homepage
Menu
Open menu

SANS NewsBites

Google Cloud is Rolling Out Mandatory MFA; Interpol Operation Targets Ransomware, Phishing, and Info Stealers; German Legislation Aims to Protect Legitimate Cybersecurity Research

November 8, 2024  |  Volume XXVI - Issue #86

Top of the NewsThe Rest of the Week's NewsInternet Storm Center Tech Corner

Top of the News

2024-11-06

Google Cloud Will Require MFA by the End of Next Year

Google Cloud plans to establish mandatory multi-factor authentication by the end of 2025. This month (November 2024), Google Cloud will begin encouraging the 30 percent of users who have not yet adopted MFA to do so. In early 2025, Google Cloud will start 'requiring MFA for all new and existing Google Cloud users who sign in with a password.' By the end of 2025, Google Cloud expects to 'extend the MFA requirement to all users who federate authentication into Google Cloud.' They will offer flexible options for MFA adoption.

Editor's Note

This is a welcome move by Google, and to be frank, mandatory MFA should be considered as table stakes for any cloud service provider.

Brian Honan
Brian Honan

The time for passwords as the single method of authentication has come to an end. Kudos to Google and other tech companies for 'forcing' transition to multi-factor authentication. This will make credential harvesting much more difficult for the adversary. Well done in setting an end date.

Curtis Dukes
Curtis Dukes

Google has been a leader in promoting strong authentication (at least two kinds of evidence, at least one of which is resistant to replay). Its solutions have offered users options that minimize any inconvenience. For example, passkeys are both more secure and more convenient than passwords. In part to avoid alienating users and customers, Google has offered, not mandated, strong authentication. It is now clear that in most applications, clearly so in infrastructure applications, relying on fraudulently reusable passwords is reckless. While the end date that they have set, end 2025, seems inconsistent with the urgency of the situation, it is probably proportionate to the size of the effort. Let us hope for early progress.

William Hugh Murray
William Hugh Murray

I may sound like a broken record, but MFA needs to be ubiquitous. Google is taking a three-phase approach, with notification and reminders, and you don't have to wait to implement MFA. Given the publicity, assume attackers will work to take advantage of remaining password-only accounts. Google will integrate with existing MFA in your IDP or you can use their MFA, meaning there is no reason to not succeed here.

Lee Neely
Lee Neely

2024-11-06

Interpol Global Crackdown on Phishing, Ransomware, and Info Stealers Nets 40+ Arrests

An INTERPOL operation involving law enforcement agencies and private sector partners in multiple countries has resulted in more than 40 arrests and the disruption of dozens of servers allegedly used to conduct criminal activity. Operation Synergia II targeted criminal operations involved in phishing, ransomware, and information stealers. More than 22,000 suspicious IP addresses were taken down and nearly 60 servers seized.

Editor's Note

Talk about International cooperation: over 95 INTERPOL member countries participated in the takedown, as well as INTERPOL partners Group-IB, Trend Micro, Kaspersky, and Tem Cymru. While I am certain replacement services will appear, so we need to remain vigilant, I am also confident that INTERPOL (and others) will continue these takedowns, removing any appearance of these being consequence-free attacks.

Lee Neely
Lee Neely

Well done to all involved in this operation. It is welcoming to see so many arrested for their alleged participation in crime, but it is more welcoming to see the amount of servers and data seized. This should provide a treasure trove of intelligence which law enforcement will put to good use in the future.

Brian Honan
Brian Honan

This is the money line: 'The global nature of cyber-crime requires a global response," My only quibble: increase the frequency of such takedowns; it was nine months between Synergia I and II.

Curtis Dukes
Curtis Dukes

2024-11-07

German Legislators Propose Amendment to Protect Researchers Who Look for Vulnerabilities

Germany's Federal Ministry of Justice is proposing an amendment to computer criminal law 'to clearly distinguish legally between actions in IT security research that are not to be disapproved of and behavior that is punishable. The bill is intended to eliminate the existing legal uncertainty and also to increase the scope of punishment for serious offenses that endanger or impair critical infrastructure.'

Editor's Note

The categorization of common tools as criminal creates a perception challenge and a need to have a definition whereby their use is legal. The increased occurrence of living-off-the-land attacks demonstrates that the activities, not the tools, needed to be categorized, which then puts ethical hackers in the crosshairs. As I recall repeated guidance from Ed Skoudis about having a get-out-of-jail memo (permission) before doing any testing, I suggest adding a check of the local laws/regulations to that list, to avoid running afoul of less forward-looking jurisdictions.

Lee Neely
Lee Neely

This has been a legal gray area for years in most national cybersecurity crime statutes, although there has been some movement in past years to define cybersecurity research. By creating a clear use case for ethical hackers/cybersecurity researchers, you strengthen efforts to root out vulnerabilities in vendor products. Let's hope the amendment passes the German legislature and that other countries follow suit.

Curtis Dukes
Curtis Dukes

The line between so-called "researchers" and rogue hackers has always been thin, with individuals crossing back and forth between roles. This proposal is intended to clarify the roles and to make the line more clear.

William Hugh Murray
William Hugh Murray

The Rest of the Week's News

2024-11-05

Canada Arrests Hacker Suspected in Snowflake Breaches and Extortions

On October 30, 2024, Canadian authorities arrested Alexander Moucka, a.k.a. Connor Riley Moucka, who is accused of extorting companies after stealing hundreds of millions of customer records from Snowflake cloud data storage accounts. The 26-year-old was taken into custody under a provisional US arrest warrant, and appeared in court on November 5, 2024 "as part of extradition proceedings." Mandiant has been tracking threat cluster UNC5537 and its compromise and sale of Snowflake-stored data since April, 2024, and believes that the cloud storage accounts were breached using credentials previously stolen and leaked in infostealer attacks; the accounts in question were not protected by MFA. Among the 165 compromised accounts were Live Nation Entertainment (Ticketmaster), Advanced Auto Parts, Lending Tree, Neiman Marcus, Santander Bank, State Farm, and AT&T, who reportedly paid $370,000 (US) for deletion of stolen phone records. KrebsOnSecurity identifies aliases and actors associated with UNC5537 including John Erin Binns Ð who was arrested in Turkey in May, 2024, for involvement in a 2021 T-Mobile breach Ð and two nicknames believed to be used by Moucka, associated with SIM-swapping attacks, data breaches, and violent online harassment, swatting, doxxing, and extortion from extremist "harm groups." Allison Nixon, Chief Research Officer at Unit 221B, is aware that other closely-associated threat actors are still at large, but calls Moucka's arrest "a good start," as he is "one of that tiny minority that causes disproportionate harm."

Editor's Note

UNC5537 aka Alexander 'Connor' Moucka has been declared by Mandiant to be one of the most consequential threat actors of 2024, which highlights the impacts of using off-the-shelf tools for attacks. The current trial is to have him extradited to the US, at which point the competing jurisdictions will have to decide where to prosecute which crimes. There appear to be at least two other threat actors associated with UNC5537 based in North America and Turkey. Interesting wrinkle, Turkish constitution prohibits citizens being extradited to a foreign state.

Lee Neely
Lee Neely

2024-11-07

Cisco Releases Updates to Fix Critical Command Injection Vulnerability in Unified Industrial Wireless Software

On Wednesday, November 6, Cisco released updates to address a critical command injection vulnerability in the web-based management interface of their Cisco Unified Industrial Wireless Software for Cisco Ultra-Reliable Wireless Backhaul (URWB) Access Points. The improper validation of input issue could be exploited to execute arbitrary command with root privileges on vulnerable systems. Users running Cisco Unified Industrial Wireless Software Release version 17.15 are urged to update to version 17.15.1. Users running Cisco Unified Industrial Wireless Software Release versions 17.14 and earlier are urged to migrate to a fixed release. Cisco also released updates to address more than a dozen additional vulnerabilities in their products.

Editor's Note

Update your Cisco devices, then make sure none of your management interfaces are exposed. Comprehensive input validation has to become a survival skill. Make sure you're fully testing EVERY input, no matter how difficult you think it would be to supply bogus data.

Lee Neely
Lee Neely

2024-11-06

Georgia Hospital Ransomware Attack

Memorial Hospital and Manor in the US state of Georgia is experiencing IT outages related to a ransomware attack. Specifically, hospital staff are unable to access their electronic health record (EHR) system. The attack has also disrupted the availability of Memorial Hospital and Manor's email system and website. The hospital posted a notification on their Facebook page on Sunday, November 3, noting that they had detected a ransomware attack the previous day.

Editor's Note

The Embargo ransomware gang is taking credit for the attack and claims to have 1.15 terabytes of data they will leak on November 8th if not paid. Embargo's claim to fame is they have a tool which appears to be able to disable EDR as well as using the double extortion play to get paid. They have attacked other hospitals including Idaho's Weiser Memorial Hospital and California's NorthBay Vacaville Hospital. Things to think about here include what to do when your electronic records are not available, and frequency of updates to your breach notification; five days seems a bit long.

Lee Neely
Lee Neely

2024-11-06

Washington State Court System is Experiencing IT Outages Following 'Unauthorized Activity'

Court systems in the northwestern US state of Washington are experiencing outages after the Washington State Administrative Office of the Courts (AOC) detected 'unauthorized activity on the Washington courts network.' AOC 'proactively took down [their] systems to secure them.' Some Washington state court systems have reported that their electronic filing systems and phones were unavailable; others have rescheduled certain hearings. The suspicious activity was identified over the weekend; the systems have been offline since Sunday, November 3.

Editor's Note

It's been a very busy year for ransomware gangs Ð on par if not exceeding last year. By now we all know about ransomware attacks, and we know how to protect ourselves from attack. So, the question becomes, why aren't we?

Curtis Dukes
Curtis Dukes

The outage is impacting courts in the counties of Thurston, Monroe, Renton, Puyallup, Bainbridge, King, Pierce, Whatcom and Lewis as well as several city municipal courts. Check the website for your local court before attempting any planned business with them.

Lee Neely
Lee Neely

Municipalities rank just after healthcare as targets for cyber extortion.

William Hugh Murray
William Hugh Murray

2024-11-06

AI Civil Rights Bill Enters House

'From housing to health care to national security, algorithms are making consequential decisions, diagnoses, recommendations, and predictions that can significantly alter our lives,' says Senator Ed Markey (D-MA), who introduced the Eliminating Bias in Algorithmic Systems (BIAS) Act to the US Senate in December, 2023. The same bill was introduced in the House of Representatives on November 1, 2024, and is co-sponsored by a total of eighteen Democrats in the House and Senate. Sen. Markey emphasizes that the impact of AI and "Big Tech" compounds the risks, requiring the federal government to "protect [marginalized] communities and ... address algorithmic harms." The law would direct "all Federal agencies that use AI technology to create an office of civil rights." These offices would investigate and enact measures to mitigate algorithmic discrimination through their agencies' relationships with "industry, representatives, businesses, [and] civil rights advocates;" these reports would then be passed to congressional committees to generate additional legislative and administrative recommendations.

Editor's Note

The Eliminating BIAS act was introduced to mitigate the impacts of algorithmic decision making, and the widespread adoption of AI increases the potential impacts. Recent conversations with (qualified) applicants about how they have to game the screening systems to get an interview indicates we need to be looking at what is rejected (and passed) to assess, monitor and tweak our algorithms, AI-driven or otherwise, regardless of legislative action.

Lee Neely
Lee Neely

While I applaud the civil rights bill, the best solution is enriching data sets used to train the large language models. Until we have accessible data sets that represent marginalized communities, you unfortunately will have increased chances of algorithmic bias.

Curtis Dukes
Curtis Dukes

2024-11-07

South Korean Privacy Commission Fines Meta $15.6 million

The South Korean government's Personal Information Protection Commission (PIPC) has stated that Meta violated the Personal Information Protection Act (PIPA) by illegally collecting data from approximately 980,000 users and sharing those data with advertisers, and has fined the company 21.6 billion won ($15.6 million US). Meta disregarded legal safeguards for personal data, "reject[ed] access to personal data without legitimate rationale," and was negligent in identity verification during account recovery, leading to data breaches for at least 10 users. The PIPC press release issued on November 7, 2024, states that "Put simply, Meta analyzed users' behavioral data, including the pages they hit the 'Like' button, ads they clicked on Facebook, etc., to create and operate advertising topics associated with sensitive data (specific religious affiliations, homosexuality, whether a user is a transgender or North Korean defector) collected from the users." Both Meta and Google have repeatedly incurred tens of millions in fines from the PIPC for similar violations.

Editor's Note

Privacy is a big deal, not just in the EU, and you need to make sure you're not inadvertently crossing the lines. Consider the use of an external assessor to counter any internal bias. No matter your company size, you really don't want to see if you can weather this sort of storm.

Lee Neely
Lee Neely

Internet Storm Center Tech Corner

Steam Account Checker Poisoned with Infostealer

https://isc.sans.edu/diary/Steam+Account+Checker+Poisoned+with+Infostealer/31420

Insights from August Web Traffic Surge

https://isc.sans.edu/diary/Guest+Diary+Insights+from+August+Web+Traffic+Surge/31408

Python RAT with a Nice Screensharing Feature

https://isc.sans.edu/diary/Python+RAT+with+a+Nice+Screensharing+Feature/31414

SANS Holiday Hack Challenge

https://www.sans.org/mlp/holiday-hack-challenge-2024

Apple CVE-2024-44258 PoC Exploit

https://github.com/ifpdz/CVE-2024-44258

HPE Aruba vulnerabilities

https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04722en_us&docLocale=en_US

Android Security Bulletin November 2024

https://source.android.com/docs/security/bulletin/2024-11-01

Cisco Ultra Reliable Wireless Backhaul Vulnerability

https://www.cisco.com/site/us/en/products/networking/industrial-wireless/ultra-reliable-wireless-backhaul/index.html

Malware Delivered as Virtual Machine

https://www.securonix.com/blog/crontrap-emulated-linux-environments-as-the-latest-tactic-in-malware-staging/

Breaking Down Multipart Parsers: File upload validation bypass

https://blog.sicuranext.com/breaking-down-multipart-parsers-validation-bypass/

Talkative Air Fryer

https://www.which.co.uk/policy-and-insight/article/why-is-my-air-fryer-spying-on-me-which-reveals-the-smart-devices-gathering-your-data-and-where-they-send-it-a9Fa24K6gY1c

Pygmy Goat Malware Report

https://www.ncsc.gov.uk/section/keep-up-to-date/malware-analysis-reports

Veeam Backup Enterprise Manager Vulnerability (CVE-2024-40715)

https://www.veeam.com/kb4682

Evasive ZIP Concatenation: Trojan Targets Windows Users

https://perception-point.io/blog/evasive-concatenated-zip-trojan-targets-windows-users/

Fake DocuSign Invoices

https://lab.wallarm.com/attackers-abuse-docusign-api-to-send-authentic-looking-invoices-at-scale/