#Spoilers for Crystalized episode 16: Darkness Within

[halfbakedideas]

When Life Goes Another Way

Desc: It's funny, how four seconds is not long enough to blink but long enough for someone to lose their life.

Or, Nya is four seconds too late to save the Ninja at the subway tunnel. How does this affect everything?

[Contains spoilers for Crystallised episode 16 “Darkness Within”]

The muscles in all their arms are screaming from the weight of the concrete from what used to be the roof. It is at that moment that the realization strikes all of them. Even with Cole’s superstrength and Zane’s titanium form, it is not enough. The four of them can only keep holding up the loose chunk of the subway tunnel for so long and that time is running out fast. Too fast. It won’t be long now.

A strange kind of peace washes over them all at that. After all the battles, fights and heart-stopping injuries over the years, this is how they will go out. Crushed by rubble.

“Guys, I’m sorry.” Cole says. His muscles are screaming from the immense strain of keeping them all from being crushed.

He’s the one with the super strength. He should be able to hold this piece of debris up. He’s the one who will fail them all. He’s the reason they will all be dead.

“It’s okay.” Jay tells him as sincerely as Cole’s ever heard him. There is no trace of humour anywhere in his voice. Those two words…he is not the only one who has accepted the impending death. There’s something strangely comforting in that.

I’m sorry guys.

Before Cole even opens his mouth after he has turned to him, Jay knows what he’s going to say. He knows what is coming. All four of them do. There’s an almost, kind of, peace surrounding them because of that. Contrary to what his best friend most likely believes right now, it is not his fault. The full blame rests on the shoulders of whoever controls the Crystal Spiders.

What Jay regrets the most is that he never had the chance to grow old with Nya; And that he was breaking his promise to her.

After Nya had become human again, the two of them had promised that they would always come home from a mission, battle, etc. They would eventually make it to old age together. Not anymore.

Not to forget that they would never get to marry. The couple had planned to get married when (not if, it had never been a matter of if for them) they got out of this current world-ending catastrophe (crystrophe, get it?). Now that would never come to fruition.

In those final moments, he was infinitely more aware of his Yang Medallion that was currently hanging around his neck and tucked under his tunic. All those years ago, he had asked Nya to be his Yang when no one had been sure if they would ever make it out of that battle against the Oni.

I’m sorry Nya.

Zane has come to the same conclusion that their brothers have. They will all die here and there’s nothing that they can do about it.

hopes that Pixal does not take the news of their death too hard. This fight will not be over just because three-quarters of the ninja are dead. Pixal will still need to fight, they hope that their death won’t impair her performance too badly.

The Yang medallion in their pocket is metaphorically burning them, mocking them for their hesitation. Hesitation that they will take to the grave. They had planned to ask the samurai to be their Yang later today. It seems that will never come to pass now; There is a core-deep sadness in that.

The two of them had made plans for the future. Eventually, they would have settled down and built a child together. They had been unable to come to an agreement on the gender of this future child.

“Then we will let them decide their own gender, when the time comes,” Pixal had declared and that was that.

They hope that whoever finds the remains of their body does not rebuild them again, once is enough. They refuse to continue to live in a world where their brothers do not. And that the Yang medallion will make it into Pixal’s possession. These two thoughts are saved as audio recordings in their “black box” instead of their usual memory storage; Until now, their “black box” memory storage had been empty. They had no need to use it until now.

I am sorry, Pixal.

The one thing that Kai regrets above all else is that they never had the chance to say goodbye to Nya. That she will find their bodies buried amongst this rubble.

They remember how destructive Nya’s ‘death’ had been and that had been only one person, how much damage will four deaths cause?

After all that joking around that their recklessness would one day kill them, that they will be the first one to die; that will actually be true. There is no coming back from being crushed to death by concrete, after all.

Oh. They never got to tell Cole that they love him. They hope that it is reciprocated. <s>I can assure you, Kai, it very much is.</s> Maybe there will still be a chance on the other side of the river?

They are leaving Nya behind. They are leaving her to fight a world-ending battle by herself (<s>she won’t be alone not with Skylor and Pixal at her side</s>). They won’t be able to protect her anymore.

I’m sorry little sis. 

In hindsight, it is a twisted kind of humour. Nya had taken four seconds longer to get to the boys, to rescue them. Those four seconds, barely long enough to blink, cost the original four their lives.

Her mech touches down in the street that is riddled up and down with more of those purple crystals. In front of what once was a part of the subway system that runs under the city.

There is no sign of her brothers anywhere in the street. All that there is here is destroyed concrete and debris. Nary a scrap of brightly coloured fabric to be seen anywhere. The samurai’s heart sinks at what it implies.

Her mech’s hands haul away boulder after boulder. Chunk after chunk. Finding nothing. Then finally, she pulls away the largest piece of debris. There are four bodies underneath, of four saddengly familiar people.

Their bodies are battered, slightly pancaked by the weight of the debris, but still mostly intact. An elephant-sized weight takes residence on her chest. With the utmost care, the former ninja picks up all four of the bodies and cradles them against the torso of the mech as she takes off back towards the monastery.

As soon as she touches down in the courtyard, the bodies are carefully placed down on the courtyard’s pavement before she jumps out of the mech.

“Pix, take the mech, go into the city; we’ll talk later,” Nya tells the android. She knew that Pixal had questions even though she nods, gets in the mech and takes off. But the battle going on in New Ninjago City is far from over just yet.

Master Wu has yet to say anything; is it for the better or worse?

When she landed, he was standing a few paces away, now he is kneeling over the prone forms of four of his students. The aging teacher looks up at her as she wordlessly joins him. After all, there’s nothing that she can say that can make this better, that can take away this pain.

Four seconds wasn’t even long enough for someone to blink. But it had been long enough for her brother, boyfriend and closest friends to lose their lives.

I’m sorry I wasn’t faster.

Epilogue: When they have the time, amongst fighting the Overlord and the Crystal Council, they bury the ninja at the base of the Mountain of Impossible Height. Pixal, Skylor, Nya, Wu and their parents are all present. For the three humans (well two full humans and one part-Oni) there was no doubt in burying them. But there was for Zane, who could be rebuilt and reactivated again. That is until Pixal comes across something interesting while she was going through the remains of the Master of Ice’s body. Upon connecting Zane’s ‘Black Box’ to the computer, Pixal finds two files. Both bear the main title “Zane Julien Final Wishes”; the first one has the subtitle “Body” while the second one’s subtitle is Pixal’s name. The android clicks on the first file. It is an audio-only file that outlines Zane’s wish to not be rebuilt again, being rebuilt once already is enough. They are steadfast in their refusal to continue to live in a world where their brothers do not. That will not be a problem, neither Nya nor Pixal were planning to rebuild them. The second file informs the viewer, whether that be someone else or Pixal herself, that the Yang Medallion in Zane’s chest cavity will make it into Pixal’s possession. She listens to the file once more before she crosses the room to Zane’s body and opens their chest cavity. She does indeed find a Yang Medallion in there. When Pixal comes out to join the others in burying the ninja, the Yang Medallion is hanging around her neck. Nya notices it, of course, she does, and the two share a sad smile.

We’re sorry.

[lloydlings]

EPISODE 16 SPOILERS — dive into metaphysical implications and little things I noticed.

Ah, finally. We’ve got to the Overlord reveal, and my god the way they handled it was heartbreaking. Especially in relation to how Lloyd’s story is being handled right now.

Sam Vincent’s voice acting shines in this episode as he goes from rage, to sadness, to grief, to fear. It’s also one of the times we see this character truly break and become angry, and it’s very reminiscent of his quick angry quips in earlier seasons.

Some details I note is how touchy Harumi is, as she does not give him any personal space, proceeds to stroke his hair and lift his head, and drop it. It’s very sadistic and she follows the breaking of boundaries she’s always had, especially for him. It just makes me seethe, and honestly she needs to get what’s coming to her.

We also have Lloyd trying to regain composure and in that he’s breathing really deeply in a pattern that signals a panic attack or trauma response. Especially in that part where she corners him about the Great Devourer, and him being alone: in which he only shudders, and struggles to breathe.

Those small details only add to the tension and the uncomfortableness. And then the last bit, in which I noted Lloyd’s reaction to the Overlord.

I note that Lloyd also becomes physically aware of the Overlord’s existence in the realm once he’s able to sense it.

And with what I headcanon as Lloyd having sensory issues, especially with someone who drained his life force before, thrown him around like a ragdoll, it makes sense.

Once the Overlord breaches the Crystal, Lloyd slumps over, his eyes closed, wincing. From my point of view it kind of hints towards the fact that the ritual is also bringing HIM physical pain.

Also the fact that this being who is the literal embodiment of darkness being just feet away from a being who needs to thrive on light, this affects Lloyd more than anything. His breath hitches, and he sighs, when this happens and it’s one of fear but also pain.

And then the realization of what he fears. By now I reckon he already knows deep in his soul, or feels it within. This beacon of torment in his life, his fated, prophesied foe, being back.

The final battle was all for nothing?

He’s just alone like the how Overlord reminded him in his head, as he once drained his power.

And the fact that he brings up what Lloyd had said to him ten years ago, when he was only a child. And being helpless, he realizes, he is STILL THAT CHILD, LOST AND ALONE, HOMELESS, just like he started out in that first episode of Ninjago.

We see him not want to open his eyes, but he does, to see the Overlord just getting closer, and Lloyd looks probably the most scared we’ve ever seen him. A detail like his lip quivering/shivering gives us a lead that he is absolutely beyond terrified then.

This episode tore my heart into pieces. We see a tortured, lost, and tormented Lloyd, on the brink of helplessness all the while, the person he’s fated to destroy is back.

But he has no golden power. He thinks his friends are lost. He can feel the impact of the physical form of the Overlord on the realm. Because he’s so inertly aware.

But that’s a lot of rambling. Please tell me your thoughts in the thread or replies below.

[nedsvallesny]

How Not to Acknowledge a Data Breach

I’m not a huge fan of stories about stories, or those that explore the ins and outs of reporting a breach. But occasionally I feel obligated to publish such accounts when companies respond to a breach report in such a way that it’s crystal clear they wouldn’t know what to do with a data breach if it bit them in the nose, let alone festered unmolested in some dark corner of their operations.

And yet, here I am again writing the second story this week about a possibly serious security breach at an Indian company that provides IT support and outsourcing for a ridiculous number of major U.S. corporations (spoiler alert: the second half of this story actually contains quite a bit of news about the breach investigation).

On Monday, KrebsOnSecurity broke the news that multiple sources were reporting a cybersecurity breach at Wipro, the third-largest IT services provider in India and a major trusted vendor of IT outsourcing for U.S. companies. The story cited reports from multiple anonymous sources who said Wipro’s trusted networks and systems were being used to launch cyberattacks against the company’s customers.

Wipro asked for several days to investigate the request and formulate a public comment. Three days after I reached out, the quote I ultimately got from them didn’t acknowledge any of the concerns raised by my sources. Nor did the statement even acknowledge a security incident.

Six hours after my story ran saying Wipro was in the throes of responding to a breach, the company was quoted in an Indian daily newspaper acknowledging a phishing incident. The company’s statement claimed its sophisticated systems detected the breach internally and identified the affected employees, and that it had hired an outside digital forensics firm to investigate further.

Less than 24 hours after my story ran, Wipro executives were asked on a quarterly investor conference call to respond to my reporting. Wipro Chief Operating Officer Bhanu Ballapuram told investors that many of the details in my story were in error, and implied that the breach was limited to a few employees who got phished. The matter was characterized as handled, and other journalists on the call moved on to different topics.

At this point, I added a question to the queue on the earnings conference call and was afforded the opportunity to ask Wipro’s executives what portion(s) of my story was inaccurate. A Wipro executive then proceeded to read bits of a written statement about their response to the incident, and the company’s chief operating officer agreed to have a one-on-one call with KrebsOnSecurity to address the stated grievances about my story. Security reporter Graham Cluley was kind enough to record that bit of the call and post it on Twitter.

In the follow-up call with Wipro, Ballapuram took issue with my characterization that the breach had lasted “months,” saying it had only been a matter of weeks since employees at the company had been successfully phished by the attackers. I then asked when the company believed the phishing attacks began, and Ballapuram said he could not confirm the approximate start date of the attacks beyond “weeks.”

Ballapuram also claimed that his corporation was hit by a “zero-day” attack. Actual zero-day vulnerabilities involve somewhat infrequent and quite dangerous weaknesses in software and/or hardware that not even the maker of the product in question understands before the vulnerability is discovered and exploited by attackers for private gain.

Because zero-day flaws usually refer to software that is widely in use, it’s generally considered good form if one experiences such an attack to share any available details with the rest of the world about how the attack appears to work — in much the same way you might hope a sick patient suffering from some unknown, highly infectious disease might nonetheless choose to help doctors diagnose how the infection could have been caught and spread.

Wipro has so far ignored specific questions about the supposed zero-day, other than to say “based on our interim investigation, we have shared the relevant information of the zero-day with our AV [antivirus] provider and they have released the necessary signatures for us.”

My guess is that what Wipro means by “zero-day” is a malicious email attachment that went undetected by all commercial antivirus tools before it infected Wipro employee systems with malware.

Ballapuram added that Wipro has gathered and disseminated to affected clients a set of “indicators of compromise,” telltale clues about tactics, tools and procedures used by the bad guys that might signify an attempted or successful intrusion.

Hours after that call with Ballapuram, I heard from a major U.S. company that is partnering with Wipro (at least for now). The source said his employer opted to sever all online access to Wipro employees within days of discovering that these Wipro accounts were being used to target his company’s operations.

The source said the indicators of compromise that Wipro shared with its customers came from a Wipro customer who was targeted by the attackers, but that Wipro was sending those indicators to customers as if they were something Wipro’s security team had put together on its own.

So let’s recap Wipro’s public response so far:

-Ignore reporter’s questions for days and then pick nits in his story during a public investor conference call. -Question the stated timing of breach, but refuse to provide an alternative timeline. -Downplay the severity of the incident and characterize it as handled, even when they’ve only just hired an outside forensics firm. -Say the intruders deployed a “zero-day attack,” and then refuse to discuss details of said zero-day. -Claim the IoCs you’re sharing with affected clients were discovered by you when they weren’t.

WHAT DID THE ATTACKERS DO?

The criminals responsible for breaching Wipro appear to be after anything they can turn into cash fairly quickly. A source I spoke with at a large retailer and Wipro customer said the crooks who broke into Wipro used their access to perpetrate gift card fraud at the retailer’s stores.

I suppose that’s something of a silver lining for Wipro at least, if not also its customers: An intruder that was more focused on extracting intellectual property or other more strategic assets from Wipro’s customers probably could have gone undetected for a much longer period.

A source close to the investigation who asked not to be identified because he was not authorized to speak to the news media said the company hired by Wipro to investigate the breach dated the first phishing attacks back to March 11, when a single employee was phished.

The source said a subsequent phishing campaign between March 16 and 19 netted 22 additional Wipro employees, and that the vendor investigating the incident has so far discovered more than 100 Wipro endpoints that were seeded with ScreenConnect, a legitimate remote access tool sold by Connectwise.com. Investigators believe the intruders were using the ScreenConnect software on the hacked Wipro systems to connect remotely to Wipro client systems, which were then used to leverage further access into Wipro customer networks.

Additionally, investigators found at least one of the compromised endpoints was attacked with Mimikatz, an open source tool that can dump passwords stored in the temporary memory cache of a Microsoft Windows device.

The source also said the vendor is still discovering newly-hacked systems, suggesting that Wipro’s systems are still compromised, and that additional hacked endpoints may still be undiscovered within Wipro.

Wipro has not yet responded to follow-up requests for comment.

I’m sure there are smart, well-meaning and capable people who care about security and happen to work at Wipro, but I’m not convinced any of those individuals are employed in leadership roles at the company. Perhaps Wipro’s actions in the wake of this incident merely reflect the reality that India currently has no laws requiring data owners or processors to notify individuals in the event of a breach.

Overall, I’m willing to chalk this entire episode up to a complete lack of training in how to deal with the news media, but if I were a customer of Wipro I’d be more than a little concerned about the tone-deaf nature of the company’s response thus far.

As one follower on Twitter remarked, “openness and transparency speaks of integrity and a willingness to learn from mistakes. Doing the exact opposite smacks of something else entirely.”

In the interests of openness, here are some indicators of compromise that Wipro customers are distributing about this incident (I had to get these from one of Wipro’s partners as the company declined to share the IoCs directly with KrebsOnSecurity).

from Technology News https://krebsonsecurity.com/2019/04/how-not-to-acknowledge-a-data-breach/

[jennifersnyderca90]

How Not to Acknowledge a Data Breach

I’m not a huge fan of stories about stories, or those that explore the ins and outs of reporting a breach. But occasionally I feel obligated to publish such accounts when companies respond to a breach report in such a way that it’s crystal clear they wouldn’t know what to do with a data breach if it bit them in the nose, let alone festered unmolested in some dark corner of their operations.

And yet, here I am again writing the second story this week about a possibly serious security breach at an Indian company that provides IT support and outsourcing for a ridiculous number of major U.S. corporations (spoiler alert: the second half of this story actually contains quite a bit of news about the breach investigation).

On Monday, KrebsOnSecurity broke the news that multiple sources were reporting a cybersecurity breach at Wipro, the third-largest IT services provider in India and a major trusted vendor of IT outsourcing for U.S. companies. The story cited reports from multiple anonymous sources who said Wipro’s trusted networks and systems were being used to launch cyberattacks against the company’s customers.

Wipro asked for several days to investigate the request and formulate a public comment. Three days after I reached out, the quote I ultimately got from them didn’t acknowledge any of the concerns raised by my sources. Nor did the statement even acknowledge a security incident.

Six hours after my story ran saying Wipro was in the throes of responding to a breach, the company was quoted in an Indian daily newspaper acknowledging a phishing incident. The company’s statement claimed its sophisticated systems detected the breach internally and identified the affected employees, and that it had hired an outside digital forensics firm to investigate further.

Less than 24 hours after my story ran, Wipro executives were asked on a quarterly investor conference call to respond to my reporting. Wipro Chief Operating Officer Bhanu Ballapuram told investors that many of the details in my story were in error, and implied that the breach was limited to a few employees who got phished. The matter was characterized as handled, and other journalists on the call moved on to different topics.

At this point, I added a question to the queue on the earnings conference call and was afforded the opportunity to ask Wipro’s executives what portion(s) of my story was inaccurate. A Wipro executive then proceeded to read bits of a written statement about their response to the incident, and the company’s chief operating officer agreed to have a one-on-one call with KrebsOnSecurity to address the stated grievances about my story. Security reporter Graham Cluley was kind enough to record that bit of the call and post it on Twitter.

In the follow-up call with Wipro, Ballapuram took issue with my characterization that the breach had lasted “months,” saying it had only been a matter of weeks since employees at the company had been successfully phished by the attackers. I then asked when the company believed the phishing attacks began, and Ballapuram said he could not confirm the approximate start date of the attacks beyond “weeks.”

Ballapuram also claimed that his corporation was hit by a “zero-day” attack. Actual zero-day vulnerabilities involve somewhat infrequent and quite dangerous weaknesses in software and/or hardware that not even the maker of the product in question understands before the vulnerability is discovered and exploited by attackers for private gain.

Because zero-day flaws usually refer to software that is widely in use, it’s generally considered good form if one experiences such an attack to share any available details with the rest of the world about how the attack appears to work — in much the same way you might hope a sick patient suffering from some unknown, highly infectious disease might nonetheless choose to help doctors diagnose how the infection could have been caught and spread.

Wipro has so far ignored specific questions about the supposed zero-day, other than to say “based on our interim investigation, we have shared the relevant information of the zero-day with our AV [antivirus] provider and they have released the necessary signatures for us.”

My guess is that what Wipro means by “zero-day” is a malicious email attachment that went undetected by all commercial antivirus tools before it infected Wipro employee systems with malware.

Ballapuram added that Wipro has gathered and disseminated to affected clients a set of “indicators of compromise,” telltale clues about tactics, tools and procedures used by the bad guys that might signify an attempted or successful intrusion.

Hours after that call with Ballapuram, I heard from a major U.S. company that is partnering with Wipro (at least for now). The source said his employer opted to sever all online access to Wipro employees within days of discovering that these Wipro accounts were being used to target his company’s operations.

The source said the indicators of compromise that Wipro shared with its customers came from a Wipro customer who was targeted by the attackers, but that Wipro was sending those indicators to customers as if they were something Wipro’s security team had put together on its own.

So let’s recap Wipro’s public response so far:

-Ignore reporter’s questions for days and then pick nits in his story during a public investor conference call. -Question the stated timing of breach, but refuse to provide an alternative timeline. -Downplay the severity of the incident and characterize it as handled, even when they’ve only just hired an outside forensics firm. -Say the intruders deployed a “zero-day attack,” and then refuse to discuss details of said zero-day. -Claim the IoCs you’re sharing with affected clients were discovered by you when they weren’t.

WHAT DID THE ATTACKERS DO?

The criminals responsible for breaching Wipro appear to be after anything they can turn into cash fairly quickly. A source I spoke with at a large retailer and Wipro customer said the crooks who broke into Wipro used their access to perpetrate gift card fraud at the retailer’s stores.

I suppose that’s something of a silver lining for Wipro at least, if not also its customers: An intruder that was more focused on extracting intellectual property or other more strategic assets from Wipro’s customers probably could have gone undetected for a much longer period.

A source close to the investigation who asked not to be identified because he was not authorized to speak to the news media said the company hired by Wipro to investigate the breach dated the first phishing attacks back to March 11, when a single employee was phished.

The source said a subsequent phishing campaign between March 16 and 19 netted 22 additional Wipro employees, and that the vendor investigating the incident has so far discovered more than 100 Wipro endpoints that were seeded with ScreenConnect, a legitimate remote access tool sold by Connectwise.com. Investigators believe the intruders were using the ScreenConnect software on the hacked Wipro systems to connect remotely to Wipro client systems, which were then used to leverage further access into Wipro customer networks.

Additionally, investigators found at least one of the compromised endpoints was attacked with Mimikatz, an open source tool that can dump passwords stored in the temporary memory cache of a Microsoft Windows device.

The source also said the vendor is still discovering newly-hacked systems, suggesting that Wipro’s systems are still compromised, and that additional hacked endpoints may still be undiscovered within Wipro.

Wipro has not yet responded to follow-up requests for comment.

I’m sure there are smart, well-meaning and capable people who care about security and happen to work at Wipro, but I’m not convinced any of those individuals are employed in leadership roles at the company. Perhaps Wipro’s actions in the wake of this incident merely reflect the reality that India currently has no laws requiring data owners or processors to notify individuals in the event of a breach.

Overall, I’m willing to chalk this entire episode up to a complete lack of training in how to deal with the news media, but if I were a customer of Wipro I’d be more than a little concerned about the tone-deaf nature of the company’s response thus far.

As one follower on Twitter remarked, “openness and transparency speaks of integrity and a willingness to learn from mistakes. Doing the exact opposite smacks of something else entirely.”

In the interests of openness, here are some indicators of compromise that Wipro customers are distributing about this incident (I had to get these from one of Wipro’s partners as the company declined to share the IoCs directly with KrebsOnSecurity).

from https://krebsonsecurity.com/2019/04/how-not-to-acknowledge-a-data-breach/

[amberdscott2]

How Not to Acknowledge a Data Breach

I’m not a huge fan of stories about stories, or those that explore the ins and outs of reporting a breach. But occasionally I feel obligated to publish such accounts when companies respond to a breach report in such a way that it’s crystal clear they wouldn’t know what to do with a data breach if it bit them in the nose, let alone festered unmolested in some dark corner of their operations.

And yet, here I am again writing the second story this week about a possibly serious security breach at an Indian company that provides IT support and outsourcing for a ridiculous number of major U.S. corporations (spoiler alert: the second half of this story actually contains quite a bit of news about the breach investigation).

On Monday, KrebsOnSecurity broke the news that multiple sources were reporting a cybersecurity breach at Wipro, the third-largest IT services provider in India and a major trusted vendor of IT outsourcing for U.S. companies. The story cited reports from multiple anonymous sources who said Wipro’s trusted networks and systems were being used to launch cyberattacks against the company’s customers.

Wipro asked for several days to investigate the request and formulate a public comment. Three days after I reached out, the quote I ultimately got from them didn’t acknowledge any of the concerns raised by my sources. Nor did the statement even acknowledge a security incident.

Six hours after my story ran saying Wipro was in the throes of responding to a breach, the company was quoted in an Indian daily newspaper acknowledging a phishing incident. The company’s statement claimed its sophisticated systems detected the breach internally and identified the affected employees, and that it had hired an outside digital forensics firm to investigate further.

Less than 24 hours after my story ran, Wipro executives were asked on a quarterly investor conference call to respond to my reporting. Wipro Chief Operating Officer Bhanu Ballapuram told investors that many of the details in my story were in error, and implied that the breach was limited to a few employees who got phished. The matter was characterized as handled, and other journalists on the call moved on to different topics.

At this point, I added a question to the queue on the earnings conference call and was afforded the opportunity to ask Wipro’s executives what portion(s) of my story was inaccurate. A Wipro executive then proceeded to read bits of a written statement about their response to the incident, and the company’s chief operating officer agreed to have a one-on-one call with KrebsOnSecurity to address the stated grievances about my story. Security reporter Graham Cluley was kind enough to record that bit of the call and post it on Twitter.

In the follow-up call with Wipro, Ballapuram took issue with my characterization that the breach had lasted “months,” saying it had only been a matter of weeks since employees at the company had been successfully phished by the attackers. I then asked when the company believed the phishing attacks began, and Ballapuram said he could not confirm the approximate start date of the attacks beyond “weeks.”

Ballapuram also claimed that his corporation was hit by a “zero-day” attack. Actual zero-day vulnerabilities involve somewhat infrequent and quite dangerous weaknesses in software and/or hardware that not even the maker of the product in question understands before the vulnerability is discovered and exploited by attackers for private gain.

Because zero-day flaws usually refer to software that is widely in use, it’s generally considered good form if one experiences such an attack to share any available details with the rest of the world about how the attack appears to work — in much the same way you might hope a sick patient suffering from some unknown, highly infectious disease might nonetheless choose to help doctors diagnose how the infection could have been caught and spread.

Wipro has so far ignored specific questions about the supposed zero-day, other than to say “based on our interim investigation, we have shared the relevant information of the zero-day with our AV [antivirus] provider and they have released the necessary signatures for us.”

My guess is that what Wipro means by “zero-day” is a malicious email attachment that went undetected by all commercial antivirus tools before it infected Wipro employee systems with malware.

Ballapuram added that Wipro has gathered and disseminated to affected clients a set of “indicators of compromise,” telltale clues about tactics, tools and procedures used by the bad guys that might signify an attempted or successful intrusion.

Hours after that call with Ballapuram, I heard from a major U.S. company that is partnering with Wipro (at least for now). The source said his employer opted to sever all online access to Wipro employees within days of discovering that these Wipro accounts were being used to target his company’s operations.

The source said the indicators of compromise that Wipro shared with its customers came from a Wipro customer who was targeted by the attackers, but that Wipro was sending those indicators to customers as if they were something Wipro’s security team had put together on its own.

So let’s recap Wipro’s public response so far:

-Ignore reporter’s questions for days and then pick nits in his story during a public investor conference call. -Question the stated timing of breach, but refuse to provide an alternative timeline. -Downplay the severity of the incident and characterize it as handled, even when they’ve only just hired an outside forensics firm. -Say the intruders deployed a “zero-day attack,” and then refuse to discuss details of said zero-day. -Claim the IoCs you’re sharing with affected clients were discovered by you when they weren’t.

WHAT DID THE ATTACKERS DO?

The criminals responsible for breaching Wipro appear to be after anything they can turn into cash fairly quickly. A source I spoke with at a large retailer and Wipro customer said the crooks who broke into Wipro used their access to perpetrate gift card fraud at the retailer’s stores.

I suppose that’s something of a silver lining for Wipro at least, if not also its customers: An intruder that was more focused on extracting intellectual property or other more strategic assets from Wipro’s customers probably could have gone undetected for a much longer period.

A source close to the investigation who asked not to be identified because he was not authorized to speak to the news media said the company hired by Wipro to investigate the breach dated the first phishing attacks back to March 11, when a single employee was phished.

The source said a subsequent phishing campaign between March 16 and 19 netted 22 additional Wipro employees, and that the vendor investigating the incident has so far discovered more than 100 Wipro endpoints that were seeded with ScreenConnect, a legitimate remote access tool sold by Connectwise.com. Investigators believe the intruders were using the ScreenConnect software on the hacked Wipro systems to connect remotely to Wipro client systems, which were then used to leverage further access into Wipro customer networks.

Additionally, investigators found at least one of the compromised endpoints was attacked with Mimikatz, an open source tool that can dump passwords stored in the temporary memory cache of a Microsoft Windows device.

The source also said the vendor is still discovering newly-hacked systems, suggesting that Wipro’s systems are still compromised, and that additional hacked endpoints may still be undiscovered within Wipro.

Wipro has not yet responded to follow-up requests for comment.

I’m sure there are smart, well-meaning and capable people who care about security and happen to work at Wipro, but I’m not convinced any of those individuals are employed in leadership roles at the company. Perhaps Wipro’s actions in the wake of this incident merely reflect the reality that India currently has no laws requiring data owners or processors to notify individuals in the event of a breach.

Overall, I’m willing to chalk this entire episode up to a complete lack of training in how to deal with the news media, but if I were a customer of Wipro I’d be more than a little concerned about the tone-deaf nature of the company’s response thus far.

As one follower on Twitter remarked, “openness and transparency speaks of integrity and a willingness to learn from mistakes. Doing the exact opposite smacks of something else entirely.”

In the interests of openness, here are some indicators of compromise that Wipro customers are distributing about this incident (I had to get these from one of Wipro’s partners as the company declined to share the IoCs directly with KrebsOnSecurity).

from Amber Scott Technology News https://krebsonsecurity.com/2019/04/how-not-to-acknowledge-a-data-breach/

[terabitweb]

Original Post from Krebs on Security Author: BrianKrebs

I’m not a huge fan of stories about stories, or those that explore the ins and outs of reporting a breach. But occasionally I feel obligated to publish such accounts when companies respond to a breach report in such a way that it’s crystal clear they wouldn’t know what to do with a data breach if it bit them in the nose, let alone festered unmolested in some dark corner of their operations.

And yet, here I am again writing the second story this week about a possibly serious security breach at an Indian company that provides IT support and outsourcing for a ridiculous number of major U.S. corporations (spoiler alert: the second half of this story actually contains quite a bit of news about the breach investigation).

On Monday, KrebsOnSecurity broke the news that multiple sources were reporting a cybersecurity breach at Wipro, the third-largest IT services provider in India and a major trusted vendor of IT outsourcing for U.S. companies. The story cited reports from multiple anonymous sources who said Wipro’s trusted networks and systems were being used to launch cyberattacks against the company’s customers.

Wipro asked for several days to investigate the request and formulate a public comment. Three days after I reached out, the quote I ultimately got from them didn’t acknowledge any of the concerns raised by my sources. Nor did the statement even acknowledge a security incident.

Six hours after my story ran saying Wipro was in the throes of responding to a breach, the company was quoted in an Indian daily newspaper acknowledging a phishing incident. The company’s statement claimed its sophisticated systems detected the breach internally and identified the affected employees, and that it had hired an outside digital forensics firm to investigate further.

Less than 24 hours after my story ran, Wipro executives were asked on a quarterly investor conference call to respond to my reporting. Wipro Chief Operating Officer Bhanu Ballapuram told investors that many of the details in my story were in error, and implied that the breach was limited to a few employees who got phished. The matter was characterized as handled, and other journalists on the call moved on to different topics.

At this point, I added a question to the queue on the earnings conference call and was afforded the opportunity to ask Wipro’s executives what portion(s) of my story was inaccurate. A Wipro executive then proceeded to read bits of a written statement about their response to the incident, and the company’s chief operating officer agreed to have a one-on-one call with KrebsOnSecurity to address the stated grievances about my story. Security reporter Graham Cluley was kind enough to record that bit of the call and post it on Twitter.

In the follow-up call with Wipro, Ballapuram took issue with my characterization that the breach had lasted “months,” saying it had only been a matter of weeks since employees at the company had been successfully phished by the attackers. I then asked when the company believed the phishing attacks began, and Ballapuram said he could not confirm the approximate start date of the attacks beyond “weeks.”

Ballapuram also claimed that his corporation was hit by a “zero-day” attack. Actual zero-day vulnerabilities involve somewhat infrequent and quite dangerous weaknesses in software and/or hardware that not even the maker of the product in question understands before the vulnerability is discovered and exploited by attackers for private gain.

Because zero-day flaws usually refer to software that is widely in use, it’s generally considered good form if one experiences such an attack to share any available details with the rest of the world about how the attack appears to work — in much the same way you might hope a sick patient suffering from some unknown, highly infectious disease might nonetheless choose to help doctors diagnose how the infection could have been caught and spread.

Wipro has so far ignored specific questions about the supposed zero-day, other than to say “based on our interim investigation, we have shared the relevant information of the zero-day with our AV [antivirus] provider and they have released the necessary signatures for us.”

My guess is that what Wipro means by “zero-day” is a malicious email attachment that went undetected by all commercial antivirus tools before it infected Wipro employee systems with malware.

Ballapuram added that Wipro has gathered and disseminated to affected clients a set of “indicators of compromise,” telltale clues about tactics, tools and procedures used by the bad guys that might signify an attempted or successful intrusion.

Hours after that call with Ballapuram, I heard from a major U.S. company that is partnering with Wipro (at least for now). The source said his employer opted to sever all online access to Wipro employees within days of discovering that these Wipro accounts were being used to target his company’s operations.

The source said the indicators of compromise that Wipro shared with its customers came from a Wipro customer who was targeted by the attackers, but that Wipro was sending those indicators to customers as if they were something Wipro’s security team had put together on its own.

So let’s recap Wipro’s public response so far:

-Ignore reporter’s questions for days and then pick nits in his story during a public investor conference call. -Question the stated timing of breach, but refuse to provide an alternative timeline. -Downplay the severity of the incident and characterize it as handled, even when they’ve only just hired an outside forensics firm. -Say the intruders deployed a “zero-day attack,” and then refuse to discuss details of said zero-day. -Claim the IoCs you’re sharing with affected clients were discovered by you when they weren’t.

WHAT DID THE ATTACKERS DO?

The criminals responsible for breaching Wipro appear to be after anything they can turn into cash fairly quickly. A source I spoke with at a large retailer and Wipro customer said the crooks who broke into Wipro used their access to perpetrate gift card fraud at the retailer’s stores.

I suppose that’s something of a silver lining for Wipro at least, if not also its customers: An intruder that was more focused on extracting intellectual property or other more strategic assets from Wipro’s customers probably could have gone undetected for a much longer period.

A source close to the investigation who asked not to be identified because he was not authorized to speak to the news media said the company hired by Wipro to investigate the breach dated the first phishing attacks back to March 11, when a single employee was phished.

The source said a subsequent phishing campaign between March 16 and 19 netted 22 additional Wipro employees, and that the vendor investigating the incident has so far discovered more than 100 Wipro endpoints that were seeded with ScreenConnect, a legitimate remote access tool sold by Connectwise.com. Investigators believe the intruders were using the ScreenConnect software on the hacked Wipro systems to connect remotely to Wipro client systems, which were then used to leverage further access into Wipro customer networks.

Additionally, investigators found at least one of the compromised endpoints was attacked with Mimikatz, an open source tool that can dump passwords stored in the temporary memory cache of a Microsoft Windows device.

The source also said the vendor is still discovering newly-hacked systems, suggesting that Wipro’s systems are still compromised, and that additional hacked endpoints may still be undiscovered within Wipro.

Wipro has not yet responded to follow-up requests for comment.

I’m sure there are smart, well-meaning and capable people who care about security and happen to work at Wipro, but I’m not convinced any of those individuals are employed in leadership roles at the company. Perhaps Wipro’s actions in the wake of this incident merely reflect the reality that India currently has no laws requiring data owners or processors to notify individuals in the event of a breach.

Overall, I’m willing to chalk this entire episode up to a complete lack of training in how to deal with the news media, but if I were a customer of Wipro I’d be more than a little concerned about the tone-deaf nature of the company’s response thus far.

As one follower on Twitter remarked, “openness and transparency speaks of integrity and a willingness to learn from mistakes. Doing the exact opposite smacks of something else entirely.”

In the interests of openness, here are some indicators of compromise that Wipro customers are distributing about this incident (I had to get these from one of Wipro’s partners as the company declined to share the IoCs directly with KrebsOnSecurity).

#gallery-0-5 { margin: auto; } #gallery-0-5 .gallery-item { float: left; margin-top: 10px; text-align: center; width: 33%; } #gallery-0-5 img { border: 2px solid #cfcfcf; } #gallery-0-5 .gallery-caption { margin-left: 0; } /* see gallery_shortcode() in wp-includes/media.php */

Go to Source Author: BrianKrebs How Not to Acknowledge a Data Breach Original Post from Krebs on Security Author: BrianKrebs I’m not a huge fan of stories about stories, or those that explore the ins and outs of reporting a breach.