2021 – Hackers start to value quality over quantity

We could be forgiven for thinking that 2021 was the year of the ransom note. However, subtle exfiltration of data and the further industrialisation of exploitation and revenue-generating software worryingly continued apace. The last year has not seen a reduction of security incidents but attack techniques are changing; targets are shifting but, as ever, money is at the root of all (cyber) evil. The more things change, the more they stay the same.

The Microsoft hack

Microsoft reported eight separate suspected ‘nation-state’ hacking operations against its software in the past 12 months. It became a victim itself in March. The state-sponsored Chinese group Hafnium is credited with compromising Microsoft Exchange1. It is thought that up to 30,000 businesses were affected through this popular corporate email system. The attackers gained access to onsite servers via stolen credentials and some undetected vulnerabilities. They then erected web shells around the infected servers and were able to harvest email communications.

The Colonial Pipeline hack

Ransomware was front and centre this year. The Colonial Pipeline2 Company operates the largest fuel pipeline in the US. It was breached through compromise of a single machine in April, using an employee’s credentials found on the dark web. This implies that the employee may have used the same password on multiple sites, not just at work. Once in, the DarkSide ransomware operators moved laterally across the corporate network installing their ransomware.

Finally, around 5am local time on 7 May, administrators began to see the ransomware demand light up their screens. By 6:10am local time, the pipeline had been shut down for the first time in the company’s 57 year history. This rapidly caused a fuel shortage on the US East Coast. The pipeline transports 2.5 million barrels of fuel daily to the US East Coast and, as news of the problems spread, panic buying began. It was five days before service was restored.

Security company Mandiant was called in to triage and understand the manner and extent of the breach. The ransom of $4.4 million was paid by Colonial shortly after the attack. The perpetrators also exfiltrated more than 100GB of data which they threatened to publish if not paid.

REvil/Sodinokibi ransomware

Another notable attack involved the infamous REvil/Sodinokibi ransomware. Just before the Fourth of July holiday weekend in America, users of Kaseya’s virtual system administrator (VSA) software began to be infected3.

Kaseya is a cloud-based managed service provider (MSP) platform that allows service providers to perform patch management, backups and client monitoring for its customers. Most customers who used the cloud version of the service were unaffected but those using on-premise Kaseya software were hit.

Although a small number were directly affected, it is thought that around 1,000 organisations downstream were affected as a result. This is a supply chain attack, as the affected systems are not independently infected but rather compromised through the trusted software of a third party (Kaseya in this case). Current estimates are that between 800 and 1,500 small and medium sized businesses were infected with the REvil ransomware as a result of this compromise of Kaseya’s software. It certainly resulted in 800 Co-op supermarkets in Sweden closing. Mandiant was also called in to investigate this incident.

2021: it’s not all bad news

Headlines and statistics are not universally bad to this point in 2021. Risk Based Security, a US-based cyber risk analytics firm claims that publicly reported breaches fell by 24% in the first half of 2021, compared to the same period a year ago. This decline seems to mostly be for incidents outside the US, as the same report shows declared breaches are up 1.5% within the US.

The sheer number of records exposed has also fallen, according to the data. 18.8 billion records exposed in the first half of 2021 — representing a 32% decline — compared to 27.8 billion records exposed in the first half of 2020.

This does point to a possible shift in focus for certain highly sophisticated groups. In the ransomware field particularly, crime groups are carefully selecting targets based on an ability to pay higher ransoms. In many cases, this will involve compromise of less (but more valuable) data. With the addition of a threat to expose sensitive data as well as the ransomware having encrypted it, the victim company has a diffi cult tightrope to walk. This unwelcome trend has spawned companies on the whitehat side specialising in ransomware negotiation, triage and recovery. On the blackhat side, ransomware-as-a-service is a booming growth industry.

The problem with LinkedIn

Before the celebrations begin over less personal data being exposed, there was a problem at LinkedIn4. Data associated with 700 million LinkedIn users was posted for sale in a dark web forum on June 2021. This exposure impacted 92% of the total LinkedIn user base of 756 million users.

The data was dumped in two waves, initially exposing 500 million users — and then a second dump where the hacker ‘God User’ boasted that they were selling a database of 700 million LinkedIn users. It is well known that Chinese hackers place particular value on such data as it can be used to select targets for exploitation in industrial espionage.

Enter the government agencies

The publicity that ransomware attracts can be a problem. It provides superb advertising of the dangers of ransomware, highlighting the crippling effect it has on business. Also, reports of ransoms being paid help to persuade the next victim of the wisest choice of action.

Compromising sensitive operations, however — like the Colonial Pipeline and other critical national infrastructure (CNI) targets — has attracted the attention of government agencies. Their investigation of these attacks has made it more dangerous for underground groups to operate.

Many dark web forums have outlawed discussions of ransomware and the marketing of the software to try to avoid the attention of such three letter agencies.

Security on the fly

Personally identifiable information (PII) is not the only valuable data under threat. Recently, Security Researcher Bob Diachenko stumbled across an unprotected server on the clear web, which seems to have contained the US no-fly list of suspected and confirmed terrorists and other undesirables. A database of 1.9 million records included names, country citizenship, gender, date of birth, passport details and no-fly status.

He found the list on an Elasticsearch cluster, which was indexed by search engines Censys and ZoomEye. This could mean that Bob was not the first, or indeed the only person to run across the list. Evidence that this could be the actual ‘no-fly’ list used by the US government is that another field in the database was ‘TSC_ID’. TSC (or the Terrorist Screening Center) which is responsible for maintaining the list. Bob alerted the Department of Homeland Security (DHS) immediately but the server was only taken down after three weeks (on 9 August 2021).

A million free samples

In truth, the availability of PII is such that dark web marketplaces even provide free samples to draw customers in. Recently, AllWorld.Cards (a site specialising in stolen credit card data) offered one million sets of card data5 for free, to entice new users to their site.

While the data was stolen between 2018 and 2019, it is likely that a significant number of the cards will still be exploitable. Since the data trove includes credit-card number, expiration date, CVV, name, country, state, city, address, ZIP code, email and phone number, even if the card itself may have expired, the data would still have value.

Morse code to crypto heist

Such is the technical scramble by crime groups to evade detection that Microsoft reports detecting the use of Morse Code6 by some malware to obfuscate malicious code. Even when a cyber crime succeeds, perhaps beyond the perpetrator’s wildest dreams, things don’t always end as you might expect. It appears that an as yet unknown individual managed to get away with over $600 million worth of cryptocurrency7 from the Chinese decentralised financial (DeFi) network, or cryptocurrency exchange Poly Network.

Since the successful heist, the thief has returned around $260 million: $256 million Binance Smart Chain (BSC) tokens, $3.3 million in Ethereum tokens and $1 million in USD Coin (USDC) on the Polygon network. While the hacker is claiming noble reasons for the currency’s relocation, their motives are being questioned. This is because blockchain security firm SlowMist claims that it traced the attacker’s email address, IP address and device fingerprint.

Whichever way this plays out, it must be worrying that someone, perhaps not terribly skilled in cyber crime (or at least remaining anonymous while doing it) has managed to make offwith so much currency.

Security is (slowly) getting better

The good news from 2021 is that companies terrified of ransomware are finally motivated to streamline and improve both their security stance and operational readiness for disasters.

The bad news is that sophisticated and increasingly subtle crime groups are still finding it straightforward to penetrate large corporations and hold them to ransom with a reasonable likelihood of being paid. Lone hackers seem still capable of perpetrating high profile and lucrative intrusions, while government agencies still struggle to protect CNI in all its forms. Let us all take heart from the slowly improving global health situation while remaining very much aware that cyberspace is still a highly infectious and polluted environment.

(First published in The British Computer Society’s magazine ITNow, Winter 2021 2021: hackers value quality over quantity | ITNOW | Oxford Academic (oup.com) )

References

Microsoft, 2021. New nation-state cyberattacks.https://bit.ly/MSExchangeIssuesBloomberg, 2021. 

Hackers Breached Colonial Pipeline Using Compromised Password.https://bit.ly/ColonialPipeline2021ZDNet, 2021. Updated Kaseya ransomware attack FAQ: What we know now.https://bit.ly/KaseyaRansomwareForbes, 2021. 

A LinkedIn ‘Breach’ Exposes 92% Of Users—And Other Small Business Tech News.https://bit.ly/LinkedInBreach2021Hemidal security, 2021. 

One Million Stolen Credit Cards Leaked.https://bit.ly/LeakedCreditCardDataThe Hacker News, 2021. 

Hackers Spotted Using Morse Code in Phishing Attacks to Evade Detection.https://bit.ly/MorseCodeHackBleeping Computer, 2021. Hacker behind biggest ever cryptocurrency heist returns stolen funds.https://bit.ly/CryptoHeist2021