Identifying the best server infrastructure security to protect against ransomware

Infosecurity Magazine | February 15, 2019

A software company has been forced to remind customers to patch a two-year-old flaw in a third-party plug-in, after reports it is being exploited to infect scores of companies with GandCrab ransomware via their managed security provider (MSP). The issue relates to CVE-2017-18362, a flaw which affects the Connectwise Manage plug-in for the Kaseya VSA remote-monitoring tool. ConnectWise Manage is a professional services automation (PSA) product popular among IT support staff in MSPs. “This vulnerability allows a remote attacker to execute arbitrary SQL commands against the Kaseya VSA database, which means they can create administrative users, change user passwords, or even create tasks to deploy software to all endpoints under management,” explained Chris Bisnett, co-founder of Huntress Labs. “This week an unknown attacker leveraged the vulnerable integration to attack MSPs and their customers by tasking all managed endpoints to download and execute a ransomware variant known as GandCrab. This type of attack is particularly devastating because the Kaseya RMM tool has remote administrative (SYSTEM) access to all managed endpoints leading to a quick and complete compromise of all customer assets.” The incident was first revealed in a Reddit post a few days ago with the user claiming if affected a “local mid-sized MSP with about 80 clients” — all of which were apparently infected. Kaseya was forced to issue an update on the ConnectWise plugin bug. “Kaseya takes security very seriously and recommends that all customers using the Connectwise Plugin for VSA upgrade to the newly released version of the Plugin immediately or alternatively remove all versions of this Plugin,” it stated. The news is yet another example of the lengths ransomware authors are now going to in order to get their wares on as many victim machines as possible.

Read More

Infosecurity Magazine | February 07, 2019

Ransomware accounted for one tenth of 1% of all malicious email content in Q4, according to a new threat report from Proofpoint. It’s Q4 threat report found that banking trojans accounted for 56% of all malicious payloads in email in Q4, while remote access trojans (RATs) accounted for 8.4%. Proofpoint claimed that this marked a “significant change” for RATs, as in previous years they were rarely used by attackers. The report stated that email remains the top vector for malware distribution and phishing, while email fraud, also known as business email compromise (BEC), continues to grow rapidly. Ransomware message volumes dropped significantly from Q2 to Q4 “suggesting that ransomware campaigns did not generate sufficient returns for threat actors to continue distributing them at scale.” Speaking to the Risky Business podcast in November, Sherrod DeGrippo, Proofpoint’s director of threat research and detection, said that ransomware “has basically evaporated” after it was in the headlines for many months. “I probably attribute that to the fact that cryptocurrency is so difficult for the average consumer to use, and what we’ve seen instead is, back to cryptocurrency, they are bolting on crypto-miners to just about everything: commodity banking trojans, commodity RATs and keyloggers and pretty basic crimeware stuff,” she said. “We’re starting to see banking trojans have crypto-miners bolted on to them so they steal the money from the traditional bank account and then leave the crypto-miner behind.” In an email to Infosecurity, Ed Tucker, CISO and co-founder of Email Auth, Byte and Human Firewall, said that this research highlights that ransomware is actually less of a prevalent threat both to the individual and business, and criminals know that trojans work.

Read More

SDxCentral | January 02, 2019

A ransomware attack with ties to North Korea took down cloud hosting provider Data Resolution’s systems on Christmas Eve. The California-based company provides software hosting, cloud computing, and data center services for about 30,000 businesses worldwide. First reported by KrebsOnSecurity, the attackers used a compromised login account to infect servers with Ryuk ransomware. In August, Check Point threat researchers linked Ryuk to the North Korean Lazarus Group, also known as Hidden Cobra. This is the state-sponsored group believed to be behind the WannaCry attack in 2017. And over the weekend, Ryuk malware infected the Los Angeles Times’ Olympic printing plant in downtown Los Angeles. This attack delayed that newspaper’s Saturday editions as well as the West Coast editions of the Wall Street Journal and New York Times, which are also printed at that plant. Data Resolution did not immediately respond to a request for comment. According to security researcher Brian Krebs, the attack gave hackers control of Data Resolution’s data center domain, locking the company out of its own systems and forcing it to shut down its network. A Jan. 2 status update shared with customers said the cloud hosting provider is still working to restore email access and multiple databases for clients and is in the process of restoring service for companies that use it to host Microsoft Dynamics GP, a popular accounting and payroll software. Data Resolution reportedly told customers that no data was stolen.

Read More