Eliana Willis

More than 700 organizations were attacked with ransomware and had their data posted to data leak sites in Q2 of 2021, according to a new research report from cybersecurity firm Digital Shadows. Out of the almost 2,600 victims listed on ransomware data leak sites, 740 of them were named in Q2 2021, representing a 47% increase compared to Q1. The report chronicles the quarter’s major events, which included the DarkSide attack on Colonial Pipeline, the attack on global meat processor JBS, and increased law enforcement action from US and European agencies. But Digital Shadows’ Photon Research Team found that under the surface, other ransomware trends were emerging. Since the Maze ransomware group helped popularize the data leak site concept, double extortion tactics have become en vogue among groups looking to inflict maximum damage after attacks. Digital Shadows tracks the information posted to 31 Dark Web leak sites, giving them access to just how many groups are now stealing data during ransomware attacks and posting it online. Data from companies in the industrial goods and services sector were prevalent on Dark Web leak sites, according to the report. Construction and materials, retail, technology, and healthcare organizations also dominated the list of attacked organizations. The retail sector saw the biggest increase in ransomware attacks, with Digital Shadows researchers finding a 183% increase between Q1 and Q2. 

In terms of activity, the Conti group led the way followed by Avaddon, PYSA, and REvil.”This is the second consecutive quarter that we have seen Conti as the most active in terms of victims named to their DLS. Conti, believed to be related to the Ryuk ransomware, has consistently and ruthlessly targeted organizations in critical sectors, including emergency services,” the report said, noting the group’s devastating attack on Ireland’s healthcare system. But the report notes that on the wider ransomware market, a number of groups disappeared or emerged out of nowhere. In Q2, Avaddon, Babuk Locker, DarkSide, and Astro Locker ransomware groups all closed operations while groups like Vice Society, Hive, Prometheus, LV Ransomware, Xing, and Grief ransomware operations emerged with their own Dark Web leak sites, according to Digital Shadows.The report also notes that 60% of the victim organizations are based in the US, with only Canada seeing a reduction in ransomware attacks from Q1 to Q2. More than 350 US organizations were hit by ransomware in Q2 compared to 46 from France, 39 from the UK, and 35 from Italy. The researchers behind the report questioned whether Q3 would see more attacks resembling the Kaseya ransomware attack, where REvil operators used a zero-day vulnerability to compromise more than 40 Managed Service Providers. “Ransomware operations will likely continue to operate brazenly into the third quarter of 2021, giving limited thought to who they are targeting and more to how much money they might make,” the researchers wrote. More

Saudi Aramco — one of the largest oil companies in the world — has denied that their systems were breached by hackers after cybercriminals contacted ZDNet with a trove of files from the company. A threat actor going by ZeroX told ZDNet on Telegram that it had stolen 1T of “sensitive data” ranging from 1993 to 2020. The group said it hacked Saudi Aramco’s network, stealing information on refineries in Yanbu, Jazan, Jeddah, Ras Tanura, Riyadh, and Dhahran. The cybercriminals also contacted other news outlets like Bleeping Computer, which first reported the hack. The group provided samples of the data, which included documents covering project specifications, electrical and power systems, machinery at the refineries, analysis reports, unit prices, business agreements, network documents, company clients, invoices, and more.The group also said it stole information from about 14,254 employees, including names, photos, passports, emails, phone numbers, family information, ID numbers, and more. ZeroX shared the data through an “onion dark web link.”But in a statement to ZDNet, Saudi Aramco denied that they had been hacked.”Aramco recently became aware of the indirect release of a limited amount of company data which was held by third party contractors,” the spokesperson said. “We confirm that the release of data was not due to a breach of our systems, has no impact on our operations, and the company continues to maintain a robust cybersecurity posture.”Saudi Aramco has more than 270 billion barrels of crude oil reserves, the second largest in the world, and produces more oil on a daily basis than any other company in the world. 

The company brought in $204 billion in 2020. Bleeping Computer reported that ZeroX was auctioning the entire data dump for $5 million while also offering 1GB samples for about $2,000.Saudi Aramco dealt with a cyberattack in 2012 that damaged 30,000 workstations and the oil giant has routinely faced attacks ever since.  More

More than 1,000 GB of data and over 1.6 million files from dozens of municipalities in the US were left exposed, according to a new report from a team of cybersecurity researchers with security company WizCase. 

ZDNet Recommends

All of the towns and cities appeared to be connected through one product: mapsonline.net, which is owned by a Massachusetts company called PeopleGIS. The company provides information management software to local governments across Massachusetts, New Hampshire and Connecticut. Ata Hakçıl and his team discovered more than 80 misconfigured Amazon S3 buckets holding data related to these municipalities. The data ranged from residential records like deeds and tax information to business licenses and job applications for government positions. Due to the sensitive nature of the documents, many of the forms included people’s email address, physical address, phone number, driver’s license number, real estate tax information, license photographs and photos of property. The researchers shared redacted photos of the data available. “The data of these municipalities was stored in several misconfigured Amazon S3 buckets that were sharing similar naming conventions to MapsOnline. Due to this, we believe these cities are using the same software solution,” the report said. “Our team reached out to the company and the buckets have since been secured.”

Not every municipality had the same information exposed, and the report said the types of files leaked varied. The researchers were not able to provide an estimate on the number of people affected by the exposure because of how varied the forms were. The security company deployed a scanner that found 114 Amazon Buckets connected to PeopleGIS and named similarly. According to the report, 28 were configured correctly while “86 were accessible without any password nor encryption.”The researchers did not have a definitive reason for why some buckets were properly secured and others were not. They suggested that PeopleGIS simply “created and handed over the buckets to their customers (all municipalities), and some of them made sure these were properly configured.”Another theory involved a potential situation where different employees at PeopleGIS — without clear guidelines — created and configured each bucket. The third theory was that the municipalities themselves created the buckets with basic guidelines from PeopleGIS “about the naming format but without any guidelines regarding the configuration.”The researchers said this “would explain the difference between the municipalities whose employees knew about it or not.””The breach could lead to massive fraud and theft from citizens of those municipalities. The highly-sensitive nature of the data contained within a local government’s database, from phone numbers to business licenses to tax records, are highly susceptible to exploitation by bad actors,” the report said. “Much of this information is supposed to be only accessible by the government and the citizens, meaning someone could potentially defraud an individual by posing as a government official.”PeopleGIS did not respond to requests for comment.  More

Cloud computing services have become a vital tool for most businesses. It’s a trend that has accelerated recently, with cloud-based services such as Zoom, Microsoft 365 and Google Workspace and many others becoming the collaboration and productivity tools of choice for teams working remotely.While cloud quickly became an essential tool, allowing businesses and employees to continue operating from home, embracing the cloud can also bring additional cybersecurity risks, something that is now increasingly clear. Previously, most people connecting to the corporate network would be doing so from their place of work, and thus accessing their accounts, files and company servers from inside the four walls of the office building, protected by enterprise-grade firewalls and other security tools. The expanded use of cloud applications meant that suddenly this wasn’t the case, with users able to access corporate applications, documents and services from anywhere. That has brought the need for new security tools. Cloud computing security threats

ZDNet Recommends

The best cloud storage services

Free and cheap personal and small business cloud storage services are everywhere. But, which one is best for you? Let’s look at the top cloud storage options.

Read More

While positive for remote workers – because it allows them to continue with some semblance of normality – working remotely also presents an opportunity for cyber criminals, who have quickly taken advantage of the switch to remote working to attempt to break into the networks of organisations that have poorly configured cloud security. SEE: IT Data Center Green Energy Policy (TechRepublic Premium)Corporate VPNs and cloud-based application suites have become prime targets for hackers. If not properly secured, all of these can provide cyber criminals with a simple means of accessing corporate networks. All attackers need to do is get hold of a username and password – by stealing them via a phishing email or using brute force attacks to breach simple passwords – and they’re in. 

Because the intruder is using the legitimate login credentials of someone who is already working remotely, it’s harder to detect unauthorised access, especially considering how the shift to remote working has resulted in some people working different hours to what might be considered core business hours. Attacks against cloud applications can be extremely damaging for victims as cyber criminals could be on the network for weeks or months. Sometimes they steal large amounts of sensitive corporate information; sometimes they might use cloud services as an initial entry point to lay the foundations for a ransomware attack that can lead to them both stealing data and deploying ransomware. That’s why it’s important for businesses using cloud applications to have the correct tools and practices in place to make sure that users can safely use cloud services – no matter where they’re working from – while also being able to use them efficiently.Use multi-factor authentication controls on user accountsOne obvious preventative step is to put strong security controls around how users log in to the cloud services in the first place. Whether that’s a virtual private network (VPN), remote desktop protocol (RDP) service or an office application suite, staff should need more than their username and password to use the services.  “One of the things that’s most important about cloud is identity is king. Identity becomes almost your proxy to absolutely everything. All of a sudden, the identity and its role and how you assign that has all of the power,” says Christian Arndt, cybersecurity director at PwC.  Whether it’s software-based, requiring a user to tap an alert on their smartphone, or hardware-based, requiring the user to use a secure USB key on their computer, multi-factor authentication (MFA) provides an effective line of defence against unauthorised attempts at accessing accounts. According to Microsoft, MFA protects against 99.9% of fraudulent sign-in attempts.  Not only does it block unauthorised users from automatically gaining entry to accounts, the notification sent out by the service, which asks the user if they attempted to log in, can act as an alert that someone is trying to gain access to the account. This can be used to warn the company that they could be the target of malicious hackers. Use encryption The ability to easily store or transfer data is one of the key benefits of using cloud applications, but for organisations that want to ensure the security of their data, its processes shouldn’t involve simply uploading data to the cloud and forgetting about it. There’s an extra step that businesses can take to protect any data uploaded to cloud services – encryption. Just as when it’s stored on regular PCs and servers, encrypting the data renders it unreadable, concealing it to unauthorised or malicious users. Some cloud providers automatically provide this service, employing end-to-end protection of data to and from the cloud, as well as inside it, preventing it from being manipulated or stolen.  Apply security patches as swiftly as possible Like other applications, cloud applications can receive software updates as vendors develop and apply fixes to make their products work better. These updates can also contain patches for security vulnerabilities, as just because an application is hosted by a cloud provider, it doesn’t make it invulnerable to security vulnerabilities and cyberattacks. Critical security patches for VPN and RDP applications have been released by vendors in order to fix security vulnerabilities that put organisations at risk of cyberattacks. If these aren’t applied quickly enough, there’s the potential for cyber criminals to abuse these services as an entry point to the network that can be exploited for further cyberattacks. Use tools to know what’s on your networkCompanies are using more and more cloud services – and keeping track of every cloud app or cloud server ever spun up is hard work. But there are many, many instances of corporate data left exposed by poor use of cloud security. A cloud service can be left open and exposed without an organisation even knowing about it. Exposed public cloud storage resources can be discovered by attackers and that can put the whole organisation at risk. 

In these circumstances, it could be useful to employ cloud security posture management (CSPM) tools. These can help organisations identify and remediate potential security issues around misconfiguration and compliance in the cloud, providing a means of reducing the attack surface available to hackers to examine, and helping to keep the cloud infrastructure secure against potential attacks and data breaches. “Cloud security posture management is a technology that evaluates configuration drift in a changing environment, and will alert you if things are somehow out of sync with what your baseline is and that may indicate that there’s something in the system that means more can be exploited for compromise purposes,” says Merritt Maxim, VP and research director at Forrester. SEE: Network security policy (TechRepublic Premium)CSPM is an automated procedure and the use of automated management tools can help security teams stay on top of alerts and developments. Cloud infrastructure can be vast and having to manually comb through the services to find errors and abnormalities would be too much for a human – especially if there are dozens of different cloud services on the network. Automating those processes can, therefore, help keep the cloud environment secure. “You don’t have enough people to manage 100 different tools in the environment that changes everyday, so I would say try to consolidate on platforms that solve a big problem and apply automation,” says TJ Gonen, head of cloud security at Check Point Software, a cybersecurity company. Ensure the separation of administrator and user accountsCloud services can be complex and some members of the IT team will have highly privileged access to the service to help manage the cloud. A compromise of a high-level administrator account could give an attacker extensive control over the network and the ability to perform any action the administrator privileges allow, which could be extremely damaging for the company using cloud services.It’s, therefore, imperative that administrator accounts are secured with tools such as multi-factor authentication and that admin-level privileges are only provided to employees who need them to do their jobs. According to the NCSC, admin-level devices should not be able to directly browse the web or read emails, as these could put the account at risk of being compromised.It’s also important to ensure that regular users who don’t need administrative privileges don’t have them, because – in the event of account compromise – an attacker could quickly exploit this access to gain control of cloud services.Use backups as contingency planBut while cloud services can – and have – provided organisations around the world with benefits, it’s important not to rely on cloud for security entirely. While tools like two-factor authentication and automated alerts can help secure networks, no network is impossible to breach – and that’s especially true if extra security measures haven’t been applied. SEE: Ransomware: Paying up won’t stop you from getting hit again, says cybersecurity chiefThat’s why a good cloud security strategy should also involve storing backups of data and storing it offline, so in the event of an event that makes cloud services unavailable, there’s something there for the company to work with. Use cloud applications that are simple for your employees to useThere’s something else that organisations can do to ensure the security of cloud – and that’s provide their employees with the correct tools in the first place. Cloud application suites can make collaboration easier for everyone, but they also need to be accessible and intuitive to use, or organisations run the risk of employees not wanting to use them.  A business could set up the most secure enterprise cloud suite possible, but if it’s too difficult to use, employees, frustrated with not being able to do their jobs, could turn to public cloud tools instead. This issue could lead to corporate data being stored in personal accounts, creating greater risk of theft, especially if a user doesn’t have two-factor authentication or other controls in place to protect their personal account.  Information being stolen from a personal account could potentially lead to an extensive data breach or wider compromise of the organisation as a whole. Therefore, for a business to ensure it has a secure cloud security strategy, not only should it be using tools like multi-factor authentication, encryption and offline backups to protect data as much as possible, the business must also make sure that all these tools are simple to use to encourage employees to use them correctly and follow best practices for cloud security. MORE ON CYBERSECURITY  More

Microsoft has released a workaround for a privilege elevation flaw that affects all versions of Windows 10 and could give attackers the ability to access data and create new accounts on systems. Microsoft this week confirmed a serious elevation of privilege flaw, tagged as CVE-2021-36934, that could allow a local attacker to run their own code with system privileges. 

While the bug is important, the attacker must have already gained the ability to execute code on the target system in order to exploit the flaw, according to Microsoft. SEE: Network security policy (TechRepublic Premium)The bug affects the Security Accounts Manager (SAM) database in all versions of Windows 10 from version 1809. It may be more urgent to patch or mitigate because details of the flaw are publicly available. The SAM database is a sensitive component of Windows 10 since it is the location for storing user accounts, credentials and domain information. While credentials are hashed in SAM, the flaw gives attackers the opportunity to exfiltrate the hashed credentials and crack them offline.    “An elevation of privilege vulnerability exists because of overly permissive Access Control Lists (ACLs) on multiple system files, including the Security Accounts Manager (SAM) database,” Microsoft says in an advisory. 

“An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.”Per The Record, the flaw was found by Jonas Lyk over the weekend. The issue is being referred to as SeriousSAM. Lyk discovered shadow copies of SAM were available for attackers to exploit while probing a preview of Windows 11, Microsoft’s next version of Windows. SEE: GDPR: Fines increased by 40% last year, and they’re about to get a lot biggerSecurity firm Blumira explains why CVE-2021-36934 is a serious flaw.  “The SYSTEM and SAM credential database files have been updated to include the Read ACL set for all Users for some versions of Windows,” the company notes in a blogpost. “This means that any authenticated user has the capability to extract these cached credentials on the host and use them for offline cracking, or pass-the-hash depending on the environment configuration.”The US CERT coordination center notes several more ways the bug can impact affected Windows 10 machines. An attacker could:Extract and leverage account password hashes.Discover the original Windows installation password.Obtain DPAPI computer keys, which can be used to decrypt all computer private keys.Obtain a computer machine account, which can be used in a silver ticket attack. More

It seems that a delay in Apple pushing out the iPadOS 14.7 update was responsible also for the delayed publication of the security content of both iOS and iPadOS 14.7.But now that iPadOS has been released, we have the full picture… and yes, you need to update, and do it promptly.Must read: Don’t make this common, fatal iPhone or Android mistakeWe already knew that the Wi-Fi bug that could cause denial of service was addressed, but there are over two dozen more bugs fixed in these releases.For example, there are four WebKit bugs, three of which that could cause a malicious webpage to run code.The Measure app — do you even use that app? — has seven vulnerabilities fixed, and there’s also a fix for a Find My bug that may allow a malicious application to access Find My data.This is a pretty big set of bugfixes, on top of the items listed in the release notes:MagSafe Battery Pack‌ supports iPhone 12, iPhone 12 mini, iPhone 12 Pro and iPhone 12 Pro Max.Apple Card‌ Family adds the option to combine credit limits and share one co-owned account with an existing ‌Apple Card‌ user.The home app adds the ability to manage timers on ‌HomePod‌.Air quality information is now available in Weather and Maps for Canada, France, Italy, Netherlands, South Korea, and Spain.The podcasts library allows you to choose to see all shows or only followed shows.Share playlist menu option missing in Apple Music.Dolby Atmos and ‌Apple Music‌ lossless audio playback may unexpectedly stop.The battery service message that may have disappeared after reboot on some iPhone 11 models is restored.Braille displays could show invalid information while composing Mail messages.

To install the update, go to Settings > General > Software Update and download it from there. More