A Hackers Pot of Gold: Your MSP’s Data

Feb 09, 2023The Hacker NewsPassword Security

A single ransomware attack on a New Zealand managed service
provider (MSP) disrupted several of its clients’ business
operations overnight, most belonging to the healthcare sector.
According to the country’s privacy commissioner, “a cyber security incident involving a
ransomware attack^[1]” in late November
upended the daily operations of New Zealand’s health ministry when
it prevented the staff from accessing thousands of medical records.
The Ministry of Justice, six health regulatory authorities, a
health insurer, and a handful of other businesses also number among
those affected by second-hand damage from the attack. There are
ways to recover from a ransomware attack^[2], but the damage often
extends into that attacked organization’s customers and
vendors.

The targeted MSP in this incident is Mercury IT, a business
based in Australia. Te Whatu Ora, the New Zealand health ministry,
was unable to access at least 14,000 medical records because of the
outage at Mercury IT. This includes 8,500 bereavement care services
records going back to 2015, and 5,500 cardiac inherited disease
registry records from 2011. Although Te Whatu Ora said in a public
statement that their healthcare services were not affected by the
ransomware attack, one can easily see how poor security posture
could inadvertently harm medical patients.

In the private sector, health insurance firm Accuro reported an
illegal download and dissemination of corporate data following the
Mercury IT attack. Most of the stolen data pertained to the
company’s finances, according to Accuro in a
statement^[3], which was then leaked
onto the dark web. Some of the stolen data includes member contact
information and policy numbers, Accuro adds, but states that there
has been no observed misuse of the stolen personal data.

MSP Attacks: Killing Several Birds with One Stone

This incident shows how MSPs are attractive targets for
attackers because of the vast amount of client data stored in a
single company’s systems. Cybercriminals need only to exploit the
security vulnerabilities of one MSP to steal confidential data from
dozens of companies at once. Investigators are too early in their
investigation to determine the attacker’s objective and motive, but
there is a clear lesson for IT admins in this story—audit an MSP’s
security practice before you pay.

Passwords: The Weakest Link

The 2021 MSP Threat Report^[4]
by ConnectWise revealed that 60% of MSP client incidents were
related to ransomware. Ransomware groups only need the lowest
hanging fruit to launch a successful attack – weak passwords. Even
while new forms of authentication are being developed to make
passwords obsolete, passwords remain the most common and most
vulnerable method of securing data.

Consequently, one of the most common methods for distributing
ransomware is an RDP brute-force attack. Attackers launch
brute-force attacks by using an automated program to try a long
list of password combinations on an account until they guess the
right one, after much trial and error. Once inside, an attacker is
free to steal data from the target’s organization and paralyze
their systems with ransomware. A common defense against brute-force
attacks involves setting a finite number of login attempts before
the account is temporarily locked down.

Auditing Vendor Passwords

Organizations risk inheriting the security weaknesses of their
vendors without conducting a security audit beforehand. Specops Password Auditor^[5] is a free read-only
password auditing tool that aids the decision-making of IT admins
by scanning active directory for password-related security
weaknesses. Using this tool, admins can view every account’s
security posture so that no accounts with breached passwords will
go unnoticed.

Specops Password Auditor gets to the root of weak passwords by
identifying the password policies that enabled their creation in
the first place. With the interactive reports generated by Specops
Password Auditor MSPs can identify if their policies are compliant
and which ones rely on default password policies. They can also
compare their password policies with various compliance standards,
such as NIST, CJIS, NCSC, HITRUST, and other regulators. IT Admins
can request vendors and their MSPs to run this free scan and then
get a read-only report. For precise security planning, admins can
customize the Password Policy Compliance report to display only the
standards relevant to their organization.

Download Specops Password Auditor for free
here.^[6]