Information Technology

Over 170 mobile apps in the Android ecosystem have been identified as scam services designed to jump on the cryptocurrency bandwagon. 

Lookout researchers said this week that the apps, 25 of which were hosted on Google Play, are scamming people interested in cryptocurrencies by offering cloud-based mining services. In return for a fee, these mobile apps promise to perform cryptocurrency mining on behalf of subscribers.  Cryptocurrency mining leverages computing power — either from a personal device or a rented system — to solve computational and cryptographic puzzles, and coins are received in return.  However, the power required for many types of cryptocurrency is now more than a personal PC can manage, which means that individuals may join mining pools, sharing the work — and the proceeds.  Lookout analyzed each cryptocurrency mining app that appeared on the firm’s radar and found that not a single one performed any kind of legitimate cloud-based cryptocurrency mining. In other words, users have been paying for a non-existent service.  There are two main categories of fraudulent apps involved in these schemes, classified by the researchers as “BitScams” and “CloudScams.”

CloudScams offer mining options using cloud computing power, and it is common for developers to create realistic-looking mining services to appear legitimate. BitScams are mobile apps that offer users additional “virtual hardware” — for prices between $12.99 – $259.99 — that promise additional mining returns.  Payments can either be made via Google Play or through Bitcoin (BTC) and Ethereum (ETH) direct transfers to the developers’ wallets.
Lookout
Both types use similar business models, but there are groups behind the apps that appear to be competing forces. According to the company, over 93 000 people have been scammed in this way. An estimated $350 000, or more, has been lost with users paying for fake apps and upgrades, based on the average ‘subscription’ price the apps requested and installation rates. “What enabled BitScam and CloudScam apps to fly under the radar is that they don’t do anything actually malicious,” the researchers say. “In fact, they hardly do anything at all. They are simply shells to collect money for services that don’t exist.” Once Google was made aware of Lookout’s findings, offending apps hosted on Google Play were rapidly removed. However, the company has no means to wipe out Android apps hosted on third-party websites, and so users should remain cautious if applications promise returns that are too good to be true.  Previous and related coverage Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0 More

Microsoft has released patches for more versions of Windows affected by the PrintNightmare bug, but researchers claim the patches don’t provide complete protection. Microsoft released out-of-band patches for Windows systems affected by two critical bugs being tracked as CVE-2021-1675 and CVE-2021-34527, and has advised admins to disable the print spooler service until patches are applied. One is a remote code execution flaw, while the second is a local privilege escalation bug. 

“Microsoft identified a security issue that affects all versions of Windows and have expedited a resolution for supported versions of Windows that will automatically be applied to most devices,” it said in an update on Wednesday.  SEE: Windows 10 Start menu hacks (TechRepublic Premium) The company has now released patches for Windows 10 1607 for enterprise customers still on that version, plus Windows Server 2016 and Windows Server 2012. Upon installing the security update, users who aren’t admins are restricted to installing signed print drivers to a print server while admins can install signed and unsigned printer drivers.  Admins also have the option to configure the ‘RestrictDriverInstallationToAdministrators’ registry setting to prevent non-administrators from installing signed printer drivers on a print server.

“Prior to installing the July 6, 2021, and newer Windows Updates containing protections for CVE-2021-34527, the printer operators’ security group could install both signed and unsigned printer drivers on a printer server,” Microsoft notes in an advisory.  “After installing such updates, delegated admin groups like printer operators can only install signed printer drivers. Administrator credentials will be required to install unsigned printer drivers on a printer server going forward.” CISA’s advice for this bug is available here.  SEE: Ransomware: Now gangs are using virtual machines to disguise their attacks However, via The Register, the creator of the Mimikatz penetrating testing kit, said he has found a way to bypass the patch on systems by using UNC or the Universal Naming Convention (UNC) string, which is used to point to shared files or devices. Reportedly, Microsoft’s patch for CVE-2021-34527 improperly checks remote libraries; it doesn’t check for UNC for pointing to remote files.  And security researcher Will Dormann notes that certain registry settings that are meant to mitigate the bug don’t prevent local privilege escalation (LCE) or remote code execution (RCE).  More

(Source: Cyber Security Agency of Singapore)×sgsecurity2020-csa.pngThe number of reported cybercrime cases accounted for almost half of total crimes in Singapore last year, where both ransomware and botnet attacks saw significant spikes. The city-state is anticipating intensifying threats from ransomware as well as malicious attacks targeting remote workers and supply chains. The Singapore Computer Emergency Response Team (SingCERT) last year handled 9,080 cases, up from 8,491 the year before and 4,977 in 2018, according to the latest Singapore Cyber Landscape report released Thursday by Cyber Security Agency of Singapore (CSA). The government agency noted that last year saw marked increases in ransomware, online scams, ad COVID-19 phishing activities. In particular, the number of reported ransomware attacks saw a significant spike of 154% in 2020, with 89 incidents, compared to 35 in 2019. These mostly affected small and midsize businesses (SMBs) in various sectors including manufacturing, retail, and healthcare. In one such incident in August 2020, an F&B business found its servers and devices infected with NetWalker, with a ransom note directing the company to a webpage on the Dark Web to view the ransom demands. None of the F&B company’s data could be recovered as it also stored its backups on the affected servers and it had to rebuild its IT system from scratch. 

CSA attributed the increase in ransomware cases in Singapore to the global ransomware outbreak, where such attacks moved from being indiscriminate and opportunistic in nature to more targeted “Big Game Hunting”. Cybercriminals also shifted towards ransomware-as-a-service and “leak and shame” tactics, the agency said. It noted that the number of malicious command-and-control (C&C) server attacks also grew 94% to 1,026 reported incidents last year. These were fuelled partly by the increase in such servers distributing the Emotet and Cobalt Strike malware, which accounted for one-third of malware in C&C servers. Some 6,600 botnet drones with Singapore IP addresses were identified daily last year, up from 2,300 in 2019. CSA revealed that Mirai and Gamarue malware variants were prevalent amongst infected botnets in 2020, with the former malware targeting primarily Internet of Things (IoT) devices. 

But while COVID-19 themed phishing campaigns were pervasive globally, Singapore-hosted phishing URLs dipped 1% to some 47,000 last year. Defacements affecting “.sg” website also fell 43% to 495 cases last year, with SMBs again mostly impacted by such attacks. CSA said this dip might be due to activist groups opting to target other platforms such as social media to drive awareness of their causes. In total, 16,117 cybercrime cases were reported last year, accounting for 43% of all crimes in Singapore. The number also climbed from 9,349 cases in 2019. Online scams were the most common form of cybercrime in the city-state, with such cases up 62% to hit 12,251 last year, compared to 7,580 in 2019. CSA noted that the this was due to the accelerated growth of e-commerce as well as community marketplace and social media platforms, as more users in Singapore turned to online shopping amidst the global pandemic. CSA said: “Throughout 2020, global threat actors had capitalised on the anxiety and fear wrought by the pandemic, with repercussions felt by individuals and businesses. These threat actors made their presence felt, targeting areas such as e-commerce, data security, vaccine-related research and operations, as well as contact tracing operations. “Some of these trends were mirrored locally, where a surge in ransomware incidents as well as the emergence of COVID-19-related phishing activities were seen. These also coincided with the rise of work-from-home arrangements, as individuals and businesses adopted new technologies to maintain business continuity,” the government agency said. It pointed to an increasingly complex security landscape, where it anticipated ransomware to evolve into “a massive and systemic threat”.  Such attacks were no longer confined to sporadic and isolated incidents, it warned, noting that the recent spate of high-profile ransomware attacks worldwide had affected critical service providers and major organisations, including Colonial Pipeline and JBS. These incidents indicated that cyber attacks could have real-world effects and had the potential to become national security concerns, CSA said. It urged organisations to assess their cybersecurity readiness and ensure their systems were sufficiently resilient to recover from such attacks. It also warned that cybercriminals would increasingly target remote workers, given the rise of such work arrangements amidst the COVID-19 pandemic. “Poorly configured network and software systems, which are part of the new remote work ecosystems, have widened the attack surface and exposed organisations to greater risk of cyber attacks,” CSA said.Supply chains also were expected to be targeted and attacks more sophisticated, it said, pointing to the SolarWinds breach. CSA’s chief executive and commissioner of cybersecurity David Koh said in the report: “Cybersecurity threats to supply chains have been around for more than a decade, but the impact of the SolarWinds attack was unprecedented. The incident is a stark reminder of the cybersecurity risks that all companies–big and small–face within their supply chains and when engaging third-party vendors, which is a near-certainty in today’s highly-interconnected global economy. He added that ransomware had transformed from “a sporadic nuisance” impacting just a handful of machines to a massive threat affecting entire networks of large enterprises. “This is now a major security issue that affects critical information infrastructure (CII) sectors and nations,” Koh said. RELATED COVERAGE More

Image: Getty Images
The New South Wales Department of Education has on Thursday revealed it fell victim to a cybersecurity attack.In a statement, the department said a number of its internal systems were deactivated on Wednesday as a precaution.”The timing of this creates considerable challenges for staff as we prepare for the start of Term 3,” NSW Education Secretary Georgina Harrisson said. “Thankfully, our teams have been able to isolate the issues and we are working to reactivate services as soon as possible.”Harrisson said the department’s priority would be the safety and security of its student and staff data, which she explained was why the precautionary decision was made to take some systems offline as it investigates further.Department of Education and Cyber Security NSW teams are working to ensure normal access is restored in time for the start of Term 3, the statement continued.Most of NSW is currently in week two of a three-week lockdown in response to the COVID-19 outbreak affecting the state.”I am confident we will have the issue resolved soon and want to reassure teachers and parents that there will be no impact on students learning from home next week,” Harrisson said.

“Whilst we are confident all systems will be back online before day 1, Term 3, we are making information to support home learning available on our public website so that preparations for the start of term can continue.”Education said it has been working closely with Cyber Security NSW to resolve the issue, and that the matter has been referred to the NSW Police and federal agencies.The department said it was inappropriate to make any further comment as the matter is under investigation.Need to disclose a breach? Read this: Notifiable Data Breaches scheme: Getting ready to disclose a data breach in AustraliaRELATED COVERAGE More

Australian logistics and utilities providers have raised concerns with the speed at which consultation on the looming critical infrastructure legislation has been pursued by the government, but they have otherwise accepted the Bill, including the installation of software on their systems to help with incident response.Among other things, the Security Legislation Amendment (Critical Infrastructure) Bill 2020 would allow government to provide “assistance” to entities in response to significant cyber attacks on Australian systems. This includes the proposal for software to be installed that is touted as aiding providers in dealing with threats.The Parliamentary Joint Committee on Intelligence and Security (PJCIS) on Thursday morning heard from four large technology firms who declared they did not need assistance from the Australian Signals Directorate (ASD) nor its Australian Cyber Security Centre (ACSC) and that the installation of software would do more harm than good.But later that day it was a different story, with representatives from the nation’s water, electricity, and logistics sectors accepting government assistance, within reason, however.”I’m quite open to the idea, but it needs to be, for it to be effective, it actually has to be done with us,” Toll global head of information security Berin Lautenbach said. “It’s very hard to walk into an organisation and just know where the critical servers are, how the network works, everything like that, we’ll just roll some stuff out and everything will be good. But it’s not quite the way it’s going to work, it’s actually got to be, ‘Right, we’re coming in to help, here’s software, here’s what it does, here’s where we think it needs to go, here’s how it’s going to be deployed.”Lautenbach continued by saying it needed to be a joint exercise between the company and ASD.”It does have to be done with care, because it is very easy to have unintended consequences when installing software in a network,” he added.

Last year, Toll found itself victim to ransomware on two occasions. Lautenbach said Toll has already had the ASD load software on its systems.”I don’t see how you can have this kind of legislation and not have a power to walk in,” he added. “If we have something critical to the nation that is out or failed or something is going wrong and the necessary actions aren’t being taken, there has to be an ability to do something about that, so I think that’s fair.”What I worry about is the practical reality of how that would work. And it is really hard to walk into a large network or a large company and understand the IT environment well enough to be able to quickly take action.”Water Services Association of Australia similarly accepted the idea of government assistance, but added it would be open to some sort of indemnity or insurance that provides security to the organisation. “Something that provides security to the organisation that if something does go — there are some of these unintended consequences — that the federal government is willing to then pick up the tab and take ownership of the problem,” the association’s director of business excellence Greg Ryan added.His colleague Luke Sawtell said he preferred to see ASD’s intervention occur “few and far between” and as a last resort.In agreement with Lautenbach and the Water Services Association was Qantas Group security officer Luke Bramah and representatives from AGL.”I think that’s absolutely correct that if it were emergent need, you need the hook in the legislation, but very sparingly used,” Bramah said.While those appearing before the PJCIS testified that they were consulted on the legislation, many raised concerns with the speed at which it has been pushed through and the lack of clarity around what is actually considered critical.Clean Energy Council policy officer Lucinda Tonge asked for a clearer definition of “critical electricity asset” and Ports Australia CEO Michael Gallacher wants a distinction drawn between the Bill and competing legislation affecting his industry, as some examples.”We want to see these issues resolved, we want to support this legislation, we will support it, but we want to see it work … and while there is a glaring weakness in the legislation, that has a real confusion between who’s actually responsible for the delivery of port services and the response, we think we need to get it fixed, otherwise, the only people are going to take advantage of it are going to be bad people,” Gallacher said.Bramah, as well as AGL, testified that the “early days” of consultation had moved “a little too fast” and Lautenbach said it was more important to get things right than out the door.”We’d just like to see the time spent on getting the rules right, work with us on that, and we will work with Home Affairs,” he said. “We’re a bit concerned that things will be missed.”RELATED COVERAGE More

An Australian intelligence and security committee has been told by four technology giants that they foresee no scenario where the installation of government software would be of benefit and do not require assistance from the government in responding to cyber incidents. “I cannot think of a situation where installing ASD software on our networks would be of assistance,” director of Google’s threat analysis group Shane Huntley said. “We have a good working relationship with the ACSC and there has been productive threat sharing, and we believe that there is a productive means to collaborate as collaborators, not as coercion or them stepping in to operate our systems and to install stuff on our systems. “That is where we draw the strong line.” Among other things, the Security Legislation Amendment (Critical Infrastructure) Bill 2020 would allow government to provide “assistance” to entities in response to significant cyber attacks on Australian systems. This includes the proposal for software to be installed that is touted as aiding providers in dealing with threats. Huntley on Thursday told the Parliamentary Joint Committee on Intelligence and Security (PJCIS) — which is looking into the Bill — that if there was an incident, Google would absolutely work with the Australian Signals Directorate (ASD) to help respond if required, however that is where it would end. “I do not believe that there is a situation where installing ASD software on our networks or our systems, especially in the heat of an incident, is actually going to cause anything except more problems, and it’s not going to help the solution and it’s not going to help the problem at hand,” he continued.

Appearing alongside Huntley was Atlassian director of global public policy David Masters, who echoed much the same — that it’s not that his company wouldn’t want to work with the Australian Cyber Security Centre (ACSC), but allowing officials into his company’s networks to install software and somewhat pick up the running of services and processes is not a scenario he could see Atlassian wanting or even requiring. The tech sector has raised concerns with government step in powers from day one. Amazon Web Services (AWS) previously said government “assistance” or “intervention” powers could give it overly broad powers to issue directions or act autonomously and Microsoft previously told the PJCIS it would prefer the government stay out of its incident response. AWS and Microsoft also provided testimony to the PJCIS on Thursday morning, as did Australian cloud services provider AUCloud. With the exception of AUCloud, who said “never say never”, the other two tech giants agreed with the characterisation put forward by Google and Atlassian. “Installation of any type of software, particularly in a complex and interconnected network will have severe adverse consequences,” Hasan Ali, assistant general counsel in Microsoft’s office of critical infrastructure, said. “Doing so in the data storage or processing sector with hyperscale cloud providers, these are interdependent systems, they will introduce vulnerabilities, and we think it’s going to be potentially a source of substantial third-party risk that we may have to mitigate for, from the government, if there is uncertainty with how these powers may be used.” While Huntley accepted that installing software to allow for monitoring and detection of threats and for data collection would be beneficial for those without a sophisticated IT environment and a lack of internal capability, that isn’t the case with the likes of Google. “We have 1,000s of security engineers, we have our own systems for monitoring, threat analysis, detection, and the best way — and really, the only feasible way to do this sort of monitoring — would be with our own systems and our own tools,” he said. “I really can’t imagine the situation where there is some software from ACSC or ASD which installing on our systems wouldn’t even work, let alone be safe.” Instead, he would prefer the government provide threat information. “If ASD wants to say, ‘Here’s what to look for on your systems, here is the IP addresses, here’s the signatures of the malware, here is data to help in this instance’, we always want to see that information,” he said. “What we need is information and collaboration, because the only real software that’s safe to operate in a sort of Google or hyperscale cloud environment is our software and our systems that have been tested and vetted. “I don’t think there was a gap that can be filled by the government here.” Speaking following the tech giants, auDA CEO Rosemary Sinclair said the Department of Home Affairs had taken on its recommendation for the domain name system to be treated as a subsector, rather than being “caught up” in the broader communications sector.Sinclair added the domain administrator was already adhering to cybersecurity standards such as the Essential Eight and ISO27001, using DNSSEC, and working with parts of its supply chain and registry operators on cyber assessments and red team exercises. She said AuDA will be auditing them every 12 months, with the potential penalty for failure to comply being the loss of accreditation.”If needed we have our own disaster recovery arrangements and could step in should a register or the registry fail. All that is already in place and is quite extensive in its operation and effective,” Sinclair said.”All those relationships and processes are in place, and one of the things that strikes us about the legislation is that it’s focusing on a problem of the unwilling and trying to address that. Whereas I suspect that … the vast majority of people who have been engaging in this process are in fact, the willing.”In response, Senator James Paterson pointed back to a large company that refused assistance from ASD.”Unfortunately, we do have to legislate … for those worst case scenarios, and we are already aware of, at least, one instance, of the significant entity failing to cooperate when they should have in a serious cybersecurity incident,” he said.”And so, unfortunately, the Parliament can’t ignore that — we have to balance the impact that it has on those of you who do have better practice.” Sinclair said that the government should be careful about creating a solution to the wrong problem, but that she appreciated the problem of “somebody reaching for the lawyers, rather than actually reaching for the cybersecurity experts”.”Nonetheless, the powers that are being proposed are very significant and require proportionate use and scrutiny.” MORE ON THE CRITICAL INFRASTRUCTURE BILL More

Image: iStock/Borislav
When he was an undercover specialist surveillance photographer with the South Australia Police Force in the 1990s, David Chadwick was responsible for taking photos of suspected criminals and their associates from the backseat of a car, “just like you see in the movies”, he said.He would return to the station, print his shots, then make multiple copies of the best quality image that would be distributed to police officers, among dozens of other shots, with hopes of finding out the identity of the individual talking to a known criminal.”I would zoom in, crop, print off 50 copies of that, and I would stick those in the internal dispatch system and I would send them out to every detective agency in the state and say, ‘Right, we need to know who this is’,” Chadwick told ZDNet. “We had collections of criminal records photos, but they were under ‘name’, and we have no idea who this is.”Then hopefully, at some stage in the next two, three, four, five days we get a response back saying, ‘Hey that looks like John Smith’.” John Smith could be an old school teacher, a neighbour, or a drug dealer, but once his name was known, Chadwick said that would become a lead and then police work would come into it.Now the director of identity and biometrics for Unisys Asia Pacific, Chadwick would argue the use of biometrics in 2021 is just a faster, and safer, way of performing this task.”What police are doing with facial recognition is exactly what they did without facial recognition,” he said.

“Most of the time, you don’t know if this person has done anything wrong — if they’re coming out of a bank holding a sawed-off shotty and a bag of money, pretty good odds it’s a bad guy, but realistically, it returns essentially ‘I think that’s John Smith’, then police would do police work.”See also: Australia’s cops need reminding that chasing criminals isn’t society’s only needBIOMETRICS AND BIASThe Australian Human Rights Commission in May asked for a moratorium on the use of biometrics, including facial recognition, in “high-risk” areas, such as in policing and law enforcement, until such time that legislation is in place that guarantees the protection of, among other things, human rights.Chadwick would argue there needs to be education, not a moratorium. He said real-life use of biometrics is not at all like what you see on CSI or NCIS.”I’ll hack into the DMV to find a match — A. you’ve committed a criminal offence and B. you can’t,” he said. “It will then flash lots of images on a screen and produce one with flashing text saying ‘match’ underneath. Well, no, that’s not how facial recognition works.”Facial recognition is incredibly good, but it’s only ever a probability of a match.”Biometrics is a useful little tool in the identity management lifecycle and nothing else. It is all about identity, biometrics is just the sexy stuff.”Biometrics only anchors the identity; he said it never returns a result saying, that with 100% accuracy, the person you are looking for is this one, rather it pulls a number of images, usually the top 20 matches, and in a random order.”Unless you pass in a passport quality photo taken by a surveillance operative — I had a joke that if I ever take a perfect quality facial image, I’m burnt, I’ve been seen, because that means they’re looking right at me — this will be off-axis, might be a bit blurry, might be a bit grainy,” he said. “You’ll get a stream of 20 images and most systems will not show you the best match because if you see one image that’s 99%, that’s likely to bias you.”You might have two or three possible matches, but the emphasis is on possible. It’s a lead generation device.Also raised by the Human Rights Commission, and many, many others, is the possibility of bias in the use of biometrics. According to Chadwick, that isn’t as prominent in Australia.”Because they use machine learning it depends on the dataset that you train them on,” Chadwick said. “The Australian passport dataset is wonderfully diverse … most of the training databases in America is filled with correctional datasets, which is overrepresented by people of colour.”A MATTER OF TRUSTMaking the distinction between facial recognition and mass surveillance, Chadwick said, is important.”Everybody’s confused,” he said. “You read about how terrible facial recognition is, about how people want it banned, and then they look at their phone and it unlocks and think this is wonderful, then you cross the border and you go, ‘this is fantastic’, without actually understanding this is also biometrics.”He was pointing to the Australian government’s digital identity play.The Digital Transformation Agency (DTA) has been working on Australia’s digital identity system for a number of years, going live with myGovID — developed by the Australian Taxation Office — which is essentially just a form of proof allowing the user to access certain online services, such as the government’s online portal myGov.Read more: Australia to open digital ID system to private sector with consultation on new legislationChadwick would appreciate the DTA referring to this as a digital credential as the first step in correcting any confusion.”There’s one thing government does really, really badly and that’s sell itself,” he said, noting there needs to be clear, simple communication from government about what it’s actually doing in the space.”Even the very fact the DTA still calls it a digital identity, the first thing that goes through the average person’s mind is ‘oh you’re creating an identity database’ … It’s not an identity, it’s a credential.”Chadwick said government needs to lift its game; communicate better and actually gain the trust of people. Industry carries some of the responsibility, too.”Industry needs to stop selling bullshit, otherwise we end up like China where everyone thinks China has the most unbelievably good facial surveillance system in the world that could pick you out of a crowd and deduct 10 social points because you spat on the ground … it’s utter rubbish,” he said.He said it is impossible to do accurate, many-to-many facial recognition matches in real-time.”Imagine you’ve got 10 million people in the city, you’ve got to have a database of 10 million people and you’ve got to be scanning this low resolution camera for a thousand faces, so you’re doing a thousand faces to 10 million records, constantly. Sorry, it’s rubbish.”We need to start telling an accurate and honest story … and understand some people will never believe you, the tinfoil hat wearers will never believe you.”He also said there needs to be an understanding that the government is not tracking you.”Police or intelligence agencies tracking — they may well be, but if they are, then you’ve got more problems because they think you’re up to no good,” he said.”Biometrics isn’t the bad guy; biometrics is in fact a really important way to protect your identity, all this rubbish about identity, hackers getting in and changing your biometrics, oh my god, the Australian passport office has been doing this for 15 years, they’ve kind of got that bit figured out.”It’s about trust, it’s about trusting the capability, but its also about the government being able to trust you are who you say you are, so they can deliver higher value services to you.”Related coverage More

The White House is urging mayors across the US to be more proactive about cybersecurity measures and meet with state level officials to test their cybersecurity posture as attacks continue to plague both small towns and major metropolitan areas. Anne Neuberger, the deputy National Security Advisor for Cyber and Emerging Technology, spoke to a bipartisan group of mayors virtually during a US Conference of Mayors event this week, addressing the spate of ransomware attacks on dozens of cities over the last two years. Neuberger “urged mayors to immediately convene heads of state agencies to review their cybersecurity posture and continuity plans,” according to a White House readout of the meeting. Multiple cities, including Tulsa, Atlanta, New Orleans, Baltimore and others, have dealt with ransomware attacks and other breaches by criminal groups in recent months. Two weeks ago, Tulsa was forced to notify city residents that some of their personal information may be on the dark web thanks to a ransomware attack in May by prolific cybercriminal group Conti.Many cities and towns do not make ransom payments public, as noted in a recent report from eSentire that found ransomware gangs like Ryuk launched attacks on “Jackson County, Georgia, which paid a $400,000 ransom; Riviera Beach, Florida, which paid $594,000; and LaPorte County, Indiana, which paid $130,000.”In addition to attacks on government infrastructure, ransomware groups made hundreds of millions of dollars throughout 2020 and 2019 by attacking hospitals across the country. Neuberger said the White House is working to “disrupt ransomware infrastructure” through coordination with private cybersecurity firms and partnering with other countries to “hold countries who harbor ransom actors accountable.” 

She did not go into detail about what specific actions are being taken against ransomware groups but said the White House is continuing to use cryptocurrency exchanges as a way to track down threat actors. They are also in the process of creating a “cohesive and consistent approach” when it comes to whether local communities should go through with ransom payments, which dozens of towns and cities have already paid. Neuberger also touted the administration’s “Improving the Nation’s Cybersecurity” Executive Order and said the FBI as well as CISA are ready to help cities facing ransomware attacks. She outlined efforts the federal government is making to secure critical industries like the electric sector, pipelines, water treatment plants and chemical plants. The federal government is working on a pilot program called the Cybersecurity Industrial Control Systems Initiative, which Neuberger said will “strengthen cyber resilience in the electric sector.”Cybersecurity expert Chloé Messdaghi told ZDNet that legacy equipment, inadequate or even undesignated cybersecurity budgets, and challenges finding and up-skilling talent are all substantial problems across the public sector prompting the increase in ransomware attacks. “Whether public or private sector, the thing to remember is that everyone is a target. Outdated equipment, missed patches, inadequate staffing and tight budgets are a huge problem across the public sector,” Messdaghi said. “Getting employees to update their systems in time is such a challenge, and the slower that cities and towns are to patch and update their systems, the more at risk they put the public they serve.” More