Security News for the Week Ending August 23, 2019
Remember That Vague Client Alert Earlier This Week?
For those of you who are clients, you received an out of cycle client alert on Tuesday (they usually come out on Wednesday) providing a copy of the Homeland Security Alert on the Sodinokibi ransomware going after Managed Service Providers or MSPs. It now appears that the attack on Texas towns (see below) is based on an attack on the MSP hosting the systems of those municipalities. Assuming that is true (The state of Texas is being very vague on the whole situation), that could explain why DHS issued the alert at this time. To reiterate the recommendation in the alert – make sure that your MSPs’ security programs are up to the task. In the case of Texas, one town has announced that the attacker wants that town to pay $2.5 million in ransom. Source: Bleeping Computer.
20 Texas Towns Hit by Ransomware. Wait 23. Wait …..
Cities and towns across the country have been hit by a wave of ransomware attacks, but of course, everything is bigger in TEXAS.
While the press release is very short on details, the Governor has called out the Texas Military Department (that is the combination of the Army National Guard, the Air National Guard and the Texas State Guard, which is an organized militia as defined in the Constitution) along with the experts at Texas A&M University (The Aggies have a world class cybersecurity capability) to help the cities impacted deal with the situation. While Colorado was the first state to activate the National Guard to help with a cyber attack, Texas is now the third (after Louisiana) in what may become a trend. Source: KUT, Austin’s Public Radio Station.
IRS Notifies Thousands of Cryptocurrency Traders of Back Taxes and Penalties
Not wanting to leave money – even digital money – on the table, the IRS has sent out letters to thousands of cryptocurrency traders who did not report the trades on their tax returns assessing them taxes and penalties along with the threat of possible criminal prosecution. Not a big surprise, but if you thought you could escape the tax man… Of course, if you are trading peer to peer, then it is 100% unlikely that the tax man will ever find you. Source: CNBC.
Huawei Goes Into Full Battle Mode
Huawei CEO Ren Zhengfei sent a memo to the company that says, in light of the US bans, that it was time for the company to go into full battle mode, making references to the military bible, The Art of War.
As President Trump effectively admitted, the ban on Huawei has only a little to do with national security and all to do with his trade war, by continuing to suspend the ban – which is affecting US companies bottom lines and user’s security.
In the mean time, Huawei says that it will build 60,000 5G base stations this year and 1.5 million next year – all without any US components. Since other countries continue to buy Huawei equipment and US rural cell carriers say that that it will cost them more than a billion dollars to replace Huawei equipment which they do not have – meaning that they will dramatically slow 5G deployments.
Currently the US is lagging in 5G deployment and despite the President’s wishes that this is not so, this is not likely to change any time soon. Read the details of this dance here.
Plan for End of Life of Software Support
End-of-life in software and hardware means no more security fixes and given the number of fixes we see every month, using software and hardware that is no longer supported is not a good plan. No more patches does not mean no more flaws – just no more fixes for those flaws. Hackers count on that fact. Here is what is coming up to the end of life soon:
Python 2 on January 1, 2020 (about 4 months)
Windows 7 on January 14, 2020 (also about 4 months)
Windows Server 2008 and 2008 R2 also on January 14, 2020 (4 months). As an incentive to get you to migrate to Azure, if you migrate your Windows 2008 servers to Azure before January 14th (and therefore pay Microsoft monthly cash), they will support Server 2008/2008 R2 for three more years.
For states with cybersecurity and privacy laws that say that you have to take reasonable measures to protect your data, it will be hard to defend in court, if you have to, that using unsupported software is taking reasonable measures.
by 