2021 Week 14 Security Summary
Summary
There was not a lot of activity of general interest this week. Industrial control systems (ICS) security kind of had a spotlight on it. ICS security is included in this blog as many local governments are responsible for power and water production and/or distribution. Another hot topic was educational security, and I outline a couple of individual cases as well as general information.
News
Kansas water utility hack
The DOJ announced they were inditing Wyatt Travnichek for hacking the Ellsworth Rural Water District No. 1 (AKA Post Rock Rural Water District) in Ellsworth County, Kansas In March 2019. The DOJ is claiming that Travnichek tampered with the water purification and disinfecting systems via computers with the intent of causing harm. If found guilty on all charges he faces 25 years in prison. It appears that he was a former employee that had remote access privileges. Apparently, when his employment ended in January 2019, his remote access was not revoked, which allowed him to remotely access the services from a Samsung smartphone. A representative for the water utility indicated that there were no safety impacts as other processes caught the tampering.
NIST Election Security Guidance
The National Institutes of Science and Technology (NIST) has a draft of election security recommendations for government entities. NISTIR 8310 ranges from polling paces procession to cyber threats that can affect voter registration, machines, and networks used during the voting process. NIST will accept comments on the draft until May 14, 2021. The guidance is tied to the Cybersecurity Framework version 1.1. (Will link the framework and the draft below). This is part of the ongoing process by the government at all levels to defend the election infrastructure of the United States against foreign actors who wish to subvert the process.
NIST documents:
Universities under attack
Several groups have identified an uptick in attacks targeting universities. This continues the trend seen over the last few weeks. In one announcement this week the IRS said they had seen an increase in phishing attacks using refund adjustment phishing emails to get credentials to then perform identity theft or gain access to networks. It was also announced this week even more universities have had data stolen and are being extorted to ensure the data is not released to the world. Following similar extortion attempts in the last few weeks, the request for payment was sent along with screenshots of sensitive information. It appears this is part of the same Clop activities, but it was noted that they are not the only actors active.
The DeKalb County School District announces a 3rd party breach
PCS Revenue Control Ssytems, Inc. sent letters to parents of the school district of a breach that exposed records of school meal programs. The data included names, id numbers, dates of birth, and social security numbers.
Broward County Public School (BCPS) attack update
A screenshot was leaked by the Conti gang that shows that the attackers demanded $40,000,000 ransom. For those not familiar with US public schools, that is an impossible sum.
Industrial Control Systems (ICS) security news
ICS security was in the news this week. One survey discovered that there are still challenges in securing the interface between IT and OT networks. It was also disclosed that A41APT has been implanting back doors into ICS hardware in Japanese manufacturing facilities. It was also reported this week that attacks using USB devices have nearly doubled.
Legislative actions
The U.S. breach disclosure bill is moving forward. This bill will require any company that is serving critical infrastructure to disclose any cybersecurity breaches.
President Biden extended Executive Order 13694, first issued in 2015 by Obama, which allows authorities to block the property of groups engaging in "significant malicious cyber-enabled activities." It would seem that if we have had this EO since 2015, it may be worthwhile to encode it in our legal framework.
Comments
Post a Comment