Categories
Security

Don’t drink the water — it’s been hacked

That’s a scary title, isn’t it? It could have been the headline in newspapers this week had it not been for the watchful eye of a water treatment plant operator in Oldsmar, Florida.

Last week, a hacker (or group of hackers) attempted to poison a Florida city’s water supply by accessing a dormant remote access software platform. If it hadn’t been caught in time, at least 15,000 people could have been affected.

Law enforcement, including the FBI, the Secret Service, and the Pinellas County Sheriff’s Office are currently investigating how the threat actor got in and who would want to do this. What we know so far is that a plant operator at the Oldsmar water treatment facility noticed someone remotely accessing the computer system he was monitoring — once at about 8:00am and again at 1:30pm — to open the function that controls the amount of sodium hydroxide (lye) in the water.

Lye is used to treat acidity in water by raising its pH levels and removing heavy metals. Too much lye in the water could cause skin burns and rashes — and the hacker changed the lye ration from about 100 parts per million to 11,100 parts per million. This is obviously a significant and potentially dangerous increase. After the attacker left the system, the operator quickly reduced the lye concentration level back to normal, so there was no adverse effect on the water. Importantly, the water treatment plant had redundancies in place, so if the operator had missed the hacker’s intrusion, the system would have caught the change in time.

So, what was this? A test by nation-state actors? An attempt to severely harm the townspeople of Oldsmar? As of this writing, there are no indications that this was targeted attack. The Pinellas County Sheriff’s office doesn’t have a suspect but is following leads — none of which point to terrorism. It may simply have been an act of vandalism. Vulnerable Internet-connected Industrial Control Systems (ICS) are not difficult to find.

In the case of the Oldsmar water treatment facility, the attack was neither successful nor sophisticated. A remote access software tool was either exposed to the open Internet or accessed via brute force/password. (Although law enforcement say they don’t know how hackers got onto the system, a CNN source counters that a password was required to operate the software remotely.) Unfortunately, a sophisticated attack isn’t required to render a dangerous result, and what happened at Oldsmar simply highlights how many critical infrastructure systems are vulnerable.

IT and security professionals charged with securing vital infrastructure needn’t panic — the first priority here isn’t shielding against complex zero-days or advanced persistent threats. Instead, it’s the kind of grunt work facing all in cybersecurity today, such as patching, air-gapping, and enforcing two-factor authentication. My advice for anyone in infrastructure or others using remote access software:

  • Be careful with how much remote access software you deploy on your network. You should never leave this software unused for long periods, especially if it’s left open to the Internet.
  • Ensure that the remote access software you do have is configured properly. Open it only to staff that require remote access, and require they access it using a strong password and 2FA.
  • Remote Desktop Protocol (RDP) should be kept closed or used with protection, such as our Brute Force Protection module in Malwarebytes Nebula.

To learn more about the hack of the Florida city water facility, read our blog on Malwarebytes Labs:
https://blog.malwarebytes.com/hacking-2/2021/02/hackers-try-to-poison-florida-citys-drinking-water/

Categories
Security

Emotet bites the dust… or does it?

If I never hear the name “Emotet” again, I’d be a pretty happy guy. But it’s worth bringing up this bad boy one more time to announce its demise — or at least the beginning of its end.

On January 27, Europol announced that law enforcement agencies from eight countries seized control of the Emotet botnet in a coordinated effort, putting a stop to more than six years of torment from one of the world’s most dangerous forms of malware.

Although the culprit has been metaphorically locked up, the final blow won’t be delivered until April 25, when an update pushed out to all infected servers will wipe them clean of Emotet once and for all. How did law enforcement finally shut down this banking-Trojan-turned-beast? Why are they waiting until April to wipe it out? What are the ethical pitfalls of pushing code — even “good” code — onto these infected networks?

Law enforcement bests Emotet in TKO

The notorious Emotet botnet, which first appeared as a banking Trojan in 2014, is known for its consistent ability to shapeshift, which allowed it to avoid detection and drop other vicious malware in its wake. Over the more recent years, it wreaked havoc on organizations with other partners, including the equally dangerous TrickBot and Ryuk ransomware.

On January 27, Emotet met its match when agencies from the United States, United Kingdom, Germany, the Netherlands, and more gained control of its infrastructure and took it down from the inside. In a statement announcing the action, Europol described Emotet’s infrastructure as involving several hundred servers across the world, all of which had different functionalities: to manage computers of the infected victims, to spread to new ones, to serve other criminal groups, and to make the network more resilient against takedown attempts.

The global effort to bring down Emotet’s complex web of servers and controllers, dubbed Operation Ladybird, should not be underestimated. Law enforcement coordinated with security researchers from the private sector to take over Emotet’s C&C infrastructure — located in more than 90 countries — while simultaneously arresting at least two of the cybercriminal crew members behind it.

“Unlike the recent and short-lived attempt to take down TrickBot, authorities have made actual arrests in Ukraine and have also identified several other individuals that were customers of the Emotet botnet,” said Jérôme Segura, Director of Threat Intelligence for Malwarebytes. “This is a very impactful action that likely will result in the prolonged success of this global takedown.”

In its press release, Europol described the approach to Emotet’s take-down as “unique and new.” While details of how Operation Ladybird were able to disrupt the Emotet botnet are still emerging, we do know that infected machines have been redirected toward the law enforcement-controlled infrastructure. This effectively removes the threat posed by Emotet by preventing it from contacting the infrastructure it uses to receive updates and deliver malware.

Shortly after the Emotet infrastructure was seized, Dutch authorities deployed an update: a special cleanup payload with code to remove the malware from infected computers on April 25. Why so far away? The lengthy delay gives system administrators time for forensic analysis and to check for other infections that Emotet may have left behind. After Emotet uninstalls itself on April 25, these investigations will be harder to carry out.

But pushing code via botnet, even with the best of intentions, has always been a thorny topic. In this case, law enforcement took control of one of the most significant botnets of the decade — but instead of dismantling it, they pushed an update that will likely impact many thousands of organizations and endpoints — without consent. The end result is positive, of course. But what about the ramifications? The DOJ actually distanced itself from the update, stating in its affidavit that “foreign law enforcement agents, not FBI agents, replaced the Emotet malware, which is stored on a server located overseas, with the file created by law enforcement.”

What are your thoughts about the downfall of Emotet? Do you think this is the last we’ll hear of it? Do you believe it was a good idea to deploy the Emotet update, even without consent?

To read the Department of Justice’s official release on the operation that took down Emotet: https://www.justice.gov/opa/pr/emotet-botnet-disrupted-international-cyber-operation

Categories
General

Privacy made simple: translating EULAs into perfect prose

The problems with long-winded, small-printed EULAs and Terms of Service (TOS) have long been lamented. Packed with jargon and legalese, it’s well-known these lengthy documents receive a skim of the eye at best before users click “I agree.” According to Visual Capitalist, it can take longer to read the TOS of some online companies than it does to read an entire book. That’s great news for an organization trying to hide shady privacy practices. But what about users who care about how their data is used by the businesses they support?

Beyond the content itself, the timing and format of TOS and EULAs — typically served via pop-up once users have already decided to install the product — encourages users to blow past the fine print instead of stopping to educate themselves. In addition, some EULAs include sections in all capital letters, a throwback to when these contracts were written using a typewriter. Instead of having the intended effect of getting the reader to pay more attention to those sections, trying to scan all-caps paragraphs via browser is a visual nightmare.

But again, why should organizations care if most people click through and accept those terms blindly? Setting aside any moral obligations for a second, privacy is becoming more and more important to users in the wake of various abuses of personal data by organizations, such as social media giants, parental monitoring apps, and other online platforms. In early January, WhatsApp made changes to its privacy policy that allowed for more sharing of its users’ data between Facebook-owned apps. Its userbase promptly flocked to Telegram and Signal, driving downloads of those more private messengers into the millions. Organizations such as ProtonMail, DuckDuckGo, and Apple have also baked privacy into their brand identities, framing it as a commodity that gives them a competitive edge.

To help privacy-conscious users better understand how your organization is using their data, it’s important to simplify the language of privacy policies, TOS, and EULAs, or add plain language “translations” next to legal jargon. In addition, explaining why your organization needs to collect particular data — for certain functions of the software or for better metrics/performance — helps educate users on which data is critical for product functionality, which is optional, and which should be anonymous or discarded. Describing the why also helps users establish trust in your organization and keeps their confidence high should changes need to be made to the policy in the future.

If establishing trust in your data and privacy policies is of interest, you’ll want to revise your legal documents like Terms of Service, EULAs, and privacy policy, as well as portions of your website or even advertising campaigns to include readable prose. Some advice on how includes:

  • Section off portions of legal language required for a contract and list their plain language “translations” parallel to or below the sections they describe.
  • Clearly identify the types of data collected by your organization/product and explain why that data is needed.
  • Use both the company website and blog to outline your organization’s views on privacy to customers earlier in the buyer’s journey — before they are ready to install. In this way, users will spend more time with the content and absorb it in a visually appealing format (as opposed to a wall of text crammed into a small pop-up).
  • Raise awareness of your privacy-positive positioning through advertising and content marketing campaigns, SEO, press, or even through advocacy.

Ideally, by crafting smart privacy policies that protect users and clearly communicate which data you will use and why, your prospects will have a solid sense of where you stand on privacy long before they click “Install.” And if you manage to make privacy a commodity that your customers are willing to pay for: Congratulations! You’ve done the right thing by your users and you’ll profit from it. Win, win!

For a look at Malwarebytes’ privacy policy, check out our webpage: https://www.malwarebytes.com/privacy/

Happy Privacy Day!

Categories
Security

Greatest cybersecurity hits of 2020

It’s been an unprecedented year for cybersecurity. The pandemic has forced organizations to evolve at breakneck speeds, strong-arming a distributed, remote work model for millions of employees at once — and in the process, leaving corporate networks more vulnerable. Distance learning has brought IT and security issues into every student’s and teacher’s living rooms. The increase in online shopping has lured cybercriminals to take advantage via digital skimming. As we close out this most difficult year, it might appear that the cybercriminals have the upper hand.

Yet as I look back on the scams, phishing campaigns, new malware strains, and sophisticated attacks, I also see teams of IT and security professionals adapting swiftly to wave after wave of obstacles. I see Herculean efforts to keep companies up and running and students learning. I see researchers, analysts, system admins, technicians, directors, and CISOs working together to solve complicated problems. And that makes me hopeful as we head into 2021 and face new challenges. So, let’s take a look back at some of the major cyber events of 2020 and keep their lessons fresh in our minds as we tackle the new year with fortitude, resilience, and renewed optimism.

We may have kicked off this year with 20/20 vision, but none of us had the foresight to predict what was to come. Not long after the beginning of the year, the coronavirus hit in the United States and its first impacts to cybersecurity were cancellations of major conferences. However, as cases rapidly increased through March, it became clear that we had to hunker down and stay in our homes. This, of course, brought on a massive shift to remote work.

For resources on the impact of working from home on security:

As more and more states issued social distancing, masking, and shelter-in-place orders, cybercriminals (ever the opportunists) capitalized on the rising fear with COVID-19 misinformation campaigns, phishing emails that dropped Emotet payloads, and even APT attacks using the coronavirus as a lure. Here are a few stories featuring the ways in which threat actors leveraged public fear and confusion about the virus to their advantage:

Meanwhile, cyberattacks on organizations, a carry-over trend from 2019, picked up pace on SMBs through large enterprise. The malware of choice? Ransomware. Ransomware variants became stealthier and harder to remove as the threat actors behind them became bolder, double-dipping on extortion and raising ransom prices through the roof. Here are just a few of the notable ransomware attacks of 2020:

Attacks on ecommerce platforms, schools/distance learners, and of course the latest discovery of the alleged Russian hack of federal government agencies and IT/security companies round out an astonishing year in cybersecurity. In comparison, the entire previous decade seems pretty tame!

For other takes on the year in cybersecurity, take a look at the following: https://www.techradar.com/news/2020-could-be-the-worst-year-in-cybersecurity-history

https://www.govtech.com/blogs/lohrmann-on-cybersecurity/2020-the-year-the-covid-19-crisis-brought-a-cyber-pandemic.html

And for a look ahead at 2021, Security Magazine has five predictions: https://www.securitymagazine.com/articles/94223-cybersecurity-predictions-for-2021

Categories
Security

The cyberattack that could only happen in 2020

I’m sure you already heard the news. Last week, we learned that (likely) Russian nation-state hackers conducted a massive APT attack that impacted thousands of companies and government agencies through tainted updates of the SolarWinds Orion platform. This sophisticated supply-chain attack ensnared over 200 public and private organizations dating back to March.

We are relativity early in the process of deconstructing this stealthy attack — more details will emerge over time, including what the Russian APT group was really after, though we do know they monitored communications of hacked organizations for months. The US Cybersecurity and Infrastructure Security Agency (CISA) called the attack a “grave risk” to national security, while others described it as devastating to the economy, infrastructure, and public trust on a level not seen since ShadowBrokers.

Attacks like these are scary as hell, but they’re not going away. That’s why it’s important to share what we know, so there doesn’t have to be a “next time.”

Massive Russian hack leaves private and public sector reeling

If you were in a minor state of shock after learning about the presumed Russian hack, you weren’t alone. As if our supply chain, infrastructure, and business security weren’t already taxed enough by the pandemic, IT teams running SolarWinds software must now contend with complex mitigation efforts to root out backdoors slipped into Orion platform updates earlier this year. The boobytrapped updates pushed the Sunburst malware onto victim networks, which then gathered recon for 12 to 14 days before sending data to a remote C&C server. If the intelligence proved fruitful, Russian threat actors then escalated their attacks on select networks.

It’s important to note that of the 18,000+ organizations that received malicious updates through Orion, only 200 were targeted for follow-on action. Therefore, many businesses may be sitting on a “dormant” version of the Sunburst malware and not yet know it. CISA advises: “Organizations with suspected compromises need to be highly conscious of operational security, including when engaging in incident response activities and planning and implementing remediation plans.” However, there are a few proactive steps you can take:

  • Immediately isolate any systems running the Orion platform versions 2019.4 HF 5 through 2020.2.1, released between March and June 2020
  • Scan your premises using an endpoint protection product like Malwarebytes and look for detections, such as Backdoor.Sunburst and Backdoor.WebShell
  • Use the Indicators of Compromise at the end of this Malwarebytes Labs blog to hunt within your logs, telemetry, and other SIEM data to learn the perspective timeline of intrusion
  • Perform a comprehensive security sweep to review and harden your physical and cloud infrastructure
  • Upgrade to Orion platform version 2020.2.1 HF 2 and restore systems once you feel confident with the previous steps

For more technical information on the cyberattack from CISA: https://us-cert.cisa.gov/ncas/alerts/aa20-352a