COI Report – Part IV
Page
111 of
425 312.
On reviewing the network logs, Benjamin noticed that there were many instances of access to the foreign IP address. All the
successful instances of access were from a single IP address, and involved
either a particular SGH user-ID, or the hostname of a SGH workstation. The IP address and hostname were in fact that of Workstation A, and the user-ID was that of the user of Workstation A. As discussed in Part III above, Workstation A played
a significant role in the Cyber Attack.
313. In the afternoon of 19 January 2018, Benjamin sent an email to the SMD, including Ernest, titled “
Hits to IOCs” (‘IOCs’ refer
to indicators of compromise, attaching the network logs. In this email, Benjamin informed his colleagues that he had arranged for scans for hits involving the malicious IPs and URLs that he was aware of at that time.
314. There was no immediate reply to Benjamin’s 19 January 2018 email. Ernest stated that he glanced at the logs when he received the email. He could see that there were multiple attempts to communicate with the foreign IP address from one or more workstations in SGH and PHI 1. However, no steps were taken by Ernest or Benjamin to (i) identify the owner of the user-ID shown in the logs
(
i.e. the user of Workstation A (ii) identify the physical location of Workstation A (iii) investigate into the
callbacks from Workstation A, including whether it was infected with malware or (iv) to block connections to the suspicious IP address from SGH or the rest of the SingHealth network. There is also no indication that there was any followup from any other members of the SMD.
315. Apart from the URL related to the foreign IP address, Benjamin’s email also mentioned another URL. Benjamin has explained that this URL was also flagged up as having been accessed by the PHI 1 Workstation, but he had inadvertently forgotten to include this URL in his subsequent reports on the matter. Although Benjamin had flagged
this other URL in his email, no further action was taken by Benjamin or Ernest to block the domain name for the
SingHealth network. This URL was in fact one of the attacker’s C servers.
