UK Paper Hit by Ransomware

Ransomware hitting many kinds of targets.  First I had seen of anewspaper. 

Guardian newspaper hit by suspected ransomware attack

Published, 21 December 2022, By Tom Singleton, Technology team in the BBC

The Guardian newspaper has come under a suspected ransomware attack.

It said there had been a "serious incident" affecting its IT systems in the last 24 hours, with disruption to "behind the scenes services".  The company said it was continuing to publish globally to its website - one of the most visited news sites in the world - and was "confident" it could still print the physical paper.

Staff have been told not to go into the office and to work from home.

In a statement, the Guardian said: "Our technology teams have been working to deal with all aspects of this incident, with the vast majority of our staff able to work from home as we did during the pandemic.

"We believe this to be a ransomware attack, but are continuing to consider all possibilities."  Ransomware is malicious software used by hackers - and often sent via attachments in emails - to gain access to an organisation's or individual's computer systems.

The criminals then find and encrypt important or sensitive files - and demand a ransom for them to be unlocked.  ... ' 

Encountered and Reported Security Issues in MS Office

In the most recent  ' Security Now  'Podcast #893'  by Steve Gibson, he discussed  the fact that Microsoft  has chosen not to fix a well understood security vulnerability currently in their OME (Office Method Encryption), that has existed for years,  a commonly used system, which claims to have a means to encrypt text in  Office, say before sending it or storing it.  

BUT they use ECB  'Electronic Code book' as a 'secure' method, which is well known to leak information.  ECB is well known to be insecure.  Microsoft has refused to fix or patch the Windows Office method.  I have personally examined ECB in the past, and its problems are obvious and well known. Especially for cases like stolen or diverted data. (Ransomware?)   A major issue for assumed security in MS Office.

Much more here   https://www.grc.com/sn/SN-893-Notes.pdf 

More on ECB Here:  https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation#ECB 

Following, but please report any patching of this so I can inform followers. 

Hacker GoldRush: Business Mail Compromise better than Ransomware?

From Wired via ACM

Ransomware attacks, including those of the massively disruptive and dangerous variety, have proved difficult to combat comprehensively. Hospitals, government agencies, schools, and even critical infrastructure companies continue to face debilitating attacks and large ransom demands from hackers. But as governments around the world and law enforcement in the United States have grown serious about cracking down on ransomware and have started to make some progress, researchers are trying to stay a step ahead of attackers and anticipate where ransomware gangs may turn next if their main hustle becomes impractical.

At the RSA security conference in San Francisco on Monday, longtime digital scams researcher Crane Hassold will present findings that warn it would be logical for ransomware actors to eventually convert their operations to business email compromise (BEC) attacks as ransomware becomes less profitable or carries a higher risk for attackers. In the US, the Federal Bureau of Investigation has repeatedly found that total money stolen in BEC scams far exceeds that pilfered in ransomware attacks—though ransomware attacks can be more visible and cause more disruption and associated losses. 

In business email compromise, attackers infiltrate a legitimate corporate email account and use the access to send phony invoices or initiate contract payments that trick businesses into wiring money to criminals when they think they're just paying their bills.  ... '

From Wired  

View Full Article

Microsoft AI Spots Ransomware?

 Have not heard much of this elsewhere.

How Microsoft's AI spots ransomware attacks before they even get started   in ZDNet

Microsoft is targeting human-operated ransomware operations.

Written by Charlie Osborne, Contributor

Microsoft has revealed how artificial intelligence (AI) technologies are used in the fight against ransomware. 

Ransomware is one of today's most prolific and vicious digital threats. Ransomware families including Locky, WannaCry, NotPetya, and Cerber plague consumers and businesses alike, locking up infected systems and demanding payment in return for decryption keys, which may or may not return access to encrypted files. 

Cyber security 101: Protect your privacy from hackers, spies, and the government

Simple steps can make the difference between losing your online accounts or maintaining what is now a precious commodity: Your privacy.

Ransomware as a service (RaaS) is also now a standalone and popular criminal business. Operators can purchase access to ransomware for use in their campaigns, whether they are targeting the general public en masse or going after 'Big Game' enterprise companies. 

SEE: Ransomware attacks: This is the data that cyber criminals really want to steal

According to Microsoft's 365 Defender Research Team, human-operated ransomware campaigns are complex and multi-faceted, which can make early detection very difficult to achieve – especially as the campaigns continue to evolve.   ... ' 

Ransomware and Government

Was afraid of this ...

The Government's Still Mostly in the Dark on Ransomware

By The Washington Post, May 24, 2022

Senate Homeland Security Committee Chair Gary Peters released a report on the government's limited visibility into ransomware attacks.

The government is largely in the dark when it comes to the scale of ransomware attacks pummeling schools, local governments and businesses, a congressional report out this morning warns.

Government officials don't reliably know how many attacks there are, how badly those attacks are hurting victims or how much victims are paying to rid themselves of the malicious software that locks up their computers and data. That's the troubling assessment of a 10-month investigation by Democratic staffers on the Senate Homeland Security Committee.

From The Washington Post   

Faster Ransomware Detection

But is the method easily side-stepped?

New Approach for Faster Ransomware Detection

By NC State University News, May 18, 2022

Engineering researchers at North Carolina State University (NC State) and Hewlett Packard Enterprise have come up with a new technique that can detect ransomware faster than previous systems.

The Field-Programmable Gate Array-Accelerated XGBoost Inference for Data Centers using High-Level-Synthesis (FAXID) approach is a hardware-based implementation of the ransomware-detecting XGBoost algorithm.   The researchers found FAXID was up to 65.8 times faster than software running XGBoost on a central processing unit, and 5.3 times faster than graphic processing unit-based deployment.

NC State's Archit Gajjar said FAXID can allocate security hardware's computational muscle to separate problems. "For example, you could devote a certain percentage of the hardware to ransomware detection and another percentage of the hardware to another challenge—such as fraud detection," he explained. .... '

The researchers found the new approach was just as accurate as software-based approaches at detecting ransomware, and up to 65.8 times faster. ...'

From NC State University News

View Full Article   

Ransomware Goes Deeper into Government

Ransomware Rampant

Ransomware gang threatens to overthrow Costa Rica government

Ransomware gang threatens to overthrow Costa Rica governmentA ransomware gang that infiltrated some Costa Rican government computer systems has upped its threat, saying its goal is now to overthrow the government.

The Russian-speaking Conti gang attacked Costa Rica in April, accessing multiple critical systems in the Finance Ministry, including customs and tax collection. Other government systems were also affected and a month later not all are fully functioning.   President Rodrigo Chaves declared a state of emergency over the attack as soon as he was sworn in last week. The U.S. State Department offered a $10 million reward for information leading to the identification or location of Conti leaders.

Conti responded by writing, "We are determined to overthrow the government by means of a cyber attack, we have already shown you all the strength and power, you have introduced an emergency."

The gang also said it was raising the ransom demand to $20 million. It called on Costa Ricans to pressure their government to pay. .... ' 

Think of Ransomware as a Data Management Problem

As most things can be thought of.   Just reading work of Turing, Von Neumann et al, and their early work was all about how you effectively stored things and used them,  though its safety had not yet come up. 

Ransomware: Why It’s Time to Think of it as a Data Management Problem

Enrico Signoretti. Mar 23, 2022 -- Blog in  GigaOm

Over the last couple of years, ransomware has taken center stage in data protection, but very few people realize it is only the tip of the iceberg. Everybody wants to protect their data against this new threat, but most solutions available in the market focus just on relatively quick recovery (RTO) instead of detection, protection, and recovery. In fact, recovery should be your last resort.

Protection and detection are much more difficult measures to implement than air gaps, immutable backup snapshots, and rapid restore procedures. But when well-executed these two stages of ransomware defense open up a world of new opportunities. Over time, they will help defend your data against cybersecurity threats that now are less common, or better said, less visible in the news—such as data exfiltration or manipulation. And again, when I say less visible, it is not only because the incidents are not reported, it is because often nobody knows they happened until it’s too late!

Security and Data Silos

Now that data growth is taken for granted, one of the biggest challenges most organizations face is the proliferation of data silos. Unfortunately, new hybrid, multi-cloud, and edge infrastructures are not helping this. We are seeing what we might call a “data silo sprawl”–a multitude of hard-to-manage data infrastructure repositories that proliferate in different locations and with different access and security rules. And across these silos there are often rules that don’t always follow the company’s policies because the environments are different and we don’t have complete control over them.

As I have written many times in my reports, the user must find a way to consolidate all their data in a single domain. It could be physical—backup is the easiest way in this case—or logical, and it is also possible to use a combination of physical and logical. But in the end, the goal is to get a single view of all the data.

Why is it important? First of all, once you have complete visibility, you know how much data you really have. Secondly, you can start to understand what the data is, who is creating and using it, when they use it, and so on. Of course, this is only the first step, but, among other things, you start to see usage patterns as well. This is why you need consolidation: to gain full visibility.

Ransomware Gangs Helping Putin?

Conti Ransomware Gang Helping Putin?  Became more aware of software as a governmental weapon.  Some indications hints and here. 

Leaked Ransomware Docs Show Conti Helping Putin From the Shadows  By Wired, March 18, 2022

While evidence of Conti’s direct ties to the Russian government remains elusive, the gang’s activities continue to fall in line with Russian national interests.  ... 

For years, Russia's cybercrime groups have acted with relative impunity. The Kremlin and local law enforcement have largely turned a blind eye to disruptive ransomware attacks as long as they didn't target Russian companies. Despite direct pressure on Vladimir Putin to tackle ransomware groups, they're still intimately tied to Russia's interests. A recent leak from one of the most notorious such groups provides a glimpse into the nature of those ties—and just how tenuous they may be.

A cache of 60,000 leaked chat messages and files from the notorious Conti ransomware group provides glimpses of how the criminal gang is well connected within Russia. The documents, reviewed by WIRED and first published online at the end of February by an anonymous Ukrainian cybersecurity researcher who infiltrated the group, show how Conti operates on a daily basis and its crypto ambitions. They likely further reveal how Conti members have connections to the Federal Security Service (FSB) and an acute awareness of the operations of Russia's government-backed military hackers.

As the world was struggling to come to grips with the Covid-19 pandemic's outbreak and early waves in July 2020, cybercriminals around the world turned their attention to the health crisis. On July 16 of that year, the governments of the UK, US, and Canada publicly called out Russia's state-backed military hackers for trying to steal intellectual property related to the earliest vaccine candidates. The hacking group Cozy Bear, also known as Advanced Persistent Threat 29 (APT29), was attacking pharma businesses and universities using altered malware and known vulnerabilities, the three governments said.

From Wired   View Full Article 

Ransomware: Insurance Might Pay

And of course will foreign plays admit guilt for hostile actions?  And surely insurance premiums will increase. 

Via Schneier, with further comments:

The insurance company Ace American has to pay for the losses:

On 6th December 2021, the New Jersey Superior Court granted partial summary judgment (attached) in favour of Merck and International Indemnity, declaring that the War or Hostile Acts exclusion was inapplicable to the dispute.

Merck suffered US$1.4 billion in business interruption losses from the Notpetya cyber attack of 2017 which were claimed against “all risks” property re/insurance policies providing coverage for losses resulting from destruction or corruption of computer data and software. ...,, '

War on Ransomware

Good overview on govt efforts.

Winning the War on Ransomware

By The Verge,  December 10, 2021

(contains a number of good link references)

As long as there is a sustained effort against these somewhat decentralized and shifting crime gangs; this isnt just whack-a-mole, says Kurt Baumgartner, principal security researcher at Kaspersky.

In the past 10 years, ransomware has become inescapable. All kinds of institutions have been targeted, from the schools children go to, to fuel and medical infrastructure. A report from the U.S. Treasury estimates there were over half a billion dollars in ransomware payouts in the first half of 2021 alone. Law enforcement has struggled to get a handle on the situation, with many groups operating for years with no apparent fear of repercussions.

This year, federal law enforcement decided to try something new. In April, the Department of Justice created the Ransomware and Digital Extortion Task Force in a move to prioritize the "disruption, investigation, and prosecution of ransomware and digital extortion activity." The task force is supposed to help share information between DOJ departments, as well as work with outside and foreign agencies. In the months since, it's made some impressive prosecutions, but they're just a sliver of the overall — and the bigger picture remains maddeningly unclear.

One of the first publicized wins for the group came in June, when the Department of Justice said the group was handling the case of an individual alleged to be partially responsible for the malware suite known as Trickbot, which could help expose a system to a ransomware attack. Days after that announcement came an even bigger win: the DOJ announced it had seized back $2.3 million of the $4.4 million ransom paid by oil company Colonial Pipeline, and that the task force had coordinated the efforts. Then, in October, its biggest win yet — the arrests of a few alleged members of REvil, a hacking group, by European police forces, and the seizure of over $6 million in funds the department says were linked to ransomware payments.

Still, the sheer volume of attacks means a handful of prosecutions is unlikely to make a difference. Prosecutors need the threat of law enforcement action to scare criminals away from ransomware — and some experts say the scheme is still too lucrative for criminals to give up.

From The Verge

View Full Article

Windows Defender with Windows 10 (latest version) Test vs Ransomware.

Comments on the use of standard security tools for Ransomware

The PC Security Channel   162K subscribers

Windows Defender with Windows 10 (latest version) Test vs Ransomware. 

Contact us for business: https://www.thepcsecuritychannel.com/

Is Windows Defender good enough in 2021? Do you need an antivirus with Windows 10? This video will help you answer some of those questions. #windows #windowsdefender

https://www.thepcsecuritychannel.com/...

🔥 Want to join the community and participate? Join us on Discord. https://discord.com/invite/y7q3qMM

Russia Exluded from Ransomware Summit

Is it useful to do this?  Hard to say, but I think so, with the carrot being later involvement. 

Russia excluded from 30-country meeting to fight ransomware and cyber crime

By Nandita Bose,   Reuters

WASHINGTON, Oct 13 (Reuters) - Russia was not invited to attend a 30-country virtual meeting led by the United States that is aimed at combating the growing threat of ransomware and other cyber crime, a senior administration official said.

Many ransomware gangs operate from Ukraine and Russia, private sector cybersecurity experts say. Some U.S. officials and analysts have said Russian ransomware gangs operate with the Kremlin's tacit approval, but are not directly controlled by the government.

The meeting will be held over two days, involve six sessions and include topics such as addressing the misuse of virtual currency to launder ransom payments, prosecuting ransomware criminals, using diplomacy to counter ransomware, and helping nations become more resilient to such attacks, the administration official said.

Along with the United States, India, Australia, Germany and the United Kingdom will lead discussions on topics such as disruption, virtual currency and diplomacy. Others joining the meeting include Canada, France, the United Kingdom, Brazil, Mexico, Japan, Ukraine, Ireland, Israel, South Africa, the European Union.   ... '

Death Due to Ransomware?

Out of Schneier: 

The Wall Street Journal is reporting on a baby’s death at an Alabama hospital in 2019, which they argue was a direct result of the ransomware attack the hospital was undergoing. ... '

Discussion of where the negligence was, in part for allowing the malware intrusion?

Beware Food and Agriculture

 In ZDNet: 

FBI warns of ransomware attacks targeting food and agriculture sector  ... 

In addition to the May attack on JBS, the FBI listed dozens of ransomware incidents that have taken place over the last six months targeting the food sector.

By Jonathan Greig    ... 

Thwarting Ransomware

Would have thought this is where you could unusual activity?   is it enough?    There will be challenges from both sides.

Your SSD may soon be able to detect ransomware attacks  By Mayank Sharma  in TechRadar

Best of all, the additional functionality comes with only a minor increase in latency

Academic researchers have conjured up a novel idea to thwart ransomware attacks using firmware that can block write access to solid-state disks (SSD) as soon as it detects patterns matching such an attack.

The idea about the intelligent firmware, dubbed SSD-Insider++, has been proposed by a team of researchers that includes engineers from Korea’s Inha University, Daegu Institute of Science and Technology, and the Cyber Security Department at Ewha Womans University (EWU) as well as a researcher from the University of Central Florida in the US.

“I thought that it would be good if we can protect people not having anti-ransomware installed on their computers by providing them with an anti-ransomware-intrinsic SSD,” DaeHun Nyang, PhD, at EWU told The Register.  ... " 

Hospital Security Bug

 Seems a considerable issue, with broad ransomware target.  How many other targets like this exist? 

Security Bug Affects Nearly All Hospitals in North America

TechRadar, Anthony Spadafora, August 2, 2021

Researchers at security firm Armis identified nine critical vulnerabilities in the Nexus Control Panel that powers all current models of Swisslog Healthcare's Translogic pneumatic tube system (PTS) stations. The Translogic PTS system is used in 3,000 hospitals worldwide and 80% of major hospitals in North America to deliver medications, blood products, and lab samples across multiple hospital departments. Hackers can exploit the vulnerabilities, dubbed PwnedPiper, to gain control over a hospital's pneumatic tube network, with the potential to launch ransomware attacks. Armis' Ben Seri said his firm had told Swisslog of the vulnerabilities at the beginning of May, “and has been working with the manufacturer to test the available patch and ensure proper security measures will be provided to customers."

Full Article

Protect Against BlackMatter Ransomware Before It’s Offered

 Somewhat unclear the breadth of what is being offered, but interesting. 

Protect Against BlackMatter Ransomware Before It’s Offered

Insikt Group

Editor’s Note: The following post is an excerpt of a full report. To read the entire analysis, click here to download the report as a PDF. 

Insikt Group reverse-engineered the Linux and Windows variants of BlackMatter ransomware and provided a high-level overview of the functionality in addition to IOCs, utilities, and detections. The intended audience of this research is threat intelligence professionals and those interested in a technical overview of the new ransomware variant.

Executive Summary

Insikt Group analyzed Windows and Linux variants of BlackMatter ransomware, a new ransomware-as-a-service (RaaS) affiliate program founded in July 2021. During our technical analysis, we found that both variants accomplish similar goals of encrypting a victim’s files and appear to have been developed by a relatively sophisticated group. The Windows version of the ransomware employs several obfuscation and anti-reverse engineering techniques, suggesting that it was created by an experienced ransomware developer. BlackMatter’s Linux variant is another example of an emerging trend of malware targeting Linux-based systems, including ESXi and network-attached storage (NAS) devices. Recorded Future has provided reverse-engineering utilities, a YARA rule, and IOCs that organizations can use to hunt or detect the ransomware.

Editor’s Note: This post was an excerpt of a full report. To read the entire analysis, click here to download the report as a PDF.  https://go.recordedfuture.com/hubfs/reports/MTP-2021-0804.pdf

Blackmatter Interview

 I see that the Podcast 'Security Now' has now published the 'Blackmatter' interview with the Recorded Future company.   We did some work with Recorded Future at the enterprise. The interview, I think is revealing regarding ransomware approaches and future.  See: 

https://twit.tv/shows/security-now/episodes/830?autostart=false    (Contains interview script) 

SECURITY NOW 830:  THE BLACKMATTER INTERVIEW

Hosted by Steve Gibson, Leo Laporte:  Bad News for Firefox, DarkSide Returns, Tailscale, Google to Assume HTTPS

Records live every Tuesday at 4:30pm Eastern / 1:30pm Pacific / 20:30 UTC.

Benefits of Ransomware

Makes the usual case, we have been alerted. 

Could Ransomware Attacks Ultimately Benefit Consumers?   in HBR by Rahul Telang

Summary.   

In the past year alone, ransomware attackers have collected hundreds of millions of dollars from the companies they’ve attacked, and companies are realizing that these attacks represent a greater threat to them than traditional data breaches. Why? Because in traditional attacks, hackers ultimately harm consumers, not companies. But ransomware attacks hurt companies directly—which means they’re finally going to feel the need to get more serious about cybersecurity. The author offers a few recommendations for how to get started  ... '