Cyber Security Roundup for October 2018

Aside from Brexit, Cyber Threats and Cyber Attack accusations against Russia are very much on the centre stage of UK government's international political agenda at the moment. The government publically accused Russia's military 'GRU' intelligence service of being behind four high-profile cyber-attacks, and named 12 cyber groups it said were associated with the GRU. Foreign Secretary Jeremy Hunt said, "the GRU had waged a campaign of indiscriminate and reckless cyber strikes that served no legitimate national security interest".

UK Police firmly believe the two men who carried out the Salisbury poisoning in March 2018 worked for the GRU.

• What is Russia's GRU Intelligence Agency?
• The risks of cyber-conflict with Russia
• Russia accused of net hack attacks
• Russian spy: What happened to the Skripals?

The UK National Cyber Security Centre said it had assessed "with high confidence" that the GRU was "almost certainly responsible" for the cyber-attacks, and also warned UK businesses to be on the alert for indicators of compromise by the Russian APT28 hacking group.  The NCSC said GRU hackers operated under a dozen different names, including Fancy Bear (APT28), had targetted:

• The systems database of the Montreal-based World Anti-Doping Agency (Wada), using phishing to gain passwords. Athletes' data was later published 
• The Democratic National Committee in 2016, when emails and chats were obtained and subsequently published online. The US authorities have already linked this to Russia.
• Ukraine's Kyiv metro and Odessa airport, Russia's central bank, and two privately-owned Russian media outlets - Fontanka.ru and news agency Interfax - in October 2017. They used ransomware to encrypt the contents of a computer and demand payment 
• An unnamed small UK-based TV station between July and August 2015, when multiple email accounts were accessed and content stolen

FireEye attributed TRITON ICS attack to Russia,  the US Cyber Command launches its first acknowledged offensive action against individual Russians and worryingly, it was reported that MoD secrets exposed in dozens of cybersecurity breaches.

Facebook was fined the maximum amount of £500,000 under pre-GDPR data protection laws by the UK Information Commissioner's Office (ICO) over the Cambridge Analytica Scandal. Facebook could face a new ICO fine after revealing hackers had accessed the contact details of 30 Million users due to a flaw with Facebook profiles. The ICO also revealed a 400% increase in reported Cyber Security Incidents and another report by a legal firm RPC said the average ICO fines had doubled, and to expect higher fines in the future. Heathrow Airport was fined £120,000 by the ICO in October after a staff member lost a USB stick last October containing "sensitive personal data", which was later found by a member of the public.

Notable Significant ICO Security Related Fines

• Facebook fined £500,000 over Cambridge Analytica Scandal. The ICO said that the fine would have been considerably higher under the GDPR which came into force on 25 May this year but cannot be applied to this case due to the timing of events.
• Equifax fined £500,000 for failing to protect the personal information of up to 15 million UK citizens during a cyber-attack in 2017
• Carphone Warehouse fined £400,000 for failing to adequately protect customer and employee data
• TalkTalk fined £400,000 after 157,000 customer records were stolen in 2015
• Sony fined £250,000 following the PlayStation network hack in 2013
• The British and Foreign Bible Society fined £100,000 in June 2018 following a cyber-attack that compromised personal data of 417,000 people

Last month's British Airways website hack was worse than originally reported, as they disclosed a second attack which occurred on 5th September 2018, when the payment page had 22 lines of malicious Javascript code injected in an attack widely attributed to Magecart.  Another airline Cathay Pacific also disclosed it had suffered a major data breach that impacted 9.4 million customer's personal data and some credit card data.

Morrisons has lost a challenge to a High Court ruling which made it liable for a data breach, after an employee, since jailed for 8 years, stole and posted thousands of its employees' details online in 2014.  Morrisons said it would now appeal to the Supreme Court., if that appeal fails, those affected will be able to claim compensation for "upset and distress". 

Interesting article on Bloomberg on "How China Used a Tiny Chip to Infiltrate U.S. Companies". However, there was a counter-narrative to the Bloomberg article on Sky News. But didn't stop Ex-Security Minister Admiral Lord West calling the Chinese when he said Chinese IT Kit 'is putting all of us at risk' if used in 5G.  He raises a valid point, given the US Commerce Department said it would restrict the export of software and technology goods from American firms to Chinese chipmaker Fujian Jinhua BT, which uses Huawei to supply parts for its network, told Sky News that it would "apply the same stringent security measures and controls to 5G when we start to roll it out, in line with continued guidance from government". Recently there have been warnings issued by the MoD and NCSC stating a Chinese espionage group known as APT10 are attacking IT suppliers to target military and intelligence information.

NCSC is seeking feedback on the latest drafts 'knowledge areas' on CyBOK, a Cyber Security body of knowledge which it is supporting along with academics and the general security industry.

Google are finally pulling the plug on Google+, after user personal data was left exposed. Google and the other three major web browser providers in the world said, in what seems like coordinated announcements, businesses must accept TLS Version 1.0 and 1.1 will no longer support after Q1 2018.

• Google with Chrome, said it will depreciate the protocol versions from January 2020
• Mozilla with Firefox  have set a deprecation date of March 2020
• Apple with Safari  have a deprecation date of March 2020
• Microsoft said both Edge and IE will disable the protocols in the 'first half' of 2020.

So its time to move over to the more secure TLS V1.2 or the more secure & efficient TLS V1.3.

NEWS

• UK Blames Russian GRU for Cyber Attacks and Vows to Respond
• BA Website and Data Breach by Magecart deeper than first thought
• Morrisons Loses Court Appeal over Employee Data Theft
• Cathay Pacific Data Breach exposes PII of 9.4 million Customers
• CyBOK: Feedback sought on NCSC's Cyber Security Body of Knowledge
• Big Four Web Browser Providers say Businesses must Accept TLS v1.0 & v1.1 End of Life by Q1 2020
• Facebook fined £500k by ICO over Cambridge Analytica Scandal
• Hackers Accessed Names and Contact Details of nearly 30 Million Facebook Users
• Chinese IT Kit 'putting all of us at risk' if used in 5G says Ex-security minister Admiral Lord West 
• MoD Secrets Exposed in dozens of Cyber Security Breaches
• Plug pulled on Social Network Google+ after Users’ Data Left Exposed
• Heathrow fined £120K by the ICO for USB stick Data Breach
• Fifa Hacked again as officials fear Information has been illegally obtained
• US Weapons Systems can be 'easily hacked'
• UK Government Launches IoT Code of Practice
• Microsoft Patches 49 Vulnerabilities, 12 of which are Critical for Chakra, IE\Edge, MS XML, Scripting Engine & Hyper V
• Adobe Releases Fixes 86 Vulnerabilities for Acrobat and Acrobat Reader
• Adobe Patches Vulnerabilities in Adobe Digital Editions, Experience Manager, FrameMaker & Tech Comms Suite
• TP-Link (TL-WRN841N) Router Vulnerable to Remote Takeover Flaw
• Cisco release Patches for 36 Vulnerabilities, 3 of which are Critical
• Cisco Patches Command Injection Bug in WebEx Meetings Desktop App for Windows
• Vulnerability found in Sophos Anti-Malware Product
• Oracle release Security Updates for 45 Critical-Rated Vulnerabilities
• Amazon Patches IoT and Critical Infrastructure Security Flaws

AWARENESS, EDUCATION AND THREAT INTELLIGENCE

• FireEye outs APT38 as North Korean Cyber Bank Heist Gang
• APT28 Threat: National Cyber Security Centre warning to UK Companies 
• DDoS and Ransomware tools for Starter and Experienced Cybercriminals Exposed
• Cobalt Gang targets Banks and Financial Service providers by sneaking PDFs past staff
• Enigmatic Cyber Espionage Campaign revives source code from old foe APT1
• Exploit Kits: Autumn 2018 Update 
• Crypto-Locking Kraken Ransomware Looms Larger

REPORTS

• ICO reveals 400% Increase in Reports of Cyber-Security Incidents
• ICO Average data breach fines have doubled as ICO hints at Higher Fines
• Radware 2018 State of Web Application Security Report 
• Abandoned Web Applications 'hidden threat to Corporate Security’ says High-Tech Bridge Report

Cyber Security Roundup for September 2018

September 2018 started with a data breach bang, with British Airways disclosing a significant hack and data loss. 380,000 of the airlines' website and mobile app customers had their debit and credit card details lifted via a maliciously injected script.  The breach even caused BA owners, IAG, to drop in value 4%. And to compound matters, there were several claims made that the BA website wasn't PCI DSS compliant, implying if they were PCI DSS compliant, their customer's personal and payment card information would still be safe.  For further details about this breach see my blog posts; British Airways Customer Data Stolen in Website and Mobile App Hack and British Airways Hack Update: Caused by Injected Script & PCI DSS Non-Compliance is Suspected.

Facebook continues to make all the wrong kind of privacy headlines after a massive user data breach was confirmed by the social media giant at the end of the month. Facebook said at least 50 million users’ data was at risk after hackers exploited a vulnerability the Facebook code. Facebook CEO Mark Zuckerberg said he doesn’t know who is behind the cyber attack, however, the FBI are investigating. 

There was a good measure of embarrassment at the Tory Conference after a flaw in the conference App revealed the personal data of senior UK government cabinet ministers, with Boris Johnson, Michael Gove, Gavin Williamson among those whose their personal information and phones numbers made available.

There was a number of large data breach fines handed out in September, Tesco Bank was hit by a whopping £16.4 by the Financial Conduct Authority (FCA), the fine would have been doubled if it weren't for Tesco's good co-operation with the FCA investigation. The FCA said Tesco had security deficiencies which left their bank account holders vulnerable to a cyber attack in November 2016. The attack netted the bad guys, via 34 transactions, a cool £2.26 million. The FCA report said the cyber criminals had exploited weaknesses in the bank's design of its debit card, its financial crime controls and in its financial crime operations team, to carry out the attack over a 48-hour period. 

Equifax was fined the maximum pre-GDPR law amount of £500K by the Information Commissioner's Office (ICO) after the US-based credit reference agency failed to protect the personal data of 15 million UK citizens. The ICO ruled Equifax's UK branch had "failed to take appropriate steps" to protect UK citizens' data. It added that "multiple failures" meant personal information had been kept longer than necessary and left vulnerable.

The ICO also fined Bupa £175K, for not having good enough security to prevent the theft of 547,000 customer records by an employee.  Uber has paid £133m to settle legal claims to customers and drivers, as a result of trying to cover up a huge breach which occurred in 2016 from their regulators. The ride-hailing company admitted to paying off hackers to the tune of $100,000 to delete the data they robbed from Uber's cloud servers. The personal data stolen was from 57 million Uber accounts, also included information about 600,000 driving license numbers. 

Looks like the MoD and GCHQ are looking to beef up Britan's Cyber Offense capabilities, announcing a plan to recruit a 2,000 strong 'cyber force' to take on the Russian threat. Meanwhile across the pond, the Mirai creators have done a deal to keep themselves out of jail in return for helping the FBI catch cybercrooks, which has echoes of the approach the FBI took with con artist and cheque fraud expert Frank Abagnale, the subject of book and movie "Catch me if you Can".

Bristol Airport was impacted by a ransomware attack, which took down their arrival and departure screens for a couple of days, and a Scottish Brewery was also hit by ransomware attack through infected CV it had received through an online job advertisement. 

Europol warned of 15 ways you could become a Cyber Crime Victim, and there was an excellent article in the New York Times on the Bangladesh’s Central Bank Cyber Theft

NEWS

• British Airways Hacked, 380,000 Customer Payment Card details Stolen via Website & Mobile App
• Equifax fined £500K by ICO over Cyber Attack that Breach UK Citizen Personal Information
• 50 Million Facebook Accounts Exposed after Security Breach
• Major Security flaw in Tory Conference App reveals Personal Data 
• Tesco Bank fined £16.4m by FCA over ‘Avoidable’ Cyber Attack
• Uber pays £113m to settle Legal action after Cyber Attack exposed 57 million Customers & Drivers
• Bupa fined £175,000 for Personal Email Data Theft by an Employee affecting 547,000 Customers
• Amazon investigates claims Staff are Selling Data for Bribes
• Equifax fined £500,000 for failing to protect Customer details in Cyber Attack
• Ransomware Attack led to Bristol Airport Blank Screens
• Scottish Brewery Ransomware attack leverages job opening
• Veeam MongoDB left unsecured, 440 million records exposed after AWS Misconfiguration
• MEGA Chrome extension compromised to steal credentials and cryptocurrency
• Staff and Students behind Hacks on UK Universities
• Britain to create 2,000-strong Cyber Force to Tackle Russia Threat
• Mirai creators sentenced to probation after assisting FBI with Cyber Investigations
• Microsoft Patches 61 Vulnerabilities for Windows, IE\Edge, Office, SharePoint, Chakra,  Flash, and .NET
• Cisco Patches Critical Default Password Vulnerability
• Vulnerability in Cisco Routers could allow DoS attacks
• Adobe Releases Important Fixes for Flash Player
• Adobe Releases Critical Fix for Acrobat and Acrobat Reader
• Adobe Releases Critical Fixes for ColdFusion
• Cisco Releases 29 Patches, 3 Critical, including one for Apache Struts
• Apple pushes out Mojave 10.14 to Patches numerous Vulnerabilities
• Google Desktop Update for Chrome

AWARENESS, EDUCATION AND THREAT INTELLIGENCE

• CrowdStrike verifies portions of a report linking APT10 activity to Chinese government actors
• Fraudsters Targeting NHS Suppliers, using with Phishing Email Tactics
• Viro Botnet Ransomware Breaks Through
• Ransomware Gains Force as Prominent Cyber Threat 
• USB Malware and Cryptominers are Threat to Emerging Markets
• Malware Campaign infects Thousands of Magento e-Commerce websites

REPORTS

• Europol warns of 15 ways of becoming a Cyber Crime victim
• Billion Dollar Bank Job – Article by New York Times detailing the Bangladesh’s Central Bank Cyber Theft
• Palo Alto Web-based Threat – 2018 Q2 Reports: Out of date Enterprise Systems Targeted by Criminals