Cyberattack to the City of Atlanta's network

[arjay57]

Originally Posted by jero23

What do you think? I'm asking you because no one here are officials of the City of Atlanta.

That's beyond my expertise. However, what made me think about it is the city's internal memo quoted by the AJC that says "If you have not already, please unplug your Ethernet cable from your desktop in an effort to prevent possible corruption...."

I read that as implying that if you were connected to the city's network, you might be at risk. Maybe some of our computer gurus can clarify.

[cqholt]

Originally Posted by jero23

What do you think? I'm asking you because no one here are officials of the City of Atlanta.

No, the website is secure.

[Need4Camaro]

Originally Posted by arjay57

Here's a question.

Say you want to access the city of Atlanta website for something. Does that put you at risk of getting the same high-jack/ransom bug?

It really depends on what kind of information you shared with the website. I haven't browsed it for myself. Is there anyplace for you to make payments, input personal information, ect? If so then technically YES, and the reason is because they likely gained access to secure servers during the hacking if they managed to encrypt so much data, said servers would likely at minimum trace back to where the website is actually hosted (presumably on one of their local servers with a public IP natted and dynamically translated to their web domain, HOWEVER; Likely, no.. If I understand correctly, they did not attempt data-theft but merely encrypted the data available to them..

If none of those options I listed before are available, then the only thing they have access to is your public IP address (the IP of your modem is stored in server logs whenever you access a website.)..they wouldn't care about this as unless you seriously exploit yourself by disabling your modem firewall and also your Windows firewall, they can't do anything with it unless they had literal interest in finding out who you are, and it will take a bit more than that...which they don't want or need...they only want money.

[Stormhammer]

https://blog.raxis.com/2018/03/27/ci...learn-from-it/

A little more technical details

Oh yeah, Loganville got hit too.

[Need4Camaro]

Originally Posted by Stormhammer

https://blog.raxis.com/2018/03/27/ci...learn-from-it/

A little more technical details

Oh yeah, Loganville got hit too.

Thats quite interesting and a good retaliation on Atlanta's part (completely shutting down to mitigate and control the damage).

I have to add though that if the attacker got in through RDP some incompetency is being exhibited somewhere. RDP uses port 3389 for TCP & UDP and by default on a Windows Server is open (and is a HUGE vulnerability risk to anything that isn't behind a firewall.(while the Server is behind the firewall, in order for traffic to get to that port, it must remain open in that firewall and using 3389 is pretty much like not having a firewall.)) -- Anyone with sense changes the port of which RDP connections are made on (it's absolutely unsafe for any secure network to allow it to remain on 3389 if RDP connections are mandatory).

If the port was changed, It's possible the attacker used a port sniffer, but highly more likely that the attack was an inside attack from someone who knew the network atleast decently, and also had credentials to actually login to the RDP session because getting the port right is only half the battle, having the UAC to actually access the RDP session is the other half..

Its likely the attacker is local (and possibly even an employee), and wants the money in BitCoin because it will make it harder to trace where the money goes thus keeping his identity sealed.

[fourthwarden]

Audit shows city was warned of cyber vulnerabilities | CBS46

An internal audit obtained by the CBS46 Bulldog team, shows in stunning detail how the City of Atlanta was warned months before the recent cyber attack their IT systems could easily come under attack, if not fixed immediately. And the problem had grown for some time.


In the 41-page audit, the city was told last summer their IT department was on life support, and there was basically no formal plans in place to protect the city from cyber threats.


According to the auditor, it took months for the city to even respond to the audit, formally acknowledging the issues.

[Stormhammer]

Originally Posted by Need4Camaro

Thats quite interesting and a good retaliation on Atlanta's part (completely shutting down to mitigate and control the damage).

I have to add though that if the attacker got in through RDP some incompetency is being exhibited somewhere. RDP uses port 3389 for TCP & UDP and by default on a Windows Server is open (and is a HUGE vulnerability risk to anything that isn't behind a firewall.(while the Server is behind the firewall, in order for traffic to get to that port, it must remain open in that firewall and using 3389 is pretty much like not having a firewall.)) -- Anyone with sense changes the port of which RDP connections are made on (it's absolutely unsafe for any secure network to allow it to remain on 3389 if RDP connections are mandatory).

If the port was changed, It's possible the attacker used a port sniffer, but highly more likely that the attack was an inside attack from someone who knew the network atleast decently, and also had credentials to actually login to the RDP session because getting the port right is only half the battle, having the UAC to actually access the RDP session is the other half..

Its likely the attacker is local (and possibly even an employee), and wants the money in BitCoin because it will make it harder to trace where the money goes thus keeping his identity sealed.

Unfortunately, welcome to government. As one local infosec peer said to me when we were talking about how they should of deprecated RDP and used VPN

"

It's government. Security through obscurity

Working with other entities to get VPNs setup can be a nightmare. It took 5 months to get the Department of Juvenile Justice to accept the fact I removed any any rules blocking internet traffic to a file repo and they would have to work with setting up a VPN. It took almost a year for a sheriff vendor to give me a static IP to allow only communication between it and the server they needed access to. That vendor runs an inmate lookup database, guess what info the server includes... this joker wanted and needed any any connection... Small local government doesn't care about security until it affects the bottom line"

[Stormhammer]

Originally Posted by fourthwarden

Audit shows city was warned of cyber vulnerabilities | CBS46

It's.... disappointing, to see in the flesh a very real scenario of an apparently underfunded IT team.

However, this whole " threats have increased tremendously over the last year. New threats are fluid and often hard to keep up with " is a bunch of horse ****.

Yeah, threat's have increased, new variants of malware are made every 4 seconds, but it's unacceptable in my eyes (and world - I work in infosec ) to have vulnerabilities outstanding for so long.

I legit feel bad for that IT team.

[JPD]

Worth it!

We made the Onion.

https://www.theonion.com/lame-cybera...str-1824154853