On October 8^th 2019, an unnamed Canadian insurance company paid a total of 950 000 USD to a ransomware cyberattacker.

The attacker was able to infect 20 servers and around 1000 employee computers in the attack, encrypting data on the systems behind a ransomwall, demanding payment of 109.25 bitcoins for the safe release of the information.

It was reported that after paying the ransom fee, the cyberattackers provided decryption keys which allowed for the 20 servers to be decrypted for 5 days, and the 1000 end user computers to be decrypted for 10 days.

What was the ransomware strain responsible for the attack?

The ransomware strain that was used in this attack was “BitPaymer”. The malware was able to bypass the Canadian insurance company’s firewalls and infect its network. It is not known exactly how the malware was able to infiltrate into the company’s infrastructure.

Unlike many other ransomware strains that use strategies such as fake emails and malicious download links or websites to infect computers, it is believed that BitPaymer uses targeted brute force attacks.

Brute Force RDP (Remote Desktops Protocol) Attacks

RDP, or remote desktop protocol, is a tool developed by Microsoft for an individual to remotely connect to another computer. It is often used by IT administrators and cybersecurity professionals to diagnose and troubleshoot computer problems from a remote location. However, RDP is also a prime target for cyberattacks, as it is a direct pathway into a company’s network, if compromised.

A brute force attack tries to guess the credentials to an RDP connection through thousands of trial-and-error attempts done in rapid succession by machines.

Microsoft states that protective actions against RDP brute force attacks include activating multifactor authentication and using VPNs. Multifactor authentication is an added security feature to the login process that sends a temporary ‘second password’ to a trusted device every time an account is accessed from an unfamiliar IP.

Don’t become the victim of a brute force attack. Our team of cybersecurity professionals can identify points of vulnerability in your organizations’ network and provide remediation strategies to keep you protected. Call us at +1 888 366 4443 or email us at info@gige.ca to get started with us immediately.

The list of ransomware victims continues to grow. On New Year’s Eve 2020, Travelex, an international foreign exchange company, disclosed that it was struck by the “Sodinokibi” ransomware strain. Also known as REvil, Sodinokibi ransomware prevents users from accessing their computer data by encrypting it behind a ransomwall. The ransom demand for Travelex was $6M USD. They also stated that failure to pay the payment within 2 days will result in double the ransom demand.

In an effort to mitigate the spread of the ransomware, Travelex immediately disconnect infected computers from its company network.

The cyberattackers revealed to BBC that it had actually infiltrated Travelex’s network 6 months prior, and had been able to steal over 5 GB of customer data. According to the group, they have got access to customer information including birthdays and credit card information. This has been a common strategy of newer ransomware strains. Releasing the stolen data is used as a second point of leverage to extort money out of victims.

Cyberthreat intelligence company Bad Packets stated that it had notified Travelex of 7 security vulnerabilities present in their systems in September 2019. The vulnerability was caused by a security flaw in the Pulse Secure Virtual Private Network. According to Bad Packets, the vulnerability was actually patched April of that year, but that Travelex had failed to update its systems to the newest software version, leaving them vulnerable to attack.

The vulnerabilities present in the Pulse Secure VPN were widely known in the second half of 2019. In August of that year, the Canadian Center for Cyber Security urged for Canadian businesses to update their software to the latest versions to protect against attack. In October, the US National Security Agency, and the UK National Cyber Security Center issued similar warnings.

What does the vulnerability allow cyberattackers to do to unprotected systems?

Cybersecurity researcher Kevin Beaumont stated that the VPN vulnerability, also called CVE-2019-11510, allowed for attackers to remotely gain control of unprotected systems even without the use of the user credentials of the computer.

As illustrated by the Travelex, keeping computers up-to-date with current software updates to protect against cyberattack.

The Canadian Centre for Cybersecurity recently stressed the importance of keeping VPN devices up-to-date. Because VPN devices act as points of contact between a network and the internet, they are particularly vulnerable to cyberattack.

The Centre for Cybersecurity identified four types of VPN that are particularly vulnerable: Fortinet Forigate, Palo Alto GlobalProtect, Pulse Connect Secure, and Pulse Policy Secure. Vulnerabilities in these VPN services can allow attackers to do anything from changing passwords of user portals to downloading malicious files onto the victims’ computers. For example, Palo Algo GlobalProtect VPN is susceptible to a vulnerability called CVE-2019-1579 which, when exploited, allows attackers to execute unauthorized code on a computer without the permission of the user.

Troy Mursch, an independent researcher, stated that over 14 000 Pulse Secure VPN endpoints were still susceptible to the CVE-2019-11510 vulnerability. It was found that industries including military, government, universities, and hospitals are still affected.

These vulnerabilities were discovered by DEVCORE researchers during the recent Black Hat USA 2019 Conference – a computer security event with a focus around training and briefing. Prior to announcing the vulnerabilities to the public, the researchers disclosed their findings to the affected developers so official fixes would be released simultaneously.

Between April and July this year, several patches fixing the vulnerabiltiies were released by Fortinet, Palo Alto Networks, and Pulse Secure.

Protecting Yourself from VPN vulnerabilities

When known vulnerabilities are announced to the public, it is essential that you update your affected systems to the latest patches. Cyberattackers are constantly scanning the internet for endpoint devices that are unprotected. Many are now automating this process, making the threat more immediate than ever.

GIGE IT Corporation’s network security technicians have years of experience designing and deploying security solutions for businesses. Don’t leave yourself vulnerable to cyberattack – contact us at info@gige.ca or 888 366 4443 to get started with us immediately.

Fileless Malware Attacks are on the rise. The Canadian Centre for Cyber Security warns the public to watch out for this dangerous type of cyberattack.

Fileless malware attacks are a particularly dangerous strain of malicious software (malware) that are difficult to detect due to their ability to exploit your own programs to mask themselves. This makes it much more difficult for antivirus software to detect them, allowing the malware to spread itself across your network without triggering red flags. Furthermore, fileless malware often removes itself from the victim’s computer after initial infection, further avoiding detection.

 

How do Flawless Malware Attacks Infect Your Computer?

There are many channels that a flawless malware campaign can infect your devices. Here are some of the common methods:

Phishing Attack

A phishing attack is a malware infection that is carried through e-mail. A malicious e-mail is sent to the victim, often posing as a legitimate company asking for account confirmation or profile information updates, tricking recipients into clicking malicious links that download malware or to open malicious websites. To read more about protecting yourself against phishing attacks, check our article here.

Compromised / malicious device

One of the most common methods of infection is by connecting a malicious or compromised device to the victim’s computer. These devices can include storage devices such as hard drives, USBs, and SD cards. Once an infected devices has been connected to a computer, it is as simple as executing a malicious file to infect the PC.

What happens after infection?

After a PC becomes infected, the fileless malware abuses administrative programs such as the Windows Management Instrumentation (WMI) and the Regsvr32 tool to try to download additional malware from the internet to spread to other devices on the network, steal data, or record keystrokes. This method of cyberattack that uses existing programs is called “living off the land”, and makes it incredibly difficult for detection as these programs are usually able to bypass antivirus software due to their back-end administrative use.

Once data has been stolen, it can be sold on cyberattacker black markets, used for theft, and to hack into accounts.

In light of this rising threat, The Canadian Centre for Cyber Security has outlined best practices to keep yourself protected against this type of cyberattack.

First, ensure that all your programs are up-to-date. Developers are constantly releasing updates that repair known vulnerabilities in their programs, and neglecting software will leave you vulnerable.

Segmenting your network can help prevent malware from spreading to your sensitive devices. Centralizing your network management will also reduce the ability for malware to spread itself among your devices.

Don’t fall victim to fileless malware attacks. GIGE IT Solutions provides data backup and network security services to help you ensure that your computers are protected and secure. Call +1 888 366 4443 or email info@gige.ca to get started with us today.

Multinational insurance company CFC Underwriting says that human error still remains a primary factor in the thousands of cybersecurity insurance claims that the company handles. In 2018, the insurance company received over a thousand claims relating to ransomware, malware, data breaches, and data theft. Of these incidents, CFC Underwriting notes that the following human-driven errors were the leading cited causes of cyberattack claims:

 

Phishing Attacks:

A phishing attack is a type of cyberattack that uses malicious links in an email to trick victims into sharing personal information or downloading malware. The emails can be targeted at high-profile victims such as CEOs and CFOs, or can be sent en masse to millions of people. The main danger of this type of attack is that it is often difficult to distinguish between a legitimate or malicious email. Some attackers even construct entirely fake websites with credential fields that send the information directly to their systems. Phishing attacks are a major point of infection for ransomware attacks.

 

Business Email Compromise:

Business Email Compromises (BEC), are a specific type of malicious email attack that targets businesses that conduct wire transfers on a daily basis. The goal of these attacks is to trick these companies into completing transfers to malicious accounts. According to the FBI, around 80 000 cases were reported between October 2013 to May 2018, with a total theft of $12.5 billion.

CFC Underwriting reported that employees not following-up to check if funds were properly transferred was a major cause of the prevalence of this type of attack.

 

Losing a Device:

CFC Underwriting stressed that a common cause for data breach was misplaced or lost devices. Leaving computers and phones that contain sensitive information unattended can lead to accidentally sharing private company data.

 

What can you do to reduce minimize the risk posed by human error?

Human error will always be a risk factor in cybersecurity. Here are some best cybersecurity practices for you to protect yourself:

Stay up-to-date on phishing techniques – by training yourself and employees on key factors to look-out-for in phishing emails, you can significantly reduce risk of infection. See our article on phishing scams to learn more about this type of attack.

Keep track of your company’s devices. A key part of mitigating data breach damage relies on early detection, as seen by the recent data leak at HCL. Keeping a close eye on your devices ensures that missing devices are detected early and that efforts can start on damage mitigation.

Managed IT Security providers like GIGE IT Solutions can help you protect yourself against the risk of human-caused cyberattack. By designing customized IT security plans for your company and monitoring your security and data backup on a 24/7 basis, we ensure that you are always prepared. Call +1 888 366 4443 for an immediate consultation, or email us at info@gige.ca

The list of ransomware victims continues to grow. Florida’s Lake City and Riviera Beach City have both fallen victim to cyberattack. Both cities have been forced to pay $500 000 each to the attackers in attempts to unlock the encrypted files.

On June 5^th, the City of Riviera Beach released an official announcement stating that a “data security event” has occurred. One day later, the Lake City Police Department released a similar announcement, detailing that a ransomware attack had disabled many of the city’s systems, including email, VoIP and credit card channels.

As a result of the attacks, both governments have been thrown back to analog working environments, hand-writing bills and permits while the systems are recovered. Despite the ransom payments, there is no guarantee that the lost data will, or even can, be decrypted by the cyberattackers.

Riviera Beach released that the ransomware virus infected their systems through a malicious link in an email. Lake City, on the other hand, stated that their system was intruded after attacks on multiple fronts of their network.

What is Ransomware?

Ransomware is a type of cyberattack that encrypts data on a computer and asks for a ransom fee for an unlock key. Encryption renders ordinary data unreadable, and can only be decrypted by using the key supplied by the attackers.

This type of attack has seen a massive uptick in recent years. Since January 2016, over 4000 ransomware attacks have occurred daily, according to the U.S. Department of Homeland Security. Targets of these attacks range from households and small organizations to governments.

There are many factors that caused the widespread use of ransomware. Firstly, the rise in cryptocurrency popularity have given attackers an ideal payment channel. Recent years has seen digital currencies such as Ethereum and Bitcoin rise in both usage and value. Bitcoin, for instance, costs around CAD 14 000 as of July 3^rd 2019. Some of these currencies are designed to be difficult to track, therefore making them perfect for cyberattackers.

The unpreparedness of companies and governments to deal with ransomware attacks is another reason why this type of attack has been so successful. As demonstrated by the attacks of the Florida cities, ransomware causes significant damage to day-to-day functions. Therefore, businesses and governments are often forced to simply pay the fee to avoid compounding damage.

Don’t fall victim to ransomware. Managed IT service providers can help you design and monitor backups of your data to restore your systems in the event of an attack. GIGE IT Solutions provides customizable backup and security solutions tailored to your business goals. Call us at +1 888 366 4443 for an immediate consult.

Hong Kong’s flag carrier, Cathay Pacific, has been the latest in the long list of companies affected by major digital data breaches. It was reported that the sensitive data of over 9.4 million customers were compromised due to the incident. Over 400 expired credit card numbers, and 27 active cards (without CVV information) were leaked. In these situations, is reporting data breaches a legal necessity?

The breach that resulted in the data leakages had in fact occurred in March 2018, months prior to Cathay Pacific’s official announcement. The company now states that this was when they began noticing suspicious activity in their servers. However, it was decided that the information would be held from the public in order to avoid creating an “unnecessary scare”.

This practice is not limited to Cathay Pacific. Other large companies such as Yahoo and Facebook did not notify the public of data breaches until years after they occurred. In the case of Facebook, this resulted in the Cambridge Analytica Data Controversy of early this year. Both of these companies have suffered consequences from their respective incidents. Yahoo paid a $35 Million settlement payout for withholding information to its investors, while Facebook was fined due to over 80 million of its customers having their data stolen.

Is Reporting Data Breaches A Legal Requirement?

Rules for reporting data breaches is determined differently in various jurisdictions. Individual countries generally have autonomy in how they regulate organizations that have been breached. For instance, in Hong Kong, companies do not legally need to report it to the public. Instead, they are simply encouraged to communicate with the Privacy commissioners for Personal Data (PCPD) in order to mitigate damages. However, in light of the incident, Hong Kong’s current PCPD Stephen Kai-Yi Wong stated that the state may implement stricter rules in the future.

For GDPR Regulated Countries:

For states following the GDPR regulation that was implemented May of this year, companies suffering from a data breach impacting European citizens must notify affected parties as soon as possible, up to a maximum of 72 hours under reasonable circumstances. Companies that fail to do this face fines of the greater value between 20 Million pounds or a 4% annual turn-over rate.

How will Canada’s regulation be affected by the Digital Privacy Act?

Canada’s new Digital Privacy Act will be implemented November 1^st of 2018. Following this, Canadian companies impacted by data breaches are legally bound to report the incident to both the Privacy Commissioner of Canada, and any other affected individuals. Under this new regulation, Canadian companies failing to notify these parties will net fines of up to $100 000. Furthermore, if a company does not properly keep, or deliberately destroys breach information, they will also be subject to fines of up to $100 000.

Do not fall victim to data breaches. Call us at GigE today at 888 366 4443 to protect your company from cyberthreats.

It has recently been discovered by Check Point researchers that fax machines contain cyber-vulnerabilities that allow attackers to infiltrate your network using only a fax number. Given that many companies today still use fax machines, and that fax numbers are publicly provided contact information, this new exploit poses a major vulnerability concern to thousands of organizations.

The new exploit that abuses this vulnerability has been dubbed “Faxploit” (short for fax exploit), and is believed to affect all fax-capable machines, including fax-to-mail services and all-in-one printers.

To infect the printer, all the attackers need to do is send a malicious fax to the machine. From there, they can gain full control of the device and then further infiltrate the company’s network. In their study, the researchers at Check Point were able to gain control of an HP Officejet all-in-one printer simply by sending an infected fax, and then were able to infect its network with spying software such as ‘EternalBlue’.

Another point of vulnerability that was discovered was through the fax machine’s PSTN phone line connection. Using this, attackers can exploit the machine and gain control of the device without it even being connected to the internet.

Still a Lab Contained Danger

The Faxploit has not been detected outside of the laboratory conditions, reported the Check Point researchers. However, they noted that it will only be a matter of time before other researchers and cyberattackers develop the software for themselves.

The researchers stated that they have already notified HP of the exploit, and the company has since developed and released a patch that has repaired the cyber vulnerability. This update was released on August 1^st 2018, and likely has already been applied to your printer if its update-sequence is set to automatic. However, if your printers’ updates are manually managed, it is important to ensure that the latest software has been installed on it.

The checkpoint researchers have confirmed that the exploit works on HP all-in-one machines, and has therefore prioritized communicating with this manufacturer to develop a fix. However, they believe that the exploit will also work on devices from other manufacturers. There is no word yet from these companies on fixes.

Here are some best practices to keep in mind to protect your organization’s or personal printer from infection:

Firstly, always ensure that your fax machine is running the latest software from its developer. If the automatic update feature is not turned on, manually check if the latest firmware is running. Second, if you do not use the fax features of your all-in-one printer machine, it is beneficial to disconnect it entirely from the PSTN line, eliminating this potential malicious pathway into your network. Finally, if you are unable to completely disconnect your fax machine, use network segmentation to protect critical areas of your network. This strategy involves creating ‘breaks’ in an organization’s network by disconnecting groups of computers from each other. This way, if a segment becomes infected, the infection can be contained more easily.

GigE Solutions can help your company protect its networks from fax exploits by ensuring that all your machine are up-to-date with the latest patches from developers. Contact us at +1 (888) 366-4443 to get started today.