Log inRegister

Fraud News

ESET eggheads have shed more light on the Unified Extensible Firmware Interface (UEFI) rootkit being used by the Kremlin's Fancy Bear hacking crew.

Dubbed Lojax, the software nasty embeds itself within the motherboard firmware of infected Windows PCs, allowing it to run as soon as the machine is powered up or reset, allowing it to ideally spy on the user and evade detection by the operating system or any antivirus tools. The firmware executes at the lowest levels, underneath OS kernels and apps, with full system access.

While ESET blew the whistle on Lojax with a disclosure back in September, the nitty-gritty of how the malware operates was withheld until the annual Computer Chaos Club conference at the end of December, where researcher Frederic Vachon described in a presentation how the UEFI-based rootkit is able to hide in modern firmware. ESET was able to get its hands on a copy of Lojax when one of its customers' computers picked up the cyber-nasty.

In short, Lojax – a modified version of the legitimate Lojack anti-theft software – starts out as a poisoned application delivered via spear phishing emails that, when run by hoodwinked victims, unpacks and runs code that hijacks a vulnerable driver, which is loaded by the UEFI firmware during startup, to install the rootkit in flash memory.

UEFI has a mechanism called DXE that locates and runs device drivers needed to get a machine going, before the OS is booted. Lojax tampers with one of the loaded drivers so that it flips the switch on the firmware's write protection, disabling the safeguard and allowing the chips' contents to be overwritten. At that point, the malware can inject its rootkit into the firmware so that it is run following a subsequent power or reset cycle.

So, the driver is fiddled with so that it unlocks the firmware during next boot, then Lojax alters the flash chip contents to inject its rootkit, and then on next boot, the spyware is up and running. This is because the firmware is expected to maintain its own security.

"The chipset exposes write protection mechanisms that need to be properly protected by the firmware," he explained. "Because there is no such thing as BIOS write protection by default, it is the job of the firmware to do that."

In order to turn off the firmware's write protection, Lojax exploits a known race-condition in Intel's flash memory controllers by repeatedly enabling BIOS updates and attempting to write to flash memory before the motherboard software steps in and automatically disables updates.

Once that is done, Lojax is able to write the full rootkit on to the UEFI firmware, which ensures the malware is installed and run during the operating system startup, making it nearly impossible to remove by anything short of a complete reflash of the board's SPI memory.

Fortunately, Vachon notes, vendors themselves can protect against the attack by fixing and patching the driver vulnerabilities, and/or enabling Secure Boot. This will cause the Lojax malware to automatically abort installation attempts. Secure Boot cryptographically ensures the firmware contents isn't altered. Also, not opening emailed applications as a system administrator helps a lot: the rootkit installer requires sysadmin access. However, it could exploit privilege escalation holes to gain admin control, so the real solution is enabling Secure Boot in the BIOS settings and set a password or other lock to prevent any changes.

"The tool only works if the platform is misconfigured," he explained. "If firmware vendors would have done their job correctly here, this tool would have failed at flashing the firmware, it's a great example of how [important] firmware security is." ®

The latest version of NRSMiner has been spotted in recent attacks across Asia which are compromising systems which have not been patched against the well-known EternalBlue exploit.

According to cybersecurity researchers from F-Secure, unpatched machines in Asia -- centered in Vietnam -- are being infected with the latest version of NRSMiner, malware designed to steal computing resources in order to mine for cryptocurrency.

Starting mid-November last year, the latest wave of attacks is also actively spreading across countries including China, Japan, and Ecuador.  

The new version of the malware relies on the EternalBlue exploit to spread through local networks.

See also: Chinese hackers tap into EU diplomatic communications network

EternalBlue is an SMBv1 (Server Message Block 1.0) exploit which is able to trigger remote code execution (RCE) attacks via vulnerable Windows Server Message Block (SMB) file-sharing services. The security flaw responsible for the attack, CVE-2017-0144, was patched by Microsoft in March 2017 and yet many systems have still not been updated and remain vulnerable to attack.

It was over a year ago that EternalBlue first hit the headlines as the world was gripped by the spread of WannaCry, a form of ransomware which struck organizations worldwide including the UK's National Health Service (NHS), FedEx, Renault, and global banks. WannaCry, linked to North Korean hackers and the Lazarus group, used EternalBlue as an infection vector in order to spread.

Following the compromise of hundreds of thousands of PCs during the WannaCry outbreak, attackers then leveraged the same flaw to spread another form of ransomware known as Petya.

It is believed EternalBlue was originally the work of the US National Security Agency (NSA)'s Equation Group, after the examination of the tool was made possible by its public release as part of a cache published online by the Shadow Brokers hacking group.

Read on: Why the 'fixed' Windows EternalBlue exploit won't die

NRSMiner makes use of the XMRig Monero miner to hijack an infected system's CPU to mine for the Monero (XMR) cryptocurrency. NRSMiner is also able to download update modules, refresh older versions of the malware present on a machine, and delete files and services installed by previous installs.

The latest variant of NRSMiner infects new machines either through old versions of the same malware by forcing a download of an updater module into system's /temp folder or by relying on EternalBlue.

The exploit is spread through Wininit.exe, which upon execution will decompress files including one named svchost.exe, otherwise known as EternalBlue 2.2.0. Wininit.exe will then scan TCP port 445 for any other available -- and potentially vulnerable -- systems before executing the exploit.

TechRepublic: Website security paradox: What's a small business to do?

If successful, the DoublePulsar backdoor is then executed via a file called spoolsv.exe. DoublePulsar, a kernel payload, hooks x86 and 64-bit systems and makes use of ports to open up infected machines to additional malware payloads, as well as forge a path to a command-and-control (C&C) server for the purposes of information theft and the execution of commands by C&C operators.

This backdoor is used in this scenario to both maintain persistence on an infected machine and to implement the Snmpstorsrv service, which is able to continually scan for new, vulnerable systems.

CNET: Malware suspected of hobbling several newspapers' production

This is not the only case of EternalBlue being used for the purpose of cryptojacking. Other campaigns include Wannamine, a cut-and-paste coding effort which has still been able to compromise machines worldwide, and RedisWannaMine, which targets Windows servers.

Indicators of compromise have been listed by F-Secure.

Previous and related coverage

Cybercrime , Data Breach , Fraud

Ex-Cybercriminal Brett Johnson Discusses Life as a Keynote Speaker(@nickster2407) • January 2, 2019     Brett Johnson, Consultant, Anglerphish

It's good to be legal, according to Brett Johnson, formerly America's most wanted cybercriminal, as he reflects on a year of his experiences speaking at ISMG Summits.

See Also: Key Drivers to Enable Digital Transformation in Financial Services

In a video interview at Information Security Media Group's recent Breach Prevention Summit in Washington, Johnson discusses:

His takeaways from a year of ISMG Summit keynotes; Taking down a romance fraud at the Chicago ISMG Summit; What's in store for 2019.

Johnson, referred to by the United States Secret Service as "The Original Internet Godfather" has been a central figure in the cybercrime world for over 20 years. Today, Johnson works as a security consultant and public speaker.

Image: Carol M. Highsmith

On Monday, New Year’s Eve, a hacker group announced it had breached a law firm handling cases related to the September 11 attacks, and threatened to publicly release a large cache of related internal files unless their ransom demands were met.

The news is the latest public extortion attempt from the group known as The Dark Overlord, which has previously targeted a production studio working for Netflix, as well as a host of medical centres and private businesses across the United States. The announcement also signals a slight evolution in The Dark Overlord’s strategy, which has expanded on leveraging the media to exert pressure on victims, to now distributing its threats and stolen data in a wider fashion.

In its announcement published on Pastebin, The Dark Overlord points to several different insurers and legal firms, claiming specifically that it hacked Hiscox Syndicates Ltd, Lloyds of London, and Silverstein Properties.

“Hiscox Syndicates Ltd and Lloyds of London are some of the biggest insurers on the planet insuring everything from the smallest policies to some of the largest policies on the planet, and who even insured structures such as the World Trade Centers,” the announcement reads.

It is unclear what exact files the group has stolen, but it is trying to capitalize on conspiracy theories around the 9/11 attacks.

“We'll be providing many answers about 9.11 conspiracies through our 18.000 secret documents leak,” the group tweeted on Monday.

Got a tip? You can contact this reporter securely on Signal on +44 20 8133 5190, OTR chat on This email address is being protected from spambots. You need JavaScript enabled to view it., or email This email address is being protected from spambots. You need JavaScript enabled to view it..

A spokesperson for the Hiscox Group confirmed to Motherboard that the hackers had breached a law firm that advised the company, and likely stolen files related to litigation around the 9/11 attacks.

“The law firm’s systems are not connected to Hiscox’s IT infrastructure and Hiscox’s own systems were unaffected by this incident. One of the cases the law firm handled for Hiscox and other insurers related to litigation arising from the events of 9/11, and we believe that information relating to this was stolen during that breach,” the spokesperson wrote in an email.

“Once Hiscox was informed of the law firm’s data breach, it took action and informed policyholders as required. We will continue to work with law enforcement in both the UK and US on this matter,” they added. Lloyds of London did not respond to a request for comment.

The hacking group published a small set of letters, emails and other documents that mention various law firms, as well as the Transport Security Administration (TSA) and Federal Aviation Administration (The TSA could not provide a statement in time for publication, and the FAA told Motherboard in an email it was investigating.) Those documents themselves appear to be fairly innocuous, but the group says it may release more.

In its extortion note, The Dark Overlord included a link for a 10GB archive of files it allegedly stole. The group also provided a link to this archive to Motherboard before publishing its announcement. The cache is encrypted, but the hackers are threatening to release the relevant decryption keys, unlocking different sets of files at a time, unless the victims pay the hackers an undisclosed ransom fee in Bitcoin.

“Pay the fuck up, or we're going to bury you with this. If you continue to fail us, we'll escalate these releases by releasing the keys, each time a Layer is opened, a new wave of liability will fall upon you,” the extortion note reads.

The Dark Overlord is also claiming to be offering to sell the data on a dark web hacking forum, and is attempting to blackmail individuals who may be included in the documents themselves.

“If you're one of the dozens of solicitor firms who was involved in the litigation, a politician who was involved in the case, a law enforcement agency who was involved in the investigations, a property management firm, an investment bank, a client of a client, a reference of a reference, a global insurer, or whoever else, you're welcome to contact our e-mail below and make a request to formally have your documents and materials withdrawn from any eventual public release of the materials. However, you'll be paying us,” the group’s post reads.

As The Dark Overlord’s announcement notes, the breach itself was previously reported in vague terms by a specialist legal publication, and Hiscox Group pointed Motherboard to the firm’s own April 2018 announcement of a data breach.

“Hiscox recently learned of an information security incident affecting a specialist law firm in the US that provided advice to Hiscox or its policyholders on some of its US commercial liability insurance claims. The incident involved illegal access to information stored on the law firm’s server, which may have included information relating to up to 1,500 of Hiscox’s US-based commercial insurance policyholders,” that earlier announcement reads.

Subscribe to our new cybersecurity podcast, CYBER.

3rd Party Risk Management , Cybersecurity , Endpoint Security

Co-Developed with Healthcare Sector Coordinating Council, Designed for Organizations of All Sizes(HealthInfoSec) • January 2, 2019    HHS Publishes Guide to Cybersecurity Best Practices

With the aim of helping healthcare entities of all sizes improve their cybersecurity, the Department of Health and Human Services has issued a four-volume publication of voluntary best practices.

See Also: Key Drivers to Enable Digital Transformation in Financial Services

The authors of the publication note that the document "does not create new frameworks, rewrite specifications, or 'reinvent the wheel.' We felt that the best approach to 'moving the cybersecurity needle' was to leverage the NIST Cybersecurity Framework, introducing the framework's terms to start educating health sector professionals on an important and generally accepted language of cybersecurity and answering the prevailing question: 'Where do I start, and how do I adopt certain cybersecurity practices?'"

The goal of the guidance is to aid healthcare entities - regardless of their current level of cyber sophistication - in bolstering their preparedness to deal with the ever-evolving cyber threat landscape.

"I spend a lot of time in healthcare providers that run the gamut in size and security maturity and still the top two questions are either: 'Where do I start?' or 'What do I do next, now that this part is done,'" says former healthcare CIO David Finn, an executive vice president at security consulting firm CynergisTek.

"The days of small providers not knowing what to do or large providers thinking they've done all they need to do are over," adds Finn, who was a member of a federal cyber task force that also contributed to the document .

HHS notes in a statement that the "Health Industry Cybersecurity Practices: Managing Threats and Protecting Patients" document is the culmination of a two-year effort involving more than 150 cybersecurity and healthcare experts from industry and the government under the Healthcare and Public Health Sector Critical Infrastructure Security and Resilience Public-Private Partnership.

The creation of the publication was in response to a mandate under the Cybersecurity Information Sharing Act of 2015 to develop "practical cybersecurity guidelines to cost-effectively reduce cybersecurity risks for the healthcare industry," HHS notes.

Top Issues

HHS Deputy Secretary Eric Hargan notes in the document that experts contributing to the guidelines determined that it was "not feasible" to address every cybersecurity challenge across the large and complex U.S. healthcare industry.

"Therefore, it focused on the five most prevalent cybersecurity threats and the 10 cybersecurity practices to significantly move the needle for a broad range of organizations within our sector," Hargan says.

Erik Decker, University of Chicago Medicine chief security and privacy officer - who co-led the effort to create the new document as a member of Health Sector Coordinating Council - tells Information Security Media Group that he hopes the new HICP document will help improve cybersecurity across the healthcare industry. "It provides practical, actionable and measurable cybersecurity steps to help mitigate notable cyber threats our industry faces," he says.

imageErik Decker, co-lead of new HICP document effort and University of Chicago Medicine chief security and privacy officer

The document "was written to be a 'how to' guide on helping mitigate salient cybersecurity threats our industry faces while also leveraging all the existing frameworks, standards and controls already in place," says Decker, who is also advisory board chairman of the Association for Executives in Healthcare Information Security, a CISO group within the College of Healthcare Information Management Executives.

"We purposefully did not want to create a new framework or set of controls, but rather augment what already exists. It maps back to other NIST Special Publications as well as HIPAA and other regulatory guidance from the Centers of Medicare and Medicaid Services, the Office for Civil Rights, and the Food and Drug Administration. It's a pretty comprehensive index that will help organizations jump right in without having to first be scholars of all off the great cyber guidance that exists already."

'Best Thinking'

The document's guidelines "reflect the best thinking of more than 150 experts from the healthcare and security industries and government about how hospital systems and other healthcare organization should manage enterprise cyber risk," Greg Garcia, executive director of cybersecurity for the Healthcare and Public Health Sector Coordinating Council, tells ISMG.

"The practices, mapped to the NIST Cybersecurity Framework, are scalable and flexible, and we believe that if every healthcare organization adopts these practices over time, we will see uniform improvement in our collective cyber preparedness and resilience," Garcia says.

The practices spelled out in the guidance are tiered for small, midsize and large organizations, he notes. "But it is clear that small community hospitals that have the least expertise and resources to manage cybersecurity even at the most fundamental level can look to [the guidelines] as the place to start, in language that is tailored to the unique needs of healthcare and patient safety."

Four Volumes

The publication's four volumes include a main document that discusses the current cybersecurity threats facing the healthcare industry. The threats highlighted include email phishing attacks; ransomware attack; loss or theft of equipment or data; insider, accidental or intentional data loss; and attacks against connected medical devices that may affect patient safety.

That first volume sets forth a call to action for the healthcare industry, especially executive decision makers, with the goal of raising general awareness of the issue, the document notes.

The publication also includes two technical volumes - the first for smaller healthcare organizations and the second for midsize to large healthcare organizations.

The technical volumes are organized according to the top 10 most effective cybersecurity practices, as identified by the HHS Cyber Task Force, which in June 2017 issued a report with more than a 100 recommendations for how the healthcare sector can improve its cybersecurity posture.

Those 10 top best practices spotlighted in the new HHS document include the use of:

E-mail protection systems, including multifactor authentication for remote email access; Endpoint protection systems, including micro-segmentation and virtualization strategies; Access management, such as federated identity management Data protection and loss prevention, including mapping of data flows; Asset management, such as integration with network access controls; Network management, including anomalous network monitoring and analytics; Vulnerability management, such as penetration testing; Incident response, such as deploying deception technologies; Medical device security, including vulnerabilities management; Cybersecurity policies, such as defining the organization's position on the use of personal devices or bring-your-own-device.

The fourth volume is an appendix that provides resources and templates that organizations can leverage to assess their cybersecurity posture, as well to develop policies and procedures.

Top Tips

So, what are the some of the most helpful tips offered by the publication?

"One area that stands out is its attention to supply chain and vendor management - how to procure equipment and technology from vendors with cybersecurity requirements in mind," Garcia notes.

Finn, a member of the HHS cyber task force, has high hopes for the new publication.

The four-volume document "will absolutely help improve cybersecurity in the health industry," he predicts. "If the HHS Task Force report provided an overview and high-level plan to start the industry moving, this series provides the vehicle, gassed up and ready to roll," he says.

"The game-changer - or game-starter - is this: This document sets forth a common set of voluntary, consensus-based, and industry-led guidelines, best practices, methodologies, procedures and processes to achieve three core goals," Finn says.

Those goals include cost-effectively reducing cyber risks for a range of healthcare organizations; supporting the adoption and implementation of document's recommendations; and ensuring on an ongoing basis that the document's content is actionable, practical and relevant to healthcare stakeholders of every size and resource level.

Dale Nordenberg, M.D., executive director at the Medical Device Innovation Safety & Security consortium, says he's also hopeful that the document can assist healthcare sector entities.

"Overall it's pretty high level resource," says Nordenberg, who worked on the document as a member of the health sector coordinating council. "The document is unique because its target audience is the front line of healthcare delivery and its emphasis on patient protection. The breadth and depth of the technical content is tuned for optimal effect of healthcare systems at the point of care," he says. "Maybe it will help some front-line people see things in new light and help them advance."

Looking Ahead

In addition to this publication, Garcia notes that HHS and the health sector coordinating council "will soon be releasing medical technology and health IT product security development guidelines that will cross-reference with the newly released HICP guidelines." (See New Effort to Draft Medical Device Cybersecurity Guidance).

"The HICP and medical tech security guidelines express what hospital systems should expect from their technology providers and what medical technology companies will hold themselves accountable for as a commitment to their customers and patient safety," Garcia notes.

) • January 2, 2019     15 Minutes   

Payment card data continues to be a prime target for fraudsters in the U.S. even though the country has almost completed the transition to EMV chip cards. The U.S. Payments Forum is working to bring together stakeholders to mitigate card fraud online and offline.

"The U.S. Payments Forum has really served two roles, and we anticipate in 2019 we are going to continue in that area," Randy Vanderhoof, director of the forum, says in an interview with Information Security Media Group. "One is to raise the level of education and information about these new technologies and standards. But more important is to bring together the stakeholders that are represented that have to implement these technologies - particularly the payment brands, the issuers, the merchants, the processors and all of the technology parties that operate in between them. They all need to have a seat at the table to discuss ways in which this technology is going to operate, because significant investments are required, as well as time and resources."

In this interview (see audio link below photo), Vanderhoof discusses:

Initiatives such as EMV 3DS that are designed to improve online and mobile payment authentication; Coordination among standards bodies, such as W3C, SRC and the FIDO Alliance; Contactless payments and chip card implementation trends for 2019.

Vanderhoof is director of the U.S. Payments Forum, formerly the EMV Migration Forum, a cross-industry body focused on supporting the introduction and implementation of EMV chip and other new and emerging technologies that protect the security of payment transactions in the United States.

  1. Privacy International Hits Out At Facebook Tracking
  2. The Worst Hacks Of 2018
  3. Suspected Ransomware Outbreak Disrupts US Newspapers
  4. The Critical Importance of Data Integrity

Page 321 of 351