Business Continuity Management / Disaster Recovery , Fraud Management & Cybercrime , Governance

There's plenty of advice on how to prepare for a ransomware attack, but the message about the importance of backups segregated from the main network doesn't seem to be getting through.

See Also: 10 Incredible Ways You Can Be Hacked Through Email & How To Stop The Bad Guys

Organizations may not be able to prevent their employees from clicking malicious phishing links, but robust backups can help restore order quickly. And it appears - at least in the case of Lake City, Fla., there are unpleasant consequences for those at the top.

The small city in central Florida has fired its IT manager, Brian Hawkins, after ransomware disabled its phone and email systems on June 10, according Gainesville-based broadcaster, WCJB TV20.

Hawkins could not be immediately reached for comment via his LinkedIn profile, which says he has been the IT manager there for five years.

Lake City opted to pay the attackers about $530,000, or 42 bitcoins, to restore access to systems and data. According to its fiscal 2019 report, the city's general fund - which pays for administration, police, public work and recreation - is about $16 million.

But the ransom cost was mostly covered by insurance. The city has a policy with the Florida League of Cities and will only have to cover $10,000 out of pocket. The ransom was paid on June 25, and the city then received the decryption key (see Second Florida City Pays Up Following Ransomware Attack).

Pay Up?

Despite advice from the FBI that organizations should not pay ransoms, the decision is increasingly being looked at from a cost/benefit perspective.

Insurance policies may cover ransoms, and the option may look appealing if the cost of recovery is more than the ransom. And as ProPublica reported last month, some forensics firms that claim to be able to resolve a ransomware infection are actually paying the ransom while passing the cost onto their customers.

Plus, there's the vexing question over who is profiting from the ransom. ProPublica traced four ransom payments made by Proven Data Recovery, a firm based in New York. The payments - made to get the decryption key for a SamSam infection - ended up in bitcoin wallets linked to Iran.

The city of Baltimore, however, refused to pay a ransom after a recent attack and endured an estimated $18 million in recovery costs. The city was affected by the Robbinhood ransomware, which forced the city to revert to manual processes (see: Fingerpointing Over Baltimore's Ransomware Attack).

But another Florida city, Riviera Beach, opted to authorize its insurance company to pay $600,000 in bitcoin to resolve its woes after a ransomware attack that struck on June 5 (see: Florida City Paying $600,000 to End Ransomware Attack).

More Cities Affected

Other security incidents targeting units of government have surfaced in recent days.

Key Biscayne, a barrier island just off Miami, was hit by some sort of security incident last week, according to a report from the local CBS station and the Associated Press. The severity of the attack is unclear, and the village's website is still operating.

The Miami Herald reported on Thursday that Village Manager Andrea Agha confirmed a "data security event" on June 23. However, Agha reportedly said the city's system were back online by June 26, although some systems were being kept offline and other processes were being performed manually.

And in Georgia, WXIA-TV reports that the state's Administrative Office of the Courts and the Judicial Council of Georgia were compromised in a ransomware attack.

A court spokesman, Bruce Shaw, tells WXIA-TV: "Our systems have been compromised, so we have quarantined our servers and shut off our network to the outside." Court officials found a note on their computers but it did not have a ransom demand.

Shaw tells WXIA that the network has been taken offline. The affected system contains public documents and not personal data. Judges reportedly cannot access their information.

The FBI's Advice

The FBI's ransomware advice

Given that ransomware is having a ferocious run, it's good to review the FBI's advice for CISOs. In particular, the agency has a several words of caution around paying a ransom. First, paying a ransom encourages the criminal business model.

Even after paying a ransom, the FBI says some organizations never received a decryption key. Also, some who paid the ransom were then asked for more money before the key was delivered. Hackers have also targeting organizations again after getting a ransom.

"After systems have been compromised, whether to pay a ransom is a serious decision, requiring the evaluation of all options to protect shareholders, employees and customers," the FBI says. "Victims will want to evaluate the technical feasibility, timeliness and cost of restarting systems from backup."

Endpoint Security , Governance , IT Risk Management

Sophos is the latest security firm to create a proof-of-concept exploit for the so-called BlueKeep vulnerability in older versions of Microsoft Windows. The company echoed several government agencies that have urged businesses to patch their devices.

See Also: Webinar | Passwords: Here Today, Gone Tomorrow? Be Careful What You Wish For.

So far, however, a full-functioning exploit has not been spotted in the wild, although attackers may be trying or developing their own code, Andrew Brandt, principal researcher for Sophos, tells Information Security Media Group.

"The bigger point is that if we and others can create functional [proof-of-concepts], serious threat actors could very well have developed their own by now, too," Brandt says. "We have no idea if a criminal group or nation-state attacker is any closer to a weaponized version of this, but we believe the day is fast approaching when someone will, inevitably, develop and use this."

System Takeover Demo

While some other conceptual exploits show a distributed-denial-of-service attack that crashes a Windows device, the Sophos offensive research team's exploit demonstration professes to show a full system takeover with administrative and system-level privileges that can be completed in less than two minutes.

As with other proof-of-concept exploits, the Sophos team is not publishing the full code it developed, but the company did provide a video along with a blog released Monday that shows the exploit in action and the eventual takeover of the device.

The Sophos teams says it hopes its demonstration will lead more companies to patch devices running older versions of Windows. Some researchers claim that nearly 1 million of devices are vulnerable to BlueKeep (see: Microsoft Sounds Second Alarm Over BlueKeep Vulnerability).

"Sophos has been concerned at published news reports that highlight the lack of urgency that some organizations are taking with this update," Brandt says. "When the operating system maker, the government agencies tasked with tracking security incidents, and a large number of security companies are all telling everyone to update, we hope that admins and everyday users at home will start to take this seriously before a wormable malware appears and causes a lot of damage."

Tracking BlueKeep

Since May 14, Microsoft has issued a security patch plus two warnings concerning BlueKeep, a vulnerability in the company's Remote Desktop Protocol service that could enable attackers to use a worm-like exploit to take over devices running unpatched older Windows operating systems.

Versions of Windows vulnerable to this flaw are Windows XP, Windows 7, Windows 2000, Windows 2003 and Windows Server 2008. Newer versions, including Windows 8 and Windows 10 are not affected, according to Microsoft.

In addition to warnings from Microsoft and security firms such as Sophos, the U.S. National Security Agency and the Department of Homeland Security have each issued their own alerts about BlueKeep, which is also known as CVE-2019-0708 (see: DHS Is Latest to Warn of BlueKeep Vulnerability).

The main concern about BlueKeep is that because the vulnerability does not require user interaction, an exploit using remote code execution could spread malware from one vulnerable device to another within a network in the same way that the WannaCry ransomware was "wormable."

In addition to Sophos, Zerodium, McAfee, Kaspersky, Check Point, MalwareTech and Valthek have reportedly developed conceptual exploits for BlueKeep but are keeping that code private.

Developing the Exploit

To demonstrate a BlueKeep exploit, SophoLabs' offensive research team spent weeks reverse-engineering the patch Microsoft issued for BlueKeep, according to Monday's blog post.

If hypothetical attackers were to use the code that Sophos developed, they would be able to launch a command shell that appears prior to login on the Windows login screen, according to the blog. In the video, the Sophos team replaces an executable called utilman.exe, which is part of Windows, with another trusted component that is the command shell - or cmd.exe.

In Windows, utilman.exe can launch several features in the operating system and has system-level privileges, according to Sophos. By replacing it with the command shell, another user can gain those same privileges. Because this particular attack is fileless, no malware is needed, and simply connecting over the vulnerable Remote Desktop Protocol is enough, the blog notes.

"With very little effort, a malicious threat actor could fully automate the whole attack chain, including synthetically 'typing' commands into the shell, or simply passing commands to the shell," according to the Sophos blog. "That would be extremely bad, as it would allow rapid-fire attacks targeting any system hosting RDP to the outside world. It wouldn't necessarily succeed in the case of the patched devices, but an attack like this falls into the category of 'spray and pray' - the attackers are not choosy about who they target, and some percentage of machines will be vulnerable."

Brandt and other researchers say that if threat actors develop similar exploits, they will be able to speed up an attack faster than what Sophos has been able to demonstrate with its proof-of-concept.

"In our proof-of-concept, it takes a bit of time for the exploit to do its work, and right now that might constitute a limitation, but with additional work it should be possible to speed this up significantly," Brandt says.