Do you process, transmit or store more than 10,000 financial transactions per year?
YesNo, less than 10,000
Do you use and keep up to date firewalls and anti-virus protection for all systems?
YesNo
Do you use third parties to complete audits of your system and security on a regular basis?
YesNO
Are all portable devices password protected? (mobile phones, laptops, tablets, etc)
YesNo
Do you have encryption requirements for all data including portable media?
YesNo
Do you have back-up and recovery procedures for business critical systems, data and info assets?
YesNo
Do you outsource any part of your network, including storage?
Yes, we use third party providers.No, all managed in house
Do you store sensitive information on web servers?
YesNo
Do you know of any loss payments, fines or penalties being made on your behalf?
YesNo
Are you aware of any matter which might give rise to a claim or loss under such insurance?
YesNo
Have you suffered any loss or claim but not limited to a regulatory, governmental or administrative action brought against you, or any investigation or information request concerning any handling of personal info?
YesNo
The applicant or any subsidiaries have any knowledge of any loss payments, fines or penalties being made on behalf of any applicant or any person proposed for coverage any cyber policy or similar insurance?
YesNo
Your quote request has been sent successfully, one of our brokers will contact you today! Close this notice.
Business Insurance Quote
Contact details:
Sections
Property & Contents
Yes, please quoteNo, thank you
Public & Products Liability
Yes, please quoteNo, thank you
Cyber Liability
Yes, please quoteNo, thank you
Theft & Money
Yes, please quoteNo, thank you
Computers & electronic equipment
Yes, please quoteNo, thank you
Business Interruption
Yes, please quoteNo, thank you
Machinery Breakdown
Yes, please quoteNo, thank you
Your quote request has been sent successfully, one of our brokers will contact you today! Close this notice.
Today we take a look at how some small to medium Australian businesses responded and recovered from various cyber events and how their insurance was able to assist. In the past 12 months the majority of all cyber attacks against Australian businesses were targeted at small to medium size businesses. Many owners have heard the buzzwords and have seen the major international incidents on the news but haven’t seen relatable cyber claims from Australian businesses.
Eye Surgery Clinic
2 Locations
15 Employees
$8 million turnover
Incident
An employee opened an email attachment which contained ransomware, causing the Insured to lose access to their network of digital patient records. The cyber criminals demanded ransom payment in Bitcoin of approximately $6,000 at the time of writing. Both practice’s were able to continue trading however at greatly reduced efficiency as they had not used paper records for accepting and treating patients in years. Despite having access to some paper filing, the business was not able to raise invoices as this is part of a paperless system. Forensic Investigators were able to recover the vast majority of data and restore the paperless system.
Outcome
$126,000 in forensic IT expenses, First Party damage and lost work hours.
Law Firm
1 Location
55 Employees
$20 million turnover
Incident
An unknown organisation gained access to a law firm’s network and may have gained access to sensitive client information, including a public company’s acquisition target, another public company’s prospective patent technology, the draft prospectus of a venture capital client, and a significant number of class-action lists containing plaintiff s’ personally identifiable information (PII). A forensic technician hired by the law firm determined that malware had been planted in its network. Soon after, the firm received a call from the intruder seeking $10 million to not place the stolen information online.
Outcome
The law firm incurred $2 million in expenses associated with a forensic investigation, extortion-related negotiations, a ransom payment, notification, credit and identity monitoring, restoration services and independent counsel fees. It also sustained more than $600,000 in lost business income and extra expenses associated with the system shutdown.
$2.6 million total costs
Help protect your business with cyber insurance.
Raw Materials Manufacturer
1 Location
28 Employees
$7.5 million turnover
Incident
The Insureds system was hacked via an email they received carrying a Ransomware virus. The virus prevented them from having any access to emails and their network. The criminals held the clients system to ransom and would only release files if the client paid $12,500. The fact that the client had numerous file shares and common storage areas made their system particularly vulnerable to attack and made it easy for the ransomware to encrypt nearly every file in their system.
Outcome
$12,500 in ransom costs plus an additional $25,000 in IT expenses related to diagnosing the problem, decommissioning the old servers and installing a new network.
Hardware Store
1 Location
20 Employees
$5 million turnover
Incident
An employee at a hardware store ignored internal policies and procedures and opened a seemingly innocuous file attached to an email. The next day the hardware store’s stock order and cash registers started to malfunction and business trade was impaired as a result of the network failing.
Outcome
The hardware store incurred over $100,000 in forensic investigation and restoration services. They also had additional increased working costs of $20,000 and business income loss estimated at $50,000 from the impaired operations.
$170,000 total costs
Health Clinic
1 Location
7 Employees
Turnover: unknown
Incident
A small health clinic discovered that an unauthorised third party had gained remote access to a server that contained electronic medical records. The third party posted a message on the network stating that the information on the server had been encrypted and could only be accessed with a password that would be supplied if the insured made a “ransom” payment. The insured contacted law enforcement and working with law enforcement, determined that the payment ($2,500) should be made. The payment constituted cyber extortion monies under the policy. Furthermore loss of business income amounted to $65,000 and IT forensic costs of $5,000 were paid in accordance with the coverage provided by other sections of the policy.
Outcome
$72,500 in ransom, forensic IT and lost business income costs
Help protect your business with cyber insurance.
Conclusion
Regardless of staff size, turnover or industry, all businesses have a possible exposure from the ever increasing reliance on information technology. From most reports it is only a matter of time rather than a matter of being secure or not.
Here is our January 2017 wrap-up of large scale malicious emails making the rounds for Australian businesses.
We have all received some suspicious emails in the past and laughed at the seemingly obvious red flags, it appears that gone are the days of the poorly translated foreign prince simply trying to return your unknown wealth. Today, as employee education continues to increase, criminals are very fastidious and clever with their malicious email phishing attempts.
Earlier this month a torrent of Australia Post scam emails were discovered with a simple method of infection designed to evade anti-virus software. At the time of discovery by MailGuard, only 1 of 68 popular antivirus vendors were detecting the link as malicious
The message indicates a parcel is ready for collection at their local post office, simply confirm your correct postal address by clicking the link at the bottom of the email.
Malicious Australia Post Email
Replica Australia Post Website
After clicking to confirm, a series of prompts leading to an identical Australia Post website end with a remotely executed malicious file being downloaded. An identical Australia post website has been created with the noticeable difference being the www.auspost.tk address instead of the official www.auspost.com.au, the malicious website even has ‘Captcha’ security forms and correctly scales for mobile users.
Help protect your business with cyber insurance.
Australian Securities and Investments Commission – ASIC
Reports of fake emails claiming to be from ASIC are making the rounds and distributing malware at an alarming rate. “Malware can reformat your hard drive, alter, delete or encrypt files, steal sensitive information, send unauthorised emails, or takes control of your computer and all of the software on it.”
“The message claims to contain an important message. But those who click to the link inadvertently download a malicious JavaScript file. The file is housed within a zip file on a compromised SharePoint site.” said Jaclyn McRae of Mailguard.
The emails have been disguised using a third party program which causes them to appear to be sent from a legitimate @asic.gov.au account.
ASIC email scam
According to MailGuard, at the time of reporting, none of 68 well-known antivirus vendors were detecting the link as malicious.
“Scammers pretending to be from ASIC have been contacting Registry customers asking them to pay fees and give personal information to renew their business or company name,” “These emails often have a link that provides an invoice with fake payment details or infects your computer with malware if you click the link.”ASIC says.
Australian Taxation Office – ATO
The next government organisation being impersonated is the Australian Tax Office. The malicious emails are coming from a recently registered set of domains with slight variations to the correct ATO web address which is https://www.ato.gov.au.
“The email looks quite legitimate, and includes the recipient address within the text body. It includes Australian Government branding and confidentiality clause.”said Jaclyn McRae
The email contains a Microsoft Word attachment which the recipient is told requires their attention.
ATO scam email
“The attached document contains a a macro which when executed, downloads a virus from a remote location.”
Microsoft Word Malicious Macro
We’ve recently written about malicious Microsoft Office macros and other methods of infection, here.
“Adversaries are increasingly using Microsoft Office macros – small programs executed by Microsoft Office applications such as Microsoft Word, Excel or PowerPoint – to circumvent security controls that prevent users from running untrusted applications. Microsoft Office macros can contain malicious code resulting in a targeted cyber intrusion yielding unauthorised access to sensitive information.”
Commonwealth Bank
Apart from government departments, financial services giants are also regular targets. ANZ, Macquarie and AMEX have been recent targets of phishing scams.
Commonwealth Bank scam email
Very similar to the above mentioned ATO email scam, Commonwealth Bank customers have been sent the above secure message requiring the attached content to be downloaded. Once again, the Microsoft Macro contained in the Message.doc attachment downloads a virus from a remote location. Once recipients ‘enable editing’ and then ‘ enable content’ the virus is activated.
According to the MailGuard Security Blog , the malicious emails were sent from cloud-hosted servers in Hong Kong but the attack could have originated anywhere.
Driving Infringement Notices
A round of malicious emails poorly disguised as driving infringement notices has been targeting Australians for a few months. The continued attempts from criminals suggests some measure of success.
Despite having no branding, the ‘from’ name having no relationship to the sending domain and no reference to which police authority had issued the fine, it seems many targets have taken the bait.
According to MailGuard, “The malicious emails claim the recipient has incurred a fine for negligent driving. It says the fine will arrive in the mail, but that it can be viewed by clicking the link.”
Negligent driving scam email
The “photo proof” attachment contains a link which accesses a malicious ZIP archive and allows malicious software to be downloaded.
Conclusion
Thanks to MailGuard, subscribe to the security blog for regular updates here.
Each month we will try to highlight some common email scams targeted at the Australian market.
If we have missed a scam you think is important, please let us know below.
Have you ever wondered what the financial incentive for cyber criminals is? Many experts are reporting a staggering $1 billion was taken in from ransomware alone in 2016 not counting the other options for cyber crime.
For years we have repeatedly seen stories in the media about shadowy criminals making purchases with your credit card online and the onus being put onto the financial institution to identify,block and refund these transactions. Today things have escalated drastically and the black market for information has a broad range of options from online reward point accounts, medical records, auction site accounts and tutorials for new people interested in cyber crime. This escalation also means that the responsibility for online security is shifting to the personal side instead of solely the vendor.
Below are a few examples of the many ways cyber criminals are making money online from your accounts and information. Whether they are taking a website down to stop trade, extorting hospitals with sensitive patient information, auctioning hacking tools and guides for new criminals or just use of your netflix subscription, there is a market for it and it is thriving.
Bank details
Selling credit card numbers has been a classic source of revenue for cyber criminals. Although the market is starting to lean towards more specific details like medical records for social engineering and fraud purposes, credit card information is still a strong source of revenue. As can be seen below from a 2016 McAfee report, full card and personal details for a little as $40.
“Everything is available. We see bank-to-bank transfers offered for sale, and the availability of banking login credentials.”
Bank credentials for a specific account to drain funds has a higher value which runs as a percentage of the account balance. Usually around 1% – 5% of the available balance.
DDoS Rental Services
A DDoS attack will overload a victims website causing it to crash and prevent access until the attack stops. A frozen website can cause an instant halt to sales and have ongoing reputational damage. In 2016, 84% of Australian small and medium businesses are online with that percentage expected to increase in 2017.
The average cost to the victim of a DDoS attack is around $500USD per minute, the mean cost to the attacker is only $66 per attack. The cost to launch a DDoS attack is so low that the barrier to entry for attackers is practically nil – and that means that any organization can potentially be the target of a DDoS attack. What is a DDoS attack?
Russian DDoS advertisement
Exploit kits
Exploit kits are designed to be a ready to launch hacking tool, with many different variations available online for the budding cyber criminal to purchase and start causing mischief. One case of a student in Virginia, USA is facing a 10 years prison sentence after creating a key logger tool which records keystrokes and ultimately account information on the victim’s system. The student offered the nefarious tool for sale at $35 USD and sold to around 3,000 people who, in turn, infected over 16,000 victims, the U.S. Attorney’s Office said.
Using those numbers, his personal incentive for the key logger tool was approximately $105,000 USD which is certainly an attractive figure for any would-be cyber criminal.
Ransomware is malicious software which once it has infected a system the software will encrypt important files rendering the operations frozen until the victim pays a ransom usually demanded in bitcoin. Multiple ransomware kits have been found for rent in online marketplaces for as little as $1,000USD a month or $100USD for 48 hours.
Insure your business against cyber crime.
Online rewards programs
Online rewards programs such as account information for airline points have also been found for sale on cyber crime marketplaces. According to the report 300,000 airline points for as low as $90USD which is very concerning after the recent reveal that 90% of airline booking systems are insecure.
“Flight bookings worldwide are managed by the so-called Global Distributed Systems (GDS) that connect travel agencies, online booking websites, airlines and passengers. Amadeus, Sabre, and Travelport, the three largest GDS networks, administer more than 90 percent of the bookings as well as numerous hotel, car, and other travel reservations, according to Security Research Labs (SR Labs), a Berlin-based hacking research collective.”
Compromised organisation & infrastructure access
Other types of data for sale include access to systems within organizations’ trusted networks. The types of entry vary, from very simple direct access (such as login credentials) to those that require a degree of technical competence to carry out (such as vulnerabilities). We can see the availability of vulnerabilities that allow potential buyers access to bank and airline systems located in Europe, Asia, and the United States.
A recent report by cyber crime expert Idan Aharoni suggests that the types of systems criminals sell access to now include critical infrastructure systems. In his article “SCADA Systems Offered for Sale in the Underground Economy,” Aharoni included one example in which a seller provided a screenshot that appears to be a French hydroelectric generator as evidence that the seller had access.
Stolen enterprise data is also for sale, we have seen sellers offering data stolen from a university.
Medical Records
One of the fastest growing areas of data theft is the medical industry. Client records have been shown to be extremely valuable in the black market community for a number of reasons. One reason is the level of detail which medical records hold. Most medical records hold sensitive information which financial institutions are not privy to for example full name, age, family history, government ID numbers and other details used for social engineering.
Another reason medical records have increased in value is their extortion value to the holding hospital or medical practitioner. “A breach happens at one of these companies. The hackers go direct to that company and say, ‘I have your data.’ The cost of keeping this a secret is X dollars and the companies make the problems go away that way,” said Greg Virgin, CEO of the security firm RedJack.
Online Subscription Services
Netflix, HBO, Spotify, etc are just a few of the online subscription services for digital content that are available to purchase for a low as $1 USD. High demand for these accounts can be seen from the widespread listings in the marketplace despite their seemingly low value.
video streaming services are in high demand. Even premium professional sports streaming services can be purchased for $15. We also found other online accounts being sold, including lifetime subscriptions to premium pornography accounts, as well as free referral links to the dark web market Agora.
Insure your business against cyber crime.
It is unclear how 2017 will unfold with reports already saying 123456 is still the world’s most popular password but if that is any indicator of the state of personal security, 2017 is going to be a very lucrative year for cyber criminals.
“Employees still remain the most cited source of compromise”
With each new report the cyber security expert consensus remains the same regarding internal culture to self mitigate. The below is an excerpt from the latest Australia Securities and Investment Commission (ASIC) Cyber Resilience Assessment Report: ASX Group and Chi-X Australia Pty Ltd.
“There is clear recognition that effective cyber resilience requires a strong ‘cultural’ focus driven by the board and reflected in organisation-wide programs for staff awareness, education and random testing, including of third parties.”
CERT Australia (the CERT) is the national computer emergency response team and are the point of contact in Government for cyber security issues affecting major Australian businesses. The CERT is part of the Federal Attorney-General’s Department, with offices in Canberra and Brisbane.
At least 85% of the targeted cyber intrusions that the Australian Signals Directorate (ASD) responds to could be prevented by following the Top 4 mitigation strategies listed in our Strategies to Mitigate Targeted Cyber Intrusions.
“This Cyber Security Strategy sets out my Government’s philosophy and program for meeting the dual challenges of the digital age—advancing and protecting our interests online.” Hon Malcolm Turnbull MP
CREST Australia New Zealand Ltd, a not for profit company, runs CREST Australia New Zealand on behalf of member companies and provides assessment, accreditation, certification, education and training in cyber and information security for individuals and corporate entities and promotes the provision of high quality, best practice information security services according to its company constitution.
MailGuard is one of Australia’s leading technological innovators and the world’s foremost cloud web and email security service, providing complete protection against web and email security threats like malware, ransomware, spyware, phishing, spear phishing, viruses, spam and similar malicious scams in 27 countries around the world.
“This comprehensive report is a must-have reference for C-suite executives, senior managers and anyone new to the information security management space.”
CSO provides news, analysis and research on a broad range of security and risk management topics. Areas of focus include information security, physical security, business continuity, identity and access management, loss prevention and more.
The SANS Institute was established in 1989 as a cooperative research and education organization. Its programs now reach more than 165,000 security professionals around the world. SANS is the most trusted and by far the largest source for information security training and security certification in the world.
“Everything you want to know about cyber security and are too tired to search for.” Whatever you may be interested in – from DEF CON to SANS – you will find on this page.
Conclusion
As the emphasis on employee exploitation tactics continues, the more important it is to educate all staff. Cyber Insurance Australia will continue to update this cyber security resource list as more valuable resources are discovered. For any additions please comment or message.
Cyber attack results show over 2.2 billion records stolen
It’s time to reflect on some of the most audacious, embarrassing and dangerous hacks, leaks and data breaches from the past year. 2016 is finished but and at this point there have been more than 2.2 billion records stolen in the past 12 months with a large number coming from historical breaches.
Yahoo – Yahoo has advised they have had at least an incredible 500 million accounts compromised. The intrusion actually happened in 2014 but was only picked up by the company in August of 2016 following an investigation into a separate breach. The August cyber attack turned out to be false but brought to light the extent of the 2014 intrusion. While Yahoo says the information taken was low-value data it did include security questions and answers which would make users vulnerable if used across multiple sites.
Linux Mint backdoor– The Linux operating system still remains one of the most popular Linux releases with approximately 6 million users despite a recent backdoor being announced. The malicious code was inserted into the legitimate version listed on the official Linux Mint forums. Hundreds of users downloaded the malicious build before detection.
“The hacked ISOs are hosted on 5.104.175.212 and the backdoor connects to absentvodka.com. Both lead to Sofia, Bulgaria, and the name of 3 people over there. We don’t know their roles in this, but if we ask for an investigation, this is where it will start.” said the official Mint statement.
SWIFT – SWIFT or Society for Worldwide Interbank Financial Telecommunication is a global organisation that operates a trusted and closed computer network for communication between member banks around the world. With 11,000 members and around 25 million financial messages sent per day SWIFT is a prime target for a cyber attack. On February 4, 2016 unknown hackers used Bangladeshi Bank employee SWIFT credentials to send approx $850 million to numerous accounts in the Philippines, Sri Lanka and other parts of Asia.
When Bank employees found the error $81 million had already been credited to multiple accounts—reportedly belonging to casinos in the Philippines—and all but $68,000 of it was withdrawn on February 5 and 9 before further withdrawals were halted. The hackers might have stolen much more if not for a typo in one of the money transfer requests that caught the eye of the Federal Reserve Bank in New York.
TRUMP – The president elect’s TRUMP hotel chain has been the victim of two cyber attacks since 2015 with the most recent in April 2016. According to some sources the organisation was using unpatched and insecure systems which were more than 10 years old. The April findings were only scratching the surface but it is likely the TRUMP organisation has been compromised much further.
Then, Trump’s presidential campaign leaked the resumes of prospective interns, including their names, addresses, and in some cases sensitive employment details. Let’s hope his cybersecurity strategy is better when he’s in office.
LinkedIn – The global professional networking company was first compromised in 2012. As with the same case as Yahoo, the scale of the historical 2012 breach was only understood this year when the number of stolen accounts exploded to almost 117 million. One reporter noted that the majority of stolen accounts had passwords found in the annual worst passwords list from SplashData.
Here’s how to check if your accounts have been compromised in a cyber attack, haveibeenpwned.com
Tumblr – It comes as no surprise that the Yahoo owned micro blogging and social networking website, Tumblr suffered a similar breach to their parent company in 2013 before the acquisition. Tumblr staff announced that it had been the victim of a security breach but refused to give details until investigative journalists discovered the stolen database had more than 65 million accounts.
MySpace – Formally the world’s largest social network, Myspace suffered their largest known exploit and brought them back into the headlines for the wrong reasons. The breach occurred on June 11th, 2013 but once again was only fully recognised earlier this year after further investigation.
“Each record may contain an email address, a username, one password and in some cases a second password.The methods MySpace used for storing passwords are not what internet standards propose and is very weak encryption or some would say it’s not encryption at all but it gets worse. We noticed that very few passwords were over 10 characters in length (in the thousands) and nearly none contained an upper case character which makes it much easier for people to decrypt.” said leaked data analysts at leakedsource.com.
US Political Attacks – The media had a field day surrounding the 2016 US election accusations from the White House that the Kremlin had committed politically motivated hacks on presidential candidates. Director of National Intelligence, James Clapper stated that “based on the scope and sensitivity of these efforts, that only Russia’s senior-most officials could have authorized” regarding the hacks. Russia has repeatedly denied the hacking allegations.
VK – The largest European online social networking service, based in Russia was the victim of 3 separate hacks in as many months. According to reports, the attack occurred in 2012 or 2013 and continues the historical hack trend which has dominated this list. An estimated 171 million accounts from VK.com and their parent company Mail.ru’s forums.
The hacker is now reported to be selling a portion of the database. 100 million accounts, which turns out to be a little over 17 gigabytes in size have been found on a dark web marketplace for 1 bitcoin.
NSA – The infamous National Security Agency which is an intelligence organization of the US government, responsible for global monitoring, collection, and processing of information and data for foreign intelligence and counterintelligence purposes has had their internal tools stolen and auctioned off by The Shadow Brokers.
The hacking tools which could break through Fortinet and Cisco firewalls was seen listed for auction through known exploit sites. With the wide range of Snowden Leaked files sources are able to confirm that the exploit tools belonged to the US government.
At the time of writing the auction has failed however, The Shadow Brokers have now appeared to have put up the NSA’s hacking tools and exploits for direct sale on an underground website.
NSA 2nd breach – To add to the public woes the NSA has been dealing with over the past three years,Harold Martin, former staffer stole approximately 50 terabytes of data from the the United States’ top security organisation. The majority of the information taken was considered classified and actually greatly eclipsed the previous breach by Edward Snowden.
Martin has been initially charged with mishandling information which has now been upgraded to espionage. While a lot of information was classified there is a large amount which is of greater public interest for which Martin has done a great service. Martin reportedly simply walked out the front door with the data over the course of his 20 year employment. This is case study number 1 for future employee breaches.
Oracle Point-of-Sale Terminals – Point of sale machines have become common place globally to assist all business’s process and retain important customer details. Micros, one of the largest terminal manufactures which was acquired by Oracle in 2014 for $5.3 billion reported that “hundreds of systems” at the company had been compromised.
The compromised systems had malware installed which was designed to remotely access usernames and passwords from systems located in retail outlets internationally.
Weebly – The web development and design giant put more than 43 million customers at risk earlier this year thanks to their own terrible internal security.
Weebly has openly admitted in a statement that the security gap and cyber attack was their own fault and they are taking appropriate measures for future security. The hacker reportedly took records which included usernames, passwords, IP addresses and email addresses.
AdultFriendFinder – The 2015 Ashley Madison breach which involved approx 37 million accounts has been made to look like a drop in the ocean after the 2016 AFF breach.
More than 400 million users were exposed in a targeted attack on the AdultFriendFinder network. The adult hook-up website has reportedly compromised an absolutely staggering 20 years of data from their initial set up in 1996. AdultFriendFinder describes itself as “one of the world’s largest sex hook-up” websites, with more than 40 million active users and a handful of similar adult oriented sites which were also compromised. In the cyber attack stolen data included usernames, browser information, date of the users last visit, purchasing patterns and more.
Insure your business against cyber crime.
Conclusion
Many more breaches have occurred which did not make the above list and with the enormity of the historical breaches now being brought to public attention it looks like 2017 is set for bigger and scarier reports to surface.
“I’m afraid we no longer live in a world where you can prevent breaches taking place, instead it is about how you manage them and what measures you have in place to protect your business and importantly, your customers. As recent events have shown, hard-earned reputations can be lost in a flash if you do not have the correct plans in place.” Inga Beale, Lloyd’s Chief Executive.
Each year the government departments release their collective data for an eye opening report about national, commercial and private online security.
Between July 2015 and June 2016, CERT Australia responded to 14,804 cyber security incidents affecting Australian businesses, 418 of which involved systems of national interest (SNI) and critical infrastructure (CI). The incidents affecting SNI and CI are broken down by sector below.
As CERT Australia relies on the voluntary self-reporting of information security incidents from private, commercial and government sources throughout Australia and internationally, CERT is unfortunately not able to get a complete view of all incidents. A large number of businesses which have been victims of a breach have paid a bitcoin ransom or fixed their system without notifying CERT or their cyber insurance provider.
According to CERT, the energy and communications sectors had the highest number of compromised systems. The banking and financial services and communications sectors had the highest number or DDoS attacks while the highest number of malicious emails was received by the energy and mining sectors.
Insure your business against cyber crime.
Trending exploitation techniques
Spear Phishing – emails containing a malicious link or file attachment with methods used becoming more convincing and difficult to spot. As such, spear phishing emails continue to be a common exploitation technique used in the compromise of Australian industry networks.
Ransomware – Ransomware encrypts the files on a computer (including network fileshares and attached external storage devices) then directs the victim to a webpage with instructions on how to pay a ransom in bitcoin to unlock the files. The ransom has typically ranged from $500 – $3000 in bitcoins.
Web-seeding techniques – By compromising web sites frequently visited by targets, adversaries are able to exploit targets without overt communication, such as spear phishing emails. Strategic web compromises have proven effective for thematic campaigns, such as targeting foreign policy and defence organisations via the compromise of think tanks and media organisations, but pose an equal threat to all users.
Malicious advertising – “Malvertising” allows an adversary to target a specific audience by exploiting online advertisement networks used by popular websites that visitors trust. Typically, either malicious code is inserted into an ad being presented to users in the course of their normal browsing or a benign ad is used to redirect the user to somewhere that will download malicious code automatically.
Microsoft office macros– Adversaries are increasingly using Microsoft Office macros – small programs executed by Microsoft Office applications such as Microsoft Word, Excel or PowerPoint – to circumvent security controls that prevent users from running untrusted applications. Microsoft Office macros can contain malicious code resulting in a targeted cyber intrusion yielding unauthorised access to sensitive information.
DDoS extortion– A Distributed Denial of Service (DDoS) attack is an attempt to make an online service unavailable by overwhelming it with traffic from multiple sources. DDoS extortion occurs when a cyber adversary threatens to launch DDoS activities against an organisation unless a fee is paid.
Secondary Targeting – There has been an increase in the detection of cyber adversaries attempting to gain access to enabling targets – targets of seemingly limited value but which share a trust relationship with a higher value target organisation. It is imperative that organisations understand that they might be targeted solely based on their connections with other organisations – the real target of these adversaries.
Targeted Disclosures – While the theft and targeted disclosures of sensitive information is not a new threat, the employment of the tactic in such a brazen manner against high profile entities has almost certainly lowered the threshold of adversaries seeking to conduct such acts.
Credential Harvesting Campaigns – emails direct the user to access a document via Google Drive, and by clicking on a “View Document” link, the user is then directed to a webpage where credentials are requested and thereby harvested by the adversary. Emails are then sent from the compromised user’s account to contacts contained in the compromised user’s address book, meaning the malicious emails will appear to be coming from legitimate and trusted sources.
What does a typical cyber security compromise look like?
Intial foothold
The attacker sends a spear phishing email with a malicious link to their target which when opened will execute malware creating an entry into the network.
Network Reconnaissance
After access has been granted the attacker will continually monitor and study the network, search for domain administration credentials and possibly propagate through other linked networks. As an example, an adversary will regularly access the network to gain updated user credentials, thus avoiding losing access because of password changes.
Establish Presence
Once in the network, adversaries will attempt to obtain legitimate user credentials with the goal of gaining legitimate remote administrative access. After legitimate credentials are obtained, the adversary will transition from malware dependant tradecraft to the use of Virtual Private Network (VPN), Virtual Desktop Infrastructure (VDI), or other corporate remote-access solutions combined with software native to the organisation.
Ensure Persistence
Adversaries strive to install malware or a web shell to ensure ongoing access should their legitimate accesses cease to function. Malware is typically configured with a limited “beacon rate” to minimise network traffic and evade network defenders. However, web shells are increasingly being used as they generate zero network traffic and are difficult to detect unless the adversary is actively interacting with them.
Execute Intent
Once persistent access is gained, the adversary will execute their intent. This intent could be anything from data exfiltration to enabling lateral movement to the real targeted organisation, exploiting circle of trust relationships between the organisations.
Insure your business against cyber crime.
Further Resources
Mitigation of Targeted Cyber Security Intrusions
The mitigation strategies tailor and provide additional controls that make the mitigation strategies relevant to current and emerging issues such as ransomware and other destructive malware, malicious insiders, and industrial control systems.More information can be found at http://www.asd.gov.au/infosec/mitigationstrategies.htm
The Australian Government Information Security Manual (ISM)
The Australian Government Information Security Manual (ISM) assists in the protection of official government information that is processed, stored or communicated by Australian government systems, and is available at http://www.asd.gov.au/infosec/ism/index.htm
CERT Australia (Computer Emergency Response Team)
CERT Australia’s public website contains useful information for Australian businesses in relation to mitigating cyber security incidents and security issues affecting major Australian businesses. More information can be found at: https://www.cert.gov.au/
Cyber crime & security tips from experts you can apply to your business
As cyber crime becomes more pervasive in business life the importance for employee education and security procedures is paramount. Norton has compiled a list of basic information on how you can prevent online fraud.
1. Keep your computer current with the latest patches and updates
Applying patches and other software fixes as soon as they become available is one of the best ways to keep criminals away from your sensitive information. Software manufacturers regularly update versions to include newly found software vulnerabilities that attackers could otherwise exploit.
While staying up to date will not stop all attacks, it can make the process more difficult and potentially discourage attackers from accessing to your system.
Most recent versions of popular software can be configured to download and automatically update, giving you a great start toward keeping your business secure online.
2. Make sure your computer is configured securely
Ensuring your online applications such as web browser, antivirus and anti spyware, online storage and email software are configured correctly is one of the most important areas to focus on.
Choosing the right level of security and privacy for a business depends on many variables and is best reviewed by your IT department or an independent security analyst.
Insure your business against cyber crime.
3. Choose strong passwords and keep them safe
We use passwords frequently for everything from online banking, social media and shopping to logging into our favorite airline Web site. As a result, choosing a strong password that cannot easily be guessed has never been more important to prevent becoming another victim of cyber crime.
Typically a strong password will have 8 or more characters and use a combination of letters, numbers and symbols (e.g. #3%9&@6). Avoid using any passwords which use your login name, are based on personal information such as name or date of birth and avoid words in the dictionary. Keep your passwords in a safe place and make sure not to use the same password for multiple online services.
Resetting passwords regularly or at least every 90 days can also limit the damage caused by an attacker who has already gained access to your account.
4. Protect your computer with security software
Security software necessities include firewall and antivirus programs. A firewall is usually your computer’s first line of defense-it controls who and what can communicate with your computer online and isolates bad traffic such as attacks from ever reaching your system.
The next line of defense is more often than not, antivirus software. Most antivirus software is designed to monitor all online activities such as email messages and web browsing and protects an individual from viruses, worms, Trojan horse and other types of malicious attacks. Spyware and unwanted programs such as adware are usually picked up from a good antivirus package like Norton Antivirus, McAfee Antivirus 2017, Kaspersky 2017, Avast Pro Antivirus and Bitdefender total security.
Insure your business against cyber crime.
5. Protect your personal information
It is always prudent to exercise caution when sharing personal information online such as your name, address, contact number and email address. As more online services require your information for subscriptions, newsletters and shipping your purchases it is nearly impossible to transact online without divulging personal details.
Keep an eye out for suspicious or fraudulent email messages – Suspicious messages with misspellings, poor grammar, odd phrasings and website addresses with strange extensions
Don’t respond to email messages that request personal information – Legitimate companies will not use email messages to ask for your information. When in doubt, contact the company
Avoid fraudulent websites which are used to gather personal information – Fraudsters often forge malicious links to make them look convincing
Pay attention to privacy policies on websites and in software – It is important to understand how an organization might collect and use your personal information before you share it with them
Guard your email address – be careful when posting your email address online in newsgroups, blogs or online communities
6. Online offers that look too good to be true usually are
“Free” software and guides such as screen savers, investment tricks, emoticon packs, contests and instant millionaire guarantees are some of the alluring attention grabbing techniques these companies use. The software or guide usually comes packaged with hidden advertising or monitoring software that tracks your behavior and habits ultimately being given to another group without your knowledge.
Ultimately, the old saying “if it seems too good to be true, it usually is” is again accurate.
7. Review bank and credit card statements regularly
Identity theft and online scams can be greatly reduced if caught promptly after your data is stolen or when the first use of your details is attempted.
Reviewing your monthly statements and online banking transaction history regularly is one of the easiest ways to stay on top of and report any incidents to your bank and credit card providers. Many financial institutions use fraud prevention services to identify unusual purchases and prevent the transaction in real time before any funds are charged, these systems are not perfect though and some transactions are still approved.
If your bank catches the transaction they might call you to confirm the unusual order, don’t ignore these calls as they are a good sign something or someone is attempting to access your details which are now compromised.
Trade secrets stolen in cyber attack on ThyssenKrupp AG
One of the world’s largest engineering firms ThyssenKrupp has released a cyber security statement. The release indicates they have been the victims of “organised, highly professional hacker activities” earlier in 2016.
The corporation consists of 670 companies worldwide. While ThyssenKrupp is one of the world’s largest steel producers, the company also provides components and systems for the automotive industry, elevators, escalators, material trading and industrial services. As of a 2009 reorganization, it is structured into eight business areas that fall under two major divisions, Materials and Technologies
“The incident is not attributable to security deficiencies at Thyssenkrupp. Human error can also be ruled out. Experts say that in the complex IT landscapes of large companies, it is currently virtually impossible to provide viable protection against organized, highly professional hacking attacks. Early detection and timely countermeasures are crucial in such situations. Thyssenkrupp has been successful in both respects” stated Robin Zimmermann, head of external communications.
The breach which was discovered in April 2016 after a series of additional breaches were discovered by the company’s internal security. The original breach was traced back to February 2016 and was caused by hackers located in southeast Asia.
Trade secrets and project data have been stolen from the plant engineering division. Other areas are still yet to be fully investigated in what is now the second major cyber breach since 2012 for the engineering giant. In 2012 TKAG and Airbus parent company EADS had also been targeted by Chinese hackers. In September 2015 China and the U.S. agreed not to target each other for cybertheft of intellectual property. This is a major step in the right direction and indicates their compliance with these tactics towards other targets.
Insure your business against cyber crime.
“It is important not to let the intruder know that he has been discovered,” a spokesman said. The news of the breach was not publicly announced until the company had cleansed the infected systems in one global action and implemented new security measures to monitor its computer network.
Within its marine systems unit, which produces military submarines and warships no breaches have been found.
The Australian federal government has successfully appointed Craig Davies as CEO for the new not-for-profit company Australian Cyber Security Growth Network Ltd in December 2016.
For the past 3 years Craig was previously the head of security for Australian enterprise software giant Atlassian. Mr Davies has over 25 years experience in the industry and has been a long time advisor for start-ups on security.
Insure your business against cyber crime.
Greg hunt, minister for innovation has stated “[The centre] will bring together industry, researchers and governments to create a national enterprise that will provide the foundation for the development of next generation products and services needed to live and work securely in our increasingly connected world,”
The new centre which was announced earlier this year as part of the national innovation and science agenda will cost $32 million and be positioned next to Data 61’s national cyber security centre in the Docklands.
Mr davies will be joined by Data61’s Adrian Turner and Doug Elix as the centre’s joint chairs.
In a joint study with Cambridge University, the Lloyd’s insurance giant has ranked Sydney 12th out of 301 global cities in terms cyber attack exposure with $4.86 billion ($6.36 billion) of GDP at risk for 2015 – 2025.
In its City Risk Index 2015-2025, Lloyd’s also ranked other Australian cities in the study, Melbourne’s economic risk was measured at $US3.87 billion ($5.06 billion), followed by Canberra at $US2.8 billion ($3.66 billion).
Brisbane’s risk was $US2.05 billion ($2.68 billion), Perth’s $US1.83 billion ($2.39 billion) and Adelaide’s $US1.01 billion ($1.32 billion).
Globally, Lloyd’s warns that $294 billion is at risk as attempted and successful cyber attacks become more prevalent.
“We are living in a world where people carry a globally connected supercomputer in their pocket and almost every important work document is stored in the cloud, on servers or online. The result is an explosion in the potential for cyber risk.” Lloyd’s Global CEO Inga Beale stated during a recent visit to Sydney.
“The latest series of high-profile data breaches is just the beginning,” she said. “With the emergence of the Internet of Things, the potential for cyber risk is enormous.”
Lloyd’s has seen the amount of Cyber Insurance coverage increase 168-fold in the past two decades in Australia with more businesses seeking to protect themselves.
In the US 25% of businesses now have cyber insurance. Europe should catch up after the EU introduces its General Data Protection Regulation in 2018.
The regulation, with implications for Australian business holding European customer data, requires disclosure of breaches to national data protection authorities and potentially affected individuals.
