The Iran-based hacking group known as Silent Librarian – aka Cobalt Dickens and TA407 – has recommenced spear phishing attacks on universities in the United States and around the world. The hacking group has been conducting attacks since 2013 to gain access to login credentials and steal intellectual property and research data. Credentials and data stolen in the attacks are subsequently sold via the hacking group’s portals.

The U.S. Department of Justice indicted 9 Iranians in connection with the attacks in 2018, but the indictments have had no effect on the campaigns which have continued. Those individuals have yet to be brought to justice.

The spear phishing campaigns usually recommence in September to coincide with the start of the new academic year. The hackers have developed many different phishing websites which are used in the campaigns, and while many of these sites are taken down, sufficient numbers are used to ensure the campaigns can continue. This year, the group is known to be using sites hosted in Iran, which could hamper efforts to have the sites shut down due to a lack of cooperation between Iran and the United States and Europe.

Spear phishing emails are highly targeted and are sent to relatively few individuals at each targeted institution. The emails often spoof university libraries and prompt users to click links and login to the university’s web portal.

The domains used in the campaign closely resemble the official domains used by the universities. For instance, attacks on Western University Canada use login.proxy1.lib.uwo.ca.sftt.cf instead of login.proxy1.lib.uwo.ca, and the campaign targeting Stony Brook University uses the domain blackboard.stonybrook.ernn.me instead of blackboard.stonybrook.edu.

The threat group is known to use URL shortening services for links to the phishing domains to mask the true destination URL. Malwarebytes, which discovered the latest campaign, reports that Silent Librarian is using Cloudflare this year for most of their phishing hostnames to hide the real origin of the sites, which are mostly hosted in Iran this year.

The landing pages on the phishing pages are virtual carbon copies of those used by the universities being targeted, so if a user lands on one of those pages and fails to identify the incorrect URL, there is a strong likelihood that login credentials will be entered and captured by the group.

This year’s campaign could be even more effective. Many students and staff are remote due to COVID-19, which could potentially be exploited to steal more credentials and data.

The hacking group is known to have conducted attacks on at least 40 organizations and more than 140 educational institutions since 2013 and was discovered to have stolen more than 30 TB of data between 2013 and 2017. Malwarebytes reports that well over a dozen universities are known to have been targeted in the latest campaign, but says only a small sample of the emails have been intercepted and the campaign is likely to be far more extensive.

The post Universities Targeted in Silent Librarian Spear Phishing Campaign appeared first on HIPAA Journal.

On October 2020 Patch Tuesday, Microsoft released a patch to correct a critical remove code execution vulnerability in the Microsoft Windows Transmission Control Protocol (TCP)/IP stack. The flaw concerns how the TCP/IP stack handles Internet Control Message Protocol version 6 (ICMPv6) Router Advertisement packets. The flaw was assigned a CVSS v3 score of 9.8 out of 10.

While all patches should be applied promptly to prevent exploitation, there is usually a delay between patches being released and exploits being developed and used offensively against organizations; however, due to the severity of the flaw and the ease at which it can be exploited, patching this vulnerability is especially important. So much so that the Department of Homeland Security Cybersecurity and Infrastructure Security Agency (CISA) took to Twitter to urge all organizations to apply the patch immediately.

An attacker could exploit the flaw remotely in a Denial of Service attack, resulting in a ‘blue screen of death’ system crash; however, exploitation could also allow the remote execution of arbitrary code on the vulnerable systems. To exploit the flaw, an unauthenticated hacker need only send specially crafted ICMPv6 Router Advertisement to a vulnerable Windows computer – A device running Windows 10 1709 to 2004, Windows Server versions 1903 to 2004, or Windows Server 2019.

While there have been no known exploits of the vulnerability in the wild, the flaw will be attractive to hackers. McAfee Labs reports that a proof-of-concept exploit for the flaw was sent to Microsoft Active Protection Program members that it reports is “extremely simple and perfectly reliable.”  In addition to being easy to exploit, the vulnerability is potentially wormable, so attacking one device could easily see all other vulnerable devices on the network similarly compromised.

McAfee Labs nicknamed the vulnerability “Bad Neighbor” as it resides in the ICMPv6 Neighbor Discovery “Protocol”, using the Router Advertisement type, and is due to the TCP/IP stack improperly handling ICMPv6 Router Advertisement packets that use Option Type 25 (Recursive DNS Server Option) and a length field value that is even.

If it is not possible to patch immediately, mitigations need to be implemented to reduce the potential for exploitation.

Microsoft recommends administrators disable ICMPv6 RDNSS to prevent exploitation. This can be achieved using a simple PowerShell command:

netsh int ipv6 set int *INTERFACENUMBER* rabaseddnsconfig=disable

However, this option will disable RA-based DNS configuration, so cannot be used on network infrastructure that relies on RA-based DNS configuration. Also, this mitigating measure is only effective on Windows 10 1709 and later versions.

Alternatively, it is possible to prevent exploitation by disabling ipv6 traffic on the NIC or at the network perimeter, but this is only possible if ipv6 traffic is not essential.

The post Patch Wormable ‘Bad Neighbor’ Windows TCP/IP Flaw Now, Warns CISA appeared first on HIPAA Journal.

Following a period of dormancy between February 2020 and July 2020, the Emotet botnet sprang back to life and recommenced spam runs distributing the Emotet Trojan. Since August 2020, attacks on state and local governments have increased sharply, prompting the Department of Homeland Security Cybersecurity and Infrastructure Security Agency (CISA) to issue a cybersecurity alert for all industry sectors.

The Emotet botnet resumed activity in July with a massive phishing campaign using messages with malicious Word attachments and hyperlinks. Since then, multiple spam runs have been conducted which typically consist of more than 500,000 emails. The Emotet Trojan is a dangerous banking Trojan which is used as a downloader of other types of malware, notably the TrickBot and Qbot Trojans. The secondary payloads in turn deliver other malware payloads, including Ryuk and Conti ransomware.

One infected device could easily result in further infections across the network. Emotet infects other devices in a worm-like fashion, creating multiple copies of itself which are written to shared drives. Emotet also brute forces credentials and distributes copies of itself via email. Emotet is capable of hijacking genuine email threads and inserting malicious files. Since the emails appear to have been sent by known contacts in response to previously sent messages, there is a higher probability of the email attachments being opened.

The Trojan is continuously evolving using dynamic link libraries and regularly has new capabilities added. The capabilities of the Trojan make it difficult to eliminate from networks. The Trojan can be removed from infected devices, but they can quickly be reinfected by other compromised devices on the network.

CISA and the Multi-State Information Sharing & Analysis Center (MS-ISAC) have been collecting data on Emotet attacks and Emotet loader downloads since botnet activity resumed in July. CISA’s EINSTEIN Intrusion Detection System, which protects federal, civilian executive branch networks, identified around 16,000 alerts about Emotet activity since July, including potentially targeted attacks on state and local governments. Compromises have also been reported in Canada, France, Italy, Japan, New Zealand, and the Netherlands.

CISA regards Emotet as one of the most prevalent ongoing threats, and its secondary malware payloads of TrickBot and Qbot are also significant threats, as are the ransomware payloads they deliver.

The phishing emails used to distribute the Emotet loader are diverse and often change. COVID-19 themes emails have been used this year along with many lures aimed at businesses. The email attachments are typically malicious Word documents, although password protected zip files have also been used to evade anti-spam and anti-phishing solutions. The emails often claim that attachments have been created on mobile device and require the user to enable content (and by doing so enable macros) to view the files.

To prevent Emotet malware attacks, CISA and MS-ISAC recommend adopting cybersecurity best practices which include applying protocols to block suspicious attachments, including attachments that cannot be scanned by AV solutions such as password-protected files. Antivirus software should be used on all devices and set to update automatically, suspicious IPs should be blocked, DMARC authentication and multi-factor authentication should be implemented, organizations should adhere to the principle of least privilege, and should segment and segregate networks and disable file and printer sharing services (if possible).

The full list of recommended mitigations are detailed in the CISA alert.

The post CISA Issues Alert Following Increase in Emotet Malware Attacks appeared first on HIPAA Journal.

The National Institute of Standards and Technology (NIST) has released updated guidance on Security and Privacy Controls for Information Systems and Organizations (NIST SP 800-53 Revision 5).

This is the first time that NIST has updated the guidance since 2013 and is a complete renovation rather than a minor update. NIST explained that the updated guidance will “provide a solid foundation for protecting organizations and systems—including the personal privacy of individuals—well into the 21st century.”

The updated guidance is the result of years of effort “to develop the first comprehensive catalog of security and privacy controls that can be used to manage risk for organizations of any sector and size, and all types of systems—from super computers to industrial control systems to Internet of Things (IoT) devices.”

This is the first control catalog to be released worldwide that includes privacy and security controls in the same catalog. The guidance will help to protect organizations from diverse threats and risks, including cyberattacks, human error, natural disasters, privacy risks, structural failures, and attacks by foreign intelligence agencies. The controls detailed in the guidance will help organizations take a proactive and systematic approach to protecting critical systems, components and services and will ensure they have the necessary resilience to protect the economic and national security interests of the United States.

The guidance is intended to help government agencies and their third-party contractors meet the requirements of the Federal Information Security Management Act and it will be mandatory for government agencies to implement the new provisions detailed in the updated guidance. The guidelines are voluntary for private sector organizations, although the private sector is being encouraged to adopt the new guidelines to tackle privacy and security issues.

There have been several major updates to the guidance, which include:

• New, ‘state-of-the-practice’ controls to protect critical and high value assets. The revisions have been based on the latest threat intelligence and cyber attack data and will improve cyber resiliency, support secure system design, security and privacy governance and accountability.
• Information security and privacy controls have been integrated into a seamless, consolidated control catalog for systems and organizations.
• Controls are now outcome-based, with the entity responsible for implementing the controls removed from the document. The guidance now focuses on the protection outcome from implementing the controls.
• Standards have been incorporated for supply chain risk management with guidance provided on how to integrate those standards throughout an organization.
• The guidance incorporates next generation privacy and security controls, and includes guidelines for how to use them.
• Control selection processes have been separated from the controls to make it easier for the controls to be used by different communities of interest.
• Descriptions of content relationships have been improved, clarifying the relationship between requirements and controls and the relationship between security and privacy controls.

“The controls offer a proactive and systematic approach to ensuring that critical systems, components, and services are sufficiently trustworthy and have the necessary resilience to defend the economic and national security interests of the United States,” explained Ron Ross, NIST Fellow and co-author of the document.

The post NIST Publishes Updated Security and Privacy Controls Guidance for Information Systems and Organizations appeared first on HIPAA Journal.

The Department of Homeland Security Cybersecurity and Infrastructure Security Agency (CISA) has issued an alert following a surge in LokiBot malware activity over the past two months.

LokiBot – also known as Lokibot, Loki PWS, and Loki-bot – first appeared in 2015 and is an information stealer used to steal credentials and other sensitive data from victim machines. The malware targets Windows and Android operating systems and employs a keylogger to capture usernames and passwords and monitors browser and desktop activity. LokiBot can steal credentials from multiple applications and data sources, including Safari, Chrome, and Firefox web browsers, along with credentials for email accounts, FTP and sFTP clients.

The malware is also capable of stealing other sensitive information and cryptocurrency wallets and can create backdoors in victims’ machines to provide persistent access, allowing the operators of the malware to deliver additional malicious payloads.

The malware establishing a connection with its Command and Control Server and exfiltrates data via HyperText Transfer Protocol. The malware has been observed using process hollowing to insert itself into legitimate Windows processes such as vbc.exe to evade detection. The malware can also create a duplicate of itself, which is saved to a hidden file and directory.

The malware may be relatively simple, but that has made it an attractive tool for a wide range of threat actors and LokiBot is used in a wide variety of data compromise use cases.  Since July, CISA’s EINSTEIN Intrusion Detection System identified a significant increase in LokiBot activity.

LokiBot is most commonly distributed via email as a malicious attachment; however, since July, the malware has been distributed in a variety of different ways, such as links to websites hosting the malware sent by SMS and via text messaging apps.

Information stealers have proven popular during the COVID-19 pandemic, especially LokiBot. LokiBot was the most commonly detected information stealer in the first half of 2020, according to F-Secure.

CISA has shared best practices to adopt to strengthen defenses against LokiBot and other information stealers. These include:

• Deploying antivirus software and ensuring virus definition lists are kept up to date
• Applying patches for vulnerabilities promptly
• Disabling file and printer sharing services. If not possible, set strong passwords or use AD authentication
• Use multi-factor authentication on accounts
• Restrict user permissions to install and run software applications
• Enforce the use of strong passwords
• Provide training to the workforce and encourage workers to exercise caution when opening email attachments
• Deploy a spam filtering solution
• Use a personal firewall on workstations and configure the firewall to deny unsolicited connection requests
• Monitor web activity and consider using a web filter to prevent employees from accessing unsavory websites
• Scan all software downloaded from the Internet prior to executing

The post CISA Issues Alert Following Surge in LokiBot Malware Activity appeared first on HIPAA Journal.