Texas Cybersecurity Weekly

Volume I - No. 9 May 31, 2018

Subject to standard copyright rules, TLP:WHITE information may be distributed without restriction https://www.us-cert.gov/tlp

Advisory

Shift in Ongoing SSO Credential Harvesting Campaign Targeting Direct Deposit Information MS-ISAC - May 25, 2018    A phishing campaign seeking to harvest single sign on credentials (SSO) in order to modify victims’ direct deposit information has expanded to affect entities outside of the education sector. The attack begins with a phishing email containing a link that directs the recipient to a customized phishing website that requests login credentials. Affected SLTT entities have received hundreds of phishing emails with slightly different subject lines in an attempt to bypass subject line based email filtering. The most recent example available of this phishing campaign is a survey-themed email, asking employees to provide feedback. The customized website contains correct branding for the targeted SLTT government or university and is hosted on a compromised domain. The phishing email may originate from a compromised internal email account or an external email account spoofed to appear as though it is from a co-worker.   Of note, a compromise of this nature could potentially result in a data breach as the cyber threat actor would have access to the information contained within the compromised email account and the employee’s payroll profile. If the employee is a manager or has a higher level of access to the payroll system, the data breach could affect additional employees.   RECOMMENDATIONS: In order to reduce the likelihood that cyber threat actors successfully complete phishing attempts, the MS-ISAC recommends: • Train end users regarding phishing and social engineering tactics. Remind users that all suspicious emails should be reported to the security and/or information technology (IT) departments according to local policy. Implement filters at the email gateway to filter out emails with known phishing indicators, such as known malicious subject lines, and block suspicious IP addresses at the firewall. • Mark external emails with a banner denoting they originate from an external source • Enable two factor authentication to prevent unauthorized access to externally hosted payroll accounts, web based email accounts and other at externally accessible websites.  • If possible, restrict external account access to known IP addresses or those that originate within the United States, as appropriate.  • Utilize Sender Policy Framework (SPF), a validation system that minimizes spam emails by detecting email spoofing and allowing administrators to specify who is allowed to send email from a given domain by creating a SPF record in the Domain Name System (DNS). • Implement the Domain-based Message Authentication, Reporting & Conformance (DMARC) email authentication policy   In order to recover from a successful phishing attempt the MS-ISAC recommends: • The credentials for any compromised accounts should be changed immediately in order to prevent the cyber threat actor from further access.  • If an employee submits their credentials, ensure no changes have been made to the payroll system as they may go unnoticed until after payment has been dispatched.  • Identify if any auto-forwarding rules have been put in place and be sure to remove them to prevent further exposure of information.    The MS-ISAC requests any SLTT government aware of incidents targeting payroll systems via SSO credential harvesting to report the incident and IOCs to the MS-ISAC. Please do not hesitate to leverage the MS-ISAC to assist you in investigating the incident or in your response and recovery efforts. We perform a variety of incident response services including log analysis, malware analysis, computer forensics, development of a mitigation and recovery strategy as well as network and application vulnerability scanning. Requests for these services can be obtained by calling 1-866-787-4722 or sending an email to SOC@msisac.org .

Become an MS-ISAC Member: If you are not currently a part of MS-ISAC click here to learn about becoming a member.

Destructive 'VPNFilter' Attack Network Uncovered May 23, 2018 - Dark Reading A newly unearthed novel and destructive cyberattack infrastructure made up of more than a half-million home and small office routers and network-attached storage devices worldwide has security and equipment vendors, Internet service providers, government officials, and law enforcement scrambling to help clean and patch the infected devices before they're weaponized in an attack. Read More

Trisis masterminds have expanded operations to target U.S. industrial firms May 24, 2018 - CyberScoop A group known for infecting a Saudi petrochemical plant with highly sophisticated industrial control malware has expanded its operations, according to new research, with a former U.S. official telling CyberScoop that companies inside the United States have been breached. Read More

Vulnerability Alerts

T-Mobile website security flaw let anyone view customer account info May 24, 2018 - Tmo News A couple of months after it was discovered that a vulnerability with the T-Mobile website allowed hackers to log into any customer’s account, another vulnerability with T-Mo’s site has been found. Read More

Google and Microsoft Reveal New Spectre Attack May 21, 2018 - Bleeping Computer Security researchers from Google and Microsoft have found two new variants of the Spectre attack that affects processors made by AMD, ARM, IBM, and Intel. Rumors about this new flaw leaked on line at the start of the month in a German magazine, bu actual details were published today. Read More

Multiple Vulnerabilities in Google Chrome Could Allow for Arbitrary Code Execution MS-ISAC ADVISORY NUMBER: 2018-059 DATE(S) ISSUED: 05/30/2018 OVERVIEW: Multiple vulnerabilities have been discovered in Google Chrome, the most severe of which could result in arbitrary code execution. Google Chrome is a web browser used to access the Internet. These vulnerabilities can be exploited if a user visits, or is redirected to, a specially crafted web page. Successful exploitation of the most severe of these vulnerabilities could allow an attacker to execute arbitrary code in the context of the browser, obtain sensitive information, bypass security restrictions and perform unauthorized actions, or cause denial-of-service conditions. THREAT INTELLIGENCE: There are currently no reports of these vulnerabilities being exploited in the wild. Read More

Breach Events

Tech Company Hack Affected Minnesota Law Enforcement May 28, 2018 – Star Tribune A hacker slipped into the servers of prison technology giant Securus Technologies and exposed thousands of potentially confidential records from law enforcement agencies across the United States, including in Minnesota, according to a technology website. Read More

BMO and CIBC-Owned Simplii Financial Reveal Hacks of Customer Data May 28, 2018 – CBC News Two Canadian banks warned Monday they have been targeted by hackers, and that the personal information of tens of thousands of customers may have been stolen — something that appeared to be confirmed in a letter to the media from someone who said they were demanding a $1-million ransom from the banks.  Read More

Coca-Cola Suffers Breach at the Hands of Former Employee May 25, 2018 – Bleeping Computer The Coca-Cola company announced a data breach incident this week after a former employee was found in possession of worker data on a personal hard drive. The company learned of the security breach last September after law enforcement officials contacted Coca-Cola. Read More

Industry Reports

Mobile Threat Report: The Next 10 Years McAfee Q1, 2018 This year marks 10 years that both the Apple App Store and the Google Play store have been in business. Even though the app store concept dates to the early days of the Symbian operating system—think Nokia and Ericsson phones—the advent of the application market from Apple and Google is what most smartphone users associate with the concept of app distribution.  Read More

News and Commentaries

How Blockchain Can Help Increase The Security Of Smart Grids May 18, 2018 – Forbes Blockchain is the new “hot” technology that promises to disrupt many industries. It gains traction at a time when “smart” electrical grid management systems are automatically diagnosing problems and emergencies, and reconfiguring responses to them. It also comes at a time when the U.S. Department of Homeland Security announced that Russians had successfully hacked into at least one power grid in the U.S. and have been attempting to do so since 2016. Read More

Ghostery Tries to Comply With GDPR, but Ends Up Violating GDPR in the Process May 28, 2018 – Bleeping Computer The company behind Ghostery, a privacy-focused browser and an ad-blocking browser extension, has apologized for a technical error that occurred last Friday when its staff was sending out GDPR-themed notification emails. According to numerous user reports, Ghostery sent out emails that exposed the addresses of other users. Read More

OCISO Updates

Information Security Forum 2018 As the months flip on, so too do we say goodbye to another Information Security Forum. This year’s ISF, held May 23-24, saw an estimated 500 attendees and approximately 100 vendors and exhibitors. This wonderful turnout doesn’t even include the fantastic panelists and keynotes who were in attendance this year. DIR’s Office of the Chief Information Security Officer (OCISO) prides itself on the many events we hold each year with ISF being the largest and most robust educational conference that is held. Opening with a legislative update featuring Texas Rep. Giovanni Capriglione and state Chief Information Officer (CIO) Todd Kimbriel, ISF featured two full days of panels from five separate tracks.  The tracks (Engagement, Tooling, Staffing, Response, and Outreach) aligned sessions with the topics they fit best with in order to offer attendees opportunities to learn new tools, tips and best practices facing the future of the cybersecurity profession. Preparation for next year’s ISF is already underway and future panels will likely have similar topics, dependent on attendee feedback that was provided via evaluation forms for each panel.  Without all of the hard working security professionals across Texas in government, higher education and in the private sector, events such as ISF wouldn’t be possible and we look forward to improving upon ISF in 2019 so make sure you come back to see what we have in store then.

Workforce Development and Events

NCCIC and MS-ISAC Ransomware Awareness Briefings See dates and times below Over the next three weeks, the National Cybersecurity and Communications Integration Center (NCCIC) and the Multi-State Information Sharing and Analysis Center (MS-ISAC) will host four webinars on the current ransomware threat environment. The webinars are TLP: WHITE and open to all audiences. The MS-ISAC encourages sharing this information with partners and organizations throughout your community. The MS-ISAC Ransomware Security Primer , with basic information and detailed recommendations is available via the CIS website. Dates and Times: 1:00 PM –2:30 PM ET (content is the same for each session): May 31, 2018 June 4, 2018 June 5, 2018 June 11, 2018 Attend Here

DFIR Summit & Training Summit Dates: June 7-8, 2018 Training Course Dates: June 9-14, 2018 The annual SANS Digital Forensics & Incident Response (DFIR) Summit is the most comprehensive DFIR event of the year, bringing together an influential group of experts, immersion-style training, and industry networking opportunities in one place.  For more information visit the website

Texas Government Data Forum 2018 Thursday, June 21, 2018 | 8:00 am - 4:30 pm | Austin, TX Annual conference hosted by the Texas Department of Information Resources. Any government/public sector employees may attend. Visit the website

Texas Cybersecurity Weekly Collected news & information for Texas’ cybersecurity community The periodical aggregates information about cybersecurity and information technology to promote shared awareness, cyber hygiene, and information sharing amongst government, the private sector, and all Texans.

Subject to standard copyright rules, TLP:WHITE information may be distributed without restriction https://www.us-cert.gov/tlp

Assistance/Feedback/Questions? Email the Office of the CISO at DIRSecurity @dir.texas.gov

Visit our Website