Two US senators accuse carmakers of deceptive language and shifty practices in sharing and resale of driver data.

Source: CC7 via Shutterstock

Two US senators have called on the US Federal Trade Commission (FTC) to hold automakers accountable for sharing driver data without consent, highlighting the growing data privacy challenges — and deceptive verbiage from terms of service — associated with modern smart cars.

In a letter to the FTC (PDF) last week, Sens. Ron Wyden (D-Ore.) and Edward Markey (D-Mass.) used the data-sharing practices of General Motors, Honda, and Hyundai as symptomatic of an industrywide problem that needs immediate investigation.

**Data Sharing Without Consent**

All three vendors collected and sold driver information such as acceleration and braking data to Verisk, a data analytics company that used the information to prepare driver behavior reports that it then resold to insurance companies. By their own account, none of the automakers obtained informed consent from customers before sharing their information. Instead, they deliberately obscured their data-sharing relationship with Verisk in lengthy disclosures and made deceptive claims about how they would use driver data, the senators charged.

"The FTC should hold accountable the automakers, which shared their customers' data with data brokers without obtaining informed consent, as well as the data brokers, which resold data that had not been obtained in a lawful manner," their letter noted. "Given the high number of consumers impacted, and the outrageous manipulation of consumers using dark patterns, the FTC should also hold senior company officials responsible for their flagrant abuse of their customers' privacy."

The letter highlights just one aspect of what many say is a rapidly growing set of security and privacy issues around modern, highly connected software-defined vehicles. While such vehicles offer increased automation, autonomous capabilities, and highly customizable user experiences, they also collect an enormous amount of data that can be hard to protect and secure.

"Your vehicle knows your name, your home address, your debit/credit card info, how fast you drive, how hard you brake, what you ask its voice assistant, the locations you frequent and at what times," says Riley Keehn, lead regulatory and government affairs consultant for SBD Automotive, an automotive research and consulting firm. "Certain occupant detection and automated driving cameras and sensors can even see you and your surroundings."

The onboard storage of this sheer volume of personal and identifying information (PII) and sensitive data types make drivers and their vehicles the direct targets of cyberattacks. These attacks can happen via hardwired systems like the OBD-II port or even the headlights, connections to the vehicle via shared and insecure Wi-Fi networks, through electric vehicle charging stations, compromised aftermarket components, and other means, Keehn says.

Some of these risks can be addressed via security-by-design approaches and the implementation of industry best practices and regulations, such as UN R155 on Cybersecurity Management Systems (CSMS) and UN R156 on Software Update Management Systems (SUMS), ISO/SAE 21434:2021 on Cybersecurity Engineering for Road Vehicles, and other international and regional requirements, she notes.

**A Complete Lack of Consumer Privacy Protections?**

But where things can get messy is what happens to personal data after a vehicle collects it. "The US still lacks a comprehensive, general data privacy regulation comparable to the EU's GDPR, China's PIPL/DSL/CSL framework, and other global regulations that have adopted the GDPR's model and stringency," Keehn says.

The US largely relies on sector-specific regulations, such as HIPAA in healthcare, to address unique data privacy and security requirements. Individual states have filled that gap with their own data privacy laws, creating a patchwork of inconsistent rules, often exempting certain sectors and technologies. While some states may have clear requirements for how an original equipment manufacturer (OEM) must handle the storage, collection, sharing, and sale of data, other states may have different requirements or none at all, she says.

"This inconsistency and lack of national guidance in the US creates a host of risks at the business level and can foster an OEM culture where security stops with the vehicle," Keehn adds.

**Can the FTC Really Drive Change?**

David Brumley, CEO of software security firm ForAllSecure, says car companies should be required to ask for informed consent from drivers to share their information for advertising or for any other purpose not specific to delivering a required feature. 

"Over-the-air software updates? Probably being served from Amazon or Google. Maps? Probably from a third-party. Accurate position? It's not just GPS; often it's assisted with other metadata — like Swift Navigation — to increase accuracy," Brumley notes.

A car vendor might require some data, like location information, for instance, to provide services such as roadside assistance, traffic warnings, and autonomous driving. So there needs to be separate consent requirement for sharing such data and for sharing data for pure profit reasons, he says. "Second, we need a law that says companies must not limit functionality when someone opts out," he adds. "Someone shouldn't be able to force your consent so you can keep driving to work."

Brumley says it's unrealistic, however, to expect the FTC to drive much change. "They don't exercise their regulatory powers in other domains, and instead rely on free-market" dynamics, which won't help here, he says. "Where we may get a bump is EU regulations, which tend to be stricter.  We also need consumers to speak up that it impacts their buying decisions."

**About the Author(s)**

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year career at Computerworld, Jai also covered a variety of other technology topics, including big data, Hadoop, Internet of Things, e-voting, and data analytics. Prior to Computerworld, Jai covered technology issues for The Economic Times in Bangalore, India. Jai has a Master's degree in Statistics and lives in Naperville, Ill.

Smart Cars Share Driver Data, Prompting Calls for Federal Scrutiny

The security vulnerabilities, CVE-2024-37394, CVE-2024-37395, and CVE-2024-37396, could lay open proprietary and sensitive research to data thieves.

Source: Yuri Arcurs via Alamy Stock Photo

Researchers have discovered three cross-site scripting (XSS) vulnerabilities in Research Electronic Data Capture (REDCap), a Web application developed by Vanderbilt University and used for building and managing online surveys and databases for scientific and academic researchers.

The vulnerabilities are tracked as CVE-2024-37394, CVE-2024-37395, and CVE-2024-37396, and they "could allow attackers to execute malicious JavaScript code in victims' browsers, potentially compromising sensitive data," according to an advisory from Trustwave's SpiderLabs.

Researchers there identified the vulnerabilities in multiple locations within version 13.1.9 in REDCap, which is popular in universities and scientific institutions for managing studies that contain private, sensitive information. The vulnerable locations in the platform include calendar events, public surveys, and project dashboards.

"Our researchers developed proof-of-concept exploits for each vulnerable location," the researchers wrote. "In each case, they were able to inject a simple JavaScript payload that, when triggered, executes an alert displaying the document domain."

The vulnerabilities could allow threat actors to steal sensitive information, impersonate the victim's actions, manipulate the REDCap application, and even gain access to protected data.

It's recommended that users update to REDCap version 14.2.1 or later, where Vanderbilt University has addressed these bugs, to mitigate these flaws. 

**About the Author(s)**

Dangerous XSS Bugs in RedCAP Threaten Academic &amp; Scientific Research

If paying a ransom is prohibited, organizations won't do it — eliminating the incentive for cybercriminals. Problem solved, it seems. Or is it?

Ilia Sotnikov, Security Strategist & Vice President of User Experience, Netwrix

July 31, 2024

4 Min Read

Source: Olekcii Mach via Alamy Stock Photo

COMMENTARY

Ransomware and other malware attacks are among the top three types of security incidents that organizations experience, according to Netwrix's "2024 Hybrid Security Trends Report." In a bid to curb this menace, for several years now there have been discussions around a radical approach: making ransomware payments illegal. The rationale is straightforward. If paying a ransom is prohibited, organizations won't do it — thus eliminating the incentive for cybercriminals to launch ransomware attacks. Problem solved. Or is it?

**All Ransoms Are Not Equal**

We must first recognize that there are multiple types of extortion. Ransomware is generally different from physical extortion cases like kidnappings, hostage situations, and threats of violence against individuals or public spaces. However, a ransomware attack, for example, on a hospital, literally endangers patients' lives. 

In scenarios where human lives are directly at stake, the ethical and legal considerations surrounding ransom payments are more complex than a simple ban allows for. Given the adaptability and resourcefulness of ransomware attackers, it is highly likely that they will push the boundaries of such a ban and test the limits of enforcement. As a result, a blanket ban on all ransom payments could force decision-makers into impossible moral dilemmas.

**The Law of Unintended Consequences**

Let's suppose for a moment that ransom payments have been legally prohibited, and a ransomware attack has just crippled your business. You need to get back online quickly or your business may go under. While the law forbids you from paying the ransom, enforcement agencies cannot stop what they don't know about. Almost certainly, some companies would quietly pay the ransom and simply not report the incident. This hesitancy to report attacks affects visibility into the actual scope of the problem and hinders law enforcement from acting accordingly. If the challenge is unknown, it cannot be addressed. 

In addition, there would be a disproportionate impact on small and medium-sized businesses. While large organizations might possess the resources to endure a ransomware attack without caving in to ransom demands, small businesses could face existential threats. A blanket ban on ransom payments could leave them in a precarious position of having to choose between resorting to illegal payments or risking going out of business.

**Case in Point: Cyber Insurance **

No legislative action or policy change occurs in isolation; it inevitably has ripple effects and unintended consequences. Cyber insurance provides a prime example in the arena of ransomware. By securing a cyber-insurance policy, businesses aim to protect themselves from the financial fallout of a ransomware attack, as the insurance provider would cover the ransom payment. 

Indeed, this is how it worked just several years ago. However, cybercriminals quickly recognized that insured organizations are more likely to pay ransoms, since their insurance company covers these expenses. It is reasonable to assume that threat actors started conducting reconnaissance on the cyber-insurance coverage of potential victims to tailor their attacks and maximize their profits. This is how cyber insurance might have contributed to the growth of the ransomware epidemic. 

Currently, one can hardly find an insurance company ready to reimburse the ransom payment.

**A Better Model: Follow the Banking Industry**

Bank robberies were once a prevalent threat, but they have significantly declined in recent decades. This reduction was not achieved by banning bank tellers from handing over cash. Instead, banks have adopted a multifaceted approach to mitigate the risk. To deter potential robbers, they use measures such as reduced cash handling, time-lock safes, enhanced security cameras, and alarm systems. Dye packs, decoy money, and GPS trackers reduce the risk of financial loss in cases where cash is ultimately handed over. What's more, appropriate security measures are a must to obtain and keep the license to operate. 

A similar approach may prove equally effective for other high-risk industries. Governments can establish cybersecurity benchmarks and recommend risk mitigation strategies, just as they have for the public sector and critical infrastructure. Such standards offer essential guidance for organizations that lack the strategic leadership necessary to develop an effective ransomware defense strategy independently. 

Finally, law enforcement agencies take their share of the responsibility and increase international collaboration to dismantle ransomware networks. The benefits of this approach are already paying off, as evidenced by the recent takedown of the LockBit ransomware gang. Agencies from more than half a dozen countries issued a detailed joint cybersecurity advisory that outlined LockBit's tactics and tools. They also seized some of the group's attack assets, significantly hindering their ability to initiate attacks.

**Conclusion**

Frustration is understandable as ransomware attacks continue around the globe, but simply denying victim organizations the option of paying the ransom is neither realistic nor practical. There will always be exceptions to the law, and unanticipated repercussions could make the cure worse than the disease. Instead, an effective response will require organizations to take greater responsibility for cybersecurity and government agencies to engage in good old-fashioned police work. This strategy may not be as straightforward as a ban on ransom payments, but the war against ransomware is winnable through a comprehensive, nuanced approach.

**About the Author(s)**

Security Strategist & Vice President of User Experience, Netwrix

An accomplished expert in cybersecurity and IT management, Ilia Sotnikov is security strategist and vice president of user experience at Netwrix, a vendor of information security and governance software. Netwrix is based in Frisco, Texas. 

Ilia has more than 20 years of experience in cybersecurity as well as IT management experience during his time at Netwrix, Quest Software, and Dell. In his current role, Ilia is responsible for technical enablement, UX design, and product vision across the entire product portfolio. Ilia’s main areas of expertise are data security and risk management.

Would Making Ransom Payments Illegal Result in Fewer Attacks?

A network of more than 2,600 Telegram bots has helped exfiltrate one-time passwords and data from devices for more than two years.

Dynamically Evolving SMS Stealer Threatens Global Android Users

The nation-state espionage group known for attacking Pakistan has expanded its reach to targets in Egypt and Sri Lanka.

Source: Papilio via Alamy

A nation-state cyber-espionage group linked to India has broadened its targeting beyond regional rivals in Pakistan, Afghanistan, China, and Nepal and is focused on compromising computers and networks at maritime facilities in countries as far away as the Mediterranean Sea.

The group — known variously as SideWinder, Razor Tiger, and Rattlesnake — commonly wages spear-phishing attacks using images of official-looking documents. In its latest campaigns, SideWinder has falsified documents from specific ports, including the Port of Alexandria in Egypt, with high-interest topics such as job termination and salary reductions, researchers from BlackBerry said in a newly published advisory.

While the group has typically focused on rivals closer to home and is less prolific than other cyber spies, the current campaign suggests that they have expanded their targeting, says Ismael Valenzuela, vice president of threat research and intelligence at BlackBerry.

"It's the first time we have seen SideWinder targeting ports and maritime facilities in EMEA," he says. "We see a lot of geopolitical turbulence and \[changing\] environments across the globe on a variety of issues. This often galvanizes threat groups and state-sponsors to specifically strike down critical assets, like those within the maritime industry."

The maritime industry increasingly has become a target of cyberattacks, posing serious danger to ships and ports. In 2019, the US Coast Guard warned shipping companies that attacks on their systems could lead to accidents and catastrophes. In the past year, following increased Chinese cyber operations against critical infrastructure including maritime systems in and around the South China Sea, various countries in the Asia-Pacific region have banded together to protect their networks and systems.

The cyber warnings also come as physical threats to shipping increase as well. Piracy off the Atlantic coast of Africa and the Arabian Sea, and among the island nations of the Asia-Pacific, has escalated, while ship malfunctions — such as the one the caused a vessel to collide with the Baltimore bridge — have become more frequent.

**New Phishing Lures, Old Exploits**

SideWinder has conducted attacks since at least 2012. The group is relatively sophisticated, commonly using encrypted malware samples, various obfuscation techniques, and running code in memory to avoid file scanners, according to a presentation at Black Hat Asia in 2022. From 2020 to 2022, the group conducted more than 1,000 attacks, Noushin Shabab, senior security researcher with Kaspersky, said during that presentation.

"I think what truly makes them stand out among other APT \[advanced persistent threat\] actors is the large tool set they have with many different malware families, lots of new spear-phishing documents, and a very large infrastructure," Shabab said. "I haven't seen 1,000 attacks from a single APT" from another group thus far.

However, the current cyberattacks are, in many cases, using older vulnerabilities, such as a flaw in Microsoft Office dating back to 2017. The vulnerability (CVE-2017-0199) allows remote code execution against old versions of Microsoft Office and Windows, and has been a very popular vector of attack, with more than 5,600 malware samples exploiting the issue this year, including 15 malicious samples reported from Egypt, according to BlackBerry.

Like most groups, SideWinder does not like to waste a good exploit, even if it's seven years old, says Valenzuela.

"Why do we still see old CVEs like these exploited in the wild? Attackers know that many organizations don’t patch their Office software for many years," he says. "This is especially common in organizations with legacy systems, which are often used in ports and maritime facilities as well as other critical infrastructure."

BlackBerry documented the use of another very popular — and seven-year-old — vulnerability, in the Microsoft Office Equation Editor (CVE-2017-11882), with more than 9,500 samples of Office documents exploiting the issue since the start of 2024. Both of these vulnerabilities have made the Known Exploited Vulnerabilities list maintained by the Cybersecurity and Infrastructure Security Agency (CISA).

**Maritime Under Attack**

BlackBerry's threat researchers discovered a variety of domains in the first and second stages of the attack that are likely evidence of their targets, including a long list in South Asia including Pakistan, Sri Lanka, Bangladesh, Myanmar, Nepal, and the Maldives. Egyptian ports appear to be the only target outside of India's extended neighborhood.

While the country appears to be extending its reach to other regions of the world, the cyber operations are not actually targeting ports on a global scale, Valenzuela says.

"They’re certainly targeting ports in key countries where this threat actor has geopolitical interests, and that includes the Indian Ocean and the Mediterranean, \[such as\] Egypt," he says. "We don’t have information about other targets in the Mediterranean Sea at this time."

The researchers have not captured the final payload in the attacks, but based on the group's previous actions, they believe the goal is intelligence-gathering and cyber espionage, the company stated in its advisory.

**About the Author(s)**

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline Journalism (Online) in 2003 for coverage of the Blaster worm. Crunches numbers on various trends using Python and R. Recent reports include analyses of the shortage in cybersecurity workers and annual vulnerability trends.

India-Linked SideWinder Group Pivots to Hacking Maritime Targets

Clutch Security is the latest cybersecurity startup looking to secure and manage non-human identity.

Source: Sasin Paraska via Alamy Stock Photo

Identity is more than just logins and passwords. Enterprise defenders now have to consider that attackers can target and breach their networks by stealing and abusing non-human identities, such as API keys, secrets, tokens, and service accounts.

Clutch Security has emerged from stealth with its Universal Non-Human Identity (NHI) Security platform to give security teams complete visibility into all of an organization's non-human identities. The platform allows security teams to understand which NHIs exist within the organization and identifies associated risks. The platform prioritizes the risks based on severity and business impact and provides tailored remediation advice to address those risks.

The modern technology stack spans cloud services, software-as-a-service applications, on-premises software, digital vaults, code repositories, continuous integration/continuous delivery pipelines, and data warehouses, which means identity and access management requires working with both human and non-human identities. Adversaries like to target NHIs because they are distributed — making them difficult to track — and usually have elevated privileges. Clutch estimated a 1-to-45 human-to-non-human ratio in many organizations.

As part of the launch, Clutch Security announced it has raised a $8.5 million seed funding round led by Lightspeed Venture Partners. The round included Merlin Ventures, Cyber Club London (CCL), and individual investors, including Exabeam co-founder Nir Polak, serial co-founder Shlomo Kramer (Imperva, Check Point, Cato Networks), and HashiCorp co-founder Armon Dadgar. Clutch CEO and co-founder Ofir Har-Chen was the former COO at Hunters.

Clutch Security Launches With NHI Platform

According to the study, around 400 stolen GenAI credentials are being sold by threat actors per day.

Source: AlexPhotoStock via Alamy Stock Photo

Cybercriminals are now able to purchase Generative AI (GenAI) account credentials on underground hacker markets along with other various illegal goods, according to new research.

The GenAI credentials include those that belong to users of ChatGPT, Quillbot, Notion, Huggingface, and Replit, among many others. eSentire's cybersecurity research team found that the hackers are selling the credentials for roughly 400 GenAI accounts per day, usually stolen from corporate end users' computers after they've been infected with an infostealer.

LLM Paradise was one underground service found to be selling stolen GenAI credentials, advertising GPT-4/Clause API keys at a starting price of $15 each (the market has since closed its doors). The threat actors also have leveraged legitimate outlets, at one point advertising the illegal products on social media platform TikTok.

Ultimately, the researchers also found that the threat actors are finding a variety of ways to monetize GenAI account credentials, whether that's by creating phishing campaigns or launching malware from the accounts, producing chatbots, or stealing sensitive corporate data such as financial information or customer information.

The researchers recommend that organizations monitor employee usage of cloud-based GenAI offerings, encourage GenAI vendors to implement WebAuth in their portals, use passkey security or password best practices, and use Dark Web monitoring services. 

**About the Author(s)**

Criminal Hackers Add GenAI Credentials to Underground Markets

With sufficient privileges in Active Directory, attackers only have to create an "ESX Admins" group in the targeted domain and add a user to it.

Source: Schoening via Alamy Stock Photo

Multiple ransomware groups have been weaponizing an authentication bypass bug in VMware ESXi hypervisors to quickly deploy malware across virtualized environments.

VMware assigned the bug (CVE-2024-37085) a "medium" 6.8 out of 10 score on the CVSS scale. The average score is largely due to the fact that it requires an attacker to have existing permissions in a target's Active Directory (AD).

If they do have AD access, however, attackers can cause significant damage. With no technical trickery whatsoever, they can use CVE-2024-37085 to instantly scale up their ESXi privileges to the max, opening the door to ransomware deployment, data exfiltration, lateral movement, and more. Groups like Storm-0506 (aka Black Basta), Storm-1175, Manatee Tempest (part of Evil Corp), and Octo Tempest (aka Scattered Spider) have already tried it out, deploying ransomware such as Black Basta and Akira.

Broadcom recently published a fix, available on its website.

**How CVE-2024-37085 Works**

Some organizations configure their ESXi hypervisors to use AD for user management. It turns out that by doing this, organizations were exposing themselves to something unexpected. By default, ESXi hypervisors granted full administrative access to any member of an AD domain group named "ESX Admins."

It's unclear how the "ESX Admins" group vulnerability was introduced into ESXi in the first place—Broadcom declined to clarify when Dark Reading reached out on the question. As Microsoft noted in a blog post, there's no particular reason why the hypervisor should have expected such a domain group, or have had a rule for what to do with it. "This group is not a built-in group in Active Directory and does not exist by default. ESXi hypervisors do not validate that such a group exists when the server is joined to a domain and still treats any members of a group with this name with full administrative access, even if the group did not originally exist," the threat intel team wrote. "Additionally, the membership in the group is determined by name and not by security identifier (SID)."

Exploiting CVE-2024-37085 was entirely trivial. So long as an attacker had sufficient privileges in AD, all they'd have to do to gain ESXi admin privileges was to create an "ESX Admins" group in the targeted domain and add a user to it. They could also rename any existing group to "ESX Admins," and either wield one of its existing users or add a new one.

**The Risk with Hypervisors**

"Ransomware attacks targeting ESXi and VMs are increasingly common, especially since around 2020, when enterprises increased their move toward digital transformation and took advantage of modern hybrid cloud and virtualized on-premise environments," explains Jason Soroko, senior vice president of product at Sectigo.

For all the business sense they make, virtualized environments also afford hackers unique benefits. Hypervisors tend to run many VMs at once, making them a one-stop shop for blasting ransomware as widely as possible, and those VMs often host critical services and business data.

Their utility to hackers makes it all the more troubling that, as Microsoft noted in its blog, security products have limited visibility and protections for hypervisors. This, Soroko explains, is "due to their isolation, complexity, and the specialized knowledge required for their protection. This isolation makes it difficult for traditional security tools to monitor and protect the entire environment, and API integration limits further exacerbate this issue."

To cover for these shortcomings, Microsoft highlighted the importance of keeping up to date with patches, and practicing broader cyber hygiene around critical and vulnerable assets. "Attackers love using the path of least resistance that provides maximum opportunity," Soroko notes, adding that ransomware actors will only target these systems more and more in the future.

**About the Author(s)**

Nate Nelson is a freelance writer based in New York City. Formerly a reporter at Threatpost, he contributes to a number of cybersecurity blogs and podcasts. He writes "Malicious Life" -- an award-winning Top 20 tech podcast on Apple and Spotify -- and hosts every other episode, featuring interviews with leading voices in security. He also co-hosts "The Industrial Security Podcast," the most popular show in its field.

Ransomware Gangs Exploit ESXi Bug for Instant, Mass Encryption of VMs

The incident serves as a stark reminder of the fragility of our digital infrastructure. By adopting a diversified, resilient approach to cybersecurity, we can mitigate the risks and build a more secure digital future.

Source: SOPA Images Limited via Alamy Stock Photo

COMMENTARY

On July 19, the world experienced one of the largest IT outages in history, affecting millions of users globally, and systems and people will be reeling from its impact for weeks. The cause? A faulty update on CrowdStrike's Falcon platform. This seemingly minor error in code cascaded into a major outage, affecting critical infrastructure worldwide. Airports, hospital systems, and other large enterprises relying on CrowdStrike were brought to a standstill, highlighting the vulnerabilities inherent in our increasingly digital world.

Falcon, a cloud-based security solution, functions like an advanced antivirus, updating threat intelligence and protecting systems automatically without user intervention. This automation is a boon for large enterprises, which can ensure all endpoints are protected and up to date without manual oversight. While efficient, this centralized system also introduces a fundamental risk: a single point of failure. When the update failed, it didn't just affect a few computers, but millions, all at once. The very feature that made Falcon attractive — its cloud-based, seamless, automated updates — became its Achilles' heel.

The Falcon failure exposed another fundamental flaw in our approach to cybersecurity and IT infrastructure. We tend to focus on protecting the most critical systems — flight control systems, cardiac machines in hospitals — while neglecting the everyday, mundane systems that are equally vital. In this case, it wasn't the high-stakes technology that failed but the routine systems like accounting, billing, and ticketing. These systems, often taken for granted, are the backbone of our daily operations, and their disruption can lead to chaos. 

This is not a new phenomenon. Often when hospitals and pipelines are hacked, attackers target accounting and billing systems, not the core refinery or processing plant. Without the ability to track and bill customers, operations came to a halt. Our reliance on digital solutions, coupled with the assumption that technology will always function flawlessly, leaves us unprepared for such disruptions.

Finally, we won't be able to fully recover for a while, even though mitigation guidance has already been released by CrowdStrike. It is because the system needs to be reset, and most endpoint users either lack the permissions (because IT has locked down systems by default) or because they don't know how to reset or revert systems. This is the third reason why the problem is persisting despite mitigation guidance already being released.

Such issues will only get worse as artificial intelligence (AI) gets integrated into systems. AI will centralize control further, automate complex tasks, and strip power and autonomy from users at the endpoint. Imagine a hospital where AI manages patient data, schedules, and even treatment plans. If such a system fails, frontline healthcare workers might find themselves unable to access crucial information or perform essential tasks, leading to potentially life-threatening delays. As AI becomes more integrated into our systems, the potential for large-scale disruptions increases. Our reliance on silicon-based systems will only deepen, making it imperative to address these vulnerabilities now.

**Blueprint for Resilience**

Fortunately, carbon-based systems in nature provides a blueprint for resilience. In the early 1900s, Buffalo, N.Y., where I live, had thousands of tree-lined streets designed by Frederick Law Olmsted. Many of these trees were the same species, with streets named for the trees that lined them. But it created a single point of failure. When Dutch elm disease struck in the 1950s, it wiped out most of the elm trees because they were planted too closely together, allowing the disease to spread rapidly. This lesson teaches us the importance of diversity — in this case, heterogeneous computing systems. Organizations must implement diverse IT systems, especially for their core functions. Just as a monoculture of trees can be decimated by a single disease, a uniform IT infrastructure can be crippled by a single point of failure. Introducing variety in hardware and software solutions can create a more resilient digital environment.

Nature also offers insights into protecting core functions. Just as the human body employs multiple layers of defense to protect vital organs, organizations should use a variety of software and operating systems to handle critical functions. For example, a hospital's patient management system could run on one platform while its diagnostic tools operate on another, ensuring that a failure in one system doesn't compromise the entire operation. This is akin to how different species of trees in a forest can prevent the spread of disease; if one species is affected, others can continue to thrive. Similarly, deploying diverse cybersecurity measures and segregating core functions can provide a buffer against widespread failure, enhancing overall system resilience.

Finally, to prevent future meltdowns like the CrowdStrike incident, we also need to invest in training and preparedness drills to equip IT teams to respond swiftly and effectively to emerging threats. This is not a minor issue. Fixing the current problem required computers to be reverted back to their pre-update stage or waiting to deploy an updated patch. Even as technology is being centralized and implemented, more of the core functionalities are being centrally administered or locked down. While this approach aims to prevent disruption, it also makes it harder for staff to reboot systems or have administrative access, such as needing to reboot the system in safe mode or revert systems to their older state.

The issue is that people aren't really given access or equipped to handle these things, even as more of the technological functionalities are being centrally administered and removed from the hands of users at the endpoint. People remain the weakest link in cybersecurity — whether it's the coders creating patches or the individuals installing or reverting systems. Thus, our solutions must also include comprehensive training and a focus on the human element to ensure robust security measures.

The CrowdStrike meltdown serves as a stark reminder of the fragility of our digital infrastructure. By learning from nature and adopting a diversified, resilient approach to cybersecurity, we can mitigate the risks and build a more secure digital future. As the saying goes, "Those who can't remember the past are condemned to repeat it." Let us collaborate, innovate, and learn from our mistakes to ensure that such a disruption never happens again. The future of our digital world depends on the lessons we learn from the past and the actions we take today.

This column was updated to clarify a reference to pipeline attacks, July 30, 2024.

**About the Author(s)**

Technologist

Arun Vishwanath, Ph.D., MBA, is among the foremost experts on the "people problem" of cybersecurity. He is the author of the book, The Weakest Link: How to Diagnose, Detect, and Defend Users from Phishing, published by MIT Press.

His research on the science of cybersecurity focuses on the biggest vulnerability in enterprise security: users. His body of work includes the development of methodologies to quantify human cyber-risk, approaches to diagnose how and why people are at risk through social engineering, and techniques to mitigate this risk.

Arun, an alumnus of the Berkman Klein Center at Harvard University, has held faculty positions at the University at Buffalo and Indiana University. He has authored close to 50 peer-reviewed research papers on the science of security and has written pieces for CNN, the Washington Post, and other leading media. His views on cybersecurity have also appeared in Wired Magazine and in reports such as the Verizon "Data Breach Investigations Report" (DBIR). You can read more about him on his website here.

The CrowdStrike Meltdown: A Wake-up Call for Cybersecurity

Data thieves heisted the HSA provider's data repository for 4.5 million people's HR information, including employer and dependents intel.

Source: Brian Jackson via Alamy Stock Photo

HealthEquity, a Utah-based health savings account (HSA) provider, has disclosed a data breach affecting 4.5 million customers across the US. The incident stemmed from a hack of a data repository maintained by a third party, a spokesperson confirmed.

The company said in the notice that a hacker managed to breach an "an unstructured data repository outside our core systems" containing customer data, making off with various kinds of personally identifiable information (PII). While the spokesperson confirmed that the repository was maintained by a third-party vendor, she declined to offer further details on the topography or supply chain implications beyond noting that internal systems, including transactional platforms and integrations, weren't impacted.

The stolen PII included a mix of benefits sign-up information that varied by customer. That mix could include name, address, phone number, employee ID, employer, Social Security number, and dependent information. In all, the heist offers crooks a treasure trove of social engineering information.

"By referencing a procedure or test that an individual might think is private and known only to medical professionals, bad actors can more easily build trust with potential victims," said Erich Kron, security awareness advocate at KnowBe4, in an emailed statement.  

**Dwell Time & Response Anatomy**

The initial access occurred on March 9, but it was only officially reported on June 26, according to a notice filed with the Maine Attorney General's Office. However, the dwell time for the cyberattackers before discovery was "much narrower" than that timeline would suggest, according to the company's spokesperson.

Rather than months, the attackers apparently went unnoticed for a little more than two weeks. The first inkling that there was a problem was a systems anomaly alert on March 25. HealthEquity said it took immediate action upon receiving the alert from its vendor, resolving the issue quickly and then kicking off an "extensive technical investigation and … data forensics" effort that lasted through June 10.

That was followed by a validation of the data theft that wrapped up June 26. After that, the company was finally able to file notifications with state authorities, and also notified the US Securities and Exchange Commission although it wasn't mandated to do so.

"We have taken immediate, proactive and prudent action since we first discovered an anomaly with our third-party vendor," the company said in a statement shared with Dark Reading. "This included quickly resolving the issue, bringing together a team of outside and internal experts to investigate, and preparing for response."

The spokesperson also noted that incident response is an ongoing effort: HealthEquity is now in the process of notifying partners, clients and members, and is working with its vendors to prevent future incidents.

**Protecting External Data Stores**

In this case, the type of repository "outside core systems" the attackers accessed was one hosted by a third-party cloud provider. But that's not the only kind of external storage that organizations need to worry about protecting. Data can also be hosted in an internally maintained container, or even in shadow databases that employees maintain on their own for productivity. In all cases, a comprehensive data protection strategy is necessary to prevent HealthEquity-type incidents, researchers note—starting with gaining visibility on where that data is.

"This is a lesson in the protection of data outside of the most common systems," Kron said. "It is not unusual to find that employees have used tools such as spreadsheets to collect information and process it without the knowledge of the IT and security staff. This is often not malicious but done to make work easier and more efficient, however these additional copies of data are difficult to protect if they are unknown."

Erfan Shadabi, cybersecurity expert at comforte AG, says that organizations should ensure they have processes in place to secure data across such hybrid storage footprints. This could include "comprehensive vetting processes, regular audits, and robust contractual agreements to enforce strict security standards," he said.

"Prioritizing data-centric security techniques — such as encryption, tokenization, and secure access controls — is essential to safeguard sensitive information effectively," he added.

Specifically for third-party risk, "organizations must recognize that their security posture is intricately linked to the practices of their third-party vendors," he adds. "By focusing on securing data itself and not just the network, companies can reduce the risk of exposure and limit the impact of breaches when they occur."

**About the Author(s)**

Tara Seals has 20+ years of experience as a journalist, analyst and editor in the cybersecurity, communications and technology space. Prior to Dark Reading, Tara was Editor in Chief at Threatpost, and prior to that, the North American news lead for Infosecurity Magazine. She also spent 13 years working for Informa (formerly Virgo Publishing), as executive editor and editor-in-chief at publications focused on both the service provider and the enterprise arenas. A Texas native, she holds a B.A. from Columbia University, lives in Western Massachusetts with her family and is on a never-ending quest for good Mexican food in the Northeast.

Source

DARKReading