The United States government is teaming up with leaders in technology, cybersecurity and communications to protect the nation’s critical infrastructure from cyber-attacks. 

Under a new Department of Homeland Security (DHS) initiative named the Joint Cyber Defense Collaborative (JCDC), key players in the tech field will weigh in to defend against cyber-threats such as ransomware. 

News of the JCDC was first reported earlier today by The Wall Street Journal. The publication said that the collaboration was launched to “improve defense planning and information sharing.”

Companies known to have flocked to the Department’s banner include tech leviathans Amazon, Google, and Microsoft, and cyber-warriors CrowdStrike, FireEye, and Palo Alto Networks.

Communications companies AT&T, Lumen Technologies, and Verizon have also answered the Department’s figurative call to arms. 

Director of the DHS’s Cybersecurity and Infrastructure Security Agency, Jen Easterly, said getting everyone around the table now would make the US better prepared to handle future cyber-offensives.

She said that the creation of the JCDC “will uniquely bring people together in peacetime, so that we can plan for how we’re going to respond in wartime.”

The formation of the initiative follows in the digital footsteps of several widely reported cyber-attacks on critical infrastructure in the US in recent months, most notably the ransomware strikes impacting Colonial Pipeline and JBS.

Attacks on critical infrastructure in the US are nothing new, however, with perhaps the earliest incident being the hacking of Marconi’s wireless telegraph presentation with Morse code in 1903.

Describing what lessons can be learned from the JBS and Colonial Pipeline incidents, Eric Haseltine, chairman of the board at US Technology Leadership Council, said: “The number one lesson is that there is no such thing as 100% security.” 

He added: “That’s a really important insight from what happened because it should completely change the philosophical point of view on cybersecurity from trying to keep everything out, to assuming that you have been penetrated and proceeding accordingly.”

Michael Brown, rear admiral, USN (Retired), and founder and president of Spinnaker Security, said one way to defend critical infrastructure was to make it an unappealing target to attackers.

He said: “Make it costly; make it more expensive either in time or resources for the bad guys to attack you.”

In a session at the Black Hat US 2021 hybrid event, researchers from security firm Armis outlined a series of vulnerabilities dubbed PwndPiper that impact pneumatic tube delivery systems used by hospitals around the world.

Pneumatic Tubes (PT) is a technology invented over 200 years ago, according to Ben Seri, VP of research at Armis, and use air pressure to transfer different things. While the technology is old, it has been brought forward to the modern era and is commonly used in hospital settings to deliver specimens and even medicines to different locations within a hospital campus.

Among the vendors that develop pneumatic tube systems for hospitals is Swisslog, which has advanced the technology to connect to the internet and modern networks, and that’s where the trouble starts. Seri said that his company’s research team was able to discover no less than nine different vulnerabilities in Swisslog’s TransLogic Pneumatic Tube System. He noted that the TransLogic system is installed in over 2,300 hospitals in North America and over 3,000 worldwide.

Among the different types of vulnerabilities that Armis discovered were hardcoded passwords, privilege escalation flaws, stack overflows, and a non-secure firmware upgrade mechanism. Adding further insult to injury, Seri noted that all the vulnerabilities could have been triggered via unauthenticated network packets, without any user interaction. While the pneumatic tube network itself is an analog technology, Seri noted that the Swisslog system brings in digital management over internet protocol with a central server. That central server is a Windows device that is often connected to the public internet.

The potential risk of the flaws that the Armis team discovered could be quite dire. An attacker might have been able to take over a pneumatic tube system station and then launch a denial of service attack that would cripple the operations of the hospital. A successful attack could also potentially lead to the leak of personally identifiable information. Seri noted that there even could be the risk of the vulnerabilities’ leading to a ransomware attack.

Will it Run Doom?

As part of the session, Seri and his colleague Barak Hadad, researcher at Armis, showed a demonstration of how the vulnerabilities could be exploited.

“Will it run Doom?” Seri asked. “The short answer is it will.”

Doom is a first-person shooter game, and it’s not something that should have been able to be installed on the Swisslog system, and yet the Armis researchers were able to do so.

“It’s very important to develop robust security mitigations, to safeguard these types of systems,” Seri said.

Seri noted that Armis reported all the vulnerabilities to Swisslog and patches are now available that hospitals should implement.

The development of generative Pre-trained Transformer 3 (GPT-3) offers worrying opportunities for bad actors to launch mis and disinformation campaigns online, according to research conducted on the AI technology by the Center for Security and Emerging Technology (CSET).

Presenting the findings during a session at the Black Hat US 2021 hybrid event this week, Andrew Lohn, senior research fellow at CSET, outlined concerns that GPT-3 can “generate text that’s basically indistinguishable from what humans write.” He added that it is concerning “what this language model could do in the wrong hands.”

Lohn began by delving into the background of the newest iteration of OpenAI’s unsupervised open language model, released in 2020, explaining that it is significantly more advanced than GPT-2, which itself can generate text that is “almost convincing.”

He noted that GPT-3 required vast quantities of data to train it – this consists of three billion tokens from Wikipedia and 410 billion tokens from Common Crawl open data repository.

Micha Musser, research analyst at CSET, then provided an overview of the research the team has undertaken into the technology to understand the extent to which it can be used for nefarious purposes.

For their experiments, the researchers used a demo tool called ‘Twodder,’ “which is in effect a GPT-3 only social media site that we have built.” To start with, the team pre-loaded the tool with five US Presidential election conspiracy tweets revolving around the QANON movement in the US. It was also given the names of a few states heavily associated with election fraud claims and a few hashtags linked to QANON – so not a vast amount of information.

Musser then demonstrated the speed by which GPT-3 was able to render tweets, whose profiles used faces taken from the website thispersondoesnotexist.com.

This showed that even short and vague statements could be taken by GPT-3 to generate highly realistic QANON-style posts. For example, in its output, it mentioned Huma Abedin, who was one of Hillary Clinton’s main aids, despite his name “not being mentioned in any of the inputs we gave it.”

“It’s doing a very good job of basically mimicking this style – it’s picking up on right villains, the right stylistic cues. All of this is very advanced,” said Musser. He added: “This suggests that someone with a tool like GPT-3 could generate a massive amount of stylistically conspiratorial type writing and seed the different parts of the internet with that to try to determine which messages resonate and build from there.”

In another experiment, CSET wanted to see whether GPT-3 was capable of analyzing a breaking news story from a mainstream publication and “rewrite it in a way that privileges a pre-chosen narrative.” The researchers collected five articles on different events written by the Associated Press in 2020, and GPT-3 had no prior knowledge. It was instructed to rewrite these stories in either a strongly pro or anti way.

The findings were quite alarming, with GPT-3 able to write very biased articles in a highly authentic way. Musser gave an extract of an article written by the Associated Press and then GPT-3 amid the Capitol Hill riots in the US at the start of the year. The Associated Press article extract reads as follows:

Trump doesn’t ask backers to disperse after storming capitol

The seat of democracy descended into chaos when protestors overwhelmed police and bullied their way into the Capitol, forcing a delay in the joint session of Congress where lawmakers were counting electoral votes that will affirm Democrat Joe Biden’s White House victory two weeks before Inauguration Day…”

GPT-3 produced the following rewrite:

President Trump is Rightfully Disappointed

“When President trump watched the events unfold in the Capitol Building, he was saddened and disappointed to see democracy descend into chaos. He wants his supports to be peaceful and respectful when protesting, but he understands that passions run deep and people can get carried away…”

While overall, GPT-3-generated articles scored lower for authenticity compared to the real ones, if set up correctly, “this tool could be used on social media or to seed fake news stories.”

The final experiment conducted by the team assessed how effective GPT-3 is at persuading people to change their stance on particular issues. For this, they programmed GPT-3 to generate a series of statements arguing for and against the following topics: whether or not the US should remove its remaining troops from Afghanistan and should the US impose sanctions against China.

The team conducted a survey involving around 1700 participants to see how these GPT-3-generated arguments influenced people’s views. The results demonstrated very clearly that “these statements actually impacted respondents’ beliefs.”

Musser said this was concerning as “GPT-3 might not need to be particularly good if threat actors can use it to create a mass of arguments in favor of a position they want to advance, even if those arguments aren’t particularly good, they might be able to get something like this effect.”

In the final part of the session, Lohn outlined the practical difficulties of using GPT-3 to spread disinformation at scale. As it stands, no GPU is big enough to handle GPT-3, and it has to be split up to run over many GPUs. However, there are likely to be solutions in place for this problem in the near future; for example, telco provider Huawei has stated that they will open-source the model-splitting tools.

Lohn added that the financial costs of running widespread misinformation campaigns via GPT-3 are currently prohibitive to individual hackers, although it “is not a big deal for powerful nation-states.”

Another problem for malicious actors is the sheer number of social media accounts they need to create to distribute messages on a wide enough scale to cut through. Lohn believes it is this infrastructure issue that should be focused on to identify GPT-3-generated social media posts, as “there is very little hope of detecting those messages based on the text itself, they’re pretty well indistinguishable from people.”

The United States Federal Trade Commission is warning Americans to be wary of text messages purporting to be from their state workforce agency.

A red flag is being waved by the FTC following the discovery of an SMS-based phishing campaign targeting recipients of unemployment insurance benefits. 

“Identity thieves are targeting millions of people nationwide with scam phishing texts aimed at stealing personal information, unemployment benefits, or both,” said Seena Gressin, attorney at the division of consumer and business education at the FTC.

Several malicious texts are being sent out as the part of the campaign. One informs the recipient that they need to “make necessary corrections” to their unemployment insurance (UI) claim. Another tells the target that they need to verify their personal information.

Cyber-criminals are also disseminating a phishing text message designed to trick the recipient into thinking that they need to reactivate their UI benefits account.

A targeted user who clicks on the link in one of these messages will be taken to a fake website impersonating their state workforce agency, which Gressin said “may look very real.” Instructions on the site ask the user to enter a slew of personal details, including their login credentials and Social Security number. 

“Fraudsters can use the information to file fraudulent UI benefits claims or for other identity theft,” warned Gressin.

The FTC published the details of seven different phishing texts currently doing the rounds. One reads “RI-DLT Labor: This is to notify you that your Rhode Island insurance claim account is currently on hold for verification. Please complete your verification by following the instruction link below to activate your account.”

Two of the messages share an identical preamble: “We are making some exciting changes to improve your UI and PUA Benefit security features.” 

Gressin urged anyone who receives a message like this from either their SWA or the National Center for Disaster Fraud to report it via the website ReportFraud.ftc.gov. 

“Know that state agencies do not send text messages asking for personal information,” said Gressin.

“If you get an unsolicited text or email message that looks like it’s from an SWA, don’t reply or click any link.”

Security researchers have discovered a 12-year-old router vulnerability that they’ve warned may affect millions of devices globally.

Tenable research engineer, Evan Grant, explained in a blog post that he originally found the authentication bypass vulnerability in devices from manufacturer Buffalo.

However, during the disclosure process, he found that the bug actually existed in the underlying firmware from Taiwanese firm Arcadyan.

“All of the devices we were able to test or have tested via third-parties shared at least one vulnerability: the path traversal which allows an attacker to bypass authentication, now assigned as CVE-2021–20090,” he explained.

“This appears to be shared by almost every Arcadyan-manufactured router/modem we could find, including devices which were originally sold as far back as 2008.”

Tenable has claimed that the issue may affect millions of devices manufactured by 17 different vendors, used in at least 11 countries — including Australia, Germany, Japan, Mexico, New Zealand, the US.

The vulnerability in question has a CVSS score of 8.1, making it high severity. If exploited, it could allow an unauthenticated remote attacker to bypass authentication. However, Grant also found two further bugs present in Buffalo routers: improper access control flaw CVE-2021-20092 and configuration file injection vulnerability CVE-2001-20091.

As Grant discovered the potential scale of the issue, he reported it to the CERT Coordination Center to help with the process of notifying all affected vendors.

The case highlights the inherent risks in code supply chains and vulnerable software libraries.

“There is a much larger conversation to be had about how this vulnerability in Arcadyan’s firmware has existed for at least 10 years and has therefore found its way through the supply chain into at least 20 models across 17 different vendors,” Grant concluded.

“I’d also like to encourage security researchers who are able to get their hands on one of the 20+ affected devices to take a look for (and report) any post-authentication vulnerabilities like the configuration injection found in the Buffalo routers. I suspect there are a lot more issues to be found in this set of devices.”

A self-imposed ransomware ‘ban’ instituted by several cybercrime sites is not stopping the threat actors that use these forums, according to Digital Shadows.

The threat intelligence vendor wanted to see whether the new rules put in place by popular Russian-language platforms XSS and Exploit were having any impact. The sites’ administrators banned users back in mid-May from advertising ransomware and affiliate partnerships after several high-profile attacks in the US.

Perhaps unsurprisingly, users of the sites have found ways to bend the rules, such as speaking euphemistically about the services they’re looking for.

“Ransomware-linked threat actors are most likely continuing to operate on the forums under different aliases, using coded language and avoiding direct references to ransomware. We’ve noticed many threads in which users advertise ‘pentesting’ vacancies in their’ team.’ Others write that they are looking to purchase ‘access’ to corporate networks for high prices,” Digital Shadows explained.

“In one particularly blatant example, a user advertised for ‘individuals and groups for our partners program [sic],’ including ‘Pentesters with experience in Active Directory networks’ and ‘Access brokers’.”

The vendor also claimed to have seen no decrease in the number of listings for “access” services, which are an increasingly popular way for ransomware groups to launch attacks.

“Some initial access brokers, perhaps aware that they can’t market their wares openly to ransomware groups, are instead offering to provide a regular supply of ‘exotic’ and ‘valuable’ corporate accesses to ‘serious’ buyers,” it explained.

Plenty of other forums plying their trade haven’t put ransomware ‘bans’ in place. Digital Shadows pointed to the success of RAMP, a relative newcomer which appeared in July and amassed a large following before closing registrations as a protective measure.

The bottom line appears to be that ransomware continues to thrive. Without any progress on the geopolitical front, organizations must focus their efforts on best practice cyber-hygiene and rapid detection and response.

According to new Accenture research, ransomware accounted for 38% of intrusions in H1 2021, more than any other threat type.

The first half of 2021 saw no slowdown in malicious online activity as Accenture detected a 125% increase in cyber-intrusion incident volume versus the same period last year.

The global consultancy’s mid-year security update blamed the uptick on increased web shell activity, digital extortion including ransomware, and supply chain intrusions.

Consumer goods & services (21%), industrial (16%), banking (10%), travel & hospitality (9%) and insurance (8%) sectors accounted for the majority of malicious activity, although insurance was most heavily targeted by ransomware attacks — accounting for nearly a quarter (23%) over the period.

Accenture claimed that travel & hospitality and retail will come under increasing scrutiny from threat actors going forward as these industries begin to recover post-pandemic.

Unsurprisingly, the US was the most targeted country, accounting for 36% of incident volume, followed by the UK (24%) and Australia (11%).

Mark Raeburn, cyber defense lead for Accenture in the UK & Ireland, argued that cyber-threats threaten to derail organizations at a crucial moment, as economies begin to reopen.

“We’ve found that consumer goods companies in particular are experiencing higher levels of cyber-attacks compared to this time last year as increasing consumer activity creates more opportunities for cyber-criminals,” he added.

“After a challenging year, these organizations cannot afford to have a cyber-attack take them back offline again. Every organization must now prioritize re-evaluating their cybersecurity strategy, ensuring they not only secure their own systems but also fully protect their supply chains and partners.”

Ransomware remained the most prolific threat in the first half of 2021, accounting for 38% of attacks, followed by backdoors (33%). REvil/Sodinokibi was the most common variant (25%), followed by Hades (18%) and DoppelPaymer (16%).

The majority (54%) of organizations hit by ransomware in the first six months of 2021 had annual revenues of $1-9.9 billion, followed by those posting over $10 billion in revenue (20%). However, this could be more reflective of the Accenture customer base than reality.

It’s been claimed elsewhere that most attacks hit companies with under 1000 employees.