The federal government has issued a warning to the healthcare sector about the threat of cyberattacks by Iranian threat actors. Iranian state-sponsored actors lack the sophisticated technical capabilities of Russian and Chinese threat actors, but still pose a significant threat to the sector. The threat actors mostly use social engineering in their attacks to gain access to healthcare networks and are known to conduct sophisticated spear-phishing campaigns.

Spear phishing campaigns often involve healthcare-related lures with the threat actors using fake personas and social media platforms to interact with their targets, often impersonating doctors, researchers, and think tanks to trick targets into disclosing their credentials or downloading and installing malware. The Tortoiseshell Facebook campaign saw threat actors claim to be recruiters in hospitality, medicine, journalism, NGOs, and aviation. Fake accounts were used to trick targets into opening malware-infected files or to lure them onto phishing URLs to steal credentials. The threat actors often use LinkedIn for contacting targets and sending fake job offers headhunting individuals of interest. Popular online platforms such as Google, Microsoft, and Yahoo are also impersonated to steal credentials.

One notable campaign involved the impersonation of the Director of Research at the Foreign Policy Research Institute (FRPI), with the email appearing to CC the Director of Global Attitudes Research at the Pew Research Center. The emails sought input for an article about Iraq’s position in the world. Spear phishing emails can be realistic and convincing and may involve multiple messages to engage targets in conversation to build trust before tricking them into installing malware or disclosing their credentials. Considerable time and effort are put into creating convincing social media profiles and Internet footprints to make the scams seem more credible and to survive attempts to verify the authenticity of the profile and request.

While spear phishing is the most common initial access vector, the Iranian state-sponsored hacking group known as Pioneer Kitten (aka NC757, Parisite, & Fox Kitten) is known to exploit vulnerabilities in VPNs and other network appliances, such as CVE-2020-5902 (BIG-IP), CVE-2019-19781 (Citrix), & CVE-2019-11510 (Pulse Connect Secure). Other vulnerabilities exploited for initial access include the Log4j vulnerabilities, the Microsoft Exchange ProxyShell and other Exchange vulnerabilities, and Fortinet FortiOS vulnerabilities. One attack that was thwarted involved exploiting a vulnerability in a Fortigate appliance to gain access to the environmental control networks of a U.S. children’s hospital.

Iranian threat actors are known to conduct attacks to gain access to sensitive personally identifiable information; however, the attacks tend to be more destructive than other state-sponsored hacking groups. Cyberattacks often exploit cyber vulnerabilities to attack Iran’s adversaries to retaliate for sanctions while minimizing the risk of retaliation. Attacks have been conducted where websites have been defaced, DDoS attacks employed to damage reputations, and the country is infamous for using wiper malware in attacks. Once access is gained to networks, the threat actors move laterally and are known to install a PowerShell backdoor called POWERSTATS for persistence.

Improving resilience to attacks requires a focus on anti-phishing strategies such as implementing a robust email security solution, multi-factor authentication, and engaging in end-user training., Employees should receive regular training and be taught how to recognize and report phishing and social engineering attacks. Reviews should be conducted of all internet-accessible systems, vulnerabilities should be patched promptly, networks segmented to limit the ability of the threat actors to move laterally, user accounts should be regularly audited, especially those with administrative privileges. and strong passwords should also be set to improve resilience to brute force attacks. Further mitigations have been suggested by the Department of Health and Human Services’ Health Sector Cybersecurity Coordinating Center in its threat brief.

The post Healthcare Sector Warned About Cyberattacks by Iranian State-Sponsored Threat Actors appeared first on HIPAA Journal.

The Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), and the Multi-State Information Sharing and Analysis Center (MS-ISAC) have recently issued guidance for federal and private agencies on the prevention and mitigation of distributed Denial of Service (DDoS) attacks.

These attacks are conducted to overload applications and websites with traffic, thus rendering them inaccessible and preventing legitimate users from accessing that service. A Denial of Service (DoS) attack causes a network resource overload that consumes all hardware, software, and bandwidth, protocol resource overloads consume the available session or connection resources, and application resource overloads use all compute or storage resources.

DDoS attacks are DoS attacks where the traffic comes from multiple devices that are acting together. They can involve huge amounts of traffic and have the potential to cause hardware damage. Botnets – slave armies of malware-infected devices – are commonly used to perform DDoS attacks at scale, and they have become far more common due to the huge increase in IoT devices. The botnets are often rented out to threat actors thus allowing unskilled individuals to conduct DDoS attacks.

These attacks may be short-lived; however, prolonged attacks can significantly disrupt critical services, resulting in extensive remediation costs and substantial reputational damage. These attacks are only concerned with causing disruption and do not involve access being gained to systems or data theft; however, cybercriminal groups are known to conduct DDoS attacks to distract IT teams while an attack is simultaneously conducted on another part of the network. With the attention of security teams focused elsewhere, there is less chance that data exfiltration, malware delivery, or ransomware deployment will be detected. It is therefore vital that any response to a DDoS attack does not result in other security monitoring being neglected.

Preventing and Reducing the Impact of DDoS Attacks

The key to defending against DDoS attacks and reducing their severity is preparation. All critical assets and services that are exposed to the public Internet must be identified, with those applications and services prioritized. Web application firewalls should be implemented to protect the most critical assets, and cybersecurity best practices should be followed, such as hardening servers and patching promptly. Understanding how users connect to the services and identifying any chokepoints can make it easier to implement mitigations to prevent disruption to key staff.

Consider enrolling in a DDoS protection service, ideally, a dedicated DDoS protection service, as those provided by ISPs are not as robust and may not protect against larger attacks. These services allow the source of the attack to be identified and will reroute traffic elsewhere. Managed Service Providers may be able to assist and provide DDoS protection, including providing custom network edge defense services.

Take steps to avoid single points of failure, such as having a high-value asset hosted on a single node. Load balancing across multiple loads is recommended. It is also vital to develop an incident response plan specifically for DDoS attacks. All stakeholders should be aware of their responsibilities through all stages of an attack to ensure a rapid and efficient response is possible. You should also develop a business continuity plan to ensure that business operations can continue in the event of a prolonged attack, and tabletop exercises should be conducted to test those plans.

Steps to Take During an Attack

In the event of a suspected attack, such as when there is network latency, sluggish application performance, unusually high traffic, or the unavailability of websites, technical professionals should be contacted for assistance. Consult your ISP to determine if they have an outage, and learn about the nature of the attack, such as where the traffic is coming from and which applications are being targeted. This will allow you to implement targeted mitigations and work with service providers to get the attack blocked quickly.

While an attack may target a specific application, monitor other network assets, as they may be simultaneously attacked. Specific mitigations for dealing with DDoS attacks are detailed in the MS-ISAC Guide to DDoS Attacks.

Recovering from a DDoS Attack

After an attack, continue to monitor all network assets, learn from the response, and update your incident response plan accordingly to correct any aspects of the response plan that did not run smoothly. You should also ensure you proactively monitor your network and create a baseline of normal activity, as this will allow you to rapidly identify attacks in progress in the future.

The post Feds Issue Guidance on Responding and Reducing Impact of DDoS Attacks appeared first on HIPAA Journal.

The White House has issued a proclamation from President Biden declaring November as Critical Infrastructure Security and Resilience Month – A month dedicated to raising awareness of the need to improve critical infrastructure and strengthening the resilience of critical infrastructure against physical and cyber threats.

President Biden has recommitted to improving and fortifying critical infrastructure, “by building better roads, bridges, and ports; fortifying our information technology and cybersecurity across sectors, including election systems; safeguarding our food and water sources; moving to clean energy; and strengthening all other critical infrastructure sectors,” and by doing so will lay the foundation for long-term security and prosperity.

One of the main focus areas is improving defenses and shielding critical infrastructure against malicious cyber activity. President Biden has confirmed his administration will be establishing clear international rules of the road as they relate to cyberspace. In the United States, most critical infrastructure is owned and operated by private companies. Federal agencies have been working closely with critical infrastructure owners and operators to improve resilience to cyberattacks.

As part of this effort, CISA has recently published a set of cybersecurity performance goals for critical infrastructure organizations to guide their cybersecurity efforts to help them achieve minimum standards for cybersecurity. President Biden has also “reinvigorated the National Infrastructure Advisory Council to advise on how to reduce physical and cyber risks and improve the security and resilience of our Nation’s critical infrastructure sectors.”

CISA is encouraging all critical infrastructure organizations to take steps to improve resilience to cyber threats this November. CISA urges all organizations to strengthen their security plans by gaining a better understanding of the unique risks to their organization and systems, conducting exercises of preparedness plans and updating them with the latest techniques and tactics, focusing on ways risk can be reduced and resilience built on physical and cyber fronts, and considering ways to embed resilience as a foundational design feature when upgrading or building new critical infrastructure.

The post President Biden Declares November as Critical Infrastructure Security and Resilience Month appeared first on HIPAA Journal.

MFA is one of the most important measures to take to prevent unauthorized account access; however, it does not provide complete protection and some forms of MFA can be circumvented. Any form of MFA is better than none at all, but for maximum protection, organizations should implement phishing-resistant MFA, especially in industries such as healthcare that are extensively targeted by malicious cyber actors.

Multifactor authentication requires more than just a password to be provided before account access is granted, with the additional authentication being something a person has (physical device, one-time code) or something they are (fingerprint, voice print, etc.). In the event of a password being stolen in a phishing attack or being guessed using brute force tactics, it makes it much harder for a threat actor to access the account.

Phishing campaigns are now being conducted that use phishing kits with reverse proxies that allow threat actors to steal login credentials, MFA codes, and session cookies to circumvent MFA protection. Some forms of MFA are also susceptible to push bombing, Signaling System 7 (SS7) protocol vulnerabilities, and SIM Swap attacks.

CISA is urging all organizations to implement phishing-resistant multifactor authentication – the gold standard for MFA – or, if that is not possible, to implement number matching MFA. CISA has produced two fact sheets offering guidance for organizations on implementing phishing-resistant MFA and number matching MFA. The latter does not provide as strong protection as phishing-resistant MFA; however, it is suitable as an interim measure for any organization that is currently using mobile push-notification-based MFA and cannot yet switch to phishing-resistant MFA. Number matching helps prevent push bombing, by requiring users to enter a number from the identity platform into the app to approve the authentication request.

FIDO/WebAuthn authentication is the most widely available form of phishing-resistant MFA and is supported by major web browsers, OSs, and smartphones. WebAuthn works with the related FIDO2 standard to provide a phishing-resistant authenticator, such as a physical token connected to a device via USB or NFC, or can be embedded into laptops or mobile devices as platform authenticators. FIDO authentication also supports other forms of authentication such as biometrics and PIN codes.

As an alternative, public key infrastructure (PKI)-based MFA can be implemented. While this form of MFA is less widely available but may be better suited for large organizations. Guidance is offered in the fact sheets on implementing both forms of MFA, including how to prioritize the implementation phases and some of the stumbling blocks organizations can encounter, with advice on how to overcome them.

The post CISA Urges Organizations to Implement Phishing-Resistant Multifactor Authentication appeared first on HIPAA Journal.

Last week, the OpenSSL Project announced a patch would be released on November 1, 2022, to address a critical OpenSLL vulnerability, the details of which were being kept secret to prevent exploitation of the flaw ahead of the patch being released. The news of the vulnerability caused considerable concern amongst the open source community and beyond due to the extent to which  OpenSLL is used – It is extensively used to encrypt communication channels and HTTPS connections, so the implications of such a flaw are enormous.

The news of a critical flaw existing brought back memories of the Heartbleed Bug (CVE-2014-0160) which was exploited to read the memory of systems including servers and routers to eavesdrop on communications. It is now 8 years since that patch was released and there are still 240, 000 publicly accessible servers that remain vulnerable to Heartbleed.

The latest vulnerability affects versions 3.0 to 3.06 of OpenSLL. Version 3 was only released a year ago, so usage of the latest version is limited; however, the vulnerability still has the potential to be extremely serious and has been a major cause of concern. “The short answer is you should be worried,” said Yotam Perkal, Director of Vulnerability Research at Rezilion. As for how worried you should be, Perkal said, “that depends how many vulnerable instances of OpenSSL3.x you have in your environment and do you have the ability to accurately detect them so that you could apply the patch once it’s out.” For many organizations, the answer to the latter will be no. This is why it took so long for the Heartbleed bug to be patched.

The OpenSSL Project announced that the patch for the vulnerability would be released between 13:00 and 1700 UTC on November 1, 2022.

Not One But Two Vulnerabilities

The OpenSSL Project has now confirmed that the vulnerability is not one issue, but two. The two flaws are being tracked as CVE-2022-3602 and CVE-2022-3786, although there is some good news. The severity of the flaws has been downgraded from critical to high severity, and exploiting the flaws would be difficult and require a high level of technical skill.

CVE-2022-3602 is a 4-byte stack buffer overflow that, if exploited, could cause a crash or potentially lead to remote code execution. CVE-2022-3786 is a buffer overflow issue that could be exploited using malicious email addresses in a denial-of-service attack.

The OpenSSL Project said that at the time of releasing the patches, it was not aware of any working exploit in the public domain that would allow remote code execution and that no evidence has been found to indicate either vulnerability has been exploited to date.

The Health Sector Cybersecurity Coordination Center issued an alert about the flaw soon after the OpenSSL Project announced a patch was due for release, warning that exploitation of the flaw was very likely, and may start almost immediately after the publication of the patch. Even though the severity of the flaws is reduced, exploitation is still possible, so prompt patching is recommended if OpenSSL 3.0-3.0.6 has been used. Fortunately, the vulnerable versions of OpenSSL have yet to be heavily deployed in production – Currently, between 7,000 and 16,000 systems are exposed to the Internet and are running vulnerable OpenSSL versions.

Exploitation of the bugs would require a high level of technical skill, which limits the potential for exploitation. Researcher Marcus Hutchins said that while one of the flaws could theoretically lead to RCE, it would be extremely unlikely for the flaw to be exploited and lead to RCE.

That said, OpenSSL warns that “OpenSSL is distributed as source code, we have no way of knowing how every platform and compiler combination has arranged the buffers on the stack, and therefore remote code execution may still be possible on some platforms.”

A list of products confirmed to be affected by the OpenSSL vulnerabilities is being maintained here.

Akamai has released YARA Rules and OSQuery queries that can be used to detect vulnerable instances.

The post OpenSSL Downgrades Bug Severity to High and Releases Patches appeared first on HIPAA Journal.

A warning has been issued to the healthcare and public health sector about a critical vulnerability in the OpenSSL software library. OpenSLL is an open source cryptographic library that is used by most operating systems and applications for implementing Transport Layer Security for secure Internet communications, including connections to websites and web applications.

The OpenSSL project team says the vulnerability affects OpenSSL versions 3.0 to 3.0.6, but does not affect OpenSSL 1.1.1 or LibreSSL. Details about the exact nature of the vulnerability have yet to be disclosed to limit the potential for exploitation. Further information about the vulnerability is expected to be released along with the patch, which will be applied in OpenSLL version 3.0.7. At present, no CVE code has been assigned.

While vulnerabilities have been announced by the OpenSLL project team in the past, critical vulnerabilities are very rare. A critical vulnerability is one that affects common configurations and is likely to be exploited. In 2014, OpenSLL discovered a critical vulnerability dubbed Heartbleed, which could be exploited to obtain passwords or encryption keys. The flaw allowed anyone on the Internet to read the memory of systems that used vulnerable OpenSLL versions. The bug was rapidly exploited by threat actors to eavesdrop on communications, steal data directly from services and users, and to impersonate services and users. Because OpenSLL is so extensively used, the severity of such a vulnerability is enormous. Patching every instance where OpenSSL has been used could take considerable time.

The Health Sector Cybersecurity Coordination Center (HC3) explained in a cybersecurity alert that threat actors are likely to attempt to exploit the vulnerability at large scale, and warns that exploitation may begin very soon after the patch is released. Cybercriminal and nation-state threat actors are likely to immediately begin reverse engineering the patch as soon as it is released to determine the technical details of the vulnerability to allow an exploit to be developed.

HC3 urges all HPH sector organizations to treat this vulnerability with the highest priority and ensure the patch is applied rapidly. In order for that to happen, it will be necessary to find all instances where OpenSSL has been used. OpenSSL Project team says the patch will be released between 13:00 and 1700 UTC on November 1, 2022.

The post Patch Due for Release on November 1, 2022 to Fix Critical OpenSLL Vulnerability appeared first on HIPAA Journal.

A set of cross-sector Cybersecurity Performance Goals (CPGs) have been published by the Cybersecurity and Infrastructure Security Agency (CISA) for critical infrastructure organizations to adopt a minimum cybersecurity standard and better protect their networks and systems from attacks that threaten their ability to operate.

In response to the May 2021 ransomware attacks on the oil pipeline system operator, Colonial Pipeline, and the food processing firm JBS, President Biden signed an Executive Order on Improving the Nation’s Cybersecurity. As part of that initiative, President Biden signed the National Security Memorandum on Improving Cybersecurity for Critical Infrastructure Control Systems on July 28, 2021, which called for CISA to publish a baseline set of CPGs with the aim of improving the cybersecurity of all critical infrastructure in the United States on which Americans depend.

According to CISA, the CPGs are “a prioritized subset of IT and operational technology (OT) cybersecurity practices that critical infrastructure owners and operators can implement to meaningfully reduce the likelihood and impact of known risks and adversary techniques.” The CPGs were developed from existing cybersecurity frameworks and guidance, and in response to real-world threats and the tactics techniques, and procedures that CISA and its partners have observed nation-state and cybercriminal hacking groups using. CISA Director Jen Easterly said the CPGs were “informed by extensive input from experts across sectors, public and private, domestic and international, the CPGs reflect some of the best thinking gleaned from across the cybersecurity community.”

In the United States, the majority of critical infrastructure is owned and maintained by the private sector, which is resistant to cybersecurity regulation. Consequently, it is not mandatory for the CPGs to be adopted by critical infrastructure owners and operators. Compliance is voluntary, although strongly recommended.

The CPGs are unique from other control frameworks, as they consider not only the practices that address risk to individual entities, but also the aggregate risk to the nation. They are intended to help critical infrastructure organizations, especially small- and medium-sized organizations, accelerate their cybersecurity plans and rapidly improve resilience to cyberattacks. The CPGs are not a comprehensive set of practices for developing an effective cybersecurity program. They are a set of prioritized security practices that have proven risk-reduction value, which can be implemented by all critical infrastructure organizations to address the most pressing risks and vulnerabilities that are known to be exploited by malicious actors.

The CPGs cover account security, device security, data security, governance and training, vulnerability management, supply chain and third-party risk management, and response and recovery, and have been written to be easy to understand and communicate to non-technical audiences, including senior business leadership.

The best practices include important cybersecurity measures such as credential management, password management, asset inventories, disabling macros, security log collection and monitoring, data encryption, multifactor authentication, and basic and OT cybersecurity training.

The Biden Administration has stressed that the CPGs are voluntary and there are no reporting requirements. You can view the CPGs here (PDF).

The post CISA Publishes Voluntary Cybersecurity Performance Goals for Critical Infrastructure Organizations appeared first on HIPAA Journal.