BLOG POST by Alice Strange / Heather Santos

SonicWall’s Mid-Year Update to the 2021 Cyber Threat Report: the number of attacks eclipses 2020 global totals in just six months.

There are several documents that many of us in this business open with a bit of trepidation. One is our tax bill, and the other is SonicWall’s annual Cyber Threat Report. 

There’s not much we can do about the former – being that taxes and death, as Benjamin Franklin once wrote, are the only certainties in life. The latter is a tool for those of us who work to keep networks secure, and this report is often a harbinger of things to come.

SonicWall’s semi-annual releases (one for the annual report, a second one for a mid-year update, because you can never have enough of a good thing, right?) is an authoritative source. Researchers use threat intelligence data from more than 1.1 million sensors in 215 countries and territories. SonicWall also produces the report in such a non-promotional way (they are a cybersecurity services company) that even news organizations like the Wall Street Journal and CNN quote their findings. 

The Mid-year update to the 2021 SonicWall Cyber Threat Report 

So, when we say that 2021’s cyberattack data eclipsed last year’s, we mean that cybercrime reached a new and unsettling paradigm. Established technology and infrastructure are under siege from ransomware. Through the first half of 2021, global ransomware volume hit 304.7 million, which surpasses the entire year of 304.6 million attacks in 2020. That’s a 151% year-to-date increase in case you’re wondering.

The data shows that threat actors are busy adapting ransomware tactics to reap more financial gains. The trend is especially worrisome for security experts because the risk to businesses and organizations will remain high while remote working is still widespread. And as Bill Conner, SonicWall CEO and President, recognizes, “Criminals are acutely aware of uncertainty across the cyber landscape.”

Ransomware attacks continue to wallop us.

After the record highs in April and May, June saw another record high of 78.4 million ransomware attacks. In the U.S., attacks increased by 185% and in the U.K., 144%. The U.S., U.K., Germany, South Africa and Brazil were the hardest-hit countries. In addition, Florida, New York, Idaho, Louisiana and Rhode Island were the states in the U.S. that saw the most confirmed attacks. The report also shows that in the recent rise in attacks, hackers targeted key verticals with a 917% rise in ransomware attacks on government entities, 615% on education, 594% on healthcare, and 264% on retail.

Patented RTDMI software is finding and blocking more original malicious code and variants.

SonicWall also discovered a record number of new and original malicious programming. For example, there was a 54% increase over the first half of 2020 new coding in the current pipeline of threats. The technology that made the discovery is SonicWall’s Real-Time Deep Memory Inspection or RTDMI, which is the core of SonicWall services like Capture Advanced Threat Protection (ATP).  

RTDMI technology blocks more advanced and new malicious code than other behavior-based sandbox methods. In one 33-day test by ICSA, SonicWall’s technology found 100% unique threats and variants with zero false positives. The results of the sixth and most recent test confirmed the high performance of the technology. 

Distribution of malware and non-standard port attacks continues to fall.

Last year, there was a global drop in the number of non-ransomware malware attacks. After hitting record highs in 2020, these attacks fell in the first half of 2021, with a decrease of 24% worldwide. And in another sign that threat actors are getting more sophisticated, there are fewer “spray and pray” attacks and more surgical strikes that target specific organizations or verticals. 

Concerns for Cryptojacking.

With the sharp value fluctuations of cryptocurrencies, there is also an ebb and flow in the number of cryptojacking incidents. After making an unexpected return to prominence in 2020, the number of cryptojacking malware incidents rose in the first half of 2021 (when cryptocurrency prices were the highest). SonicWall’s researchers found 51.1 million cryptojacking attempts from January to June, a 23% increase over the same six-month period last year. Cryptojacking hit Europe particularly hard with a 248% year-to-date increase. 

The Wild West of IoT devices goes wild.

When everyone packed their belongings and went home, they plugged in millions of new IoT (internet of things) digital devices, adding a new and fertile attack vector for cybercriminals, as reported by SonicWall. As a result, attacks on this class of devices rose 59% year-to-date globally, a rate not seen since 2018. Comparing regions, the U.S. saw a slightly smaller increase in IoT attacks (15% year-to-date), but Europe and Asia were slammed (113% and 190%, respectively).

CONCLUSION

As working situations evolved in 2021, so did the methods of threat actors and motivated perpetrators. SonicWall Capture Labs threat researchers team compiled their findings into the mid-year update to the 2021 SonicWall Cyber Threat Report, which arms enterprises, government agencies, SMBs and other organizations with actionable threat intelligence to safeguard workforces, networks and data in today’s distributed IT reality. Visit our website to view the full report and all of its findings.  

SOURCE: www.sonicwall.com/threatreport

BlackMatter ransomware hits the US food supply chain

September 21, 2021

Published with permission from CyberTalk

EXECUTIVE SUMMARY:

In Iowa, over this past weekend, an agrarian business that plays a critical role in the American food supply chain experienced a cyber attack. The Fort Dodge New Cooperative began operations in 1973, and is a member-owned farm cooperative that maintains 60 operating locations across the state. 

Launched by the BlackMatter ransomware group, the attack could have massively disrupted grain, chicken and pork availability within the US. Within the grain business alone, the company is involved in operations such as running grain storage elevators, selling fertilizer, purchasing grain from farmers and providing agricultural enterprises with new technologies. “About 40% of grain production runs on our software,” said a New Cooperative spokesperson.

The National Security Agency’s elite cyber team believes that the BlackMatter threat actors may have electronically mistook the New Cooperative group for an IT firm. The New Cooperative produces a SoilMap software product, which may have contributed to a case of mistaken identities. 

The BlackMatter ransom demand

The BlackMatter group demanded $5.9 million in a New Cooperative ransom payment. In exchange, attackers would provide a decryptor key. Further, if a ransom were not paid by a Saturday deadline, the group would publish 1 terabyte of proprietary data, supposedly stolen from the New Cooperative group. 

Since the attack, New Cooperative took systems offline. IT experts successfully contained the threat. In addition, the group has notified law enforcement and continues to work with information security professionals to investigate and remediate the attack. 

Questions have also been asked regarding the duration of time for which the ransomware group lingered in systems ahead of actually launching the attack. At present, this information remains unknown, although it is under investigation. 

The BlackMatter group’s hidden identity

Experts remain divided over whether the BlackMatter group is a “rebrand” of the REvil group or the DarkSide group. The REvil gang “disappeared” earlier this summer, and the DarkSide group vanished from the dark web shortly after the Colonial Pipeline attack. Or is BlackMatter an entirely independent gang?

High-profile ransomware attacks 

This attack represents the fourth significant and high-profile cyber attack directed towards US critical infrastructure entities in recent months, according to former CIA cyber official, Marcus Fowler. 

The Biden Administration intends for 16 different industry sectors to remain “off-limits” within nation-state backed hacking attempts. Biden has called for cyber crime gangs and politicians to stop the blitz of attacks on critical industry. However, this food and farmland attack indicates that Biden’s talks and warnings may have fallen on deaf ears. 

When addressing the BlackMatter threat actors about this issue, BlackMatter responded by saying that they did not agree with the assessment of agrarian enterprises as ‘critical industry’. The FBI reports that food and agricultural groups are active targets of cyber threats. Downstream effects could impact retail groups, hospitals, restaurants, and the average consumer

Should you care that these much-loved food delivery apps gather the data that they do?

Even if you weren’t super into takeout before the pandemic, chances are you’ve upped your delivery in the past year. I get it! Cooking gets tedious and boring and we’ve all needed to — literally — spice up our lives while homebound. I know that in my household, takeout has become a much more regular occurrence than I’d probably occur.

But whatever. We all deserve to give ourselves and others some grace right now. But should we be giving food delivery apps grace, too? For this week’s What Does the Internet Know About Me?, I’m going to take a look at DoorDash and GrubHub/Seamless, two of the bigger food delivery app services here in the US. (GrubHub owns Seamless, so I’m batching them together.) I already know that they know I love Chinese food. Let’s see what else they’ve got.

What does DoorDash track? What does GrubHub track?

Both delivery services collect a couple of obvious things that are necessary for them to, you know, bring food to my house. They know my name, my email address, phone number, address, and information about my payment method (i.e. credit card info or PayPal). 

DoorDash specifically says in their Privacy Policy that they know the items I’ve purchased and when, any special instructions, and the payment method used, but GrubHub doesn’t mention that in theirs. It seems odd — they kind of have to know that information to get me my food, right? — but I’m not sure there’s a strong conclusion to draw from that omission. They do mention, however, that they also know of any communications with them directly or with their “Delivery Partners.”

On the technical side, DoorDash is definitely watching me. They “use cookies, web beacons, pixels, session replay/screen capture, and similar technologies to collect information and personalize [my] experience with [their] Services.” They also use “session replay technology” to “collect real-time” information about how I interact with the app, including how I scroll it. They’re careful to note that they don’t record keystroke data. 

If I access their service through a website instead of my phone (which isn’t a thing I do) or the app on my phone, they also “collect information to better understand customer traffic patterns and Site usage.” That includes the website I visited before visiting their site or app, which parts of the site or app I visited and how much time I spent there. 

If I log in with a third party account, like Facebook, DoorDash will exchange information with that service too. They would also access my phone’s phone book for referrals, if I let them. (Which I don’t.) Finally, they track me across different devices “to better tailor content and features” and provide a “seamless experience.”

And speaking of seamless! (See what I did there?) In addition to the obvious stuff listed above, GrubHub/Seamless tracks transaction info, any communications done in-app or via phone or mail, location information, information about my device(s) and software, and analytics info, including through third party services like Google Analytics. 

But perhaps the creepiest thing that Seamless/GrubHub does is track the exact location of your phone. From their Privacy Policy:

“If you have previously opted into Grubhub’s collection and use of location-based information through our mobile application, we may collect and store the precise location of your device when the app is running in the foreground or background of your device.”

Yikes. That means that if you don’t opt out of location tracking on your phone, they potentially know where you are at all times. 

What do DoorDash and GrubHub do with my data?

Both DoorDash and GrubHub need some — to be fair, kind of a lot — of the data they collect in order to tell me what restaurants are nearby and then to deliver my food when I order it. They also have a legitimate interest in learning my likes and recommending similar restaurants in the future. Realistically, the nature of the business of a food delivery app means that they’re going to have to collect a lot of data about me.

However, I do think they step a bit over the line with the technical information they collect. I can see the business argument for it — I’m sure there’s a justification for why they need to know where I am at all times — but I just don’t think it’s valid. I don’t think they need to track as much of the technical information about me as they do, and I don’t like the ways they use it outside of getting food from local businesses to my house. Namely: third-party advertising. And they’re pretty broad about that. From GrubHub’s Privacy Policy:

“We work with third-party Ad Networks and Advertising Partners to deliver advertising and personalized content to you on our Platform and Services, on other sites and services you may use, and across other devices you may use. These parties may collect information directly from your browser or device when you visit the Platform through cookies or other tracking technologies. This collected information is used to provide and inform targeted advertising, as well as to provide advertising-related services such as reporting, attribution, analytics and market research.” 

And while GrubHub doesn’t give instructions on how to opt out of data collection for third party advertising, DoorDash, on the other hand, does so directly in their Privacy Policy. That’s a point in their favor from me. 

Should I care that food delivery apps gather so much data?

I’m bummed out by this investigation because, like all millennials, I like the convenience of ordering on an app — and not having to talk to a person on the phone. (Although honestly, as I’ve gotten older, the talking on the phone thing is less of an issue.) But the many, many ways GrubHub and DoorDash track me definitely has me concerned. Is it worth that much data being sucked up about me just for a slightly easier ordering experience?

Add on the fact that it became very clear during the pandemic just how big of a cut these food delivery apps take — and how shady some of their business practices are — and I think I might go back to ordering on the phone. 

That, or I’ll make my partner order using apps on his phone. Then it’s his info being collected, not mine. (Kidding. Or am I?)