Breach Response , Cyberwarfare / Nation-state attacks , Data Breach

Production of newspapers owned by Chicago-based Tribune Publishing have been disrupted after malware began infecting the company's publishing and printing systems.

See Also: Third-Party Cyber Risk Management - A Data-Driven Approach

Multiple sources quoted by Tribune newspapers have suggested that the malware infection, which began late on Thursday, involved ransomware known as Ryuk, which may tie to North Korean operators. But security experts say it's far too soon to label Tribune's ransomware outbreak as anything more than an opportunistic infection, and note that anyone can potentially obtain and use malware, irrespective of their identity, political affiliation or other motivations (see Stop the Presses: Don't Rush Tribune Ransomware Attribution).

Tribune Publishing says the malware infection, which it discovered on Friday, compromised no financial information and had no impact on its websites, but did disrupt systems that it uses to publish and print its newspapers. All of its newspapers were affected.

"This issue has affected the timeliness and in some cases the completeness of our printed newspapers," Tribune Publishing spokeswoman Marisa Kollias said in a statement released on Saturday, the Chicago Tribune reported. "Our websites and mobile applications however, have not been impacted."

Kollias said the company is "making progress" with restoring systems. "There is no evidence that customer credit card information or personally identifiable information has been compromised," she said.

Formerly known as Tronc, Tribune Publishing owns the Chicago Tribune, as well as Chicago suburban newspapers Lake County News-Sun and Post-Tribune; Los Angeles Times; The Baltimore Sun; the New York Daily News; Hartford Courant; Orlando Sentinel; the Capital Gazette in Annapolis, Maryland; The Morning Call in Allentown, Pennsylvania; and in Virginia, the Daily Press in Newport News, and The Virginian-Pilot in Norfolk.

The Chicago Tribune reported that its Saturday edition had been published "without paid death notices and classified ads," due to the malware infection, and that some Saturday newspapers in other markets were delivered in a "slimmed-down version" on Sunday.

The Los Angeles Times and San Diego Union-Tribune also reported experiencing disruptions due to the malware, resulting in delays in home deliveries, or no deliveries at all. Tribune sold both newspapers to biotech billionaire Patrick Soon-Shiong for $500 million in June. But as part of a transition arrangement, it's continuing to support the newspapers, including their printing operations.

"Because of a major computer breakdown that affected our printing and deliveries, many of you did not receive your copy of Saturday's Los Angeles Times," Norman Pearlstine, executive editor of the newspaper, and Chris Argentieri, its chief operating officer, said in an apology posted on Saturday.

"We are also aware that many of you have been unable to report your missed delivery," they wrote. "We apologize for the inconvenience and thank you for your patience as we actively work to resolve these issues and restore timely service to our customers."

The newspaper distribution problems also affected the west coast editions of The New York Times and The Wall Street Journal, which share the same printing presses.

Tribune said it has alerted the FBI to the incident. "We are aware of reports of a potential cyber incident affecting several news outlets, and are working with our government and industry partners to better understand the situation," DHS spokeswoman Katie Waldman said in a statement, Reuters reported.

Ryuk Infection Suspected

Citing unnamed source with knowledge of the investigation, multiple Tribune outlets have reported that the malware appeared to be ransomware called Ryuk, with one source noting that crypto-locked files having been renamed with a ".ryk" extension. But the sources have noted that no ransom demand had been received.

Ryuk has been used to infect organizations across numerous verticals since it was first spotted on Aug. 13. "Our first discovery of Ryuk was during an incident response engagement involving a medical research equipment design and manufacturing company headquartered in the U.S., with locations in Europe," Tim Otis, a Check Point incident response leader, told Information Security Media Group in August (see Alert: 'Ryuk' Ransomware Attacks the Latest Threat). "We have had additional Ryuk cases involving other verticals, such as law firms and convenience store chains both in the United States and abroad."

Check Point in August released a report into Ryuk, later cited in a U.S. government alert, noting that the ransomware appeared to be based on the Hermes ransomware, which has been widely tied to Lazarus, which is a group of hackers, tools and attack campaigns that have suspected ties to the Pyongyang-based government of North Korea (see Lazarus 'FASTCash' Bank Hackers Wield AIX Trojan).

But the code similarity between Ryuk and Hermes is no smoking gun, Check Point cautioned. The similarity "leads us to believe that the current wave of targeted attacks using Ryuk may either be the work of the Hermes operators - the allegedly North Korean group - or the work of an actor who has obtained the Hermes source code," Check Point's report said.

Data Loss , Data Loss Prevention (DLP) , Endpoint Security

Altered data can be just as damaging as lost or stolen data. Diana Kelley of Microsoft outlines key steps for how enterprises can improve how they maintain data integrity.

See Also: Live Webinar | Levers of Human Deception: The Science and Methodology Behind Social Engineering

In a video interview at Information Security Media Group's recent Breach Prevention Summit in Washington, Kelley discusses:

Kelley is the Cybersecurity Field CTO for Microsoft and a cybersecurity architect, practitioner, executive advisor and author. At Microsoft, she leverages her 25+ years of cyber risk and security experience to provide advice and guidance to CSOs, CIOs and CISOs.

Anti-Malware , Cybercrime , Cyberwarfare / Nation-state attacks

Don't rush to blame the publishing and printing outage at newspapers owned by Chicago-based Tribune Publishing on anything more than an organization failing to block a malware outbreak (see Suspected Ransomware Outbreak Disrupts US Newspapers).

See Also: Third-Party Cyber Risk Management - A Data-Driven Approach

On Saturday, Tribune said that all of its newspapers' print runs had been disrupted or delayed by a malware outbreak. The printing press troubles also disrupted the distribution of west coast editions of The New York Times and The Wall Street Journal.

Various Tribune newspapers, including the Chicago Tribune and Los Angeles Times, reported that the outbreak involved crypto-locking Ryuk ransomware, which appeared to have been contained before it then managed to continue spreading, causing publishing headaches throughout the weekend.

The appearance of Ryuk led some media outlets to rush to connect the attribution dots and suggest that North Korea had attempted to disrupt U.S. newspapers. That's because Ryuk's code shares numerous similarities with Hermes ransomware, as software and hardware IT firm Check Point Software noted in a report released in August. The U.S. government later incorporated that information into its own alert about Ryuk.

"Our research led us to connect the nature of Ryuk's campaign and some of its inner-workings to the Hermes ransomware, a malware commonly attributed to the notorious North Korean APT Lazarus Group, which was also used in massive targeted attacks," Check Point says in its August report.

But Check Point emphasized that Ryuk's reuse of Hermes code proves nothing. "The current wave of targeted attacks using Ryuk may either be the work of the Hermes operators - the allegedly North Korean group - or the work of an actor who has obtained the Hermes source code," Check Point's report said.

Ryuk Hits Hard

One thing is clear: Since August, Ryuk has continued to pummel organizations, some of which have paid attackers a ransom to unlock their systems, which law enforcement experts recommend victims avoid whenever possible (see Connecticut City Pays Ransom After Crypto-Locking Attack).

In some cases, Ryuk appears to have been distributed by Emotet, formerly a banking Trojan. In July, Symantec warned that the group behind Emotet, which it calls Mealybug, had begun distributing malware for others, primarily to target U.S. organizations (see Malware Moves: Attackers Retool for Cryptocurrency Theft).

Security firm CrowdStrike, meanwhile, tells The New York Times that it believes that an Eastern European cybercrime gang is behind Ryuk, which it has seen being distributed by Trickbot malware, which may be related to Emotet.

The attacks by the group behind Ryuk, which calls itself Grim Spider, have been lucrative, netting it more than 100 bitcoins (over $380,000) this month alone, The New York Times reported on Sunday.

Tools Alone Don't Attribution Make

As Check Point's Ryuk analysis made clear, attacks cannot be attributed to a specific individual or organization based solely on an attacker's choice of tools.

"If you take a piece of data from an assessment (such as links to Hermes malware) and take it away from all the other data, then you cannot take the assessment with that piece of data," says Robert M. Lee, CEO of industrial cybersecurity firm Dragos, in a Monday blog post. "You cannot just simply look for Hermes malware to pop up and go, 'Yup that's Lazarus Group.' Further, links of Hermes to other malware families like Ryuk and thus attacks where Ryuk show up further complicate the issue. The more analytical leaps you make the less likely your assessment is going to be sound."

Lee is careful to note that hackers affiliated with North Korea may or may not have been behind a Ryuk outbreak at Tribune. Simply put, it's too soon to tell, and voicing vague hypotheses does no one any good.

"The only thing being highlighted in certain media outlets is transitive attribution because of links observed in different malware families," he says. "This is sloppy and will lead to numerous inaccuracies."

What is Lazarus?

Originally, Lazarus referred to TTPs - tactics, techniques and procedures, including toolsets, targets and attack infrastructure. But the concept of the Lazarus group has now expanded to encompass a variety of TTPs, campaigns and likely attack groups, some of which may cross over with other attack groups.

"We don't know what aspects of Lazarus might represent the operators, the developers, alliances with criminals or other states, etc.," Lee says via Twitter.

Just because a particular tool gets used in an attack, however, that alone proves nothing about the attacker's identity or motivations. Many attackers may in fact be mercenaries, which provides plausible deniability for any nation state employers. Others may be cybercrime gang members who moonlight as politically motivated hackers, or vice versa, as Robert Hannigan, the former head of GCHQ, highlighted in a keynote presentation at this year's Infosecurity Europe conference in June, in London.

For example, while both the U.S. and U.K. governments have officially attributed the 2017 WannaCry ransomware outbreak to the Pyongyang-based regime of what is officially called the Democratic People's Republic of Korea, many hallmarks of the attack made it look like a poorly tested cybercrime side project that may have gotten out of control (see Cybercrime Groups and Nation-State Attackers Blur Together).

At the same conference, Zeki Turedi, a technology strategist at CrowdStrike, likewise told me that investigators were finding increasingly "blurred lines between statecraft and criminal organizations" (see Nation-State and Cybercrime Gangs: Lines Blur).

Two Ransom Note Variations

So far, however, it's not even clear if Ryuk is the work of just one group.

Check Point in August, for example, reported seeing two different Ryuk ransom notes: "A longer, well-worded and nicely phrased note, which led to the highest recorded payment of 50 BTC [worth about $150,000 as of Monday], and a shorter, more blunt note, which was sent to various other organizations and also led to some fine ransom payments ranging between 15-35 BTC [worth up to $100,000]," it says. "This could imply there may be two levels of offensive."

Last month, Beazley Breach Response Services reported that attackers wielding Ryuk and BitPaymer ransomware have been demanding the biggest ransoms.

'Criminal Money-Making Tool'

As those figures highlight, security expert Lesley Carhart, a digital forensic investigator at Dragos, says Ryuk has historically been used not as a nation-state disruption tool, but rather as a "criminal money-making tool."

But if the Tribune disruption does trace to Ryuk, "the narrative we're likely going to see for the next few weeks is, 'DPRK Attacks US News Infrastructure' - and while that statement may be technically correct, it misses a lot of nuance, may lead to faulty assumptions, and doesn't really help infosec," Carhart says via Twitter.

Regardless of the motive in the Tribune outbreak, one takeaway for all organizations is that they must ensure they have the correct defenses in place to not only spot and quickly recover from ransomware, but also to block modes of ingress being used by more advanced ransomware cybercrime gangs.

Indeed, cybercrime gangs are increasingly buying stolen or brute-forced remote desktop protocol credentials and using them to remotely log into targeted systems and distribute ransomware, potentially after having first ransacked systems for any valuable information data (see Ransomware Keeps Ringing in Profits for Cybercrime Rings).

Such is the case with Ryuk attacks, which are "highly targeted, well-resourced and planned," according to the August advisory by the U.S. Department of Health and Human Services' cybersecurity program (see Alert: 'Ryuk' Ransomware Attacks the Latest Threat). Victims are targeted and "only crucial assets and resources are infected in each targeted network."

The 2018 calendar year saw an interesting mix of both technical and strategic questions, as engineers were met with new problems and execs were forced to cope with stark new realities.

Here are a few of the most interesting and memorable stories to break over 2018.

It's a bit anticlimactic for the biggest news in the year to erupt in its first days, but that is exactly what happened when, on January 4, The Register broke word on security vulnerabilities present in one form or another in nearly all modern desktop, mobile, and server chips.

Known as Meltdown and Spectre, the design flaws would allow an attacker to pull information from the processor's kernel memory, potentially allowing an attacker to access things like passwords and decryption keys.

Fallout from the disclosure was swift and severe, with Intel, AMD, Microsoft, and virtually every other major vendor forced to spend months dealing with the flaws.

Normally, America's mid-term election years hardly draw any attention outside of Washington DC. However, with a heated political climate and investigations of the 2016 presidential election still going on, the 2018 vote became one of the biggest ongoing security stories of the year.

First, there was the talk that both foreign and domestic hackers could be looking to sway public opinion by targeting certain groups or by spreading misinformation. By the summer, security companies were already warning that Russian crews were trying to infiltrate campaigns in order to steal and leak sensitive information and tip the scales toward one candidate or another.

Then, there was the possibility that the machines themselves could be hacked. These fears were underscored in August when the Defcon voting village exhibit showed how even a novice hacker could break into a machine and do everything from erasing vital data to changing the actual vote tally.

Fortunately for the voters, and in spite of the best efforts of Congress, the elections went off with very little fanfare and only one instance of outright voter fraud.

Considering the mess we were looking at earlier in the year, that wasn't such a bad outcome.

Speaking of elections, 2018 also saw US authorities begin efforts to bring to justice the Russian groups who oversaw the 2016 election meddling.

In February, Republican-appointed special prosecutor Robert Mueller charged 13 members of the Russian Internet Research Agency (IRA), a well-known troll factory, with conspiring against the United States in 2016.

Among the charges were that the trolls stole the identities of American citizens and used fake companies to create a front for their disinformation campaign. This included moving millions of dollars from Russia to the US in order to fund bogus rallies and purchase promoted posts and tweets.

Of course, the IRA crew have yet to even be apprehended in Russia, let alone extradited to the US. There is also no indication that Moscow will ever cooperate, as the Kremlin has said that the 13 professional trolls would be protected by diplomatic immunity.

Facebook not giving a crap about data privacy and getting hammered for it has become something of an evergreen story these last few years.

2018, however, saw perhaps the worst of the social network's scandals when it was revealed that influence-peddling research company Cambridge Analytica had harvested tens of millions of Facebook profiles to gather information and covertly shape public opinion.

This would eventually lead to the end of Cambridge Analytica as a going concern and would force Mark Zuckerberg to once again get up in front of the world and say how really, truly, truly, absolutely he sorry was that, yet again, he and his company made a huge profit by selling out people's personal lives.

How sincere was that apology? Well, it only took a few months for Facebook to do the same thing all over again.

The year saw the emergence, or better yet, explosion, of a new type of malware: the cryptocoin miner. Lured by the promise of big payoffs and low risks, malware writers began to load up their payloads with scripts that would use the compute cycles of infected machines to generate malware for the attacker.

Eventually, cryptocoin miners and wallet-stealing trojans would make their way into everything from in-the-wild exploits to injected scripts on charity websites and even otherwise legitimate software packages.

Sadly (or perhaps not sadly) for the malware writers, the year also saw the price of Bitcoin and other crypto currencies plummet from all-time highs in January to depressing lows in December that matched pre-boom levels.

Of all the head-pounding security cockups to occur this year, perhaps none were as consistently frustrating as the data leaks created by poorly secured cloud storage buckets.

Armed with little more than Shodan and a lot of spare time, researchers have made a career out of rooting out AWS S3 storage instances that were not adequately walled off from public access.

When the buckets are left open to the internet, it often results in the mass exposure of private business information and in many cases, the personal info of customers and citizens. Some of the targets to fall victim this year included political campaigns, robocalling companies, and social networking strategists.

Amazon has done what it can to get a hold of the issue, including placing stricter default settings on S3 buckets and giving administrators more control over when and where data can be shared. Ultimately, however, the responsibility will lie with the admins themselves, and companies will need to tighten up their practices if they want to avoid a repeat of this issue in 2019.

A report more than a year in the making was finally issued in December of 2018 when Congress delivered its formal account of the 2017 breach at Equifax saying 145 million Americans' personal data was leaked to hackers.

In the 96-page writeup, investigators condemned the credit agency's mega-breach as "entirely preventable" and savaged Equifax for, among other things, taking more than a year and a half to spot the lapsed security certificate that left its network vulnerable to the hackers.

The breached application itself was also faulted, found to be woefully out of data and connected to dozens of external databases that it no longer needed access to, the system allowed the hackers to get at tens of millions of customer records they would otherwise have not been able to access.

Equifax has since disputed portions of that report.

It wasn't only Equifax's IT operation that caught heat in 2018. The year also saw one of the executives who profited off the incident be brought to justice (sort of).

Software development boss Sudhakar Reddy Bonthu was given eight months' home confinement and was fined $50,000 as well as forced to turn over $75,000 in gains he made when, upon learning of the breach, he purchased options on Equifax stock that allowed him to turn a quick profit when the breach was revealed to the public and the share price plummeted.

The Mirai botnet has emerged as one of the largest and most influential botnets in recent memory as it showed just how vulnerable, and effective, unsecured IoT devices can be.

In 2018, the Mirai story took a number of new twists. In June, criminals hung some more flesh on the framework bones of Mirai to create a nasty new group of IoT botnet menaces. In May, researchers calculated the cost of the attack and found that each infected internet thing cost device owners about $13.50 in power, bandwidth, and repair costs.

In September, we learned that the three crooks behind Mirai would escape jail time thanks to a deal that saw them work on behalf of the FBI. And two months later, we found out that Mirai had become even more dangerous, thanks to code tweaks that let it infect Linux servers alongside IoT hardware.

Clearly, Mirai is the awful, unwanted, infectious gift that keeps on giving.

This one wasn't exactly unexpected, but it was still noteworthy.

In 2018, as it has in previous years, Microsoft released a major new update to Windows. And as it had in previous years, that update managed to cause all sorts of strange and wondrous new problems for PC owners once it was installed.

For Microsoft, the big cockup came in October when the Windows 10 Fall Creators Update landed. Within days customers began reporting that the new firmware was prone to randomly wiping files, prompting Microsoft to pull the update just four days into its availability.

The problems would not end there. Even after it was re-released, Windows 10 continued to be beset by errors, and by the end of the month El Reg had declared the Fall release "officially a shit show."

But the complaints didn't stop there. In late November Microsoft was still adding new bugs to its advisories on the release, and as the year rolled to a close new reports surfaced of unwanted data collection.

So all in all, it was a pretty standard year for Windows. ®