Powerful Cyberattack Knocked Out Ukraine's Top Terrestrial Telco for Fifteen Hours
Documents show poor Sitel/Okta breach responses, U.S. officials weigh Trickbot sanctions, Yandex ships mobile device data back to Russia, WordPress sites used to launch DDoS attacks on Ukraine, more
A “powerful” cyber attack hit Ukraine’s biggest fixed-line telecommunications company, Ukrtelecom, crippling the company’s services across the country. A similar incident occurred earlier this month with Triolan, a smaller Ukrainian telecom company.
Although it was unclear whether the attack was a DDoS event or a more sophisticated intrusion, Alp Toker, director of NetBlocks, said the “gradual loss of connectivity was a giveaway that it wasn’t a power or cable cut.” He called the cyberattack the most significant since Russia’s invasion. Fifteen hours after the attack, NetBlocks reported that Ukrtelecom’s service was being restored. (Thomas Brewster / Forbes)
Related: Mirror, VentureBeat, Slashdot, Reuters, Cyberscoop, The Record by Recorded Future, PCMag.com, BBC News, Wall Street Journal
Doug Madory @DougMadory
Ukrainian incumbent Ukrtelecom has gone offline as a result of a reported cyberattack. Views from @CloudflareRadar and @gatech_ioda both show a slow decline in connectivity over ~5 hours: an unusual outage profile. https://t.co/oS8AJlbxi1 https://t.co/uTfPy2x0Vz https://t.co/3c6HZsxr3M
Russia's foreign ministry accused the United States of leading a massive cyber operation targeting Russian state institutions daily and said it would find those responsible for the "cyber aggression.”
"There should be no doubt that cyber aggression unleashed against Russia will lead to severe consequences for its instigators and perpetrators," the ministry said. (Reuters)
Leaked documents show Sitel's initial breach notification to customers, including identity platform management company Okta, on January 25 and a detailed “Intrusion Timeline” dated March 17. The forensics timeline was seemingly produced by security investigators at Mandiant or based on data gathered by the firm. It was through Sikes Enterprises-owned Sitel, a subcontractor, that Okta was breached.
The documents obtained by independent security researcher Bill Demirkapi raise serious questions about Sitel/Sykes' security defenses before the breach. They highlight apparent gaps in Okta's response to the incident. After receiving Sitel’s breach report on March 17, Okta seemed to be caught flat-footed when the hackers took the information public. The timeline also shows that the Lapsus$ group hackers were able to use extremely well-known and widely available hacking tools, like the password-grabbing tool Mimikatz, to rampage through Sitel's systems.
Moreover, the timeline reveals that the attackers were also able to gain enough system privileges to disable security scanning tools that might have flagged the intrusion sooner, likely through a stolen spreadsheet containing admin passwords. The timeline further shows that attackers initially compromised Sykes on January 16 and then ramped up their attack throughout the 19th and 20th until their last login on the afternoon of the 21st, which the timeline calls “Complete Mission.” (Lily Hay Newman / Wired)
Related: TechCrunch, Threatpost, Motley Fool, ZDNet Security, isssource.com, Business Insider, The Stack, ZDNet, The Record by Recorded Future, Malware News, Computing.co.uk, The Register - Security, VentureBeat
Bill Demirkapi @BillDemirkapi
I have been terminated from Zoom for refusing to remove the following tweets. Anyone have recommendations for wrongful termination lawyers based in California? https://t.co/YplFEcn2Am
Bill Demirkapi @BillDemirkapi
The LAPSUS$ ransomware group has claimed to breach Okta sharing the following images from internal systems. https://t.co/eTtpgRzer7
Zack Whittaker @zackwhittaker
New documents offer the most detailed account so far of how the Lapsus$ group hacked Sitel, including how the hackers accessed a spreadsheet of 'domain admin' passwords on Sitel's network at the time they were compromising Okta. https://t.co/5q580tMNxTA surprising consequence of the war in Ukraine is the wide-open view of the inner workings of one of the world’s biggest and most dangerous organized cybercrime groups, the Trickbot gang. An anonymous researcher who had infiltrated the group’s servers and identified himself as Ukrainian posted a massive leak of internal conversations among the pro-Russian group’s members and partners.
More than 200,000 messages exchanged by 450 Trickbot managers, staff, and business partners since June 2020 reveal a well-organized criminal syndicate with possible connections to Russian intelligence agencies. They show an organizational resilience that allowed the group to recover from counterattacks by international law-enforcement coalitions rapidly and grand ambitions to diversify and develop a cryptocurrency.
According to sources familiar with the Treasury Department's thinking, U.S. officials are weighing whether to sanction the Trickbot group, which would make it illegal for U.S. companies to pay its ransomware demands. (Robert McMillan, Kevin Poulsen, and Dustin Volz / Wall Street Journal)
Russia’s biggest internet company Yandex has embedded code into apps found on mobile devices that allows data harvested from millions of users’ phones to be sent to servers located in Russia. Software created by Yandex permits developers to create apps for devices running on iOS and Android, and it is these apps that are sending the data back to Russia.
Researcher Zach Edwards first discovered this harvesting as part of an app auditing campaign for the non-profit Me2B Alliance. Four independent experts verified his work. Yandex acknowledged its software collects device, network, and IP address information stored in Finland and Russia but called the data non-personalized and very limited. (Patrick McGee / Financial Times)
MalwareHunterTeam discovered that hackers are compromising WordPress sites to insert a malicious script that uses visitors' browsers to perform distributed denial-of-service attacks on Ukrainian websites.
The script targets ten websites, including Ukrainian government agencies, think tanks, recruitment sites for the International Legion of Defense of Ukraine, financial sites, and other pro-Ukrainian sites. The scripts perform the DDoS attacks while the visitor is unaware that their browser has been coopted for an attack. Developer Andrii Savchenko says that hundreds of WordPress sites are compromised to conduct these attacks. (Lawrence Abrams / Bleeping Computer)
The Ukrainian Security Service (SSU) announced that since the start of the war with Russia, it has discovered and shut down five bot farms with over 100,000 fake social media accounts spreading fake news.
The network operated in Kharkiv, Cherkasy, Ternopil, and Zakarpattia aimed to discourage Ukrainian citizens and instill panic by distributing false information about the Russian invasion and the status of the defenders. Among items discovered when authorities raided the facilities hosting the bot farms were 10,000 SIM cards for various mobile operators to disguise the fraudulent activity. (Bill Toulas / Bleeping Computer)
Related: Ukrinform
From his hotel room in Qatar, Pakistani cybersecurity researcher Etizaz Mohsin obtained network configurations of 629 major hotels across 40 countries and the personal information of millions of guests, including their room numbers, emails, and dates they checked in and out of the hotel.
The data included that of major hotel chains across the Middle East and North Africa region, including the Kempinski, the Millennium, Sheraton, and St Regis in Qatar, Turkey, the United Arab Emirates (UAE), Saudi Arabia, Lebanon, Egypt, Bahrain, Oman, Jordan, Kuwait, and Bahrain. The hotels all use an internet system called HSMX Gateway by British company AirAngel, which suffers a flaw enabling this widespread access. AirAngel said it stopped updating its software in November 2020, and the firm encouraged clients to replace it with a new service called Captivnet. The issue with the previous service remains unfixed, however. (Kareem Chehayeb / Al Jazeera)
Kareem Chehayeb | كريم شهيب @chehayebk
Cybersecurity researcher uncovers faulty system used by hotels in the Middle East surrendering personal information on millions of guests worldwide. https://t.co/zrncM0BkLfFederal civilian agencies would get $10.9 billion total for cybersecurity under the fiscal 2023 budget of the Biden administration, an 11% increase from 2022. In addition, the Defense Department would get $11.2 billion for unclassified cyber operations.
The Homeland Security Department accounts for $2.6 billion. The Cybersecurity and Infrastructure Security Agency within DHS makes up the vast majority of DHS’s share, with a $2.5 billion overall budget request, but CISA does more than cyber, such as physical security for chemical plants. (Tim Starks / Cyberscoop)
Related: The Record, FedScoop, FCW, Nextgov, Meritalk
Researchers at Intezer say the distribution of the IcedID modular banking malware has seen a spike recently due to a new campaign that hijacks existing email conversation threads and injects malicious payloads that are hard to spot.
The primary method of the conversation hijacking attack is to assume control of a critical email account participating in discussion with the target, and then send a phishing message crafted to appear as a continuation of the thread. When the target receives a reply message with an attachment named and presented as something relevant to the previous discussion, the chances of suspecting fraud are reduced to a minimum. Intezer attributes this recent spike to the financially motivated threat group TA551. (Bill Toulas / Bleeping Computer)
Related: The Hacker News, Intezer
Hackers gained access to the personal information of 820,000 current and former New York City students during a January breach when they gained access to Illuminate Education which owns popular school management platforms IO Classroom, Skedula, and Pupilpath.
Illuminate Education said personal information was involved in the hack, and they are in the process of notifying those who may have been affected. “The security of the data we have in our care is one of our highest priorities, and we have already taken important steps to help prevent this from happening again,” a spokesperson for the company said. However, outraged New York City officials say that Illuminate may have broken state laws in its handling of the breach and have asked New York State Education Department has been asked to investigate the incident alongside several other agencies. (Jonathan Greig / The Record)
Related: JD Supra, New York Post, SC Magazine
A DDoS attack kept video game Among Us players offline in North America Europe for most of the past weekend.
According to the game’s official Twitter account, the attack began late Friday afternoon. It seemed to take most of the weekend for developer Innersloth’s small team to address the situation. (I. Bonifacic / Engadget)
Related: SlashGear » security
Sophos says that it has plugged a critical vulnerability in its firewall product, which could allow remote code execution.
The flaw tracked as CVE-2022-1040 is an authentication-bypass vulnerability in the User Portal and Webadmin of the Sophos Firewall. It affects version 18.5 MR3 (18.5.3) and older of the appliance. The company pushed out a hotfix, but those without automatic updates enabled will need to update their appliances manually. There’s also a workaround, Sophos says. (Tara Seals / Threatpost)
Related: Security Week, Techradar, Sophos, Help Net Security
The Digital Markets Act (DMA), backed by a deal among EU governing bodies, could pose a real problem for services promising end-to-end encryption. Cryptographers appear to agree that it will be difficult, if not impossible, to maintain encryption between apps, with potentially enormous implications for users because the DMA says that every large tech company will have to create products that are interoperable with smaller platforms.
Steven Bellovin, an acclaimed internet security researcher, and professor of computer science at Columbia University said there would be no way to fuse different forms of encryption across apps with varying design features. The DMA suggests another approach, equally unsatisfactory to privacy advocates, in which messages sent between two platforms with incompatible encryption schemes are decrypted and re-encrypted when passed between them, breaking the chain of “end-to-end” encryption and creating a point of vulnerability for interception by a bad actor. (Corin Faife / The Verge)
Related: Platformer News, ZDNet, JD Supra, Euronews