Chapter 2 WWW.TARGET.SG CASE STUDY ON SUPPLY CHAIN ATTACKS CASE STUDY ON SPEAR PHISHING ATTACKS Incident in the ICT Sector Business E-mail Compromise and Takedown of Phishing Websites Follow-up Action What Happened? In early-2019, data stolen from a local information and communications technology (ICT) firm was reportedly put up for sale on the Dark Web. The ICT firm took measures immediately to detect signs of unauthorised access into their networks and systems. Cybersecurity firms were also engaged to assist in forensic investigations and gather intelligence. Investigations revealed that the threat actor accessed the company’s corporate network through a vendor, and then compromised two systems related to customer care. There was no indication of data exfiltration from the affected network and systems. 24 SINGAPORE CYBER LANDSCAPE 2019 Recovery measures taken by the company included cleaning up the affected network and systems, and disconnecting non-essential links of the network to the vendor. The firm also re-evaluated its cybersecurity practices, which included reviewing its network connectivity with its subsidiaries, reconfiguring relevant firewall rules, and scanning their networks and systems for Indicators of Compromise (IOCs). Many websites are prone to web hacking techniques, such as Structured Query Language (SQL) code injection — the embedding of malicious codes — that allow attackers to send queries to webpages, such as the log-in page. Through such techniques, attackers can assume the identity of the web administrator, access or modify data, or exploit inherent vulnerabilities. In the event of a systems compromise, the recovery process would be costly and time-consuming, especially in cases where the system was damaged, or if company data was stolen or corrupted. To prevent such attacks and for business continuity, organisations need to ensure that their websites and databases are properly secured, configured and encrypted where necessary. Organisations should also ensure that their systems are regularly patched to address known vulnerabilities in their networks and systems. What Happened? Recommendations An employee received a phishing e-mail that looked like it had been sent by the company’s IT department, which alerted the employee to update the software on his computer to avoid an account suspension. Unaware that he had been re-directed to a phishing webpage by clicking on the e-mail link, the employee unsuspectingly entered his user credentials, which were then harvested by the attacker. CSA constantly watches out for phishing e-mails and links. Organisations and members of public can report phishing links to CSA, who will work with the Infocomm Media Development Authority (IMDA) to take down the phishing site. IT administrators can also analyse malicious e-mails to discover the originating IP addresses, and subsequently block all e-mails from them to prevent similar scams. Organisations are encouraged to conduct regular awareness campaigns to educate their employees on good cyber hygiene practices, so that they do not fall victim to phishing scams. With the stolen user credentials, the attacker logged into the employee’s e-mail account and sent an e-mail to the company’s accountant to request for an immediate online fund transfer. Fortunately, the accountant spotted suspicious signs in the e-mail, and checked the veracity of the information via phone calls with the sender instead of replying through the e-mail. Further investigations confirmed that the employee’s e-mail account had been compromised and the user credentials were leaked through the phishing webpage. 25