Blog

Lax Navy cybersecurity has left the Navy and its supply chain “under cyber siege” from Russian and Chinese hackers.

Everyone already knew that Navy cybersecurity had big problems. Last fall, a Wall Street Journal report on Navy cybersecurity revealed that Chinese nation-state hackers had successfully breached a number of third-party Navy contractors over an 18-month period, stealing highly classified information about advanced military technology currently under development, including “secret plans to build a supersonic anti-ship missile planned for use by American submarines.” The hackers had targeted the contractors, the WSJ reported, because they surmised these firms had less robust cybersecurity and would make easy targets.

illustration of cartoon businessman with leaking boat

Shortly after the WSJ published its report, an internal Navy cybersecurity audit was ordered, citing “several significant compromises of classified and sensitive information.” The resulting audit report, which was released last week and first reported on by the Wall Street Journal, portrays a military branch in complete cyber chaos, “in ways few appreciate, fewer understand, and even fewer know what to do about.”

Cybersecurity awareness severely lacking in the Navy

The scathing, 80-page report details many of the same organizational culture stumbling blocks and lack of awareness/education among personnel that stymie cybersecurity at private-sector firms, including:

• Navy cybersecurity is predominantly viewed as “an IT issue and is not integrated across all operations and activities of the organization.”
• Navy leadership “occasionally articulate[s] the importance of cybersecurity, but do[es] not fully understand how to convert their words into action.”
• The Navy’s workforce is “generally uneducated in cybersecurity, largely complacent, and fails to fully embrace ‘a risk to one is a risk to all.’”
• Navy internal bureaucracy is mired in the pre-digital era, is focused on pre-digital threats, and has been reluctant “to shift its focus from ship or platform centric, to information centric, in order to attend to the world of vulnerabilities presented by its adversaries’ capabilities growth and sophistication.”

Navy contractors “under cyber siege” from foreign nationals

The audit did not mince words regarding the significant ongoing threat to Navy cybersecurity posed by its own supply chain, including subcontractors who “are not US owned or domiciled” but who are necessary to the Navy supply chain because they are part of ”key industrial and utility commons ecosystems that are no longer centered or owned in the US, such as advanced composite materials or national telecommunications infrastructures.” These contractors, the audit states, are “under cyber siege” by foreign adversaries, particularly those in Russia and China, and have been for years.

Meanwhile, the Navy “did not anticipate this attack vector,” did not adequately warn its supply chain about possible cybersecurity threats, and has relied on an honor system where contractors self-report vulnerabilities and breaches. This system, the audit states, has “demonstrably failed” and left the Navy and the DoD with no grasp of the true scope of Navy supply chain breaches. Very few cyber incidents are reported, and of those that are, only a small number are “fully investigated.”

In a brief statement, Secretary of the Navy Richard Spencer pledged that “the Department of the Navy Secretariat along with the Chief of Naval Operations and the Commandant of the Marine Corps, will coordinate with the Department of Defense and Congress for the resources required to compete and win in the cyber domain.” The Navy also announced that it had ceased publicizing promotions of Navy captains and admirals last fall to prevent top brass from being targeted by hackers.

The cybersecurity experts at Lazarus Alliance have deep knowledge of the cybersecurity field, are continually monitoring the latest information security threats, and are committed to protecting organizations of all sizes from security breaches. Our full-service risk assessment services and Continuum GRC RegTech software will help protect your organization from data breaches, ransomware attacks, and other cyber threats.

Lazarus Alliance is proactive cybersecurity®. Call 1-888-896-7580 to discuss your organization’s cybersecurity needs and find out how we can help your organization adhere to cybersecurity regulations, maintain compliance, and secure your systems.

How to protect your business and your customers against credential stuffing attacks

Nearly everyone knows that reusing passwords across multiple sites and systems is a security risk, but most people continue to do it anyway. As a result, credential stuffing attacks abound, especially among retailers. Dunkin’ Donuts has been victimized twice in the past three months by hackers seeking access into customers’ DD Perks loyalty program accounts.

What is credential stuffing?

Credential stuffing takes advantage of two problems in the current cyber threat environment: (1) massive data breaches that compromise large numbers of login credentials and (2) people’s propensity to reuse passwords. Armed with these credentials, hackers set up bots that attempt to use them to gain access to accounts on other sites; that’s where the “stuffing” part comes in.

Credential stuffing attacks are endemic in the retail industry; it’s estimated that credential stuffing accounts for 90% of global traffic to online retail sites, where hackers seek to grab loyalty points that can be converted into cash, airline points, or merchandise, such as in the Dunkin’ Donuts attacks. Retailers aren’t the only potential target for credential stuffing; these types of attacks make up about 60% of traffic to consumer banking and airline sites, and any company whose customers sign up for online accounts is at risk. Hackers recently used credential stuffing to access TurboTax tax preparation software accounts.

Despite the ubiquity of credential stuffing, about 32% of companies lack visibility into this type of attack, and another 30% admit being unable to detect or mitigate credential stuffing attacks.

Preventing credential stuffing attacks

Individuals can prevent having their accounts taken over by using a password manager, which will allow them to easily generate a different, secure password for each of their accounts. They should also opt for multi-factor authentication whenever possible.

While enterprises can and should implore their customers not to recycle passwords, in the end, they cannot control what their customers choose to do. There is also no magic bullet to completely halt credential stuffing attacks on the enterprise’s side. Most websites already monitor authentication logs for large numbers of login attempts from specific IP addresses or address spaces. Knowing this, hackers use credential stuffing tools that make it appear as though their login attempts are coming from different IPs and even different browsers.

However, companies can take proactive steps to mitigate credential stuffing attacks, such as:

• Allow users to secure their accounts through multi-factor authentication (MFA). In addition to preventing credential stuffing, MFA provides a competitive advantage. As credential stuffing and other cyber attacks multiply, consumers are becoming increasingly leery of sites that don’t offer MFA protection.
• Regularly check compromised accounts lists and require password resets for any users who appear on a list.
• Require periodic password resets for all users.
• Enable CAPTCHAs. Yes, they can be bypassed, but they at least put a hurdle in hackers’ way. Project management site Basecamp recently used a CAPTCHA to halt a credential stuffing attack.
• Continuously monitor your systems for warning signs and mitigation of possible credential stuffing activity and other cyber abuse.
• Consult with a reputable cybersecurity firm, such as Lazarus Alliance, regarding implementing JavaScript restrictions and other specific technical controls.

The cybersecurity experts at Lazarus Alliance have deep knowledge of the cybersecurity field, are continually monitoring the latest information security threats, and are committed to protecting organizations of all sizes from security breaches. Our full-service risk assessment services and Continuum GRC RegTech software will help protect your organization from data breaches, ransomware attacks, and other cyber threats.

Lazarus Alliance is proactive cybersecurity®. Call 1-888-896-7580 to discuss your organization’s cybersecurity needs and find out how we can help your organization adhere to cybersecurity regulations, maintain compliance, and secure your systems.

GandCrab has infected a slew of companies by targeting their MSP’s

Third-party vendor hacks, where hackers attack a company by compromising one of their business associates, have been a problem for a while. Now, the hackers behind GandCrab ransomware have gotten into the act, exploiting a year-old SQL injection vulnerability in a common remote IT support software solution to infect organizations with GandCrab through their MSP’s. ZDNet reports:

The vulnerability used by the hackers impacts the Kaseya plugin for the ConnectWise Manage software, a professional services automation (PSA) product used by IT support firms.

The Kaseya VSA plugin allows companies to link data from the Kaseya VSA remote monitoring and management solution to a ConnectWise dashboard.

Many small IT firms and other types of managed service providers (MSPs) use the two applications to centralize data from their clients and manage customer workstations from a remote central location.

Kaseya issued a patch for the vulnerability shortly after it was discovered in late 2017, but apparently, some MSP’s never installed it. Notably, the number of MSP’s who had not updated as of January 2019, when GandCrab hackers began exploiting the flaw, was relatively small in light of the popularity of the app; Kaseya reported that fewer than 130 MSP’s out of thousands were impacted. However, the first reported victim was allegedly a “local mid-sized MSP with about 80 clients,” all of whom were infected. If we were to assume that all of the impacted MSP’s had about the same number of clients, it’s easy to see the potential of this attack method to rapidly infect hundreds, perhaps thousands of new victims.

This particular incident illustrates how important it is for organizations to stay on top of software updates, as they frequently contain security patches. However, prompt software updates alone won’t inoculate against all cyber threats, and particularly not GandCrab.

GandCrab is the ransomware that keeps evolving

Cyber security is a continual game of Spy vs. Spy; the moment one vulnerability is shored up, hackers find a new one to exploit. GandCrab is the poster child for this dynamic cyber threat environment. GandCrab first emerged about a year ago and has dominated the infosec news cycle since, primarily because the hackers behind it are continually enhancing and refining it.

In addition to exploiting multiple software vulnerabilities, GandCrab has spread through JBoss and WebLogic server flaws, malicious emails, malvertising, by disguising itself as legitimate software or a cracked utility, and brute-force password-cracking attacks. GandCrab even took advantage of Valentine’s Day last week, sending out “love letters” that weren’t so loving.

Once infected, it’s notoriously difficult to rid machines of GandCrab. Bitdefender released a free decrypter for GandCrab last October, but it doesn’t work with the latest versions, starting with GandCrab 5.0.4. Some organizations turn to data recovery firms, but this can backfire. GandCrab is distributed using a ransomware-as-a-service (RaaS) model – with a twist. In addition to partnering with other hackers, GandCrab offers “discount codes” to unscrupulous data recovery firms. Here’s how the scheme works:

1. Instead of paying the ransom, an organization infected with GandCrab hires a dishonest data recovery firm to recover its files.
2. The data recovery firm logs onto its GandCrab portal, enters a special code, and pays a discounted ransom to retrieve the victim’s files.
3. The data recovery firm returns the files to the victim and charges a significant markup for their “services.” The victim ends up paying more than if they’d simply paid the ransom themselves.

Protect yourself against GandCrab

Proactive cybersecurity measures can prevent GandCrab infections and other cyber attacks. In addition to ensuring that your organization employs robust cybersecurity defenses, protocols, and procedures, vet the cybersecurity posture of your third-party business partners. Back up all of your systems and data so that you can restore them after a ransomware infection, another cyber attack, or a natural disaster. If you enlist the services of a data recovery firm, ask for references, do a web search on the company’s name to look for complaints, and make sure they explain how they intend to recover your data.

The cybersecurity experts at Lazarus Alliance have deep knowledge of the cybersecurity field, are continually monitoring the latest information security threats, and are committed to protecting organizations of all sizes from security breaches. Our full-service risk assessment services and Continuum GRC RegTech software will help protect your organization from data breaches, ransomware attacks, and other cyber threats.

Lazarus Alliance is proactive cybersecurity®. Call 1-888-896-7580 to discuss your organization’s cybersecurity needs and find out how we can help your organization adhere to cybersecurity regulations, maintain compliance, and secure your systems.