,
10 tweets,
4 min read
Read on Twitter
Today, Singapore gov published a large, thorough, 450+ pages analysis report on the Health Services Private Ltd hack. Here's a summary analysis highlighting the most interesting findings. Full report is available at: mci.gov.sg/coireport
The attackers breached Singapore Health Services through a vulnerability in Outlook. Although a patch was available, the systems were not updated. As a side note, it is quite rare that we see attackers exploiting vulnerabilities in Outlook. 
Once on the host, the attackers collected passwords and began moving laterally. Some of the passwords were weak and their hashes easily crackable by tools such as @hashcat. Sadly, ‘P@ssw0rd’ is way too common in IT environments.
On the initial host, the attackers deployed a couple of malicious PowerShell scripts, some of them disguised as JPG files. One was a modified post exploitation open source tool.
In addition to PowerShell malware, the attacker leveraged some custom malware. The report calls it RAT 1 and RAT 2. Most of the initial compromise happened by December 1, 2017.
The attackers used an extensive C2 infrastructure, for infection, exfiltration and beaconing/heartbeat checkins. These were "overseas" servers, unfortunately the report doesn't contain the IPs.
The attacker had a clear goal in mind, namely the personal and
outpatient medication data of the Prime Minister in the main, and
also that of other patients. Their actions were targeted and specific, showing technical competence and mission-orientation.
outpatient medication data of the Prime Minister in the main, and
also that of other patients. Their actions were targeted and specific, showing technical competence and mission-orientation.
The report includes a couple of mitigation strategies, which include: implementing a patching strategy, using stronger passwords, disable PowerShell a.s.o. Nevertheless, I like this reality-check type statement: "While our cyber defences will never be impregnable..."
A large amount of these recommendations match the Austrlian Signals Directorate @ASDGovAu top 35 mitigation strategies to fight targeted attacks. It's never too late to start implementing them: securelist.com/how-to-mitigat…
Overall, excellent work preparing the report, analysis, recommendations and releasing it to the public. Kudos for transparency!
