Cyber Security Roundup for November 2020

A roundup of UK focused Cyber and Information Security News, Blog Posts, Reports and general Threat Intelligence from the previous calendar month, October 2020.

London's Hackney Borough Council has been tight-lipped about "a serious cyber-attack" which took down its IT systems, impacting its service delivery to citizens. Providing scant information about the attack, but it does have all the hallmarks of a ransomware outbreak. The council says it is working with the UK's National Cyber Security Centre (NCSC) and the Ministry of Housing to investigate and understand the impact of the incident. Ransomware attacks continue to be a major blight for UK public services, with councils to hospitals struggling to defend their IT systems against ransomware. Earlier this year Redcar and Cleveland Borough Council said it had been hit by a ransomware attack, which cost it more than £10m.

It looks like the ransomware will continue to pose a major threat to the UK for some time to come, with separate reports advising a resurgence in the Emotet trojan, a common dropper of ransomware, while the hacking group behind the notorious Ryuk ransomware has been reported as being active again. A new variant of the Ryuk ransomware was behind a cyberattack on Sopra Steria’s operations in October 2020, the digital services company confirmed.

British Airways had it credit card breach DPA fine cut by a massive £163m to £20m by the UK Information Commissioner's Office (ICO), which imposed the original fine after the now pandemic financially beleaguered airline lost 430,000 payment card details to hackers after an e-commence skimming attack in 2018. 

 BA lost 430,000 payment card details to hackers after Magecart e-commence skimming attack in 2018

This data breach was a lesson in failing at PCI DSS compliance, with customer credit card details stolen due to ‘Magecart’ payment card skimming script being injected onto the BA payment page. The attackers initially compromised the BA network through a third-party worker’s remote access (not MFA protected), gaining access to BA's Citrix environment. Once inside the BA network, the attackers were gifted privilege level access after finding a domain admin account username and password in plaintext on a server folder. I understand investigators found the storage of payment cards in plaintext, including CVV numbers post-payment authorisation which is never permitted under PCI DSS rules. Aside from the ICO fine and reputational damage, this breach cost is likely to have cost BA a small fortune in specialised PCI PFI digital investigation forensic work, a complete solution rebuild, and with card brand penalties. The Visa Chief Enterprise Risk Officer once said ‘no compromised entity has yet been found to be in compliance with PCI DSS at the time of a breach’, I understand that statement still rings true today.

The ICO didn't hold back in dishing a massive DPA (GDPR) fine to the Marriott Hotels chain to the tune of £18.4m after a major data breach which affected up to 7 million UK guests. The ICO reported UK citizen names, contact information, and passport details were compromised in the cyber-attack. The ICO also said the company failed to put appropriate safeguards in place but acknowledged it had improved.

Meanwhile, the UK NCSC released an advisory which repeated an earlier United States warning that Chinese Threat Actors are exploiting well-known software vulnerabilities. The advisory details 25 top vulnerabilities that are being exploited whilst offering mitigation advice. Many of the vulnerabilities allow attackers to gain access to a victim’s network by exploiting products directly connected to the internet. The NSA has also produced a nice infographic breaking the 25 vulnerabilities down by threat.

UK MPs said there was "clear evidence of collusion" between Huawei and the "Chinese Communist Party apparatus" following a parliamentary inquiry has concluded. While the US authorities charged six Russian hackers over cyber-attacks that targeted the UK Novichok probe and the Olympics.

Stay safe and secure.

BLOG

• Securing an Agile and Hybrid Workforce
• Cyber Security Roundup for October 2020

NEWS

• London's Hackney Borough Council hit by Cyber Attack
• British Airways fine dropped by £163m due to economic impact of Pandemic
• Blackbaud: Bank details and Passwords at Risk in giant Charities Hack
• Sopra Steria confirms new Ryuk version behind Cyberattack on its Operations
• The United States charges six Russian Hackers over Global Attacks that hit Novichok probe and Olympics
• 'Clear evidence of collusion' between Huawei and Beijing, claim MPs
• Therapy Patients Blackmailed for Cash after Clinic Data Breach
• Marriott Hotels fined £18.4m for Data Breach that hit Millions

VULNERABILITIES AND SECURITY UPDATES

• Microsoft Patches 102 Vulnerabilities, 13 Critical Rated
• NSA releases a list of 25 Vulnerabilities targeted by China
• New Chrome 0-day Under Active Attacks Addressed by Google Patch
• ESXi Vulnerability VMSA-2020-0023
• NCSC issued TLP white alert on a new SharePoint Vulnerability

AWARENESS, EDUCATION AND THREAT INTELLIGENCE

• Microsoft and Partners unite to target Trickbot Infrastructure in Legal Takedown
• Sophisticated New Android Malware marks the latest Evolution of Mobile Ransomware
• NCSC Advisory: The US warns of Chinese Actors Exploiting Public Vulnerabilities
• ‘Zombie’ Ryuk Ransomware Group Returns
• Resurgence of Emotet Ransomware