singhealth

Question 1

what are the first 3 key events of the singhealth attack

Answer 1

1. • The attacker gained initial access to SingHealth’s IT network around
   23/8/17, infecting front-end workstations, most likely
   through phishing attacks.
2. Attacker then lay dormant for 4 months, before commencing lateral
   movement (6 months) in the network between Dec2017 and Jun2018, compromising many endpoints and servers, including the
   Citrix servers located in SGH, which were connected to the SCM
   database.
3. • Along the way, the attacker also compromised a large number of user
   and administrator accounts, including domain administrator accounts.

Question 2

what are the second 2 key events of the singhealth attack

Answer 2

4. Starting from May 2018, the attacker made use of compromised user
   workstations in the SingHealth IT network and suspected virtual
   machines to remotely connect to the SGH Citrix servers
5. Attacker initially tried unsuccessfully to access the SCM database
   from the SGH Citrix servers.

Question 3

what are the third 3 key events of the singhealth attack

Answer 3

6.IHiS’ IT administrators first noticed unauthorised logins to Citrix
servers & failed attempts at accessing the SCM DB on 11 June 2018.
7. Unknown to them, the attacker had obtained credentials to the SCM
database on 26 June 2018.
8. Next Day 27 June 2018, the attacker began querying the SCM
database, stealing and exfiltrating patient records, and doing so
undetected by IHiS.

Question 4

what are the fourth 3 key events of the singhealth attack

Answer 4

• 1 Week later, on 4 July 2018, an IHiS administrator for the SCM system
noticed suspicious queries being made on the SCM database.
• Working with other IT administrators, ongoing suspicious queries
were terminated, and measures were put in place to prevent further
queries to the SCM database.
• These measures proved to be successful, and the attacker could not
make any further successful queries to the database after 4 July 2018.

Question 5

what are the fifth 3 key events of the singhealth attack

Answer 5

Between 11/6 & 9/7/18, the persons who knew of & responded to
the incident were limited to IHiS’ line-staff & middle management
from various IT administration teams, & the security team.
• After 1 month, on 9/7/18, IHiS senior management were finally
informed of the Cyberattack…
• 3 days later, 10/7/18, matter was escalated to Cyber Security Agency
(“CSA”), SingHealth’s senior management, the Ministry of Health
(“MOH”), and the Ministry of Health Holdings (“MOHH”)

Question 6

what are the sixth 4 key events of the singhealth attack

Answer 6

• Starting from 10 July 2018, IHiS and CSA carried out joint
investigations and remediation.
• Several measures aimed at containing the (a) existing threat, (b)
eliminating the attacker’s footholds, and ©preventing recurrence of
the attack were implemented.
• In view of further malicious activities on 19 July 2018, internet surfing
separation was implemented for SingHealth on 20 July 2018.
• No further suspicious activity was detected after 20 July 2018.

Question 7

what are the seventh 4 key events of the singhealth attack

Answer 7

• The public announcement was made on 20 July 2018, and patient
outreach and communications commenced immediately thereafter.
SMS messages were used as the primary mode of communication, in
view of the need for quick dissemination of information on a large
scale.
• COI Committee has identified 5 key Findings!

Question 8

what was a key finding from singhealth attack

Answer 8

IHiS staff did not have adequate levels of
cybersecurity awareness, training, and
resources to appreciate the security
implications of their findings and to
respond effectively to the attack.

Question 9

what was another 1 key finding from singhealth attack

Answer 9

Certain IHiS staff holding key roles in IT
security incident response and reporting
failed to take appropriate, effective, or
timely action, resulting in missed
opportunities to prevent the stealing and
exfiltrating of data in the attack

Question 10

what was another 2 key finding from singhealth attack

Answer 10

There were a number of vulnerabilities,
weaknesses, and misconfigurations in the
SingHealth network and SCM system that
contributed to the attacker’s success in
obtaining and exfiltrating the data, many of
which could have been remedied before the
attack

Question 11

what was another 3 key finding from singhealth attack

Answer 11

The attacker was a skilled and
sophisticated actor bearing the
characteristics of an Advanced
Persistent Threat group

Question 12

what was another 4 key finding from singhealth attack

Answer 12

While our cyber defences will never be
impregnable, and it may be difficult to
prevent an Advanced Persistent Threat from
breaching the perimeter of the network, the
success of the attacker in obtaining and
exfiltrating the data was not inevitable

Question 13

what did the attack exploit to make queries to the database

Answer 13

1. A significant vulnerability was the network connectivity (referred to
   in these proceedings as an “open network connection”) between the
   SGH Citrix servers and the SCM database

Question 14

What was the network connectivity maintained for

Answer 14

r the use of

administrative tools and custom applications,

Question 15

was it necessary to maintain the network connectivity for administrative tools and custom apps?

Answer 15

no

Question 16

Describe the security of the SGH Citrix servers

Answer 16

not adequately secured against unauthorised access.

Question 17

Describe the 2fa in the sgh citrix servers

Answer 17

it was not enforced as the exclusive means of loggin in as an admin.

Question 18

Describe the 2fa in the sgh citrix servers fucked us all

Answer 18

it was not enforced as the exclusive means of loggin in as an admin, therefore the attacker gained entry to server through other routes that did not require 2fa

Question 19

How did the hacker access the SCM database

Answer 19

There was a coding vulnerability in the SCM application which was
likely exploited by the attacker to obtain credentials for accessing the SCM database.

Question 20

What did a penetration test identify in the network and when,

Answer 20

There were a number of other vulnerabilities in the network which
were identified in a penetration test in early 2017

Question 21

What was another thing exploited by the hacker

Answer 21

There were a number of other vulnerabilities in the network which
were identified in a penetration test in early 2017, and which may have
been exploited by the attacker.

Question 22

Describe 2 things exploited by the hacker

Answer 22

These included weak administrator account passwords and the need
to improve network segregation for administrative access to critical servers such as the domain controller and the Citrix servers

Question 23

Described the remeditation process undertaken by IHIS

Answer 23

Unfortunately, the remediation process undertaken by IHiS was
mismanaged and inadequate, and a number of vulnerabilities
remained at the time of the Cyber Attack.

Question 24

Describe the Modus Operandi of the attacker

Answer 24

The attacker had a clear goal in mind, namely the personal and
outpatient medication data of PM in the main, and other patients.

Question 25

What was the weapon of choice of hacker

Answer 25

The attacker employed advanced TTPs (tools/tactics, techniques,
procedures), as seen from the suite of advanced, customised, and
stealthy malware used, generally stealthy movements, and its
ability to find and exploit various vulnerabilities in SingHealth’s IT
network and the SCM application.

Question 26

Describe the work ethic of the attacker

Answer 26

. The attacker was persistent, having established multiple footholds
and backdoors, carried out its attack over a period of over 10 months,
and made multiple attempts at accessing the SCM database using
various methods.

Question 27

Describe the vibe of the attacker

Answer 27

The attacker was a well-resourced group, having an extensive
command and control network, the capability to develop numerous
customised tools, and a wide range of technical expertise.

Question 28

How could we have defended better against the attacker

Answer 28

1. A number of vulnerabilities, weaknesses, and misconfigurations
   could have been remedied before the attack. Doing so would have
   made it more difficult for the attacker to achieve its objectives.
2. The attacker was stealthy but not silent, and signs of the attack
   were observed by IHiS’ staff. Had IHiS’ staff been able to recognise
   that an attack was ongoing and take appropriate action, the
   attacker could have been stopped before it achieved its objectives.

Question 29

Who was the 7 step cyber kill chain framework invented by

Answer 29

lockheed martin

Question 30

what is the 7 step kill chain framework

Answer 30

which identifies what adversaries must complete in order to

achieve their objectives, going through 7 stages starting

Question 31

what are the steps in the 7 step kill chain framework

Answer 31

1. recce
2. weaponisation
3. delivery
4. exploitation.
5. installation
6. command and control
7. actions on objectives

Question 32

What was the first evidence of breach and establishing control over Workstation A and when was this

Answer 32

August to December 2017
• Forensic investigations uncovered signs of callbacks to
an overseas command & control server (“C2 server”)
from 23 August 2017.
• Callbacks refer to communications between malware
and C2 servers, to either fetch updates and
instructions, or send back stolen information.

Question 33

CSA discovered many malicious artefacts in Workstation A, including ________

Answer 33

(i) a log file which was a remnant of a malware set;
• (ii) a publicly available hacking tool,
• (iii) a customised Remote Access Trojan referred to as “RAT 1”.
• (i) The log file was a remnant file from a known malware which has password
dumping capability;
• (iii) RAT 1 provided the attacker with the capability to access and control the
workstation, enabling the attacker to perform functions such as executing
shell scripts remotely, and uploading and downloading files.

Question 34

Describe the publicly available hacking tool that CSA discovered in aug to dec 2017

Answer 34

(ii) The publicly available hacking tool enables an attacker to maintain
a persistent presence once an email account has been breached, even
if the password to the account is subsequently changed.
• Hacking tool also allows an attacker to
• interact remotely with mail exchange servers,
• perform simple brute force attacks on the user’s email account password,
• and serve as a hidden backdoor for the attacker to regain entry into the
system in the event that the initial implants are removed;

Question 35

What was inside the log file created on workstation a on 29 aug 2017

Answer 35

The log file was created on Workstation A on 29 August 2017. The file
contained password credentials in plaintext, which appeared to
belong to the user of Workstation A.
The malware was likely to have been used by the attacker to obtain
passwords for privilege escalation and lateral movement.

Question 36

When was the public hacking tool installed on workstation A, and what did it exploite

Answer 36

Public hacking tool was installed on Workstation A on 1 Dec 2017 by
exploiting a vulnerability in the version “Outlook” that was installed on the
workstation.

Question 37

A vulnerability in Outlook installed in workstation A fucked us by revealing the password, elaborate more on this

Answer 37

• Although a patch was available at that time, but the patch was not installed
on Workstation A then.
• The tool was thus successfully installed and was used to download
malicious files onto Workstation A.
• Some of these files were masqueraded as .jpg image files, but in fact
contained malicious PowerShell scripts, one of which is thought to be a
modified PowerShell script taken from an open source post-exploitation
tool.

Question 38

rec 1

Answer 38

it security risk assessments and audit process must be treated seriously and carried out regularly

Question 39

rec 2

Answer 39

enhanced safeguards must be put in place to protect electronic medical records

Question 40

rec 3

Answer 40

domain controller must be better secured against attack

Question 41

rec 4

Answer 41

a robust patch management process must be implemented to address security vulnerabilites

Question 42

rec 5

Answer 42

a software upgrade policy with focus on security must be implemented to increase cuber resilience

Question 43

rec 6

Answer 43

an internet access strategy that minimises exposure to external threats should be implemented

Question 44

rec 7

Answer 44

incident response plans must more clearly state when and how a security incident is to be reported

Question 45

rec 8

Answer 45

competence of computer secuity incident reponse personnel must be significantly improved

Question 46

rec 9

Answer 46

a post breach independant forensic review of the network, all endpoints and the SCM system should be considered