Giu 05, 2024 Marina Londei Approfondimenti, Minacce, News, RSS 0

In un panorama di minacce sempre più complesse e pericolose, il ruolo del CISO diventa essenziale per proteggere adeguatamente le organizzazioni, ma i leader aziendali sembrano non dare peso alle preoccupazioni di questi esperti.

Secondo l’ultima ricerca Trend Micro, “The CISO Credibility Gap: How a Communication Breakdown in the Boardroom is Hurting Cyber-Resilience“, il 79% dei responsabili di cybersecurity ha avvertito pressioni da parte dei leader aziendali per minimizzare la gravità dei rischi a cui è esposta l’azienda. 

“Oltre la metà dei responsabili di sicurezza afferma che i rischi cyber sono quelli più pericolosi per l’azienda. Purtroppo, i CISO non riescono a comunicare questi rischi in un linguaggio che sia comprensibile ai leader aziendali e di conseguenza vengono ignorati, sminuiti o accusati di eccessivo allarmismo” afferma Veronica Pace, Head of Marketing di Trend Micro Italia.

Tra chi afferma di aver subito pressioni dai responsabili, il 43% sostiene di essere stato etichettato come “ripetitivo” o “fastidioso” e il 42% come “eccessivamente negativo”, mentre il 33% dichiara addirittura di essere stato licenziato.

La ricerca di Trend Micro evidenzia un grave divario di fiducia legato soprattutto alla difficoltà di spiegare e allineare i rischi cyber con quelli aziendali; a dimostrazione di ciò, il 46% dei CISO intervistati afferma di aver guadagnato più credibilità solo nel momento in cui è riuscito a quantificare il valore della strategia di cybersecurity in termini di business.

Un approccio di questo tipo consentirebbe ai responsabili di sicurezza di ottenere più responsabilità (45%), essere visti come una funzione di maggior valore (44%), ricevere più budget (43%) e guadagnare posizioni nei processi decisionali (41%).

Al momento, però, solo il 54% degli intervistati ritiene che la dirigenza comprenda completamente i rischi di sicurezza a cui è esposta l’organizzazione, e oltre un terzo dei CISO coinvolti afferma che la sicurezza è considerata ancora parte dell’IT e non un rischio aziendale. L’80% degli intervistati ritiene che una violazione grave può incentivare i responsabili aziendali ad agire con maggior fermezza contro i rischi informatici.

L’uso di più prodotti per proteggere la superficie di attacco complica la comunicazione coi leader aziendali: poiché ci sono fonti eterogenee, i dati raccolti risultano incoerenti ed è difficile usarli per dare ai leader un’idea chiara del rischio e dell’impatto sul business. Il 58% del campione ritiene che, per superare questa sfida, è necessario migliorare le proprie abilità comunicative, ma per supportare la chiarezza delle informazioni è anche importante affidarsi a una piattaforma unificata. 

“I responsabili di cybersecurity devono riuscire a interagire meglio, oppure la resilienza informatica dell’organizzazione ne risentirà. Il primo passo è avere a disposizione un’unica fonte di verità su tutta la superficie di attacco” conclude Pace.

A survey from Abnormal Security reveals that account takeovers are a prominent threat. By surveying 300 security professionals across a range of industries and organization sizes, the report found that 83% of organizations claimed to have experienced at least one account takeover in the last year. Furthermore, 45.5% of organizations experienced more than five account takeover incidents in the past year, and nearly one in five experienced more than 10. The survey determined that 77% of security leaders believe an account takeover is among the top four security concerns for their organization. 

The survey also revealed what cloud applications security stakeholders are most concerned may be compromised. These include: 

• File and storage sharing services, such as Box and Dropbox. 
• Cloud infrastructure services, such as Microsoft Azure, Google Cloud Platform and Amazon Web Services. 
• Business email accounts, such as Gmail and Microsoft Outlook. 
• Contract and document management software, such as Docusign. 

https://www.securitymagazine.com/articles/100745-83-of-organizations-faced-at-least-one-account-takeover-the-past-year

Nei PLC tradizionali, un attaccante può prendere di mira il livello di logica di controllo o il firmware. Gli attacchi al firmware, in particolare, offrono un elevato grado di controllo del dispositivo e sono difficili da rilevare, ma la distribuzione del malware può risultare complicata. Gli attacchi al livello di logica di controllo sono più facili da eseguire, ma anche più suscettibili di essere scoperti. Entrambi questi scenari richiedono però all’attaccante un accesso privilegiato alla rete industriale del target.Molti PLC moderni includono un server web e possono essere gestiti a distanza tramite API dedicate e un browser web che funge da interfaccia uomo-macchina (HMI). Questo determina sicuramente numerosi vantaggi in termini di efficienza ed efficacia delle operation, tuttavia determinano anche un aumento della superficie di attacco.

Infatti, i ricercatori hanno sviluppato un malware web-based, denominato IronSpider, che risiede nella memoria del controller, ma è eseguito dai dispositivi dotati di browser presenti nell’ambiente ICS. Questo malware sfrutta le API web legittime del PLC per interferire con i processi industriali o danneggiare le macchine.

Il malware IronSpider sfrutta i service worker per garantire la persistenza, consentendo al codice JavaScript di eseguirsi indipendentemente dalla pagina web che lo ha installato, e può sopravvivere anche dopo la rimozione dal server. Utilizzando questo metodo, il malware può superare gli aggiornamenti del firmware, le nuove versioni degli HMI web-based e persino le sostituzioni hardware.

Una volta distribuito, le capacità del malware dipendono dalla potenza delle legittime API web-based utilizzate, e alcune di queste API sono molto potenti. Ad esempio, possono essere sfruttate per sovrascrivere direttamente i valori di input/output, manipolare gli input dell’HMI, modificare le impostazioni di sicurezza, falsificare i dati visualizzati sull’HMI e persino esfiltrare dati in tempo reale.

I ricercatori hanno dichiarato che il malware può anche stabilire una connessione di Comando & Controllo (C&C), anche se il PLC bersaglio si trova in una rete isolata. Una volta che l’attaccante ha eseguito l’accesso, può coprire le proprie tracce facendo in modo che il malware si distrugga, sovrascriva il payload dannoso con un payload benigno, deregistri tutti i service worker e potenzialmente esegua un ripristino alle impostazioni di fabbrica del dispositivo.

Il malware è stato sviluppato prendendo di mira i PLC Wago. L’attacco simulato coinvolge lo sfruttamento di vulnerabilità precedentemente sconosciute per distribuire il malware quando l’operatore bersaglio guarda un banner pubblicitario appositamente creato. IronSpider è stato paragonato al noto Stuxnet, che ha preso di mira una centrale nucleare dell’Iran più di un decennio fa.

“Stuxnet ha sabotato le strutture nucleari iraniane modificando il segnale di uscita analogico verso i variatori di frequenza che controllavano le centrifughe di arricchimento dell’uranio. Un risultato diretto di questo sabotaggio è stata la distruzione fisica di oltre 1.000 centrifughe e una riduzione del 30% della capacità operativa delle strutture”, hanno detto i ricercatori nel loro paper. Il malware IronSpider è stato in grado di ottenere un attacco fondamentalmente simile utilizzando un approccio drasticamente diverso. Stuxnet attaccava i PLC tramite malware di logica di controllo distribuito tramite workstation di ingegneria compromesse. IronSpider, utilizza un malware we-based distribuito attraverso un sito web maligno senza la necessità di compromettere sistemi periferici.

Sebbene l’attacco sia stato eseguito contro un prodotto specifico, i ricercatori hanno dimostrato che questo tipo di malware PLC può essere utilizzato anche contro PLC Siemens, Emerson, Schneider Electric, Mitsubishi Electric e Allen Bradley.

Nel loro studio, i ricercatori hanno formulato diverse raccomandazioni per proteggersi dal malware PLC web-based, inclusi i passaggi che gli sviluppatori browser possono implementare per impedire l’accesso pubblico alle reti private e i cambiamenti all’architettura dei server web. Hanno inoltre delineato i controlli che i produttori di PLC possono implementare per rendere più sicuri i propri dispositivi contro questo nuovo tipo di attacco.

Fonti: “Compromising Industrial Processes using Web-Based Programmable Logic Controller Malware” Ryan Pickren, Tohid Shekari, Saman Zonouz, Raheem Beyah Georgia Institute of Technology, Network and Distributed Systems Security (NDSS) Symposium 2024 26 February – 1 March 2024, San Diego, CA, USA https://www.ndss-symposium.org/wp-content/uploads/2024-49-paper.pdf

Articolo a cura di Mariacristina Bringheli

Profilo Autore

Mariacristina è una Cyber Security Manager con oltre 5 anni di esperienza in ambito IT ed OT. Ha lavorato in diversi contesti internazionali, inclusi Stati Uniti e Medio Oriente, interagendo con una vasta gamma di clienti e fornendo supporto nella definizione e implementazione di strategie integrate di sicurezza informatica.
Negli ultimi anni, nell’area Emerging Technology di Deloitte Risk Advisory, si concentra sulle tematiche cyber legate alle tecnologie emergenti, con focus sulla sicurezza OT e IIoT, e ha acquisito una conoscenza strutturata e approfondita diversi processi produttivi e delle minacce informatiche che li prendono di mira, in particolare in ambienti complessi e fortemente interconnessi. La sua esperienza e competenza si estendono anche alla valutazione dei rischi informatici e alla protezione delle infrastrutture critiche.
Inoltre, grazie al suo coinvolgimento in diversi progetti focalizzati sulla gestione delle crisi informatiche e l’esecuzione di simulazioni ed esercitazioni con CEO e Top Management, ha sviluppato competenze nella gestione di crisi cyber a livello strategico, tattico e operativo.

https://www.ictsecuritymagazine.com/articoli/web-based-plc-malware-come-ironspider-rivoluziona-le-minacce-cibernetiche-in-ambito-industriale/

The ShinyHunters threat operation has taken responsibility for the alleged hacking of Ticketmaster, claiming to have stolen the personal information of 560 million users. The breached information includes full names, emails, phone numbers, addresses, event information, ticket sale details and order details. The ShinyHunters group states that it is also in possession of credit card information, but only the last four digits and expiration dates. ShinyHunters is offering the database for sale at $500,000. 

Security leaders weigh in 

Toby Lewis, Global Head of Threat Analysis at Darktrace:

“This alleged attack on Ticketmaster is an unpleasant reminder that no organization is immune from cyber threats. However, it’s crucial to approach this incident with skepticism until more information is available, as the timing of the data being offered on the relaunched BreachForums site raises questions about its authenticity.

“If confirmed, Ticketmaster must be transparent about the accessed data. Customers can protect themselves by changing passwords and monitoring their accounts, although this may be fruitless if the attackers still have access or if there is no breach in the first place.

“It’s advisable to wait for confirmation and follow instructions from Ticketmaster’s incident response teams. While there’s no harm in proactively changing passwords (including on accounts with re-used passwords), customers should be prepared to do it again if necessary.

“Cybersecurity should be at the forefront of businesses’ technology strategy. AI tools can automate prevention and response protocols, enabling proactive defence. Until more details emerge, customers should remain vigilant but avoid jumping to conclusions about the scale or impact of this alleged breach.”

Narayana Pappu, CEO at Zendata:

“Potentially affected Ticketmaster customers should closely monitor their email for any new account creations and credit/debit cards for transactions. I also recommend that they create a pin with their cell phone providers to protect against SIM swaps.

“Ticketmaster has a significant market share of the ticket sale market, and incidents like this can have significant long-term impact. In the past, breaches have led to companies losing market share to key competitors. The Ashley Madison and Equifax breaches are a couple of examples.”

John Bambenek, President at Bambenek Consulting:

“The good news for Ticketmaster customers is that some of the more sensitive information hasn’t been stolen, including full card numbers, so likely this could be used for targeted phishing. This is why the price of the database is so small compared to the number of records. Consumers will see this months from now. 

“Ticketmaster is a near-monopoly in its space. Since the risks customers will face will be in the future in the form of phishing, odds are the impact is minimal. Consumers have become numb to data breaches which leads to industry complacency.”  

Debrup Ghosh, Sr. Staff Product Manager at Synopsys Software Integrity Group:

“Companies offering a digital marketplace need to place special emphasis on protecting key customer data, especially personally identifiable information (PII). In the age of digital transformation, data is a valuable currency — hence, companies need to continually protect not only company IP but also customer data that helps them study consumer preferences and build the product to better serve those consumer preferences. Overall, companies need to invest in both detection and prevention technologies that allow them to mitigate risk exposure from cyberattacks. Finally, such incidents impact consumer trust in the brand, and very often lead to both direct financial impact from lost revenue, and also punitive legal damages that impact the business.”

Roy Akerman, CEO & Co-Founder at Rezonate: 

“We need to face the facts. User identities are the keys to the castle and should be protected as such. According to the 2024 Verizon Data Breach Report, 68% of breaches happen due to human error and one-third of breaches happen due to misconfigurations and other issues. In light of this, it’s crucial to allocate resources to security solutions that establish a baseline for user behavior within an organization’s network. This approach allows security teams to swiftly detect and address anomalies and respond to potential threats before they escalate into full blown breaches. In today’s landscape, the question is not whether you’ll face a breach, but when. That’s why prioritizing investment in modern security solutions and fostering a security-conscious culture across your entire organization is paramount, rather than confining it solely to the security team.”

Jim Routh, Chief Trust Officer at Saviynt:  

“Ticket brokers create massive sets of highly desirable transaction data and personal information that is easily monetized by cybercriminals (name, address, order information for high priced transactions) and as a result, require industry-leading and mature cybersecurity practices applied to third-party cloud providers. All enterprises have the opportunity today to mature identity management practices for third parties in addition to ticket brokers.”

Philip Odence, Synopsys Software Integrity Group:

“The recent data attacks on Ticketmaster, Snowflake and others are prime examples of how companies making headlines in the news might be more likely to attract the attention of bad actors. We’ve heard from our Black Duck Audit private equity clients that, consistently, after they announce an acquisition, attacks on the new portfolio company significantly increase. There’s no particular logic for it, but if your company is preparing for major news or events, it’s a good reminder to triple check that your cybersecurity practices are operating at more than 100%.”

https://www.securitymagazine.com/articles/100743-security-leaders-respond-to-ticketmaster-breach

@import url(‘https://fonts.googleapis.com/css2?family=Nunito+Sans:ital,opsz,wght@0,6..12,400;0,6..12,500;0,6..12,600;0,6..12,700;1,6..12,400;1,6..12,500;1,6..12,600;1,6..12,700&family=Nunito:ital,wght@0,400;0,500;0,600;0,700;1,400;1,500;1,600;1,700&display=swap’); h3 { font-weight: bold; font-size: 18px; color: #C72026; }

In this edition of Security’s Top 5 from Security magazine, we showcase the top stories and new developments from across the security industry throughout April. This month, we take a look at top cybersecurity conferences, fixing the cybersecurity skills gap, geopolitics and security, and more.

1. Top Cybersecurity Conferences in 2024

Cybersecurity conferences provide security leaders around the world of all levels of experience with an opportunity to connect with one another. Security magazine highlights some of the upcoming cybersecurity conferences in 2024.

2. How to Fix the Growing Cybersecurity Skills Gap

In today’s cybersecurity landscape, companies must strive to be a learning-forward organization. Tangible adoption of this principle must go beyond formal skills and training — every encounter your teams have with a threat or an attack is a learning opportunity. In the midst of an incident, team members should be encouraged to apply their skills and expertise without the fear of post-incident blame, which only limits response and hinders loyalty.

3. Protecting Ships From Cyber Terrorism

Ports and offshore facilities are major elements of the maritime ecosystem, and they expose a collection of additional attack surfaces. Equipment and systems operating on loading docks and even oil rigs are inviting targets. These communicate with ships and can unknowingly share malware. Equipment and systems — from Chinese-made cranes to container-stacking machinery to drilling mechanisms — are in the hacker’s sights.  

4. The Cybersecurity and Geopolitical Discussion — The real space race: Inside geopolitics and security of a $1.8T industry— Episode 22

In Episode 22 of the Cybersecurity & Geopolitical Discussion, hosts Ian Thornton-Trump CD, CISO for Cyjax, Lisa Forte, Partner at Red Goat Security and Philip Ingram MBE, CEO of Grey Hare Media debate the geopolitical and security dimensions of the current global space industry.  

5. A Vulnerability in Linux Distributions May Allow Unauthorized Access 

Red Hat has recently reported a malicious code embedded in XZ Utils versions 5.6.0 and 5.6.1, which are XZ format compression utilities that are often involved in Linux distributions. The vulnerability has been labelled as CVE-2024-3094.

https://www.securitymagazine.com/articles/100748-securitys-top-5-april-2024

A ransomware attack that crippled a London-based medical testing and diagnostics provider has led several major hospitals in the city to declare a critical incident emergency and cancel non-emergency surgeries and pathology appointments, it was widely reported Tuesday.

The attack was detected Monday against Synnovis, a supplier of blood tests, swabs, bowel tests, and other hospital services in six London boroughs. The company said it has “affected all Synnovis IT systems, resulting in interruptions to many of our pathology services.” The company gave no estimate of when its systems would be restored and provided no details about the attack or who was behind it.

Major impact

The outage has led hospitals, including Guy’s and St Thomas’ and King’s College Hospital Trusts, to cancel operations and procedures involving blood transfusions. The cancellations include transplant surgeries, which require blood transfusions.

“I can confirm that our pathology partner Synnovis experienced a major IT incident earlier today, which is ongoing and means that we are not currently connected to the Synnovis IT servers,” Ian Abbs, CEO of the hospital network Guy’s and St Thomas’ NHS Foundation Trust, wrote in an email posted to social media. “This is having a major impact on the delivery of our services, with blood transfusions being particularly affected. Some activity has already been canceled or redirected to other providers at short notice as we prioritize the clinical work that we are able to safely carry out.”

Royal Brompton and Harefield hospitals, the largest specialized heart and lung centers in the UK, said they are affected. Primary care across southeast London is also impacted. The disruption may also hamper trauma cases since urgent blood components will be transfused only when it is “critically indicated for the patient,” according to a memo circulated to hospital staff.

A government spokesperson said: “The Department of Health and Social Care, NHS England, and the National Cyber Security Centre are working together to investigate a cyber incident affecting a number of NHS organizations in South East London. Patient safety is our priority and support is being offered to the impacted organizations.”

The London hospitals are the latest in a long line of health care facilities to be hamstrung by a ransomware attack. Such attacks routinely cause Emergency Rooms to divert patients to other facilities, often resulting in delays in patients receiving lifesaving care. In 2020, a patient in Germany died after being rerouted to a hospital about 20 miles away, resulting in about a one-hour delay in treatment.

Emergency care continues to be available in London, and health care professionals see patients for scheduled appointments in most cases.

Last year, the number of ransomware attacks targeting health care providers almost doubled, according to the US Director of National Intelligence, with 214 worldwide in 2022 and 389 in 2023. In the US, the number rose from 113 in 2022 to 258 last year. Security firm Emsisoft said attacks against US hospitals numbered 27 in 2021, 25 in 2022, and 46 in 2023.

Few details are known about the latest ransomware attack. There are no known reports of ransomware groups taking credit, and researchers have yet to provide any intelligence. Synnovis said it has reported the incident to law enforcement and the Information Commissioner and is working with the UK’s National Cyber Security Centre and the Cyber Operations Team.

https://arstechnica.com/?p=2029003

A report by Women in CyberSecurity (WiCyS) reveals key findings on the current state of inclusion in cybersecurity. By conducting a survey of 1,000 employees (65% women and 35% men) the report found notable gender disparities in the cybersecurity industry. 

In the report, surveyed women noted the top four categories in which they experience exclusion: respect, career and growth, access and participation and recognition. When compared to their male counterparts, women reported 350% more exclusion in recognition and 250% more in respect. 

Key findings from the report include: 

• 48% of women face obstacles associated with career and growth opportunities, suggesting a class ceiling effect in the cybersecurity workforce. For comparison, 26% of men report similar struggles in career and growth. 
• Individuals with intersectional identities and/or disabilities report exclusion at levels that compare to or exceed those related to gender. 
• Inclusive practices can increase employee engagement, satisfaction, loyalty and productivity. Thus, the report suggests that inclusive practices can improve organizational revenues and retention. 

Paolo Gaudiano, Chief Scientist of Aleria, said, “This report underscores the tangible impact of inclusive policies. Organizations have a clear opportunity to significantly boost their financial results and employee satisfaction by addressing these disparities. Our analysis suggests that a company with $1 billion in revenue could be losing approximately $23 million annually due to differential treatment of women and people of color. This highlights the critical financial incentive companies gain from an inclusive workplace.”

https://www.securitymagazine.com/articles/100740-women-face-nearly-twice-as-much-exclusion-in-cybersecurity-than-men

In the dynamic world of cybersecurity, the security operations center (SOC) is the nerve center of an organization’s defense strategy. Yet, despite its critical role, the SOC is grappling with challenges that have persisted for nearly two decades. Everywhere security leaders turn, there’s another article discussing burnout in the SOC, false positive churn, staffing issues, and more. It’s clear that the attack surface is ever-expanding, with new applications and technologies requiring constant vigilance. The addition of cloud services, hybrid workspaces and remote work has also added to the complexity, creating more vulnerabilities that can be exploited by attackers. Additionally, the evolution and speed of cyberattacks combined with the significant cybersecurity talent shortage means security leaders are swimming in incredibly dangerous waters. Ultimately, the wide range of problems necessitates a reevaluation of how security leaders approach the SOC and its operations to ensure an effective and efficient approach to maintaining security.

From a chief information security officer’s (CISO’s) perspective, leveraging multiple controls in an environment is imperative. However, the looming question arises: Why, despite the many measures that are implemented, are security leaders still falling prey to so many attacks? The simple answer: Conducting business inherently creates vulnerabilities within the processes, people and technology. Risk reduction strategies like zero trust are often slow-moving and have their own difficulties in implementation. The SOC often serves as the last control, identifying the attacks that have slipped through other defenses. This underscores the SOC’s value as one of the most crucial controls within a security program. So, to evaluate for improvements, it’s important to pinpoint specific challenges and their impact and identify a solution to strengthen the role of a SOC.

One of the significant challenges faced by SOCs is the need for interoperable infrastructure. With the increasing number of applications and tools used by the SOC, the lack of interoperability can create significant issues in terms of delayed incident response and gaps in threat visibility. The absence of a “single pane of glass” is a common complaint in the security industry, and it refers to the inability to have a unified view of all the infrastructure components and tools used by the SOC. This lack of visibility can lead to significant delays in incident response times and can make it challenging to identify and mitigate security threats effectively. To overcome this challenge, it’s critical that all infrastructure components used by the SOC can communicate and work together seamlessly. This means that the tools and applications used by the SOC must be designed to integrate with one another and share data effectively. Having an interoperable infrastructure that allows for seamless communication between different components can significantly improve incident response times and enhance the SOC’s ability to detect and mitigate security threats effectively. It also enables the SOC to have a unified view of the security posture of the entire credit union, which is critical for effective security management.

Another important aspect of strengthening future SOCs is ensuring that individuals are placed in suitable positions that align with their skills and expertise. While the majority of platforms now have components of user and entity behavior analytics, machine learning, artificial intelligence, and advanced correlation features that allow us to drill down to the information that matters much more quickly, cybersecurity tools can only go so far. Every network is different, and even networks with the same topology will have data moving in different ways at different times. The public is still a long way off from adaptive technologies that can shift and move with the landscape. This is where the human element comes in — where operators can make a difference. Consider the person employed in a SOC. Should a SOC be staffed by Level 1 analysts, or should it be comprised of more experienced security personnel? Part of the problem has been that traditionally, this was identified as an entry-level position and hasn’t been treated as the critical security control that it is. When considering the tasks at hand — being the last line of defense on the network and the control most able to decrease the impact a successful attack has on an organization — it becomes clear that this is not an entry-level responsibility. As technologies advance and networks become more complex, the SOC must evolve accordingly with personnel who are prepared to tackle the role effectively, leveraging their education as well as experience. 

Focusing on the importance of the human element in driving technology, organizations should invest in security operators, as they carry heavy responsibility in times of crisis. This investment should also be focused on platforms — not just financially but in terms of “people hours.” Tuning the system to reduce false positives and conform to the organization’s unique needs is essential. This investment should focus on the quality of alerting, not only to reduce false positives to ensure the investigative force isn’t burnt out but to also equip them with the information they need to conduct thorough investigations.

The modern SOC is at a crossroads, facing an expanding attack surface, a significant IT talent shortage, and the critical need for interoperable infrastructure. To address these challenges, security leaders must rethink their approach to staffing, invest in people as well as platforms, and recognize the invaluable role of the human element in cybersecurity. By doing so, security leaders can ensure that SOCs are equipped to protect against the ever-changing landscape of cyber threats. The future of cybersecurity depends on security leaders’ ability to adapt, innovate and invest in the key components that make strong defenses.

https://www.securitymagazine.com/articles/100744-the-modern-security-operations-center-shaping-the-future-of-socs

Giu 04, 2024 Marina Londei Attacchi, In evidenza, News, RSS, Vulnerabilità 0

I ricercatori di TrendMicro hanno scoperto che il gruppo Water Sigbin, conosciuto anche come 8220 Gang, sta sfruttando due vulnerabilità di Oracle WebLogic per eseguire un miner di criptovalute tramite uno script PowerShell.

Il gruppo, di origine cinese, è attivo almeno dal 2017 e ha sempre orbitato nel mondo del malware per il mining, soprattutto negli ambienti cloud e sui server Linux.

Il primo bug è CVE-2017-3506, una vulnerabilità in Oracle WebLogic Server che consente a un attaccante non autenticato con accesso via HTTP di compromettere il server tramite la creazione, cancellazione o modifica dei dati, anche quelli critici; il secondo è invece CVE-2023-21839, una vulnerabilità di deserializzazione insicura che permette a un attaccante di accedere a tutti i dati di WebLogic server.

I ricercatori hanno scoperto che il gruppo sta colpendo sia macchine Linux che Windows; gli attacchi contro quest’ultimo sistema sono quelli più di nota in quanto Water Sigbin ha utilizzato delle tecniche di offuscamento sofisticate.

Pixabay

Il gruppo usa l’encoding esadecimale per offuscare l’URL usato per la comunicazione e utilizza la porta HTTP 443 per le comunicazioni con il server C2. Lo script PowerShell consiste di due parti: una stringa in base64 che contiene il codice binario e le istruzioni per eseguirlo e una funzione responsabile di effettuare il decoding della stringa, scrivere il contenuto in un file .bat ed eseguirlo.

Il file .bat sfrutta le variabili d’ambiente per offuscare il codice originale, rendendolo complesso da analizzare. Il file contiene ulteriori stringe in base64 che rappresentano il codice effettivo, il quale deve essere processato, decodificato e decompresso per essere eseguito.

“L’uso di sofisticate tecniche di offuscamento come la codifica esadecimale degli URL, la codifica complessa all’interno di PowerShell e degli script batch, l’uso di variabili d’ambiente e l’offuscamento stratificato per nascondere il codice dannoso all’interno di script apparentemente benigni, dimostra che Water Sigbin è un gruppo in grado di nascondere abilmente le proprie tracce, rendendo il rilevamento e la prevenzione più impegnativi per i team di sicurezza” spiegano i ricercatori di TrendMicro.

Al momento non è stato reso noto l’effettivo impatto degli attacchi del gruppo. Per proteggersi da questo tipo di attacchi, i ricercatori ricordano di mantenere aggiornati i software e installare il prima possibile le patch di sicurezza, segmentare la rete per ridurre la superficie di attacco, effettuare audit di sicurezza regolari e definire un piano di risposta agli incidenti. 

The United States Department of Justice has arrested a 35-year-old Chinese man, YunHe Wang, as the alleged creator and operator of a residential proxy service called 911 S5. This botnet infected more than 19 million IP addresses and led to billions of dollars of unemployment and pandemic fraud. Allegedly, 911 S5 has enabled malicious actors to circumvent financial fraud safeguards to steal from financial institutions, federal lending programs and credit card issuers.

Principal Deputy Assistant Attorney General Nicole M. Argentieri, head of the Justice Department’s Criminal Division, said, “As alleged in the indictment, Wang created malware that compromised millions of residential computers around the world and then sold access to the infected computers to cybercriminals. These criminals used the hijacked computers to conceal their identities and commit a host of crimes, from fraud to cyberstalking. Cybercriminals should take note. Today’s announcement sends a clear message that the Criminal Division and its law enforcement partners are firm in their resolve to disrupt the most technologically sophisticated criminal tools and hold wrongdoers to account.”

The botnet was utilized by various cybercriminals to carry out a range of violations, such as child exploitation, large-scale fraud, harassment, bomb threats and more. 

Assistant Secretary for Export Enforcement Matthew S. Axelrod of the U.S. Department of Commerce’s Bureau of Industry and Security (BIS), said, “The conduct alleged here reads like it’s ripped from a screenplay: A scheme to sell access to millions of malware-infected computers worldwide, enabling criminals over the world to steal billions of dollars, transmit bomb threats, and exchange child exploitation materials — then using the scheme’s nearly $100 million in profits to buy luxury cars, watches, and real estate. What they don’t show in the movies though is the painstaking work it takes by domestic and international law enforcement, working closely with industry partners, to take down such a brazen scheme and make an arrest like this happen.”

Wang has been charged with the following: 

• Conspiracy to commit computer fraud
• Substantive computer fraud
• Conspiracy to commit wire fraud
• Conspiracy to commit money laundering

Wang may be given a maximum penalty of 65 years in prison if convicted on all accounts. 

https://www.securitymagazine.com/articles/100738-administrator-of-911-s5-botnet-arrested-botnet-dismantled