1.0 Introduction
The National Security Council (MKN) had recently released a media statement to highlight the video released by Anonymous Malaysia on their plan to launch a cyberattack operation against government websites and online assets called #OpsWakeUp21. Meanwhile, MyCERT also received several incidents targeting Malaysian websites, such as Web Defacement and Distributed Denial of Services (DDOS) attacks. As a preventive measure, MyCERT releases this alert to advise System Administrators to take necessary steps to secure their systems against unwanted incidents as well from other security threats.
2.0 Recommendations
Listed below are recommendations for System Administrators as preventive measures and mitigation steps against these attacks:
1. Organizations are recommended to apply defense in depth strategy in protecting their networks. Firewalls, intrusion prevention systems (IPS), network and host based intrusion detection systems (IDS) can prevent and log most of the generic attacks. Make sure systems, applications and third party add-ons are updated with latest upgrades and security patches.
2. If you're running older versions of operating systems or software, make sure they are upgraded to the latest versions as older versions may have some vulnerability that can be manipulated by intruders. Aside from that, please make sure that your web based applications and network based appliances are patched accordingly.
You may refer to your respective vendors' websites for the latest patches, service packs and upgrades. You may also refer to MyCERT's website for information on the latest patches, service packs and upgrades by referring to our latest advisories at:
https://www.mycert.org.my/portal/advisories?id=431fab9c-d24c-4a27-ba93-e92edafdefa5&year=2020&ctype=&keyword=
3. If you do not prepare for a DDoS incident in advance, contact your ISP to understand the DDoS mitigation it offers and what process you should follow. If the risk of a DDoS attack is high, consider purchasing specialized DDoS mitigation products or services.
4. Harden the configuration of network, OS, and application components that may be targeted by DDoS. Whitelisting and blacklisting IP address during DDOS is very useful to mitigate the attack to certain extend.
5. Make sure Anti-virus software that are running on hosts and email gateways are updated with the latest signature files and are enabled to scan all files.
6. Make sure that your systems are configured properly in order to avoid incidents such as information disclosure, directory listing that are caused by system misconfiguration.
7. Make sure loggings of systems and servers are always enabled. System Administrators are advised to read and monitor the logs on daily basis.
8. Perform regular backups of all critical information to limit the impact of data or system loss and to help expedite the recovery process. Ideally, the backup must be done daily, on a separate media and stored offline at an alternate site.
9. Organizations are recommended to regularly conduct vulnerability assessment and penetration testing on their systems.
10. Report security incidents to relevant authorities or to CERTs/CSIRTs in your constituency for immediate remediation and mitigations.
Generally, MyCERT advises system administrators and internet users in Malaysia to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my
Phone: 1-300-88-2999 (monitored during business hours)
Fax: +603 - 8008 7000 (Office Hours)
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours: Mon - Fri 09:00 -18:00 MYT
Web: https://www.mycert.org.my
Twitter: https://twitter.com/mycert
Facebook: https://www.facebook.com/mycert.org.my
3.0 References
https://twitter.com/MKNJPM/status/1353968772898385920
https://technave.com/gadget/Anonymous-Malaysia-returns-with-a-new-video-as-a-warning-to-the-Malaysia-government-23009.html
https://www.malaymail.com/news/malaysia/2021/01/25/hacktivist-group-anonymous-malaysia-resurfaces-vows-cyber-attack-against-go/1943943
https://www.lowyat.net/2021/231126/anonymous-malaysia-video-against-government-again/