Ransomware and other cyber attacks

[ska invita]

There's been a few since thread last posted on and this one explicitly pinned on Russia

Cyber-attack on London hospitals to take ‘many months’ to resolve

Exclusive: NHS source says clarity needed on how Russian hackers gained access and whether records are retrievable

www.theguardian.com

 

[Chz]

There's been a few since thread last posted on and this one explicitly pinned on Russia

Cyber-attack on London hospitals to take ‘many months’ to resolve

Exclusive: NHS source says clarity needed on how Russian hackers gained access and whether records are retrievable

www.theguardian.com

I think that's letting Synnovis off the hook. They were hacked in Italy and France before this one occurred, so it's not like it should be a surprise to them.

 

[Boris Sprinkler]

Ultimately it’s the responsibility of Information Security in the NHS (is that what we are talking about?), to make sure that their 3rd party risk management is in order. And hopefully they are using comprehensive processes to monitor and secure their 3rd party systems and connections.

 

[Boris Sprinkler]

Of course they aren’t. The only time that gets fixed is if big money is at stake.

 

[alex_]

Ultimately it’s the responsibility of Information Security in the NHS (is that what we are talking about?), to make sure that their 3rd party risk management is in order. And hopefully they are using comprehensive processes to monitor and secure their 3rd party systems and connections.

Almost all of these happen because the security measures the people ticking all of the boxes thought were in place weren’t in place. This kind of thing is very hard to detect ahead of time through the supply chain

 

[Boris Sprinkler]

Exactly. Which is why you need a uniform process approach. One of my guys, when I worked in that field, designed a paper based system so good that, it’s now his bread and butter as a lecturer.

 

[two sheds]

Exactly. Which is why you need a uniform process approach. One of my guys, when I worked in that field, designed a paper based system so good that, it’s now his bread and butter as a lecturer.

Interesting, do you know any more about it?

Lots of postit notes?

 

[Boris Sprinkler]

Now. It’s actually an excel based system of assessments and questionnaires, allowing to categorize suppliers based on the function of their product/software/design and architecture of their connections to other third parties. He found it lifts and shifts quite easily so he quit the corporation to sell it to others. Or at least he did. I don’t know what happened post COVID. I’m no longer in that world.

 

[Winot]

There's been a few since thread last posted on and this one explicitly pinned on Russia

Cyber-attack on London hospitals to take ‘many months’ to resolve

Exclusive: NHS source says clarity needed on how Russian hackers gained access and whether records are retrievable

www.theguardian.com

I spoke to my GP earlier to arrange a routine cholesterol test. He said that there was no point taking one for at least four weeks, because they were not able to process any blood tests because of the cyber attack.

 

[ska invita]

So supposeldy recent breaches of TfL, Hackney council and Royal Mail
THis website is interesting....
TfL hacked by 17 year old from Walsall

17-Year-Old Arrested in Connection with Cyber Attack Affecting Transport for London

17-year-old arrested over cyber attack on TfL, exposing 5,000 customers' sensitive data. Investigation ongoing.

thehackernews.com

Possibly same kid doing MGM Resorts

17-Year-Old Linked to Scattered Spider Cybercrime Syndicate Arrested in U.K.

Teen arrested in UK for links to global cybercrime group. Suspected Scattered Spider member connected to MGM Resorts hack.

thehackernews.com

22 year old from Scotland caught doing the same style hack

U.K. Hacker Linked to Notorious Scattered Spider Group Arrested in Spain

Scattered Spider member arrested in Spain. Group evolves tactics, targets SaaS apps for data theft. FBI prepares charges against hackers tied to high-

thehackernews.com

So maybe for from being Russian espionage

...talking of Russia that site has several stories about Russia being attacked by anti-Putin hackers
such as

Hacktivist Group Twelve Targets Russian Entities with Destructive Cyber Attacks

Twelve hacktivist group targets Russian entities with destructive cyber attacks, using public tools for maximum damage without financial gain.

thehackernews.com

 

[Boris Sprinkler]

Attribution is incredibly difficult to prove. And TTP’s from threat actor groups will often use subterfuge and obfuscation.
I’ve seen leaked data from US weapons companies left on a sever belonging to a Scandinavian bioethanol research firm. That time it was supposedly Chinese. Other times it was Russians or a North Koreans.
Only common factor was the reporting entity of the Americans.

 

[ska invita]

Attribution is incredibly difficult to prove. And TTP’s from threat actor groups will often use subterfuge and obfuscation.
I’ve seen leaked data from US weapons companies left on a sever belonging to a Scandinavian bioethanol research firm. That time it was supposedly Chinese. Other times it was Russians or a North Koreans.
Only common factor was the reporting entity of the Americans.

in these cases they've made arrests but yeah could be a feint

 

[Boris Sprinkler]

In this case. And my experience of police forces is that they will see through an investigation where it is clear who the perpetrators are. Otherwise
I have raised countless fraud cases with ncp. None followed up on.
I had to explain to Northumbria police what an IP address was way back in 2006 in order to assist them in their pursuit of a paedophile gang. We were also in a position to do what they couldn’t. And we did. And they were successful. But it was purely by accident or their luck.

 

[bcuster]

Bank of America

Nationwide glitch affects thousands of Bank of America customers

The problem appears to be nationwide; some reports show more than 18,000 people being impacted by the glitch so far.

www.latimes.com

 

[ska invita]

Two prominent pieces in the Guardian today

UK underestimates threat of cyber-attacks from hostile states and gangs, says security chief

New head of National Cyber Security Centre to warn of risk to infrastructure in first major speech

www.theguardian.com

‘Russia can turn the lights off’: how the UK is preparing for cyberwar

Moves made to prepare country for utility outages as malicious technological threats intensify

www.theguardian.com

but in reading those it links to this one which I think is most important as it explicitly makes the link between Russian gangs and the Russian state

Russia’s FSB protected Evil Corp gang that carried out Nato cyber-attacks

NCA says cybercriminal gang used family links to spy agency to shield members targeted by US authorities

www.theguardian.com

that all does need to be tampered with the fact that, as posted above on the thread, more than one high profile case has had nothing to do with Russia and rather seems to have been carried out by teenage herberts in British bedrooms

 

[ska invita]

its getting pretty endemic isnt it

 

[ska invita]

Interetsing bit here about how the hacks of coop/harrods etc are being done:
"
The point is they — the threat actor — are entering using the front door, via the helpdesk to get MFA access — those are very good guides from defenders about what to do, links below.

DragonForce Ransomware Cartel attacks on UK high street retailers: walking in the front door

The individuals operating under the DragonForce banner and attacking UK high street retailers are using social engineering for entry.

doublepulsar.com

 

[ska invita]

Finally some certified Russian hackers

Pro-Russian hackers claim to have targeted several UK websites​

Group that calls itself NoName057(16) appears to have had limited success disrupting council and other websites

 

[alex_]

Interetsing bit here about how the hacks of coop/harrods etc are being done:
"
The point is they — the threat actor — are entering using the front door, via the helpdesk to get MFA access — those are very good guides from defenders about what to do, links below.

View attachment 477046

DragonForce Ransomware Cartel attacks on UK high street retailers: walking in the front door

The individuals operating under the DragonForce banner and attacking UK high street retailers are using social engineering for entry.

doublepulsar.com

It’ll be phishing, then calling help desk to get mfa reset, then breaking into Active Directory then kaboom!

Protecting against this is actually pretty hard, requires good tools, processes and people.

Alex

 

[Boris Sprinkler]

Looks like crouching cock nose tiger strikes again!!

It’s all a bunch of wank. Orchestrated by misfits who would be incels if they didn’t have cyber security companies to run.

 

[ID47]

Coop shelves are empty of fruit and veg in at least two of their stores down here today. Like totally empty. Connected?

 

[Nine Bob Note]

I'm assuming that hackers are responsible for the Guardian's hideous new layout?

 

[yield]

Coop shelves are empty of fruit and veg in at least two of their stores down here today. Like totally empty. Connected?

Almost definitely.

 

[ska invita]

Coop shelves are empty of fruit and veg in at least two of their stores down here today. Like totally empty. Connected?

yep confirmed, just back from my local, no fruit veg or ready meals, asked why, because deliveries fried after hack

 

[ID47]

I'm assuming that hackers are responsible for the Guardian's hideous new layout?

What were they thinking, the new post split Observer site is almost as bad, very empty and looks like could heading for extinction.

 

[editor]

Some of the shelves in Brixton's M&S had a bit of a pandemic vibe about them and I wondered if this was down to the hack?

 

[Elpenor]

Your local street or farmers market garden isn’t affected plus can buy closer to the source

 

[kenny g]

Probably time to stock up on toilet paper ...

 

[two sheds]

I'm assuming that hackers are responsible for the Guardian's hideous new layout?

Atrocious isn't it. I hate it when designers are given free reign without understanding why they're there and they demand loads of white space. Which here means loads of pointless scrolling down to get to the information.

Also responsible for loads of white space on packaging which means they have to use 4 point text for the information you actually need.

Grrrr.

 

[ska invita]

"US cryptocurrency exchange Coinbase has been targeted by hackers who stole customer data and demanded $20mn to prevent its public disclosure, the company said on Thursday.
The group, which next Monday is set to become the first crypto exchange to join the S&P 500, said the cyber demands were made on Monday.
The company’s shares were down 5.4 per cent in morning trade in New York. They had soared by a quarter on Tuesday after the announcement of its inclusion in the US blue-chip stock index.
“Their aim was to gather a customer list they could contact while pretending to be Coinbase — tricking people into handing over their crypto. They then tried to extort Coinbase for $20mn to cover this up. We said no,” the group said in a statement on its website.
The California-based group has promised to pay a $20mn reward — the amount demanded — for information leading to the arrest and conviction of the criminals responsible."