Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

comp sec > singhealth > Flashcards

singhealth Flashcards

1
Q

what are the first 3 key events of the singhealth attack

A
  1. • The attacker gained initial access to SingHealth’s IT network around
    23/8/17, infecting front-end workstations, most likely
    through phishing attacks.
  2. Attacker then lay dormant for 4 months, before commencing lateral
    movement (6 months) in the network between Dec2017 and Jun2018, compromising many endpoints and servers, including the
    Citrix servers located in SGH, which were connected to the SCM
    database.
  3. • Along the way, the attacker also compromised a large number of user
    and administrator accounts, including domain administrator accounts.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

what are the second 2 key events of the singhealth attack

A
  1. Starting from May 2018, the attacker made use of compromised user
    workstations in the SingHealth IT network and suspected virtual
    machines to remotely connect to the SGH Citrix servers
  2. Attacker initially tried unsuccessfully to access the SCM database
    from the SGH Citrix servers.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

what are the third 3 key events of the singhealth attack

A

6.IHiS’ IT administrators first noticed unauthorised logins to Citrix
servers & failed attempts at accessing the SCM DB on 11 June 2018.
7. Unknown to them, the attacker had obtained credentials to the SCM
database on 26 June 2018.
8. Next Day 27 June 2018, the attacker began querying the SCM
database, stealing and exfiltrating patient records, and doing so
undetected by IHiS.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

what are the fourth 3 key events of the singhealth attack

A

• 1 Week later, on 4 July 2018, an IHiS administrator for the SCM system
noticed suspicious queries being made on the SCM database.
• Working with other IT administrators, ongoing suspicious queries
were terminated, and measures were put in place to prevent further
queries to the SCM database.
• These measures proved to be successful, and the attacker could not
make any further successful queries to the database after 4 July 2018.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

what are the fifth 3 key events of the singhealth attack

A

Between 11/6 & 9/7/18, the persons who knew of & responded to
the incident were limited to IHiS’ line-staff & middle management
from various IT administration teams, & the security team.
• After 1 month, on 9/7/18, IHiS senior management were finally
informed of the Cyberattack…
• 3 days later, 10/7/18, matter was escalated to Cyber Security Agency
(“CSA”), SingHealth’s senior management, the Ministry of Health
(“MOH”), and the Ministry of Health Holdings (“MOHH”)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

what are the sixth 4 key events of the singhealth attack

A

• Starting from 10 July 2018, IHiS and CSA carried out joint
investigations and remediation.
• Several measures aimed at containing the (a) existing threat, (b)
eliminating the attacker’s footholds, and ©preventing recurrence of
the attack were implemented.
• In view of further malicious activities on 19 July 2018, internet surfing
separation was implemented for SingHealth on 20 July 2018.
• No further suspicious activity was detected after 20 July 2018.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

what are the seventh 4 key events of the singhealth attack

A

• The public announcement was made on 20 July 2018, and patient
outreach and communications commenced immediately thereafter.
SMS messages were used as the primary mode of communication, in
view of the need for quick dissemination of information on a large
scale.
• COI Committee has identified 5 key Findings!

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

what was a key finding from singhealth attack

A 
IHiS staff did not have adequate levels of
cybersecurity awareness, training, and
resources to appreciate the security
implications of their findings and to
respond effectively to the attack.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

what was another 1 key finding from singhealth attack

A

Certain IHiS staff holding key roles in IT
security incident response and reporting
failed to take appropriate, effective, or
timely action, resulting in missed
opportunities to prevent the stealing and
exfiltrating of data in the attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

what was another 2 key finding from singhealth attack

A

There were a number of vulnerabilities,
weaknesses, and misconfigurations in the
SingHealth network and SCM system that
contributed to the attacker’s success in
obtaining and exfiltrating the data, many of
which could have been remedied before the
attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

what was another 3 key finding from singhealth attack

A

The attacker was a skilled and
sophisticated actor bearing the
characteristics of an Advanced
Persistent Threat group

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

what was another 4 key finding from singhealth attack

A

While our cyber defences will never be
impregnable, and it may be difficult to
prevent an Advanced Persistent Threat from
breaching the perimeter of the network, the
success of the attacker in obtaining and
exfiltrating the data was not inevitable

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

what did the attack exploit to make queries to the database

A
  1. A significant vulnerability was the network connectivity (referred to
    in these proceedings as an “open network connection”) between the
    SGH Citrix servers and the SCM database
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What was the network connectivity maintained for

A

r the use of

administrative tools and custom applications,

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

was it necessary to maintain the network connectivity for administrative tools and custom apps?

A

no

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Describe the security of the SGH Citrix servers

A

not adequately secured against unauthorised access.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Describe the 2fa in the sgh citrix servers

A

it was not enforced as the exclusive means of loggin in as an admin.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Describe the 2fa in the sgh citrix servers fucked us all

A

it was not enforced as the exclusive means of loggin in as an admin, therefore the attacker gained entry to server through other routes that did not require 2fa

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

How did the hacker access the SCM database

A

There was a coding vulnerability in the SCM application which was
likely exploited by the attacker to obtain credentials for accessing the SCM database.

20
Q

What did a penetration test identify in the network and when,

A

There were a number of other vulnerabilities in the network which
were identified in a penetration test in early 2017

21
Q

What was another thing exploited by the hacker

A

There were a number of other vulnerabilities in the network which
were identified in a penetration test in early 2017, and which may have
been exploited by the attacker.

22
Q

Describe 2 things exploited by the hacker

A

These included weak administrator account passwords and the need
to improve network segregation for administrative access to critical servers such as the domain controller and the Citrix servers

23
Q

Described the remeditation process undertaken by IHIS

A

Unfortunately, the remediation process undertaken by IHiS was
mismanaged and inadequate, and a number of vulnerabilities
remained at the time of the Cyber Attack.

24
Q

Describe the Modus Operandi of the attacker

A

The attacker had a clear goal in mind, namely the personal and
outpatient medication data of PM in the main, and other patients.

25
Q

What was the weapon of choice of hacker

A

The attacker employed advanced TTPs (tools/tactics, techniques,
procedures), as seen from the suite of advanced, customised, and
stealthy malware used, generally stealthy movements, and its
ability to find and exploit various vulnerabilities in SingHealth’s IT
network and the SCM application.

26
Q

Describe the work ethic of the attacker

A

. The attacker was persistent, having established multiple footholds
and backdoors, carried out its attack over a period of over 10 months,
and made multiple attempts at accessing the SCM database using
various methods.

27
Q

Describe the vibe of the attacker

A

The attacker was a well-resourced group, having an extensive
command and control network, the capability to develop numerous
customised tools, and a wide range of technical expertise.

28
Q

How could we have defended better against the attacker

A
  1. A number of vulnerabilities, weaknesses, and misconfigurations
    could have been remedied before the attack. Doing so would have
    made it more difficult for the attacker to achieve its objectives.
  2. The attacker was stealthy but not silent, and signs of the attack
    were observed by IHiS’ staff. Had IHiS’ staff been able to recognise
    that an attack was ongoing and take appropriate action, the
    attacker could have been stopped before it achieved its objectives.
29
Q

Who was the 7 step cyber kill chain framework invented by

A

lockheed martin

30
Q

what is the 7 step kill chain framework

A

which identifies what adversaries must complete in order to

achieve their objectives, going through 7 stages starting

31
Q

what are the steps in the 7 step kill chain framework

A
  1. recce
  2. weaponisation
  3. delivery
  4. exploitation.
  5. installation
  6. command and control
  7. actions on objectives
32
Q

What was the first evidence of breach and establishing control over Workstation A and when was this

A

August to December 2017
• Forensic investigations uncovered signs of callbacks to
an overseas command & control server (“C2 server”)
from 23 August 2017.
• Callbacks refer to communications between malware
and C2 servers, to either fetch updates and
instructions, or send back stolen information.

33
Q

CSA discovered many malicious artefacts in Workstation A, including ________

A

(i) a log file which was a remnant of a malware set;
• (ii) a publicly available hacking tool,
• (iii) a customised Remote Access Trojan referred to as “RAT 1”.
• (i) The log file was a remnant file from a known malware which has password
dumping capability;
• (iii) RAT 1 provided the attacker with the capability to access and control the
workstation, enabling the attacker to perform functions such as executing
shell scripts remotely, and uploading and downloading files.

34
Q

Describe the publicly available hacking tool that CSA discovered in aug to dec 2017

A

(ii) The publicly available hacking tool enables an attacker to maintain
a persistent presence once an email account has been breached, even
if the password to the account is subsequently changed.
• Hacking tool also allows an attacker to
• interact remotely with mail exchange servers,
• perform simple brute force attacks on the user’s email account password,
• and serve as a hidden backdoor for the attacker to regain entry into the
system in the event that the initial implants are removed;

35
Q

What was inside the log file created on workstation a on 29 aug 2017

A

The log file was created on Workstation A on 29 August 2017. The file
contained password credentials in plaintext, which appeared to
belong to the user of Workstation A.
The malware was likely to have been used by the attacker to obtain
passwords for privilege escalation and lateral movement.

36
Q

When was the public hacking tool installed on workstation A, and what did it exploite

A

Public hacking tool was installed on Workstation A on 1 Dec 2017 by
exploiting a vulnerability in the version “Outlook” that was installed on the
workstation.

37
Q

A vulnerability in Outlook installed in workstation A fucked us by revealing the password, elaborate more on this

A

• Although a patch was available at that time, but the patch was not installed
on Workstation A then.
• The tool was thus successfully installed and was used to download
malicious files onto Workstation A.
• Some of these files were masqueraded as .jpg image files, but in fact
contained malicious PowerShell scripts, one of which is thought to be a
modified PowerShell script taken from an open source post-exploitation
tool.

38
Q

rec 1

A

it security risk assessments and audit process must be treated seriously and carried out regularly

39
Q

rec 2

A

enhanced safeguards must be put in place to protect electronic medical records

40
Q

rec 3

A

domain controller must be better secured against attack

41
Q

rec 4

A

a robust patch management process must be implemented to address security vulnerabilites

42
Q

rec 5

A

a software upgrade policy with focus on security must be implemented to increase cuber resilience

43
Q

rec 6

A

an internet access strategy that minimises exposure to external threats should be implemented

44
Q

rec 7

A

incident response plans must more clearly state when and how a security incident is to be reported

45
Q

rec 8

A

competence of computer secuity incident reponse personnel must be significantly improved

46
Q

rec 9

A

a post breach independant forensic review of the network, all endpoints and the SCM system should be considered

comp sec (13 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions