to track abandoned shopping carts in order to recover those sales. A lack of sanitation on both input and output allows attackers to inject malicious JavaScript payloads into various data fields, which will execute when a logged-in user with administrator privileges views the list of abandoned carts from their WordPress dashboard.

 

 

So essentially what wordfence is suggestingwordfence is suggesting is to update WooCommerceAbandoned cart  Cart Lite for WooCommerce.

Wordfence is suggesting to update the plugin ASAP to 5.2.0 or higher to solve the sanitization checks that a bug introduced.

 

So now that we know a specific problem with a specific plugin, all we have to do is update. But this basic act of updating is not that easy sometimes.

This is typical of software and our security dilemma,  a new vulnerability is discovered, has to be fixed and patched/released. Then of course the administrators have to install the patch.

So this is why we will never be 100% secure there will always be a time when the vulnerability is discovered to the time it a patch is installed  when  we are not secure.

I wrote about this before(Dec 2017): From Vulnerability Found , to patched safe

The above image describes the journey from Vulnerability found to Patched better than

What are the  possible problems when patches are not applied? and hackers do their work first?

Here is a worst case scenario:

Onlineathens.com has the story of the  Ryunk Ransomware

Here is a notable quote:

Jackson County Sheriff Janis Mangum said Friday that experts are still cleaning their computers.

“We can book someone (in jail) without doing it on paper, but deputies are still doing paper reports,” she said.

Mangum said she received a telephone call last Saturday from the Information Technology staff “wanting to know if we had an FBI contact they could reach. That’s when I knew it was more serious than just being down,” she said.

This article does not go into the forensics investigation of how the ransomware software installed itself, and we will keep an eye out to the Internet as to how exactly this started.

But very likely something was not patched, the hacker software installed and then went from there to control the data and all the devices on the network it can.

Even if the initial infestation was unique (social engineering ) the additional attacks of infesting the rest of the computers usually requires some additional vulnerability which also can take advantage of unpatched devices.

The weaker you are with patching the more likely you will be attacked and hacked. In this case (Sheriffs computers in court house) somehow were infested and then later the encryption software download happened. After that the software tries to propagate and destroy the rest of the systems on the network.

Also an Auditor reviewing your patching is also advisable.

There are no guarantees, although one can reduce risk with enough safeguards and testing in place.

Like we can do  CISA certified contact us.

Hacking, is it Like a Recipe?

One thing we do know that Hackers are very successful in hacking overall. We don’t really know how they do it? But the headlines say it all: “Yahoo says 500 Million Accounts Stolen”

If you study the image above (a bubble representation of all hacked entities) from the website www.informationisbeautiful.net

You see Yahoo actually with 320 million and River City Media with 1.37 Billion  hacked accounts. Each bubble has a story, with a breach and people affected by the hackers attacking some aspect of the information technology defense.

So how easy is it for hackers to attack ? Is it a recipe? Do you perform a few functions and then steal the data?

I have blogged this methodology for 3 years now, and it is interesting that in 3 years plus with various explanations the methods of hackers has not changed too much.

(image from previous post)

We can summarize and say the hackers review the job (attack) and try to find an opening to perform their objectives:

  1. Money
  2. Political reasons
  3. The fun of it (young hackers)
  4. National goals

After they review the attacks by looking at your defenses they are now ready to probe your specific defense with specific attacks.

In my mind the #1 reason for hackers to attack is money and the Darknet tells the story, the Darknet is where the criminal hackers trying to make money sell their gains.

If you ask me the credit card problems we have gotten due to the new normal of these “hacking events” is annoying but not life changing for the most part.

What would be LIFE changing is the hacking and stealing data (information) of health records. Now the hackers could really mess with other aspects of our lives which we are not used to modifications.

How exactly would a “screwed up” health record look? The next time your doctor looks at health records are they doctored? Or not?

Every day there is a new day and the hackers are looking for new ways to make money including using the massive amount of health data already stolen.

This means we need to be wary of our information usage and review all manners of defenses everywhere.

Test, test, test your defense should be the mantra. Because the hackers are probing and attacking all the time. It is a classic red vs blue issue.

Contact Us to review your defenses

 

Sure Connect ABC device to Internet!!??

Sure Connect ABC device to Internet!!??

Amazing to note that many companies are creating devices to connect to the Internet and thus open these devices up to a variety of attacks.

Note the following Blog MWR Labs 

The default root password has been disclosed by Packetstorm last year January 12th, 2016.

Login to telnet with the credentials: root / founder88

Did you read that correctly?  Yes last year.

This Biometric hardware by Fingertec does not operate like a traditional machine, it is ‘updated’ and gets it’s intelligence from the ‘cloud’. Which means it is on the Internet.

This means that you are exposing this device to the hackers and wily operators of the world.

The problem we have is managers that make decisions to purchase and install these devices are not thinking about security at all.

In fact due to their preconceived notions of it will not happen to us, we are too small, we have nothing to steal, and more excuses, Cybersecurity is not thought about.

They do not understand the implications of clear text tcp/ip communications by Fingertec. To a seasoned hacker (security professional) the device will take a little effort but can be breached rather quickly. Especially if basic precautions are not kept, like changing default passwords.

PCI compliance requires default passwords to be changed, but do we really have to wait for PCI compliance to require the biometric devices to have encrypted communications over the Internet

What if you have Biometric devices? are they connected to the Internet? Maybe they are vulnerable.


Contact US to help you with vulnerability analysis

New DDOS Attacks Changes Likelihood in Risk Assessments

The hacker must have a method in starting an attack like Dynamic Denial of Service (DDOS). in the last few days. the one which used hacked cameras and DVRs (Brian Krebs story) in attacking many Internet properties.

l3outage-580x330

 

Im sure you have seen the many media stories about this DDOS attack on various media (including Computerworld)

chinesefirmsbehindddosattack

Moneyquote from Computerworld article: Hangzhou Xiongmai Technology, a vendor behind DVRs and internet-connected cameras, said on Sunday that security vulnerabilities involving weak default passwords in its products were partly to blame.”

The hackers used the weak default passwords of these devices (cameras and DVRs – IoTs) to create a program that controlled many of these devices to then create an attack using the simplest method of all – just ask for a connection.

Asking for a connection might be innocuous but when a hundred thousand devices do it then it becomes a traffic jam. And pretty soon it is not a regular traffic jam, but the monster trucker traffic jam.

We have discussed this IoT powder keg before in our “Hidden hacks in Network”  Also “IoT Botnet can DDOS Your Webserver”

 

ddos-reflectorattacks1

What does this new DDOS attack mean for the foreseeable future?

we have to figure out Risk in our compliance-IT departments.

Risk assessment:

Risk = Impact * Likelihood

The interesting thing of  security is that Likelihood can change with the latest occurrences  in the world.

So now all of our Risk calculations are changed.

riskanalysis

In the past many vulnerabilities are downplayed when they consist of some kind of DOS (Denial of Service)

As usual this means that it depends on your impact from a DOS event. If you are using a webserver to accept sales orders and you are getting attacked by these DOS events your Risk has now increased.

What can you do? It may be hard to differentiate the traffic from standard traffic, but that is what we would have to do. Figure out what this malware does and filter the traffic.  Here is where you have to have competent Network Operations Center (NOC)  . The source code to the Mirai malware which was purported to be behind the DDOS attacks  was placed up on GitHub (by James Gallagher) and looks to be still there https://github.com/James-Gallagher/Mirai

What if there is no major impact because there are no sales on the web(Internet)  then there would be no appreciable affect BUT

As Amazon, Twitter and other Internet properties had problems due to the nature of the DDOS as it affected DNS servers providing addresses to the general public.

This particular attack was an indirect attack, as your own servers were not targeted only DNS servers which may or may not have translated  your name to IP addresses across the world. So ‘it depends’ on whether you would have an impact or not.  One thing is for sure if you are creating IoT devices and have lax security default passwords and the like which are vulnerable to these types of attacks, in the future you may be liable  for any damages.

In any case this is a great example for re-evaluating your Internet exposure and updating your risk analysis.

Contact Us to discuss.