Combatting Ransomware: A Comprehensive Recommendation

 Will this be sufficient to address the problem and likely variants of the ploy that re likely to arise? 

RTF Report: Combatting Ransomware

A Comprehensive Framework for Action: Key Recommendations from the Ransomware Task Force

Ransomware is no longer just a financial crime; it is an urgent national security risk that threatens schools, hospitals, businesses, and governments across the globe.

This is not a problem that any one entity can solve. Over 60 experts from industry, government, law enforcement, civil society, and international organizations worked together to produce this comprehensive framework, which breaks down siloed approaches and advocates for a unified, aggressive, comprehensive, public-private anti-ransomware campaign. These recommendations are informed by a deep bench of experts and are immediately actionable, together forming a framework to reduce this criminal enterprise.

It will take nothing less than our total collective effort to mitigate the ransomware scourge. Read the report now to learn our path forwards.

DOWNLOAD THE REPORT  81 pages. ... 

Updated 4/30. On page 45, “Global Resilience Institute” has been corrected to “Global Resilience Federation.

We felt an urgent need to bring together world-class experts across all relevant sectors to create a ransomware framework that government and industry can pursue, and ensure the continued faith of the general public in its institutions.

Philip Reiner, IST CEO and Executive Director of the RTF

THANK YOU: This report is the result of an immense collective effort by the RTF Members, and we at IST are proud to have convened such an incredible group of experts. We sincerely thank the RTF members, who volunteered immense time and care to this effort, whose lively discussions and deep expertise led to these recommendations, and who dedicate themselves each day towards making the ransomware problem better.

Priority Recommendations

The RTF report includes 48 recommendations that together form a comprehensive framework to address ransomware. Among those, these priority recommendations are the most foundational and urgent, and many of the other recommendations were developed to facilitate or strengthen these core actions.  ... " 

Remote Access Cautions

 Good more balanced view of the recent SCADA threat in infrastructure.  Remote access is a classic potential security weakness.    Have myself been involved in the need to monitor and control industrial systems remotely   The failure was not including several elements in the remote connection.    Fix that now, early warnings are good.  Good points made here: 

Increased uptime? Check. Better access to outside expertise? Check. Improved first-time-fix rate? Check. in Tripwire

These are just some of the benefits of industrial remote access. Yet many customers are reluctant to embrace remote access. Not only that, but incidents such as the breach at the Oldsmar water utility might increase organizations’ reluctance to use remote access.

Using Oldsmar as an Example

The benefits of remote access should not be in dispute. So rather than making remote access the scapegoat, let’s consider the incident at Oldsmar water utility briefly.

It has been established that the nefarious actor was able to access the SCADA system via TeamViewer. The details of how they were able to gain access via TeamViewer is still unknown.

So, based on this information, TeamViewer is the villain, correct?

The answer is not binary. TeamViewer serves a legitimate purpose if used correctly. In this instance, to understand if TeamViewer was the right tool, let’s consider the application more closely.

As a water authority, the Oldsmar plant’s main KPI is to keep the plant operational 24/7 because we all want safe and clean drinking water when we start the tap! This means minimal downtime, timely notifications of any alarms and the ability to diagnose faults promptly. Remote access is an essential tool to achieve this objective. The remote user does not need access to the utility’s IT network to keep the plant operational. And, this is the key – IT and OT’s remote access needs are different .... " 

US Infrastructure Attack

Broadly reported last week.  Was later pointed out that such local systems are universally poorly funded and protected.  And this is unlikely to be improved given the current business models of such systems.

A relatively rare SCADA attack on infrastructure occurs in the US.  By allowed remote access.  

Poor Password Security Led to Recent Water Treatment Facility Hack

By The Hacker News, February 11, 2021

New details emerging about the remote computer intrusion at a Florida water treatment facility last week highlight a lack of adequate security measures to protect critical infrastructure environments.

New details have emerged about the remote computer intrusion at a Florida water treatment facility last Friday, highlighting a lack of adequate security measures needed to bulletproof critical infrastructure environments.

The breach, which occurred last Friday, involved an unsuccessful attempt on the part of an adversary to increase sodium hydroxide dosage in the water supply to dangerous levels by remotely accessing the SCADA system at the water treatment plant. The system's plant operator, who spotted the intrusion, quickly took steps to reverse the command, leading to minimal impact.

Now, according to an advisory published on Wednesday by the state of Massachusetts, unidentified cyber actors accessed the supervisory control and data acquisition (SCADA) system via TeamViewer software installed on one of the plant's several computers that were connected to the control system.

From The Hacker News 

New Zoom Abuse: TurkeyBombing

In the sense that your guard may be down to phishing when you are casually involved in video communication with family and friends.

TurkeyBombing Puts New Twist on Zoom Abuse   In Threatpost

Threat actors already stole nearly 4,000 credentials before the holiday was even over, according to report.

Millions of family and friends, forced to spend Thanksgiving socially distant, are being targeted by cybercriminals as they turn to video platforms like Zoom to virtually be together. In this ongoing attack, cybersecurity experts warn, victims are targeted with a Zoom-related and Thanksgiving-specific hook reminiscent to ZoomBoming — call it TurkeyBombing.

On Thursday, a security researcher warned that a major phishing campaign kicked off over the Thanksgiving long weekend and is aimed at stealing Microsoft credentials. Attackers have already successfully pried credentials out of thousands of users, according to the researcher who goes by the handle TheAnalyst.  According to the researcher, quoted in a BleepingComputer report, the attack is ongoing and forecast to continue. ... " 

Security of The Form and Parameters of Neural Nets.

Out of Cornell University an intriguing article that deals with how neural nets react to adversarial attacks in their energy consumption.   As predicted by simulation.   Akin to how you might test a system by giving it questions that you know would take time for a human to do, but are easy for machines.  Doing this repeatedly could reveal indications to the form and parameters of the network involved. Which contains the 'knowledge' involved.  Threats continue to get very innovative.

Sponge Examples: Energy-Latency Attacks on Neural Networks

By Ilia Shumailov, Yiren Zhao, Daniel Bates, Nicolas Papernot, Robert Mullins, Ross Anderson

The high energy costs of neural network training and inference led to the use of acceleration hardware such as GPUs and TPUs. While this enabled us to train large-scale neural networks in datacenters and deploy them on edge devices, the focus so far is on average-case performance. In this work, we introduce a novel threat vector against neural networks whose energy consumption or decision latency are critical. We show how adversaries can exploit carefully crafted sponge examples, which are inputs designed to maximise energy consumption and latency.

We mount two variants of this attack on established vision and language models, increasing energy consumption by a factor of 10 to 200. Our attacks can also be used to delay decisions where a network has critical real-time performance, such as in perception for autonomous vehicles. We demonstrate the portability of our malicious inputs across CPUs and a variety of hardware accelerator chips including GPUs, and an ASIC simulator. We conclude by proposing a defense strategy which mitigates our attack by shifting the analysis of energy consumption in hardware from an average-case to a worst-case perspective.  ... "

Also being discussed at Schneier, where there is some interesting comment going on.

Pay Up or We Leak Your Data

Not very unexpected. But a means to make smaller groups take notice, to create more incentive to respond with blackmail payments more quickly.   And can create an ongoing rather than one-off threat.   Probably also increase demand amounts via leveraged publicity.

Ransomware: Cybercriminals are adding a new twist to their demands
Pay the ransom or we'll leak your data is the latest trend, warns cybersecurity company.  .... "

By Liam Tung in ZDNet

Intelligence Cards

Had not heard of the term in particular.  We repeat that Recorded Future has been acquired by Insight Partners.

Recorded Future Has Over 1 Billion Intelligence Cards  in the RF Blog:   By Zane Pokorny 

Recorded Future’s database now includes over one billion Intelligence Cards.
But how many is a billion, really?

Well, one billion seconds is 31.7 years. That means that if you wanted to look at every Intelligence Card, even if you only glanced at each card for one second (24 hours a day), it would take you nearly 32 years to finish. That’s one of the big troubles with getting the cybersecurity information you need these days — there’s just so much of it.

A Problem of Too Much Information

Let’s take alerting as an example. Many analysts in a typical security operations center (SOC) will see upwards of hundreds of alerts every day, and each alert can take minutes — or hours, depending on how far down the rabbit hole of security blogs and forums they want to go — to research and evaluate manually. It’s no wonder why some 44% of alerts are not investigated at all, and why only around half of the remaining 56% are resolved. There’s just not enough time to look at each one.

But even if you did have the time, the most diligent research is still unlikely to be comprehensive, mainly because the threat landscape changes so rapidly and there’s so many disparate sources to mine for information. New vulnerabilities and exploits targeting them are uncovered every day, and they’re taken advantage of by threat actors that change their names and tactics almost as frequently, in some cases. Discussions happen in public security forums and blogs, but also across social media platforms and in hard-to-access spaces like marketplaces on the dark web and behind the paywalls of more technical resources.

As illustrated above, the exact thing that nobody wants to do is read a billion of anything to get the answer they’re looking for — or a million, or even a hundred, when they have to do that research dozens of times daily. What’s needed is a filter.

Intelligence Cards Are Threat Intelligence in One Place:

Recorded Future Intelligence Cards are exactly that filter. They bundle real-time threat intelligence on any security topic, like technical indicators, malware families, vulnerabilities, threat actors, or companies, into a single view. This unifies thousands of data points into a single place, dramatically increasing the speed and efficiency of threat research and analysis. ....

Intelligence Cards
Manually collecting and analyzing data from disparate sources is a major burden for security teams. Recorded Future consolidates massive amounts of real-time intelligence from the widest breadth of sources into a concise view of available threat intelligence. .... "

Recorded Future Bought by Insight Partners

Recorded Future is a company we worked with in its early years, and reported here about them since then.  Good company.  Their recent movement towards 'threat intelligence' analysis is of interest.

The security acquisitions continue: Insight Partners buys Recorded Future for $780M   By Maria Deutscher in SiliconAngle

Insight Partners does most of its investing through growth-stage funding rounds, but the venture capital giant occasionally makes bigger bets as well. The firm today announced that it has acquired threat intelligence startup Recorded Future Inc. for a hefty $780 million.

The transaction is the third nine-figure acquisition that the cybersecurity industry has seen this week. On Wednesday, Palo Alto Networks Inc. bought container protection specialist Twistlock Inc. for $410 million along with a second, smaller startup called PureSec. A day earlier, FireEye Inc. picked up network monitoring provider Verodin Inc. in a $250 million deal.  ... " 

Threat Intelligence Handbook

I continue to follow the work of Recorded Future.   They have updated their new handbook in an interesting way.  Links to a favorite topic:  Risk analysis

A Closer Look at 'The Threat Intelligence Handbook' (Infographic)    By Chris Pace,  Recorded Future.

Faster and more accurately, avoiding countless hours manually sorting through data feeds and instead developing more accurate and insightful reports. But the way you leverage threat intelligence depends on your role. Threat intelligence isn’t just streams of data feeds that only expert analysts working in a security operations center will benefit from — teams that work in vulnerability management, risk analysis, fraud prevention, and security leadership positions will all find their lives made easier with threat intelligence.   ... "

Cameras Detecting Emotions and Implying Threat

Good piece in the BBC on detecting emotions and implying threat.    Background and current state.  Here again an algorithm will deliver a likelihood level of threat   So accuracy implications.  Privacy of emotions.  Risk of false positives.  Very likely this will be broadly implemented in a world of greater dangers. 

The cameras that know if you're happy - or a threat  By Daniel Thomas in the BBC

Facial recognition tech is becoming more sophisticated, with some firms claiming it can even read our emotions and detect suspicious behaviour. But what implications does this have for privacy and civil liberties?

Facial recognition tech has been around for decades, but it has been progressing in leaps and bounds in recent years due to advances in computing vision and artificial intelligence (AI), tech experts say.

It is now being used to identify people at borders, unlock smart phones, spot criminals, and authenticate banking transactions.

But some tech firms are claiming it can also assess our emotional state.

Since the 1970s, psychologists say they have been able to detect hidden emotions by studying the "micro expressions" on someone's face in photographs and video .... " 

Keeping Intelligence Fresh

From Recorded Future, Podcast of interest. 

How to Keep Finished Intelligence Fresh     By Amanda McKeon  

Our guest today is Storm Swendsboe. He’s an analyst services manager at Recorded Future, leading a team of intelligence analysts providing on-demand reports for their customers. In our conversation he explains the different types of reports his team provides, with a focus on finished intelligence. Swendsboe answers questions like, where does finished intelligence fit into an organization’s threat intelligence strategy, how it can be customized for specific audiences, and how to make sure a report doesn’t quickly become out of date the moment it’s published. ... " 

Threat Intelligence

Did some work with Recorded Future, an impressive group.

How to Empower Teams With Threat Intelligence   By Amanda McKeon 

In this episode of the Recorded Future podcast, we examine how threat intelligence applies to a variety of roles within an organization, and how security professionals can integrate it to empower their team to operate with greater speed and efficiency. How does threat intelligence apply to SOCs, to incident response, or vulnerability management? And how do corporate leaders make the case that threat intelligence is a worthwhile investment?

Joining us to address these questions is Chris Pace, technology advocate at Recorded Future.

Alliance for Intelligence Driven Security

We connected with Recorded Future at an early stage.  Good to see their continued work.

Recorded Future Connect Xchange: Alliance for Intelligence-Driven Security

Integrations to Expand Impact of Traditional Security Operations, Incident Response, Security Orchestration and Automation, and Vulnerability Management Solutions With External Threat Intelligence

SAN FRANCISCO, April 16, 2018 /PRNewswire/ -- RSA CONFERENCE – Recorded Future, the leading threat intelligence provider, today announced Recorded Future Connect Xchange, a global technology partner community designed with one goal in mind: help security teams by enhancing their deployed tools through rich threat intelligence from outside their organization.

Connect Xchange partners will work together to increase accessibility to threat intelligence, allowing security professionals to proactively map applicable threats to their organization, and add dynamic, real-time intelligence to traditionally static security functions. Inaugural partners include: Brinqa, Cofense (formerly known as PhishMe), DFLabs, DomainTools, EclecticIQ, Farsight Security, IBM QRadar, IBM Resilient, LogRhythm, Palo Alto Networks, ProtectWise, ReversingLabs, Tenable®, ThreatConnect, and Versive.  ....

"Determining a security strategy without applying the lens of threat intelligence is akin to gauging the difficulty and danger of a hike based on what you can see from the trailhead. You know it's a mountain and the plan is to get to the top, but you don't know what predators are native to the region, how challenging the trail is, and so on. Understanding what's happening outside your organization, and applying that intelligence to your existing security solutions, is the only way to stand a fighting chance against today's attackers." 

— Dr. Christopher Ahlberg, CEO and Co-Founder of Recorded Future. .... "