Venerable SSH client PuTTY has received a pile of security patches, with its lead maintainer admitting to the The Register that one fixed a "'game over' level vulnerability".

The fixes implemented in PuTTY over the weekend include new features plugging a plethora of vulns in the Telnet and SSH client, most of which were uncovered as part of an EU-sponsored HackerOne bug bounty.

Version 0.71 of PuTTY includes fixes for:

A remotely triggerable memory overwrite in RSA key exchange, which can occur before host key verification Potential recycling of random numbers used in cryptography On Windows, hijacking by a malicious help file in the same directory as the executable On Unix, remotely triggerable buffer overflow in any kind of server-to-client forwarding multiple denial-of-service attacks that can be triggered by writing to the terminal

Lead maintainer and "benevolent dictator" of all things PuTTY Simon Tatham told El Reg that "of all the things found by the EU bug bounty programme, the most serious was vuln-dss-verify. That really is a 'game over' level vulnerability for a secure network protocol: a MITM attacker could bypass the SSH host key system completely."

"Luckily," he continued, "it never appeared in a released version of PuTTY: it was introduced during work to rewrite the crypto for side-channel safety, and spotted only a few weeks later by a bug-bounty participant, well before the release came out. So the EU protected almost everybody from that one."

Another one of the patched vulns was PuTTY not enforcing minimum key lengths during RSA key exchange, creating an integer overflow situation. Tatham explained that this "could be triggered by a server whose host key hasn't yet been authenticated. So you'd not only have been at risk from servers you actually trust turning out to be untrustworthy; you were also at risk from anyone who could MITM your connection to such a server, because the usual mechanism that protects you from MITM has not yet kicked in at that stage in the connection."

The other major vuln patched in v0.71 involved planting a malicious help file in the PuTTY root directory, something Tatham said wouldn't have applied to those using the regular Windows .msi installer.

Opened in January, the EU review of PuTTY paid out more than $17,500 and was funded by the EU Directorate-General for Informatics, which describes itself as "providing digital services that support other Commission departments". The bounty formed a wider part of the EU's ongoing Free and Open Software Audit, or FOSSA. ®

Sponsored: Becoming a Pragmatic Security Leader

Endpoint Security

Aaron Lint of Arxan on How Application Telemetry Can Guide Security Strategies(APACinfosec) • March 18, 2019     Aaron Lint, chief scientist and vice president of research, Arxan

Getting a telemetry stream back from applications can help organizations to "adjust much more quickly to see how practical attacks are happening on the endpoint and then go to mitigate," says Aaron Lint of Arxan.

See Also: Webinar | The Future of Adaptive Authentication in Financial Services

In a video interview with Information Security Media Group at RSA Conference 2019 in San Francisco, Lint discusses:

Application protection and shielding; Recommendations for improving application security; How application telemetry is changing the game.

Lint is chief scientist and vice president of research at Arxan.

Cybercrime , Cyberwarfare / Nation-state attacks , Fraud Management & Cybercrime

Nation Flaunts Sanctions via Cybercrime Efforts• March 18, 2019    

North Korea's cybercrime capabilities have given the country the ability to flaunt international sanctions by allowing the regime to steal millions in currency not only from banks but also from cryptocurrency exchanges, according to a report from the United Nation's Security Council.

See Also: Live Webinar | Passwords: Here Today, Gone Tomorrow? Be Careful What You Wish For.

Between January 2017 and September 2018, the Democratic People's Republic of Korea carried out at least five successful attacks against cryptocurrency exchanges in Asia, resulting in the theft of $571 million in currency, the report concludes.

The UN report also notes North Korea's ability to attack banks across the world, including the Bangladesh Bank heist that targeted the bank's SWIFT system account at the Federal Reserve Bank in New York and then transferred about $81 million to accounts in the Philippines, where the money was then laundered.

Other international banks targeted by North Korean cyberattacks include the Banco de Chile and Cosmos Bank in India, according to the report, which the UN released March 14. Between 2015 and 2018, the country targeted banks in Europe, Asia, the United States and South America, resulting in the theft of over $1 billion, the report adds.

"Cyberattacks by the Democratic People's Republic of Korea to illegally force the transfer of funds have become an important tool in the evasion of sanctions and have grown in sophistication and scale since 2016," according to the UN report.

Evading Sanctions

The report, written by a panel of UN security experts, looks at how North Korea is evading international sanctions through a variety of means while keeping its nuclear and ballistic missile capabilities intact. One reason is that the country and its agents keep finding ways to fill the country's coffers through numerous illegal activities, including cyberattacks.

As the report states: "The panel notes a trend in the Democratic People's Republic of Korea's evasion of financial sanctions of using cyberattacks to illegally force the transfer of funds from financial institutions and cryptocurrency exchanges. According to a member state, 'cyberspace is used by the DPRK as an asymmetric means to carry out illicit and undercover operations in the field of cybercrime and sanctions evasion. These operations aim to acquire funds through a variety of measures in order to circumvent the sanctions.'"

North Korea's APT Groups

At the heart of these schemes are a network of advanced persistent threat groups that work with or are directly sponsored by the North Korean regime and carry out various cyberattacks, according to the report. Some of these groups share ties, while others work independently, the report found.

For instance, the most well-known of these groups, Lazarus - which also goes by the name Hidden Cobra among other aliases - is mostly focused on disruptive campaigns, which include the well-known Sony Pictures hack of 2014 as well as the Wannacry ransomware attacks of 2017.

In September 2018, U.S. prosecutors charged Park Jin Hyok of North Korea with being part of Lazarus and alleged that he was one of the main architects of WannaCry and other attacks, including those against Sony and Bangladesh Bank. While North Korea and the U.S. do not have a formal extradition treaty, which means that it's unlikely that Hyok will ever face trial, the nearly 200-page indictment offers a window into how the APT group works, what tools its uses as part of attacks and some of the motivation behind these various schemes.

Other APT groups, such as APT 38 and Temp.Hermit, overlap, with each of these groups using some of the same toolsets as part of their various cyberattack campaigns.

APT 38 and Temp.Hermit are involved with various financial schemes, but Temp.Hermit also launches espionage campaigns, according to the UN report. APT 38, which security analysts began studying in late 2018, has been involved in several high-profile banking attacks targeting the SWIFT systems of banks in Africa and Asia, according to a recent analysis by FireEye.

Connecting the Dots

There appears to be a direct line between North Korea's attacks against banks and the country's new-found interest in attacking cryptocurrency, which helps to further hide its activities, says Mukul Kumar, the CISO and vice president of cyber practice at Cavirin, a Santa Clara, California-based security company.

"North Korea's attacks on cryptocurrency exchanges are a logical escalation from their earlier attacks on other financial institutions, since, as the report points out, the digital trail is more difficult to trace," Kumar tells Information Security Media Group. "What is important to note is that the U.S. is not just sitting back and hoping sanctions have an impact. Under the administration's new guidelines, the U.S. can take additional offensive actions to counter future attacks. I see this change in strategy as critical to ensuring our national cyber posture."

As part of the UN report released last week, the panel noted that it's recommending several guidelines to help stop North Korea avoid sanctions. To help stop cyberattacks, it recommends, among other steps:

U.N. member states need to be aware of North Korea's ability to use cyberattacks to circumvent sanctions by illegally generating revenue. Member states need to share information about North Korea's capabilities not only among themselves, but with banks and other financial institutions. The UN Security Council, when drafting financial sanctions measures, needs to take into account North Korea's ability to wage cyberattacks to circumvent sanctions.

Artificial Intelligence & Machine Learning , Next-Generation Technologies & Secure Development

Sam Curry of Cybereason on When to Trust ML Systems(APACinfosec) • March 18, 2019     Sam Curry, CSO, Cybereason

Machine learning systems adapt their behavior on the basis of a feedback loop, so they can overlearn and develop blind spots, which if not understood by practitioners can lead to dangerous situations, says Sam Curry, chief security officer at Cybereason.

See Also: 10 Incredible Ways You Can Be Hacked Through Email & How To Stop The Bad Guys

"Don't just say you are using ML. Tell me how and where you are applying it and then how you are training it," he says. "Because that deeper understanding is what's going to let me know when to trust it and when not to."

In a video interview with Information Security Media Group at RSA Conference 2019 in San Francisco, Curry discusses:

The promise and dangers of AI and ML; The Increase in use of automation and analytics by threat actors.

Curry, chief security officer at Cybereason, has more than 20 years of IT security industry experience. Previously, Curry served as chief technology and security officer at Arbor Networks. He also spent more than seven years at RSA, the security division of EMC, in a variety of senior management positions.

3rd Party Risk Management , Cloud Security , Data Breach

Incident Highlights the Importance of Vendor Risk Management(HealthInfoSec) • March 18, 2019    

A medical software vendor's unsecured fax server leaked patients' medical information, highlighting yet again the importance of vendor risk management.

See Also: Webinar | The Future of Adaptive Authentication in Financial Services

Sacramento, Calif.-based Meditab Software Inc., which provides fax services and other services for healthcare providers, leaked the patient records through a fax server that was hosted by a subdomain of one of its affiliate companies, MedPharm Services, based in Puerto Rico, according to a March 17 report on news site TechCrunch.

Meditab's website says the privately held company provides software to over 2,200 clients from over 35 medical specialties.

TechCrunch reports that SpiderSilk, a Dubai-based cybersecurity firm, made the discovery that the exposed fax server was running a Elasticsearch database with over 6 million records since its creation in March 2018.

As of Monday, the incident did not appear on Department of Health and Human Service's HIPAA Breach Reporting Tool website that lists major health data breaches. It's not yet clear how many records were potentially exposed or for how long.

Because the server allegedly had no password, anyone could read the transmitted faxes in real time, SpiderSilk told TechCrunch. The faxes contained a variety of information, including names, addresses, medical information, prescription information and, in some cases, Social Security numbers and payment data, the news site reports. And apparently none of the data was encrypted, it states.

Meditab Response

Angel Marrero, general counsel at Meditab and MedPharm Services, confirms to Information Security Media Group that MedPharm hosted the unsecured fax server on its subdomain.

Marrero says the companies cannot yet disclose how long the fax server was left unsecured, the number of individuals who were affected or how the incident occurred because the incident is under review for the scope of the potential exposure. "I can confirm that the fax server was taken down immediately after we were notified," he says.

MedPharm Services and Meditab Software will comply with all required notification requirements under federal and state regulations, he adds.

"We are conducting a comprehensive security check of all our portals and services to make sure they are secured," Marrero says. "In addition, we will be implementing additional penetration testing as part of our development and testing methodology. Lastly, the management team has already conducted discussions to implement a bug bounty program so that security researchers can report any flaws they find directly and securely."

Marrerro adds: "We can assure all our customers and their patients that we will do everything in our power to make sure this never happens again."

Skipping the Basics

The apparent data exposure stemming from an unsecured fax server is troubling for a variety of reasons, says Rebecca Herold, president of Simbus, a privacy and cloud security services firm, and CEO of The Privacy Professor consultancy.

"I'm coming across increasingly more B2B online services organizations that are simply choosing not to implement basic information security controls on their servers," she says.

Often these vendors will skip implementing necessary controls "with the expressed opinion that they believe it is more important to 'be agile' than to perform long-time known and necessary due diligence data and systems security actions and implement the necessary protections," she says. "Too many are simply willing to gamble with their clients' data security that nothing will happen."

The security of fax servers, as well as fax machines, is often overlooked, she adds.

"I've had business owners, and many start-up managed services providers, tell me, 'No one uses faxes anymore. That is a waste of our time to put attention to fax security if they are not used.' They push forward with that flawed opinion, despite the advice of those of us who have actually been working, and continue to work with, a wide range of businesses of all sizes that regularly use fax transmissions as part of their business processing."

The alleged lack of a password to protect the fax server and alleged absence of encryption are particularly concerning, Herold says.

"The breached organizations in this case will likely never know how many others may have obtained all that sensitive patient data," she says. "The crooks using it for fraud and other crimes, and selling it to other criminals, are the only ones who will have any type of insights into the answer to that question."

Lingering Problems

Despite the move to electronic health records, as well as growing adoption of the Direct protocol for point-to-point encrypted healthcare messaging, many healthcare providers in the U.S., especially smaller entities, still rely on faxes for exchanging patient information and sending prescriptions to pharmacies.

The U.K. in January banned National Health System healthcare trusts from buying fax machines, and faxes will be phased out by March 31, 2020, in favor of more secure methods of communication, including secure email, according to a statement issues last December by Matt Hancock, the U.K's secretary of state for health and social care.

Privacy attorney David Holtzman of the security consultancy CynergisTek says the Meditab mishap is a prime example of the risks involving vendors.

"This incident has little to do with the prevalence in the use of fax machines in healthcare. The root cause of this event was that the cloud computing vendor did not secure their servers, resulting in exposing the data to the internet," he says. "This represents a fundamental failure to practice minimum information security practices. We have seen these incidents over and over again with cloud-based medical transcription vendors and healthcare billing services."

Other Vendor Mishaps

Many other vendors have also been implicated in security breaches involving misconfigured servers.

For instance, last November, the New Jersey state attorney general office signed a $200,000 settlement with Best Medical Transcription for a 2016 breach involving the misconfiguring a server that publicly exposed protected health information - including the names and medical diagnoses of more than 1,600 patients treated by Marlton, New Jersey-based Virtua Medical Group.

Healthcare practice Virtua Medical Group and its vendor Best Medical Transcription each signed settlements last year with New Jersey's attorney general for a breach involving an unsecured server.

The New Jersey attorney general's office last April also signed a nearly $418,000 settlement with Virtua Medical Group.

The cases against Best Medical Transcription and Virtua Medical Group alleged violations of HIPAA and the New Jersey Consumer Fraud Act.

Healthcare providers cannot rely on a cloud computing vendors' claims they are "HIPAA compliant," Holtzman says.

"It's crucial for healthcare organizations to have a vendor security management program in place to verify that business associates are continuously safeguarding the information security of PHI and PII," he says. "Don't place a high level of trust in a certification that is the result of a one-and-done cybersecurity assessment."

Good vendor management practices call for a covered entity to work with their contractors to employ a risk-based strategy to assess the potential for compromise of data, Holtzman stresses. "Organizations must aggressively pursue getting answers to questions about how their e-PHI will be safeguarded."