Zenith Stock Exchange Data Breach: A Comprehensive Malware Case Study

This case study examines a ransomware attack on the Zenith Stock Exchange, where hackers gained control of vital data and demanded a US$25 million ransom in Bitcoin. The attack originated from a phishing email targeting the head of security, leading to system-wide lockdown. The organization paid the ransom, and a subsequent data audit confirmed data integrity. The report outlines preventative measures, including installing antivirus software and firewalls, enhancing staff security awareness, creating data backups, patching systems, implementing GPO restrictions, enforcing admin rights and access controls, preventing data leakage, installing plugins and whitelists, and employing unified threat management on edge devices. These measures aim to strengthen the exchange's defenses against future attacks by addressing vulnerabilities and improving overall system security. Desklib offers a variety of resources, including solved assignments and study tools, to aid students in understanding complex topics like cybersecurity.

MALWARE ATTACK REPORT
CASE STUDY: ZENITH STOCK EXCHANGE

HOW IT HAPPENED
• ON 31ST JANUARY, ZENITH WOKE UP TO A MALWARE (SPECIFICALLY RANSOMWARE) ATTACK.
THE HACKERS WERE IN POSSESSION OF THE ENTIRE DATA LOAD OF THE STOCK EXCHANGE
DATA. THE DATA THEY HAD GOT HOLD OF WAS VERY VITAL AND COULD BE VERY DAMAGING
TO THE ORGANIZATION. IN THEIR RANSOM DEMAND THE HACKER GROUP WANTED AN
EQUIVALENT OF US$25M IN BITCOIN. THE ORGANIZATION HAD NOTHING TO DO BUT TO GIVE
IN TO THE DEMANDS OF THE HACKER GROUP. THE HACKER GROUP KEPT THEIR WORD AND
RESTORED ACCESS TO THE DATA. THE DATA AUDITORS HAVE SINCE CONFIRMED THAT
EVERYTHING IS INTACT AND WE, THE DATA SECURITY TEAM HAVE STEPPED IN AND
MITIGATED THE DAMAGE DONE. THE PRESENTATION IS AN EXPLANATION AND PREEMPTION
ON WHAT MEASURES ARE NEEDED TO AVOID THIS KIND OF ATTACK IN THE FUTURE.

POINT OF ENTRY
BASED ON FINDINGS BY THE TEAM, THE MALWARE FOUND ITS WAY INTO OUR
SYSTEM THROUGH ONE OF THE MOST COMMON MALWARE DELIVERY SYSTEMS.
THE HACKER GROUP SENT OUR HEAD OF SECURITY AN ALERT THAT SEEMED
TO BE FROM A GENUINE EMAIL ADDRESS. HE OPENED THE EMAIL AND THE
MALWARE STARTED PROPAGATING INTO THE SYSTEM. AFTER A FEW DAYS, THE
MALWARE WHICH WAS CONFIGURED AS A RANSOMWARE HAD TAKEN CONTROL
OF THE SYSTEM BY MIMICKING THE SYSTEM ADMIN PASSWORDS. THE ENTIRE
SYSTEM WENT ON A LOCKDOWN AND THE RANSOM MESSAGE REMAINED ON
THE SCREENS UNTIL THE ORGANIZATION CAME TO AN AGREEMENT WITH THE
HACKER GROUP.

TABULAR RISK ASSESSMENT

MEASURES TO BE TAKEN IN PREVENTION OF
FURTHER ATTACKS
• INSTALLING ANTIVIRUS AND FIREWALLS
• ENHANCING STAFF AWARENESS ON SYSTEM SECURITY
• CREATING DATA BACKUPS
• PATCHING
• GPO RESTRICTIONS
• ADMIN RIGHTS AND ACCESS CONTROLS
• DATA LEAKAGE PREVENTION
• INSTALLING PLUGINS AND WHITELISTS
• UNIFIED THREAT MANAGEMENT ON EDGE DEVICES

INSTALLING ANTIVIRUS AND FIREWALLS
• THE FIRST AND MOST EFFECTIVE WAYS IN AVOIDING AND PROTECTING AN
ORGANIZATION IS BY INSTALLING AN ANTIVIRUS AND A FIREWALL. THE TWO
ARE VERY IMPORTANT BECAUSE THEY ARE VERY IMPORTANT IN ENSURING
THAT THERE IS CONTROL IN WHAT GETS INTO A NETWORK SYSTEM OF THE
ORGANIZATION. FIREWALLS AND THE ANTIVIRUS ARE BASED ON
SIGNATURES.

ENHANCING STAFF AWARENESS ON SYSTEM
SECURITY
• THE ORGANIZATION MUST INVOLVE THE STAFF MEMBERS IN A FORM OF
SECURITY AWARENESS TRAINING THAT WORKS TOWARDS GIVING THEM
VITAL INFORMATION ON WAYS OF AVOIDING RANSOMWARE ATTACKS. HERE,
THE ORGANIZATION WILL WARN THE EMPLOYEES AGAINST OPENING LINKS,
ATTACHMENTS OR VISITING SITES THAT ARE PROHIBITED BY THE FIREWALLS
INSTALLED. THE EMPLOYEES ARE SUPPOSED TO BE CONSTANTLY REMINDED
THAT THEY ARE THE FIRST LINE OF DEFENSE BECAUSE RANSOMWARE
ATTACKS ARE MOSTLY BASED ON SOCIAL ENGINEERING OTHER THAN
NETWORK BASED REPLICATION ().

CREATING DATA BACKUPS
• THE OTHER VERY EFFECTIVE APPROACH AGAINST RANSOMWARE ATTACKS IS
HAVING A VERY EFFECTIVE AND RELIABLE DATA BACKUP PLAN. AS INDICATED
IN THE PRESENTATION, DATA BACKUP MAKES THE DATA STOLEN AND PUT UP
FOR RANSOM USELESS TO THE PERPETRATORS. THE VALUE OF DATA THAT IS
ONLY STORED IN ONE STORAGE POINT IS VERY HIGH. NONETHELESS, IF THE
PERPETRATORS FIND THAT THEY ARE HOLDING RANSOM DATA THAT IS OF NO
USE TO THE ORGANIZATION BECAUSE THE ORGANIZATION HAS A DATA
BACKUP THAT HAS SIMILAR DATA THEN THAT IS NOT VERY DAMAGING.

PATCHING
• KEEPING ALL COMPUTERS AND ALL NETWORK END DEVICES UPDATED WITH
THE LATEST PATCHES WILL ENSURE THAT THE HACKERS DO NOT HAVE ANY
LOOPHOLES AND VULNERABILITIES TO EXPLOIT BECAUSE THOSE ARE WEAK
POINTS OF ANY SYSTEM. THE HACKERS CAN EASILY BE KEPT SEALED OFF
FROM THE ZENITH SYSTEM IF THESE WEAK POINTS ARE WELL COVERED.

GPO RESTRICTIONS
• GROUP POLICY OBJECTS ARE SPECIFIC RULES THAT DEFINE HOW EACH AND
EVERY MEMBER OF THE GROUP INTERACTS WITH THE SYSTEM AND HOW
MUCH THEY CAN ACCESS. THEREFORE THE GPO RESTRICTIONS ON THE
ZENITH COMPUTER SYSTEM MUST BE SET IN A WAY THAT MAKES I
IMPOSSIBLE FOR A USER WITH MINIMAL PRIVILEGES ON A SYSTEM TO MAKE
AN ERROR THAT BRINGS DOWN THE ENTIRE SYSTEM.

ADMIN RIGHTS AND ACCESS CONTROLS
THE OTHER MOST IMPORTANT FEATURE ON AN INFORMATION SYSTEM IS THE
ADMIN RIGHTS AND THE ACCESS CONTROLS. THE ADMIN RIGHTS GIVE
CERTAIN PERSONS MORE ACCESS AND SUPERIOR PRIVILEGES TO THE SYSTEM
AND ACCESS CONTROLS RESTRICT THE AMOUNT OF DATA THAT ANY PERSON
ON THE SYSTEM GETS (RUJ, STOJMENOVIC AND NAYAK, 2014). ZENITH WILL
NEED SOME VERY STRONG AND EFFECTIVE ADMIN RIGHTS AND ACCESS
CONTROLS TO ENSURE THAT NOBODY GETS ACCESS AND PRIVILEGE IN THE
SYSTEM UNLESS IT IS ABSOLUTELY NECESSARY AND THEY HAVE AN
UNDERSTATING OF THE CONSEQUENCES THAT MAY ARISE IN CASE OF A
SYSTEM BREACH.

DATA LEAKAGE PREVENTION
ALL ORGANIZATIONS MUST HAVE A POLICY THAT AIMS AT KEEPING DATA WITH
THE BOUNDARIES OF THE ORGANIZATION. AT ZENITH, EVERY STAFF MEMBER
MUST MAKE SURE THAT THEY ARE VERY CAREFUL WHEN THEY SHARE OR
RECEIVE DATA. IN THE EMPLOYEE AWARENESS TRAINING, IT SHOULD
CONSTANTLY COMMUNICATED THAT EACH AND EVERY PERSON MUST MAKE
SURE THAT THE DATA THEY SHARE OR RECEIVE MUST KEPT CROSSCHECKED.
THAT WAY, DATA LEAKAGES WILL BE PREVENTED IN THE FUTURE.