Month: October 2019

When more than 20 local governments in Texas were hit this summer by ransomware in one day. The attack was apparently tracked back to one thing the organizations had in common: a managed service provider. With limited IT resources of their own, local governments have increasingly turned to MSPs to operate significant portions of their networks and applications, as have other organizations and businesses—often placing critical parts of their business operations in the MSPs’ hands. And that has made MSPs a very attractive target to ransomware operators.

Threat researchers at the global cloud security provider Armor have been tracking publicly-reported incidents in which MSP and cloud service providers have been hit with ransomware. Thus far, they have documented 13 such incidents this year—with 6 of them reported in the past few months.

The most recent publicly exposed victim is Billtrust, which as security journalist Brian Krebs reported, was hit by what BleepingComputer reported was BitPaymer ransomware (a report that has not been confirmed). BillTrust is an online invoicing and billing provider based in New Jersey that also provides credit decision services. Billtrust executives sent an email to customers on October 22, informing them of the attack, stating:

Our standard security and back-up procedures have been and remain instrumental in our ability to execute the ongoing restoration of services… Out of an abundance of caution, we cannot disclose the precise ransomware strains but will do so as soon as prudently possible.

Other victims include:

• SchoolinSites, a cloud-based service provider for school districts that offered websites and parental access to student information, was taken down in an attack in September as reported by WKRG in Mobile, Alabama. The company’s email was affected as well as other communications; SchoolinSites had to use Facebook to provide updates during the outage, which began on September 23.
• TrialWorks, a Florida-based case management software provider, was hit by a ransomware attack the week of October 14. The company, which serves about 2,500 law firms, acknowledged the ransomware attack and said that, while it did not impact their software, about 5% of the company’s customers could not access their accounts.
• California-based MetroList, a real estate multiple listing and application services firm with about 20,000 real estate broker customers, was hit by ransomware in June, taking the company’s services offline for two days. MetroList reportedly paid the ransom, which included a $10,000 insurance deductible.
• Also on October 14, Magnolia Pediatrics of Prairieville, Louisiana, was reportedly hit by ransomware via the practice’s managed IT services provider. Magnolia reported the ransomware to law enforcement.
• In July, CorVel, a managed service provider for insurance companies handling workers compensation, auto, health, and disability claims, got hit by Ryuk ransomware. As the company responded, systems used to process claims, email and phone systems, and healthcare provider databases were taken offline.

Organizations using full-service IT-managed service providers, such as Magnolia Pediatrics, are particularly at risk because the security of all of their systems is dependent on that of the MSP. As was the case in Texas, this meant that all their data was put at risk. In Magnolia’s case, all patient data was encrypted, but it could just as easily have been stolen by attackers—and since that data includes personal identifying data for children, it could have significant long-term consequences. A clinic spokesperson said that “out of an abundance of caution,” Magnolia advised patients’ families to monitor credit card statements and credit bureau reports.

These issues are why having a conversation (and a contract) with a service provider that includes security is so important.

On October 29, 1969, at 10:30pm Pacific Time, the first two letters were transmitted over ARPANET. And then it crashed. About an hour later, after some debugging, the first actual remote connection between two computers was established over what would someday evolve into the modern Internet.

Funded by the Advanced Research Projects Agency (the predecessor of DARPA), ARPANET was built to explore technologies related to building a military command and control network that could survive a nuclear attack. But as Charles Herzfeld, the ARPA Director who would oversee most of the initial work to build ARPANET put it:

The ARPANET was not started to create a Command and Control System that would survive a nuclear attack, as many now claim. To build such a system was, clearly, a major military need, but it was not ARPA’s mission to do this; in fact, we would have been severely criticized had we tried. Rather, the ARPANET came out of our frustration that there were only a limited number of large, powerful research computers in the country, and that many research investigators, who should have access to them, were geographically separated from them.

In its infancy, ARPANET had but four “nodes”:

• The University of California-Los Angeles’ Network Measurement Center, with its SDS Sigma 7 computer;
• Stanford Research Institute’s Network Information Center, with its SDS 940 computer running NLS (an early hypertext system and precursor to the World Wide Web);
• The University of California, Santa Barbara’s Culler-Fried Interactive Mathematics Center, with its IBM 360/75 running OS/MVT; and
• The University of Utah School of Computing, with its Digital Equipment Corp PDP-10 running the TENEX operating system.

Rather than being directly connected, the computers were connected via Interface Message Processors (IMPs), which were the first network routers. This would allow additional systems to be added as nodes to the network at each site as it evolved and grew. This idea came from physicist Wesley Clark, who is also credited with designing the LINC, the world’s first personal computer.

The first letters transmitted, sent from UCLA to Stanford by UCLA student programmer Charley Kline, were “l” and “o.” On the second attempt, the full message text, login, went through from the Sigma 7 to the 940. So, the first three characters ever transmitted over the precursor to the Internet were L, O, and L.

By the time I was first exposed to ARPANET, it had grown significantly, but it was still primarily a connection between researchers and military organizations. ARPANET was operated by the military until 1990, and until then, using the network for anything other than government-related business and research was illegal. By that time, ARPANET was largely being supplanted by the National Science Foundation Network (NSFnet). Even though the Defense Department had split off its own networks as MILNET in the mid 1980s, parts of the military still referred to its network connections as ARPANET in many internal documents into the early 1990s, as I found when I was working as a network engineering contractor at Army Test Lab at Aberdeen in 1992.

When it was shut down, Vinton Cerf, one of the fathers of the modern Internet, wrote a poem in ARPANET’s honor:

It was the first, and being first, was best,
but now we lay it down to ever rest.
Now pause with me a moment, shed some tears.
For auld lang syne, for love, for years and years
of faithful service, duty done, I weep.
Lay down thy packet, now, O friend, and sleep.

Without ARPANET, there would have been no Internet. So pour one out for the original tonight if you happen to be basking in the Internet’s glow.