Crypto-Mining Malware is Crippling Enterprise Networks

Cryptocurrencies such as Bitcoin and Ethereum have gone mainstream; it seems like everybody and their brother is looking to buy some crypto and get their piece of the digital currency gold rush. Hackers want a piece of it, too. In addition to hacking ICO’s and cryptocurrency exchanges, they’re using crypto-mining malware to “mine” their own “coins.”

Crypto-mining malware isn’t new; last summer, this blog reported on a crypto-mining malware variant called Adylkuzz that came to light in the wake of the WannaCry attacks. Adylkuzz took advantage of the same Windows exploit as WannaCry. In fact, it acted as a sort of “vaccine” against the ransomware, preventing it from taking root in Adylkuzz-infected computers lest it interfere with its Monero-mining operations. However, Adylkuzz wasn’t a kinder, gentler malware. While it didn’t directly lock down systems or access data, it did hijack infected machines’ processing power, and it proved to be far more lucrative than WannaCry; it’s estimated that Adylkuzz raked in 10 times more money for its users than WannaCry.

At first, rogue crypto-miners were viewed as an annoyance; the most they did was slow down machines and perhaps cause problems accessing certain network folders. They were also seen as more of a threat to consumers than businesses. Many variants went after IoT devices, such as smartphones, overwhelming their processors to the point where the devices could be damaged or even destroyed. However, as crypto-mining malware has evolved, it has become more sophisticated, and hackers are looking to harvest enterprise processing power.

Move Over, WannaCry; Here Comes WannaMine

Recently, Dark Reading reported on yet another exploit of the Eternal Blue tool stolen from the NSA, a crypto-mining malware variant dubbed WannaMine. WannaMine doesn’t attack smartphones and other small IoT devices; it goes after Windows computers, and isn’t just slowing systems down. Security firm CrowdStrike reports having seen it cause “applications and hardware to crash, causing operational disruptions lasting days and sometimes even weeks.”

A report in Security Week elaborates on how WannaMine appears to be designed to specifically target enterprise networks:

WannaMine, the security researchers explain, employs “living off the land” techniques for persistence, such as Windows Management Instrumentation (WMI) permanent event subscriptions. The malware has a fileless nature, leveraging PowerShell for infection, which makes it difficult to block without the appropriate security tools.

The malware uses credential harvester Mimikatz to acquire legitimate credentials that would allow it to propagate and move laterally. If that fails, however, the worm attempts to exploit the remote system via EternalBlue.

To achieve persistence, WannaMine sets a permanent event subscription that would execute a PowerShell command located in the Event Consumer every 90 minutes.

The malware targets all Windows versions starting with Windows 2000, including 64-bit versions and Windows Server 2003. However, it uses different files and commands for Windows Vista and newer platform iterations.

WannaMine isn’t the only crypto-mining malware harnessing Eternal Blue and using the Windows Management Infrastructure to propagate. Another Monero-mining worm, dubbed Smominru (aka Ismo), has infected over a half a million Windows hosts, most of them servers.

These “next-generation” crypto-mining malware variants have proven extremely difficult to take down. First, the malware is distributed. Second, even if all machines on a network are patched against Eternal Blue, the malware will seek to use the Mimikatz credential harvester to get in by cracking a weak password. Finally, some legacy antivirus products do not detect crypto-mining malware because it doesn’t actually write files to an infected machine’s disk.

Protecting Your Organization Against WannaMine and Other Crypto-Mining Malware

There are several ways to protect your enterprise systems from being hijacked for illegal crypto-mining:

• Keep your systems and software up-to-date; only older Windows machines are susceptible to the Eternal Blue exploit.
• Use network security software to monitor for and block the activity needed for crypto-miners to work.
• Ensure that all system users are using strong passwords that cannot be cracked by Mimikatz.

In addition to doing damage to enterprise systems, crypto-mining malware can be employed by real-world threat actors to fund their criminal activity. It’s in everyone’s best interest to put a stop to it.

The cyber security experts at Lazarus Alliance have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting organizations of all sizes from security breaches. Our full-service risk assessment services and Continuum GRC RegTech software will help protect your organization from data breaches, ransomware attacks, and other cyber threats.

Lazarus Alliance is proactive cyber security®. Call 1-888-896-7580 to discuss your organization’s cyber security needs and find out how we can help your organization adhere to cyber security regulations, maintain compliance, and secure your systems.

Latest FINRA Examination Findings Reveal That Firms Have Made Progress with Cyber Security, but Problems Remain

Cyber security remains “one of the principal operational risks facing broker-dealers,” according to the FINRA 2017 Examination Findings Report, and while progress has been made, many broker-dealer firms still have work to do to protect themselves against hackers.

Firms More Aware of Cyber Security Risks

FINRA noted a significant uptick in firms’ awareness of cyber security risks, noting a substantial increase in “attention to cybersecurity challenges over the past two years, including at the executive management level.” Most of the firms FINRA examined had already established or were in the process of establishing risk management programs to address security issues. FINRA noted that firms with the most effective cyber security programs tended to have:

• Strong, risk-based governance structures and processes
• Conducted regular risk assessments and followed up to address areas of concern
• Conducted regular vulnerability and penetration tests
• Conducted regular employee cyber security training
• Conducted comprehensive cyber security reviews of any branch offices

But Better Risk Management & Data Governance Needed

FINRA noted that the quality of firms’ cyber risk management programs varied widely, not only from firm to firm but also within the same organization. By far, the biggest security vulnerability was firms’ own people; the most common threats observed in 2016 and 2017 were all rooted in social engineering: phishing and spearphishing schemes, ransomware (which usually begins with a phishing email), and fraudulent third-party wires (again, usually involving phishing schemes).

The agency highlighted a number of frequent problem areas:

• Access Management – Some firms didn’t adhere to basic procedures such as terminating system access for former employees and monitoring systems for anomalies, such as logins from unusual locations or privileged users granting themselves additional, unwarranted system privileges.
• Risk Assessments – Despite the importance of regular risk assessments, some firms still aren’t doing them; even worse, the firms “could not effectively identify their critical assets and the potential risks to those assets.”
• Vendor Management – Third-party vendor hacks are a serious problem, but some broker-dealers are still not properly vetting their business associates’ cyber security preparedness or sufficiently documenting vendors’ responsibilities in service level agreements.
• Branch Offices – Branch offices tended to have less robust cyber security than home offices; FINRA noted problems with password management, software updates, removable storage device security, data encryption, and reporting incidents.
• Segregation of Duties – Some small and medium-sized firms are not properly segregating responsibilities for cyber security rules and systems changes; for example, at some firms, network engineers are performing cyber security functions without any supervision from cyber security experts.
• Data Loss Prevention – Many firms need stronger DLP protocols, such as applying the same rules that currently protect clients’ Social Security Numbers to other sensitive data, such as account numbers.

Since cyber attacks represent such a serious threat to the U.S. and global financial systems, both FINRA and the SEC, NFA have indicated that cyber security will be of high priority throughout 2018. Firms that run afoul of SEC, NFA and FINRA standards – or, worse yet, suffer a breach – can face millions of dollars in fines. The good news is that a data-centric, integrated risk management approach to cyber security will head off all of the problem areas FINRA discusses in its report.

The cyber security experts at Lazarus Alliance have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting organizations of all sizes from security breaches. Our full-service risk assessment services and Continuum GRC RegTech software will help protect your organization from data breaches, ransomware attacks, and other cyber threats.

Lazarus Alliance is proactive cyber security®. Call 1-888-896-7580 to discuss your organization’s cyber security needs and find out how we can help your organization adhere to cyber security regulations, maintain compliance, and secure your systems.

New data breach notification regulations aren’t a matter of if, but when

The U.S. Securities and Exchange Commission plans to update its six-year-old guidelines regarding data breach notification and cyber risk disclosure, Bank Info Security reports:

The agency has indicated that it expects to refine guidance around how businesses disclose cybersecurity risks to investors as well as require insider trading programs to include blackout rules in the event that a suspected data breach gets discovered.

“Unfortunately, in the reality that we live in now, cyber breaches are going to be increasingly common, and this is in part why the SEC, NFA is so fully focused on cybersecurity,” says Matt Rossi, a former assistant chief litigation counsel to the SEC, NFA who’s now an attorney specializing in securities litigation and enforcement as well as data privacy at global law firm Mayer Brown. “Chairman [Jay] Clayton said it’s one of the greatest risks to the financial system right now.”

There is great irony in the SEC’s announcement. Less than two weeks after the Equifax breach came to light last fall, the agency disclosed that its EDGAR database, which is used to disseminate company news and data to investors, had been hacked – over a year prior.

Be that as it may, data privacy is at top of mind for consumers. The General Data Protection Regulation (GDPR) is about to become law in the European Union, and 2017 saw numerous high-profile incidents where breached organizations sat on their hands for extended periods of time before notifying potential victims.

Equifax Breach Incites Outrage from Congress, But No Action

The SEC’s guidelines are just that – guidelines, not legislation – and they apply only to publicly traded firms. While 48 states have data privacy laws on the books, and companies in certain industries are subject to industry-specific regulations or standards, such as HIPAA and PCI DSS, there is no federal data privacy or data breach notification law that applies across industries.

For the past several years, the U.S. government has been under increasing pressure to establish federal data breach notification regulations and address other data privacy issues. This pressure intensified after the Equifax breach was disclosed, and many privacy advocates hoped the incident would finally push Congress to act. Unfortunately, lawmakers’ initial public outrage over the Equifax breach quickly died down, and Congress’ focus shifted back to healthcare and tax reform.

Frustrated with the lack of progress in Washington, states have begun taking matters into their own hands. Last year, New York State passed a sweeping cyber security law that was heavily steeped in data governance and integrated risk management. Effective January 1, 2018, Maryland’s data breach notification law was amended to not only require companies to notify victims within 45 days of a data breach but also expand the definition of “personal information.”

Could We Ultimately See an “American GDPR”?

However, the lack of progress on a federal level doesn’t mean U.S. companies should assume that we will never see an “American version” of the GDPR on a federal level. The New York Times recently reported on businesses that do not accept cash as a form of payment. While these are isolated incidents, they are a sign of the rapid digitization of our society. Consumers are seeing more and more of their personal information being preserved for posterity in digital files kept by a dizzying array of government entities and private-sector organizations, with almost no control over where it goes or what happens to it. Even minors’ information is stored digitally, and children can easily become victims of identity theft.

Businesses, meanwhile, are struggling to stay abreast of an ever-changing compliance landscape complicated by the fact that while states have borders, ecommerce does not. This forces businesses that sell in multiple states to reconcile a confusing patchwork of regulations, some of which contradict each other. Depending on individual states to regulate data breach notification and data privacy is rapidly becoming untenable, and the federal government will eventually be forced to step in, as it did with HIPAA in the 1990s.

In the meantime, the best option for businesses is to adopt a data-centric, integrated risk management approach to ensure they have control of their data and are able to quickly adapt to changing regulations.

The cyber security experts at Lazarus Alliance have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting organizations of all sizes from security breaches. Our full-service risk assessment services and Continuum GRC RegTech software will help protect your organization from data breaches, ransomware attacks, and other cyber threats.

Lazarus Alliance is proactive cyber security®. Call 1-888-896-7580 to discuss your organization’s cyber security needs and find out how we can help your organization adhere to cyber security regulations, maintain compliance, and secure your systems.