Texas Cybersecurity Weekly

Volume I - No. 6 May 10, 2018

Advisories Recent Phishing Attempts

An organization was recently the target of a phishing attempt. An email was received asking the organization’s users to enter their credentials into a site that resembled one of the organization’s login pages. Users were requested to enter their credentials into a form which would have compromised the user’s account.   Remediation steps for an incident such as this should include: ·          Resetting user’s authentication tokens ·          Blocking URL in the phishing email ·          A scan of the organization’s email system and removal of any copies of the phishing attempt. ·          A scan of the user’s emails to ensure they were not compromised and the attackers did not send any emails. If the attackers did, removal of those emails and scan for similar emails in the system. ·          A check of user’s rules to ensure that the attackers did not create a rule that forwards user emails outside of the organization.   Scanning the organization’s entire email system is important. A common occurrence in these situations is that users fail to inform their IT departments that they visited the site, due to the mistaken belief that the entry of their information did not advance the webpage to a new screen, so no harm occurred.   Should your organization experience an incident of this nature report the incident in SPECTRIM and inform DIR. This will provide crucial information for DIR to notify other state organizations of the phishing campaign, as well as allowing NSOC staff to implement blocks to protect state resources.

WHOIS Changes Likely to Affect SLTT Governments May 9, 2018 – MS-ISAC Advisory On May 25, 2018, it is highly likely that the Internet Corporation for Assigned Names and Numbers (ICANN) will greatly restrict public WHOIS information while it creates and implements a plan to become compliant with European Union (E.U.) Regulation 2016/679 General Data Protection Regulation (GDPR). This change will almost certainly impact many state, local, tribal, and territorial (SLTT) governments that rely on WHOIS data. Due to the forthcoming changes and potential unavailability of WHOIS information, the MS-ISAC recommends that SLTT governments identify where WHOIS data is being used and by whom. The questions and research points in the attached paper will aid SLTT governments in determining the potential impact to their organizations. View Document

Vulnerability Alerts

Critical Patches Issued for Microsoft Products, May 8, 2018 MS-ISAC Advisory Number – 2018-053 Date Issued: May 8, 2018 Multiple vulnerabilities have been discovered in Microsoft products, the most severe of which could allow for code execution. Successful exploitation of the most severe of these vulnerabilities could result in an attacker gaining the same privileges as the logged on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.   THREAT INTELLIGENCE: There are reports of a remote code execution vulnerability (CVE-2018-8174) being actively exploited in the wild as part of a cyber-espionage campaign. Read More

A Vulnerability in Adobe Flash Player Could Allow for Arbitrary Code Execution (APSB18-16) MS-ISAC Advisory Number – 2018-052 Date Issued: May 8, 2018 A vulnerability has been discovered in Adobe Flash Player, which could allow for arbitrary code execution. Adobe Flash Player is a widely distributed multimedia and application player used to enhance the user experience when visiting web pages or reading email messages. Successful exploitation of this vulnerability could allow for arbitrary code execution in the context of the user running the application. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.   THREAT INTELLIGENCE: There are currently no reports of this vulnerability being exploited in the wild. Read More

Multiple Vulnerabilities in Google Android OS Could Allow for Arbitrary Code Execution MS-ISAC Advisory Number – 2018-051 Date Issued: May 7, 2018  Multiple vulnerabilities have been discovered in the Google Android operating system (OS), the most severe of which could allow for arbitrary code execution. Android is an operating system developed by Google for mobile devices, including, but not limited to, smartphones, tablets, and watches. Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution within the context of a privileged process. Depending on the privileges associated with the application, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. If this application has been configured to have fewer user rights on the system, exploitation of the most severe of these vulnerabilities could have less impact than if it was configured with administrative rights.   THREAT INTELLIGENCE: There are currently no reports of these vulnerabilities being exploited in the wild. Read More

Annual Industry Reports

Cybrary Declassified: Unraveling the Cyber Skills Gap and Talent Shortage Cybrary - 2018 The truth is finally unveiled. From the creators of the Verizon Data Breach report comes Cybrary's newest report. Get the first look at Cybrary's report covering one of the industry's worst kept secrets, the cyber skills gap. Read More

Internet Crime Report Federal Bureau of Investigation - 2017 As the lead federal agency for investigating cyber-attacks by criminals, overseas adversaries, and terrorists, the FBI’s IC3 provides the public with a trustworthy and convenient reporting mechanism to submit information concerning suspected Internet facilitated criminal activity. The IC3 also strengthens the FBI’s partnerships with our law enforcement and private industry partners. As cyber criminals become more sophisticated in their efforts to target victims, we must continue to transform and develop in order to address the persistent and evolving cyber threats we face. Learn More

Breach Events

Global University Provides Notice Of Data Breach May 8, 2018 - PR Newswire SPRINGFIELD, Miss., May 8, 2018 /PRNewswire/ -- Global University ("Global") is providing notice to current and former students of a recent event involving the potential exposure of certain personal information. To date, Global has not received any reports that the information has been misused. Read More

Possible security breach of Goodyear's bill pay system, City says May 9, 2018 - AZFamily GOODYEAR, AZ (3TV/CBS 5) - The City of Goodyear said on Tuesday its bill pay system may have been compromised. The City said it is investigating after a customer reported a potential problem on Monday morning. Staff disabled the system and told the system's vendor, Goodyear officials said. Read More

Equifax reveals how much information was really exposed in data breach May 8, 2018 – Housingwire In a new filing with the Securities and Exchange Commission, the credit reporting agency broke down in detail the types of – and how much exactly – sensitive personal information was exposed to hackers in the breach. A statement for the record from Equifax included in the SEC filing breaks down what types of personal information and data was exposed in the September 2017 data breach. Read More

News and Commentaries

Healthcare sector suffered more than half of all cyber-attacks in 2017 May 4, 2018 – SC Media UK In the past couple of years, while we have seen a rise in businesses adopting new cyber-security policies, such measures have not been able to curb the rise of malicious malware and cyber-weapons used against healthcare. Read More

baseStriker: Office 365 Security Fails To Secure 100 Million Email Users May 8, 2018 – Avanan We recently uncovered what may be the largest security flaw in Office 365 since the service was created. Unlike similar attacks that could be learned and blocked, using this vulnerability hackers can completely bypass all of Microsoft’s security, including its advanced services - ATP, Safelinks, etc. The name baseStriker refers to the method hackers use to take advantage of this vulnerability: splitting and disguising a malicious link using a tag called the <base> URL tag. Read more here

Breach Costs are Rising with the Prevalence of Lawsuits May 2, 2018 - F5 Networks In our forthcoming report on protecting applications, we commissioned Ponemon to conduct a large global survey of security professionals about application security. One question we asked was about the estimated financial impact of a cyber-attack that resulted in the leakage of personally identifiable information (PII) about customers, consumers, or employees. Of the 3,135 responses we received, the most popular range chosen by 24% of respondents was $500,001 to $1,000,000. Ponemon extrapolated the future value of breaches at $6.56 million. This doesn’t take into account company size, or the count of breached records, two elements that are the biggest factors in breach costs. Based on the settlement costs we profile in this article, which do not cover the organizations breach remediation costs, compliance fines, or legal fees, we believe organizations are drastically under estimating their true breach costs. Read More

SynAck targeted ransomware uses the Doppelgänging technique May 7, 2018 – Secure List The Process Doppelgänging technique was first presented in December 2017 at the BlackHat conference. Since the presentation several threat actors have started using this sophisticated technique in an attempt to bypass modern security solutions. In April 2018, we spotted the first ransomware employing this bypass technique – SynAck ransomware. It should be noted that SynAck is not new – it has been known since at least September 2017 – but a recently discovered sample caught our attention after it was found to be using Process Doppelgänging. Here we present the results of our investigation of this new SynAck variant. Read more here

Workforce Development and Events

Cyber Security Summit: Dallas May 12, 2018, The Ritz-Carlton, Dallas The third annual Cyber Security Summit: Dallas connects C-Suite & Senior Executives responsible for protecting their companies’ critical infrastructures with innovative solution providers and renowned information security experts. Admission is $350 each, giving you access to all Interactive Panels, Discussions, Catered Breakfast, Lunch & Cocktail Reception.  Register Here

2018 Information Security Forum May 23-24, 2018 REGISTRATION IS NOW OPEN for the 18th annual Information Security Forum, to be held May 23-24, 2018 at the Palmer Events Center in Austin, Texas, and is hosted by the Texas Department of Information Resources (DIR) and managed by the Office of the Chief Information Security Officer (OCISO).  Visit the website.

GDPR Compliance – Why Should I be Concerned MS-ISAC/EI-ISAC National Webinar Initiative May 1, 2018 2:00 p.m. EST This presentation will provide a general overview of the General Data Protection Regulation, GDPR, that is going into effect on May 25, 2018. It will provide some insight as to why all SLTT entities should be concerned about compliance with the regulation. Examples that SLTT’s may not have considered will be explored and discussed. REGISTER NOW

Cyber Analysis Seminar for All MS-ISAC Members and Intel Partners DHS I&A Training Academy May14-18 The CAS provides employees an introduction to the concept of Cyber-Security and Analysis. Students learn cyber technical basics; the threats and tactics employed by threat actors; resources and expertise available to support homeland security partners in dealing with cyber threats. This seminar provides students an understanding of the cyber threat environment and enhances their ability to process and share cyber threat information across the Homeland Security Enterprise.ce article copy here. Please contact the IA-Registrar at Ia-registrar@hq.dhs.gov with any questions.

Texas-Israel Cyber Security Conference May 31, 2018 The Texas-Israel Chamber of Commerce will hold the watershed Texas-Israel Cyber Security Conference on Thursday, May 31, 2018 at the Martha Proctor Mack Ballroom, on the SMU Campus. For more information on the conference please visit www.texasisrael.org . Registration can be found here.

Texas Digital Government Summit May 30-31, 2018 Government Technology’s passion is helping spread best practices and spurring innovation in the public sector. The Texas Digital Government Summit is designed to do just that. The summit has an advisory board that gathers public and private sector leaders to create an agenda designed to make that passion relevant and actionable to the state and local government organizations attending the summit. Visit the website.

DFIR Summit & Training Summit Dates: June 7-8, 2018 Training Course Dates: June 9-14, 2018 The annual SANS Digital Forensics & Incident Response (DFIR) Summit is the most comprehensive DFIR event of the year, bringing together an influential group of experts, immersion-style training, and industry networking opportunities in one place.  For more information visit the website

Texas Government Data Forum 2018 Thursday, June 21, 2018 | 8:00 am - 4:30 pm | Austin, TX Annual conference hosted by the Texas Department of Information Resources. Any government/public sector employees may attend. Visit the website

Texas Cybersecurity Weekly Collected news & information for Texas’ cybersecurity community The periodical aggregates information about cybersecurity and information technology to promote shared awareness, cyber hygiene, and information sharing amongst government, the private sector, and all Texans.

Assistance/Feedback/Questions? Email the Office of the CISO at DIRSecurity @dir.texas.gov

Visit our Website