CHAPTER 2 TARGET.SG TARGET.ORG.SG FEATURED TOPIC Organisations are frequently targeted by threat actors, most often to steal private and personal information from their databases. As more Small and Medium Enterprises (SMEs) go digital, business e-mail impersonation scams are expected to grow in tandem. The Singapore Police Force observed 378 business e-mail impersonation scams in 2018, up from 332 cases in 2017. In total, businesses in Singapore suffered losses of close to S$58 million in 2018, an increase of about 31 per cent from 2017. CASE STUDY CRYPTO-JACKING WHAT HAPPENED? UNAUTHORISED CRYPTO-MINING BECOMING MORE PREVALENT In January 2018, SingCERT received information that a training institute’s web servers had been infected by malware. Four of the institute’s web servers were later found to be infected by a crypto-mining malware. No other suspicious activity was detected, although the infected web servers were observed communicating to Internet Protocol (IP) addresses associated with crypto-mining operations. SingCERT later discovered that the institute’s web server software had not been patched to the latest versions, leading to its subsequent compromise. The attacker exploited these vulnerabilities to hijack the systems and discreetly link the web servers to a cryptomining pool. The cryptocurrency produced was then transferred to a cryptocurrency wallet for storage. The attacker remains unknown due to the anonymous nature of the encrypted wallet. FOLLOW-UP ACTION SingCERT provided technical assistance to the organisation to investigate and understand the root cause and potential impact of the incident. SingCERT also worked together with the organisation to restore all compromised web servers to their last known serviceable state. All organisations and businesses should manage their cybersecurity risks appropriately. These include ensuring that all systems are regularly updated and patched for known vulnerabilities, and educating employees on the importance of verifying important email requests with business partners first, before responding to them. The public may refer to the SingCERT alert published on 9 November 2017 for measures to counter the rising crypto-jacking threat.10 “[SingCERT] Alert on Browser-based Digital Currency Mining,” SingCERT Advisories & Alerts, 9 November 2017, https://www.csa.gov.sg/singcert/news/advisories-alerts/alert-on-browser-based-digital-currency-mining. 10 28 Cybersecurity firms have observed a shift in modus operandi from traditional ransomware to crypto-mining, as mining cryptocurrency becomes more profitable than other criminal business models. Internet of Things (IoT) devices have also emerged as a potential attack vector that may be abused by cybercriminals. ADB.Miner, a Monero crypto-mining botnet which borrowed scanning code from Mirai, was found in February 2018 targeting Android-based devices. Another Monero crypto-mining botnet, Smominru, utilises the ETERNALBLUE 11 exploit and has since infected more than 500,000 computers worldwide. In January 2018, security company Sucuri discovered a campaign where over 2,000 WordPress websites were compromised by a malicious script. This script delivered crypto-mining and keylogging malware to devices. Users would experience a decline in computing performance of their devices when they visit these compromised websites, whose malware in turn harness the computing power to mine cryptocurrencies. Sensitive information such as payment details would also be captured by the malware. 11 ETERNALBLUE is an exploit which leverages a vulnerability in Microsoft’s Server Message Block (SMB). SMB is a protocol used by computers to share access to files and appliances over a network. 29