Week of February 27, 2023: A new US cyber strategy shifts the burden to vendors, and DISH confirms ransomware

What mattered to security leaders in the week of February 27, 2023? On March 2 the White House released a national cybersecurity strategy that aims to move responsibility for security away from individuals and small organizations and onto software vendors and service providers. DISH Network told the SEC on February 28 that its multi-day outage was a cyber incident in which data was extracted, and LastPass explained how attackers used a senior engineer's home computer to reach its corporate vault.

White House strategy aims to shift security liability toward vendors

The administration's national cybersecurity strategy, released March 2, called for rebalancing responsibility for defending cyberspace away from individuals, small businesses and local governments and onto the organizations best positioned to reduce risk, including software, hardware and managed service providers. Its pillars were defending critical infrastructure, disrupting threat actors, investing in a more secure digital ecosystem and building international partnerships. It also proposed shifting liability for security failures to software companies and more aggressive campaigns to make malicious activity unprofitable. For vendors, secure-by-design moved from slogan toward potential legal exposure. (BleepingComputer)

DISH Network tells the SEC its outage was a cyber incident with data theft

In a Form 8-K dated February 28, DISH Network said the network outage it announced on its February 23 earnings call, which hit internal servers and IT telephony, was caused by a cyber-security incident, and that it had notified law enforcement. On February 27 it learned that data had been extracted from its IT systems, possibly including personal information. The filing referred to its efforts to contain and remediate the ransomware attack. The outage had knocked out Dish.com, the Dish Anywhere app and Boost Mobile sites. (DISH Network Corporation (SEC EDGAR), BleepingComputer)

LastPass details the second-stage attack on its cloud backups

LastPass published more detail on how its August 2022 development-environment breach led to a second attack on the third-party cloud storage holding its backups. The attacker targeted a senior DevOps engineer's home computer through a vulnerable third-party media software package, planted a keylogger that captured the master password after MFA was completed, and then exported the engineer's corporate vault, which held keys needed to reach the AWS-hosted backups. The second incident initially went unnoticed because its indicators differed from the first. Home devices used to reach privileged corporate secrets are part of the attack surface. (Help Net Security)

US Marshals Service investigates a ransomware and data theft incident

The US Marshals Service confirmed on February 27 that it was investigating a ransomware and data exfiltration event, discovered on February 17, affecting a stand-alone system. That system held law enforcement sensitive information, including returns from legal process, administrative data and personal information on subjects of investigations, third parties and some USMS employees. It was disconnected from the network and treated as a major incident; sources said the witness protection database was not accessed. Stand-alone systems still need the same backup and monitoring discipline as connected ones. (BleepingComputer)

FBI and CISA publish a #StopRansomware advisory on Royal

On March 2 the FBI and CISA released a joint #StopRansomware advisory with tactics, techniques, procedures and indicators of compromise for Royal ransomware variants, drawn from FBI investigations as recent as January 2023. The agencies said Royal attacks had spread across several critical infrastructure sectors, including manufacturing, communications, healthcare and public health, and education, and urged defenders to apply the advisory's mitigations. (CISA)

CISA red team reaches sensitive systems at a mature critical infrastructure organization

A February 28 CISA advisory described a red team assessment of a large critical infrastructure organization with a mature security posture. The team obtained persistent access, moved laterally across several geographically separated sites and reached systems next to the organization's sensitive business systems. CISA used the findings to stress early detection and continuous monitoring, and published the team's techniques so defenders could test for the same paths. Even well-resourced programs, the exercise suggested, can miss lateral movement between sites. (CISA)

ESET analyzes BlackLotus, a UEFI bootkit that defeats Secure Boot

ESET published what it called the first analysis of a UEFI bootkit able to bypass UEFI Secure Boot, which it linked with high confidence to BlackLotus, sold on hacking forums for $5,000 since at least October 2022. The bootkit runs even on fully updated Windows 11 systems with Secure Boot on, exploiting CVE-2022-21894, which Microsoft fixed in January 2022; exploitation remained possible because the vulnerable signed binaries had not been added to the UEFI revocation list. The finding put boot-chain integrity and revocation-list updates on Windows hardening agendas. (Help Net Security)