CyberWire Daily - Episode Summary

Title: Novel Attacks and Creative Phishing Angles
Host/Author: N2K Networks
Release Date: November 25, 2024

1. Overview

In this episode of CyberWire Daily, hosted by N2K Networks, the focus is on the latest developments in cybersecurity, highlighting novel attack methods and innovative phishing strategies. The episode delves into sophisticated cyber espionage tactics, emerging phishing scams targeting consumers, significant discussions from international cyber defense conferences, critical vulnerabilities in widely-used software, and a comprehensive interview with Leslie Carhart from Dragos on the evolving landscape of Operational Technology (OT) incident response.

2. Sophisticated Cyber Espionage: APT28's Nearest Neighbor Attack

A significant segment of the episode covers a complex cyber espionage operation uncovered by Valexity in early 2022, executed by the Russian cyber group APT28, also known as Fancy Bear.

• Key Points:

  • Operational Strategy: The group employed a strategy termed the "Nearest Neighbor Attack," where they compromised multiple organizations in close physical proximity to their primary target (Organization A).
  • Technical Exploitation: After gaining valid credentials through password spraying, APT28 encountered multifactor authentication barriers on Organization A’s public-facing services. To bypass these, they infiltrated a neighboring entity (Organization B) and exploited a dual-homed system connected via Ethernet and WiFi. Using the WiFi adapter, they accessed Organization A’s enterprise network remotely.
  • Extended Compromise: The attackers also breached a third nearby organization (Organization C), demonstrating the scalability and stealth of their approach.

• Notable Quote:

  “They infiltrated their target's network remotely, highlighting the need for robust WiFi security measures and vigilance against such innovative attack vectors.”
  — Maria Varmazas, 05:15

3. Emerging Phishing Scams: Apple ID Suspension Tactic

As Black Friday approaches, cybercriminals are ramping up phishing attacks to exploit consumer frenzy.

• Key Points:

  • Target: Apple users receiving fraudulent emails claiming their Apple ID has been suspended.
  • Mechanism: These deceptive messages prompt recipients to provide personal information or click malicious links, capitalizing on the urgency to secure deals.
  • Apple’s Warning: Apple advises users to verify the authenticity of such communications by contacting official channels and to be cautious of unsolicited emails requesting sensitive data.

• Notable Quote:

  “Always verify the authenticity of such communications by contacting Apple directly through official channels.”
  — Maria Varmazas, 07:45

4. International Cyber Defense Efforts: NATO Conference Insights

UK Cabinet Office Minister Pat McFadden addressed the NATO Cyber Defense Conference in London, emphasizing the escalating cyber threats from Russia.

• Key Points:

  • Threat Landscape: Russian cybercriminals are increasingly targeting nations supporting Ukraine, leveraging advanced technologies like artificial intelligence to enhance their attacks.
  • Countermeasures: Introduction of the Laboratory for AI Security Research with an initial investment of £8.22 million aims to develop sophisticated cyber defense tools and promote intelligence sharing among NATO allies.
  • Strategic Importance: McFadden stressed the necessity for NATO members to remain vigilant and proactive to safeguard critical infrastructure against potential cyberattacks.

• Notable Quote:

  “Ensuring robust defenses against potential cyberattacks on critical infrastructure is paramount in the evolving AI arms race.”
  — Pat McFadden, 10:20

5. US Senate Push for Transparency: TSA Facial Recognition Audit

A bipartisan group of US Senators has requested an audit of the Transportation Security Administration’s (TSA) use of facial recognition technology.

• Key Points:

  • Concerns Raised: The technology is set to be deployed across hundreds of airports without independent evaluation of its precision or safeguards for passenger privacy.
  • Legislative Action: Senators argue that the program could create one of the largest federal surveillance databases without Congressional authorization.
  • Audit Request: The letter urges the Department of Homeland Security’s Inspector General to evaluate TSA’s facial recognition program and report findings to Congress before its widespread implementation.

• Notable Quote:

  “This program could become one of the largest federal surveillance databases overnight without authorization from Congress.”
  — US Senators, 12:05

6. Ransomware Strikes Supply Chain: Blue Yonder Attack

US-based supply chain management software company Blue Yonder suffered a ransomware attack, disrupting services to major grocery chains in the US and UK.

• Key Points:
  • Impact: Outages affected Morrison’s and Sainsbury’s supermarkets, leading to challenges in goods distribution.
  • Response: Blue Yonder’s Azure public cloud services remained unaffected. The company is collaborating with external cybersecurity experts to investigate and implement recovery measures.
  • Recovery Status: As of November 24, Blue Yonder has made progress in restoration efforts but hasn't provided a full recovery timeline.

7. Critical Vulnerabilities: QNAP and Avast Exploits

The episode highlights two significant vulnerabilities affecting widely-used software platforms.

• QNAP Vulnerability (CVE-2024-27130):

  • Issue: A stack buffer overflow in the noSupportACL function within the Share CGI script could allow remote code execution.
  • Affected Systems: Network Attached Storage (NAS) devices.
  • Mitigation: QNAP has addressed the issue in QTS 5.1.7.2770 and QUTS Hero H 5.1.7.2770 builds released in May 2024. Users are urged to update promptly.

• Avast Anti-Rootkit Driver Exploit:

  • Technique: Attackers exploit the outdated aswrpot.sys driver in Avast's anti-rootkit software to gain kernel-level access.
  • Impact: This allows malware to disable security defenses, facilitating undetected attacks.
  • Notable Use Cases: The Avos Locker ransomware has utilized this exploit, underscoring the threat posed by vulnerable drivers.

• Notable Quote:

  “Attackers deploying the illegitimate aswrpot.sys driver allows malware to terminate processes and disable security products, effectively evading detection.”
  — Maria Varmazas, 15:40

8. China's Regulatory Moves: Combating Information Echo Chambers

China’s Cyberspace Administration (CAC) has launched a campaign to regulate internet algorithms to prevent the creation of information cocoons.

• Key Points:

  • Regulatory Mandates: Tech companies must prevent homogeneous content dissemination and enhance transparency in content ranking algorithms.
  • Prohibitions: Discriminatory pricing based on user demographics in e-commerce is banned.
  • Compliance Deadline: Companies have until the end of the year to comply, with assessments beginning in January.

• Notable Quote:

  “The CAC mandates that tech companies prevent the dissemination of homogenous content and enhance transparency in content ranking algorithms.”
  — Maria Varmazas, 17:10

9. Expert Insight: Leslie Carhart on OT Incident Response

In an in-depth interview, Leslie Carhart, Technical Director at Dragos, discusses the unique challenges and evolving strategies in Operational Technology (OT) incident response.

• Key Points:

  • Distinctive Challenges:

    • Kinetic Consequences: Cyber incidents in OT environments can lead to physical harm, environmental damage, and disruption of critical services.
    • Legacy Systems: Many OT environments rely on outdated systems (e.g., Windows NT, XP) that are difficult to secure and require specialized tools and training.
    • Operational Constraints: Incident response must prioritize safety and avoid exacerbating physical system vulnerabilities.
    • Access Difficulties: OT facilities are often remote and require specialized safety protocols for responders.

  • Monitoring and Security Measures:

    • Boundary Management: As IT and OT systems converge, monitoring the interfaces between them becomes crucial to prevent intrusions.
    • Network Architecture: Emphasizes the importance of segmenting and isolating industrial networks to control ingress points effectively.
    • Vulnerability Management: Identifying and mitigating vulnerabilities in perimeter devices is essential due to the inherent insecurity of many industrial protocols.

  • Industry Maturity:

    • Variation Across Sectors: Industries like oil and gas, with higher budgets, are leading in cybersecurity maturity, while sectors like manufacturing and municipal utilities lag due to financial constraints and limited resources.
    • Incident Response Planning: Even small organizations should develop basic incident response plans to ensure preparedness despite resource limitations.

• Notable Quotes:

  “Everything we have to do in terms of cybersecurity defense and incident response has to come down to what avoids those consequences.”
  — Leslie Carhart, 15:00

  “You have to commit at least a few hours to thinking about, if you had ransomware in your industrial environment, who would you call and would they pick up the phone?”
  — Leslie Carhart, 25:30

• Recommendations:

  • Adopt SANS Critical Controls: Implementing the five Critical Controls for Industrial Cybersecurity can significantly enhance defense mechanisms.
  • Develop Incident Response Plans: Tailored plans, even if basic, are essential for effective response and recovery.

10. Concluding News: Stop & Shop’s Customer Outreach Post-Cyber Incident

Following a recent cybersecurity incident that led to empty shelves at Stop & Shop stores, the grocery chain took proactive measures to regain customer trust.

• Key Points:
  • Recovery Efforts: Stop & Shop offered free coffee and sweet treats in Connecticut, Massachusetts, and Rhode Island as a gesture of appreciation to customers for their patience during the tech turmoil.
  • Customer Engagement: The initiative aimed to maintain customer loyalty and mitigate the negative impact of the service disruption.

11. Final Remarks

The episode underscores the dynamic and evolving nature of cyber threats, emphasizing the need for robust security measures, proactive incident response planning, and continuous vigilance across both IT and OT environments. Insights from industry experts like Leslie Carhart highlight the critical importance of tailored cybersecurity strategies to protect against sophisticated and potentially devastating cyberattacks.

For more detailed stories and updates, visit The CyberWire Daily Briefing.