An Unfortunate Reminder

If we’ve said it once, we’ve said it 1,000 times – and we’ll keep saying it: the right configuration is key for your network to be fully secure. We had another reminder this week, with news of a data breach affecting Capital One in which a hacker gained access to more than 100 million credit card applications and accounts, in what CNN calls, one of the biggest data breaches ever. Capital One had security measures in place, but the breach still occurred. So how did the hacker get through? A misconfigured web application firewall.

Misconfiguration Opens the Door

More specifically, according to the criminal complaint filed by the U.S. Department of Justice, “a firewall misconfiguration permitted commands to reach and be executed by [a specific] server, which enabled access to folders or buckets of data in Capital One’s storage space at the Cloud Computing Company.” Unfortunately, this is all too common. According to Gartner, 99% of successful network breaches can be attributed to a misconfiguration of the firewall.

The DOJ complaint alleges the hacker gained access multiple times over a few months. It wasn’t until Capital One received an anonymous tip that the company became aware of the data breach. That means the stolen personal information – which included approximately 120,000 social security numbers, more than 75,000 bank account numbers, and millions of names, addresses, and birth dates – was available to the highest bidder for quite some time.

Not only was the firewall misconfigured, the theft was not quickly detected. Those are two expensive issues you don’t want your network to have. Capital One expects to spend $100 to $150 million in costs related to this data breach.

How Can I Prevent a Breach?

So how do you prevent the same thing from happening to you? Get a professional configuration with ongoing management of your network. Our network engineers provide personalized solutions based on your unique needs, ensuring optimized performance and security. Once your configuration is complete, they offer managed security services that take the burden of everyday monitoring, patching vulnerabilities, threat detection, and more away, allowing you to rest assured that the security of your valuable data is in the hands of top-notch, certified professionals. And anytime you have a question, they’ll be there at our Security Operations Center to help.

A new variant of MegaCortexransomware making its way across the U.S. and Europe has been recast as a self-executing menace that doesn’t require a password and is aimed at enterprises, according to a technical analysis released by researchers at Accenture iDefense.

“The disadvantage of the first version was that actors had to run the ransomware manually or risk of leaking the password. This prevented global distribution of the ransomware,” Accenture said. “The MegaCortex Version 2 author has updated the ransomware to remove these disadvantages and redesigned the ransomware to self-execute.”

“It seems this threat actor has done its homework regarding which business model works best,” said Mounie Hahad, who heads Juniper Networks Threat Labs. “It has learned from the infamous SamSam group that also delivers ransomware manually after infiltrating an organization.”

As a result attackers can “precision-deliver highly potent malware while keeping it somewhat difficult to obtain by security researchers,” he said.

The new version of MegaCortex integrates the first iteration’s script features. It also “decrypts the main payload and executes in memory; detects and terminates security tools; [and] detects and stops various types of software such as backup software, database software and Web server software so there is no update to files related to that software,” the analysis showed, as well as “hardcodes the password into the ransomware to allow the ransomware to decrypt the main payload automatically; and integrates the loader, main module and worker into a single executable.”

Ransomware incidents have ramifications beyond a particular targeted company, “affecting the entire ecosystem,” including business partners, suppliers and vendors, Matan Or-El, co-founder and CEO of Panorays, stressed. “This ransomware interrupts corporate operations and causes a Denial-of-Service to the supply chain.”

On the plus side, the MegaCortex variant “is fairly easy to detect, should the threat actor decide to use it more widely or put it up on a ransomware-as-a-service offering,” said Hahad.

Noting “a variety of actions” companies have at their disposal to mitigate supply chain risks,” Matan recommends they “evaluate the cyber posture of their third parties and demand that they adhere to a certain security standard.”

They should also have a set policy for securely dealing with third parties, like severing those “connections with a high-risk vendor” that don’t meet a set security threshold or requiring a password change for those vendors that represent a medium risk.  Finally, organizations “should continuously monitor the security posture of their third parties, receive notification of any change in their security and act according to the policy they put in place,” said Matan.

• The malware does not encrypt files that have ‘zip’ or ‘rar’ extension.
• It also leaves the file unencrypted if its size is over 51,200 KB/50 MB and ‘.jpeg’, ‘.jpg’ and ‘.png’ files with less than 150KB.

A new Android ransomware family, dubbed Android/Filecoder.C, has been found making attempts to infect users. The malware is leveraging unusual tricks to propagate to a victim’s device.

How does it spread?

Discovered by ESET Mobile Security, the malware is distributed via various online forums. The malware has been active since at least July 12, 2019. Within a few days of its discovery, the researchers managed to extract samples of the malware from several posts shared on Reddit and the ‘XDA Developers’ forum.

These posts were created around topics that would lure common users. All of these posts included links or QR codes pointing to the malicious apps. Soon after the discovery, the malicious posts on the XDA Developers forum were removed.

To boost its propagation, Android/Filecoder.C uses the victim’s contact lists and spreads further via SMS with malicious links. This includes links to the ransomware, although they are presented as links to apps. Further to maximize the reach, the ransomware has 42 versions of the message template.

“Before sending the messages, it chooses the version that fits the victim device’s language setting. To personalize these messages, the malware prepends the contact’s name to them,” wrote the researchers.

What are its capabilities?

Once the ransomware sends out a batch of malicious SMSes, it encrypts most of the user files and requests a ransom. Android/Filecoder.C uses an asymmetric and symmetric algorithm to encrypt files. While encrypting files, the ransomware generates a new AES key for each file that will be encrypted.

The malware does not encrypt files that have ‘zip’ or ‘rar’ extension. It also leaves the file unencrypted if its size is over 51,200 KB/50 MB and ‘.jpeg’, ‘.jpg’ and ‘.png’ files with less than 150KB.