2022 Week 8 and 9
Summary
A lot of news from the last 2 weeks. I am trying to be more timely with these summaries as the war in Ukraine is in progress. There has been observed quite a bit of activity around SLTT and infrastuctre targets.
News
SLTT
The Cybersecurity and Infrastructure Security Agency (CISA) of the United States (U.S.) released a list of free cybersecurity tools and services for SLTT's that they pledge to keep updated. The goal is to help better the overall cybersecurity posture of U.S. critical infrastructure sectors and as such are usable by those out of the SLTT arena.
Tool:
CISA also released a bulletin outlining APT group MuddyWater and their attempt to target SLTT and critical infrastructure entities.
City of Baltimore, Maryland USA was tricked out of about $375,000. It appears it was a vendor payment redirect attack where someone gained access to a vendor's email account and requested funds be redirected to a bank account controlled by the fraudster.
Report:
Port of LA continues to make strides on its Cyber Resilience Center which was covered back in Week 5. Their partner is IBM and they are giving the various participants in the center access to the IBM X-Force threat intelligence stream. This multi-year agreement is expected to be a substantial upgrade from their old manual system. It seems that IBM is using this as a testbed to create similar centers at other critical supply chain locations.
Missouri decides to not press charges against a reporter and university researcher over their disclosure to the state that a misconfigured web server was exposing employee data. The governor originally went on the record saying that they would prosecute those involved to the fullest extent of the law, but now that it appears it was his own office at fault, they have decided to not move forward.
Criminal Incident Report:
DNA evidence from rap victims for the Oklahoma City Police Department (and potentially others) was exposed during a data breach in November 2021. DNA Solutions Inc. It is unknown how much data may have been accessed. The company says they are working with federal law enforcement to investigate the breach.
Infrastructure General
The Conti gang has vowed to hack the infrastructure of any country that supports any nation that opposes Russia.
ICS/OT/SCADA General
Broad attacks against Industrial Control Systems (ICS) are increasing and will only get worse it appears. A report by the Dragos group shows over half of these are traceable to just 2 groups.
GE Digital has released patches for 2 vulnerabilities in its Proficy CIMPLICITY HMI/SCADA software. These issues are CVE-2022-2391 which can allow privilege escalation and CVE-2022-21798 which covers credentials in cleartext.
Power
A group of men attempted to recruit juveniles to help disrupt the U.S. power grid by attacking electrical substations. The attack was planned to be coordinated attacks on substations using high-power rifles. The alleged motive was to create economic and civil hardship which they felt would lead to a race war.
Healthcare
Extend fertility out of New York City sent notice to patients that personal data may have been compromised during an attack discovered in December. They are still not reporting (if they even know yet) the extent of the breach.
The U.S. National Institute of Science and Technology (NIST) Cybersecurity Center of Excellence has released its guidance for telehealth. Securing Telehealth Remote Patient Monitoring Ecosystem (NIST SP 1800-30) guide seeks to help healthcare providers to adopt best practices around videoconferencing and other emerging technologies that seek to take healthcare remote.
Guidance:
Aerospace
TA2541 has been attempting Remote Access Trojans (RATs) at aviation companies for years according to a new report by Proofpoint. This is in addition to the 2 well-documented attacks already attributed to TA2541 (Operation Layover and the RevengeRAT attack). The articles below go over the tactics and techniques used by the threat actor(s).
Note, normally TA2541 would have a link to access more information about the organization and/or a common name. In this case, they have been good enough at evading intelligence that little is known about them, other than the consistency of their targets and the commercial tools they are using.
Proofpoint report:
Legislative actions
U.S. Senate Bill 3538 would require that companies decrypt all data and traffic on their servers to ensure, among other things, that there is no child pornography present. I guess if you can't get traction making private encryption illegal for terrorism or national defense reasons you make it unusable because of child porn.
Oklahoma House of Representatives has a bill (HB2969) in the works that seek to protect people's privacy. It would require certain businesses to disclose:
1. How to exercise their privacy rights
2. What personal information is collected
3. The reason personal information is collected
4. If information is disclosed and if so how
5. If information is shared with service providers and if so what are the categories of those service providers
6. The retention policy for personal information
Jobs
The state of Oklahoma is hiring for a threat analyst.
Comments
Post a Comment