The “sophisticated state-based” cyber-attack Australian prime minister Scott Morrison has warned about is not particularly sophisticated, according to experts, but serves as a wake-up call for businesses to keep their systems patched and secure, and to remain alert.
On Friday morning, Morrison announced Australian government agencies and businesses had been targeted by a “sophisticated state-based cyber actor”.
“This activity is targeting Australian organisations across a range of sectors, including all levels of government, industry, political organisations, education, health, essential service providers and operators of other critical infrastructure,” he said. “We know it is a sophisticated state-based cyber actor because of the scale and nature of the targeting and the tradecraft used.”
Plan for massive facial recognition database sparks privacy concerns
According to the threat advisory released by the Australian Cyber Security Centre, the so-called copy-paste compromises are nothing new – exploiting vulnerabilities in Telerik UI and several other services like Sharepoint, Microsoft Internet Information Services and Citrix where those businesses and departments had failed to patch to prevent the vulnerability being exploited.
When those have not been successful, the state actor has shifted to traditional spearphishing methods to attempt to extract login information from a person inside an organisation or government department.
“[The state actor campaign] doesn’t look very sophisticated,” UNSW professor of cybersecurity Richard Buckland said. “It’s well-resourced in a large scale but I haven’t seen anything yet that’s super secret or super sinister. They’re using known techniques against known vulnerabilities and following known processes.”
The advice from government in how to respond is basic cyber hygiene: patch software, use two-factor authentication, and implement the ACSC’s essential eight to mitigate attacks.
Morrison said the announcement wasn’t being made due to any significant attack or event, and that no large personal data breach had happened yet, leading to questions about why the prime minister had decided to make a formal announcement on a Friday morning from the Blue Room in Parliament House, particularly given the ACSC has been warning about some of the vulnerabilities for more than a year.
“I think what happened was it reached a point when the government decided enough was enough,” RMIT cyber security professor Matthew Warren said.
“It’s very simple advice but when you have government departments and organisations not patching their systems … when you look at it on an all of Australia perspective, you just need one weak link in the Australian ecosystem and then it has a potential flow-on effect.”
Buckland said he was pleased the prime minister made the announcement. He compared it to the government’s messaging around Covid-19 and needing to change behaviour around hand-washing and physical distancing.
Alerting people to the ongoing cyber-attacks might help them take it more seriously, he said.
“I am pleased that he made this announcement because I hope it leads to a shift [and] will contribute to a shift in how seriously people take cybersecurity and the importance to gain cybersecurity knowledge training, and capability in their organisations.”
Rory Medcalf, head of the Australian National University’s national security college, said the government was firing a warning shot to China – even though China was specifically not named. He said the government was not being overly provocative, even if China might interpret it that way.
“I think it is carefully measured; it is not as provocative as some people will claim it to be,” he said. “It’s a kind of a warning shot to say ‘we know this is happening, we know it’s a state actor, we’re not naming who it is at this stage’. But, if this continues, we will become increasingly frank in calling it out.”
Medcalf said there could be a future scenario where Australia and a number of other countries put out a joint statement about the activity, which would name China as the source.
The other factor behind the announcement, Medcalf said, was the government being pressured by Labor to release its four-year cybersecurity strategy.
The previous strategy expired two months ago and, in parliament earlier this week, Labor’s spokesman on cybersecurity issues, Tim Watt, accused the home affairs minister, Peter Dutton, of leaving cybersecurity “at the bottom of his in-tray”.
“It’s been 10 months since the Morrison government began consultations on the new cybersecurity strategy,” Watts said. “Given how quickly things change in cybersecurity, a virtual millennia in hacker years has passed without action … We can’t afford to respond to a crisis only after it’s happened.”
Medcalf said Morrison’s announcement was “also a signal to say that that strategy is coming and here is a kind of a foretaste of what that’s going to be”.