NASTE Publishes SP 123456789

Today the National Academy of Security and Technology Equipment (NASTE) published a draft of their newest cybersecurity publication, SP 123456789, Password Selection for Little Used Applications with No Access to Sensitive Information. This publication was designed to provide guidance on how to select a password for access to free publications and stand-alone applications that provide no access to personally identifiable information.

Kate Libby, a researcher with Dragonfire Cyber, and one of the co-authors of the draft, explained: “The proliferation of devices and applications requiring a unique password for adequate cybersecurity protections has made it increasingly difficult for the average person to keep track of the multiple passwords. We need to make it simpler for people to remember their passwords by using realistic passwords for devices and applications where system compromise will have minimal impact on individual security.

In addition to selection of easily remembered passwords, a chapter of the proposed standard discusses the use of fake names and fictional biographic data when signing up for access to devices and accounts where there are few or limited security concerns.

CAUTIONARY NOTE: This is a future news story –

Local Blackouts Caused by Electric Grid Hack

Atkinson Electric Cooperative announced today that the recent series of electrical blackouts in the area around Delano, GA have been caused by attacks on the local electric distribution system. “We have seen a pattern of electric system shutdowns that appear to be caused by cyber-attacks on many of our automated circuit reclosers,” Preston S. Arkwright, AES spokesperson, told reporters this morning at the daily CI-SOC news conference; “These devices are designed to maintain power distribution in the face of minor interruptions and these hackers are using them as a weapon against our distribution system.”

General Turgidson, Director of National Critical Infrastructure Security Operations Center (CI-SOC), told reporters that teams from the Center had helped to investigate the power system interruptions. “Our teams discovered that the Robotron AWS systems had been individually hacked and reprogramed so that the reclosers did not actually reset the power connection when a potentially minor interruption occurred. Turgidson told reporters.

Dade Murphy, CTO of Dragonfire Cyber, told reporters at the news conference that a team of analysts had isolated a copy of a new Bluetooth malware, they were calling SoreTooth, that allowed attackers to use the AWS Bluetooth connection to reprogram the switch controller. “The crafters of this malware were using a new 0-day vulnerability and two known Bluetooth vulnerabilities to gain administrator level access to the switch software.”

The Federal Bureau of Inquiry is working with the CI-SOC and Dragonfire investigators to try to determine who is behind the attack. Johnathan Quest, FBI spokesperson, refused to comment on apparent claims that a terrorist group was behind the attack; “This is an ongoing investigation and we are not prepared to comment on the identity of potential suspects at this time.”

An Instagram account, since taken down, had been claiming that a group called Carbon Restoration was behind the attack. The group reportedly was acting to stop local utilities from buying solar and hydro generated electricity to replace power previously produced at coal fired power plants. The AEC web site notes that it was targeting a 50% share of daytime power supply from the growing number of solar power farms in Georgia.

CAUTIONARY NOTE: This is a future news story –

VaxSurge Ransomware Hits Freezers

The VaxSurge ransomware reported Sunday included a previously undetected worm that attacked health department freezers holding COVID-19 vaccines. “We under-estimated the sophistication of the VaxSurge ransomware,” General Buck Turgidson, Director of the National Critical Infrastructure Security Operations Center (CI-SOC), told reporters this morning: “When we saw how easy it was to stop the spread of the data encryption process, we assumed that the attacker was not using a sophisticated ransomware program. We were wrong.”

The CI-SOC researchers discovered the worm (unofficially being called the FreezerWorm according to technicians I have talked to) after the Delano, GA Health Department reported discrepancies in their temperature monitoring processes.

A researcher from Dragonfire Cyber, speaking on background, told reporters that the Delano facility was using old-style circular chart recorders in addition to the digital temperature reporting system provided by the freezer manufacturer. They did this in response to last November’s attack on Mengele Pharma. The chart recorder showed a significant temperature rise not reflected by the digital system. The company immediately informed the Dragonfire team that was on-site for the VaxSurge investigation.

Lilian Wald, the Director for the Delano Public Health Department, told reporters at the CI-SOC news conference that temperatures never got above the safe storage temperature limit for the vaccines. “Thanks to the prompt action of the Dragonfire team, the vaccines are still safe to use,” Wald told reporters.

The Chief-Technical Officer for Dragonfire Cyber, Dade Murphy, explained to reporters at the press conference that the worm associated with the VaxSurge attack exploited a new vulnerability in the Robotron data historian that effectively bypasses the digital data diode used in that system. “We have communicated the vulnerability to Robotron and they are working on mitigation measures,” Murphy explained.

CI-SOC has a software tool that reverses the attack on the Robotron freezer control system. “Any organization that has received the VaxSurge email, should immediately contact CI-SOC for assistance,” Turgidson explained at the end of the VaxSurge presentation.

Mary Cavart, spokesperson for the Department of Health and Medical Services, confirmed today by video feed that the Department had shut down the email account that had been used to spread the VaxSurge ransomware.

The Federal Bureau of Inquiry is investigating the attack on that email server. “As far as we can tell that account was established at least eight months ago,” Johnathan Quest, FBI spokesperson said; “It does appear that may have been associated with the Solar Winds based attack last year.”

The FBI reports that they have now received notifications form over 150 health departments about receiving the VaxSurge email. Because of the news reporting Sunday, most of those reporting did not open the email on Monday when it was first seen in their inboxes. “Most of the reporting health departments are located in the South Eastern United States,” Quest reported.

CAUTIONARY NOTE: This is a future news story –

VaxSurge Ransomware

The Federal Bureau of Inquiry announced this morning that it was investigating a new ransomware campaign targeted at local public health agencies. While the attack was encoding files at the affected agencies the attacker has not been demanding a monetary ransom. Instead, they are unlocking files once the agency has published a notice in the local newspaper that they were not supporting the President’s new mandatory COVID-19 vaccination program.

“We have been notified by twenty local public health agencies about successful attacks since yesterday morning,” Johnathan Quest, spokesperson for the FBI, told reporters this morning; “Since the attacks appear to have started on Saturday, we expect to receive more notifications on Monday when many of these organizations return to normal workhours.”

The National Critical Infrastructure Security Operations Center (CI-SOC), working with the Delano, Georgia Health Department, has determined that the attackers have delivered the ransomware via a letter emailed to the Department. “The email was apparently sent by a compromised email server in the Department of Health and Medical Services. It purportedly came from the Office for COVID Vaccinations,” General Turgidson explained at an unusual Sunday press conference at CI-SOC.

A spokesperson for the Department confirmed that there was no such office in DHMS.

A technician from the CI-SOC, speaking on background, told reporters that this was not a very sophisticated ransomware program. Instead of trying to penetrate the organization network before announcing its presence, the ransomware encrypted the machine at the point of infection before it started penetrating the network. Promptly unplugging the connections to the network effectively stopped the spread of the ransomware.

Turgidson reported that the infected email included a Microsoft Word document entitled “Mandatory COVID-19 Vaccination Surge”. It contained an ActiveX-control that exploited the newly reported 0-day Microsoft® MSHTML Remote Code Execution Vulnerability. “The rapid exploitation of the Microsoft vulnerability and the use of the old-school ransomware program do not paint a consistent picture of this attacker,” Turgidson explained; “That combined with an exploitation of a SolarWinds compromised mail system is causing us all sorts of investigative headaches.”

CI-SOC is calling this the VaxSurge malware campaign because of that term is used in a comment line in the malware code sample that they are working on.

CAUTIONARY NOTE: This is a future news story –

CI-SOC Expands Robotron Advisory

Today, at an unusual afternoon press conference, Gen Turgidson, the Director of the Director for the National Critical Infrastructure Security Operations Center (CI-SOC), announced that on-going investigations related to yesterday’s announcement by Robotron had determined that a number of other vendor products were affected by the underlying JavaScript vulnerability. “We have already identified seven products from three other vendors that have SMS reporting tools that allow the exfiltration of system configuration files.” Turgidson told reporters.

A new alert published today by CI-SOC did not name the vendors or products that have been identified. A CI-SOC spokesperson speaking on background said that the government was working with the vendors to develop mitigation measures and did not want their names released until such fixes were available. “We expect to announce those mitigation measures within the next couple of days,” she told reporters.

The alert does note that any organization that has an industrial control system, building control system or security system that provides SMS alerts containing .PNG images of HMI screens associated with those alerts should contact CI-SOC. According to the alert, CI-SOC has a relatively simple test available that identifies active exploits of the JavaScript vulnerability.

Turgidson explained to reporters that the exploit of this vulnerability was a precursor tosome sort of potential future attack. “The configuration data would provide attackers insights into the cybersecurity weaknesses at the affected facilities that could potentially be exploited by a wide variety of potential actors, the General said.

In a series of messages, cYberg0d, the researcher who originally reported the vulnerability being exploited, explained to me that the JavaScript module that they identified was designed to search for a number of specific control system related devices and copy their configuration files. The information would then be encoded in a .PNG file and sent to one of a series of cell phone numbers hardcoded in the module.

When asked if this did not make the attacker vulnerable, Cyberg0d said that both the phone list and target systems had been changed in the module at least twice since he originally identified the problem. “The phones for the old numbers have probably been destroyed.”

Johnathan Quest, spokesperson for the Federal Bureau of Inquiry confirmed that the FBI was working with CI-SOC to try to identify the identity of the attackers. “We are also working with a number of cybersecurity firms to keep an eye on the facilities that we have identified as being impacted by this problem,” Quest explained; “We are hoping to prevent any subsequent attacks on these facilities.”

CAUTIONARY NOTE: This is a future news story –

Robotron Announces Data Exfiltration Vulnerability

Today, Robotron announced the presence of a bug in their RoboAlarm® product that has been exploited in the wild to exfiltrate control system configuration files from secure control systems. Robotron spokesperson Erich Mielke explained that this bug was actually an exploit of the JavaScript CVE-2021-23406 vulnerability. Robotron has an update available to fix the vulnerability. RoboAlarm is packaged as a component of many Robotron products, including all of their HMI stations.

According to Robotron’s RoboAlarm advisory the vulnerability was reported by cYbrg0D. In a tweet published right after Robotron’s announcement, cYbrg0d explained that the current vulnerability could be expanded to include process information exfiltration by modifying a specific JavaScript module.

General Turgidson, the Director for the National Critical Infrastructure Security Operations Center (CI-SOC), urged all companies that owned Robotron equipment to update their RoboAlarm systems immediately. “We have documented cases where this bug has been used to exfiltrate control system configuration data,” Turgidson explained at the CI-SOC morning press conference: “This information would provide an attacker with critical intelligence needed to execute an effective attack on an industrial control system.”

Kate Libby, a spokesperson for Dragonfire Cyber, explained that RoboAlarm is a messaging application used by Robotron human-machine interfaces to send remote notifications about process upset conditions to managers and engineers in an organization. The messages typically include a screen shot of the HMI to provide more details for the recipient to make more informed judgements about an alarm condition.

“The system uses a .PNG file for the screen shot,” Libby explained: “So this JavaScript within the RoboAlarm product converts configuration files into .PNG files for exfiltration.”

In response to a question about the underlying vulnerablity Mielke reported that Robotron had not been aware of the JavaScript vulnerability until being informed about how it impacted their RoboAlarm product by cYbeg0D. “We are going back and reviewing all of the JavaScript code used in our products.” Mielke said.

CAUTIONARY NOTE: This is a future news story –

FMPC Sues PSSOO Over Pipeline Security Directive

On Friday the Friendly Morning Pipeline Company (FMPC) filed a suit in the 14^th US District Court against the Pipeline Safety, Security and Operations Office (PSSOO) over their labeling of the most recent PSSOO pipeline security directive as Sensitive Security Information. SSI is part of the sensitive but unclassified (SBU) information protection system maintained by various agencies of the US government.

The suit claims that the PSSOO’s declaring the security directive as SSI imposed an unreasonable financial burden on the pipeline company because the SSI regulations required that the company install special computer equipment at each of its offices to store the directive and all associated files in accordance with the requirements of SP 800-171. The lawsuit also alleges that the SSI requirements are an unlawful restraint of the company’s free speech rights to discuss regulatory actions of a government agency.

Michael E. Thane, spokesperson for PSSOO, told reporters this morning that the agency had no comment on the lawsuit, explaining: “It is the policy of the Federal Government to not speak to the press about on-going litigation.”

Thane did, however, confirm that the SDO2, the most recent PSSOO cybersecurity directive for pipelines was labeled as SSI. “SDO2 contains detailed cybersecurity requirements for covered pipeline owner/operators;” Thane explained; “If adversaries of the United States had access to that information, it would allow them to bypass those security controls. That could imperil the safety and security of the United States.”

Werner Bergeron, a lawyer for StormFury, an environmental activist organization, has filed a friend of the court brief on the lawsuit. In a press release issued today, Bergeron said: “It is not often that I agree with pipeline operators, but the PSSOO clearly overstepped its authority in the classification of SDO2. We are concerned that the application of the SSI label to a purely regulatory document inhibits public discussion about the appropriateness and legality of the regulatory requirements. It prevents organizations such as ours from reviewing the directive and commenting on its efficacy in protecting the environment.”

I talked with Kate Libby, spokesperson for Dragonfire Cyber. She confirmed that the company was working with a number of pipeline operators in implementing the controls outlined in SDO2. “I cannot comment on the specific requirements of SDO2 since that document is classified as SSI,” Kate told me; “But if a regulation required all covered facilities to implement two factor authentication to access control system computers, that would be insufficient information for even a nation-state actor to bypass those controls. It would require specific information on what type of 2FA was being used and which specific software tool the facility was using to implement that requirement for an exploit to be crafted. I can tell you that SDO2 does not specify specific pieces of hardware, software or firmware.”

CAUTIONARY NOTE: This is a future news story –