Facepalm: In an incident that highlights the dangers of running obsolete operating systems, a company that supplies high-security fencing for customers that include military bases was compromised and had sensitive data stolen after attackers used Windows 7 as an entry point.
Zaun manufactures security perimeter fencing for UK sites that include a GCHQ listening post and the Porton Down chemical weapons laboratory. "All our fencing systems can be designed and manufactured with a wide variety of security additions, including toppings and detection technology to complete your perimeter," the company states.
Zaun confirmed that its systems had been infected by the LockBit ransomware, resulting in a data breach. It stated that the attack's entry point "in an otherwise up-to-date network" was a "rogue Windows 7 PC" that runs the software for one of its manufacturing machines. It's unclear how the attacker reached the vulnerable machine.
"We are aware of an attack upon our servers by the Lockbit [sic] Ransom group at the beginning of August. Our cyber-security systems closed the attack before they could encrypt any files on the server. However, it has become apparent that LockBit was able to download some data from our system, which has now been published on the Dark Web," Zaun said in a statement.
As reported by The Register, Zaun said it does not believe any classified documents were stored on its system or have been compromised. It said that the LockBit Ransom group may have stolen 10GB of data, admitting that the attack might have reached its server beyond the Windows 7 entry point.
The company said it had notified the National Cyber Security Centre (NCSC) as well as the UK's Information Commissioner's Office (ICO) regarding the breach.
Although Zaun isn't a government-approved security contractor, it is approved for government use via the Centre for the Protection of National Infrastructure (CPNI).
Details of some of Zaun's customer site data appeared on LockBit's .onion leaks site, writes The Stack.
Released back in 2009, Windows 7's mainstream support ended in 2015, with its extended support ceasing in January 2020. Microsoft did offer extended security updates (ESUs) to business and education customers for a hefty sum, but they ended last January.
According to Statcounter, however, Windows 7 still holds a 3.5% share of the global Windows market. The operating system isn't faring as well on the Steam survey, where it's used by just 0.08% of participants. Valve is joining many other organizations by officially killing support for the Windows 7, Windows 8, and Windows 8.1 operating systems in January 2024.