What's new this week in the news for MSPs?
Google launches a new cloud file storage tier; AWS adds a new data migration device; AWS solves a 2.3 Tbps DDOS attack; fake data breach notification malware caught by Google; and Black Kingdom ransomware hack manipulating Pulse VPN flaws.
Let's see what it's all about.
Google Launches a New Cloud File Storage Tier
Google has announced the launch of its new product Filestore High Scale, a cloud-based file storage tier for businesses operating high-performance computing workloads. It is said to be the next step in the development of Google's Cloud Filestore service.
With Filestore High Scale, Google has integrated the capabilities of data storage startup Elastifile Ltd., which it acquired in July 2019. The new tier lets users send shared file systems that can expand to a capacity that permits hundreds of thousands of input/output operations per second, with tens of gigabytes per second throughput and hundreds of terabytes.
Google said that other workloads that may benefit from Filestore High Scale's scale-out storage are electronic design automation, financial modeling, genomics, and video processing.
AWS Adds a New Data Migration Device
AWS Snowcone is a new device added by Amazon to its family of data migration devices. This device is small and very portable, weighing only 4.5 pounds and measuring just nine by six by three inches. It provides up to 8 terabytes of storage for businesses using edge computing workloads, where space, power, and cooling features are limited.
AWS Snowcone operates on two central processing units. It has 4 gigabytes of memory for computing operations, a USB-C connection, and an optional battery unit.
In a blog post, Amazon Chief Evangelist Jeff Barr shared that Snowcone's primary objective is data migration, “Internet of Things,” transportation, content distribution and tactical edge computing, logistics, and autonomous vehicles use cases. What's more, the device is tamper-proof, dust-tight, water-resistant, and can transfer data using the AWS DataSync service.
AWS Snowcone will be available first in the AWS East (Northern Virginia) and AWS West (Oregon) regions, and additional regions will be added soon.
AWS Minimizes a 2.3 Tbps DDOS Attack
Amazon Web Service reported that it was able to diminish a distributed denial-of-service attack of 2.3 terabits per second in February. It is the most massive DDoS attack on record to date. According to the details given in the AWS Shield Threat Landscape Report- Q1 2020, this attack continued for three days. Those behind the attack failed to knock Amazon cloud services offline.
The method used is the so-called Connection-less Lightweight Directory Access Protocol reflection-based attack. In this type of attack, the attacker sends a CLDAP request to an LDAP server with a spoofed sender IP address — the target's IP address. The server then mounts a bulked-up response to the target's IP address, causing the reflection attack, hence the name.
The server is unaware of the attack when it receives multiple, apparently legitimate requests to establish communication, according to Imperva. From each open port, it answers each attempt with an SYN-ACK packet. This will eventually cause the server's connection overflow tables to flood and genuine clients will be denied access.
Fake Data Breach Notification Malware Caught by Google
To distribute malware and scams, bad actors have begun pushing fake notices about data breaches at big company names. These direct people to risky websites. The groups behind them are mixing Google Sites, black SEO, and spam pages.
Google Alerts, which uses predefined terms set by users to monitor search results, has helped in the spread of these false notifications. Some companies found in the notifications include Dropbox, Hulu, Ceridian, Shein, PayPal, Target, Chegg, EA, Canva, HauteLook, Mojang, InterContinental Hotels Group, and Houzz. These companies have suffered a data breach at some point in the past.
If a user follows any of these links picked up by Google Alerts, they find themselves on landing on pages with download offers for undesired extensions and malware, and fake giveaways.
Aside from using compromised websites, these groups also make their own pages. In many instances, they have used Google Sites to host their content.
A fake giveaway of iPhone 11 devices was one of the malicious links used as a redirect, claiming to have been set up by Google for its “Membership Rewards” program.
Using spam pages to redirect users to pages that pose a risk is not new; this is just the latest example by a malware group.
Black Kingdom Ransomware Hack Manipulating Pulse VPN Flaws
Businesses with unpatched Pulse Secure VPN software or initial access on the network are the target of the operators of the Black Kingdom ransomware. The malware was captured in a honeypot computer system that let security researchers examine and document its methods of operation.
A Pulse Secure VPN (CVE-2019-11510) critical vulnerability affecting earlier versions of its software was leveraged by the malware operators.
Researchers noted that the ransomware built endurance by mimicking a legitimate scheduled task for Google Chrome. According to REDTEAM.PL's analysis, it's likely that a scheduled task runs base64-encoded string code in a hidden PowerShell window to get a script named “reverse.ps1”, and then opens a reverse shell on the infected host.
Security researcher GrujaRS first spotted Black Kingdom ransomware in February, when it appeared to have appended a .DEMON extension to encrypted files.
The sample examined communicated with the same IP address seen in REDTEAM.PL's report. The ransom note sought $10,000, to be deposited to a bitcoin wallet, and threatened that failure to do so would lead to the data being destroyed or sold.
Learn about common ransomware attack scenarios and what to do if one of these attacks affects your clients:
Further reading Ransomware Attack Scenarios
That's a Wrap
I hope this update has been helpful. MSP360 is your resource for MSP news. Stay home, stay safe and healthy, and remember to check back next week for more highlights.
Read our free guide to learn about:
- Common MSP vulnerabilities;
- How to prepare for a ransomware attack to keep your clients safe;
- Which actions response to a ransomware attack should involve;
- How to manage clients while handling an attack.