Application Security , Cloud Security , Governance

CMS Project Team Patches 'Highly Critical' Remote Code Execution Vulnerability(euroinfosec) • February 22, 2019    

Patch alert: Some versions of the popular content management system Drupal have a "highly critical" flaw that attackers can exploit to remotely execute code.

See Also: Live Webinar | Underestimated Risk & Overestimated Security: When All You Do Is React, it May Be Too Late

The vulnerability, designated CVE-2019-6340, exists because "some field types do not properly sanitize data from non-form sources," the open source Drupal project team says in a security alert. "This can lead to arbitrary PHP code execution in some cases."

To patch the problem, Drupal on Wednesday released "critical releases" that update Drupal 8.6.x to Drupal 8.6.10, and Drupal 8.5.x or earlier users to Drupal 8.5.11.

"Be sure to install any available security updates for contributed projects after updating Drupal core," the project team says. "No core update is required for Drupal 7, but several Drupal 7 contributed modules do require updates."

What's at Risk?

Drupal says versions of the CMS are at risk if they meet one of the following conditions:

Drupal 8 Web Services: "A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests." Other web services modules: "The site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7."

Drupal says that while Web Services Module version 7 is not at risk, it recommends applying all possible updates regardless.

In lieu of immediately installing updates, Drupal says the flaw can be mitigated by disabling all web services modules or else configuring services to not all PUT, PATCH or POST requests to web services resources. "Note that web services resources may be available on multiple paths depending on the configuration of your server(s)," Drupal warns.

The project team also notes that any versions of Drupal that are 8.5.x or earlier are "end of life" and will see no further security updates.

Independent security researcher Troy Mursch of Bad Packets Report on Friday said attackers have already been scanning sites en masse, looking for Drupal installations vulnerable to CVE-2019-6340.

Popular CMS

Drupal is the world's third most popular content management system, commanding 4 percent market share, after Joomla at 5 percent and CMS heavyweight WordPress, which owns 60 percent of the market, according to W3Techs.com.

More than 1 million websites use Drupal, according to the Drupal project team.

This isn't the first time that a critical flaw in Drupal has been targeted by attackers. Last year, Mursch warned that at least 400 websites had hacked by attackers who exploited a remote-code-execution flaw in Drupal to install code designed to mine for the virtual currency known as monero.

Victims included Lenovo, the India Olympic Association, San Diego Zoo and the Office of Inspector General of the U.S. Equal Employment Opportunity Commission, among many others (see: Cryptocurrency Miners Exploit Widespread Drupal Flaw).

Many administrators of Drupal CMS sites fail to patch their installations in a timely manner. Two months after the Drupal project team patched two "Drupalgeddon" flaws early last year, security firm Malwarebytes reported that it was still finding dozens of sites running vulnerable versions of the CMS (see: Websites Still Under Siege After 'Drupalgeddon' Redux).

Data Breach , Fraud Management & Cybercrime , Incident & Breach Response

Country Has Faced a Series of Security Incidents in Recent Weeks(jeremy_kirk) • February 22, 2019    A 2018 Toyota Yaris (Source: EurovisionNim via Wikimedia Commons)

Toyota Australia's computer systems were still down on Friday after the company said it was a victim of an attempted cyberattack.

See Also: Sunset of Windows Server 2008: Migrate with Docker

Meanwhile, a Melbourne-based cardiology group acknowleged on Thursday it was struck by ransomware in late January that encrypted patient records and scheduling calendars.

The incidents come as Australia has faced a few tough weeks of cyberattacks. For example, the country's Parliament was hit last week with what the government described as a nation-state attack that gained access to the email archives of lawmakers (see: Suspected State-Sponsored Hackers Pummel US and Australia).

Efforts to reach Toyota Australia officials on Friday weren't successful. But the company says in a statement on its website that "we believe no private employee or customer data has been accessed."

"The threat is being managed by our IT department [which] is working closely with international cybersecurity experts to get systems up and running again," the company says.

Unreachable By Phone, Email

On another part of its website, Toyota Australia writes that it's experiencing technical difficulties and that "we are currently unreachable via phone or email." The outages began late Tuesday evening, according to Caradvice.com.au.

Toyota Australia warned on its website that the cybersecurity incident affected its email and phone systems.

The company says it didn't have further information on the origin of the attack. But the effects would indicate the possibility of a ransomware infection, the file-encrypting malware that has caused IT problems worldwide over the past few years.

The Australian Cyber Security Center, the government's top cybersecurity agency, says it's assisting Toyota, but it declined to comment further on the incident. It noted that it recently provided advice on attacks that were targeting the automotive industry.

With Toyota Australia not saying much, it's difficult to determine what happened, says Chris Culnane, a cybersecurity expert and lecturer with the School of Computing and Information Systems at the University of Melbourne. The incident could stem from cybercrime, industrial espionage or even a disgruntled insider, he says.

That some of Toyota's systems remain offline is an indication that the source of intrusion may not have been isolated yet, Culnane says. Until that is uncovered, "they can't risk bringing the email servers back online," he says.

Ransomware: A Heart Stopper

The Melbourne Heart Group, which leases space at Cabrini Hospital in the Melbourne suburb of Malvern, says it was hit with a cybersecurity incident late last month in which "our patient data was encrypted."

"This means that our patients' information became inaccessible to anyone, including ourselves," the group says. "We have been assured that no patient's privacy has been compromised in any way. We are working through this issue with our I.T. provider and hope to resolve it as soon as possible."

A source close to the investigation said Friday the group was infected by the Hermes 2.1 ransomware.

Although the origin of the infection hasn't been discovered, it likely was a result of someone browsing a malicious website or clicking on a malicious link, the source says. The group also used a very old firewall, the source says, although workstations were running security software from a well-known vendor.

But luckily, all of the patient data was backed up and is now being restored, the source says. "It was a tricky process," the source says. Fortunately, patient data was only encrypted locally by the ransomware and not directly accessed or exfiltrated.

Although Melbourne Heart Group works out of Cabrini Hospital, the hospital says its own data storage and information systems weren't affected.

"No Cabrini data storage or patient related systems or operations have been impacted or compromised by this incident, and there has been no breach of hospital patient data," says Michael Walsh, Cabrini Health's chief executive.

Earlier this week, Australian Prime Minster Scott Morrison declined to lay blame for the cyberattacks against Parliament. The government continues to investigate. Some forensic evidence, however, was destroyed as a result of having to take quick remediation, officials said.

As in many nation-state attacks, China fell under suspicion. But on Friday, China Foreign Ministry spokesman Geng Shuang dismissed the suggestion that it was behind the attacks against Parliament, calling it "baseless speculation," the ABC reported.

Cybercrime , Cybercrime as-a-service , Finance & Banking

Street Value of 70,000 Cards on Joker's Stash Is $3.5 Million, Group-IB Says(euroinfosec) • February 22, 2019    Stolen Pakistani bank cards are being offered for sale on the Joker's Stash carder forum. (Source: Group-IB)

A notorious carder site is featuring a fresh batch of Pakistani banks' payment card data with an estimated street value of $3.5 million.

See Also: Live Webinar | Underestimated Risk & Overestimated Security: When All You Do Is React, it May Be Too Late

Moscow-based threat intelligence firm Group-IB says that in late January, it spotted the sale of nearly 70,000 cards on the cybercrime marketplace called Joker's Stash, which specializes in selling batches of stolen payment card data. This marks the second time in the past six months that a big batch of Pakistani bank card data has appeared for sale (see: Pakistan: Banks Weren't Hacked, But Card Details Leaked).

Group-IB says 96 percent of the new 69,189 bank cards being offered for sale are advertised as being issued by Pakistan's Meezan Bank, based in Karachi, the country's largest city.

Meezan Bank bills itself as being Pakistan's first and largest Islamic bank, offering a range of Shariah-compliant products and services. It has 600 branches in 159 cities. The bank didn't immediately respond to a request for comment on the card data that's appeared on Joker's Stash.

The headquarters of Pakistan's Meezan Bank in Karachi (Photo: Meezan Bank)

Group-IB said it saw two batches of Pakistani cards get posted to Joker's stash in the form of dumps advertised under the following names:

Pakistan-D+P-01: First offered for sale on Jan. 24, this included about 1,500 cards, most of which were issued by Meezan Bank. Pakistan-D+P-02: First offered for sale on Jan. 30, this dump contains 67,654 Pakistani bank cards. "The sellers marked the set as 'high valid' and unlike the first set, advertised the database on all major underground forums, such as Omerta, Crdclub [and] Enclave," Group-IB says. It adds that the card numbers were initially sold with no refunds possible, before the listing was updated to say buyers have three hours after purchase to receive a full refund for any card numbers that don't work.

The cards are being sold for a premium - $50 per card, above the $10 to $40 that is more often charged for bank cards on darknet forums, Group-IB says. "Pakistani banks' cards are rarely sold on underground card shops," the firm says. "This, and the fact that all the cards came on sale with PIN codes, explains the high price."

Sample of data being advertised on Joker's Stash (Source: Group-IB)

The appearance of so much Pakistani bank card data in one place is unusual, says Dmitry Shestakov, head of Group-IB's cybercrime research unit. "The scale, volume, frequency and connection to one institution contributes to the theory that the leak might be involved in a larger incident, potentially an advanced actor gaining access to card systems within Pakistan," he says.

Attack of the Cloned Cards

Fraudsters often use stolen payment card data to create cloned cards. Third parties, acting as money mules, may be hired to use those cards to fraudulently purchase and resell goods. Cards might also be used to withdraw cash from ATMs (see: Taiwan Sentences Money Mules in ATM Attacks).

Group-IB says some scammers also create dummy companies, use cloned cards to buy nonexistent goods from the companies, then withdraw the money in cash from the dummy companies' bank accounts.

Fraudsters have tended to favor payment cards issued in the U.S. or Canada, and to a lesser extent Western Europe. But security experts say fraud controls in these regions have been continuing to improve, enabling card issuers to more rapidly block fraud.

Banks in emerging markets, such as Pakistan, however, "frequently do not have adequate anti-fraud control," allowing attackers to perpetrate a number of different types of fraud, Group-IB says.

Late-2018 Dumps

The latest dumps of Pakistani payment card data to Joker's Stash follow earlier dumps, Group-IB says:

Oct. 26, 2018: 10,467 payment cards issued by smaller Pakistani banks posted for sale. Oct. 31, 2018: 11,795 cards issued by banks in Pakistan and others in the region posted. Early November 2018: 177,878 payment cards from a number of international banks offered for sale. Cards from major Pakistani banks, including Habib Bank, MCB Bank Limited and Allied Bank Limited, were part of the dump.

The State Bank of Pakistan responded to those data dumps via a statement it issued on Nov. 6, 2018, saying that none of the country's banks had been hacked. But in response to the payment card data breach, SBP says some banks did restrict the use of payment cards internationally, requiring approval from customers prior to any international transaction being approved.

Frequent Targets: POS Systems, ATMs

The appearance of fresh card data on Joker's Stash often sends banks and card issuers scrambling in an attempt to determine the origin of the data. Such dumps have sometimes offered the first clues that an organization was hacked, potentially by attackers having infected its point-of-sale systems with RAM-scraping malware, then exfiltrated massive quantities of payment card data (see: Fast-Food Chain Sonic Investigates Potential Card Breach).

Another potential target: Bank ATMs into which gangs have installed physical skimmers, aka "cutlets," that record magnetic card data and record video, allowing attackers to "read" victims' PIN codes (see: Cybercrime Gangs Advertise Fresh Jobs, Hacking Services).

Magecart at Work

Joker's Stash has continued to serve as the carder marketplace of choice for many cybercriminals, including some of the groups known as Magecart.

"Magecart is an umbrella term given to at least seven cybercriminal groups that are placing digital credit card skimmers on compromised e-commerce sites at an unprecedented rate and with frightening success," according to security firms RiskIQ and Flashpoint.

The firms say one of the more advanced Magecart gangs, known as Group 6, tends to only sell stolen card data on Joker's Stash. Group 6 has been tied to the breach of e-commerce site Newegg, as well as U.K. flagship carrier British Airways, which is owned by International Airlines Group.

Payment card data stolen from retailer Newegg by Magecart Group 6 appeared for sale on the notorious carder site Joker's Stash about a week after the attack was remediated.

'Formjacking' on the Increase

Security firm Symantec, in its Internet Security Threat Report, says hackers are increasingly using "formjacking" attacks that inject JavaScript into sites - aka digital skimming - to "steal credit card details and other information from payment forms on the checkout web pages of e-commerce sites."

The security firm estimates that 4,800 new websites fall victim to formjacking attacks each month.

"Requiring only a few simple lines of code loaded onto a website, formjacking represents a significant threat to online retailers or anyone who collects personally identifiable information from their customers via their website," Symantec's report says.

Group-IB says that on average, a total of 1.8 million new payment cards get offered for sale on carder sites each month.

Breach Notification , Data Breach , Data Loss

UW Medicine Notifying Nearly 1 Million Patients of Data Exposure(HealthInfoSec) • February 21, 2019    

A misconfigured database at UW Medicine in Washington state that left patient data exposed on the internet for several weeks resulted in a breach affecting 974,000 individuals.

See Also: Live Webinar | Underestimated Risk & Overestimated Security: When All You Do Is React, it May Be Too Late

UW Medicine says in a statement that on Dec. 26, 2018, it became aware of a vulnerability on a website server that made protected internal files available and visible by search on the internet on Dec. 4, 2018.

The mistake was discovered by a patient who was conducting a Google search for their own name and found a file containing their information. The patient reported this to UW Medicine, a Seattle, Washington-based academic medical system that includes several hospitals and a large physician practice plan.

UW Medicine is just the latest healthcare organization to report a breach involving misconfigured IT. Similar mishaps have been reported by many others, including breaches that have resulted in enforcement actions by federal and state regulators.

To help avoid incidents involving misconfigured IT, organizations should add a step to their change management processes - check af list of key security attributes to ensure they're still intact after a change is completed, says Keith Fricke, principle consultant at tw-Security. "Such a practice may even uncover that security controls were missing before the change," he notes.

Coding Error

The misconfigured database at UW Medicine was the result of a coding error when data was being moved onto a new server, a UW Medicine spokeswoman tells Information Security Media Group.

The organization is not offering free credit or ID monitoring services because the exposed files contained no Social Security numbers, patient financial information or medical records, the spokeswoman says.

The files contained protected health information that UW Medicine is legally required to track to, for example, comply with Washington state reporting requirements, the statement says. The exposed information included patients' names, medical record numbers, and a description and purpose of the information shared for regulatory reporting purposes.

"The database is used to keep track of the times UW Medicine shares patient health information that meets certain legal criteria," the statement says. The most common reasons involve situations where UW Medicine is required by Washington state law to share patient information with public health authorities, law enforcement and Child Protective Services, the organization notes.

"Another common example is when a researcher receives approval to access medical records to determine whether a patient may be eligible for a research study or to recruit participants. The researcher must document in the database when they access the medical record," the statement adds.

"When we learned of the exposure of the files to the internet, we took immediate steps to remove the information from the site and initiated appropriate measures to remove saved information from any third-party sites," UW Medicine says in the statement. "At this time, there is no evidence that there has been any misuse or attempted use of the information exposed in this incident."

UW Medicine notes that because Google had saved some of the files before Dec. 26, 2018, the institution worked with Google to remove the saved versions and prevent them from showing up in search results. All saved files were completely removed from Google's servers by Jan. 10, 2019, UW Medicine notes.

Federal Tally

Although UW Medicine notes that the incident has been reported to the Department of Health and Human Services, the breach has not yet been posted on the HHS Office for Civil Rights HIPAA Breach Reporting Tool website, which lists health data breaches affecting 500 or more individuals.

Once regulators confirm the details and add the incident to the website, it could be the largest health data breach reported so far in 2019.

Common Problem

Misconfigured databases, servers and other IT are a fairly common culprit in health data security incidents.

Some breaches involving misconfigurations have also resulted in hefty HIPAA settlements with OCR. For example, earlier this month, OCR slapped Cottage Health, which runs several California-based hospitals, with a $3 million settlement for two breaches involving misconfigured IT that impacted a total of 62,500 individuals.

One of those Cottage Health breaches, which impacted more than 5,000 individuals, occurred when a server was misconfigured following an IT response to a troubleshooting ticket, exposing unsecured electronic PHI on the internet.

Among OCR's findings during its investigation into the Cottage Health breaches, the agency says the entity failed to perform periodic technical and nontechnical evaluations in response to environmental or operational changes affecting the security of ePHI.

Besides the enforcement action by OCR, Cottage Health in 2017 reached a $2 million settlement with the California attorney general's office for the same two breaches Health Data Breaches Lead to $2 Million California Penalty).

In another incident reported last October, a coding error in a portal of the Employee Retirement System of Texas, which administers retirement benefits, including health insurance, for state workers, inadvertently allowed some users to view the information of others, potentially exposing information on nearly 1.25 million of its members.

Avoiding Mishaps

Misconfiguration incidents often occur because a change or an upgrade is only tested for user functionality, and security is not tested, notes Tom Walsh, president of tw-Security.

"Information security needs to be integrated into all phases of the change control and configuration management, including request, review, approval and implementation. This is to ensure that changes to the application or system do not introduce any additional vulnerabilities," he says.

"Regardless who is handling the change - vendor, internal IT staff, web master/developer, etc. - information security and privacy need to be involved."

No Simple Answer

Unfortunately, there is no simple way to completely prevent misconfiguration mishaps, such as the one at UW Medicine, says Mark Johnson of the consultancy LBMC Information Security.

"It highlights that the basics of configuration management, involving cybersecurity in that process, vetting and reviewing each change, and validating that the change was done correctly might have prevented this instance," he says.

"However, no technology or process will 100 percent prevent human error. These steps will reduce the likelihood of it - but not eliminate it. "

Some industry researchers predict that 80 percent of cloud data breaches will be due to customer misconfiguration, mismanaged credentials or insider theft, rather than cloud provider vulnerabilities, by 2020, Johnson says.

"Therefore, I believe it [misconfiguration] will become more common still due the complexity of the healthcare technical environment and the push to give patients greater access and accounting of their protected health information," he says.