Ransomware Infects 23 Texas Government Agencies

The Texas Department of Information Resources (DIR) announced that 20-plus state agencies have been infected by ransomware.

In an Aug. 17 update, DIR stated that “the evidence gathered indicates the attacks came from one single threat actor” and “investigations into the origin of this attack are ongoing; however, response and recovery are the priority at this time.”

“Ransomware is not going to subside anytime soon,” said SonicWall President and CEO Bill Conner. “It’s too easy to demand and receive ransom payment without the risks associated with traditional data exfiltration. Until organizations are serious about ransomware protection, these types of wide-reaching ransomware attacks will, unfortunately, continue.”

According to ZDnet, the “infection is blamed on strain of ransomware known only as the .JSE ransomware.”

Texas is hardly the first state to be the victim of coordinated attacks against municipalities. The last 12 months have seen ransomware attacks bring city services to a halt, including those in Arizona, Florida, Georgia, Indiana, Maryland, Nevada, New York and more.

Ransomware escalates again

Ransomware continues to be one of the most lucrative cyberattack options for criminals. According to the mid-year update of the 2019 SonicWall Cyber Threat Report, ransomware volume raced to 110.9 million in the first half of 2019 — 15% year-to-date increase over 2018.

Exclusive SonicWall data highlights an escalation in ransomware-as-a-service (RaaS) and open-source malware kits in the first half of 2019. As more RaaS and open-source options are available, the volume and ferocity of ransomware attacks will only increase.

RaaS is no different than any legitimate cloud-hosted service used by businesses every day. Instead of buying software, criminals subscribe to a service delivery model to reduce CapEx, always have the latest ransomware offerings, gain predictable pricing and receive support. While there are only so many bona fide malware authors creating new ransomware, these services will ensure cybercriminals have plenty of variants to purchase or obtain freely on the Dark Web.

Webinar: Prep Your Business to Face 2019’s Most Advanced Cyber Threats

Cyber threat intelligence is a must-have component for any security-conscious organizations. And for those who couldn’t get enough of the mid-year update to the 2019 SonicWall Cyber Threat Report, SonicWall security experts hosted an exclusive webinar to go inside the exclusive threat data, ask questions about the threat landscape and offer best practices for improving your security posture.

This edition, “Prep Your Business to Face 2019’s Most Advanced Cyber Threats,” was hosted by Brook Chelmo, a charismatic storyteller who will help you make sense of the numbers. Watch the exclusive on-demand webinar to gain a better understanding of what’s at stake. You’ll explore:

About Brook Chelmo

Brook handles all product marketing responsibilities for SonicWall security services and serves as SonicWall’s ransomware tsar.

Fascinated in the growth of consumer internet, Brook dabbled in grey-hat hacking in the mid to late ‘90s while also working and volunteering in many non-profit organizations. After spending the better part of a decade adventuring and supporting organizations around the globe, he ventured into the evolving world of storage and security. He serves humanity by teaching security best practices, promoting and developing technology.

Porte non standard sotto attacco

Nei film di supereroi a un certo punto si vedono dei personaggi che parlano di proteggere la loro identità con l’anonimato. Ad eccezione di Iron Man, nascondere la propria identità conferisce ai supereroi una sorta di protezione. La sicurezza delle reti è qualcosa di simile.

“La sicurezza nell’oscurità” è un’affermazione che viene apprezzata ma anche criticata. Se si guida un’auto su strade secondarie anziché in autostrada per evitare incidenti, ci si può sentire sicuri? Si arriva a destinazione in tempo? È possibile, ma ciò non significa poter sempre evitare i problemi.

Differenza tra porte standard e non

Le porte dei firewall vengono assegnate dalla Internet Assigned Numbers Authority (IANA) per fini o servizi specifici.

A fronte delle oltre 40.000 porte registrate, solo poche vengono comunemente utilizzate. Si tratta delle cosiddette porte “standard”. Ad esempio, HTTP (pagine) utilizza 80 porte, HTTPS (siti web che utilizzano codifiche) utilizza la porta 443 ed SMTP (email) la porta 25.

I firewall configurati per dialogare con queste porte sono disponibili per la ricezione del traffico. I cibercriminali lo sanno, per cui molti attacchi prendono di mira le porte comunemente utilizzate. Ovviamente, le aziende normalmente rafforzano queste porte contro le minacce.

In risposta alla moltitudine di attacchi che prendono come bersaglio le porte standard alcune organizzazioni hanno deciso di utilizzare porte “non standard” per i loro servizi. Le porte non standard vengono utilizzate per scopi diversi da quelli prestabiliti. Un esempio è l’uso della porta 8080 al posto della porta 80 per il traffico web.

Si tratta della cosiddetta strategia di “sicurezza nell’oscurità”. Anche se per qualche tempo i cibercriminali restano disorientati, non si tratta di una soluzione a lungo termine. Inoltre essa può rendere più difficile per gli utenti collegarsi ai server web dal momento che i browser sono preconfigurati per utilizzare la porta 80.

Attacchi contro porte non standard

I dati del Rapporto SonicWall 2019 sulle ciberminacce indicano che il numero di attacchi rivolto contro le porte non standard è aumentato. Nel 2017 SonicWall ha riscontrato che più del 17,7% degli attacchi malware è passato attraverso porte non standard.

A fronte del dato del 2018, 19,2%, si è avuto un aumento dell’8,7%. Nel solo mese di dicembre del 2018 la percentuale è salita addirittura al 23%.

Che cosa fare per proteggere le porte non standard?

La miglior difesa contro i ciberattacchi sferrati contro i servizi attraverso porte standard e non, consiste nell’adottare una strategia di difesa multilivello.

La ”sicurezza nell’oscurità” è solo uno di essi. Fare eccessivo affidamento su di essa non garantisce comunque il necessario livello di sicurezza. Può essere d’aiuto contro la scansione delle porte, ma non ferma i ciberattacchi più mirati.

Per questo occorre adottare azioni più incisive, come il cambio frequente delle password, l’uso dell’autenticazione a due fattori e l’installazione di patch e aggiornamenti. E si può anche decidere di utilizzare un firewall in grado di analizzare determinati aspetti anziché tutto il traffico (ad esempio un approccio basato su proxy).


Non-Standard Ports Are Under Cyberattack

If you like watching superhero movies, at some point you’ll hear characters talk about protecting their identities through anonymity. With the exception of Iron Man, hiding their true identities provides superheroes with a form of protection. Network security is similar in this respect.

‘Security through obscurity’ is a phrase that’s received both praise and criticism. If you drive your car on side streets instead of the freeway to avoid potential accidents, does that make you safer? Can you get to where you need to go as efficiently? It’s possible, but it doesn’t mean you can evade bad things forever.

Difference between standard and non-standard ports

Firewall ports are assigned by the Internet Assigned Numbers Authority (IANA) to serve specific purposes or services.

While there are over 40,000 registered ports, only a handful are commonly used. They are the ‘standard’ ports. For example, HTTP (web pages) uses port 80, HTTPS (websites that use encryption) uses port 443 and SMTP (email) uses port 25.

Firewalls configured to listen on these ports are available to receive traffic. Cybercriminals know this too, so most of their attacks target the commonly used ports. Of course, companies typically fortify these ports against threats.

In response to the barrage of attacks aimed at standard ports, some organizations have turned to using ‘non-standard’ ports for their services. A non-standard port is one that is used for a purpose other than its default assignment. Using port 8080 instead of port 80 for web traffic is one example.

This is the ‘security through obscurity’ strategy. While it may keep cybercriminals confused for a while, it’s not a long-term security solution. Also, it can make connecting to your web server more difficult for users because their browser is pre-configured to use port 80.

Attacks on non-standard ports

Data in the 2019 SonicWall Cyber Threat Report indicates that the number of attacks directed at non-standard ports has grown. In 2017, SonicWall found that over 17.7% of malware attacks came over non-standard ports.

In comparison, that number was 19.2% in 2018, an increase of 8.7 percent. December 2018 alone hit an even higher number at 23%.

How do I protect non-standard ports?

The best defense against cyberattacks targeting services across both standard and non-standard ports is to have a layered security strategy.

Using ‘security through obscurity’ is just one layer. Relying on it too heavily, however, won’t provide the level of security you need. It may help against port scans, but it won’t stop cyberattacks that are more focused.

You’ll also want to take some other actions, such as changing passwords frequently, using two-factor authentication, and applying patches and updates. And, you’ll want to use a firewall that can analyze specific artifacts instead of all traffic (i.e., proxy-based approach).

On-Demand Webinar: The State of the Cyber Arms Race

There are two kinds of cybersecurity enthusiasts in this world.

Person 1: I anxiously set my alarm to be the first one to download the new 2019 SonicWall Cyber Threat Report. I await its glorious arrival every spring and have already read it cover-to-cover 34 times. What else can I learn?

Person 2: I, too, value the actionable cyberattack intelligence and research from SonicWall Capture Labs threat researchers. I downloaded it (hopefully), but just haven’t had a chance to absorb all it has to offer. I need more.

SonicWall obviously supports both approaches, but we know different types of people digest content in different ways.

For this reason, we hosted an exclusive webinar that explored the key findings, discussed intricacies of the data, provided updates and answered many questions.

Watch the on-demand replay to learn about the findings, intelligence, analysis and research from the 2019 SonicWall Cyber Threat Report.

The exclusive session, The State of Cyber Arms Race: Unmasking the Threats Coming in 2019,” will help you improve your security preparations and posture through 2019 and beyond. Pro tip: Download the full report now so you’re primed for the webinar.

Hosted by SonicWall’s John Gordineer, the convenient 60-minute webinar explored the complete report, which covers key trends and findings from 2018, such as:

  • Global Malware Volume
  • UK, India Harden Against Ransomware
  • Dangerous Memory Threats & Side-Channel Attacks
  • Malicious PDF & Office Files Beating Legacy Security Controls
  • Attacks Against Non-Standard Ports
  • IoT Attacks Escalating
  • Encrypted Attacks Growing Steady
  • Rise & Fall of Cryptojacking
  • Global Phishing Volume Down, Attacks More Targeted

About the Presenter

John Gordineer
Director, Product Marketing

John is responsible for technical messaging, positioning and evangelization of SonicWall network security, email security, and secure remote access solutions to customers, partners, the press and industry analysts. John has more than 20 years of experience in product marketing, product management, product development and manufacturing engineering. He earned a bachelor’s degree in Industrial Engineering from Montana State University.