Security Digest (November 2023)

November 2023

• Singapore-based luxury resort Marina Bay Sands reported they have uncovered evidence of a cybersecurity incident in late October.
• Per the report, the incident exposed personally identifiable information (PII) of roughly 665,000 customers.
• Exposed PII included customer names, email addresses, phone numbers, country of residence, and membership numbers.
• While no credit card or social security information was stolen, consultants believe the PII may be sold in bunches for use by social engineers for phishing scams. Those who have been impacted will be contacted and advised to be particularly alert.
• This incident comes less than a month after reported incidents at USA based casinos MGM and Caesars, both of which resulted in losses estimated to be in the hundreds of millions of dollars. Investigators have advised those in the casino and hospitality industry to be vigilant as these attacks continue.

• Boeing was recently listed on Ransomware Gang LockBit’s public website, claiming that a tremendous amount of data had been stolen, and payment was needed to prevent release.
• Lockbit will post companies under siege on its forum. The group also provides a countdown timer until data is released if the ransom is not paid.
• Boeing was then delisted, with the forum moderator reporting ‘negotiations were underway for payment’. Several days later, Boeing was relisted on the site.
• At 8:30 AM UTC on November 10th, roughly 40 GB worth of proprietary data became available for download. The forum post can be seen below.

• Boeing has confirmed they are aware of the breach and have reassured the public flight safety is not at risk. They have not disclosed how the information was leaked at this time.
• This is the latest in a long series of attacks over by the LockBit ransomware gang. They have been attributed to over 1700 attacks since January 2020, accumulating approximately $91 Million dollars in ransomware payments.

• • Australia’s top container terminal operator, DP World, suffered a cyberattack causing major disruptions at key Australian ports.
  • DP World handles 40% of the nation’s container trade and was brought to a standstill following an attack on Friday, November 10th.
  • An estimated 30,000 shipping containers remain unmoved at the time of writing. Estimated damages exceed several million dollars due to the containment of time sensitive goods.
  • DP World hasn’t disclosed specifics about the cyberattack itself, although it was initially reported as not being a ransomware attack. Citrix Bleed has been believed to be the root cause, but these reports have not been confirmed.
  • Supply chain attacks can dramatically disrupt businesses at a global scale and are thus very lucrative targets for attackers. Japan’s largest maritime port, in Nagoya, was disrupted by a ransomware attack in July.
  • BBC reported in 2022 that ransomware attack attempts on shipping ports have nearly doubled since the beginning of COVID. Regulatory changes have been proposed for mandatory auditing for cyber resilience to protect the worldwide flow of trade.
  • Remediation is expected to continue for some time, and initial estimates gauge full recovery to be complete within a month.

• • An on-demand moving platform, Dolly.com, fell victim to a cyber attack in September and was contacted by the threat actor to pay a ransom.
  • Dolly paid this ransom as requested but the threat actors exposed the information on public forums anyway. Dumped information can be seen below.

• • This raises difficult questions on the morality and legality of paying ransoms to known international threats, as even when paid, there is no guarantee a criminal organization will adhere to their side of the agreement.
  • For this reason, the U.S. Department of Treasury’s Office of Foreign Assets Control (OFAC) and the Financial Crimes Enforcement Network (FinCEN) declare it illegal to pay a ransom in most cases.
  • OFAC explains, “Ransomware payments made to sanctioned persons or to comprehensively sanctioned jurisdictions could be used to fund activities adverse to the national security and foreign policy objectives of the United States.”
  • This is a groundbreaking statement for cybercrime response, as paying established international threat actors can carry civil penalties and even prosecution. This is classified as funding cyber terrorism and possibly financially aiding other countries’ malicious efforts.
  • This controversy came into question November 7th, when digital solutions company MeridianLink fell victim to a cyber-attack. After failing to disclose this breach to the SEC, the threat actors ‘ALPHV’ reported the breach to the SEC directly. The post can be seen below.

• • Filing a K-8 form following a breach is mandatory for a publicly traded company. This further incentivizes victims to involve the government as fast as possible and discourage cover ups.
  • Private companies should follow suit and never pay a ransom, as there is no guarantee of recovery once payment is made. Trusting anonymous threat actors already engaged in illegal activities is ill-advised, per the SEC.
  • Cyber Insurance is recommend to mitigate the damage of a cyber-attack and cover potential cost for remediation. In rare circumstances, the government can approve paying a ransom on a case-by-case basis.