Author Archives: Cheryl Biswas

Unknown's avatar

About Cheryl Biswas

Writer, reader, techie, Trekkie. InfoSec and political analyst. Keeping our world safe one byte at a time.

Weekly Security Brief: May 20 2015

Posted on by
Reply

secmat1

Welcome! When the best offense is a good defense, you’ve come to the right place. Given the ever-changing landscape of technology threats, that couldn’t be more true. Each week, we’ll cover current security threats, patches and issues that affect you and your business. And when something really big happens, we’ll post on Twitter and update this page with all the details you need to stay safe. Read on!

Venom

We’ve had some big security issues over the past year. But Venom isn’t going to be one of them, despite the name. Sometimes, it’s easy to get carried away by the hype and hyperbole. If we’re doing our job right, though, rather than scaring you we’re preparing you.
This latest vulnerability, classified as CVE-2015-3456, is a problem in the floppy drive emulation code found on many virtualization platforms. What that means is if an attacker were able to, by considerable effort, escape the Guest OS, they could use the host to launch other network attacks. Essentially, an administrator account would have to be compromised for this to happen. Only certain platforms are impacted and they have patches currently available. Major VMs that are not impacted include:

  • VMware
  • Microsoft Hyper-V
  • Bochs
  • AWS
  • Linode

Rombertik Malware

It’s elusive, evasive, and the next evolution of malware. Newly identified by Cisco researchers, “Rombertik” doesn’t just self-destruct when it finds tools that can detect it. Instead, if tries to destroy the Master Boot Record (MBR) of the machine it’s on, which is destructive because when the machine restarts, it will be inoperable. The MBR is critical to system operation, and is the first sector of a hard drive, where all the initial instructions are at boot up, letting the computer know to load the operating system.

rombertik pic

This is an example of complex malware, hard to detect, and to protect against. Its purpose is to gain access to the target’s browser, read credentials and pilfer other sensitive information which it then collects to send off to a remote server. Rombertik spreads via spam and phishing emails. Here’s how it works:

Once loaded into the system, Rombertik first runs a series of anti-analysis checks to determine if it is running within a sandbox. In case it isn’t running within the sandbox, Rombertik decrypts and installs itself on the victim’s machine, which then allows the malware to launch a second copy of itself and overwrite the second copy with the malware’s core spying functionality. After completing this process and before begins spying on users, Rombertik runs a final check to make sure it is not being analyzed in memory. In case it finds any indication of being analyzed, the spyware attempts to destroy the master boot record (MBR) of the vulnerable computer. Rombertik then restarts the machine, and because now the MBR is missing from the hard drive, the victim’s computer will go into an endless restart loop.

The best defence in this situation is a layered defence, because Rombertik won’t be able to evade all the layers.

Macro Malware’s Re-Emergence. Be Aware. Be Very Aware

Remember that saying “Everything old is new again”? That’s a trend in InfoSec. It’s not at all uncommon for threats to re-emerge after seeming cease, because attackers have taken the time to revisit and retool. Think of it as a more damaging version of reduce, reuse, recycle. What happens is that the malware gets onto computers via spam email attachments. When the user opens the document, they are prompted by a bar along the top asking if they wish to enable macros to read the item. Most people click willingly, enabling the macro and the malware. The malware then becomes a portal for even nastier stuff waiting in the wings, like the banking Trojan, Dridex, which hunt down and collect valuable personal and financial information. Once again, the onus is on the end user to be aware of what they open and click, but that isn’t always an easy judgement call as these emails look very convincing. Currently, most attacks are happening within the US and the UK.

http://www.infosecurity-magazine.com/news/macro-malware-returns-with-a/#.VUbXOQefKP9.twitter

WordPress Sites Backdoored

Another week, another WordPress security issue. According to Zscaler, this time multiple WordPress sites are leaking credentials. Compromised sites are implanted with a “Backdoor” code that serves up injected JAVA script when the user enters their credentials on the login page. The end user remains oblivious as they are redirected to a successful logged in session of a WordPress site. Meanwhile, those valuable credentials are encoded and sent to off to the attacker’s command and control server. The recommendation from the ZScaler security research report is what we’ve been saying consistently:

“It is extremely important for the site administrators to keep their WordPress sites patched with the latest security updates,”

PHP Hash Comparison Flaw May Put Many Sites at Risk

About a year ago, a flaw in PHP password hashes was identified involving the equals-equals operator (==). Robert Hansen, vice president of WhiteHat Security, describes the issue as “one that affects any website that uses two specific types of operators for comparing hashes in PHP.” The issue mostly affects authentication, but this could extend to binary checking, cookies, and passwords, among other things.

“The problem is how PHP handles hashed strings when either the double equal (==) or “!=” operators are used to compare them. When either of these two operators is used for comparing hashes, PHP interprets any hashed value beginning with ‘0e’ as having the value 0. So if two different passwords are hashed and both their hashed values begin with ‘0e’ followed by numerals, PHP will interpret both as having the value 0. Even though the hash values for both passwords are completely different, PHP would treat them both as the number zero if both begin with 0e and when either ‘==’ or ‘!=’ are used.”

This gives attackers a way to try and compromise user accounts by entering a string that when hashed gets equated to zero by PHP. If a password in the database is represented the same way, the attacker will get access to the account, Hansen said. Until now, there haven’t been examples of these hash types.

GPU Keylogger and Linux Rootkit attacks

Malware just keeps evolving. This time it’s targeting the GPU over the CPU with 2 new items: Jellyfish Rootkit for Linux and Demon Keylogger. The GPU, graphics processor unit, has its own processor and memory. That allows the malware to operate incognito, attracting no attention since malicious code isn’t modifying processes in the main operating system kernel. The danger becomes that these types of rootkits can snoop on the CPU host memory via the direct memory access (DMA). This allows hardware components to read the main system memory without going thru the CPU so actions are harder to catch.
Some attacker advantages with GPU are:

  • No GPU malware analysis tools are available on the Internet
  • Can snoop on CPU host memory via DMA (direct memory access)
  • GPU can be used for fast/swift mathematical calculations like parsing or XORing
  • Stubs
  • Malicious memory is still inside GPU after device shutdown

For reference purposes, a GPU-based keystroke logger consists of two main components:

  • A CPU-based component that is executed once, during the bootstrap phase, with the task of locating the address of the keyboard buffer in main memory
  • A GPU-based component that monitors, via DMA, the keyboard buffer, and records all keystroke events

http://thehackernews.com/2015/05/gpu-rootkit-linux-Keylogger.html

Breaking Bad Themed Crypto Ransomware

This latest ransomware, Trojan.Cryptolocker.S, is currently going after computers running Windows based systems in Australia. The attackers leverage social engineering methods to get victims to open a malicious zip archive file, apparently with a major courier firm in the file name. Attackers then can run their own PowerShell script on the computer to run the ransomware. Encryption uses a random AES key, which is then encrypted with an RSA public key. Targetted files for encryption include media files, music, images, .lnk and .rar extensions.

breakingbadmalware

Symantec has a blog post about how to stay protected if you get ransomware here.

http://www.symantec.com/connect/blogs/breaking-bad-themed-los-pollos-hermanos-crypto-ransomware-found-wild

And Last but not Least …You know that Flashlight App you have?

Time to shed a little light on a dark matter. The top 10 Android flashlight apps are actually malware designed to steal your data off your mobile device.

https://www.youtube.com/watch?v=Q8xz8xKEFvU

Thanks for reading!

Friday Fun: InfoSec Geek Speak

Posted on by
Reply

geekkspeakFind yourself mystified by all the acronyms and terms you hear when anything tech comes up? You don’t want to speak it – you just wish you knew what the heck it meant. No problem. In today’s Friday Fun installment, I’ll get you up to speed. Thanks to the fine folks at Raytheon, (sponsors of this excellent endeavour, the National Collegiate Cyber Defense Competition NCCDC) I can share this glossary of terms.  And consider yourself just that much more up to speed on your own safety and security!

InfoSec Geek Speak Glossary

@ — Symbol chosen by Ray Tomlinson, a Raytheon BBN Technologies engineer who sent the first Internet email, to separate the names of users and their networks in addresses.

Advanced Persistent Threat — A group, such as a government or a criminal organization, with the expertise, resources and intent to target a specific entity. An APT uses multiple methods to break into a network, avoid detection and harvest valuable information over a long period of time.

apt

Air gap — To physically separate or isolate a secure network from other unsecured systems or networks.

Back door — A hidden entry to a computer, network or software that bypasses security measures.

Blackhat — A criminal hacker who breaches security for malicious reasons or personal gain.

Blue Team — A group defending a computer system from mock attackers, usually as part of a controlled exercise. During the Raytheon National Collegiate Cyber Defense Competition the blue teams are made up of students.

Bot — A program that automates a simple action. Bots infect computers and secretly perform activities under the control of a remote administrator.

Botnet — A collection of computers infected by bots.botnets

Bot master or herder —Someone who controls a botnet.

DoS Attack — A Denial-of-Service attack disrupts a website, server, or network resource – often by flooding it with more requests than it can handle.

DDoS Attack — A Distributed Denial of Service Attack is a DoS attack using a multitude of machines. Hackers often control one “master” machine to orchestrate the actions of “zombie” machines.

End-point Security — Security measures that protect a network from potential vulnerabilities posed by laptops and other mobile devices that access the network remotely.

Fuzzing — Automated input of invalid, unexpected or random data to a computer program. “Shocking” a computer in this way can reveal vulnerabilities.

Honeypot — A trap set to detect intruders. A honeypot usually simulates a real network but is actually isolated and monitored so it can give advance warning of an intrusion.

honeypot1  honeypot2

Insider threat – A threat posed by employees, contractors, business associates or other people who have inside access to a computer system. Raytheon is the No. 1 insider threat solution provider, protecting hundreds of thousands of endpoints.

Malware —Software designed to hijack, damage, destroy or steal information from a device or system. Variations include spyware, adware, rootkits, viruses, keyloggers, and more.

Patching —The process of updating software.

Pentest — Short for penetration testing, or trying to hack into a system to identify weaknesses.

Phishing — Tricking someone into giving away personal information by imitating legitimate companies, organizations, or people online. The “ph” derives from phreaking, or “phone freaking” — hijacking telephone lines. Spearphishing focuses on a particular target.

phish

Pwned — Pronounced like owned with a “p” at the beginning, pwned means to defeat security measures. Derives from the word “own,” or dominate.

Red Team — A group of cybersecurity professionals authorized to simulate an attack. A “blue team” of students will face a red team at the Raytheon National Collegiate Cyber Defense Competition.

Social Engineering —Manipulating people into sharing private information.

White Team — A group responsible for refereeing an engagement between a red team of mock attackers and a blue team of cyber defenders.

Whitelist — The opposite of a blacklist, a whitelist is a list of people, groups or software OK’d for system access.

Zombie — An infected device that is used to perform malicious tasks under remote control. Botnets of zombie computers are often used to spread e-mail spam and launch denial-of-service (DoS) attacks.
Thanks for reading and remember … “You Own Your Own Security!”

Weekly Security Brief: April 21 2015

Posted on by
Reply

secmat1

Welcome! When the best offense is a good defense, you’ve come to the right place. Given the ever-changing landscape of technology threats, that couldn’t be more true. Each week, we’ll cover current security threats, patches and issues that affect you and your business. And when something really big happens, we’ll post on Twitter and update this page with all the details you need to stay safe. Read on!

The BIG Story: Apple Rootpipe Vulnerability Still NOT Fixed! Tens of Millions of Apple Users at Risk

Apple claimed to have fixed it, but they haven’t. Note that this vulnerability was discovered last October, and had existed since 2011 in version 10.7. This leaves a dangerous backdoor open to attackers on any MACs with an operating system below 10.10. Yosemite. If you can, upgrade to 10.10.3. Thomas Brewster in his analysis of the situation painted the picture by numbers: there are over 3 billion internet users. Roughly 2% are on Macs, putting 60 million at risk. Attackers can gain admin privileges without proper authentication, execute code remotely and potentially compromise a machine. This hidden backdoor opens up root access, or control over the system, too widely. A patch will definitely need to be issued for older systems as well, but there is doubt being expressed if Apple will invest the time and effort to support. According to Emil Kvarnhammar, the TrueSec Security software engineer who reported the vulnerability to Apple last year:

“Fixing buffer overflows and similar is one thing (they usually back port that kind of issues), but fixing architectural issues like rootpipe will mean more work in dev and verification…I think (and hope) Apple might be reconsidering, knowing that users of older versions are upset and that even low-privileged guest accounts on Mavericks can be used to exploit the issue and become root.”

Apple has a lot to answer for, in light of the severity of this current threat, but so far neither solutions nor explanations are forthcoming.

Get Your Security Patches On!

Last week featured several critical security patch updates from Microsoft, but there were also urgent patches issued by Adobe.. Attackers have used the week that has passed to their advantage, building exploits against the Zero-Day Windows vulnerability, and utilizing a vulnerability in Adobe Flash to aid and assist. US Security firm FireEye claims Russian attackers have been using these new vulnerabilities to boost their ongoing efforts to spy on American diplomats and the White House.

The take-away here is that issuing security patches does not make vulnerabilities disappear. They will be re-used and deployed as often as attackers find opportunities. And those opportunities are typically systems left unpatched. According to Verizon’s recently issued 2015 Data Breach Investigations Report, they found that

“99.9 percent of the exploited vulnerabilities in 2014 had been compromised more than a year after the associated CVE (Common Vulnerabilities and Exposures) was published”.

Oracle Ends Publicly Available Security Fixes for Java this Month

These public updates that included bug and security fixes could impact millions of applications. Instead, customers will need to sign on for long-term support deals or migrate to Java 8, which was released March of last year. Given that people are slow to change, this move to be forward-thinking may have serious long-term costs. Per Waratek security CTO John Holt Matthew, “there is a dangerous tradeoff; now millions of Java 7 applications will have to defend themselves against code-level vulnerabilities without the benefit of future fixes.” Users are advised to upgrade if they can, or use RASP, Java Run-time Application Self Protection.

With that in mind, be sure to install the latest series of critical patch updates for Java. There are 98 new fixes. The link is below.

XSS Security Advisory for WordPress Plugins

There doesn’t seem to be a week without a warning for WordPress users. Per the current advisory, numerous WordPress Plugins are vulnerable to Cross-site Scripting (XSS). This is largely because of two functions, add_query_arg() and remove_query_arg(), which are used by developers to modify and add query strings to URLs within WordPress. The problem stems from a lack of clarity in the official WordPress Official Documentation (Codex) for these functions so that plugin developers used them insecurely, assuming that these functions would escape the user input for them, when it does not. Sucuri security recommends that developers check that they are escaping them before use. They recommend using the esc_url() (or esc_url_raw())functions with them.

A list of affected plugins is currently on the Sucuri Blog and includes Jetpack, WordPress SEO, Google Analytics by Yoast, Gravity Forms among many.

https://blog.sucuri.net/2015/04/security-advisory-xss-vulnerability-affecting-multiple-wordpress-plugins.html

Spyware: New Browser Hack

Any computer running a late-model Intel microprocessor and a Web browser using HTML5 (i.e., 80% of all PCs in the world) is vulnerable to this attack. Dubbed “Spy in the Sandbox”, this tactic comes with little cost or time to the attacker. They lure the victim to an untrusted web page which contains content controlled by the attacker. Bogus software on the page launches a program to manipulate how data moves in and out of victim’s PC cache. Because this is spyware, NO data theft occurs. However, it can record details about browser history, keystrokes, mouse movements utilizing a classic side-channel attack to read the activity of processors, memory, and networking ports.

http://www.forbes.com/sites/bruceupbin/2015/04/20/new-browser-hack-can-spy-on-eight-out-of-ten-pcs/

Ransomware: What Would You Pay?

Sorry. Clearly Ransomware isn’t going away so let’s get smarter about what’s going on out there. If your files were jacked, would you pay? Desperation times call for desperate measures and at least 30% of security professionals – yes, security – say they would pay. That’s according to a recent survey by ThreatTrack Security.

ransom

A realistic expectation is that panic mode will set in. An episode of “The Good Wife” earlier this year accurately depicted the ensuing chaos and desperation that follows when an office discovers they can’t get to the files they need. The reality is that nobody is working on anything other than the immediate problem at hand. That’s a direct lost, impacting sales and profits. But the truth is that even if you do pay that ransom, you won’t get your files back. Because as the saying goes “There is no honour among thieves”, and there is even less among those conducting extortion in the cyberworld. Not when the game has become so easy and so lucrative.

http://www.csoonline.com/article/2911094/data-protection/cyber-extortion-a-growth-industry.html#tk.csosotd

This is cross-posted from the JIG Technologies Inc weekly website piece at  http://www.jigitsupport.com/company/yoursecuritymatters/

As always – Thanks for reading!
Cheryl Biswas, InfoSec Co-ordinator and Editor JIG Technologies Inc

DRP: What Have I Got to Lose

Posted on by
Reply

drp1

It happens when you least expect it, when the timing is bad, when it’s the last thing you’re prepared to deal with. That’s why it’s a disaster. But the real disaster is that so few companies are ready with a plan to get them through one.

Most Don’t Have One

As per research done by Symantec in a study from 2011, 57% of small to medium businesses didn’t have a Disaster Recovery Plan (DRP). Those numbers don’t appear to be improving. From an article in February 2015, roughly 60% of businesses in Canada did not have a plan in place to address security incidents like hack attacks, breaches or system failures. This information comes from 2 online surveys done by analyst firm IDC Canada for Cisco, comprising 2000 Canadians and 498 Canadian businesses.

Questions addressed security preparedness, and topics like security policies, recent cyber attacks, and familiarity with mobile and cloud-based applications. The result? Per Cisco “many Canadian businesses operate without any security strategy for their networks and are ‘woefully unprepared’”.

drp2

It’s like jumping without a net. Per CRA, a managed IT solutions firm in NYC, the average cost per day of IT downtime can amount to as much as $12,500. Many smaller businesses fail to recover from the financial losses they sustain, and go out of business within a year. As stated by Tom Richer, CRA Chief Sales & Marketing Officer:

SMBs that do not have a disaster recovery plan are taking an unnecessary risk. Not recovering quickly from a disaster or outage could mean the loss of many clients and revenue

So Why Not?

If we know the risks are growing and the costs of downtime are perilously high, why do so few companies have a plan in place? Below are the results from a recent survey done by Continuity Central. The numbers speak for themselves:

  • Lack of budget, funds and resources: 35.6 percent
  • Lack of top management commitment, buy-in and support: 16.4 percent
  • Lack of business unit support: 6.6 percent
  • The low priority given to BCM compared to other deliverables. 5.3 percent
  • Organizational apathy towards BCM: 4.9 percent
  • Staffing difficulties (loss of business continuity staff and difficulties in recruiting staff with appropriate qualifications): 4.8 percent
  • Lack of time available for business continuity staff to manage all their tasks: 3.5 percent

Simply put, lack of preparedness equals a perceived lack of funds and an ongoing lack of buy-in. We are looking at the formula for disaster.

drive crash

What Are You Waiting For?

Last year gave us

  • Mass data breaches: illustrating how Point of Sale malware is increasingly pervasive, continuing to feed our valuable information into the coffers of cybercriminals across the globe
  • The Sony Hack: how disgruntled employees can become destructive forces we don’t anticipate
  • Ransomware: cybercrime knows how to hold us hostage, and we pay regardless
  • Natural disasters: global warming or not, tornadoes, hurricanes, massive blizzards shut down cities and businesses every year

Putting a Disaster Recovery Plan in place is a lot easier than cleaning up the aftermath of a disaster. There are many approaches and templates to work from (I would love to help you with that – just ask!) but the best approach is to take the proverbial bull by the horns and get to work on your plan. Because the old adage holds true: failure to plan is a plan to fail. Don’t let it be yours.

(currently featured on the JIG Technologies corporate site)

Malware Primer: Browser Hijackers & Adware & Spyware. Oh My!

Posted on by
Reply

Welcome back for another installment in our series on Malware 101. This time, we’ll get delve into the devious realm of browser hijackers and adware.

hijack1

Not all surprises are nice. Like when you type in one destination online, and find yourself on another site you really don’t want. And try as you might, you just keep landing back at that site. Sorry but you’ve just been hijacked by your browser. More accurately, by the hacker who has used malware to take control of your browser, and your surfing.

Browser hijacks are performed by malicious software that redirects your browser – Exploer, Google, Firefox, Safari – to a specific site.  This site can then be used to download malware onto your computer, without you realizing it. It’s known as a “drive-by download”, quick and dirty.

It gets worse. You know those bundled offers you get, or combos, whether you want them or not? Well, you’ve not only been hijacked, but you have likely been loaded up with a bunch of malware to take back. Your screen will soon fill with annoying pop-ups; your computer will seem sluggish; strange things will happen to your files. A lot of this is adware, often bundled with browser hijackers. And all courtesy of something you clicked on.

adware

While the adware is annoying, the spyware it carries is more malicious. This stuff hides on your computer, where it tracks and monitors everything you do. Yes that email, tweet, ridiculous comment, all have been recorded and sent elsewhere. Worse, your personal details, banking information and sign on credentials have also been captured for sale and use by somebody you really don’t want to know.

Think of this stuff as tech VD, because cleaning up a nasty infestation reveals it to be a gift that keeps on giving. It’s hard to detect initially. Once you do catch on, the malware has proliferated and spread through your computer. You’ll likely need professional assistance to do a really good clean up job. Unless you have the patience and expertise to follow all the steps and use several different programs to unearth and remove all the malicious files.  It is doable, but you need to be diligent because you need to find and remove all of it. Otherwise, you’ll get reinfected.

Remember – You Own Your Own Security.  Take charge!

Quick Hit Malware Primer: Viruses vs Malware

Posted on by
Reply

malware3

My objective with these blogs is to show you that you can do a lot of this yourself, and to learn what you need to stay safe. I promise – you don’t have to have a computer science degree for this.

If knowledge is power then education is key. I thought it might be helpful to run a primer-style series on what types of threats are out there, and your best defence against each. We’ll take it one at a time, bite-size learning.

So – to get started. What’s the difference between viruses and malware? Malware is the umbrella term we use to refer to a whole host of troublesome things, including viruses, that infect our devices, hack our servers, and lie in wait.  A virus is bad, but not all bad things are viruses.

virusTechnically, a virus is classified as “a self-replicating piece of malicious code that travels by inserting itself into files or programs.”  It’s a malware program that performs a harmful activity on the host it infects. It infects hosts by duplicating itself, without user consent, in files, programs or the boot sector of the hard drive. Viruses can cause a variety of problems including:

  • access your personal data
  • corrupt files and data
  • log (copy and record) keystrokes
  • send out spam to contacts.

There are a lot of anti-virus programs to choose from.  Some are free.  All are effective to varying degrees, but none will catch all the problems all the time. They can’t.  Viruses are built when hackers develop malicious code that exploits vulnerabilities or weaknesses in the code of programs, typically operating systems like Windows. These exploits are constantly evolving, so for anti-virus programs, it’s a matter of how quickly they can add that virus “signature” into their database so that the anti-virus program can detect it on future scans.

What can you do?  Always have a current and updated version of an anti-virus program running on your devices.  You can install them on phones and tablets, and you should, because these face the same risks as desktops and laptops. And contrary to popular opinion, Apple/Mac do get viruses and there are programs to protect them as well. Don’t let your licence expire so that you work on an outdated program. And – make sure you don’t ignore the prompts to update.  Those updates mean the difference between getting infected and staying safe.

Because You Own Your Own Security. Why leave it up to someone else?

Back It Up, Back It UP!

Posted on by
Reply

(A cautionary tale and my little take on “Shake It Off” by Taylor Swift)

I left it too late
Got nothing on my plate
That’s what my disk drive says mmm-mmm
That’s what my disk drive says mmm-mmm

Now my files are all gone (sob)crash3
And I know something is wrong
At least that’s what the server says mmm-mmm
That’s what the server says mmm-mmm

So I keep losing
All the work that I was doing
It’s like I got this hole
In my drives
And it’s not gonna be alright

‘Cause the data’s gone away, way, way, way, waybash
And now it’s way too late, late, late, late, late
Baby, I’m just gonna cry, cry, cry, cry, cry
I shoulda backed it up, backed it up
Shellshock is gonna bash, bash, bash, bash, bash
And the hackers gonna hack, hack, hack, hack, hack
Baby, I’m just gonna cry, cry, cry, cry, cry
I shoulda backed it up, backed it up

When we got hacked todayransomware
By Ransomware – won’t pay
That’s what they say don’t do mmm-mmm
That’s what they say don’t do mmm-mmm

Get the backups- Let’s restore! (backup and restore)
Is this all- why aren’t there more? (why, why aren’t there more?)
So I tell them I don’t know, mmm-mmm
I tell them I don’t know, mmm-mmm

And we are losing
The work that we’ve been doing
It’s like we got this hole
In the drives
And it’s not gonna be alright

‘Cause the data’s gone away, way, way, way, waysonypictureshack-640x1136
And now it’s way too late, late, late, late, late
Baby, I’m just gonna cry, cry, cry, cry, cry
I shoulda backed it up, backed it up
Our site is getting hacked, hacked, hacked, hacked, hacked
Our accounts are getting jacked, jacked, jacked, jacked, jacked
Baby, I’m just gonna cry, cry, cry, cry, cry
I shoulda backed it up, backed it up

Back it up, I’ll back it up
I, I’m gonna back it up, back it up
I, I’m gonna back it up, back it up
I, I’m gonna back it up, back it up

Yeah ohhhh!!!!

Yeah the price we had to pay, pay, pay, pay, paydrive crash
But today’s a different day, day, day, day, day
Baby, I’m just gonna save, save, save, save, save
Now I back it up, I back it up
If the hard drive’s gonna crash, crash, crash, crash, crash
Or tornadoes gonna smash, smash, smash, smash, smash
Baby, I’m not gonna cry, cry, cry, cry, cry
Cause I back it up, I BACK IT UP!

You know what you gotta do – go do it!

Superfish and Lenovo: One Big Fish Fry

Posted on by
Reply

“Superfish” by @EddieTheYeti

There’s a nasty little game afoot where new laptops come with undesirable extras. I’m talking about “crapware” – all those annoying little programs and invitations to sign up and buy that suddenly fill your screen moments after you first boot up.  That’s not the way anyone deserves to experience those heady first moments with a major new purchase. And yet, it’s exactly what happens with nearly all new laptops and pcs.

If you ask, you’re told that it’s been in practice by big companies for a while; that it’s the way business is done; that it’s nothing to worry about.  That doesn’t make it right.  And as of today, that doesn’t make it safe.

lenovolaptopIt has been discovered that the plethora of advertising extras pre-installed on Lenovo laptops contains a hidden danger.  A piece of adware, known as “Superfish Visual Discovery”, actually conducts a type of attack known as “MiTM” or Man-in-the-Middle, where it messes with that lovely new laptop’s configuration, and actually compromises a key security component. And no, that is not supposed to happen.  Which is why I think it’s time to speak up and speak out about this practice.

Plenty of top-drawer securitytech experts are currently dissecting and revealing the ugly truth about “Superfish”.  Simply put by Marc Rogers on Marc’s Security Ramblings,:

 badcert Lenovo is installing adware that uses a “man-in-the-middle” attack to break secure connections on affected laptops in order to access sensitive data and inject advertising. As if that wasn’t bad enough they installed a weak certificate into the system in a way that means affected users cannot trust any secure connections they make – TO ANY SITE.

Rik Ferguson offers this explanation on CounterMeasures:

 Superfish also installs its own self-signed Root Certificate Authority… Superfish can generate any certificate it wants, which will be trusted by your browser as entirely legitimate, allowing it to impersonate any destination on the internet. These sites are normally protected by strong encryption for your security

twittererRob Graham on Errata Security described how he was able to “intercept the encrypted communications of SuperFish’s victims (people with Lenovo laptops)”. On Twitter, he challenged the supposition by Peter Hortensius, CTO of Lenovo, that the problem was “theoretical” by saying how he had tested and proved otherwise.  And Steve Ragan on Salted Hash Security News hits the nail on the head when he states:

Even if the user removes the Superfish software, the certificate remains trusted and installed on the system. As for the opt-in requirement, most users agree to everything when configuring a new system, assuming they even notice the Superfish TOS to begin with.

What really bothers me is that most users don’t have the technical skillsets to understand what is actually happening, let alone to diagnose and disinfect.  From my years of experience working with end users, cleaning up this kind of mess definitely  falls outside reasonable expectations of what we should ask most people to do. Helping folks overcome their fear of technology is always challenging.  Most people would just like the problem to go away. Or for someone else to fix it.  There is a point to which you can lead users, but then they balk.certs

My team and I are all about simplifying technology for users. And honestly, if you can teach someone the easy ways to do things right, like security, then it’s like teaching that proverbial man to fish: they’ll be fine for the rest of their lives. But there is nothing simple about cleaning up malware, spyware, adware and the technical mess they inflict on devices.  Nobody who really cares about their customers should be asking them to start prodding around in program or registry files even if the customer is technically qualified.  Because confusion happens and mistakes can be made.

It’s really great to hear the outcry against what’s been going, and to put the issue squarely in front of major manufacturers. Time for certain parties to take a good look in the mirror: How can you proclaim your commitment to improving security when you’re actually contributing to a key source of problems? I love this statement by Marc Rogers on Marc’s Security Ramblings :

We trust our hardware manufacturers to build products that are secure. In this current climate of rising cybercrime, if you can’t trust your hardware manufacturer you are in a very difficult position

That said, what can you do about it? First and foremost, you need to get that junk off your device.  I’m happy to report that some terrific folks have been addressing that and there are some good suggestions on how to detect and remove.  For those inclined to do take the task on, read the steps through carefully a couple of times to make sure it’s clear before you undertake anything.  I can recommend this piece by PC World.  As well, I found this piece by ZDNet a little more detailed and perhaps easier to follow.

Crapware serves no purpose other than garnering profit.  Lenovo has a PR nightmare ahead, and they have a lot to answer for. While they claim to have halted shipping it back in January, that does nothing about what’s already out there.  Hopefully this serves notice to other distributors about cleaning up their acts so they don’t get caught up in the same net with “Superfish”.   Because the only real victims in this fish fry are the end-users.

NOTE: The awesome pic up at the top is by talented InfoSec member and artist @EddieTheYeti

Security Patches: One Step Forward, Two Steps Back

Posted on by
Reply

malware

Security breaches, mass DDoS attacks, ransomware mutations. No question about it – the challenges to information security are constant and ever-changing. Over the past twelve months, InfoSec has had to deal with threats not only of a greater magnitude in complexity but also in sheer volume. So in our concerted, and at times hasty, efforts to keep up with all that’s out there, are we leaving ourselves exposed? Do we need to double-back and cover our tracks?

Fact is, there is a lot to keep up with, even for security super-heroes. Given the nature of the beast, we’re always looking forward, trying to keep up or gain a little ground to ready ourselves for the next challenge. But what about those “backdoors” we just closed?

malware3Cleaning up after mass events like ShellShock/Bashbug and Heartbleed isn’t straightforward. Sadly, one patch does not fit all when there are multiple iterations of operating systems and devices. And the truth is – there just aren’t enough good people or hours in a day to comb through all the stuff out there to find and fix what’s at risk, much as we want to. Much as we need to. What happens next is inevitable. The adversary takes advantage, finds the hole, and builds exploits that we then must find and shut down in a series of blocks and tackles.

Here’s a recent case in point: Shellshock and QNAP. Shellshock doesn’t just impact servers. It impacts devices connecting to these servers through the internet: wireless access points, routers, smart fridges, video cams, webcams, even light bulbs. You can patch a server. It’s not so easy to patch a fridge. The real challenge has been to identify and patch all those different exposed devices. QNAP makes network attached storage devices that are popular world-wide. And therefore ideal targets for Shellshock exploits.

While QNAP did issue a firmware patch in October, Shellshock worm exploits were detailed later in December. The worm targeted a particular CGI script, /cgi-bin/authLogin.cgi, which could then be accessed without authentication. That would allow attackers to launch a shell script that could in future download more malware. Essentially, keeping the backdoor open.cgi backdoor

One of the interesting things noted about this worm, per Kaspersky’s detailed write up, was that the script it made then downloaded and installed QNAP’s Shellshock patch. Yes! But in a move that was strictly territorial to keep other opportunistic attackers out.

Kaspersky advised that

“IT staff responsible for these devices security should apply patches themselves, or a worm will do it. At a price”

I’ve followed up with QNAP, and nothing else has been issued. The onus is on the users to identify and patch their products. Need I say more?

It’s easy to lose track when the tyranny of the urgent sets our agendas for us. And it’s hard to be proactive when you’re busy fighting fires. But the fact is we need to keep watching those backdoors – because they don’t always shut completely.

This post was featured on DarkMatters, the security blog by Norse Corp

The lead illustration is an actual screencapture of Shellshock malware by MalwareMustDie.org, a whitehat security research workgroup

Why Encryption Matters: Political Insecurity vs InfoSec

Posted on by
Reply

cam and bam

You own your own security. Bottom-line, when it comes down to planning how to protect yourself and what is yours, that decision should belong to you. But that’s not what President Obama, UK Prime Minister David Cameron or French Prime Minister Hollande would have you believe after their exchange of inflammatory rhetoric last week. If these three global leaders have their way, rather than securing our freedoms in the face of terrorism, they’ll be restricting the safeguards we need in place, and opening the cyber backdoor to those threats they fear most.

It appears fear fuelled knee-jerk reactions following the horrific terror attacks in France. French PM Hollande called for tighter surveillance measures to potentially weaken and cripple encryption in France. That encouraged UK Prime Minister David Cameron to say he’d like to ban certain forms of encryption, impacting popular messaging apps like iMessage and WhatsApp. You can read this post by Cory Doctorow to get a shopping list of what they want to limit http://boingboing.net/2015/01/13/what-david-cameron-just-propos.html. US President Obama’s new Internet security proviso followed hard on the heels of Cameron’s call to outlaw encryption. Instead, they want to build “backdoors” into applications, that would allow government officials to have the ability to read all media and messages, and effectively give the state far more access and control over everyone else. But as Cory so aptly points out “there’s no back door that only lets good guys go through it.”

Official White House photo by Pete Souza

Official White House photo by Pete Souza

When Obama delivers his State of The Union address on January 20th, he’s going to make his case against encryption, and against the people in InfoSec who watch our backdoors constantly, identifying and tracking down threats from around the world.  There is a lot of money being made by people who can breach security, acquire our personal data, and sell it to the highest bidder.  The stakes are much higher when it comes to securing our critical infrastructure: power, water, communications, defense.  We have clear proof that those systems have already been targeted and penetrated.  Those systems are vital to our way of life, and deserve the best protection we can offer.

Rob Graham has written an excellent response to this in his blog, Errata Security, and he levels this warning: “The most important innovators this law would affect are the cybersecurity professionals that protect the Internet. If you cared about things such as “national security” and “cyberterrorism”, then this should be your biggest fear…This creates an open-door for nation-state hackers and the real cybercriminals.” http://blog.erratasec.com/2015/01/obams-war-on-hackers.html#.VL1RgkfF_p6.

mw2

Call me crazy, but I think we should listen to those who know a lot more then the rest of us think we do. Misguided Security warns “once this Pandora’s Box is opened, it’s going to be damn hard to shut and the talented people who do great research and help protect the public from people and organizations that are truly scary”. http://misguidedsecurity.blogspot.ca/2015/01/wi-fight.html Encryption keeps data safe, keeps identities safe, whereas backdoors and uninvited surveillance create risk.

mw1

These guys aren’t the hackers – they’re the ones that protect us from them.  Yet the term is dangerously misunderstood. Rob Graham explains “Because of our knowledge, we do innocent things that look to outsiders like “hacking”. Protecting computers often means attacking them.” There’s a diligent army of highly skilled folks working on our behalf out there, scrutinizing infinite lines of code to catch what we don’t want to have. They share what they learn in real time, a collaborative, co-operative and highly effective network. Given the opportunity, we really should be listening to them.

Thanks to the folks in InfoSec and the tools they use daily, I’ve watched botnets being launched by attackers from China.  To see what is coming at us in real time just click on this link to a map by Norse  http://map.ipviking.com/

norse

tshirt

We need the freedom to innovate and explore technology so that it will serve us better. As Rob Graham points out, “Internet innovation happens by trying things first then asking for permission later. Obama’s law will change that. ”  How can we defend ourselves if we handcuff those who do? There’s currently a movement afoot within the InfoSec community to spread the word and explain the real value of encryption so that everybody understands they have a stake in this. (I admit, I may be owning one of these shirts myself).

Currently, this seems to be couched as a “tech” issue, with the political pundits throwing words around like “cyber”, “encryption” and “hacker”, terms that can easily be used in a campaign of fear-mongering by government policy makers to assume control. The assumption is that the average person will probably stop listening because they consider this out of their realm, so it doesn’t apply to them. But that couldn’t be further from the truth. This argument is not just about technology anymore. It challenges current standards of freedom and privacy, and within that, how we get to protect ourselves. And everything we hold dear. Isn’t that our decision to make?