Cloud Hopper Attack Bigger Than Reported. MUCH Bigger

I hate to keep beating on this drum, but the message is important and the news keeps getting worse.

Yesterday I wrote about yet another managed service provider that was hit by a ransomware attack and a number of their clients had their data encrypted.

Today the Wall Street Journal is reporting that the Cloud Hopper attack in 2016, which was revealed last year, was much bigger than has been previously reported.

Up until now, the news we knew about was that 12 managed service providers had been successfully attacked.  Among the 12 was Hewlett Packard (HPE).  According to the Journal, HPE was so compromised that even as they were giving their clients the “all-clear”, the Chinese were re-compromising their network.

The Chinese hacking group, known as APT10 (for advanced persistent threat – not your average 400 pound hacker that our President talks about) had access to the data of hundreds of firms.

Included in that list are Rio Tinto, Philips, American Airlines Group, Deutsche Bank AG, Allianz SE and Glaxo Smith Kline.

Director of the FBI Christopher Wray said it was the equivalent to stealing the master keys to an apartment complex.

The Journal says that whether the hackers are still inside those networks is an open question.  They say that data from the security firm Security Scorecard shows that thousands of IP addresses globally are still reporting back to APT10.

The US Government is now worried about their own possible exposure.  Yikes.

The government says that the hackers took personnel information on over 100,000 Navy personnel.  You can only imagine what that might mean.

This could be part of the reason that the government is moving so fast on CMMC (government fast, that is).  CMMC is a new security requirement for government contractors scheduled to go into effect very soon.

If this isn’t scary enough, the Journal says that the Ruskies, not wanting to be outdone by the Chinese, are also trying to breaking to Cloud Service Providers.

Check out yesterday’s blog post for recommendations, but the number one recommendation is to get a robust logging and alerting solution in place so that you know when you are under attack and don’t wind up like Marriott – discovering that the bad guys are inside your system.  FOUR YEARS after the fact.

Unfortunately the WSJ article is behind a paywall, but if you have access, it is fascinating reading.

Your job now is to protect yourself.

Like in previous times when Willie Sutton was robbing banks, he said that is where the money is.  Today, the money is in information and that information is at MSPs and other hosting providers.

Source: WSJ


Is This Becoming a Thing-Another MSP Ransomed

A couple of weeks ago it was a Managed Service Provider in Denver.  A few weeks before that, it was one in Wisconsin.  This week it is Irvine, CA based Synoptek with more than 1,100 customers including state and local governments, financial services and healthcare.  Their web site says that they did more than $100 million in business last year.

Someone captured a Tweet of theirs before they deleted it:

Now that they were hit by a ransomware attack which encrypted customer data on Christmas Eve, they probably wished they took their own advice.

They are being very quiet about the whole thing, but reports say that it infected a subset of their customers and that they paid the ransom.  Hopefully they have insurance to cover the cost.

Unlike the attack in Colorado, it looks like these guys were better prepared and were able to contain the attack and are working quickly to mitigate it.

Several thoughts here:

  • It looks like this *IS* becoming a thing because for an MSP, if they don’t pay the ransom, if they don’t decrypt their clients’ data, if they don’t minimize the consequences, they are likely out of business.  From an attacker’s standpoint, this is THE BEST scenario.
  • Since there are likely tens of thousands of these service providers out there from mom & pop shops to a few hundred employees (Synoptek has about 700 peops), there is no shortage of opportunities
  • As an MSP’s customer, you want to ask those embarrassing questions like do you have insurance, are you prepared and how long would I be down?
  • This attack also went after the remote control software, which is a weak spot for MSPs.  There are some options when it comes to this, so you might want to ask questions.
  • When it comes to *YOU*, you need to make sure you are prepared-
  • Do you have your own backups?
  • Do you have a monitoring and alerting system to detect the problem quickly (we have a cost effective solution)?
  • What is your plan if one or more of your service providers is down for a day?  For a week? For a couple of weeks?  Goes out of business?
  • Can you continue to do business while you are down?
  • While the total number of businesses impacted by just these three attacks that did hit the news is around, best guess, one thousand companies, that is just 3 attacks.  This will likely get uglier before it gets better.

And just to lighten things up a bit, check out this YouTube clip from the animated movie Hoodwinked.  He has a good suggestion –

Source: Brian Krebs

Security News for the Week Ending December 27, 2019

Russia Claims to Have Successfully Disconnected from the Internet

Russia has been planning to install an Internet kill switch for a couple of years now.  Of course, we have no clue what that means.  Likely, it means that they have their own DNS servers so that they do not have to resolve web site addresses using servers controlled by the US and EU.  But that means any web sites that are outside of Russia will not work if they do this.

More likely, this process, which forces all traffic through government controlled gateways, is designed to surveil its citizens even more than it already does.  Details at ZDNet.

Pentagon Tells Military Not To Use “At Home” DNA Tests

I am not sure that or 23AndMe are terribly happy about the message, but the Pentagon put out a memo this week telling members of the armed services not to take at home DNA tests unless otherwise notified.

The cover story is that the tests might be unreliable and not reviewed by the FDA.  The next story is that negative results might require members of the armed forces to disclose things that could end their military careers.

The real story is they are worried about state actors getting their hands on the DNA of our service men and women for nefarious purposes.

It looks like the military is actually starting to understand risks of the 21st century.  Good work.  Note this is not voluntary or optional. Source: MSN

Telemarketing Firm Lays off 300 Before Christmas Due to Ransomware

A Sherwood, Arkansas telemarketing firm laid off 300 people just before Christmas after a ransomware attack shut down their systems.  The attack happened about two months ago and even though they paid the ransom, they have not yet been able to restore the systems.  Apparently, at this point, they have run out of money. The company finally put out a memo explaining what was happening and told employees to call on January 2nd to see if they were going to get their jobs back.  Merry Christmas.  Source: KATV

British Pharmacy Fined $350K for Failing to Protect Medical Records

It is not just the big companies that are getting fined.  In this case a British pharmacy was fined $350,000 for leaving a half million records unprotected and exposed to the elements.  In addition, the pharmacy was issued an order to fix its security practices in 90 days or face more fines.  We are seeing less willingness by courts and regulators on both sides of the Atlantic to deal with companies missteps when it comes to security and privacy.   Source The Register.

Georgia Supreme Court Says Victims of Medical Clinic Hack Can Sue

Moving to this side of the Atlantic, the Georgia Supreme Court says that victims of an Atlanta area medical clinic that was hacked can sue the clinic for negligence.  As I said, courts are becoming much less understanding as to why companies are not effectively protecting the data entrusted to them.  This decision reverses the Court of Appeals decision and is only binding in Georgia, but courts in other states may use this as a precedent in their decision process.  Source: Atlanta Journal Constitution

What Does California’s New Privacy Law Mean to the Average Person

California’s new privacy law, CA AB 375 or the California Consumer Privacy Act (CCPA) along with it’s attendant modifications and rules goes into effect next week.  As companies scurry around to meet the January 1, 2020 deadline, here is some information on what CCPA means to the average resident of California and elsewhere.

While CCPA is still a bit of a work in progress, we need to put a fork in it anyway.

Why is it important?

This is the first time anyone, anywhere in the United States, has any “rights” to their data. While residents of the European Union have enjoyed rights to their data for about 18 months, and the world has not ended. This is a new adventure in the United States.

What Data Does This Cover?

It covers all the things you would expect like drivers license numbers, bank account information and your Social Security number, but it also covers a lot of other information.  All biometrics are covered (like your iris scan, fingerprints and DNA).  Also your IP address and other identifiers used to track you on the Internet.  Even how you smell is covered.  Data extracted DIRECTLY from public government records is not covered.

Can I Tell Those Social Media Giants to Delete Me?

You can, but I guarantee that they are going to try and discourage you or fool you.  You don’t REALLY want us to delete your stuff – how about if we take your name off it; surely that is good enough.  But you can ask them to delete it and they MUST do it.

What if they don’t do it?

The law allows for a $2,500 fine per violation or three times that if it is intentional.  But the catch is that fine can only come from the Attorney General and he doesn’t seem that keen to enforce it.  He is, however, a politician, so if there is political pressure or if he thinks that attacking some company will help get him reelected, it is game over.  The law didn’t give him extra budget or people to enforce it.

What about if there is a breach?

That is a chicken of a different color.  If there is a breach, any California resident can sue (or be part of a class action) for up to $750 per person affected, without having to show that they were damaged, or more if they can show that.

Expect there to be a cottage industry of attorneys in California going after breached companies.

Also, this right cannot be waived, so those shrink wrap agreements that no one reads – the ones that ban class action participation or lawsuits vs. arbitration – when it comes to this, they can’t be enforced.

Can I still use Facebook if I tell them not to sell my data?

They might be able to strip down the services, but only to the extent that they can show how much your data is worth to them.  If they want to charge you, they also have to show how much your data is worth.  Optics being what it is, I doubt very many businesses want the negative PR.  They are just hoping that not very many people opt out.

What if I don’t live in California?

Technically you can’t take advantage of the law.  BUT, you can see what is in the CCPA documents – what data they are collecting and how they are using it, for example.

Also, some companies are offering CCPA coverage to all residents of the U.S.  Microsoft is one of those companies.  In that case, the companies are voluntarily giving you the same rights, even though the law doesn’t force them to .

There will likely be a lot more  information coming out, so stay informed.  This is likely a dawn of a new era.

Unless Congress passes a weak national privacy law which overrides stricter state laws.  Congress is talking about this, but it is a very sticky political subject so I am not counting on this.  Still, no one is safe while Congress is in session.  Source: CNet





Universities Collect Thousands of Location Data Points Per Student Per Day

To call this big brother is watching would be polite.

Universities are using apps on students phones and either Bluetooth beacons or WiFi to track students location including class attendance and, I would guess, how much time their spend in local bars.

The attendance part is to “encourage” students to attend class.  Students who do not “clock in” by turning on Bluetooth or Wifi on their phones and making sure the university’s app is running are counted as not attending lectures and lose points, which, in turn, affects their grade.

Some universities are even using the data to create a personal risk score for each student, allowing them to intervene, if they want to.

Students say they can’t do anything about the surveillance other than to drop out of college.

They also use the tech to make sure that athletes attend classes, which is required for them to remain eligible for their scholarships.

The system can send an email to the professor if the student skips a class or comes in, say two minutes late.

It can also tell if the student leaves before the end of the class.

It also allows the colleges to see if, for example, black students skip classes or go to bars more than white kids.  They have thousands of data points per student per day.  The possibilities to discriminate, as they say, are endless.

I guess if you spend too much time in the cafeteria, they will enroll you in more gym classes?

While college students have always been thought of as lab rats, how long will it be before employers use this to track employee behavior.  How many breaks do they take;  do they show up late or leave early.  Employees who are in high demand can tell employers to take a long walk off a short pier, but many (most?) employees don’t have that luxury.  Source: WaPo



Oh What a Tangled Web Spies Weave

After the 9-11 attacks on The World Trade Center Twin Towers, the Pentagon and Shanksville, PA,  Congress quickly and without much discussion, passed the Patriot Act, the single biggest spying operation likely ever.  Under the Patriot Act, the government was able to collect information on Internet traffic, mostly of foreigners.  The amount of data that they collected and are collecting is staggering, forcing the NSA to build a huge new data center in the Utah desert.

The law was supposed to expire in 4 years, but Congress has renewed renewed the act twice, once under President Bush and once under President Obama.  A couple of parts were allowed to expire and a few tweaks have been made to the law, but basically it continues to operate.  Parts of the act were due to expire on December 31, 2019, but Congress snuck a three month extension to the parts that were due to expire into the recently passed government funding bill, so as to give Congress more time to discuss it.   In general, this is probably a good idea, but sneaking it into another bill, a popular habit of Congress when they think their votes might attract undo attention, is something that I am not so fond of.

One section that is due to expire is Section 702, which allows for bulk data collection.  Actually it is metadata – information like WHO you are calling, when and for how long, but NOT the actual conversation.

In theory, the FBI is only supposed to access this data in cases of terrorism or suspected terrorism, but in their excitement over a new data source, they accessed it at least tens of thousands of times in cases that had nothing to do with terrorism.

A federal court ruled that the way the FBI was using this database was likely unconstitutional, but they did not make them stop it.  What they did say is that you need to do a better job of creating paperwork to justify document what you are doing.  This involved a case of a US citizen who was jailed for and admitted to giving material support to a terrorist organization – someone who would not generate a lot of sympathy.

Still, it is useful to shed some light on the inner workings of the government.  The appeals court said that gathering the data under section 215 was likely legal, but using that data to obtain information on a US citizen without a warrant is a no-no.  This aligns the court with two recent Supreme Court decisions on the subject of privacy.

The interesting thing is that, apparently, it is pretty difficult for the NSA to collect data only on foreigners, so difficult that last year they had to purge the entire database and right now, the NSA says that they don’t need or want this ability any more.

However, the Director of National Intelligence, a role who’s fundamental job is to collect and analyze as much data as is possible, says not only should Congress renew it, but they should make it permanent so they don’t have to justify it every 4 or 5 years.  See details here.

We are likely to hear more about this in the next couple of months, so if privacy and government spying is an issue that is import to you, then becoming educated and communicating with your elected officials is something you should do.