The Tale Of The Electoral College: The Predictive Modeling Crappers Of Tyler Are Not Having A Very Good Lead Up To The Presidential Election - "Drats, Hacked Again"

Tyler Technologies is not in a happy place at the moment, but I am having a schadenfreude moment, so it does not matter.

Now, I want to know about these databases and if there are any land patents with fancy financial instruments associated, because this is what I call some serious gerrymandering, because you know you have to have your human asset management databases up to date before you run your magical plans for the outcome of an election, at least 30 days before the election, to make sure you got your psephological, resegregationary #coloredrevolution fairy talking points polished.

NOTE TO SELF: COME UP WITH A MODERN SOOTHESAYING AI TERM FOR GERRYMANDERING & ITS DIRTY DATA CENSUS OPS

Feature Detail Report for: City of Detroit ID: 1626181 Name: City of Detroit Class: Civil (Definitions) Citation: Census County/Townships, CDP's and incorporated cities - Bureau of Census, Geography Division, coordinates are located at the centroid. If known, the year the data were compiled follows: c1994 Entry Date: 01-Sep-1995 *Elevation: 636/194 *Elevations in feet/meters from the National Elevation Dataset Federal Codes Census Code Census Class Code 22000 C5 Class Code Description: Incorporated Places. An active incorporated place that is independent of any county subdivision and serves as a county subdivision equivalent. Counties Sequence County Code State Code Country 1 Wayne 163 Michigan 26 US Coordinates (One point per USGS topographic map containing the feature, NAD83) Sequence Latitude(DEC) Longitude(DEC) Latitude(DMS) Longitude(DMS) Map Name 1 42.3833913 -83.1024125 422300N 0830609W Highland Park 2 42.4128521 -83.2662321 422446N 0831558W Redford 3 42.3588692 -83.2578599 422132N 0831528W Inkster 4 42.4115362 -82.9640495 422442N 0825751W Grosse Pointe 5 42.3519267 -83.2187500 422107N 0831308W Dearborn 6 42.3565675 -82.9690129 422124N 0825808W Belle Isle 7 42.4100816 -83.1870580 422436N 0831113W Royal Oak 8 42.3411226 -83.0719273 422028N 0830419W Detroit

Suspicious logins reported after ransomware attack on US govt contractor

Ransomware attack on Tyler Technologies is looking worse by the day.

Customers of Tyler Technologies, one of the biggest software providers for the US state and federal government, are reporting finding suspicious logins and previously unseen remote access tools (RATs) on their networks and servers.

The reports come days after Tyler Technologies admitted last week to suffering a ransomware attack.

The Texas-based company said that an intruder gained access to its internal network on the morning of Wednesday, September 23.

The intruder installed ransomware that locked access to some of the company's internal documents.

Tyler initially played down the incident

Tyler played down the incident and said that only its internal corporate network and phone systems were impacted.

Its cloud infrastructure, where the company hosts its customer-facing applications, was not impacted, the company said in a statement published on its website and via emails sent to customers last week.

But over the weekend, the situation changed as Tyler made headway investigating the incident. The company changed its statement on Saturday.

"Because we have received reports of several suspicious logins to client systems, we believe precautionary password resets should be implemented," the company said.

"If clients haven't already done so, we strongly recommend that you reset passwords on your remote network access for Tyler staff and the credentials that Tyler personnel would use to access your applications, if applicable." [emphasis Tyler's]

Customers report remote access tools on their servers

At the same, some of Tyler's customers also reported seeing new software installed on their systems.

"If you're a Tyler customer check your servers for Bomgar that they installed," wrote one of many users on Reddit over the weekend.

A similar report followed on Monday from cyber-security training outfit SANS.

"One of our readers, a Tyler Technologies's customer, reported to us that he found this morning the Bomgar client (BeyondTrust) installed on one of his servers," said Xavier Mertens, one of the SANS ISC handlers.

According to users, Tyler uses the Bomgar client to manage its servers, but some reports claim the software was not installed prior to this weekend, prompting some to panic.

While Tyler insists in its updated statement that the attack was aimed at its internal system, customers now believe attackers might have gained access to passwords for Tyler's web-hosted infrastructure that were stored on the company's local network — and attackers are now escalating access to Tyler's client networks.

While the Tyler Technologies name might not say anything to the regular American, the ransomware attack on this company's network might quietly become one of the biggest cyber-attacks of the year, if indeed attackers gained access to passwords for customer networks and the Reddit and SANS reports aren't isolated cases.

According to its website, Tyler provides more than 50 types of web-based applications to the US public sector, such as student and school management software, public transport management solutions, jail management, courts and jury management systems, cyber-security solutions, tax and billing software, fire and EMS solutions, and entire city staff management systems, known as "Munis," just to name a few.

According to Reuters, which first broke the story about the ransomware attack, some of Tyler's software is also scheduled to be used in the upcoming US presidential election — for aggregating voting results from other sources into central dashboards."

The gang behind the Tyler attack was identified as the RansomExx group.

~~~~~~~~~~~~~~~~~~

Government software provider Tyler Technologies hit by ransomware

Leading government technology services provider Tyler Technologies has suffered a ransomware attack that has disrupted its operations.

Tyler Technologies is one of the largest U.S. software development and technology services companies dedicated to the public sector.

With a forecasted $1.2 billion in revenue for 2020 and 5,500 employees, Tyler Technologies provides technical services for local governments in many states in the USA.

Starting earlier today, Tyler Technologies' website began to display a maintenance message, and their Twitter account tweeted that they were having technical difficulties.

In an email seen by BleepingComputer, Tyler Technologies CIO Matt Bieri emailed clients stating that they are investigating a cyberattack and have notified law enforcement.

"I am writing to make you aware of a security incident involving unauthorized access to our internal phone and information technology systems by an unknown third party. We are treating this matter with the highest priority and working with independent IT experts to conduct a thorough investigation and response."

"Early this morning, we became aware that an unauthorized intruder had disrupted access to some of our internal systems. Upon discovery and out of an abundance of caution, we shut down points of access to external systems and immediately began investigating and remediating the problem. We have since engaged outside IT security and forensics experts to conduct a detailed review and help us securely restore affected equipment. We are implementing enhanced monitoring systems, and we have notified law enforcement," Bieri stated in an email to clients.

Bieri also stated that current investigations indicate that the attack was limited to Tyler Technologies' local network.

In posts to the Municipal Information Systems Association of California (MISAC) forum shared with BleepingComputer, local government employees were told that Tyler Technologies suffered a ransomware attack affecting their phone ticketing system and support systems.

"We were told this morning from one of the support techs that they got hit with ransomware early this morning on their corporate networks. Don't have any other details at this point other than support is down until they access their systems," one local municipality employee posted to the MISAC forum.

Another MISAC user stated that they heard the attack was limited to Tyler Technologies' internal network and did not affect clients.

If you have first-hand information about this or other unreported cyberattacks, you can confidentially contact us on Signal at +16469613731 or on Wire at @lawrenceabrams-bc.

Tyler technologies hit by RansomExx ransomware

Cybersecurity sources familiar with the attack told BleepingComputer that Tyler Technologies suffered an attack by the RansomExx ransomware.

 

RansomExx is a rebranded version of the Defray777 ransomware and has seen increased activity since June when they attacked the Texas Department of Transportation (TxDOT), Konica Minolta, and most recently IPG Photonics.

While BleepingComputer has not obtained the ransom note, we found an encrypted file uploaded to VirusTotal today related to this attack.

This encrypted file has an extension of '.tylertech911-f1e1a2ac,' which includes Tyler Technologies' name and is the same format used in other RansomExx attacks.

RansomExx does not have a ransomware data leak site, but that does not mean they do not steal unencrypted files before deploying their ransomware.

BleepingComputer has contacted Tyler Technologies with further questions but has not received a response.

Thx to Fate112 for the tip!

Voting is beautiful, be beautiful ~ vote.©

The Tale Of The Electoral College: Tyler Technologies Is Not Havin A Very Good Week With Its Crappy Predictive Modeling Electoral College Databases

Tyler Technologies is not having a very good week.

Wanna know why?

Because, "She was hoisted by her own petard, again."

IDIOTS!

Meet the Electoral College Corporate Parent of the vote, because in order to vote, one must live in the

National Governors Association

geopolitical district, which is administrated by SOCRATA, like all the municipal property taxes, and county registry of deeds, and court records, and school records, and Medicaid fraud in child welfare records, which are used through the certification process of the vote, to generate a finding on the Electoral College votes for a POTUS.

So, that would mean if there was a situation of fake ass property taxes, fake ass foreclosures, fake ass bankruptcy, fake ass Detroit Land Bank Authority, running some fake ass public and private mortgage fraud schemes in the name of the tax exempt lord, there would definitely not be found any corruption in the chain of command of the record when it comes to the chain of command of the certification of the election, in a situation of more illegitimate certifiers, covering up all the mean things they did to my Sweetie, because something like that would just jack the entire 2016 Presidential Election Algorithm, right?

National Conference of State Legislatures

 U.S. Presidential Elections are based on the Electoral College, not the popular vote, which is why the issue is election interference.

They negotiate who wins before the vote.

But, when those wily plans go awry, we have a serious question ask ourselves"

"When will Trump stop obstructing justice and pull that IG Report from his backpocket?"

#maytheheavensfall

Tyler Technologies: Ransomware Locked Our Network, But Election Info Not At Risk

In a late Friday afternoon update to the single page of attack information that now passes for Tyler Technologies’ website, the company admitted to being hit by ransomware, but insisted customers were safe.

Tyler Technologies has copped to the ransomware attack that still has the company’s phone lines and website off line.

In an update to its online statement, Plano, Texas-based Tyler confirmed that early Sept. 23 it was hit with ransomware. It did not specify which variant was used against its network.

The company -- No. 46 on the 2019 CRN Solution Provider 500 -- is sticking by its claims that the only portion of its system that was attacked was the internal network used by Tyler Technologies employees, as well as the telephone systems.

Tyler said addressing this with clients is the company’s “highest priority.”

“We are deploying every resource at our disposal, both internal and external, to take whatever steps are needed to return to business as usual,” the company said. “We are committed to doing that in a responsible, deliberate way, and we are laser-focused on those efforts.”

Tyler said it has been in contact with the FBI “and we are cooperating with them.”

The attack on Tyler Technologies is setting off alarm bells in the security community, not just because it is yet another ransomware attack this year against a massive solution provider, but because the company’s website and phone system remains down.

Kyle Hanslovan, CEO of Huntress Labs, said solution providers that are Tyler’s size typically have network redundancies built in, meaning the phone systems and website should be restorable quickly. The fact that the site has not yet come back online, likely means Tyler does not know the extent of the intrusion.

“It’s concerning. Redundancies are hard. Redundancies are expensive, but they should be part of any company’s resiliency plan,” he said. “They could be one of these companies that is very operationally mature when it comes to sales and products, but inside their network it is a house of cards.”

A call to Tyler’s spokeswoman could not be routed through the switchboard, an operator who picked up the phone yesterday said.

“We’re still having problems with the phones,” she said. In an email, a spokesperson directed CRN to an update on the website. Tyler’s website – which was offline following the attack – has been replaced by a single-page statement about the ransomware attack, a part of which insists that none of its clients’ systems were accessed.

“Based on all of the evidence gathered to date through our around-the-clock response efforts, all information available to us continues to indicate that this incident is limited to Tyler‘s internal corporate environment and does not impact the separate environment where we host client systems,” the statement reads. “ We have disconnected points of access between Tyler’s internal systems and our client systems to further protect our clients.”

The company also said its internal payroll systems are part of a separate system and were also not hit.

However, Hanslovan said it is very difficult for the best security forensics to determine how far-reaching an attack was, even weeks afterwards. At best, those reports will only indicate “high confidence” that an attack did not spread beyond the area that it impacted.

Tyler Technologies serves 15,000 customers around the world, but focuses primarily on state and local government customers. The company offers dozens of solutions for courts, police, EMS, fire department, probation, as well as resourced to pay parking tickets and water bills.

The company bought Socrata, an advanced AI platform in 2018, which extracts information from municipal systems giving decision makers actionable datasets used in urban planning. A part of that includes data from elections departments, raising the concern that ransomware actors could be attempting to tamper with elections.

The company said the Socrata system is housed on an AWS server and has not been touched.

“Based on all of the evidence gathered to date through our around-the-clock response efforts, all information available to us continues to indicate that this incident is limited to Tyler‘s internal corporate environment and does not impact the separate environment where we host client systems. In addition, our Socrata platform is hosted offsite on AWS (Amazon Web Services), and our Tyler Federal Entellitrak and Tyler Cybersecurity platforms are maintained in entirely separate environments. There is no evidence of any impact on those environments whatsoever.

The company also insisted that none of its products are used in voting. The Socrata system reads the information that is provided.

“None of our products is a system of record for voting or any other election- or voting-related activities. Users of our open data solution may use our platform to post aggregated information about election returns, or to provide information about polling stations and campaign finance, but Tyler does not store individual voting records. Our open data solution is hosted offsite on AWS, not on Tyler‘s internal network that was impacted.”

The company also disputed some online comments that its utility bill payment systems used by cities and towns was having trouble following the outage.

“Tyler‘s Online Services and Support teams have reviewed all the logs, monitoring, traffic reports, volume reports, and cases related to utility and court payments,” the company said. “There were no outages with any of our online payment systems and payment activity has functioned normally during this time.”

Brett Callows, a threat analyst at Emsisoft, said the looming U.S. election, and the danger posed by ransomware to municipal systems, regardless of vendor, is real.

“The threat ransomware groups present cannot be overstated,” he said. “They’re using APT-level tools and techniques to successfully attack - and extract data from - courts, government agencies, companies in the Defence Industrial Base sector, financial institutions and public and private entities in multiple other sectors. These incidents could potentially be a risk to national security, economic security and, of course, election security.”

Voting is beautiful, be beautiful ~ vote.©