Image of a space with many servers. A server room.

Microsoft vulnerability leaves over 60,000 email servers vulnerable to Hafnium attack. CISA Advisory provides guidance on how to protect email systems.

Image Credit: Schäferle from Pixabay.

***Updated March 13, 2021 – CISA has identified seven webshells associated with this activity. This is not an all-inclusive of webshells that are being leveraged by actors. CISA recommends organizations review the following malware analysis reports (MARs) for detailed analysis of the seven webshells, along with TTPs and IOCs. 

  1. AR21-072A: MAR-10328877.r1.v1: China Chopper Webshell
  2. AR21-072B: MAR-10328923.r1.v1: China Chopper Webshell
  3. AR21-072C: MAR-10329107.r1.v1: China Chopper Webshell
  4. AR21-072D: MAR-10329297.r1.v1: China Chopper Webshell
  5. AR21-072E: MAR-10329298.r1.v1: China Chopper Webshell
  6. AR21-072F: MAR-10329301.r1.v1: China Chopper Webshell
  7. AR21-072G: MAR-10329494.r1.v1: China Chopper Webshell

***Updated March 12, 2021 – Check my OWA tool for checking if a system has been affected.

Earlier this month Microsoft disclosed a set of vulnerabilities in Microsoft Exchange server products. Microsoft has provided a blog post where you can find an explanation of the attack on Exchange servers, information on HAFNIUM, and more.

Check out this latest advisory from the Cybersecurity and Infrastructure Security Agency (CISA), with step-by-step instructions on how to gather evidence with FTK Imager and KAPE. The Alert includes information on how to mitigate the vulnerabilities, including tactics, techniques and procedures (TTP) and the indicators of compromise (IOCs) associated with this attack.

As of March 10, 2021, CISA recommends the following:

  • Organizations should run the Test-ProxyLogon.ps1 script as soon as possible—to help determine whether their systems are compromised.
  • Organizations should investigate signs of a compromise from at least January 1, 2021 through present.

Furthermore, according to Bloomberg, the Chinese state-sponsored hacking group has claimed at least 60,000 known victims globally.

Cell phone with image of lock on the screen.

Reasonable Security: Implementing Appropriate Safeguards in the Remote Workplace

Photo by Franck on Unsplash

In 2020, with large portions of the global workforce abruptly sent home indefinitely, IT departments nationwide scurried to equip workers of unprepared companies to work remotely.

This presented an issue. Many businesses, particularly small businesses, barely have the minimum network defenses set up to prevent hacks and attacks in the centralized office. When suddenly everyone must become their own IT manager at home, there are even greater variances between secure practices, enforcement, and accountability.

“Reasonable Security” Requirements under CCPA/CPRA and Other Laws

Under the California Consumer Privacy Act (CCPA), the implementation of “reasonable security” is a defense against a consumer’s private right of action to sue for data breach. A consumer who suffers an unauthorized exfiltration, theft, or disclosure of personal information can only seek redress if (1) the personal information was not encrypted or redacted, or (2) the business otherwise failed its duty to implement reasonable security. See Cal. Civ. Code § 1798.150.

Theoretically, this means that a business that has implemented security measures—but nevertheless suffers a breach—may be insulated from liability if the security measures could be considered reasonable measures to protect data. Therefore, while reasonable security is not technically an affirmative obligation under the CCPA, the reduced risk of consumer liability made reasonable security a de facto requirement.

However, under the recently passed California Privacy Rights Act (CPRA), the implementation of reasonable security is now an affirmative obligation. Under revised Cal. Civ. Code § 1798.100, any business that collects a consumer’s personal information shall implement reasonable security procedures and practices to protect personal information. See our CPRA unofficial redlines.

Continue Reading Reasonable Security: Implementing Appropriate Safeguards in the Remote Workplace
PCI Expert Summer Virtual Event on November 5, 2020. Hosted by RSI.

Metaverse Law to Speak at PCI Expert Summit

Metaverse Law will be speaking at the PCI Expert Summit hosted by RSI Security.

This year, the annual PCI Expert Summit event is an online/virtual all-day conference on Thursday, November 5, 2020, from 9:00am to 5:00pm PST. The agenda includes panels with PCI experts in addition to breakout sessions on specialized topics, such as incident and data breach response. Continuing Professional Education (CPE) credits are available.

Register at https://www.rsisecurity.com/pciexpertsummit/.

Computer screens against skyscraper backdrop

Should Bar Associations Vet Technology Service Providers for Attorneys?

[Originally published in GPSOLO, Vol. 36, No. 6, November/December 2019, by the American Bar Association. Reproduced with permission. All rights reserved.]

Image Credit: Gerd Altmann from Pixabay1

Bar associations across the country have similar goals: advance the rule of law, serve the legal profession, and promote equal access to justice. Technology can easily support these goals. From online research and billing software, to virtual receptionist and SEO services, technology vendors improve the efficiency and accessibility of attorneys. It is no wonder then that bar associations around the country are promoting technology solutions for their members.

Despite the obvious benefits, bar associations need to be diligent about vetting technology vendors. By promoting one technology provider over another, bar associations could run afoul of advertising laws, tax requirements, and software agreements. In addition, bar associations and their members need to pay close attention to technology vendors’ cybersecurity safeguards to protect client confidences.

This article will briefly address each of these issues in turn and provide a non-exhaustive checklist of considerations before choosing a legal technology provider.

Bar Associations as Influencers

When we think of product endorsements today, we think of social media influencers, bloggers, and vloggers—not bar associations. Yet, bar associations wield incredible influence over the purchasing decisions of their members. Given this influence, bar associations should stay mindful of laws addressing unfair and deceptive advertising, such as Section 5 of the Federal Trade Commission Act (FTC Act), state false advertising laws, and state unfair trade practices acts (little FTC acts).

Continue Reading Should Bar Associations Vet Technology Service Providers for Attorneys?
WSJPro Cybersecurity Symposium

Metaverse Law to Speak at WSJ Cybersecurity Symposium

Metaverse Law will be one of the speakers at the Wall Street Journal’s Cybersecurity Symposium and will focus on the applicable laws and regulations per business type.

It is a two day event in San Diego, CA from Thursday, January 9 to Friday January 10, 2020. The agenda for both days includes breakfast and registration, several speakers, networking breaks, lunch, a cocktail reception on the ninth, and a cybersecurity strategy development bootcamp on the tenth.

A detailed itinerary as well as registration details can be found at https://cybersecurity.wsj.com/symposium/san-diego/#schedule

1 2