Tag Archives: Department

Lazarus Group hacker charged in Wannacry, Sony attacks

The Department of Justice has officially charged one member of the North Korean Lazarus Group for his role in the Wannacry attacks, the Sony Pictures breach, theft on the SWIFT banking system and more.

Nathan Shields, special agent for the FBI, filed an affidavit of complaint against the Lazarus Group hacker, Park Jin Hyok, on June 8, 2018, but the charges were made public Sept. 6.

Park was charged with conspiring to commit “unauthorized access to computer and obtaining information, with intent to defraud, and causing damage, and extortion related to computer intrusion” and wire fraud.

“The evidence set forth herein was obtained from multiple sources, including from analyzing compromised victim systems, approximately 100 search warrants for approximately 1,000 email and social media accounts accessed internationally by the subjects of the investigation, dozens of orders issued … and approximately 85 formal requests for evidence to foreign countries and additional requests for evidence and information to foreign investigating agencies,” Shields wrote in the affidavit.

Shields wrote that the affidavit was “made in support of a criminal complaint against, and arrest warrant” for Park, but there is no indication the DoJ knows where Park is currently located. The last mention in the affidavit noted Park returned to North Korea in 2014 after spending three years working for North Korean company Chosun Expo in China.

Although Park was the lone Lazarus Group hacker named in the filing, the entire North Korean team was implicated in the 2014 Sony Pictures breach, the 2016 theft of $81 million from Bangladesh Bank via the SWIFT network, the 2017 Wannacry ransomware attack as well as “numerous other attacks or intrusions on the entertainment, financial services, defense, technology and virtual currency industries, as well as academia and electric utilities.”

“In 2016 and 2017, the conspiracy targeted a number of U.S. defense contractors, including Lockheed Martin, with spear-phishing emails. The spear-phishing emails sent to the defense contractors were often sent from email accounts that purported to be from recruiters at competing defense contractors, and some of the malicious messages made reference to the Terminal High Altitude Area Defense (THAAD) missile defense system deployed in South Korea,” the U.S. Attorney’s Office for the Central District of California wrote in its  press release. “The attempts to infiltrate the computer systems of Lockheed Martin, the prime contractor for the THAAD missile system, were not successful.”

Confirmation of North Korean involvement

Park is the first Lazarus Group hacker named and officially charged by the U.S. government, but the Lazarus Group and North Korea has been connected to attacks before.

As far back as Dec. 2014, the FBI stated there was enough evidence to conclude that North Korea was behind the attack on Sony Pictures. And, in Dec. 2017 both the U.S. and U.K. governments blamed the Wannacry attacks on North Korea.

The affidavit detailed the use of the Brambul worm, which was malware attributed to the Lazarus Group in a US-CERT security alert issued by the FBI and Department of Homeland Security in May 2018.

However, while the confirmation of North Korean involvement was generally praised by experts, not all were happy that Park was the only Lazarus Group hacker to be named and charged.

Jake Williams, founder and CEO of Rendition Infosec, based in Atlanta, wrote on Twitter that it was a “human rights issue” to charge Park because the Lazarus Group hacker “likely had zero choice in his actions.”

DHS details electrical grid attacks by Russian agents

The Department of Homeland Security has offered more details on electrical grid attacks by Russian agents, and experts said the details show how air-gapping isn’t as secure as some may think.

In a briefing on Monday, DHS officials expanded on details of electrical grid attacks by Russian groups like Dragonfly 2.0. The briefing was the first time DHS released this amount of information in an unclassified setting, according to a report by The Wall Street Journal.

DHS said Russian hackers first targeted key industrial control vendors in order to steal credentials and access air-gapped and isolated utility networks. DHS also expanded the scope of the electrical grid attacks, saying there were “hundreds of victims,” although it is unclear if “victims” in this case refers to systems, substations, or utilities and vendors combined. Attackers reportedly stole confidential information about the utilities to learn how the industrial control systems (ICS) work and DHS said they had enough access to “throw switches.”

Ray DeMeo, COO and co-founder of Virsec, noted that “relying on air-gapping for security is a dangerous anachronism.”

Air gaps are easily being bridged by social engineering, password theft, or, in the case of Stuxnet, a few rogue USBs left in Tehran coffee houses. With the increasing convergence of IT and OT systems, the control systems that manage critical infrastructure are increasingly networked and connected,” DeMeo wrote via email. “Plus, conventional security tools that rely on signatures must be connected in order to get the latest updates. Almost all of the recent attacks, successful attacks on power plants and other critical infrastructure have bypassed air gaps.”

Rohyt Belani, CEO and co-founder of Cofense, said even with isolation electrical grid attacks are still possible.

“Even though SCADA networks and other critical infrastructure may be segmented, there are always legitimate remote access systems in place from where administrators of those systems can log in and control them,” Belani wrote via email. “Attackers often gain their initial foothold in a corporate network via spear phishing and then move laterally to identify such key systems, which they then attempt to compromise to further their sphere of influence into critical systems.”

Michael Magrath, director of global regulations and standards at OneSpan Inc., said these electrical grid attacks, like other hacks “exploit the weakest link in the security chain — the people.” Magrath was also concerned about part of The Wall Street Journal report that claimed DHS was investigating if Russian hackers had ways to defeat multifactor authentication.

“To be clear, multifactor authentication is not ‘one size fits all.’ There are numerous approaches and technologies available with varying degrees of security and usability. For example, one-time passwords transmitted via SMS are very convenient and widely deployed. However, this multifactor authentication approach has been proven to be unsecure with [one-time passwords] being intercepted,” Magrath wrote via email. “Other solutions such as fingerprint biometrics, adaptive authentication, and utilizing public key cryptography techniques are far more secure and have gained widespread adoption. It remains to be seen what DHS learns.” 

DHS claimed it has been warning utilities about potential attacks since 2014. Joseph Kucic, CSO at Cavirin, said via email the utilities “have failed to implement the necessary changes so DHS went public to embarrass the utilities into taking the needed actions (timing was on the DHS side with all the Russia media attention).” 

David Vergara, head of security product marketing at OneSpan Inc., said “this is big game hunting for cybercriminals.”

“The motivation may pivot between political and monetization, but the impact to the target is the same, terror through vulnerability and exposure,” Vergara wrote via email. “It’s not difficult to extrapolate the outcome when an entire power grid goes offline during peak hours and the attack follows the weakest link, unsophisticated utility vendors or third parties.”

Potential damage of electrical grid attacks

It was unclear from the DHS report what the extent of damage these electrical grid attacks could be.

Katherine Gronberg, vice president of government affairs at ForeScout Technologies, said in the past, electrical grid attacks were “ostensibly motivated by money, business disruption, hacktivism or espionage.”

“Now, we are facing a very real and targeted threat to U.S. national security. A successful attack on systems such as power plants, dams or the electric grid could have severe repercussions and could possibly lead to the loss of human life and disruption of society,” Gronberg wrote via email. “With so much on the line, securing critical infrastructure must be top of mind. Recent efforts by the DHS, DOE and key congressional committees suggest that it is. But we have to tackle this problem as the shared responsibility it is. It likely will entail some difficult decisions at all levels, from policymakers to power producers to consumers.”

Andrea Carcano, co-founder and CPO of Nozomi Networks, noted that since the electrical grid attacks reported by DHS didn’t result in blackouts, it raises the “question if the attackers intentionally only went so far.”

“Attacks on the grid will be difficult to control and will undoubtedly lead to lots of collateral damage. This, combined with the risk of retaliation, may be keeping attackers at bay,” Carcano wrote via email. “It is reminiscent of the mutually assured destruction model of the Cold War when restraint was used on all sides. We are likely in the midst of a Cyber Cold War with all sides holding back from enacting the destruction they are truly capable of.”

Healthcare APIs get a new trial run for Medicare claims

In the ongoing battle to make healthcare data ubiquitous, the U.S. Digital Service for the Department of Health and Human Services has developed a new API, Blue Button 2.0, aimed at sharing Medicare claims information.

Blue Button 2.0 is part of an API-first strategy within HHS’ Centers for Medicare and Medicaid Services, and it comes at a time when a number of major companies, including Apple, have embraced the potential of healthcare APIs. APIs are the building blocks of applications and make it easier for developers to create software that can easily share information in a standardized way. Like Apple’s Health Records API, Blue Button 2.0 is based on a widely accepted healthcare API standard known as Fast Healthcare Interoperability Resources, or FHIR

Blue Button 2.0 is the API gateway to 53 million Medicare beneficiaries, including comprehensive part A, B and D data. “We’re starting to recognize that claims data has value in understanding the places a person has been in the healthcare ecosystem,” said Shannon Sartin, executive director of the U.S. Digital Service at HHS.

“But the problem is, how do you take a document that is mostly codes with very high-level information that’s not digestible and make it useful for a nonhealth-savvy individual? You want a third-party app to add value to that information,” Sartin said.

So, her team was asked to work on this problem. And out of their work, Blue Button 2.0 was born.

More than 500 developers have signed on

To date, over 500 developers are working with the new API to develop applications that bring claims data to consumers, providers, hospitals and, ultimately, into an EHR, Sartin said. But while there is a lot of interest, Sartin said this is just the first step when it comes to healthcare APIs.

“The government does not build products super well, and it does not do the marketing engagement necessary to get someone interested in using it,” she said. “We’re taking a different approach, acting as evangelists, and we’re spending time growing the community.”

And while a large number of developers are experimenting with Blue Button 2.0, Sartin’s group will be heavily vetting to eventually get to a much smaller number that will release applications due to privacy concerns around the claims data.

Looking for a user-friendly approach

We’re … acting as evangelists, and we’re spending time growing the community.
Shannon Sartinexecutive director of the U.S. Digital Service at HHS

In theory, the applications will make it easier for a Medicare consumer to let third parties access their claims information and then, in turn, make that data meaningful and actionable. But Arielle Trzcinski, senior analyst serving application development and delivery at Forrester Research, said she is concerned Blue Button 2.0 isn’t pushing the efforts around healthcare APIs far enough.

“Claims information is not the full picture,” she said. “If we’re truly making EHR records portable and something the consumer can own, you have to have beneficiaries download their medical information. That’s great, but how are they going to share it? What’s interesting about the Apple effort as a consumer is that you’re able to share that information with another provider. And it’s easy, because it’s all on your phone. I haven’t seen from Medicare yet how they might do it in the same user-friendly way.”

Sartin acknowledged Blue Button 2.0 takes aim at just a part of the bigger problem.

“My team is focused just on CMS and healthcare in a very narrow way. We recognize there are broader data and healthcare issues,” she said.

But when it comes to the world of healthcare APIs, it’s important to take that first step. And it’s also important to remember the complexity of the job ahead, something Sartin said her team — top-notch developers from private industry who chose government service to help — realized after they jumped in to the world of healthcare APIs. 

“We have engineers who’ve not worked in healthcare who thought the FHIR standard was overly complex,” she said. “But when you start to dig in to the complexity of health data, you recognize sharing health data with each doctor means something different. This is not as seamless as with banks that can standardize on numbers. There, a one is a one. But in health terminology, a one can mean 10 different things. You can’t normalize it. Having an outside perspective forces the health community to question it all.”

Russian intelligence officers indicted for DNC hack

The Department of Justice announced Friday the indictment of 12 members of Russia’s GRU intelligence agency in relation to the 2016 breaches of the Democratic National Committee and Hillary Clinton’s presidential campaign.

The grand jury indictment, which is part of Special Counsel Robert Mueller’s investigation into Russian interference with the 2016 presidential election, claimed the 12 intelligence officers were engaged in a “sustained effort” to hack into the Democratic National Committee (DNC), the Democratic Congressional Campaign Committee (DCCC) and the Clinton campaign. The DNC hack led to confidential emails becoming public via WikiLeaks, which negatively impacted the Clinton campaign and Democratic Party.

The grand jury indictment alleged the Russian intelligence officers, operating under the online personas “DCLeaks” and “Guccifer 2.0,” leaked information through another entity known as “Organization 1.” The indictment does not mention WikiLeaks by name.

The Justice Department claimed that in 2016, members of Unit 26165 in the Russian government’s Main Intelligence Directorate (GRU) began spearphishing campaign officials and volunteers for Clinton’s presidential campaign; intelligence officers were able to steal usernames and passwords and use those credentials to obtain confidential emails and compromise other systems. The threat actors used similar techniques in the DNC hack as well as the breach of the DCCC’s network.

In addition, the Justice Department claimed Unit 26165, with members of the GRU’s Unit 74455, conspired to release the stolen emails and data in order to influence the election. According to the Department of Justice, Unit 74455 also “conspired to hack into the computers of state boards of elections, secretaries of state, and US companies that supplied software and other technology related to the administration of elections to steal voter data stored on those computers.”

The indictment accused the following individuals of being part of Unit 26165 and Unit 74455, and engaging in the DNC hack and other malicious activity: Viktor Borisovich Netyksho, Boris Alekseyevich Antonov, Dmitriy Sergeyevich Badin, Ivan Sergeyevich Yermakov, Aleksey Viktorovich Lukashev,  Sergey Aleksandrovich Morgachev, Nikolay Yuryevich Kozachek, Pavel Vyacheslavovich Yershov, Artem Andreyevich Malyshev, Aleksandr Vladimirovich Osadchuk, Aleksey Aleksandrovich Potemkin and Anatoliy Sergeyevich Kovalev.

The 12 GRU officers are accused of 11 criminal counts, including criminal conspiracy against the United States “through cyber operations by the GRU that involved the staged release of stolen documents for the purpose of interfering with the 2016 president election”; aggravated identity theft; conspiracy to launder money; and criminal conspiracy for attempting to hack into certain state boards of elections, secretaries of state, and vendors of U.S. election equipment and software.

The Justice Department emphasized there is “no allegation in the indictment that the charged conduct altered the vote count or changed the outcome of the 2016 election,” and no allegation that any American was a knowing participant in the alleged criminal activity.

DHS, SecureLogix develop TDoS attack defense

The U.S. Department of Homeland Security has partnered with security firm SecureLogix to develop technology to defend against telephony denial-of-service attacks, which remain a significant threat to emergency call centers, banks, schools and hospitals.

The DHS Science and Technology (S&T) Directorate said this week the office and SecureLogix were making “rapid progress” in developing defenses against call spoofing and robocalls — two techniques used by criminals in launching telephony denial-of-service (TDoS) attacks to extort money. Ultimately, the S&T’s goal is to “shift the advantage from TDoS attackers to network administrators.”

To that end, S&T and SecureLogix, based in San Antonio, are developing two TDoS attack defenses. First is a mechanism for identifying the voice recording used in call spoofing, followed by a means to separate legitimate emergency calls from robocalls.

“Several corporations, including many banks and DHS components, have expressed interest in this technology, and SecureLogix will release it into the market in the coming months,” William Bryan, interim undersecretary for S&T at DHS, said in a statement.

In 2017, S&T handed SecureLogix a $100,000 research award to develop anticall-spoofing technology. The company was one of a dozen small tech firms that received similar amounts from S&T to create a variety of security applications.

Filtering out TDoS attack calls

SecureLogix’s technology analyzes and assigns a threat score to each incoming call in real time. Calls with a high score are either terminated or redirected to a lower-priority queue or a third-party call management service.

SecureLogix built its prototype on existing voice security technologies, so it can be deployed in complex voice networks, according to S&T. It also contains a business rules management system and a machine learning engine “that can be extended easily, with limited software modifications.”

Over the last year, SecureLogix deployed the prototype within a customer facility, a cloud environment and a service provider network. The vendor also worked with a 911 emergency call center and large financial institutions.

In March 2013, a large-scale TDoS attack highlighted the threat against the telephone systems of public-sector agencies. An alert issued by DHS and the FBI said extortionists had launched dozens of attacks against the administrative telephone lines of air ambulance and ambulance organizations, hospitals and financial institutions.

Today, the need for TDoS protection has grown from on premises to the cloud, where an increasing number of companies and call centers are signing up for unified communications as a service. In 2017, nearly half of organizations surveyed by Nemertes Research were using or planned to use cloud-based UC.

Accused CIA leaker charged with stealing government property

The Department of Justice has formally charged the suspected CIA leaker with stealing government property and more in connection with the theft and transmission of national defense information.

The accused CIA leaker, Joshua Adam Schulte, has been in the custody of law enforcement since August 2017 when he was charged with possessing child pornography; the FBI reportedly thought it had enough evidence to charge him with stealing and leaking the Vault 7 files to WikiLeaks as early as January. Government prosecutors said in mid-May that there was a new indictment set to be filed and that superseding indictment was filed on Monday, June 18, by the U.S. Attorney’s Office for the Southern District of New York.

The new indictment lists 13 charges against Schulte, including charges of illegally gathering and transmitting national defense information, theft of government property, unauthorized access of a computer to obtain information from a government agency and obstruction of justice, in addition to three charges related to child pornography.

Manhattan U.S. Attorney Geoffrey S. Berman wrote in a public statement that the accused CIA leaker, Schulte, was a former employee of the CIA and “allegedly used his access at the agency to transmit classified material to an outside organization.”

“We and our law enforcement partners are committed to protecting national security information and ensuring that those trusted to handle it honor their important responsibilities,” Berman wrote. “Unlawful disclosure of classified intelligence can pose a grave threat to our national security, potentially endangering the safety of Americans.”

The Vault 7 data provided to WikiLeaks by a CIA leaker included close to 9,000 documents, including hacking tools and zero-day exploits for iOS, Android, Windows and more. The CIA has never admitted that the Vault 7 data was its own and the indictment itself does not refer to the stolen data being from the CIA.

However, the press release from the DOJ did write: “On March 7, 2017, Organization-1 released on the Internet classified national defense material belonging to the CIA (the “Classified Information”). In 2016, SCHULTE, who was then employed by the CIA, stole the Classified Information from a computer network at the CIA and later transmitted it to Organization-1. SCHULTE also intentionally caused damage without authorization to a CIA computer system by granting himself unauthorized access to the system, deleting records of his activities, and denying others access to the system. SCHULTE subsequently made material false statements to FBI agents concerning his conduct at the CIA.”

FBI fights business email compromise with global crackdown

The United States Department of Justice this week announced the arrests of 74 individuals alleged to have committed fraud by participating in business-email-compromise scams.

The arrests are the result of an international enforcement effort, coordinated by the FBI, known as Operation Wire Wire, which was designed to crack down on email-account-compromise schemes targeting individuals and businesses of all sizes.

Business email compromise (BEC) is a growing problem, accounting for the highest reported losses, according to the FBI’s “2017 Internet Crime Report.” Criminal organizations use social engineering to identify employees who are authorized to make financial transactions, and then send fraudulent emails from company executives or foreign suppliers requesting wire transfers of funds.

Some schemes are directed at individuals in human resources or other departments in an effort to collect personally identifiable information, such as employee tax records. Others target individual victims, especially those involved in real estate transactions and the elderly.

In January, according to the Department of Justice, the U.S. federal agencies worked with international law enforcement on Operation Wire Wire to find and prosecute alleged fraudsters. The six-month coordinated effort involved the U.S. Department of Homeland Security, the U.S. Department of the Treasury and the U.S. Postal Inspection Service, and it resulted in 42 arrests in the United States, 29 in Nigeria and three in Canada, Mauritius and Poland. Law enforcement recovered $14 million in financial wire fraud during the operation, and they seized close to $2.4 million.

‘Nigerian princes’ turn to BEC

The techniques and tactics of Nigerian criminal organizations have become more sophisticated, according to Agari Data Inc. The email security company captured and analyzed the contents of 78 email accounts associated with 10 criminal organizations — nine in Nigeria — and reported increased BEC activities against North American companies and individuals between 2016 and 2018.

The research involved 59,692 unique messages in email communications originating from 2009 to 2017. According to the findings, business email compromise represented the largest attack vector for email fraud at 24%, even though many of these criminal groups migrated to BEC attacks, starting in 2016. Previously, these groups had focused predominantly on “romance” fraud schemes.

Business email compromise often overlaps or has similarities with cyberfraud schemes involving romance, lotteries, employment opportunities, vehicle sales and rental scams. In some cases, money mules “hired” using romance schemes or fraudulent employment opportunities may not be aware of the BEC scams. Mules receive the ill-gotten funds stateside and transfer the monies to difficult-to-trace, off-shore accounts set up by criminals.

Since January, up to $1 million in assets has been seized domestically, and 15 alleged money mules have been identified by FBI task forces and charged “for their role in defrauding victims.”

BEC schemes are hard to detect, because they do not rely on victims downloading malicious email attachments or clicking on fake URLs. Instead, this type of cyberfraud uses identity deception — 82%, according to Agari — email spoofing or corrupted email accounts, accessed via malware or credential theft. Researchers found 3.97% of intended targets who responded to the initial emails used in business email compromise became victims.

SS7 vulnerabilities enable breach of major cellular provider

The U.S. Department of Homeland Security warned of an exploit of the Signaling System 7 protocol that may have targeted American cellphone users.

The Washington Post reported that DHS notified Sen. Ron Wyden (D-Ore.) last week that malicious actors “may have exploited” global cellular networks “to target the communications of American citizens.” The letter has not been made public, but The Washington Post obtained a copy of it and reported that it described surveillance systems that exploit Signaling System 7 (SS7) vulnerabilities. According to the report, the exploit enables intelligence agencies and criminal groups to spy on targets using nothing but their cellphone number.

SS7 is the international telecommunications standard used since the 1970s by telecommunications providers to exchange call routing information in order to set up phone connections. Cellphone providers use SS7 to enable users to send and receive calls as they move from network to network anywhere in the world. The protocol has been criticized by analysts and experts for years because of its vulnerabilities and because it enables spying and data interception.

In a different letter to Ajit Pai, chairman of the Federal Communications Commission, Wyden referenced an “SS7 breach” at a major wireless carrier and criticized the FCC for its inaction regarding SS7 vulnerabilities.

“Although the security failures of SS7 have long been known to the FCC, the agency has failed to address the ongoing threat to national security and to the 95% of Americans who have wireless service,” Wyden wrote.

He explained the SS7 vulnerabilities enable attackers to intercept people’s calls and texts, as well as hack into phones to steal financial information or get location data.

“In a prior letter to me, you dismissed my request for the FCC to use its regulatory authority to force the wireless industry to address the SS7 vulnerabilities,” Wyden wrote to Pai. “You cited the work of the [Communications Security, Reliability and Interoperability Council] as evidence that the FCC is addressing the threat. But neither CSRIC nor the FCC have taken meaningful action to protect hundreds of millions of Americans from potential surveillance by hackers and foreign governments.”

In the letter, Wyden included a call to action for Pai to use the FCC’s “regulatory authority” to address the security issues with SS7 and to disclose information about SS7-related breaches to Wyden by July 9, 2018.

In other news:

  • The U.S. government ban on using Kaspersky Lab products was upheld this week, and the security company’s lawsuits were dismissed. U.S. District Judge Colleen Kollar-Kotelly dismissed two lawsuits filed by Kaspersky Lab in response to Binding Operational Directive 17-01 and the National Defense Authorization Act (NDAA), both of which banned the company’s products from use in the federal government. Kaspersky argued the ban was unconstitutional and caused undue harm to the company, but Kollar-Kotelly dismissed the argument and said while there may be “adverse consequences” for Kaspersky, the ban is not unconstitutional. Kaspersky Lab has said it will file an appeal of the ruling.
  • The U.S. House of Representatives advanced a bill that would require law enforcement to get a warrant before collecting data from email providers. The Email Privacy Act was added as an amendment to the NDAA, which is the annual budget for the Department of Defense. The bill passed the House 351-66 and will now move to the Senate for approval. The amendment was authored by Rep. Kevin Yoder (R-Kan.) and is the latest version of the 2016 Email Privacy Act that received unanimous support in the House. If the NDAA passes with this amendment included, it will provide warrant protections to all email, chats and online messages that law enforcement might want or need for investigations. The Electronic Frontier Foundation has been a proponent of email privacy in law, saying, “The emails in your inbox should have the same privacy protections as the papers in your desk.”
  • The private equity investment firm Thoma Bravo is acquiring a majority share in the security company LogRhythm. LogRhythm offers its users a security information and event management platform that also has user and entity behavior analytics features. The company has been in business for 15 years and has more than 2,500 customers worldwide. “LogRhythm believes it has found an ideal partner in Thoma Bravo,” said LogRhythm’s president and CEO, Andy Grolnick, in a statement. “As we seek to take LogRhythm to the next level and extend our position as the market’s preeminent NextGen SIEM vendor, we feel Thoma Bravo’s cybersecurity domain expertise and track record of helping companies drive growth and innovation will make this a powerful and productive relationship.” The deal is expected to close later in 2018. Thoma Bravo owns the certificate authority company DigiCert, which recently purchased Symantec’s CA operations, and has previously invested in other cybersecurity companies, including SonicWall, SailPoint, Hyland Security, Deltek, Blue Coat Systems, Imprivata, Bomgar, Barracuda Networks, Compuware and SolarWinds.

Feds issue new alert on North Korean hacking campaigns

The FBI and the Department of Homeland Security released an alert on Tuesday regarding malware campaigns connected to a North Korean hacking group known as Hidden Cobra.

The alert, which includes indicators of compromise (IOCs) such as IP addresses, attributes two malware families to the North Korean government by way of Hidden Cobra: a remote access tool called Joanap and a worm known as Brambul, which spreads via Windows’ Server Message Block (SMB) protocol. Both malware families were first identified by Symantec in 2015 and were observed targeting South Korean organizations. Other cybersecurity vendors later attributed the two malware campaigns to the nation-state hacking group Hidden Cobra, also known as Lazarus Group.

However, Tuesday’s alert, which was issued by US-CERT, marks the first time U.S. authorities publicly attributed the malware families and their activity to North Korean hacking operations.

“FBI has high confidence that HIDDEN COBRA actors are using the IP addresses — listed in this report’s IOC files — to maintain a presence on victims’ networks and enable network exploitation,” US-CERT said. “DHS and FBI are distributing these IP addresses and other IOCs to enable network defense and reduce exposure to any North Korean government malicious cyber activity.”

The alert also claimed that, “according to reporting of trusted third parties,” Joanap and Brambul have likely been used by the North Korean hacking group since at least 2009 to target organizations in various vertical industries across the globe. The FBI and DHS didn’t identify those trusted parties, but the alert cited a 2016 report, titled “Operation Blockbuster Destructive Malware Report,” from security analytics firm Novetta, which detailed malicious activity conducted by the Lazarus Group.

DHS’ National Cybersecurity and Communications Integration Center conducted an analysis of the two malware families, and the U.S. government discovered 87 network nodes that had been compromised by Joanap and were used as infrastructure by Hidden Cobra. According to the US-CERT alert, those network nodes were located in various countries outside the U.S., including China, Brazil, India, Iran and Saudi Arabia.

The FBI and DHS attribution case for Brambul and Joanap represents the latest evidence connecting the North Korean government to high-profile malicious activity, including the 2014 breach of Sony Pictures. Last December, the White House publicly attributed the WannaCry ransomware attack to the North Korean government; prior to the U.S. government’s accusation, several cybersecurity vendors had also connected the WannaCry source code, which also exploited the SMB protocol, with the Brambul malware.

The US-CERT alert also follows tense, back-and-forth negotiations between President Donald Trump and North Korean leader Kim Jong Un regarding a U.S.-North Korea summit. Last week, Trump announced the U.S. was withdrawing from the summit, but talks have reportedly resumed.

A DHS data breach exposed PII of over 250,000 people

A data breach at the U.S. Department of Homeland Security exposed the personally identifiable information of over 250,000 federal government employees, as well as an unspecified number of people connected with DHS investigations.

DHS released a statement Jan. 3, 2018, that confirmed the exposure of “approximately 246,167” federal government employees who worked directly for DHS in 2014. It also disclosed the breach of a database for the Office of Inspector General that contained the personally identifiable information (PII) of any person — not necessarily employed by the federal government — who was associated with OIG investigations from 2002 to 2014. This includes subjects, witnesses and complainants.

In its statement, the department emphasized the DHS data breach was not caused by a cyberattack and referred to it as a “privacy incident.”

“The privacy incident did not stem from a cyber-attack by external actors, and the evidence indicates that affected individual’s personal information was not the primary target of the unauthorized unauthorized [sic] transfer of data,” DHS said.

The DHS data breach was initially found in May 2017 during a separate, ongoing DHS OIG criminal investigation in which it was discovered that a former DHS employee had an unauthorized copy of the department’s case management system.

However, individuals affected by the DHS data breach weren’t notified until Jan. 3, 2018. In its statement, DHS addressed why the notification process took so long.

“The investigation was complex given its close connection to an ongoing criminal investigation,” the department said. “From May through November 2017, DHS conducted a thorough privacy investigation, extensive forensic analysis of the compromised data, an in-depth assessment of the risk to affected individuals, and comprehensive technical evaluations of the data elements exposed. These steps required close collaboration with law enforcement investigating bodies to ensure the investigation was not compromised.”

The DHS employee data breach exposed PII that included names, Social Security numbers, dates of birth, positions, grades and duty stations of DHS employees; the DHS investigative data breach exposed names, Social Security numbers, dates of birth, alien registration numbers, email addresses, phone numbers, addresses and other personal information that was provided to the OIG during investigative interviews with its agents.

DHS is offering free identity protection and credit-monitoring services for 18 months to affected individuals. The department said it has also taken steps to improve its network security going forward, including “placing additional limitations on which individuals have back end IT access to the case management system; implementing additional network controls to better identify unusual access patterns by authorized users; and performing a 360-degree review of DHS OIG’s development practices related to the case management system.”

While the affected government employees were notified directly about the breach, DHS stated, “Due to technological limitations, DHS is unable to provide direct notice to the individuals affected by the Investigative Data.”

DHS urged anyone associated with a DHS OIG investigation between 2002 and 2014 to contact AllClear ID, the Austin, Texas, breach response service retained by DHS to provide credit-monitoring and identity protection services to affected individuals.

In other news:

  • A group of senators has introduced a bill to secure U.S. elections. The Secure Elections Act is a bipartisan bill that aims to provide federal standards for election security. One measure proposed in the bill is to eliminate the use of paperless voting machines, which are regarded by election security experts as the least secure type of voting machines in use in today. Paperless voting machines don’t allow for audits, which the proposed legislation also wants to make a standard practice in all elections. The idea is that audits after every election will deter foreign meddling in American democracy like Russia’s interference in the 2016 U.S. presidential election. “An attack on our election systems by a foreign power is a hostile act and should be met with appropriate retaliatory actions, including immediate and severe sanctions,” the bill states. The bill was sponsored by Sen. James Lankford (R-Okla.) and co-sponsors Sens. Amy Klobuchar (D-Minn.), Lindsey Graham (R-S.C.), Kamala Harris (D-Calif.), Susan Collins (R-Maine) and Martin Heinrich (D-N.M.).
  • Attackers exploited a vulnerability in Google Apps Script to automatically download malware onto a victim’s system through Google Drive. Discovered by researchers at Proofpoint, the vulnerability in the app development platform enabled social-engineering attacks that tricked victims into clicking on malicious links that triggered the malware downloaded on their computer. The researchers also found the exploit could happen without any user interaction. Google has taken steps to fix the flaw by blocking installable and simple triggers, but the researchers at Proofpoint said there are bigger issues at work. The proof of concept for this exploit “demonstrates the ability of threat actors to use extensible SaaS platforms to deliver malware to unsuspecting victims in even more powerful ways than they have with Microsoft Office macros over the last several years,” the research team said in a blog post. “Moreover, the limited number of defensive tools available to organizations and individuals against this type of threat make it likely that threat actors will attempt to abuse and exploit these platforms more often as we become more adept at protecting against macro-based threats.” The researchers went on to note that, in order to combat this threat, “organizations will need to apply a combination of SaaS application security, end user education, endpoint security, and email gateway security to stay ahead of the curve of this emerging threat.”
  • The United States federal government is nearing its deadline to implement the Domain-based Message Authentication, Reporting and Conformance (DMARC) tool. In October 2016, the DHS announced it would mandate the use of DMARC and HTTPS in all departments and agencies that use .gov domains. DHS gave those departments and agencies a 90-day deadline to implement DMARC and HTTPS, which means the Jan. 15, 2018, deadline is soon approaching. According to security company Agari, as of mid-December, 47% of the federal government domains were now using DMARC, compared to 34% the month before. Another requirement within this mandate is federal agencies are required to use the strongest “reject” setting in DMARC within a year. This means emails that fail authentication tests will be less likely to make it to government inboxes — i.e., be rejected. Agari reported a 24% increase in the use of higher “reject” settings in the last month. On the flip side, Agari noted that most agency domains (84%) are still unprotected, with no DMARC policy.