2021 Week 13 Security Roundup
Summary
This week there was not a lot of activity. We did see quite a bit of news from the SCADA front. A ransomware campaign has leaked some information in an attempt to get the victims to pay.
News
Power security
The U.S. Department of Energy (DOE) Office of Cybersecurity, Energy Security and Emergency Response (CESER) is pledging to help US energy system operators from the growing cyber and physical threat to their systems. Some of the announced programs include testing of SCADA systems to assess their vulnerabilities against nation-state actors, research into electromagnetic and geomagnetic protective technologies, and a focus on researching cybersecurity with a goal of fostering well-trained university graduates.
Dragos warns that they have seen the emergence of new threat actors specifically targeting Industrial Control Systems (ICS) and/or Operational Technology (OT) networks to include power and water systems. One of these STIBNITE has been found in the wild actively targeting wind generator companies in Azerbaijan. They gain access via spearphishing campaigns, which use tainted Microsoft documents to install PoetRAT.
GE's universal relays have vulnerabilities that could allow attackers to access information, reboot the device, gain privileged access or deny access. The affected relays include: B30, B90, C30, C60, C70, C95, D30, D60, F35, F60, G30, G60, L30, L60, L90, M60, N60, T35 and T60. There is an updated version of the UR here: https://www.gegridsolutions.com/app/viewfiles.aspx?prod=urfamily&type=7&sort=date
The collection of vulnerabilities have been given CVE's of: CVE-2021027418, CVE-2021-27420, CVE-2021-2742, CVE-2-21-27424, CVE-2-21-27426, CVE-2021-27428, and CVE-2021027430.
Clop Ransomware Gang release information from victims
The data released includes grades and social security numbers (SSN)'s for students at the University of Colorado. They also released patient information from the University of Miami. The data was harvested from Accellion FTA servers over the winter. At this time the data released has been just screenshots of the data with a demand for 10 million dollars worth of bitcoin. At the time of the initial Accellion attacks, it was announced that affected customers included state and local governments and universities from around the world.
California agency phished
The California State Controllers Office (SCO) Unclaimed Property Division {you know it has to be a government agency with a name like that} was the victim of a successful phish. The attacker used the credentials harvested to send emails to all the people (~9,000) in the contact list of the victim to attempt to gain more credentials and PII. The SCO stated that the breach was discovered quickly and remediation was enacted. It just serves as a reminder that it only takes one person to fall for a credential harvesting phish for the threat actors to gain a foothold.
Legislative actions
Oklahoma
Oklahoma's anti-Ransomware law proposal has made national news. This also includes a discussion of the Ransomware attack on The Village (for those readers outside the OKC area, this is a small town enveloped within Oklahoma City). There is also reporting on discussions with Matt Singleton who is Oklahoma's CSO. He points out the need for good relations with state, federal, and local partners and the layered defensive approach to cybersecurity.
Jobs:
Shawnee Oklahoma:
Under general supervision is responsible to assist in maintaining the computer systems for the City. Work varies, often requiring individual judgment within well-defined industry standards and procedures.
Comments
Post a Comment