Cybercrime , Fraud Management & Cybercrime , Governance & Risk Management
Breach Roundup: US Federal Cyber Incidents Go Up
Also: Ukraine Arrests Alleged Ransomware Developer; Patches Galore; and BurnoutEvery week, Information Security Media Group rounds up cybersecurity incidents and breaches around the world. This week, the U.S. federal government counted cyber incidents, Ukrainian police arrested an alleged ransomware developer, Black Basta seemed to exploit a Windows flaw, 51 flaws were included in Patch Tuesday, SolarWinds and JetBrains patched flaws, the Alan Turning Institute debunked a paper on AI, Santander called for password changes, Christie's spoke about its data breach and cyber pros face burnout.
See Also: 2024 Threat Hunting Report: Insights to Outsmart Modern Adversaries
US Federal Cybersecurity Incidents Rose 9.9% in 2023
An annual Federal Information Security Modernization Act report released by the White House reveals a 9.9% increase in cybersecurity incidents across U.S. federal agencies in fiscal 2023, totaling 32,211 incidents. The report fingered "improper usage" as the most prevalent issue, accounting for 38% of incidents. Phishing and malicious emails rose significantly, with incidents doubling from 2022 to 2023. None of the incidents were rated higher than "medium" on the National Cyber Incident Scoring System.
The report highlights 11 major incidents. Two of them at the Department of Health and Human Services involved ransomware that targeted a contractor's system, exposing personal data of 2.8 million people, and a zero-day attack on contractors that affected 1.88 million people. Treasury faced two incidents: the accidental public exposure of tax forms filed by tax-exempt entities due to a coding error and a phishing attack against an employee’s account. The Justice Department experienced two ransomware attacks affecting the U.S. Marshals Service and a data analytics vendor. At the Department of the Interior, an accidental policy change by a developer exposed 147,000 individuals' data. A rogue employee at the Consumer Financial Protection Bureau leaked data on 256,000 consumers. The Transportation Department suffered a breach of the Parking and Transit Benefit System, compromising data of 237,000 individuals. The Office of Personnel Management faced a breach likely related to MOVEit, affecting 632,000 employees, and MOVEit incidents at the Department of Energy exposed data of 100,000 individuals involved in nuclear waste programs.
Ukrainian Police Arrest Suspected Conti, LockBit Developer
Ukrainian cyber police identified and arrested a 28-year-old hacker from Kyiv linked to the Conti and LockBit ransomware gangs. The hacker allegedly developed cryptors, software that conceals malicious code in a bid to make it undetectable by antivirus.
Police confiscated computer equipment, mobile phones and data records. The suspect has been charged with unauthorized interference of electronic communication and networks under Ukrainian law. The Dutch police also participated in the operation.
Wednesday's arrest follows police disruption of LockBit ransomware that resulted in the U.S. and U.K. police seizing the group's infrastructure. Conti disbanded following Russia's invasion of Ukraine in 2022. Last year, the U.K. and U.S sanctioned 11 members of the Conti ransomware group (see: US, UK Sanction 11 Russian Cybercriminals Tied to TrickBot).
Black Basta Gang May Have Exploited Microsoft Flaw
Researchers from Symantec's Threat Hunter Team said in a Wednesday blog post that the cybercriminal group associated with Black Basta ransomware may have exploited a now-patched Windows flaw despite Microsoft's conviction that it wasn't used in the wild.
The Cardinal cybercrime group, also tracked as Storm-1811 and UNC4393, apparently used a tool to exploit CVE-2024-26169, an elevation of privilege vulnerability in the Windows Error Reporting Service. Symantec said it spotted a compile date of Feb. 27, weeks before Microsoft published a patch on March 12.
The tool took advantage of an apparently now-patched characteristic of werkernel.sys
, a Windows file that manages error reporting functions. The flaw allowed hackers to create and control a subkey in the Windows registry, inserting a pathname to a malware executable into the registry field reserved for a debugging script. Hackers could create the subkey because werkernel.sys
used a "null security descriptor" when generating registry keys, meaning it didn't assign an object owner and primary group to the parent key but automatically assigned subkey ownership to the current user - in this case, the attacker.
Symantec attributes the activity to Cardinal based on similarities between the detected group's tactics, techniques, and procedures and those described in a recent Microsoft report that details Black Basta activity. The similarities included "use of Quick Assist, ScreenConnect, malicious batch files, and suspicious cURL behavior," said Dick O'Brien, principal intelligence analyst, Symantec, in an email.
June Patch Tuesday Fixes 51 Flaws, Including 1 Zero-Day
Microsoft's June 2024 Patch Tuesday includes updates for 51 security flaws, featuring 18 remote code execution vulnerabilities and one publicly disclosed zero-day. The update also covers 25 elevation of privilege vulnerabilities, three information disclosure vulnerabilities and five denial of service vulnerabilities.
The zero-day vulnerability, tracked as CVE-2023-50868, is a vulnerability in DNSSEC validation "where an attacker could exploit standard DNSSEC protocols intended for DNS integrity by using excessive resources on a resolver," Microsoft said. Mitre created the CVE in February. Major DNS implementations including BIND, PowerDNS and Unbound have already released patches.
Other significant fixes include multiple Microsoft Office RCE vulnerabilities, notably in Microsoft Outlook. Microsoft also patched seven Windows Kernel privilege elevation flaws that could allow local attackers to gain system privileges.
SolarWinds Patches High-Severity Flaws
SolarWinds published an update of its platform that addresses several high-severity vulnerabilities, including an issue reported by a NATO penetration tester. The update includes fixes for three new security defects and multiple bugs in third-party components.
It also includes fixes for a medium-severity flaw in Angular and 10 high- and medium-severity issues in OpenSSL, some dating back seven years.
SolarWinds also released a hotfix for CVE-2024-28995, a high-severity directory traversal vulnerability in Serv-U. This flaw, which has a CVSS score of 8.6, allows attackers to read sensitive files on the host machine. SolarWinds did not report that any of the vulnerabilities were exploited in the wild.
Critical Flaw in JetBrains IDEs Exposes Tokens
JetBrains patched a critical vulnerability in its IntelliJ-based IDEs, version 2023.1 and onward that could lead to disclosure of access tokens on GitHub.
Discovered on May 29, this flaw affected popular IDEs such as IntelliJ, PyCharm, WebStorm and PhpStorm, used by over 10 million developers globally. JetBrains updated all affected IDEs and the GitHub plug-in and removed older plug-in versions from the JetBrains Marketplace. Developers are advised to revoke any GitHub tokens used by the plug-in and check OAuth and personal access token settings for compromised tokens. JetBrains previously warned of severe vulnerabilities in its TeamCity servers that could enable authentication bypass and path traversal (see: JetBrains' TeamCity Bugs Could Lead to Server Takeover).
Gen AI Probably Can't Turn CVEs Into Exploits
Researchers at the Alan Turing Institute said an April study that appeared to find that GPT-4 powered agents can autonomously develop exploits of reported security vulnerabilities likely suffered from bad methodology.
The study says that artificial intelligence agents in 87% of cases used CVE descriptions to hack websites and had more success with vulnerabilities that ranked lower on the CVSS scale.
The institute report says it's not clear whether the agents developed the vulnerabilities or merely identified them through a web search. Although some of the CVEs became public after the data cutoff data for the large language model's training data, it turns out the agents were equipped with web-searching tools. "Subsequent work has shown that for 11 of the vulnerabilities, a publicly available exploit was found," the report states.
"This throws doubt on the original paper's claim that the LLM-agents can autonomously write the exploits as an emergent behavior, suggesting they most likely searched for the exploit online instead."
AI can be helpful in threat mitigation, such as by uncovering vulnerabilities through fuzzing, mapping target networks and scanning assets, the report says.
Santander Bank Asks Customers to Change Passwords After Cyberattack
Santander Bank advised customers to change their passwords following a data breach that apparently involved customer information files belonging to customers in Spain, Chile and Uruguay (see: Hacker Sells Apparent Santander Bank Customer Data).
El Confidencial reported Wednesday that the bank has notified customers that data including names and birthdates are part of the leaked data set but that data allowing hackers to directly access customer bank accounts are not. It nonetheless advised a password change in case the password might be easy to guess based on the leaked information.
Santander attributed the breach to an incident at a third-party database provider but did not give its name.
Christie's Ransomware Attack Affects 45,798 Individuals
A RansomHub ransomware attack on U.K.-based auction house Christie's last month led to the theft of information of 45,798 individuals, far fewer than the 500,000 claimed by the attackers, reported The Register. The breach occurred between May 8 and May 9 and resulted in the exfiltration of some stored data. The compromised data included names and ID document numbers. Christie's did not pay the ransom since negotiations with RansomHub collapsed before data exposure.
Most Cybersecurity Pros Are Considering Changing Jobs
Bitdefender's 2024 Cybersecurity Assessment Report reveals a significant shift in the cybersecurity landscape, with 3 in 5 respondents indicating they will be looking for a new job within the next year, representing a 25% increase from last year's results.
The survey polled over 1,200 IT professionals - 70% of whom said that they often work on weekends "due to the security concerns that my company faces." Nearly one-quarter said there are too many systems to manage effectively, and 71% of respondents said they feel that security solutions have not lived up to the promised hype, an increase from 54% last year.
Other Coverage From Last Week
- Brazil's Climb Onto the World Stage Sparks Cyber Risks
- Fraudsters Impersonate CISA in Money Scams
- Ransomware Gang TellYouThePass Exploits PHP Vulnerability
- Dutch Agency Renews Warning of Chinese Fortigate Campaign
With reporting from Information Security Media Group's David Perera in Washington, D.C., and Akshaya Asokan in southern England.