Table of contents exchange of letters with the minister executive summary

Download 5.91 Mb.

View original pdf

Page	164/329
Date	27.11.2023
Size	5.91 Mb.
	#62728

1 ... 160 161 162 163 164 165 166 167 ... 329

Report of the COI into the Cyber Attack on SingHealth 10 Jan 2019

COI Report – Part VPage 194 of 425

COI Report – Part V
Page 193 of 425

where it would be able to access any service in the system without the need fora user-ID or password.
612. The KRBTGT account stores two of the most recent passwords in its password history. Resetting the KRBTGT account password twice in succession will invalidate any ticket granting ticket that an attacker might have accessed. Thus, as a precautionary measure, CSA recommended, on 10 July 2018, that IHiS perform a reset of the KRBTGT account twice in succession to invalidate the
Kerberos tickets, which could have been stolen or forged by the attacker. IHiS checked with Microsoft, which confirmed that the recommended practice was to perform the second reset 12 hours after the first.
613. IHiS performed the first reset at pm on 11 July 2018, and the second reset at am on 12 July 2018.
32.3.2
Changing of passwords across all healthcare clusters
614. On the assumption that the domain administrator account had been compromised, IHiS forced password changes at two levels to further ensure that the attacker would not be able to reuse any user’s existing password to breach the network a) The first level was a forced password change for all the domain users at the next point of Windows login. The instruction was sent out on 12 July 2018, and the IHiS active directories team triggered a password reset for all SingHealth users at pm on 13 July
2018. All users would be prompted to set anew password when they next logged in. Users that were already logged in would be prompted to change their passwords, once their machines were rebooted or entered screensaver mode. Users who failed to reset their passwords by 20 July 2018 would have had their accounts disabled. IHiS also applied the same precautionary measure to the other two healthcare clusters, NHG and NUHS.

COI Report – Part V
Page 194 of 425

(b) The second level was scheduling changes to the passwords of all the privileged and database application IDs, and host IDs, which was completed by 19 July 2018.
32.3.3
Cleaning-up of network-based IOCs, instituting of firewall rules, and
reloading of Citrix servers
615. IOCs (indicators of compromise) discovered by CSA in the course of their forensics and malware analyses were incorporated into IHiS’ corporate antivirus system from 17 July 2018. From 13 July 2018, the IHiS network team also created firewall rules to block off malicious callbacks to the C servers identified by the CSA analyst team.
CSA also shared the identified IOCs with the other CII Sector Leads for dissemination to their CII owners, so that they could scan for similar infections.
616. Upon discovery that the SGH Citrix server had been used by the attacker to access the SCM database, the IHiS network team added firewall rules to block access from the SGH Citrix servers to the SCM database on 11 July 2018.
617. However, as it was not possible to ascertain through detailed forensic examination whether each Citrix server was compromised (nearly a thousand such servers were running in the HDC), IHiS set out to reload each of the Citrix servers in the HDC Citrix server farm with a clean image on 14 and 15 July 2018. This ensured that no compromised Citrix server was left running after the clean images were reloaded. All Citrix servers were fully refreshed by 16 July 2018.
32.3.4
Disabling of PowerShell on endpoints
618. After learning from CSA that the attacker had made use of PowerShell malware in the attack, IHiS disabled PowerShell on 13 July 2018 on all end-user machines.

Download 5.91 Mb.

Share with your friends:

1 ... 160 161 162 163 164 165 166 167 ... 329