Las Vegas ransomware incident highlights need for cybervigilance

A ransomware incident at two of Las Vegas's largest casinos made national headlines last month and raised a lot of questions about ransomware, multi-factor authentication, single sign-on, access management, and vishing.

What happened

At the beginning of September, systems at Caesars Entertainment and MGM Resorts were infected with ransomware, degrading each organization's ability to manage its casinos and hotels. Caesars reportedly paid $15 million to get its systems back online. MGM did not pay the ransom and weathered a disruption to its business across the United States for at least ten days.

Subsequent reporting confirmed that in both cases the single sign-on access management system from Okta was compromised through vishing and used as the access point for the attack, despite the fact that protections like multi-factor authentication were in place.

Cut through the jargon

• Ransomware — code that can traverse a computer's or server's file system and encrypt any data it comes across. Once encrypted, files and applications are inaccessible. Hackers then demand a ransom payment to hand over the key that decrypts the files. Even when an organization has complete, unaffected backups and chooses not to pay, restoring a full system can be extremely time-consuming, disruptive, and expensive.
• Access management — the set of tools and processes that authenticate user credentials and provide access to file storage, applications, online services, and other systems.
• Single sign-on (SSO) — an access management service that provides authentication for multiple systems from a single set of credentials. (Okta is one such service.)
• Multi-factor authentication (MFA) — a verification step in addition to a password that's needed for user authentication. Often this is a 6-digit code texted to your mobile device, a separate app that generates one-time codes valid for only 30 seconds, or a push app that offers a Yes / No choice when logging in.
• Vishing — voice plus phishing: an attempt by phone to fool someone into compromising their own account or the security of a system they manage.

A little more detail

Both MGM and Caesars appear to have been prepared to protect their organizational data from hackers. Access management systems were in place, MFA was enforced, SSO had consolidated access management under one umbrella, and Okta is one of SSO's industry leaders.

So what went wrong?

What happened is described in this blog post from Okta's Defensive Cyber Operations team, published even before the news was reported. The hack was apparently not a code or system vulnerability in Okta or its version of MFA. Instead, someone called MGM's IT support pretending to be an MGM employee with high-level Okta admin permissions. This caller claimed to be accidentally locked out of the account and asked for the MFA to be reset. Once that request was granted, the hacker could gain access to Okta, and from there could wreak real havoc. The same sequence was repeated at Caesars and, according to Okta, at other organizations.

That's the very short version, and there are still a lot of unanswered questions about exactly how the breach was carried out. But a key takeaway is what the critical vulnerability was not:

• It was not an app with a bug that created a security loophole.
• It was not a compromised firewall.
• It was not a system secured with low-value passwords.
• It was not a system with MFA disabled or optional.

So what was the point of failure? Someone at the help desk who was trying to be helpful.

What it really means

Cybersecurity is layered, and just because a single layer failed doesn't mean the other layers aren't still a very good idea.

• Strong, unique passwords help ensure that a breach of your password in one system doesn't invite breaches elsewhere.
• MFA is valuable in protecting your account when your password is already known by someone else.
• SSO identity providers can close gaps across multiple services by directing all authentication through a central system with properly configured guardrails.
• Policies that prioritize "zero trust" encourage appropriate skepticism about every request related to cybersecurity.

Social engineering is often the weak link in a well-layered cybersecurity policy. Hackers might not even need sophisticated tools to gather enough publicly available personal information about a user to make a successful vishing attack.

It's not that the layers aren't important. It's that every layer is important.

How we can help

Macktez manages password reset requests for many clients, both for individual applications and for SSO identity management. We take that responsibility seriously, and while we always want to be helpful, we will leave requests unresolved until we can verify their legitimacy.

We do not trust incoming calls for MFA reset requests even when the caller ID is correct. We will call users back at a phone number we have on record, or reach out to our primary client contact to confirm a verified contact method for the person making the request.

We will continue to monitor events as reported and adjust our own workflow as needed to provide our clients with the most secure service possible.

We also provide cybersecurity awareness training and dark web monitoring to protect against phishing attempts that reach our clients directly. We provide domain management to protect the health and reputation of your own domain. And we can conduct a NIST-based cybersecurity assessment to evaluate an organization's risk profile and make recommendations as needed.

Get in touch if you have any other questions.