Oktacron - Cyber Security RSS Feeds History

Malicious module in IIS Web server | Kaspersky official blog

kaspersky Dec 14, 2021 Business

A malicious Internet Information Services (IIS) module is turning Outlook on the web into a tool for stealing credentials and a remote access panel. Unknown actors have used the module, which our researchers call OWOWA, in targeted attacks. Why Outlook on the web attracts attackers Outlook on the web (previously known show more ...

as Exchange Web Connect, Outlook Web Access, and Outlook Web App, or simply OWA) is a Web-based interface for accessing Microsofts Personal Information Manager service. The app is deployed on Web servers running IIS. Many companies use it to provide employees with remote access to corporate mailboxes and calendars without having to install a dedicated client. There are several methods of implementing Outlook on the web, one of which involves using Exchange Server on site, which is what cybercriminals are drawn to. In theory, gaining control of this app gives them access to all corporate correspondence, along with endless opportunities to expand their attack on the infrastructure and launch additional BEC campaigns. How OWOWA works OWOWA loads on compromised IIS Web servers as a module for all compatible apps, but its purpose is to intercept credentials entered into OWA. The malware checks requests and responses on Outlook on the Web login page, and if it sees a user has entered credentials and received an authentication token in response, it writes the username and password to a file (in encrypted form). In addition, OWOWA allows attackers to control its functionality directly through the same authentication form. By entering certain commands into the username and password fields, an attacker can retrieve the harvested information, delete the log file, or execute arbitrary commands on the compromised server through PowerShell. For a more detailed technical description of the module with indicators of compromise, see Securelists post. Who are the victims of OWOWA attacks? Our experts detected OWOWA-based attacks on servers in several Asian countries: Malaysia, Mongolia, Indonesia, and the Philippines. However, our experts have reason to believe the cybercriminals are also interested in organizations in Europe. The majority of targets were government agencies, with at least one being a transport company (also state-owned). How to guard against OWOWA You can use the appcmd.exe command — or the regular IIS configuration tool — to detect the malicious OWOWA module (or any other third-party IIS module) on the IIS Web server. Keep in mind, however, that any Internet-facing server, like any computer, needs protection.

Inside Ireland’s Public Healthcare Ransomware Scare

krebsonsecurity Dec 14, 2021 A Little Sunshine

The consulting firm PricewaterhouseCoopers recently published lessons learned from the disruptive and costly ransomware attack in May 2021 on Ireland’s public health system. The unusually candid post-mortem found that nearly two months elapsed between the initial intrusion and the launching of the ransomware. It show more ...

also found affected hospitals had tens of thousands of outdated Windows 7 systems, and that the health system’s IT administrators failed to respond to multiple warning signs that a massive attack was imminent. PWC’s timeline of the days leading up to the deployment of Conti ransomware on May 14. Ireland’s Health Service Executive (HSE), which operates the country’s public health system, got hit with Conti ransomware on May 14, 2021. A timeline in the report (above) says the initial infection of the “patient zero” workstation happened on Mar. 18, 2021, when an employee on a Windows computer opened a booby-trapped Microsoft Excel document in a phishing email that had been sent two days earlier. Less than a week later, the attacker had established a reliable backdoor connection to the employee’s infected workstation. After infecting the system, “the attacker continued to operate in the environment over an eight week period until the detonation of the Conti ransomware on May 14, 2021,” the report states. According to PWC’s report (PDF), there were multiple warnings about a serious network intrusion, but those red flags were either misidentified or not acted on quickly enough: On Mar. 31, 2021, the HSE’s antivirus software detected the execution of two software tools commonly used by ransomware groups — Cobalt Strike and Mimikatz — on the Patient Zero Workstation. But the antivirus software was set to monitor mode, so it did not block the malicious commands.” On May 7, the attacker compromised the HSE’s servers for the first time, and over the next five days the intruder would compromise six HSE hospitals. On May 10, one of the hospitals detected malicious activity on its Microsoft Windows Domain Controller, a critical “keys to the kingdom” component of any Windows enterprise network that manages user authentication and network access. On 10 May 2021, security auditors first identified evidence of the attacker compromising systems within Hospital C and Hospital L. Hospital C’s antivirus software detected Cobalt Strike on two systems but failed to quarantine the malicious files. On May 13, the HSE’s antivirus security provider emailed the HSE’s security operations team, highlighting unhandled threat events dating back to May 7 on at least 16 systems. The HSE Security Operations team requested that the Server team restart servers. By then it was too late. At just after midnight Ireland time on May 14, the attacker executed the Conti ransomware within the HSE. The attack disrupted services at several Irish hospitals and resulted in the near complete shutdown of the HSE’s national and local networks, forcing the cancellation of many outpatient clinics and healthcare services. The number of appointments in some areas dropped by up to 80 percent.” Conti initially demanded USD $20 million worth of virtual currency in exchange for a digital key to unlock HSE servers compromised by the group. But perhaps in response to the public outcry over the HSE disruption, Conti reversed course and gave the HSE the decryption keys without requiring payment. Still, the work to restore infected systems would take months. The HSE ultimately enlisted members of the Irish military to bring in laptops and PCs to help restore computer systems by hand. It wasn’t until September 21, 2021 that the HSE declared 100 percent of its servers were decrypted. As bad as the HSE ransomware attack was, the PWC report emphasizes that it could have been far worse. For example, it is unclear how much data would have been unrecoverable if a decryption key had not become available as the HSE’s backup infrastructure was only periodically backed up to offline tape. The attack also could have been worse, the report found: if there had been intent by the Attacker to target specific devices within the HSE environment (e.g. medical devices); if the ransomware took actions to destroy data at scale; if the ransomware had auto-propagation and persistence capabilities, for example by using an exploit to propagate across domains and trust-boundaries to medical devices (e.g. the EternalBlue exploit used by the WannaCry and NotPetya15 attacks); if cloud systems had also been encrypted such as the COVID-19 vaccination system The PWC report contains numerous recommendations, most of which center around hiring new personnel to lead the organization’s redoubled security efforts. But it is clear that the HSE has an enormous amount of work ahead to grow in security maturity. For example, the report notes the HSE’s hospital network had over 30,000 Windows 7 workstations that were deemed end of life by the vendor. “The HSE assessed its cybersecurity maturity rating as low,” PWC wrote. “For example, they do not have a CISO or a Security Operations Center established.” PWC also estimates that efforts to build up the HSE’s cybersecurity program to the point where it can rapidly detect and respond to intrusions are likely to cost “a multiple of the HSE’s current capital and operation expenditure in these areas over several years.” One idea of a “security maturity” model. In June 2021, the HSE’s director general said the recovery costs for the May ransomware attack were likely to exceed USD $600 million. What’s remarkable about this incident is that the HSE is publicly funded by the Irish government, and so in theory it has the money to spend (or raise) to pay for all these ambitious recommendations for increasing their security maturity. That stands in stark contrast to the healthcare system here in the United States, where the single biggest impediment to doing security well continues to be lack of making it a real budget priority. Also, most healthcare organizations in the United States are private companies that operate on razor-thin profit margins. I know this because in 2018 I was asked to give the keynote at an annual gathering of the Healthcare Information Sharing and Analysis Group (H-ISAC), an industry group centered on sharing information about cybersecurity threats. I almost didn’t accept the invitation: I’d written very little about healthcare security, which seemed to be dominated by coverage of whether healthcare organizations complied with the letter of the law in the United States. That compliance centered on the Health Insurance Portability and Accountability Act (HIPAA), which prioritizes protecting the integrity and privacy of patient data. To get up to speed, I interviewed over a dozen of the healthcare security industry’s best and brightest minds. A common refrain I heard from those interviewed was that if it was security-related but didn’t have to do with compliance, there probably wasn’t much chance it would get any budget. Those sources unanimously said that however well-intentioned, it’s not clear that the “protect the data” regulatory approach of HIPPA was working from an overall threat perspective. According to HealthcareIT News, more than 40 million patient records have been compromised in incidents reported to the federal government in 2021 so far alone. During my 2018 talk, I tried to emphasize the primary importance of being able to respond quickly to intrusions. Here’s a snippet of what I told that H-ISAC audience: “The term ‘Security Maturity’ refers to the street smarts of an individual or organization, and this maturity generally comes from making plenty of mistakes, getting hacked a lot, and hopefully learning from each incident, measuring response times, and improving. Let me say up front that all organizations get hacked. Even ones that are doing everything right from a security perspective get hacked probably every day if they’re big enough. By hacked I mean someone within the organization falls for a phishing scam, or clicks a malicious link and downloads malware. Because let’s face it, it only takes one screw up for the hackers to get a foothold in the network. Now this is in itself isn’t bad. Unless you don’t have the capability to detect it and respond quickly. And if you can’t do that, you run the serious risk of having a small incident metastasize into a much larger problem. Think of it like the medical concept of the ‘Golden Hour:’ That short window of time directly following a traumatic injury like a stroke or heart attack in which life-saving medicine and attention is likely to be most effective. The same concept holds true in cybersecurity, and it’s exactly why so many organizations these days are placing more of their resources into incident response, instead of just prevention.” The United States’ somewhat decentralized healthcare system means that many ransomware outbreaks tend to be limited to regional or local healthcare facilities. But a well-placed ransomware attack or series of attacks could inflict serious damage on the sector: A December 2020 report from Deloitte says the top 10 health systems now control a 24 percent market share and their revenue grew at twice the rate of the rest of the market. In October 2020, KrebsOnSecurity broke the story that the FBI and U.S. Department of Homeland Security had obtained chatter from a top ransomware group which warned of an “imminent cybercrime threat to U.S. hospitals and healthcare providers.” Members associated with the Russian-speaking ransomware group known as Ryuk had discussed plans to deploy ransomware at more than 400 healthcare facilities in the United States. Hours after that piece ran, I heard from a respected H-ISAC security professional who questioned whether it was worth getting the public so riled up. The story had been updated multiple times throughout the day, and there were at least five healthcare organizations hit with ransomware within the span of 24 hours. “I guess it would help if I understood what the baseline is, like how many healthcare organizations get hit with ransomware on average in one week?” I asked the source. “It’s more like one a day,” the source confided. In all likelihood, the HSE will get the money it needs to implement the programs recommended by PWC, however long that takes. I wonder how many U.S.-based healthcare organizations could say the same.

Microsoft Patch Tuesday, December 2021 Edition

krebsonsecurity Dec 14, 2021 Time to Patch

Microsoft, Adobe, and Google all issued security updates to their products today. The Microsoft patches include six previously disclosed security flaws, and one that is already being actively exploited. But this month’s Patch Tuesday is overshadowed by the “Log4Shell” 0-day exploit in a popular Java show more ...

library that web server administrators are now racing to find and patch amid widespread exploitation of the flaw. Log4Shell is the name picked for a critical flaw disclosed Dec. 9 in the popular logging library for Java called “log4j,” which is included in a huge number of Java applications. Publicly released exploit code allows an attacker to force a server running a vulnerable log4j library to execute commands, such as downloading malicious software or opening a backdoor connection to the server. According to researchers at Lunasec, many, many services are vulnerable to this exploit. “Cloud services like Steam, Apple iCloud, and apps like Minecraft have already been found to be vulnerable,” Lunasec wrote. “Anybody using Apache Struts is likely vulnerable. We’ve seen similar vulnerabilities exploited before in breaches like the 2017 Equifax data breach. An extensive list of responses from impacted organizations has been compiled here.” “If you run a server built on open-source software, there’s a good chance you are impacted by this vulnerability,” said Dustin Childs of Trend Micro’s Zero Day Initiative. “Check with all the vendors in your enterprise to see if they are impacted and what patches are available.” Part of the difficulty in patching against the Log4Shell attack is identifying all of the vulnerable web applications, said Johannes Ullrich, an incident handler and blogger for the SANS Internet Storm Center. “Log4Shell will continue to haunt us for years to come. Dealing with log4shell will be a marathon,” Ullrich said. “Treat it as such.” SANS has a good walk-through of how simple yet powerful the exploit can be. “Basically the perfect ending to cybersecurity in 2021 is a 90s style Java vulnerability in an open source module, written by two volunteers with no funding, used by large cybersecurity vendors, undetected until Minecraft chat got pwned, where nobody knows how to respond properly,” researcher Kevin Beaumont quipped on Twitter. A half-dozen of the vulnerabilities addressed by Microsoft today earned its most dire “critical” rating, meaning malware or miscreants could exploit the flaws to gain complete, remote control over a vulnerable Windows system with little or no help from users. The Windows flaw already seeing active exploitation is CVE-2021-43890, which is a “spoofing” bug in the Windows AppX installer on Windows 10. Microsoft says it is aware of attempts to exploit this flaw using specially crafted packages to implant malware families like Emotet, Trickbot, and BazaLoader. Kevin Breen, director of threat research for Immersive Labs, said CVE-2021-43905 stands out of this month’s patch batch. “Not only for its high CVSS score of 9.6, but also because it’s noted as ‘exploitation more likely’,” Breen observed. Microsoft also patched CVE-2021-43883, an elevation of privilege vulnerability in Windows Installer. “This appears to be a fix for a patch bypass of CVE-2021-41379, another elevation of privilege vulnerability in Windows Installer that was reportedly fixed in November,” Satnam Narang of Tenable points out. “However, researchers discovered that fix was incomplete, and a proof-of-concept was made public late last month.” Google issued five security fixes for Chrome, including one rated critical and three others with high severity. If you’re browsing with Chrome, keep a lookout for when you see an “Update” tab appear to the right of the address bar. If it’s been a while since you closed the browser, you might see the Update button turn from green to orange and then red. Green means an update has been available for two days; orange means four days have elapsed, and red means your browser is a week or more behind on important updates. Completely close and restart the browser to install any pending updates. Also, Adobe issued patches to correct more than 60 security flaws in a slew of products, including Adobe Audition, Lightroom, Media Encoder, Premiere Pro, Prelude, Dimension, After Effects, Photoshop, Connect, Experience Manager and Premiere Rush. Standard disclaimer: Before you update Windows, please make sure you have backed up your system and/or important files. It’s not uncommon for a Windows update package to hose one’s system or prevent it from booting properly, and some updates have been known to erase or corrupt files. So do yourself a favor and backup before installing any patches. Windows 10 even has some built-in tools to help you do that, either on a per-file/folder basis or by making a complete and bootable copy of your hard drive all at once. And if you wish to ensure Windows has been set to pause updating so you can back up your files and/or system before the operating system decides to reboot and install patches on its own schedule, see this guide. If you experience glitches or problems installing any of these patches this month, please consider leaving a comment about it below; there’s a decent chance other readers have experienced the same and may chime in here with useful tips. Additional reading: SANS ISC listing of each Microsoft vulnerability patched today, indexed by severity and affected component.

Karakurt: This New Threat Group Steals Data for Ransom

cyware Dec 14, 2021 Threat Actors

Researchers from Accenture discovered Karakurt’s attacks with multiple sightings within a short period of time. The group mainly focuses on data exfiltration, followed by extortion.

Several Threat Actors Abusing Log4Shell to Spread Malware

cyware Dec 14, 2021 Malware and Vulnerabilities

Recently, an exploit was publicly released for Log4Shell vulnerability (CVE-2021-44228) in the Apache Log4j Java-based logging utility. Soon after, cybercriminals started abusing the flaw to spread malware.

51 Arrested in Ukraine for Selling Data of 300M people in EU, US

cyware Dec 14, 2021 Incident Response, Learnings

The arrests are the latest police action against groups committing cybercrime in the country, with hacking groups and forums being shut down and cybercriminals’ databases seized.

Log4Shell attacks began two weeks ago, Cisco and Cloudflare say

cyware Dec 14, 2021 Malware and Vulnerabilities

Majority of attacks have originated from cryptomining and DDoS botnets, such as Mirai, Muhstik, and Kinsing, which are typically the first to exploit any critical enterprise bug before everyone else.

Indian PM Modi’s Twitter Account HACKED for Bitcoin scam

cyware Dec 14, 2021 Breaches and Incidents

This is the second hack attack on an account connected to the Indian premiere in two years – Previously, on September 2, 2020, PM Modi’s personal Twitter account was hacked for a Bitcoin-related scam.

Update Google Chrome to Patch New Zero-Day Exploit Detected in the Wild

cyware Dec 14, 2021 Malware and Vulnerabilities

Google has rolled out fixes for five security vulnerabilities in Chrome, including one being exploited in the wild, making it the 17th such flaw to be disclosed since the start of the year.

TA575 Sends Spam Emails with Fake Offers

cyware Dec 14, 2021 Identity Theft, Fraud, Scams

A noteworthy threat group, TA575, has been observed using holiday-themed lures in its recent attack campaigns. The main goal of the campaigns is to lure victims into downloading the banking trojan, Dridex.

Practical Coexistence Attacks on WiFi Chips Could Enable Data Theft and Traffic Manipulation

cyware Dec 14, 2021 Malware and Vulnerabilities

A group of academic researchers discovered security vulnerabilities that can be exploited to extract passwords and manipulate traffic on a WiFi chip by targeting a device’s Bluetooth component.

Employees think they’re safe from cyberthreats on company devices

cyware Dec 14, 2021 Trends, Reports, Analysis

There are now more threats to corporate devices and networks than ever as hybrid work models blur the boundaries between work and home. Many workers perform non-work-related tasks on company devices.

Virginia Assembly's Voicemail System, Law Portal, Capitol Police Facing Downtime Due to Ransomware Incident

cyware Dec 14, 2021 Breaches and Incidents

The Assembly's voicemail system was down and many of the systems involved in budgeting were disrupted due to the attack. The Virginia Law Portal is also down because of the attack.

Geopolitical and Socio-Economic Threats to Cybersecurity

cyware Dec 14, 2021 Expert Blogs and Opinion

Previously, only certain industries, like the financial sector, had the absolute need and requirement to rely on interconnected information systems to carry out automated transactions and processes.

FTC warns gift card scams are flourishing in 2021

cyware Dec 14, 2021 Trends, Reports, Analysis

In reality, these criminal actions are a way for unscrupulous individuals or criminal rings to secure gift card codes they can use illicitly or resell through online black markets for profit.

HR Management Platform Kronos Takes Cloud Services Offline After Ransomware Attack

cyware Dec 14, 2021 Breaches and Incidents

Kronos Private Cloud was hit by a ransomware attack. The company, also known as Ultimate Kronos Group (UKG), provides timekeeping services to companies employing millions of people across the world.

New tool offers Log4j flaw mitigation for systems that can't be updated immediately

cyware Dec 14, 2021 Incident Response, Learnings

Cybereason released a mitigation tool named Logout4shell. It is freely available on GitHub and Cybereason said it "is a relatively simple fix that requires only basic Java skills to implement."

A Look Into Purple Fox’s Server Infrastructure

cyware Dec 14, 2021 Malware and Vulnerabilities

Purple Fox focuses on SQL servers as its target as opposed to normal computers for cryptomining activities. This is because of the better hardware configuration that the servers would usually have.

When the question is paying ransom, the answer isn’t always clear

cyware Dec 14, 2021 Expert Blogs and Opinion

The decentralized nature of U.S. state and local agencies has made it harder to reach a consensus approach against such attacks, said Ron Sanders, staff director of Florida Center for Cybersecurity.

Latest Apple iOS Update Patches Remote Jailbreak Exploit for iPhones

cyware Dec 14, 2021 Malware and Vulnerabilities

Besides CVE-2021-30955, a total of five Kernel and four IOMobileFrameBuffer (a kernel extension for managing the screen framebuffer) flaws have been remediated with the latest updates.

CISA tells federal agencies to patch Log4Shell before Christmas

cyware Dec 14, 2021 Govt., Critical Infrastructure

Federal agencies have ten days to test which of their internal apps and servers utilize the Log4j Java library, check if systems are vulnerable to the Log4Shell exploit, and patch affected servers.

Iranian State-Sponsored Threat Group ‘Seedworm’ Targets Telcos in Asia, Middle East

cyware Dec 14, 2021 Breaches and Incidents

Though the identity of the attackers is still unconfirmed, they potentially could be linked to the Iranian group Seedworm, aka MuddyWater or TEMP.Zagros, researchers said.

Forget the dark web: ransomware gangs weaponize social media to pressure victims

cyware Dec 14, 2021 Expert Blogs and Opinion

In an effort to amplify coverage, some ransomware groups are using social media channels to bring news of their conquests to a wider audience and put more pressure on victims to pay the ransom.

Owowa: the add-on that turns your OWA into a credential stealer and remote access panel

cyware Dec 14, 2021 Malware and Vulnerabilities

Owowa is a C#-based .NET v4.0 assembly that is intended to be loaded as a module within an IIS web server that also exposes Exchange’s Outlook Web Access (OWA) to credential theft and remote access.

SANS Opens Free Holiday Hack Challenge

cyware Dec 14, 2021 Security Culture

An American non-profit cybersecurity training and IT company is inviting cybersecurity fans everywhere to boost their skills by taking part in a free festive hacking competition.

Inside Ireland’s Public Healthcare Ransomware Scare – Krebs on Security

cyware Dec 14, 2021 Incident Response, Learnings

The consulting firm PricewaterhouseCoopers recently published lessons learned from the disruptive and costly ransomware attack in May 2021 on Ireland’s public health system.

Zero-Day Vulnerability in Hillrom Cardiology Devices Could Allow Attackers to Seize Control

cyware Dec 14, 2021 Malware and Vulnerabilities

A high-severity vulnerability in several cardiac healthcare devices could allow attackers to access privileged accounts without a password and seize control of the devices.

Preparing for Evolving Phishing Scams

cyware Dec 14, 2021 Trends, Reports, Analysis

According to the FBI, U.S. businesses lost more than $1.8 billion last year in costs related to business email compromise (BEC) or spearphishing and over $54 million in losses to phishing scams.

Hackers Exploit Log4j Vulnerability to Infect Computers with Khonsari Ransomware

cyware Dec 14, 2021 Malware and Vulnerabilities

The attack leverages the Log4Shell flaw to download an additional payload from a remote server that encrypts all the files with the extension ".khonsari" and demands a Bitcoin ransom payment.

Americans Lost Almost $150 Million to Gift Card Scams: FTC

cyware Dec 14, 2021 Trends, Reports, Analysis

Almost 40,000 consumers reported falling victim to scams that involved gift cards as a payment method. This year, Target gift cards remained the top choice among cybercriminals.

Second Cyberattack Within a Week Disrupts COVID-19 Vaccine Certification in Brazil

cyware Dec 14, 2021 Breaches and Incidents

Brazil's Ministry of Health has suffered a second cyberattack in less than a week, which has compromised various internal systems, including the platform that holds COVID-19 vaccination data.

The Latest On The Log4j Remote Code Execution Nightmare

packetstormsecurity Dec 14, 2021 headline,hacker,data loss,flaw,java,apac

Hackers Steal $140 Million From Users Of Crypto Gaming Company

packetstormsecurity Dec 14, 2021 headline,hacker,bank,cybercrime,data los

Seedworm Attackers Target Telcos In Asia, Middle East

packetstormsecurity Dec 14, 2021 headline,hacker,malware,phone,saudi arab