An Infrastructure Cybersecurity Bill Passes Senate, Nvidia Confirms Data Stolen In Hack,
and Ukraine vs Russia Pt 2! All that coming up now on ThreatWire.
Greetings!! I’m Shannon Morse and this is ThreatWire for March 8
2022 - this is your summary of the threats to our security, privacy and
Internet freedom. I’ve got some updates to the cyberwar this week, so, onto the first story.
Last Tuesday, the US Senate passed with unanimous consent
a new piece of legislation aimed at increasing cybersecurity for critical infrastructure,
along with making coordination between government agencies and civilian industries better,
for the United States. This new bill is called the Strengthening American Cybersecurity Act of 2022,
but it actually combines three other bills into one big 200 page one.
Those three bills are the Cyber Incident Reporting Act AKA CIRA, the Federal Information Security
Management Act AKA FISMA, and the Federal Secure Cloud Improvement and Jobs Act AKA FSCIJA.
To give you a quick overview of what we can expect: this new bill is meant to make it a
legal requirement for entities that get hit with a cyber attack or experience some kind
of incident to report that within 72 hours to the US Cybersecurity and Infrastructure Agency
or CISA. Ransomware payments must be reported within 24 hours of the payment taking place.
Those entities are also required to preserve data
and keep the government updated with any relevant information pertaining to the incident.
It also includes a five year stipulation called the Federal Risk and Authorization
Management Program (or FedRAMP) which gives agencies five years to upgrade
to secure cloud based technologies that will improve operations and efficiency.
This bill is sponsored by Michigan Democratic Senator Gary Peters and
was brought to the Senate by Peters as well as Senator Rob Portman.
The soon-to-be bill will also have to get through the House before it’s made law
when President Biden signs it, but since this is a bipartisan agreement across political lines,
we can expect the same swift passage to happen in the House. Given the rising tide
of cyber warfare we’ve seen in just the last few weeks, this swift passage comes as no surprise.
To follow up on last week’s story regarding Nvidia, they have officially confirmed that data
was stolen in the cyberattack they experienced back in February. On the 23rd, they did state
publicly that they’d detected a cybersecurity incident, but would not confirm if data was
stolen. While Nvidia was silent on the matter, a hacker group called Lapsus claimed they were the
attackers and they started to leak data publicly, while telling Nvidia their demands, including a
request that Nvidia remove lhr limitations from their 30 series GPUs. They threatened to leak
proprietary information about Nvidia’s tools and products, along with employee credentials.
Lapsus did leak about 20 GB worth of data, claiming it had 1 TB total.
So now we have confirmation but more has happened since then.
Nvidia has confirmed that about 71,000 employees credentials were stolen. That includes email
addresses and NTLM password hashes, many of which have already been cracked and are being spread.
This database has been added to Have I Been Pwned as well.
As of the third, Nvidia’s source code for their DLSS technology has also been leaked online.
This is the Deep Learning Super Sampling rendering tech that
increases graphics performance. Lapsus didn’t end there. They’ve upgraded their demands,
now they want Nvidia to also make their GPU drivers open source. And if Nvidia doesn’t do so,
Lapsus threatened to leak all files for their silicon chipset - aka trade secrets.
Nvidia has declined to comment on whether or not they would respond to these demands.
Lapsus leaked two code signing certificates, which are digital signatures for executables
and drivers that tell the operating system and the user that a file's owner is legit and verified.
This is also used to tell if a file has been tampered with before you install it.
The ones that Lapsus leaked are expired, but Windows still allows for them to be used for
simple signing of drivers which means they’ll still load in the OS and look like they come from
Nvidia. As such, security researchers started discovering that those stolen certificates are
being used to sign malware, RATs, backdoors, and tools like Cobalt Strike beacons and Mimikatz.
Windows will likely need to revoke those stolen certificates but
this may block legit drivers from being installed, so this is still
an open problem. As of time of recording we haven’t seen additional leaks but I highly
doubt Lapsus is done. I’ll keep y’all updated whenever we see news surface on this story.
Big shoutout to my Hush Puppy perk level patrons for sharing their fur baby photos
and for the support. THANK YOU to Nic, Meade’s PC Repair Shop, Nahuel, Nathan,
CryptoHacker and Donald for joining on Patreon.com/threatwire and shoutout to
everyone who supports the show. Let’s finish out today’s episode with my last top story,
the ongoing cyber war! Stories like this one take a VERY long time to research and work on,
it is very time intensive, so if you appreciate this content, please consider supporting the show.
We’re not going to see an end to the cyber warfare happening anytime soon, so as long as
there is new information to share, I’m planning to keep you updated on the conflict. There’s a
lot happening so I’ll be giving you a summary to catch you up with any important information.
And while a lot of folks still think this is just about Russia and Ukraine,
it affects all of us, so pay attention because cyberwarfare has no borders.
First up we recently learned from ESET that a new data wiper is being deployed against
Ukrainian orgs and government. This is called IsaacWiper, and is being distributed along with
a new worm called HermeticWizard which is being used to distribute a wiper called HermeticWiper.
They haven’t been attributed to a specific threat actor at time of publication,
and they aren’t similar to other malware samples at the moment.
It’s also unknown if IsaacWiper and HermeticWiper are linked in any way.
HermeticWiper was first discovered on February 23, just hours before Russia started invading Ukraine.
IsaacWiper started showing up on Ukrainian networks on February 24.
Right now it appears both of these are just targeting Ukrainian networks,
but they could potentially hit networks outside Ukraine as well. Ransomware
called HermeticRansom was deployed with this as a decor in the wiper attacks.
As such, Avast worked to get a decryptor out ASAP for the HermeticRansom ransomware decoy after
Crowdstrike discovered an implementation error, making the ransomware encryption
breakable. Microsoft is tracking HermeticWiper via the name FoxBlade
and stated it’s intention is to disrupt, degrade, and destroy targeted resources.
Along with this malware, spear phishing campaigns are also targeting Ukrainian supporters.
Ukrainian armed service members email accounts are being targeted
and compromised to send spear phishing emails to European government personnel
who are aiding Ukrainian refugees. The emails have a malicious macro attachment which
downloads malware called SunSeed, which can deliver second stage payloads to an
infected device. Some are linking this to Ghostwriter, the hacking group from Bellaroos.
The phishing emails were first seen on February 24, and are being called “Asylum Ambuscade”.
Currently Ukraine is experiencing power outages and internet outages across
several cities due to the invasion. NetBlocks posted data about internet outages in Ukraine
due to Russian military offenses like the physical destruction of infrastructure.
Websites run on Wordpress are being hit with attacks that are targeting vulnerabilities,
according to Wordfence. The company reported seeing a 10x spike in attacks on websites
they protect, such as Ukrainian universities, government, and military and law enforcement.
Wordfence responded by deploying threat intelligence tools on all Ukrainian websites
even if a subscription for that tier of their product isn’t
active. They also blocked the IP addresses involved in these attacks.
Other companies are also stepping up on supporting Ukraine. Microsoft is stopping all sales of new
services and products to Russia in compliance with sanctions. Intel and AMD have also stopped
sales to Russia. NameCheap, a domain registrar here in the US, is now offering free domains
and hosting to sites protesting Russia and Belarus, while also banning registrations from
Russia. Meanwhile, Google and their employees are together donating $15 million to relief efforts
for Ukraine, they’re giving free advertising to aid and refugee support organizations,
some Google Maps have been disabled in the country of Ukraine to protect local communities,
they’ve blocked youtube channels that are connected to RT or Sputnik across
Europe. Monetization of state funded Russian channels has also been disabled.
No surprise, Russian cybersecurity firm Kaspersky stated they weren’t in a
position to comment or speculate on geopolitical developments outside of it’s area of expertise.
But Russia is being hit with attacks too. The Conti ransomware group got hit with
additional leaks of their own data, such as source code for their ransomware and
even more internal conversations than what I reported on last week. This leak also
contained a decryptor tool but this won’t work with the latest version of their ransomware.
Hacktivists are also focusing on the skies by targeting the Russian Space
Research Institute website and defacing it, and leaking files purportedly from the Russian Space
Agency called Roscosmos. None of this necessarily means that a satellite was taken over,
but the head of Roscosmos took this opportunity to let everyone know that hacking satellite
infrastructure is a crime and is an act of war. I mean, so is invading a neighboring country
but who’s counting right? I dunno, I feel like that’s a little hypocritical.
Of course, hacktivism comes with a word of caution. Attacks could disrupt
intelligence operations set up by Ukrainian military agencies or government partners,
and it could lead to accidental escalations or distract operatives from their current
initiatives. If a network is defaced or taken down, an agency could lose access
to important reconnaissance if they were also accessing the same network.
While we’re seeing activism by Ukrainian supporters and Russian sites blocked or orgs
sanctioned, we’re also seeing the latter. Russia is blocking social media sites like
Facebook and Twitter. News outlets such as the BBC are also being blocked. Russia has also
shared the IP addresses used in DDoS attacks against Russian orgs, totalling over 17,000.
This list includes IPs for the FBI and CIA, along with a bunch of other organizations.
Even though Ukraine isn’t a member of NATO, they were just accepted as a Contributing
Participant to NATOs CCDCOE, which is the Cooperative Cyber Defense Centre of
Excellence. This Centre is used to share training, resources, research and more with member nations,
so this could give Ukraine access to additional resources they haven’t had yet.
Ukraine’s government requested that ICANN to shut down Russia’s DNS root
servers and domains last week, but many denounced this request,
as it would affect regular folks in Russia by making network connectivity spotty and
it would make civilians vulnerable to cyber attacks. It could splinter the world wide web,
cutting off Russian civilians from the rest of our global internet. ICANN replied to Ukraine’s
letter by denying the request, though also saying they stand ready to continue to support Ukraine.
The internet exists without borders, and we’re seeing that in action now with a cyberwar.
Want to see more tech videos from me? Check out my youtube channel - youtube.com/ShannonMorse
for everything from tech reviews to security tutorials. And with that,
don't forget to like and subscribe to Hak5! I'm Shannon Morse, I'll see you on the Internet!