NCSC (National Cyber Security Centre) - Weekly Threat Report @ncsc #cybersecurity
- ASKET Operations Team
- Jun 15, 2018
- 3 min read
Weekly Threat Report - 15th June 2018
Report's are drawn from recent open source reporting, see the latest report here:
Yet another cryptocurrency exchange is attacked
On Saturday, 9 June, Coinrail, a South Korean cryptocurrency exchange, announced that they had been the victim of a data breach, leading to the loss of an estimated $40 million in altcoins.
The attackers are believed to have stolen 1,927 ether, 2.6 billion NPXS, 93 million ATX and 831 million DENT coins, alongside significant amounts from six other tokens, representing 30% of Coinrail’s total coin and reserves. However, Coinrail claim that two thirds of the stolen coins have either been frozen or withdrawn so far, with further recovery action likely to happen.
Although the attack did not feature any of the major cryptocurrencies, such as Bitcoin, Ethereum or Dogecoin, many recorded large losses in value after the attack was announced, with Bitcoin dropping to its lowest value in two months.
While cryptocurrencies remain valuable, it is almost certain that they, and associated services such as exchanges and wallet providers, will remain an attractive target for cyber criminals.
Even smaller exchanges have sufficient funds to make them worthwhile targets for cyber criminals. The Coinrail attack represents another notable attack against an exchange following the Coincheck, Youbit (twice), EtherDelta and NiceHash thefts that have taken place since December 2017.
The ongoing costs of a ransomware attack
We have previously reported on the SamSam ransomware attack on the City of Atlanta (initial report and a follow-up report on the costs of recovery). Recent media reporting has revealed that video files containing police dashcam footage were encrypted during the attack and cannot be recovered.
It is concerning that important policing processes such as evidence gathering, or even decisions around guilt and innocence, could potentially be impacted by a ransomware outbreak. Backing-up these video files to a secure location would have negated the impact of their loss.
We previously reported that the ransom demand amounted to around $55,000 and that the recovery costs were $2.66m. However, more recent reporting suggests that the recovery costs have exceeded $5m and that a further $9.5m (£1.7m) has been requested for ongoing remediation costs.
While it may seem tempting to pay the ransom in such circumstances, victims should note that there is no guarantee that paying the ransom will enable the recovery of the files. Some ransomware variants do not have the ability to allow for the decryption of the files. Victim organisations should also note that whatever vulnerability was exploited to enable the attack will still need to be resolved, and that anyone who pays a ransom will be an attractive target for further attacks by the same or other groups.
The costs and effort of hardening your systems against a ransomware attack are multiplied if the work has to be undertaken during a crisis. It is worth remembering that ransomware is only a viable activity for organised criminals if victims pay the ransom.
The NCSC has issued guidance on mitigating ransomware and other forms of malware
Prowli botnet infects over 40,000 networked devices
Over recent months, Guardicore researchers have identified a cyber crime group they have called “Prowli”, who have been conducting a wide-ranging campaign using an array of techniques to infect more than 40,000 machines at 9,000 companies globally.
They have used various techniques like exploits and password brute-forcing to spread malware and take over devices, such as website content management systems (CMS), web servers, modems, and Internet-of-Things (IoT) devices.
Once a device is compromised, a self-propagating worm is installed to exploit vulnerabilities and expands the botnet by identifying and spreading to new victims. The group have used multiple avenues to generate money from the compromised systems including installing cryptocurrency mining software, as well as redirecting people from legitimate compromised websites to malicious domains hosting scam websites (i.e. fraudulent tech support, scam products and fake browser extensions).
The attackers have compromised a range of organisations of all types and sizes, without targeting a specific sector. It is highly likely that the operation was intentionally designed and optimised to maximise profits for the money-motivated cyber criminals.
This campaign comes in the wake of several other similar large botnets which are attacking networked devices. To minimise the threat, users should ensure regular patching is undertaken across all device types. Where possible, users should set devices to automatically apply all security updates as they become available.
The NCSC website features advice and guidance for patch management, and readers should also follow the 10 steps to Cyber Security. There is also published guidance on how best to protect against ransomware attacks and mitigating malware.
Comments