Microsoft to let Office 365 users report Teams phishing messages

by snoopy | Oct 1, 2022 | Cybersecurity

The Ransomware Playbook Mistakes That Can Cost You Millions

by snoopy | Oct 1, 2022 | Cybersecurity

If there is one type of cyberattack that can drain the color from any security leader’s face, it’s ransomware. A crippling, disruptive, and expensive attack to recover from, with final costs rarely being easy to foretell. Already a prevalent threat, the number of ransomware attacks rose during the pandemic and nearly doubled in the year between 2020 and 2021, continuing to rise since.

Focusing on the extortion price of these attacks, the cost of a ransomware attack can appear finite at first, but as costs accumulate over time, and include the entire recovery project, they can reach exorbitant amounts of money. In some cases, hundreds of millions of dollars are lost as the process stretches over months following the discovery of the attack.

But although these attacks raise concerns from the IT security team all the way to the board of directors, it appears that companies are not investing enough in being prepared for such a scenario.

According to the 2022 Cost of a Data Breach Report, the average ransomware attack took 237 days to identify and 89 days to contain, for a total lifecycle of 326 days. This is well over 10 months, and those are just the initial stages of the response process. Furthermore, compared to the overall average lifecycle of regular data breaches (277 days), it took 49 days longer to identify and contain a ransomware attack, for a difference of 16.3%. The longer the attackers get to dwell, the more damage they can cause, and leverage they can eventually gain for the extortion phase.

Building preparedness for a ransomware attack can translate into shorter timelines, saving a lot of work and money in the process.

The Untested Plan

What if your organization is one of those that already thought a plan was needed, and might have one in place, but this plan was never tested? The 2022 Cost of a Data Breach report found that of the organizations that had incident response (IR) plans, 37% said they did not regularly test them. Consider the following question: “How well will you fare if you test that plan for the first time when you are under an active attack?”

With proper pressure applied, plans can crumble when you most need them. This is readily easy to infer by looking at the numbers from actual attacks. Organizations with IR capabilities saw an average cost of $3.26 million per breach in 2022, compared to $5.92 million for organizations without IR capabilities, a difference of $2.66 million, or 58%. A very significant difference.

Moreover, that’s an increase in savings over the numbers we saw in 2021, when the average cost of a breach at organizations with IR capabilities saved $2.46 million; or in 2020, when the cost difference was $1.77 million, indicating the growing cost-saving effectiveness of IR capabilities. So have a plan and test it. You’ll save a lot of time, money, and stress in case of an actual adverse event, and it sure makes its own business case.

More Organizations Have Plans, But Lack Playbooks

It’s not all bad news. Nearly three-quarters of organizations in the 2022 Cost of a Data Breach study said they have an incident response plan, and 63% said they do regularly test the plan.

But while this is a good start, general technical response plans are incomplete without scenario-specific plans for major impact, like ransomware. A Ponemon survey, sponsored by IBM Security, found that security response efforts were hindered by a lack of specific playbooks for common attack types — and ransomware has become rather common.

With double or even triple extortion schemes rampant nowadays, a ransomware attack can have your team facing a number of aspects simultaneously:

• Data breach with privacy and regulatory implications
• System disruption without immediately known recovery times
• Disaster recovery in case of a destructive attack
• Dealing with extortive DDoS
• Negotiating with criminals

This sort of complex response requires orchestration of your technical and executive teams simultaneously. It all needs its own playbook as an extension of the Cyber Security Incident Response Plan (CSIRP) you might have in place. That’s assuming that your CSIRP has the adequate maturity level to pull the organization through a ransomware crisis.

Explore the Report

Catch Up with Playbooks

While security response planning is slowly improving, most organizations surveyed by Ponemon (74%) are still reporting that even their technical response plans are either ad hoc, applied inconsistently, or that they have no plans at all. Among those with a formal CSIRP, only 17% of respondents had also developed specific playbooks for common attack types. Playbooks for ransomware and emerging attacks lagged even farther behind.

These statistics could be driving higher stress and costs on organizations in an already stormy situation. Having scenario-specific playbooks in place allows organizations to prepare for emerging attacks that may be nuanced in the need for decision-making authority and cross-organizational implications. It also means being able to fall back on an agreed-upon process that distills the knowledge and experience of your most experienced leaders into a solid, repeatable process that can be followed to the letter by even the greenest of new recruits.

Crisis Management: A Dangerous Gap

Beyond the need for a technical ransomware playbook, there is a dangerous gap to mind that is often ignored when it comes to ransomware attacks. That gap is the executive response to a crisis that impacts the entire organization.

A disruptive extortion case will very quickly require escalation to executive teams, the CEO, and even the board, in ways that other attacks rarely do. These leaders will have to face the media and impacted parties in short order, and they will have to be prepared to make decisions using time they do not have. The results are often more catastrophic than the breach itself, as leaders can fumble in front of TV cameras and may not clearly drive the messages that can best protect the company’s hard-earned reputation. These situations can go to the extreme with rash decisions that end up costing the company and its leadership dearly years after the event.

Seeing these cases unfold in the media, executives and boards are taking a more active approach and seeking to understand their role in a potential cyberattack or a cyber crisis. They do that to prepare themselves for the risk of major monetary loss, potential insurance pushbacks, and even personal liability. As a result, security leaders are being asked to show and prove preparedness and demonstrate how the entire company will orchestrate an adequate response. One way to show this preparedness is a playbook that can engage these executives early on. Equipping executives with plans, processes, templates for communications, and clear lists with contact information can save them the stress and time they need to make swift decisions and drive the company through and out of the crisis successfully.

These plans can also help make and document decisions in advance with a cool head, extending the ‘commander’s intent’ through to other team members that will use the plan under fire, even as they pivot through the event’s turns. Build a plan, drill the plan, and have metrics and KPIs to show your organization is prepared and keeps improving.

Ransomware Playbooks — the Essentials

Having a plan for responding to a ransomware attack begins with the basics of incident response. Let’s take the NIST framework as a standard for this purpose.

Figure 2: NIST IR Framework: Identify, Protect, Detect, Respond, Recover (Source: NIST)

Within the framework, zooming in on the “Response” section, we have:

• Preparation
• Detection and Analysis
• Containment, Eradication, Recovery
• Post Incident Activity

Preparing to handle incidents is the phase where plans are drafted and tested, then drilled and updated over time. It’s an essential part because it impacts the quality of response that will eventually take place.

Detection and Analysis are the port through which your organization realizes there is an incident to handle. This is where Triage takes place to assess severity and have an initial idea of impact and root cause. It’s also the process that starts to escalate to the parties who will carry out the technical response in the next stage. In the case of ransomware, this is where your technical management will also inform relevant executives.

Containment, Eradication, and Recovery activate your incident management teams and guide them through escalating to staff members that manage platforms, infrastructure, and applications that may be impacted. It could be that this plan also covers data loss cases, and it may or may not account for both IT and security, but all these aspects will go into the effort to minimize damage and restore access and services as quickly as possible.

Before moving to any post-event activity, where do ransomware playbooks come into the picture? They have to be worked with in parallel:

• Ransomware playbooks should be part of the preparation, providing plans that can guide teams through responses that are specific to ransomware attacks and their nuanced nature. This preparation should aim to prevent incidents and it should outline when and how the organization may use backups in a recovery process. Your executives must be consulted here if service impact is going to affect the organization’s reputation, employees, customers, revenues, etc. Hence, again, the preparation of playbooks is essential.
• A ransomware playbook should contain qualification criteria and thresholds that would allow ransomware to be called out immediately upon detection and analysis, and thus escalated accordingly to technical management but also to the CISO, CIO, Chief Legal and other executives.
• The ransomware playbook should be used in the containment, eradication, and recovery stages. Unlike incidents that urge availability above other considerations, a ransomware case prioritizes ensuring that endpoints, servers, databases, cloud, and other assets, are recovered safely and after they have been cleared (and cleaned) for going back online.

Evidence preservation for a ransomware case should also be specific and carried out appropriately. This will allow the organization to later work through potential legal and forensic investigations.

And this is not all.

A View from the C-Suite — The Cyber Crisis Flavor

Ransomware is a ticking time bomb that can quickly turn into a whole-of-business crisis. As such, it requires a lot of involvement from the executive team, immediately upon discovery. There are critical considerations, decisions, negotiations, budgeting, regulatory, HR, finance, legal implications, and strategic approvals that go into the overall attack lifecycle, to name a few. None of these are accounted for inside a classic, technical CSIRP.

A separate playbook, drafted from a strategic viewpoint, has to be crafted with the participation of your C-suite executive team, to ensure that they come together and understand what’s needed of them quickly when an attack advances rapidly. This book will integrate with the other plans.

In case of a crisis, executives will need to see how a pre-approved qualification criteria triggered a crisis level alert. They will ask to see a business impact analysis from the technical team. The Business Continuity team will have to present information from their end, as will the Disaster Recovery team. Looking at a threat intelligence brief on the suspected group that attacked the organization will enable executives to understand the motives and modus operandi and further help them make the right decisions with the data they have.

At this time, where time is the last thing they have more of, your organization would want to rely on pre-made decisions and intent established ahead of an actual attack — when you had the chance to plan and think through the burning questions. Will you consider paying a ransom? What are the conditions you would pay under? What if paying is a federal offense in this case? Will you call a negotiator? What is the holding statement your CEO plans to give the media when that first call comes in? Was it approved by Comms and Legal?

All these questions can, and should be, answered in advance, in a designated executive ransomware playbook.

Back to the NIST framework, we are at the Post Incident Activity stage. This is where company-wide coordination should gather the event logs and lessons learned from all those who were actively involved in the incident, and those who experienced it from the sidelines.

Feedback sessions should allow both technical and executive management to be open and candid in their viewpoint, without blaming anyone, working to improve the plans and their execution to prevent breakdowns in potential future events.

In the 2022 Cost of a Data Breach report, 83% of respondents indicated that their organization has already gone through more than one data breach. With attack numbers only growing year over year, getting better at handling them must be part of how businesses are run.

For the complete 2022 Cost of a Data Breach report, please visit: ibm.biz/breach-report

Planning for Cyber Crisis Management: www.ibm.com/downloads/cas/KMBQMBMW

Want to learn more about how X-Force incident response can help your organization? Check out www.ibm.com/security/incident-response

Continue Reading

Luxury hotel chain Shangri-La suffered a security breach

by snoopy | Oct 1, 2022 | Cybersecurity

The Shangri-La hotel group disclosed a data breach, a database containing the personal information of its customers was compromised.

The Shangri-La hotel group disclosed a data breach, threat actors had access to a database containing the personal information of customers at eight of its Asian properties between May and July.

The incident impacted hotels in Hong Kong, Singapore, Chiang Mai, Taipei and Tokio, the company launched an investigation to determine what data had been stolen by the attackers. The company notified authorities and potentially impacted guests.

A statement published on September 30 by the hotel chain on its website revealed that the company has “recently discovered unauthorised activities” on its IT infrastructure.

A “sophisticated threat actor managed to bypass Shangri-La’s IT security monitoring systems undetected, and illegally accessed the guest databases”, reads the statement.

“Certain data files were found to have been exfiltrated from these databases but the investigation has not been able to verify the content of these files,” continues the statement. “The databases contained guests’ contact information but personal information such as dates of birth, identity and passport numbers, and credit card details, was encrypted.”

Experts pointed out that the Shangri-La hotel in Singapore hosted Asia’s top security summit between June 10 and 12 in the same period the hack took place.

Asked whether the Shangri-La Dialogue was the target of the hackers, a hotel spokesman told Singapore’s Straits Times newspaper there is no evidence to support this hypothesis.

“There is no evidence to suggest any specific hotel or event was singled out. As a matter of policy, we do not disclose information about our guests.”  said the spokesman.

“Data related to the Shangri-La Dialogue was stored on a separate secure server and was not affected in this incident,”

“Data related to the Shangri-La Dialogue was stored on a separate secure server and was not affected in this incident.”  said a spokesman at the event organiser, the International Institute for Strategic Studies (IISS).

The hotel chain states that it is not aware of any abuse of stolen guest data.

Follow me on Twitter: @securityaffairs and Facebook

Developer Leaks LockBit 3.0 Ransomware-Builder Code

by snoopy | Oct 1, 2022 | Cybersecurity

One problem with running a ransomware operation along the lines of a regular business is that disgruntled employees may want to sabotage the operation over some perceived injustice.

That appears to have been the case with the operators of the prolific LockBit ransomware-as-a-service operation this week when an apparently peeved developer publicly released the encryptor code for the latest version of the malware — LockBit 3.0 aka LockBit Black — to GitHub. The development has both negative and potentially positive implications for security defenders.

An Open Season for All

The public availability of the code means that other ransomware operators — and wannabe ones — now have access to the builder for arguably one of the most sophisticated and dangerous ransomware strains currently in the wild. As a result, new copycat versions of the malware could soon begin circulating and adding to the already chaotic ransomware threat landscape. At the same time, the leaked code gives white-hat security researchers a chance to take apart the builder software and better understand the threat, according to John Hammond, security researcher at Huntress Labs.

“This leak of the builder software commoditizes the ability to configure, customize, and ultimately generate the executables to not only encrypt but decrypt files,” he said in a statement. “Anyone with this utility can start a full-fledged ransomware operation.” 

At the same time, a security researcher can analyze the software and potentially garner intelligence that could thwart further attacks, he noted.  “At minimum, this leak gives defenders greater insight into some of the work that goes on within the LockBit group,” Hammond said. 

Huntress Labs is one of several security vendors that have analyzed the leaked code and identified it as being legitimate.

Prolific Threat

LockBit surfaced in 2019 and has since emerged as one of the biggest current ransomware threats. In the first half of 2022, researchers from Trend Micro identified some 1,843 attacks involving LockBit, making it the most prolific ransomware strain the company has encountered this year. An earlier report from Palo Alto Networks’ Unit 42 threat research team described the previous version of the ransomware (LockBit 2.0) as accounting for 46% of all ransomware breach events in the first five months of the year. The security identified the leak site for LockBit 2.0 as listing over 850 victims as of May. Since the release of LockBit 3.0 in June, attacks involving the ransomware family have increased 17%, according to security vendor Sectrio.

LockBit’s operators have portrayed themselves as a professional outfit focused mainly on organizations in the professional services sector, retail, manufacturing, and wholesale sectors. The group has avowed not to attack healthcare entities and educational and charitable institutions, though security researchers have observed groups using the ransomware do so anyway. 

Earlier this year, the group garnered attention when it even announced a bug bounty program offering rewards to security researchers who found problems with its ransomware. The group is alleged to have paid $50,000 in reward money to a bug hunter who reported an issue with its encryption software.

Legit Code

Azim Shukuhi, a researcher with Cisco Talos, says the company has looked at the leaked code and all indications are that it is the legitimate builder for the software. “Also, social media and comments from LockBit’s admin themselves indicate that the builder is real. It allows you to assemble or build a personal version of the LockBit payload along with a key generator for decryption,” he says.

However, Shukuhi is somewhat dubious about how much the leaked code will benefit defenders. “Just because you can reverse-engineer the builder doesn’t mean that you can stop the ransomware itself,” he says. “Also, in many circumstances, by the time the ransomware is deployed, the network has been fully compromised.”

Following the leak, LockBit’s authors are also likely hard at work rewriting the builder to ensure that future versions won’t be compromised. The group is also likely dealing with brand damage from the leak. Shukuhi says.

In an interview, Huntress’ Hammond tells Dark Reading that the leak was “certainly an ‘oops’ [moment] and embarrassment for LockBit and their operational security.” But like Shukuhi, he believes that the group will simply change up their tooling and continue as before. Other threat actor groups may use this builder for their own operations, he says. Any new activity around the leaked code is just going to perpetuate the existing threat.

Hammond says Huntress’ analysis of the leaked code shows that the now-exposed tools might enable security researchers to potentially find flaws or weaknesses in the cryptographic implementation. But the leak does not offer all private keys that could be used to decrypt systems, he adds.

“Truthfully, LockBit seemed to brush off the issue as if it was no concern,” Hammond notes. “Their representatives explained, in essence, we have fired the programmer who leaked this, and assured affiliates and supporters that business.”

CISA adds Atlassian Bitbucket Server flaw to its Known Exploited Vulnerabilities Catalog

by Your hacker | Oct 1, 2022 | Cybersecurity

CISA added a recently disclosed flaw in Atlassian Bitbucket Server, tracked as CVE-2022-36804, to its Known Exploited Vulnerabilities Catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) this week added a recently disclosed critical vulnerability in Atlassian’s Bitbucket Server and Data Center to its  Known Exploited Vulnerabilities Catalog.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts recommend also private organizations review the Catalog and address the vulnerabilities in their infrastructure.

At the end of August, Atlassian fixed a critical flaw in Bitbucket Server and Data Center, tracked as CVE-2022-36804 (CVSS score 9.9), that could be explored to execute malicious code on vulnerable installs

The flaw is a command injection vulnerability that can be exploited via specially crafted HTTP requests.

“This advisory discloses a critical severity security vulnerability which was introduced in version 7.0.0 of Bitbucket Server and Data Center.” reads the advisory. “There is a command injection vulnerability in multiple API endpoints of Bitbucket Server and Data Center. An attacker with access to a public repository or with read permissions to a private Bitbucket repository can execute arbitrary code by sending a malicious HTTP request.”

The issue impacts all versions released after 6.10.17 including 7.0.0 and newer are affected, this means that all installs that are running any versions between 7.0.0 and 8.3.0 inclusive are impacted.

CISA orders federal agencies to fix these vulnerabilities by October 21, 2022.

Follow me on Twitter: @securityaffairs and Facebook

try {
window._mNHandle.queue.push(function (){
window._mNDetails.loadTag(“816788371”, “300×250”, “816788371”);
});
}
catch (error) {}

try {
window._mNHandle.queue.push(function (){
window._mNDetails.loadTag(“816788371”, “300×250”, “816788371”);
});
}
catch (error) {}
Pierluigi Paganini

(SecurityAffairs – hacking, Known Exploited Vulnerabilities Catalog)

The post CISA adds Atlassian Bitbucket Server flaw to its Known Exploited Vulnerabilities Catalog appeared first on Security Affairs.