LockBit gets an upgrade. CosmicStrand UEFI firmware rootkit. Treating thieves like white hats? Most-impersonated brands. AV-Test's Twitter account is hijacked. The cyber phase of a hybrid war.
Dave Bittner: LockBit gets an upgrade. CosmicStrand firmware rootkit is out in a new and improved version. Are thieves being treated like white hats? AV-TEST's Twitter account is hijacked. Joe Carrigan considers the mental health effects of the online scam economy. Mr. Security Answer Person John Pescatore ponders the cybersecurity talent gap. And ongoing speculation on the cyber phase of the hybrid war.
Dave Bittner: From the CyberWire studios at DataTribe, I'm Dave Bittner with your CyberWire summary for Tuesday, July 26, 2022.
LockBit gets an upgrade.
Dave Bittner: Researchers at Trend Micro discuss the most recent version of the familiar LockBit ransomware. LockBit 3.0, also known as a LockBit Black, appeared late last month, coincidentally alongside the release of the gang's new dump site and bug bounty program. It seems that Version 3 has borrowed some code from the BlackMatter ransomware strain, hence the alternative name, LockBit Black. The ransomware checks languages on the machines it targets, and it avoids executing on those it detects set for generally the Russian neck of the woods. The exclusions suggest privateering. Trend Micro concludes, with the release of this latest variant and the launch of LockBit's bug bounty program, which rewards its affiliates, we expect the LockBit ransomware group to be even more active in the coming days. We advise organizations and end users to be wary of this new variant, especially since the bug bounty program might help the operators in making their ransomware an even more formidable one.
Dave Bittner: The researchers summarized three best practices for mitigating the risk of ransomware. First, follow the three-two-one rule. That is, store three backup copies in two different formats and keep one of those backups offsite. Second, be alert for social engineering. And third, keep software up to date with regular patching.
CosmicStrand UEFI firmware rootkit is out in a new and improved version.
Dave Bittner: Researchers at Kaspersky have identified a new UEFI - that's unified extensible firmware interface - firmware rootkit. They're calling CosmicStrand an updated version of a rootkit Qihoo360 discussed in 2017. CosmicStrand appears in GIGABYTE or ASUS Motherboard firmware images. And while Kaspersky hasn't been able to determine how the infection occurs, they think it likely that a common vulnerability in the H81 chipset is being exploited.
Dave Bittner: The rootkit can be used to deploy a range of malicious payloads. The victimology is interesting, and the attacker's motives are difficult to discern. Kaspersky wrote, we were able to identify victims of CosmicStrand in China, Vietnam, Iran and Russia. A point of interest is that all the victims in our user base appear to be private individuals, and we were unable to tie them to any organization or even industry vertical. Attribution is unclear, although signs point to Chinese or at least Chinese-speaking authorship.
Dave Bittner: CosmicStrand offers an attacker the prospect of great persistence and extraordinary stealth. And it prompts some disturbing speculation from Kaspersky about the unknown unknowns that may still be out there. Kaspersky says the most striking aspect of this report is that this UEFI implant seems to have been used in the wild since the end of 2016, long before UEFI attacks started being publicly described. This discovery begs a final question. If this is what the attackers were using back then, what are they using today?
Treating thieves like white hats?
Dave Bittner: Cryptocurrency platforms who've seen their holdings looted by cyber thieves are increasingly offering the criminals who've rifled the platform's wallets a reward if they'll return a substantial fraction of what they've stolen. According to The Wall Street Journal, legitimate vulnerability researchers - white hat bug hunters - are unhappy about their own trade being conflated with that of the criminals. The payments are a very small fig leaf placed over a ransom payment, which isn't at all the case with legitimate bug bounties. The sort of crime the cryptocurrency platforms are dealing with isn't, in the first instance, extortion; it's direct theft. And it's difficult to see this particular business strategy as likely to do anything other than stoke the existing bandit economy.
Most-impersonated brands in phishing attacks.
Dave Bittner: Security firm Vade this morning released a report detailing trends in phishing scams with particular attention to brand impersonation. The study found that Microsoft was the most impersonated brand in the first half of 2022, followed closely by Facebook. Looking at scams by sector impersonated, financial services were at the top of the leaderboard. One interesting tidbit researchers found is that phishing is most likely to happen on weekdays, with most phishing attacks occurring between Monday and Wednesday.
AV-Test's Twitter account is hijacked.
Dave Bittner: The Magdeburg, Germany-based security testing firm AV-TEST GmbH said yesterday that its English-language Twitter account had been hijacked. As we record this, they don't seem to have returned their account to normal. How their account was hijacked is unknown. And as Graham Cluley sensibly points out, it's premature to blame either AV-TEST, Twitter or anyone else for negligence. Who hijacked the account? It's a dog-bites-man story. The hijackers appear to be some goons hawking dimwitted non-fungible tokens they call Doodles.
A look at the cyber phase of the hybrid war.
Dave Bittner: And finally, many have noted that Russian cyber offenses haven't had the devastating effects that were expected during the run-up to the invasion of Ukraine. But it's important to remember that this isn't necessarily for want of trying. CyberCube's Global Threat Briefing sees substantial cyberactivity - some hacktivism, some state-run, some privateering - on both sides. In their report, they state, since the start of the war in Ukraine, both sides have been amassing cyber armies, and hacktivists have pooled their efforts to attack Russia. Anonymous has broken into CCTV cameras at the Kremlin. Meanwhile, Russian hacktivists are striking targets in Eastern Europe. There are currently more than 70 different cyber threat actors related to the war in Ukraine, double the number identified at the beginning of March.
Dave Bittner: Strategic Risk notes CyberCube's observations about how Russian cyber-espionage and ransomware activity have increased and spread at higher-than-customary rates to target nations sympathetic to Ukraine. Target selection by ransomware privateers has shown evidence of a great deal of attention being paid to sectors that may be more vulnerable and overlooked. CyberCube told Strategic Risk that ransomware gangs are currently targeting lower-profile critical infrastructure operations and small- and medium-sized businesses in health care, agriculture and food supply chains. Businesses in these industries are among those who can least afford the downtime associated with ransomware and extortion attacks and often lack resources for effective cybersecurity in the face of well-resourced and determined attackers.
Automated Voice #1: Mister.
Automated Voice #2: Security.
Automated Voice #3: Answer.
Automated Voice #4: Person.
Automated Voice #1: Mister.
Automated Voice #2: Security.
Automated Voice #3: Answer.
Automated Voice #4: Person.
John Pescatore: Hi, I'm John Pescatore, Mr. Security Answer Person. Our question for today - we all know that first COVID and then Russia's invasion of Ukraine caused massive supply chain problems, but supply chain problems around hiring security staff predate that by many years. You'd think by now, supply and demand would have long ago addressed this. How big really is the cybersecurity talent gap?
John Pescatore: That's an easy answer for me. The number of unfilled cybersecurity positions is somewhere between 39,000 and 3.5 million. Next question? Well, I bet you're thinking, could he narrow that down a bit? Picky, picky, picky. Those numbers came from a CyberSeek study on the cybersecurity talent gap. Cybersecurity is an effort by Burning Glass, CompTIA and the National Institute of Standards and Technology, National Initiative for Cybersecurity Educationist, NIST, NICE. So in order to really answer that question, we first need to know two numbers. How many security professionals are needed? That is largely subjective. And then how many security professionals are currently employed? This is quantitative but is proven hard to measure, but that's what CyberSeek addressed.
John Pescatore: So let's dig into the CyberSeek numbers a bit. I'm going to have to be U.S.-centric here because it's really, really hard to find numbers outside the U.S. The cybersecurity project recently said they found 181,000 job openings for security analysts in the U.S. but only 142,000 employed security analysts. That's the source of the 39,000 estimate of the shortage. So let's take a statistical look. In an infographic, CyberSeek says there is one cybersecurity employee for every eight job openings versus the national average across all jobs of one employee per three openings. That would say there are about 57,000 people employed in security-related fields, meaning, overall, they're saying there are about 200,000 people working in cybersecurity against about 600,000 openings. This would say the U.S. needs 800,000 cybersecurity employees.
John Pescatore: But let me do a sanity check on that. The U.S. Census says IT employees are about 3.3% of the overall workforce. Over my years at Gartner, we typically found that there was one IT employee for about every 25 company employees, and that was a good average across both mid and large businesses. We then found that there was about one security person for about every 10 to 25 IT employees, with an average of about one security employee for about every 15 IT employees. So what? - you say. Well, there are about 8 million IT employees in the U.S., meaning there are already about 533,000 folks working in cybersecurity versus the 200,000 that CyberSeek implies. That's a big difference, and it even gets worse if you look at other studies.
John Pescatore: Bottom line on a quantitative analysis, we don't have the data. So here's a subjective qualitative analysis. First, full disclosure - for the past 10 years, I've worked for SANS, the biggest cybersecurity training company out there. What SANS sees is less a headcount gap than a skills gap. There are a lot of people already employed in cybersecurity, but not enough of them have the hands-on skills to fill the protect, detect, defend, respond jobs across the actual technologies that businesses are using today, like mobile apps and the cloud and development pipelines and all the modern software development approaches. The attackers don't need lots more people with four-year degrees to succeed. The attackers are using hands-on experience with very small numbers of, quote-unquote, "new hires." We need to look at that model for cybersecurity on the defensive side.
John Pescatore: That's nice, but I was looking for a number, is probably what you're thinking. But I honestly think there are way too many wild-ass (ph) guesses of the overall totals already out there, and I'm not going to add to it. Here's what I see as a common pattern in well-run security programs. They need to increase security operations staff by about 10% while they're sending their existing SecOp staffs to about one security training course per year to get those needed skills, especially hands-on skills. Reducing turnover is also really critical. I found that security teams that are using open-source tools the most have the lowest turnover. It's kind of a myth that security people just keep jumping for jobs to make a little bit more money. If they love their job and they're feeling creative, they stay in place. SOC staff that gets to add value to the tools versus just clicking on SIM events all day stay longer. The investment in hands-on training also helps reduce the turnover number. Bottom line - a skilled employee who's been with you for five years helps close that employee gap by being ridiculously productive. Let's close the gap through productivity increases versus trying to throw more bodies at cybersecurity problems. After all, that's what the bad guys are doing.
Automated Voice #1: Mr.
Automated Voice #2: Security.
Automated Voice #3: Answer.
Automated Voice #4: Person.
John Pescatore: Thanks for listening. Don't forget to submit your questions. See you next month.
Automated Voice #1: Mr.
Automated Voice #2: Security.
Automated Voice #3: Answer.
Automated Voice #4: Person.
Dave Bittner: Mr. Security Answer Person with John Pescatore airs the last Tuesday of each month right here on the CyberWire. Send your questions for Mr. Security Answer Person to questions@thecyberwire.com.
Dave Bittner: And joining me once again is Joe Carrigan. He's from the Johns Hopkins University Information Security Institute and also my co-host over on the "Hacking Humans" podcast. Hello, Joe.
Joe Carrigan: Hi, Dave.
Dave Bittner: Interesting story you and I actually spoke about over on "Hacking Humans."
Joe Carrigan: Yeah.
Dave Bittner: This is from The Washington Post - story written by Heather Kelly. And it's titled "The Nonstop Scam Economy is Costing Us More Than Just Money - Relentless Waves of Sophisticated Phone and Online Scams are Affecting People's Mental Health." So really hitting more on the human side of the equation here, Joe. What caught your eye in this story here?
Joe Carrigan: Well, the story involves the - I don't know - I'm going to say ordeal of a woman named Pamela, who is a cancer patient. In receiving the treatment for her cancer, she must answer her phone for every time someone calls. I don't know if anybody out there has ever had a family member or actually gone through cancer treatment yourself, but it is imperative that you are on time with all these treatments.
Dave Bittner: Right.
Joe Carrigan: That's what makes them more effective. So if a doctor's calling you to notify you of something or, you know, some care provider or whatever is calling you to tell you about some change, you should probably answer the phone.
Dave Bittner: Right.
Joe Carrigan: Also, you probably don't have everybody's phone number that's going to contact you for treatment in your phone.
Dave Bittner: Yeah.
Joe Carrigan: So you're left with the option of just letting the phone calls come through and answering all of the phone calls...
Dave Bittner: Yeah.
Joe Carrigan: ...Which then results in you getting exposed to, according to this woman, about 20 scam calls a day, including some of them for funeral insurance, which I'd like to know how they're coming through with that - coming up with that information. Is that coincidental, or do they know that she's a cancer patient...
Dave Bittner: Right.
Joe Carrigan: ...And they're trying to do this to her? Because that is - that's just awful...
Dave Bittner: Yeah.
Joe Carrigan: ...That that's happening.
Dave Bittner: Yeah. I think what caught my eye here is just how relentless these calls are. And, you know, you and I have spoken about how we just don't answer our phones anymore.
Joe Carrigan: Right.
Dave Bittner: I think for a lot of folks, that's the way it's gone where...
Joe Carrigan: Yeah.
Dave Bittner: ...If someone calls you and they're not already in your...
Joe Carrigan: In your address book.
Dave Bittner: ...Address book, you're just going to let that go to voicemail.
Joe Carrigan: Yeah. I have the Google call screener on my phone that lets me do that if it's a new phone call. I can screen the call. I can also - you use an app - right? - that is...
Dave Bittner: Yeah. Yeah, there's an app called RoboKiller that I use on my iPhone that I've been quite pleased with. And it - what it does is it cross-references the incoming call with its own database of known scam call numbers. So if something matches up, my phone doesn't even ring.
Joe Carrigan: Yeah.
Dave Bittner: So a couple bucks a month, but for me, it's worth it.
Joe Carrigan: Right. So that's a paid service?
Dave Bittner: Yeah.
Joe Carrigan: OK.
Dave Bittner: Yeah. Yeah. This article points out that the Federal Trade Commission is attempting to do stuff about this.
Joe Carrigan: Yeah.
Dave Bittner: There's the...
Joe Carrigan: Yeah.
Dave Bittner: ...the STIR/SHAKEN program, which the large carriers agreed to in 2019, and it's supposed to be rolling out to some of the - to - I guess the rest of the smaller carriers, but...
Joe Carrigan: Yeah. We'll see how that works.
Dave Bittner: (Laughter).
Joe Carrigan: You know, the smaller carriers have been the issue because they reach out to companies that need to make dialing events here in the United States. Because the United States is a big market, right? So there are companies out there that have this business model where they provide Voice Over IP links to other countries to allow the offshoring of customer service and things of that nature.
Dave Bittner: Right.
Joe Carrigan: And what happens with that is it's - of course, like I frequently say, a tool is neither good or evil; it's how you use it.
Dave Bittner: Yeah.
Joe Carrigan: I can use a hammer to build a house for somebody, or I can use a hammer to break into someone's house and rob it.
Dave Bittner: Right.
Joe Carrigan: Nobody blames the hammer. We should be focusing on the people. Some people go out and they buy these - they buy the service from these companies, and then they're allowed to make these large amounts of - volumes of calls. And I think that what happens behind the scenes is when these companies realize these guys are scammers, they shut them down, right? But there are other companies out there. They can move from company to company to company, different providers. And then when they have worn out their welcome, they just form a new organization.
Dave Bittner: Yeah.
Joe Carrigan: These are criminal enterprises, right? They can do this all day long. This is what they do. So it's very difficult to stop this from a regulatory standpoint...
Dave Bittner: Yeah.
Joe Carrigan: ...I think. And even if we do regulate this, at some point in time, there's going to be - almost immediately, actually, I'll say that - almost immediately after the regulation is put in place, these guys are going to adapt and change their game to continue to be able to reach out and contact people.
Dave Bittner: Right.
Joe Carrigan: One of my biggest concerns with this is that phones - I said this over on "Hacking Humans," too - phones and email are very similar in that if somebody has your unique identifier, be it an email address or a phone number, that's all they need to get in touch with you and to put something in front of you, barring any technical prevention on your end, right? They just have public access to your ear or to your eyes, depending on what device you're using.
Dave Bittner: Yeah. Yeah. I guess really what sticks out to me here is just the human side of this, that...
Joe Carrigan: Yeah.
Dave Bittner: ...You know, I think - we've all lived through COVID.
Joe Carrigan: Yep.
Dave Bittner: And so, you know, there's an emotional toll that that has taken on a lot of us. You know, there's a lot of uncertainty in the world for all sorts of different reasons, and so you have this on top of that. Just a good reminder that the victims of this, you know, we should be empathetic to them, do what we can to try to help them and not blame them for falling victim to these sorts of things.
Joe Carrigan: Yeah. In some small way, we're all victimized by this.
Dave Bittner: Yeah.
Joe Carrigan: I got a phone call that came right through the other day. It was someone claiming to be from Amazon - and they weren't from Amazon...
Dave Bittner: Right.
Joe Carrigan: ...Telling me that I purchased an iPhone.
Dave Bittner: Right, right. Yeah. We know that would never happen.
Joe Carrigan: Right. Exactly.
Dave Bittner: (Laughter) All right.
Joe Carrigan: I don't know. Don't say never, Dave.
Dave Bittner: (Laughter) We'll get you. We'll get you.
Joe Carrigan: I'm really not happy with my Google product.
Dave Bittner: All right.
Joe Carrigan: (Laughter).
Dave Bittner: All right. Well, Joe Carrigan, thanks for joining us.
Joe Carrigan: It's my pleasure, Dave.
Dave Bittner: And that's the CyberWire. For links to all of today's stories, check out our Daily Briefing at thecyberwire.com.
Dave Bittner: The CyberWire podcast is proudly produced in Maryland out of the startup studios of DataTribe, where they're co-building the next generation of cybersecurity teams and technologies. Our amazing CyberWire team is Liz Irvin, Elliott Peltzman, Tre Hester, Brandon Karpf, Eliana White, Puru Prakash, Justin Sabie, Rachel Gelfand, Tim Nodar, Joe Carrigan, Carole Theriault, Ben Yelin, Nick Veliky, Gina Johnson, Bennett Moe, Chris Russell, John Petrik, Jennifer Eiben, Rick Howard, Peter Kilpe, and I'm Dave Bittner. Thanks for listening. We'll see you back here tomorrow.
