{"id":179496,"date":"2018-12-07T11:09:16","date_gmt":"2018-12-07T16:09:16","guid":{"rendered":"https:\/\/www.ntegrait.com\/important-fbi-dhs-warning-update-on-fbi-and-dhs-warning-samsam-ransomware\/"},"modified":"2018-12-07T11:09:16","modified_gmt":"2018-12-07T16:09:16","slug":"important-fbi-dhs-warning-update-on-fbi-and-dhs-warning-samsam-ransomware","status":"publish","type":"post","link":"https:\/\/ntegrait.com\/important-fbi-dhs-warning-update-on-fbi-and-dhs-warning-samsam-ransomware\/","title":{"rendered":"Important FBI\/DHS Warning: Update On FBI and DHS Warning: SamSam Ransomware"},"content":{"rendered":"

The Department of Homeland Security and the Federal Bureau of Investigation issued a critical alert Dec. 3, warning users about SamSam ransomware and providing details on what system vulnerabilities permit the pernicious product to be deployed.<\/p>\n

\"SamSam<\/p>\n

According to the\u00a0alert<\/a>, which came from the DHS\u2019s National Cybersecurity and Communications Integration Center (NCCIC) along with the FBI, the SamSam actors targeted multiple industries\u2014some within critical infrastructure\u2014with the ransomware, which also is known as MSIL\/Samas. The attacks mostly affected victims within the United States, but there was also an international impact.<\/p>\n

As pointed out in the alert, organizations are more at risk to be attacked by network-wide infections than individuals because they are typically in a position where they have no option but making ransom payments.<\/p>\n

\u201cOrganizations that provide essential functions have a critical need to resume operations quickly and are more likely to pay larger ransoms,\u201d the alert states.<\/p>\n

That does not mean individual systems cannot or are not attacked, but they are targeted significantly less by this particular type of malware.<\/p>\n

How do SamSam actors operate?<\/strong><\/p>\n

Through FBI analysis of victims\u2019 access logs and victim-reporting over the past couple of years, the agencies have discovered that the SamSam actors exploit Windows servers and vulnerable JBoss applications. Hackers use Remote Desktop Protocol (RDP) to gain access to their victims\u2019 networks through an approved access point and infect reachable hosts. From there, the cyber actors \u201cescalate privileges for administrator rights, drop malware onto the server, and run an executable file, all without victims\u2019 action or authorization,\u201d the report states.<\/p>\n

RDP ransomware campaigns are typically accomplished through stolen login credentials\u2014sometimes purchased from darknet marketplaces\u2014or brute force attacks. Since they do not rely on victims completing a specific action, detecting RDP intrusions is challenging, according to the alert.<\/p>\n

Ransom notes instructing victims to establish contact through a Tor hidden service are left on encrypted computers by the SamSam attackers. Victims are assured that once they pay the ransom in Bitcoin, they will receive links to download cryptographic keys and tools for decrypting their network.<\/p>\n

Where did SamSam originate?<\/strong><\/p>\n

The Department of Justice recently indicted two Iranian men who allegedly were behind the creation of SamSam and deployed the ransomware, causing approximately $30 million of damage and collecting about $6 million in ransom payments from victims. The\u00a0crippling ransomware<\/a>\u00a0affected about 200 municipalities, hospital, universities and other targets during the past three years, according to an article from Wired.<\/p>\n

Keith Jarvis, a senior security researcher at SecureWorks, reiterated the sophistication of the SamSam ransomware and how it gains access to systems through weak authentication or vulnerabilities in web applications, methods that don\u2019t require the victim to engage in a particular action. Hackers also go out of their way to target specific victims whose critical operations rely on getting systems up and running as quickly as possible, making them more likely to simply pay up.<\/p>\n

What technical details about SamSam are important?<\/strong><\/p>\n

In the joint DHS and FBI report, the federal agencies provided a list, though not exhaustive, of SamSam Malware Analysis Reports that outline four variants of the ransomware. Organizations or their IT services administrators can review the following reports:<\/p>\n

MAR-10219351.r1.v2 \u2013 SamSam1<\/a><\/p>\n

MAR-10166283.r1.v1 \u2013 SamSam2<\/a><\/p>\n

MAR-10158513.r1.v1 \u2013 SamSam3<\/a><\/p>\n

MAR-10164494.r1.v1 \u2013 SamSam4<\/a><\/p>\n

What mitigation and prevents practices are best?<\/strong><\/p>\n

In general, organizations are encouraged to not pay ransoms, since there is no guarantee they will receive decryption keys from the criminals. However, relying on a contingency plan or waiting out an attack, as advised by the FBI, is difficult when an entire operation has been compromised.<\/p>\n

The best course of action is for organizations to strengthen their security posture in a way that prevents or at least mitigates the worst impacts of ransomware attacks. The FBI and DHS provided several best practices for system owners, users and administrators to consider to protect their systems.<\/p>\n

For instance, network administrators are encouraged to review their systems to detect those that use RDP remote communication and place any system with an open RDP port behind a firewall. Users can be required to use a virtual private network (VPN) to access the system. Other best practices, according to the report, include:<\/p>\n