Issue #22 | June, 2024
‘Recall’-ing third-party cyber risk management news
Another month, another issue of Alice in Supply Chains! This time, we have a total of three sections detailing third-party incidents. Healthcare and financial services each got their own section, since both made a number of headlines in May.
"Recall", the new Windows feature announced by Microsoft to much controversy, also has a section dedicated to it. Every company that relies on Windows for its endpoints should keep an eye on what Microsoft plans for its OS, especially when it comes to changes that can have a large impact on security, as is the case with Recall.
We're also covering some good news, as European law enforcement arrested suspects and took down the Emotet malware operation while the Department of Justice in the US managed to get a prison sentence against a Sodinokibi/REvil affiliate. Lastly, we have a section for other articles and news we believe you'll find interesting, such as the new AI policy from Slack, great AI security research from Wiz, and yet another software product that was found to have been compromised by a backdoored component.
We hope you enjoy it!
New Recall feature(?) in Windows sparks controversy around OS privacy and safety
Microsoft announced a new Windows feature called Recall. This feature takes automatic screenshots and processes them with an AI model to allow the user to search for past activities based on natural language descriptions of objects or patterns that were previously seen.?
Recall is supposed to be the flagship feature of Microsoft AI-powered "Copilot+" PCs, as only these machines have enough AI computing capabilities to run this task continuously without drawing too much power. Nevertheless, Recall sparked a lot of criticism and controversy. It may even fundamentally undermine Windows security, as Kevin Beaumont explains:
It also classifies almost everything you’re doing, seeing and typing. This is instantly searchable.
Microsoft’s store page for the PCs points out “It will not hide information such as passwords or financial account numbers […]”
For example, if you log into online banking, your information around account numbers, balances, purchases etc will enter Recall’s database.
Beaumont later published another piece proving that Recall data can be easily stolen, since its data has to be decrypted by Windows to be used when a user is logged in.
The Recall announcement clashed with Microsoft's recent commitment to make security a priority (even tying executive pay to security performance). But Microsoft CEO Satya Nadella was personally involved in marketing this feature, calling it a "photographic memory."
The controversy quickly got the attention of regulators. The Information Commissioner's Office in the UK announced it made inquiries with Microsoft to understand how Recall data is protected.
To better communicate the problems with the feature, Chris Merkel chimed in to suggest security staff should remind business leaders that lawyers could ask for their Recall data.
Microsoft responded by promising it would be reworking Recall and making it opt-in by default. Previously, it was expected to be automatically enabled on all new Copilot+ devices, with no way to turn it off during the initial setup. The group policy for corporate environments also allowed it to run by default.
All of this unfolded before Recall was released.
In the links we shared above, you'll find that others have already discussed at length the issues and questions associated with Recall. For instance, there are challenges with making sure the database remains aligned with users' expectations as to which data is kept and what should be deleted when the user removes files from the computer. Recall has its own database, so this is not a given.
Although making sure that processing happens locally is very welcome, it doesn't help much when many are still struggling to protect data on endpoints. Introducing a database with an unknown state certainly doesn't make this job any easier. The question is whether the trade-off is worth it.
The point for us, however, is that Microsoft's decision to develop, design, and release Recall is saying something about them as a vendor.?
Also, it is important to realize that Recall can represent a risk even if you disabled it at your own organization. Imagine you regularly use disappearing encrypted messages via email or a messaging app to communicate with another company. That content would be recorded by Recall and kept unencrypted for an indeterminate amount of time at that reader's computer, defeating the controls you put in place to protect it. So as part of your TPCRM efforts you will probably need to require your third parties to disable Recall as well.?
Putting it more broadly - even if Recall is opt-in for readers, what about the content of the counterparties of their communications, shouldn't their consent be obtained as well? Seems like Microsoft didn't take that into consideration, and this is a flaw that might have doomed the whole feature.
Microsoft is still dealing with the fallout from the attacks against Azure. There is pressure from regulators in Germany and the revelation that the Department of Defense held "very candid discussions" with the company. Did Microsoft not realize that Recall wouldn't get a warm reception, or did they not care?
Ascension, Cencora, and more healthcare organizations facing new security incidents
U.S. pharmaceutical company Cencora is notifying individuals that their medical information was stolen during a cyberattack. This data was obtained through partnerships with other companies, such as Bayer and Novartis:
In letters to affected individuals sent out this week, Cencora said that the data from its systems includes patient names, their postal address and date of birth, as well as information about their health diagnoses and medications.
The pharma giant said it had initially obtained patients’ data through partnerships with the drug makers it works with “in connection with its patient support programs.” That includes patients of AbbVie, Acadia, Bayer, Novartis, Regeneron, and other companies.
Because much of this data was received through third parties, Cencora said it lacks information to directly notify some of the affected patients.
This wasn't the only data leak reported last month. Another was reported by WebTPA, a vendor of administrative services to health benefit plans and insurance companies, and Monash Health revealed it found out that it was also affected by a leak that happened in February at ZircoDATA. Monash Health explained some of its historical data relating to domestic violence victims has been exposed as a result.
There are also some major new incidents. One of them hit Ascension in the United States, once again sending shockwaves throughout the whole healthcare ecosystem as payments and care both suffer ransomware-induced delays, with some patients being triaged to other hospitals.
In Australia, MediSecure also suffered a ransomware attack, and the government is warning its citizens of a "large-scale data breach" while it investigates the hack. In an official statement published on its home page, MediSecure says it believes the incident originated from a third-party vendor (these statements are bound to be moved or removed from their home page at some point, but there doesn't seem to be a permanent link – the link was valid at the time of writing). MediSecure facilitates electronic prescribing and dispensing of prescriptions. Additional coverage from ABC News here.
In the UK, ransomware hit Nottingham Rehab Supplies (NRS), leaking data of residents in locations that use their services. In Canada, London Drugs had to temporarily close stores as it recovered from a ransomware incident – for this one, we don't yet know if the problem was related to a vendor.
The UnitedHealth/Change Healthcare incident is also still creating headaches for organizations in their ecosystem. Healthcare Dive has the story that providers are asking the government to clarify how patients should be notified of the breach.
We're ending this section with an article at Chief Healthcare Executive, which looks back at recent incidents to talk about the risks stemming from third parties for organizations in this space.
Google Cloud deletes a customer, Nissan data breach call center suffers a data breach: third-party incidents round-up
Google embarrassingly deleted an account belonging to UniSuper, an Australian fund, in an "unprecedented misconfiguration," leaving users without access for a week:
The UniSuper CEO, Peter Chun, wrote to the fund’s 620,000 members on Wednesday night, explaining the outage was not the result of a cyber-attack, and no personal data had been exposed as a result of the outage. Chun pinpointed Google’s cloud service as the issue. […]
In an extraordinary joint statement from Chun and the global CEO for Google Cloud, Thomas Kurian, the pair apologised to members for the outage, and said it had been “extremely frustrating and disappointing”.
The article says that UniSuper had redundancy in two cloud regions to avoid downtime. However, as their account was fully deleted, this didn't help at all – which is why we didn't list this incident in the banking and finance section. It appears UniSuper did everything right, and this is 100% on Google, which we cover due to its role as a cloud provider. Google Cloud suffered two more availability issues that affected other customers as well.
Over a million records describing Australians who visited local pubs and clubs were posted online. The data was kept by IT services provider Outabox, and it was initially reported by the press that a subcontractor leaked the data after not being paid. A man was arrested in Sydney in connection with the leak, and police said they are investigating whether there was an attempt at blackmail or corporate sabotage. The incident prompted the Australian privacy commissioner to comment that third-party providers are a "weak spot" for customer data.
Nissan revealed a data breach that took place at a call center they had set up to handle customer inquiries regarding a previous data breach from last year. The operation was handled by a third-party, OracleCMS, which suffered a breach in April.
We end this section with a story covered by Ars Technica on how kernel.org servers were infected for two years by a backdoor in SSH known as Ebury. This issue came to light in 2011, but details were withheld. Dan Goodin, who reported this story for Ars Technica, started a thread on Mastodon/infosec.exchange with additional information and the comment that kernel.org never provided a postmortem for this intrusion.
As the whole world relies on Linux, we should ask how much transparency is healthy for an organization that handles the task of hosting the code of the system's kernel. According to ESET, Ebury is still active, compromising 400,000 Linux servers.
领英推荐
Data Leaks hit major banks
Many banks made headlines due to security incidents (or at least alleged incidents) in May. Spanish bank Santander possibly had the more serious one, and yes, it happened at a vendor:
Santander, a Spanish banking institution, has announced that it recently suffered a data breach in which a victim gained access to a database hosted by a third-party provider. […]
In its investigation of the cyber incident, the company discovered that information relating to customers based in Chile, Spain, and Uruguay were accessed, as well as the information of select former Santander employees.
Santander has a page with its official statement on the incident. Additional coverage is available from the BBC, which reveals that a group calling themselves "ShinyHunters" claimed responsibility for the hack. The same actor threatened to leak data from Ticketmaster. It appears that these two companies could have been affected (along with many others) through cloud storage company Snowflake. This could turn into another large-scale incident – the Snowflake might become a snowball, so to speak – so we will have to get back to this story next month.
ABN AMRO disclosed a ransomware incident that hit AddComm, a vendor that the bank uses to distribute documents and tokens to clients. Financial services firm Iress also reported a breach stemming from unauthorized access to its GitHub, which could affect the MFA services it provides and that are currently being migrated to a different company.
Flutterwave, a provider of software and payment infrastructure for banks and financial firms, has suffered its fourth security breach in a little over a year. The report from TechCabal claims hackers stole $7 million in funds.
An email error at Merrill, a division at Bank of America, exposed data from 1,883 individuals believed to be Walmart employees. If you're curious about what exactly this "email error" is, it seems an employee essentially typed in the wrong destination for the data.
The last incident for this section is a potential non-incident, as HSBC and Barclays denied allegations of a data leak by IntelBroker. If the threat actor isn't outright lying – a very real possibility when it comes to criminals – it might be that this data comes from other companies, like suppliers or payment processors. This type of data can be difficult to track.
There is other news for bank security, though, so we'll cover that here. TechCrunch has a special report that explains how cybercriminals are defeating MFA to raid bank accounts.
Federal regulators in the US have issued guidance for managing third-party risk at community banks. Official release announcements with links to the 30-page PDF (here) were published by the Federal Reserve and the OCC. The ABA Banking Journal, which also covered it, published an article arguing that this and other movements show a "renewed focus on third-party risk management for banks." Additionally, law firm Thompson Hine published a brief overview.
The OCC also mentioned third-party risks in a prepared testimony to the House Committee on Financial Services.?
The Securities and Exchange Commission (SEC) also announced new rules that require financial institutions to have well-defined plans of action for breaches of customer data. Even more regulations might be coming in the future, as a report at CNN reveals that the US Treasury is working on an alliance with banks, dubbed Project Fortress, to "defend the financial system from a nightmare attack."
Emotet threat actor disrupted by law enforcement
Law enforcement agencies across Europe and the United States arrested four suspects allegedly involved with the Emotet malware:
The European Union's judicial cooperation agency, Eurojust, said Thursday that police arrested four “high value” suspects, took down more than 100 servers and seized control of over 2,000 internet domains. […]
The operation targeted malware “droppers” called IcedID, Pikabot, Smokeloader, Bumblebee and Trickbot. A dropper is malicious software usually spread in emails containing infected links or attachments such as shipping invoices or order forms.
As the excerpt we left above explains, the Emotet group operates "loader" malware that is responsible for installing other pieces of malicious software. These can be ransomware, other loaders, backdoors, cryptocurrency miners – whatever they want to install, or perhaps whatever they are paid to install on their network. Europol had already raided Emotet's infrastructure in 2021, but there were no arrests at the time and the criminal operation was restored in what some understood as a partnership with Trickbot.
In the United States, the Department of Justice announced that a 24-year-old was sentenced to 13 years and seven months in prison for spreading the Sodinokibi/REvil ransomware. In 2021, the DoJ offered a reward of up to US$ 10 million for "information leading to identification or location of any individual holding a key leadership position in the Sodinokibi ransomware" on the same day that the Treasury announced sanctions against Yaroslav Vasinskyi, who has now been sentenced.
We have a few more government topics. The United Kingdom is investigating a third-party breach affecting their Armed Forces in which Chinese hackers obtained banking data on 272,000 current and former members of their military (the New York Times also covered this). The information is believed to have leaked from Shared Services Connected, a contractor owned by consulting firm Sopra Steria.
Think tank Chatham House published an analysis arguing that this and other third-party incidents that hit the British government suggest that current provisions for supply chain security are insufficient.
The UK's National Cyber Security Centre (NCSC) published a web page and a PDF with "Guidance for organizations considering payment in ransomware incidents." The document lists several issues with the decision to pay a ransomware operator. Along with NCSC, the recommendations are undersigned by the Association of British Insurers (ABI), the British Insurance Brokers' Association (BIBA) and the International Underwriting Association (IUA).
In the United States, the Environmental Protection Agency (EPA) came forward with new measures to "prevent cybersecurity attacks and protect the nation's drinking water." From the outline provided by the EPA, it would seem the goal of these measures is to make sure that water utilities get the fundamentals right – such as having backup and recovery procedures and mitigating vulnerabilities. While this initiative is important, it also paints a worrying and unflattering picture of the current state of critical infrastructure.
The White House has released the first "Report on the Cybersecurity Posture of the United States." A fact sheet is available from the White House website, highlighting "Supply Chain Exploitation" as one of five key trends. The report (37-page PDF) is an overview of the cybersecurity challenges of the United States as a country – not just the government.
Backdoor found on court recording software, Slack AI training, and other news
Rapid7 found a backdoor in a software package distributed by Justice AV Solutions, a company specialized in recordings for courtroom environments. It's unclear who could have been the target of this campaign.
Rapid7 has determined that users with JAVS Viewer v8.3.7 installed are at high risk and should take immediate action. This version contains a backdoored installer that allows attackers to gain full control of affected systems. Completely re-imaging affected endpoints and resetting associated credentials is critical to ensure attackers have not persisted through backdoors or stolen credentials.
While this might be a software supply chain attack, it could have also been a simple malware attack. Still, the presence of a signed executable suggests there might be more to this story.
Rapid7 also released its 2024 Attack Intelligence Report (PDF). The company identified a surge in zero-day attacks and noted that 40% of the incidents the company investigated in 2023 resulted from missing or inconsistent enforcement of MFA. Which highlights how important it is to perform thorough evaluations of whether third parties are using 2FA consistently on their user bases.
Bitdefender has a report on the potential impacts of ThroughTek Kalay vulnerabilities on the whole IoT ecosystem. As Bitdefender notes, the Kalay platform powers over 100 million devices, including surveillance cameras. As the core framework is shared by so many devices, vulnerabilities can affect many implementations, and it's usually up to each vendor to release patches (and then up to users to implement them).
Communications platform Slack was criticized for a new AI training policy that would require workspace administrators to opt out by email (sometimes, Big Tech isn't very big on tech). In response to the backlash, the company released a blog post saying it does not "train large language models (LLMs) on customer data,"but engineer and writer Gergely Orosz retorted that the company should say this in its privacy policy, not in an engineering blog. For the record, this is the language of the policy today: "If you want to exclude your Customer Data from Slack global models, you can opt out…"
While we're on the topic of AI, our final story comes from Wiz, which discovered a critical vulnerability in Replicate, an "AI-as-a-Service" provider. Wiz used a malicious AI model to break the isolation between tenants in Replicate, which would have allowed it to interact with other models and possibly intercept prompts made by other users – which could also contain sensitive data. The issue was reported to Replicate in January, and both companies coordinated for the disclosure of the vulnerability. Replicate's response is available here.
We have a couple of bonus links below
Podcast episode with Alexandre Sieira from Tenchi Security.
Entrepreneurs are a valuable part of the cybersecurity industry. We were joined by Alexandre Sieira, the Co-Founder and CTO of Tenchi Security, to discuss his experiences creating a startup in the sector.
An unrelated example that adds to the vulnerability disclosure topic we covered last month: Assetnote identified a vulnerability in ServiceNow but decided to hold details for thirty days after the release of the official patch. This and the Wiz/Replicate story we covered just above are both good examples of vulnerability disclosure done right.
Thankfully the issue was discovered by a responsible party and disclosed responsibly to the vendor. And the vendor acted responsibly and rapidly addressed the issue for all customers.
See you next month!