Cyber Security Roundup for October 2017

State-orchestrated cyber attacks have dominated the media headlines in October, with rogue state North Korea and its alleged 6,800 strong cyber force blamed for several cyber attacks. International intelligence scholars believe the North Korean leadership are using cyber warfare to up the political ante with their ongoing dispute with the United States. The North Koreans, as well as terrible security practices, were directly blamed by the UK National Audit Office for the recent NHS WannaCry attack (despite North Korea denying it). North Korea was also reported to be implicated in the stealing US War Plans from South Korea, and for a spear phishing campaign against the US Power Grid. The possible Russian manipulation of the US election with cyber attacks and rogue social media campaigns is still a story not going away, while the Chinese are alleged to be behind the data theft of Australian F-35 fighter jet, in what is described as an 'extensive' Cyberattack. The finger was pointed at Iran for the recent Parliamentary Emails cyber attacks in the UK, meanwhile, EU governments venting their cyber concern, warning that Cyber Attacks can be an Act of War.

Stephen Hawking caused controversy in both the science and tech industry last year when he said Artificial Intelligence could be a serious threat to human existence, could the plot of The Terminator really come to fruition? Perhaps so, as it was reported that AI had already defeated the Captcha Security Check system. Personally, I believe both AI and Quantum Computing will pose significant new threats to cybersecurity space in the next decade.

A far higher number of personal records were compromised in the Equifax data breach than was previously thought, with millions of UK citizens confirmed to be impacted by the US-based credit checking agency hack. Equifax’s now ex-CEO provided an interesting blow-by-blow account of the cyber-attack at a US government hearing, even though Equifax technical staff were specifically warned about a critical Apache Struts (web server) patch, it was ignored and not applied, which in turn allowed hackers to take full advantage of vulnerability to steal the Equifax data on mass. To make matters even worse, the Equifax consumer breach help website was found to be infecting visitors with spyware.

Yahoo revealed all 3 Billion of its user accounts had in fact been breached, in what is truly an astonishing mammoth sized hack, biggest in all history, so far. Elsewhere on the commercial hacking front, Pizza Hut's website was reported to be hacked with customer financial information taken, and Disqus said a 2012 breach it discovered in October exposed the information of 17.5 million its users from as far back as 2007.

It was a super busy month for security vulnerability notifications and patch releases, with Microsoft, Netgear, Oracle, Google, and Apple all releasing rafts of critical level patches. A serious weakness in the wireless networking WPA2 protocol was made public to great fanfare after researchers suggested all Wifi devices using WPA2 on the planet were vulnerable to an attack called Krack, which exploited the WPA2 weakness. Krack is a man-in-the-middle attack which allows an attacker to eavesdrop or redirect users to fake websites over Wifi networks secured using the WPA2 protocol. At the time of writing most wireless access point vendors and operating system providers had released patches to close the WPA2 vulnerability, and there have been no known exploits of the vulnerability reported in the wild.

BadRabbit is a new strain of ransomware which is emerging and is reported to be infecting systems and networks in Russia and the Ukraine at the moment. BadRabbit is the latest network self-propagating malware, like NotPeyta and WannaCry, to use the NSA EternalRomance hacking tool. A massive new IoT botnet was discovered, its continued growth is fuelled by malware said to be more sophisticated than previous IoT botnet king, Mirai. Russian based threat actor group APT28 is said to be targeting the exploitation of a recently patched Adobe vulnerability (CVE-2017-11292), in using a malicious Microsoft Word attachment, so ensure you keep on top of your system patching and always be careful when opening email attachments. 

Finally, the UK National Cyber Security Centre (NCSC) released its first annual report, as it seeks to improve cybersecurity across the UK. Among NCSC achievements cited in the report are:

• The launch of Active Cyber Defence, credited with reducing average time a phishing site is online from 27 hours to 1 hour
• Led UK response to WannaCry
• Advice website with up to 100,000 visitors per month
• Three-day Cyber UK Conference in Liverpool
• 43% increase in visits to the Cyber Security Information Sharing Partnership (CiSP)
• Produced 200,000 physical items for 190 customer departments via UK Key Production authority to secure and protect communications of Armed Forces and national security
• 1,000 youngsters on CyberFirst courses and 8,000 young women on CyberFirst Girls competition.
• Worked with 50 countries, including signing Nato's MoU

NEWS

• Equifax Data Breach Scale Increased / Caused by not Patching Apache Struts
• Equifax Credit Assistance Website Infected with Spyware
• NHS Cyber 'WannaCry' Attack Could Have Been Avoided With 'Basic' Security - NAO
• Yahoo Reveals all 3 Billion of its User Accounts were Breached
• Russian Hackers used Kaspersky software to gain info on U.S. Intel
• North Korea behind NHS WannaCry Attack after stealing US Cyber Weapons - Microsoft
• WannaCry: North Korea Denies Involvement in Ransomware Attack 
• North Korea Hacked South's Secret Joint US War Plans
• North Korea Spear Phishing Campaign aimed at U.S. Power Grid
• Data on Australia F-35 fighter jets stolen in 'Extensive' Cyberattack
• Indian Government and Corporate Credentials found for sale on the DarkNet
• Hackers breached Pizza Hut website, Stole Financial Info of Customers
• Websites Hacked to Mine Crypto-Cash
• Artificial Intelligence Smart Enough to Fool the Captcha Security Check
• Cyber-Attack Threat as important as Fighting Terrorism says GCHQ
• Disqus Breach Exposed Info on 17.5M between 2007-2012
• EU Governments to warn Cyber Attacks can be an Act of War
• Iran is being blamed for a cyber-attack against Parliamentary Emails
• Heathrow Investigates after Security and Anti-Terror Data found on USB stick
• Vulnerabilities in WiFi WPA Protocol - Krack Attack
• Microsoft release 28 Critical Security Updates for IE/Edge, Office, JET, Skype & Windows
• Oracle patches 252 bugs, increase in E-Business Suite and PeopleSoft flaws
• Netgear Patches 50 Vulnerabilities, 20 rated as High Risk
• Google Patches 7 Flaws in Dnsmasq
• Apple issues New Security Update for macOS High Sierra
• No Adobe Patches this Month

AWARENESS, EDUCATION AND THREAT INTELLIGENCE

• BadRabbit: Latest Malware using the NSA Hacking tool EternalRomance to Propagate
• APT28 joins BlackOasis in exploiting latest Adobe Flash Vulnerability
• Massive IoT Botnet Infects over 1 Million Organisations: More Sophisticated than Mirai

REPORTS

• NCSC First Annual Review: 1,131 Cyber Attacks Reported
• DDoS 2017 Report: Dangerous Overconfidence