Cyber News: What You Need to Know, Weekly Edition, September 9
In the weekly edition of Cyber News: What you Need to Know we compile the top cyber news stories from the previous week. We provide an easy breakdown so you can get the news you need and skip the fluff you don’t.
CIS Controls v8.1 Integration for Healthcare and Public Health Sector Released
The Center for Internet Security (CIS) announced on September 3rd that they have successfully mapped CIS Critical Security Controls version 8.1 to the US Department of Health and Human Services’ Healthcare and Public Health cybersecurity performance goals.
“The compatibility between CIS Controls v8.1 and the HPH CPGs delivers an invaluable cybersecurity resource tailored for the healthcare industry,” said CIS Executive Vice President and General Manager for Security Best Practices Curtis Dukes. “It offers organizations in this sector a clear pathway toward increased efficiency in managing security risks while optimizing their efforts on ensuring patient safety through data integrity.”
With attacks on healthcare expected to increase by 130% in 2024 and even more in 2025, that’s a really good thing.
What You Need to Know:
The Cybersecurity Performance Goals (CPGs) create a comprehensive and vital roadmap for constructing a resilient and proactive defensive posture for healthcare systems. With DDoS and ransomware attacks knocking out services in London and for United Healthcare patients this year, the spotlight is definitely on the ability to maintain services. The CPGs include a strong focus on reducing vulnerabilities, hardening systems’ digital environments, and a swift, seamless recovery if compromised. Faster recovery times would have prevented the loss of life seen in London when thousands of patients were suddenly unable to be blood-typed and surgeries were canceled – and all the litigation that goes with that.
Implications:
By integrating these two industry-leading resources, a framework is created where both sets of controls (CPG and CIS’ Critical Cybersecurity Controls) complement each other. Healthcare organizations can now use the CPGs to bridge any gaps in their security posture by consulting the CIS controls, creating the ability for organizations to have cybersecurity checks and balances.
FTC Nails Verkada with Largest-Ever CAN-SPAM Violation Fine – $3M
Have any Verkada security cameras in your surveillance system? Pay attention. The FTC just handed out its largest EVER Controlling the Assault of Non-Solicited Pornography And Marketing (CAN-SPAM) violation fine, to the tune of $2.95M. The fine originates from allegations the firm’s poor security practices – oh the irony – allowed a threat actor to not only hack into customers’ devices but also access personal data. This includes facial recognition or “people analytics.” The complaint includes “high-resolution images of all consumers whose likeness have either been recorded by their security cameras or uploaded to the Command platform, filter collected images by gender or clothing color, and search images through facial recognition or face matching technology.”
The second layer addresses the more than 30 million email ads Verkada sent over three years, without providing the means to unsubscribe.
What You Need to Know:
As a part of the settlement, Verkada must design and implement a comprehensive information security program to prevent and mitigate any future events. The presiding federal judge will sign off on the proposed plan before it takes effect. The fact that the plan will be back in court (because they didn’t learn after the first attack) makes me feel only slightly better.
Implications:
As a husband and girl dad, what particularly had me hot under the collar with this case is the fact that hacked Verkada cameras were able to be accessed in extremely sensitive locations, including women’s health clinics and psychiatric hospitals. The complaint included that the hacker “viewed patients in psychiatric hospitals (including patients resting in hospital beds) and women’s health clinics, young children playing inside of a room, and incarcerated persons inside of their cells.” The level of violation of this attack is hard to put into words. Private data and health data is one thing. To know that high-resolution images of women, patients, and incarcerated persons, all deserving of varying levels of privacy, are just floating out there on the dark web infuriates me on a whole other level.
This is an instance where a threat actor successfully exploited an Internet of Things (IoT) device(s) for a significant amount of time. Your security system isn’t secure just because that’s what it does for you. Your surveillance equipment can still be “surveilled” by an outside party if it’s not secured properly. If it uses or is attached to your WiFi, ethernet, or internet, it must be secured. Do NOT set it and forget it.
Heads Up: Cisco Backdoor Vulnerability
This one is for all my die-hard Cisco people. Cisco announced on September 4th they closed a backdoor in their Smart Licensing Utility (CSLU).
What You Need to Know:
CSLU, a Windows application, helps users manage licenses and linked products on-premises without connecting them to Cisco’s cloud-based Smart Software Manager solution. This critical vulnerability (CVE-2024-20439) would have allowed unauthenticated threat actors to log into unpatched systems remotely using an “undocumented static user credential for an administrative account.”
Implications:
Why would that be bad, exactly? “A successful exploit could allow the attacker to log in to the affected system with administrative privileges over the API of the Cisco Smart Licensing Utility application,” it explained. Rut-ro, Scooby Doo. What makes it worse is the fact that this isn’t the first backdoor account or ability that’s been removed from Cisco product in recent years. Just last month, Cisco released a patch for a maximum severity vulnerability (CVE-2024-20419) which enabled attackers to change any user password on unpatched Cisco Smart Software Manager On-Prem (Cisco SSM On-Prem) license servers. Three weeks later, the company released the fact that the exploit codes had been found online and warned CISOs to patch immediately.
NSA, FBI, CISA, and International Allies Issue Joint Advisory re:Russian Military Cyber Actors
On September 5th, 2024, the NSA, FBI, CISA, and a host of international allies issued a press release regarding Russian military cyber actors targeting both critical US and global critical infrastructure. The advisory detailed malicious activity used for espionage, sabotage, and reputational harm since at least 2020.
What You Need to Know:
Russian manipulation and disinformation issues have become so commonplace on social media, it’s almost yawn-worthy. This, however, is not just posting fake news or trying to erode faith in our electoral systems. “According to the CSA, the GRU Unit 29155 Cyber Component is responsible for deploying the destructive WhisperGate malware against Ukrainian victim organizations as early as January 2022,” the advisory states. “Additionally, Unit 29155 cyber actors have conducted computer network operations against numerous North Atlantic Treaty Organizations (NATO) in Europe and North America, as well as in Latin America and Central Asia. The activity includes destructive cyber campaigns, infrastructure scanning, and data exfiltration, with a primary focus since early 2022 of disrupting aid to Ukraine. Go all the way down the rabbit hole and read the entire report here.
Implications:
Warfare is no longer confined to the air, ground, or seas- it’s also fought digitally. The recommended actions in the advisory aren’t anything you haven’t heard before – make network and systems updates a priority, actively remediate any known vulnerabilities, use multi-factor authentication. Seriously, guys, please listen to me, your “IT guy” or your in-house IT staff. They’re trying to keep you safe. It’s the little things that trip you up.
Linux Version of Cicada Ransomware is Targetting VMWare ESXI Servers
If you or a friend enjoy twisting your brain around cryptographic puzzles, especially Cicada, you need to know this. Ransomware-as-a-service is now impersonating the legit Cicada 3301 puzzle platform and has already racked up 19 successful (paid) attacks against companies.
What You Need to Know:
This RaaS is a little different because it’s specifically targeting Linux operating systems. Their MO, however, is pretty textbook. It uses double-extortion tactics. Using this strategy, the threat actor breaches the targeted corporate networks, steal data and then encrypt devices (first extortion/payment). Then the encryption key and threats to leak stolen data are used as leverage to scare victims into paying a ransom. Then, they open or create a new data leak site (second extortion/payment). Because why get paid once when you can get paid twice?
Implications:
Cicada, the real organization, has already gone on the record in a statement, saying, “We do not know the identity of the criminals behind these heinous crimes, and are not associated with these groups in any way.” The RaaS was already active and recruiting affiliates as early as June of this year. If you want to read more about how this attack works or was written, you can read more here.