IoT and Cyber Security

[Washpark 176]

 

 

Non-CR thread.

A complete cluster and surprised it hasn't more media attention. Not surprising and quickly will become a bigger issue for city, states, and national governments. Challenge is local governments don't have the resources to really stop these attacks or will have to outsource it all to major providers (e.g. AWS).

https://www.nytimes.com/2018/03/27/us/cyberattack-atlanta-ransomware.html

Quote

ATLANTA — The City of Atlanta’s 8,000 employees got the word on Tuesday that they had been waiting for: It was O.K. to turn their computers on.

But as the city government’s desktops, hard drives and printers flickered back to life for the first time in five days, residents still could not pay their traffic tickets or water bills online, or report potholes or graffiti on a city website. Travelers at the world’s busiest airport still could not use the free Wi-Fi.

Atlanta’s municipal government has been brought to its knees since Thursday morning by a ransomware attack — one of the most sustained and consequential cyberattacks ever mounted against a major American city.

The digital extortion aimed at Atlanta, which security experts have linked to a shadowy hacking crew known for its careful selection of targets, laid bare once again the vulnerabilities of governments as they rely on computer networks for day-to-day operations. In a ransomware attack, malicious software cripples a victim’s computer or network and blocks access to important data until a ransom is paid to unlock it.

“We are dealing with a hostage situation,” Mayor Keisha Lance Bottoms said this week.

The assault on Atlanta, the core of a metropolitan area of about 6 million people, represented a serious escalation from other recent cyberattacks on American cities, like one last year in Dallas where hackers gained the ability to set off tornado sirens in the middle of the night.

Part of what makes the attack on Atlanta so pernicious are the criminals behind it: A group that locks up its victims’ files with encryption, temporarily changes their file names to “I’m sorry” and gives the victims a week to pay up before the files are made permanently inaccessible.

Threat researchers at Dell SecureWorks, the Atlanta-based security firm helping the city respond to the ransomware attack, identified the assailants as the SamSam hacking crew, one of the more prevalent and meticulous of the dozens of active ransomware attack groups. The SamSam group is known for choosing targets that are the most likely to accede to its high ransom demands — typically the Bitcoin equivalent of about $50,000 — and for finding and locking up the victims’ most valuable data.

In Atlanta, where officials said the ransom demand amounted to about $51,000, the group left parts of the city’s network tied in knots. Some major systems were not affected, including those for 911 calls and control of wastewater treatment. But other arms of city government have been scrambled for days.

The Atlanta Municipal Court has been unable to validate warrants. Police officers have been writing reports by hand. The city has stopped taking employment applications.

Rest of article in spoiler.

 

Atlanta officials have disclosed few details about the episode or how it happened. They have urged vigilance and tried to reassure employees and residents that their personal information was not believed to have been compromised.

Dell SecureWorks and Cisco Security, which are still working to restore the city’s systems, declined to comment on the attacks, citing client confidentiality.

Ms. Bottoms, the mayor, has not said whether the city would pay the ransom.

The SamSam group has been one of the more successful ransomware rings, experts said. It is believed to have extorted more than $1 million from some 30 target organizations in 2018 alone.

It is not ideal to pay up, but in most cases, SamSam’s victims have said that they can more easily afford the $50,000 or so in ransom than the time and cost of restoring their locked data and compromised systems. In the past year, the group has taken to attacking hospitals, police departments and universities — targets with money but without the luxury of going off-line for days or weeks for restoration work.

Investigators are not certain who the SamSam hackers are. Judging from the poor English in the group’s ransom notes, security researchers believe they are probably not native English speakers. But they cannot say for sure whether SamSam is a single group of cybercriminals or a loose hacking collective.

Ransomware emerged in Eastern Europe in 2009, when cybercriminals started using malicious code to lock up unsuspecting users’ machines and then demanding 100 euros or similar sums to unlock them again. Over the past decade, dozens of online cybercriminal outfits — and even some nation states, including North Korea and Russia — have taken up similar tactics on a larger scale, inflicting digital paralysis on victims and demanding increasing amounts of money.

Cybersecurity experts estimate that criminals made more than $1 billion from ransomware in 2016, according to the F.B.I. Then, last May, came the largest ransomware assault recorded so far: North Korean hackers went after tens of thousands of victims in more than 70 countries around the world, forcing Britain’s public health system to reject patients, paralyzing computers at Russia’s Interior Ministry, at FedEx in the United States, and at shipping lines and telecommunications companies across Europe.

A month later, Russian state hackers deployed similar ransomware to paralyze computers in Ukraine on the eve of the country’s independence day. That attack shut down automated teller machines in Kiev, froze government agencies and even forced workers at the Chernobyl nuclear power plant to monitor radiation levels manually. Collateral damage from that attack affected computers at Maersk, the Danish shipping conglomerate; at Merck, the American-based pharmaceutical giant; and even at businesses in Russia.

Attempted ransomware attacks against local governments in the United States have become unnervingly common. A 2016 survey of chief information officers for jurisdictions across the country found that obtaining ransom was the most common purpose of cyberattacks on a city or county government, accounting for nearly one-third of all attacks.

The survey, conducted by the International City/County Management Association and the University of Maryland, Baltimore County, also found that about one-quarter of local governments reported that they were experiencing attacks of one kind or another, successful or not, at least as often as once an hour.

Yet less than half of the local governments surveyed said they had developed a formal cybersecurity policy, and only 34 percent said they had a written strategy to recover from breaches.

Experts said government officials needed to be more aggressive about preventive measures, like training employees to spot and sidestep “phishing” attempts meant to trick them into opening the digital door for ransomware.

“It’s going to be even more important that local governments look for the no-cost/low-cost, but start considering cybersecurity on the same level as public safety,” said David Jordan, the chief information security officer for Arlington County, Va. “A smart local government will have fire, police and cybersecurity at the same level.”

Ms. Bottoms, who took office as mayor of Atlanta in January, acknowledged that shoring up the city’s digital defenses had not been a high priority before, but that now “it certainly has gone to the front of the line.”

“As elected officials, it’s often quite easy for us to focus on the things that people see, because at the end of the day, our residents are our customers,” Ms. Bottoms said. “But we have to really make sure that we continue to focus on the things that people can’t see, and digital infrastructure is very important.”

During the ransomware attack, local leaders have sometimes been able to do little but chuckle at a predicament that was forcing the city to turn the clock back decades.

Asked on Monday how long the city might be able to get by doing its business strictly with ink and paper, Ms. Bottoms replied: “It was a sustainable model until we got computer systems. It worked for many years. And for some of our younger employees, it will be a nice exercise in good penmanship.”

Security researchers trying to combat ransomware have noticed a pattern in SamSam’s attacks this year: Some of the biggest have occurred around the 20th of the month.

Allan Liska, a senior intelligence analyst at Recorded Future who has been tracking the group, said in an interview that he believed that SamSam gains access to its victims’ systems and then waits for weeks before encrypting the victim’s data. That delay, Mr. Liska said, makes it harder for responders to figure out how the group was able to break in — and easier for SamSam’s hackers to strike twice.

The Colorado Department of Transportation was able to restore its systems on its own after a SamSam attack, without paying SamSam a dime. But a week later, the hackers struck the department again, with new, more potent ransomware.

“They are constantly learning from their mistakes, modifying their code and then launching the next round of attacks,” Mr. Liska said.

 

Edited March 28, 2018 by Washpark

[Doc Holliday 199]

This type of attack is not going to stop.

For years, I've said anything with a 1 & 0 can be hacked.  Then it came true, granted, I had some insider knowledge about Intel/AMD chips.  Until we recognize that in a digital/computerized world, security needs to come first, second, and last, with application functionality in the middle we will always remain vulnerable. 

Even then, creative minds will find a way to hack anything with a 1 & 0.

For a major city to be hacked it should get more publicity and be a warning sign for others to ensure they make it as hard as possible to gain entry.  

Lastly, humans are mostly oblivious and trusting when it comes to social engineering and are the weakest link in most cases.  Doesn't matter if you have a 14 character, upper case, lower case, number and special character with no dictionary words in your password.  If you give away the right information or provide access to the right hacker, you're fubar.

[Handcruser 2814]

What is AWS going to do?  Their security posture is not very good.  Don’t rely on providers to secure your assets.  

Doc and I worked together for a short time in the security world.  Almost everyone does most of it wrong    

 

[Doc Holliday 199]

AWS, Google, and Microsoft, plus throw in all the other cloud providers out there and it doesn't matter.  They can provide some security features and they are exempt from responsibility if your application has a flaw, or your routing protocols, or your firewall applications.  It's all the same for IaaS, PaaS, and SaaS. 

Take responsibility for your own environment and make it as hard as possible to gain entry. 

Current place I am working at, we are working through some early 2000's type architecture and reworking everything from perimeter, network segmentations, and more.  Plus, before we move to Azure and even turn on one website I am making sure it's been tested and as secure as we can possibly make it. 

[next2naus 439]

These types of attack’s are easily preventable. A good Systems/Config Mgmt tool and a good data security / Crypto tool stops it all. The problem is that money is more easily spent on perimeter tools (which don’t solve this) and SEIM tools which are Post Mortems. 

 

I’m not sure how IoT factors in here short of most IoT systems are easily compromised. You can protect these easily enough as well with secure “birth” certificates and data Crypto as well but the folks who offer these devices tend to care little about security. 

 

Whats interesting is in autos. Ford is now offering a IoT Service that does things such as remote start via smart phone and if you watch the ads you will see that they got wide and partnered up with the likes of Dell/EMC, RSA, some MFA vendor and couple other security players 

[F250 29175]

2 hours ago, Handcruser said:

What is AWS going to do?  Their security posture is not very good.  Don’t rely on providers to secure your assets.  

Doc and I worked together for a short time in the security world.  Almost everyone does most of it wrong    

 

The big cloud providers will have have a higher maturity level of security than a lot of city governments. I've read some of the issues that Atlanta had and I think it shows an extreme case of incompetence. They had firewall rules in place that allowed ingressing SMB and RDP traffic to publicly facing (unpatched) Windows servers. The Windows servers were not on a DMZ. Their network appears to be flat which was how the malware jumped from their desktops to the server environment. Its come out that the City of Atlanta had compromised servers and an exposed network for over a year. Apparently they were notified in the Spring of 2017 but did nothing.

Migrating to the cloud isn't a panacea for security problems but in some cases it's a much better alternative than running an extremely shitty in house  security program.

[GSU&UT 1799]

We live outside Atlanta city limits, but the whole state has just an awful amount of old tech systems. I don't know if you can even state this is a new IoT security problem, more likely there are lots of servers and computers that are extremely outdated and are vulnerable to a number of hacks. @F250 also pointed out that the city was audited and were made aware of these issues and did very little to address them (the whole god damn state has done crap like this recently).

 

I haven't messed with IoT stuff on AWS much, but I've been in a couple of talks and, to me, it seems like they've done a pretty thorough job with security. You have to manage certificates for these devices if you want to integrate them with AWS and you can get very granular or simple with your permissions. If you ever think they've been compromised, you can very easily revoke these certificates to isolate access.

[Captainant 28387]

2 hours ago, Handcruser said:

What is AWS going to do?  Their security posture is not very good.  Don’t rely on providers to secure your assets.  

Doc and I worked together for a short time in the security world.  Almost everyone does most of it wrong    

 

And you shouldn't rely on your rack maintainer to secure the software you're running either. Thinking of AWS or Azure or GCP as your own free security staff is idiotic. The onus is still on the person running the software and configuring the servers to make sure they're secure. And besides if AWS et al aren't secure then why are government agencies and classified projects running in the cloud?

You are right though, nearly everyone does security wrong because most underpaid contract engineers don't give a rats ass about security and the companies paying for the contractors don't care to make sure they're being thorough because it hurts the bottom line.

[F250 29175]

13 minutes ago, Captainant said:

And you shouldn't rely on your rack maintainer to secure the software you're running either. Thinking of AWS or Azure or GCP as your own free security staff is idiotic. The onus is still on the person running the software and configuring the servers to make sure they're secure. And besides if AWS et al aren't secure then why are government agencies and classified projects running in the cloud?

 

Sadly, a lot of organizations think of their cloud provider as their security staff. I would even say don't even consider an MSS as part of your security program. Think of them as another tool that needs to be managed by your staff.

Cloud providers do a relatively good job of securing what they are obligated to secure based on the contract agreement. The problem is many customers don't understand everything that is not covered by the contract.

A number of years ago, I came across a customers contract (a state government) that specified they wanted their tenancy to be protected by some anachronistic standard from the 1990's that was a predecessor to PCI-DSS. They didn't even have PCI data they just thought it was a good idea to treat it like a credit card environment. Unfortunately, it was treated like a credit card environment from the 1990's.

[zork 629]

I worked and managed in the Data Center world for about 10 years.  My impression on contractors was not that they didn't give a rat's ass.  That type of attitude would get you fired or at minimum not extended.  Of course there were some who had a perceived negative attitude but generally those guys/gals got their shit done when it mattered.   Some had a lack of acumen or limited upside is maybe a better way of saying it.  If you were smart you found a way to make those people fit because the retraining/turnover loop sucks.(unless they are just complete negative bringing everyone else down daily types)

Quote

Cloud providers do a relatively good job of securing what they are obligated to secure based on the contract agreement

This is a key statement and applies to the contractor employer relationship as well.  If you aren't being clear what is expected then you aren't going to get what you need out of your contractor.

Edited April 10, 2018 by zork

[Captainant 28387]

2 minutes ago, zork said:

I worked and managed in the Data Center world for about 10 years.  My impression on contractors was not that they didn't give a rat's ass.  That type of attitude would get you fired or at minimum not extended.  Of course there were some who had a perceived negative attitude but generally those guys/gals got their shit done when it mattered.   Some had a lack of acumen or limited upside is maybe a better way of saying it.  If you were smart you found a way to make those people fit because the retraining/turnover loop sucks.(unless they are just complete negative bringing everyone else down daily)

This is a key statement and applies to the contractor employer relationship as well.  If you aren't being clear what is expected then you aren't going to get what you need out of your contractor.

Not sure why you negged me, you must never have worked in an office where the managers cared more about their bonus than putting out good tech - IE - the vast majority of dinosaur tech companies like old retailers and the Giants from the 90s. Running a DC is significantly different from writing and maintaining the software that runs in that DC. Your DC could be fucking fort Knox, but if your guys are writing shit code then it's not gonna matter how physically secure your boxes are. 

Plus, in my experience if a contractor was bad, management just rotates them through TCS to get another person and the cycle of shit continues. Write and run shitty code, get shitty security. Simple as that. 

[Handcruser 2814]

Not sure why you negged me, you must never have worked in an office where the managers cared more about their bonus than putting out good tech - IE - the vast majority of dinosaur tech companies like old retailers and the Giants from the 90s. Running a DC is significantly different from writing and maintaining the software that runs in that DC. Your DC could be fucking fort Knox, but if your guys are writing shit code then it's not gonna matter how physically secure your boxes are. 
Plus, in my experience if a contractor was bad, management just rotates them through TCS to get another person and the cycle of shit continues. Write and run shitty code, get shitty security. Simple as that. 

Truth


Sent from my iPhone using Tapatalk Pro

[F250 29175]

1 hour ago, zork said:

 

This is a key statement and applies to the contractor employer relationship as well.  If you aren't being clear what is expected then you aren't going to get what you need out of your contractor.

I would add that this also applies to Managed Security Service Providers too. I've had many clients that use Secureworks as their primary DFIR program. 80% of the time they are using Secureworks or some other MSS provider out of the box with no customization. Basically paying a good chunk of change for useless email alerts and the occasional phone call because they think the MSSP is on top of things.

[Doc Holliday 199]

1 minute ago, F250 said:

I would add that this also applies to Managed Security Service Providers too. I've had many clients that use Secureworks as their primary DFIR program. 80% of the time they are using Secureworks or some other MSS provider out of the box with no customization. Basically paying a good chunk of change for useless email alerts and the occasional phone call because they think the MSSP is on top of things.

I agree.  In one of my projects, we are going to impact Secureworks as they are a leveraged provider.   I am pushing to NOT communicate with them to see what they do, how they respond, and if they are actually worthwhile as a litmus test.

[F250 29175]

3 minutes ago, Doc Holliday said:

I agree.  In one of my projects, we are going to impact Secureworks as they are a leveraged provider.   I am pushing to NOT communicate with them to see what they do, how they respond, and if they are actually worthwhile as a litmus test.

That's not a bad idea. It will expose any gaps that exist. Then you will get to see if it was your org or Secureworks dropped the ball. Personally, I think they are a decent supplement for organizations without a 24/7 SOC and if they are properly instructed by the customer on a regular basis. The key is they are a supplement and not a replacement.

[Doc Holliday 199]

Just now, F250 said:

That's not a bad idea. It will expose any gaps that exist. Then you will get to see if it was your org or Secureworks dropped the ball. Personally, I think they are a decent supplement for organizations without a 24/7 SOC and if they are properly instructed by the customer on a regular basis. The key is they are a supplement and not a replacement.

Yes, we leverage them for the 24/7 SOC aspects.  Much of the work we will need to do will occur during off-hours so we don't impact day to day business. We will see what they do. 

I've worked with them before and had no major complaints, but, we also had a pretty good security team already in place and they were extra and a built in part of the contract.

[F250 29175]

8 minutes ago, Doc Holliday said:

Yes, we leverage them for the 24/7 SOC aspects.  Much of the work we will need to do will occur during off-hours so we don't impact day to day business. We will see what they do. 

I've worked with them before and had no major complaints, but, we also had a pretty good security team already in place and they were extra and a built in part of the contract.

That's the way it should be done. Having a good security team in place is critical. I usually tell management that an MSSP can be an efficient staff multiplier but you need a knowledgeable FTE to manage your provider.

[GSU&UT 1799]

Too many three letter acronyms, good lord. 

[crash_davis 23465]

this is a national security issue.  if/when we engage in a war with russia, china, nork, iran, our way of life will change overnight.  you can bet your ass those governments already have trojans in all of the major infrastructure systems to shut shit down at the click of a button.  what will all the insecure moms do without facebook?  what the fuck am i going to do without google maps traffic notifications and porn?????????

 

wont something think of the humanity?????

[Doc Holliday 199]

12 minutes ago, crash_davis said:

this is a national security issue.  if/when we engage in a war with russia, china, nork, iran, our way of life will change overnight.  you can bet your ass those governments already have trojans in all of the major infrastructure systems to shut shit down at the click of a button.  what will all the insecure moms do without facebook?  what the fuck am i going to do without google maps traffic notifications and porn?????????

 

wont something think of the humanity?????

We really need to pass a law called HugeManatee that segregates our network of porn and FB. 

[F250 29175]

25 minutes ago, crash_davis said:

this is a national security issue.  if/when we engage in a war with russia, china, nork, iran, our way of life will change overnight.  you can bet your ass those governments already have trojans in all of the major infrastructure systems to shut shit down at the click of a button.  what will all the insecure moms do without facebook?  what the fuck am i going to do without google maps traffic notifications and porn?????????

 

wont something think of the humanity?????

I still have a stack of Playboy magazines so I am good.

[Doc Holliday 199]

40 minutes ago, crash_davis said:

this is a national security issue.  if/when we engage in a war with russia, china, nork, iran, our way of life will change overnight.  you can bet your ass those governments already have trojans in all of the major infrastructure systems to shut shit down at the click of a button.  what will all the insecure moms do without facebook?  what the fuck am i going to do without google maps traffic notifications and porn?????????

 

wont something think of the humanity?????

I wonder if certain company moves to green energy, looking at you apple, is a pivot to help minimize their risk/dependence on municipal power supplies?

Edited April 10, 2018 by Doc Holliday

[Captainant 28387]

45 minutes ago, crash_davis said:

this is a national security issue.  if/when we engage in a war with russia, china, nork, iran, our way of life will change overnight.  you can bet your ass those governments already have trojans in all of the major infrastructure systems to shut shit down at the click of a button.  what will all the insecure moms do without facebook?  what the fuck am i going to do without google maps traffic notifications and porn?????????

 

wont something think of the humanity?????

It'll be much worse than that lol. Critical backbone infrastructure like power, gas, and water will likely be compromised in the event of a large scale cyberattack - BUT - private IT operations (like FB and twitter for example ) will likely be running for a while afterwards if they've done good DR and security work

[crash_davis 23465]

5 minutes ago, Captainant said:

It'll be much worse than that lol. Critical backbone infrastructure like power, gas, and water will likely be compromised in the event of a large scale cyberattack - BUT - private IT operations (like FB and twitter for example ) will likely be running for a while afterwards if they've done good DR and security work

so apple will still be able to sell their overpriced shit, people will buy but won't be able to use the shit because all the telcos networks will be down and all the power grids will be offline so no power.  and we'll all contract herpegonorrsyphillaids from the poisoned water supplies.

Edited April 10, 2018 by crash_davis

[crash_davis 23465]

motherfucking russians!!!!!!!!!!

i'm not going back to fapping to the montgomery wards bra section of the catalogs.  i've seen too much anal gangbangs to go back to imagination.  i won't do it.

[El Diablo 4232]

None of this discussion is in any way in my wheelhouse but by God if the flow of pron is interrupted there will be hell to pay. HELL!

[Doc Holliday 199]

46 minutes ago, crash_davis said:

so apple will still be able to sell their overpriced shit, people will buy but won't be able to use the shit because all the telcos networks will be down and all the power grids will be offline so no power.  and we'll all contract herpegonorrsyphillaids from the poisoned water supplies.

I'm going to buy 12 life straws and start stockpiling magazines and maybe I might start downloading pr0n onto an old burner phone with a redundant power supply.

[zork 629]

2 hours ago, Doc Holliday said:

I'm going to buy 12 life straws and start stockpiling magazines and maybe I might start downloading pr0n onto an old burner phone with a redundant power supply.

which then needs to be stored in a faraday cage.  

 

https://www.thesurvivalistblog.net/testing-shielding-effectiveness-metal-garbage-can/

[F250 29175]

4 hours ago, Doc Holliday said:

I wonder if certain company moves to green energy, looking at you apple, is a pivot to help minimize their risk/dependence on municipal power supplies?

I've consulted for a number of ERCOT Power Gen and TDSPs for ICS/SCADA security in the past. After I noticed a reoccurring trend (incompetence) in the industry I started looking into going off the grid for electricity. Ideally, I would like to be on solar with Tesla batteries, propane and well. I already have two of those so just need the solar.

On a sidenote, my father's ranch is outside of Victoria, TX and he was able to survive through Harvey fairly comfortable due to living mostly off the grid.

 

[Doc Holliday 199]

14 hours ago, F250 said:

I've consulted for a number of ERCOT Power Gen and TDSPs for ICS/SCADA security in the past. After I noticed a reoccurring trend (incompetence) in the industry I started looking into going off the grid for electricity. Ideally, I would like to be on solar with Tesla batteries, propane and well. I already have two of those so just need the solar.

On a sidenote, my father's ranch is outside of Victoria, TX and he was able to survive through Harvey fairly comfortable due to living mostly off the grid.

 

I've worked closely with peers who were at a certain place listed in your post.  They've told me just how jacked up they can be and I don't blame you.  At least Texas is separate from the rest of the nation in that regard despite being regarded by themselves.