The Avaddon ransomware-as-a-service operation was shut down on Friday and the threat group released the decryption keys for all victims. Bleeping Computer was sent an email with password and a link to a password protected ZIP file that contained the private keys for 2,934 Avaddon ransomware victims. The keys were confirmed as legitimate by Emsisoft and Coveware, with the former now having released a free decryptor that can be used by all Avaddon ransomware victims to decrypt their files.

Avaddon is a relatively new ransomware-as-a-service operation which started up in March 2020. The threat group behind the operation recruited affiliates to conduct attacks and provided them with a portal through which they could generate copies of the ransomware to conduct their own attacks. All ransoms generated were then shared between the affiliate and the RaaS operator.

It is not uncommon for RaaS operations to suddenly stop and release the keys for victims that have not yet paid, but the timing of the shut down suggests the RaaS operator may have got nervous with the increased focus of governments and law enforcement agencies on ransomware gangs.

Following the ransomware attacks on JBS and Colonial Pipeline attack, the White House ordered the Department of Justice to centralize its approach to ransomware investigations and treat attacks in the same way as terrorist attacks. White House deputy press secretary Karine Jean-Pierre said it would also be “delivering the message that responsible states do not harbor ransomware criminals,” and will be engaging with the Russian government to try to get action taken against ransomware gangs that operate in the country.

The G7 nations also committed to take action on ransomware attacks and issued a communique calling on Russia and other countries that may harbor ransomware gangs to take steps to identify, disrupt, and hold individuals to account who are conducting ransomware attacks, abusing virtual currency to launder ransom, and commit other cybercrimes. President Biden is also expected to speak with Vladimir Putin at the Geneva summit on June 16 about ransomware gangs operating out of Russia.

Following the DarkSide ransomware attack on Colonial Pipeline that disrupted fuel supplies to the eastern seaboard, the DarkSide ransomware gang announced it was shutting down. The REvil and Avaddon gangs issued a joint statement saying they were updating their rules and would not permit its affiliates to conduct ransomware attacks on critical infrastructure firms, governments, healthcare organizations, and educational institutions. It would appear that this was not enough for the Avaddon ransomware gang. It remains to be seen whether the operation has permanently been shut down or if the operator of the ransomware is just laying low for a while. It is not uncommon for ransomware operations to shut down then rebrand and recommence their attacks several weeks or months later.

“The recent actions by law enforcement have made some threat actors nervous: this is the result. One down, and let’s hope some others go down too,” said Emsisoft threat analyst Brett Callow to Bleeping Computer.

The post Avaddon Ransomware Operation Shuts Down and Releases Decryption Keys appeared first on HIPAA Journal.

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a security advisory warning about 6 vulnerabilities in the ZOLL Defibrillator Dashboard, including one critical 9.9 severity remote code execution flaw.

The vulnerabilities were reported to CISA anonymously and affect all versions of the ZOLL Defibrillator Dashboard prior to version 2.2. Some of the flaws can be exploited remotely and require a low level of skill to exploit.

Exploitation of the vulnerabilities could allow non-admin users to achieve remote code execution and steal credentials, which would impact the confidentiality, integrity, and availability of the application.

ZOLL has confirmed that all 6 vulnerabilities have been fixed in version 2.2 of the ZOLL Defibrillator Dashboard. Customers have been advised to upgrade the solution to version 2.2 or later as soon as possible. ZOLL also explained that in the event of any discrepancy with the Defibrillator Dashboard, the defibrillator device should be considered the source of accurate data.

The vulnerabilities are as follows:

There are not believed to have been any attempted exploits of the vulnerabilities in the wild.

The post Patch Issued to Fix Critical RCE Vulnerability in ZOLL Defibrillator Dashboard appeared first on HIPAA Journal.

A critical remote code execution vulnerability in VMware vCenter Server and VMware Cloud Foundation is being actively exploited by cyber actors to take full control of unpatched systems. The flaw, tracked as CVE-2021-21985, was announced by VMWare in late May and a patch was released to correct the flaw on May 25, 2021.

The Cybersecurity and Infrastructure Security Agency (CISA) recently issued an alert warning all users of VMware vCenter Server and VMware Cloud Foundation that the vulnerability is an attractive target for attackers and there is a high risk of exploitation. A reliable proof-of-concept exploit for the vulnerability is now in the public domain.

There are thousands of vulnerable vCenter servers accessible over the Internet that are vulnerable to attack. Mass scanning for VMware vSphere hosts vulnerable to RCE attacks are currently being conducted and several security researchers have reported the honeypots they set up with vulnerable versions of VMware vCenter Server have been scanned for the vulnerability.

Today, the Department of Health and Human Services’ Office for Civil Rights issued a cyber alert reiterating the importance of patching the vulnerability, explaining CISA identified several agencies that have not yet applied the patch and are vulnerable to attack.

According to VMWare, “A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.”

Security researcher Kevin Beaumont said his honeypot was infected with a web shell after the vulnerability was exploited. “vCenter is a virtualization management software,” he said. “If you hack it, you control the virtualization layer (e.g., VMware ESXi)—which allows access before the OS layer (and security controls). This is a serious vulnerability, so organizations should patch or restrict access to the vCenter server to authorized administrators.”

If it is not possible to apply the patches immediately, there are workarounds available that can reduce the risk of exploitation. These workarounds should be implemented immediately.

The post Critical VMWare VCenter Software Vulnerability Under Attack appeared first on HIPAA Journal.

Two medium severity vulnerabilities have been identified in Hillrom medical device management tools which could result in the leakage of sensitive data, corruption of data, and remote code execution.

An out-of-bounds write vulnerability – tracked as CVE-2021-27410 – could allow an attacker to cause memory corruption which would allow the remote execution of arbitrary code. While remote code execution is possible, exploiting the flaw is highly complex. The flaw has been assigned a CVSS v3 severity score of 5.9 out of 10.

The second flaw is an out-of-bounds read issue that could result in information leakage and arbitrary code execution if combined with the out-of-bounds write vulnerability. The flaw is tracked as CVE-2021-27408 and has been assigned a CVSS severity score of 5.9.

The flaws affected the following Hillrom Welch Allyn medical device management tools:

• Welch Allyn Service Tool: versions prior to v1.10
• Welch Allyn Connex Device Integration Suite – Network Connectivity Engine (NCE): versions prior to v5.3
• Welch Allyn Software Development Kit (SDK): versions prior to v3.2
• Welch Allyn Connex Central Station (CS): versions prior to v1.8.6
• Welch Allyn Service Monitor: versions prior to v1.7.0.0
• Welch Allyn Connex Vital Signs Monitor (CVSM): versions prior to v2.43.02
• Welch Allyn Connex Integrated Wall System (CIWS): versions prior to v2.43.02
• Welch Allyn Connex Spot Monitor (CSM): versions prior to v1.52
• Welch Allyn Spot Vital Signs 4400 Device (Spot 4400) / Welch Allyn Spot 4400 Vital Signs Extended Care Device: versions prior to v1.11.00

The vulnerabilities were identified by Itamar Cohen-Matalon of Medigate Reserach Labs who reported the vulnerabilities to Hillrom. Hillrom has now released software updates to correct the flaws. Customers are advised to upgrade to the latest versions of the software to fix the flaws to prevent exploitation. At present, there are no reported cases of exploitation of the vulnerabilities.

Product versions with the vulnerabilities corrected are listed below:

• Welch Allyn Service Tool: v1.10
• Welch Allyn Connex Device Integration Suite – Network Connectivity Engine (NCE): v5.3 (available Summer 2021)
• Welch Allyn Software Development Kit (SDK): v3.2
• Welch Allyn Connex Central Station (CS): v1.8.6 (available Fall 2021)
• Welch Allyn Service Monitor: v1.7.0.0
• Welch Allyn Connex Vital Signs Monitor (CVSM): v2.43.02
• Welch Allen Connex Integrated Wall System (CIWS): v2.43.02
• Welch Allyn Connex Spot Monitor (CSM): v1.52
• Welch Allyn Spot Vital Signs 4400 Device (Spot 4400) / Welch Allyn Spot 4400 Vital Signs Extended Care Device: v1.11.00 (available Fall 2021)

Hillrom also recommends applying proper network and physical security controls, applying authentication for server access, and applying data execution prevention (DEP) where possible to prevent shellcode from running.

The post Vulnerabilities Identified in Hillrom Medical Device Management Products appeared first on HIPAA Journal.

Five vulnerabilities have been identified in the MesaLabs AmegaView continuous monitoring system used in hospital laboratories, forensics labs, and biotech firms. Two of the flaws are critical command injection vulnerabilities with CVSS severity scores of 9.9/10 and 10/10. The vulnerabilities affect AmegaView Versions 3.0 and prior and were identified by Stephen Yackey of Securifera.

In order of severity, the vulnerabilities are as follows:

• CVE-2021-27447 – CVSS 10/10 – Flaw due to improper neutralization of special elements used in a command, which could allow an attacker to execute arbitrary code.
• CVE-2021-27449 – CVSS 9.9/10 – Flaw due to improper neutralization of special elements used in a command, which could allow an attacker to execute commands in the web server.
• CVE-2021-27445 – CVSS 7.8/10 – Insecure file permissions which could be exploited to elevate privileges on the device.
• CVE-2021-27451 – CVSS 7.3/10 – Improper authentication due to passcodes being generated by an easily reversible algorithm, which could allow an attacker to gain access to the device.
• CVE-2021-27453 – CVSS 7.3/10 – Authentication bypass issue that could allow an attacker to gain access to the web application.

There are currently no public exploits that specifically target these vulnerabilities. Since AmegaView reaches end-of-life at the end of this year, MesaLabs has taken the decision not to release patches to correct the vulnerabilities. Instead, all users of the vulnerable products have been advised to upgrade to newer Viewpoint software compatible with AmegaView hardware.

Should this not be possible, or until it is, it is recommended to locate vulnerable products behind firewalls and to isolate them from the network and ensure they are not accessible from the Internet. If remote access is required, Virtual Private Networks (VPNs) should be required for access, and VPNs should be updated to the most current version.

Prior to implementing any new defensive measures, an impact analysis and risk assessment should be performed.

The post Critical Vulnerabilities identified in MesaLabs Laboratory Temperature Monitoring System appeared first on HIPAA Journal.

The Federal Bureau of Investigation (FBI) has issued a Flash Alert warning users of Fortinet Fortigate appliances that Advanced Persistent Threat (APT) groups are targeting devices that have not been patched for three CVEs: CVE-2018-13379, CVE-2019-5591, and CVE-2020-12812.

These are not zero-day vulnerabilities, as patches have been available for some time. Many organizations have been slow to apply the patches and are now being targeted. In early April, the FBI, in conduction with the DHS’ Cybersecurity and Infrastructure Security Agency (CISA) issued a Joint Cybersecurity Advisory warning that the vulnerabilities could be exploited by threat actors to conduct data exfiltration, data encryption, and to pre-position for follow-on attacks.

In the recent Flash Alert, the FBI confirmed that an APT actor has been attempting to exploit the vulnerabilities since at least May 2021, and almost certainly exploited the vulnerabilities to gain access to a webserver hosting the domain for a U.S. municipal government. In that instance, the threat actors most likely created a new account – named elie – for conducting further malicious activities on the network.

Attacks exploiting the vulnerabilities do not appear to be targeted on any specific industry sector, instead the APT actor is simply attempting to exploit unpatched vulnerabilities. To date, victims have been in a broad range of industry sectors.

The APT actor creates new user accounts on domain controllers, servers, workstations, and the active directories. In addition to creating accounts named elie and WADGUtilityAccount, new accounts have been created to look similar to legitimate existing accounts on the network and have been specific to each victim organization.

The APT actor is known to make modifications to the Task Scheduler that may display as unrecognized scheduled tasks or ‘actions’, in particular, associated with SynchronizeTimeZone. Several tools have been used in the attacks, including Mimikatz for credential theft, MinerGate for cryptocurrency mining, WinPEAS for privilege escalation, SharpWMI for Windows Management Instrumentation, BitLocker for data encryption, and FileZilla for file transfers, with outbound FTP transfers identified over port 443.

Users of Fortigate appliances should ensure that patches are applied as soon as possible to correct the above vulnerabilities, and non FortiOS users should add key artifact files used by FortiOS to execution denylists to block any attempts to run FortiOS and its associated files.

Since exploitation may have already occurred, system administrators should review domain controllers, servers, workstations, and active directories for new or unrecognized user accounts and Task Scheduler should be reviewed for any unrecognized scheduled tasks. The FBI also recommends manually reviewing operating system defined or recognized scheduled tasks for unrecognized “actions.” Antivirus logs should also be reviewed for indications that they were unexpectedly turned off.

Further mitigations to deal with the threat are detailed in the Flash Alert, a copy of which is available from the American Hospital Association on this link.

The post FBI Warns of Ongoing Exploitation of Fortinet Vulnerabilities by APT Actors appeared first on HIPAA Journal.