Threat Geek

What’s your Content-Type IQ?

Last week I broke the vendor’s code of silence by divulging the dirty little secret that some network security vendors may actually exaggerate the degree to which their products are “content aware”.  I also put together a web site you can use to test the “Content IQ” of your favorite network security system yourself.

In this blog post I want to talk about content type.  By “content type” I mean the type of file that’s being transported over the network.  There are many situations in which a security analyst, incident responder or forensic investigator needs to identify network sessions that contain a certain type of content.  For example, you might need to find network sessions that contain Microsoft executable files or Shockwave Flash files embedded in Microsoft Office documents.

Many network security systems such as firewalls, IPSs, and network forensics systems determine the type of the file being transferred over the network by looking at its file extension or - for certain protocols such as HTTP and SMTP that have protocol fields for describing content type - it’s “mime type,” which is derived directly from the file extension.

In other words, many network security systems “believe” the file type that was asserted by the person who named the file.  Not to put too fine a point on it, but in any kind of attack scenario that would be “the bad guy”.

There are a couple of problems with this approach.

Problem 1 is that even the most unsophisticated attacker can very easily “fake” a file type simply by changing the file’s extension (e.g. from “.exe” to “.jpg”). 

Problem 2 is that this approach can’t determine the type of a file that’s embedded or contained within another type of file (for example an executable file that’s contained in a zip file, attached to a PDF file, or embedded in a Microsoft Office document) – it will only see the file type of the outermost containing file.

To avoid Problem 1, a network security system must be able to identify file types independently by performing binary file type recognition using known file-type signatures (i.e. by looking for certain byte sequences at particular offsets within the transferred files).

To avoid Problem 2, a network security system needs to “open up” content containers (such as compressed archives, Microsoft Office documents and PDF files), extract the embedded files, and do binary file type recognition on them.  This has to be done “recursively” so that it can identify the file-types of files that are contained within containers within containers within containers…

In the spirit of last week’s post, I created a test page that you can use to test your network security system’s “Content-Type IQ” and a video (below) showing a Fidelis XPS system taking the Content-Type IQ test.

 

 

- Kurt Bertone

THREAT GEEK WEEKLY UPDATE - AUGUST 25, 2011

1.      Mobile Malware: Protect Yourself Against Evolving Threats

When it comes to mobile security threats targeting our smartphones and tablets, unlike in biology, evolution isn't a good thing. Instead of "survival of the fittest" think "drug-resistant bacteria," because threats adapt to our ability to block and treat them faster than we can develop new palliatives.

2.      Yale warns 43,000 about 10-month-long data breach

Yale University has notified about 43,000 faculty, staff, students and alumni that their names and Social Security numbers were publicly available via Google search for about 10 months. All of the victims were affiliated with Yale in 1999, and are being offered identity theft insurance and free credit monitoring services for two years, the university said in a statement last week.

3.      When hackers become The Man

At DefCon III in 1995, the young crowd of 470 spent their time jamming a local radio station broadcast and playing Hacker Jeopardy at midnight when they couldn't drink at the bar. "Free Kevin" stickers were plastered everywhere protesting the jailing of fugitive hacker Kevin Mitnick, and a 14-year-old ran away from home to attend the event. (I know because I was there.)

4.      5 Top Trends Redefining CSO Priorities

The CSO carries a heavy load, as the person responsible for overall direction of security functions associated with IT applications, communications, and computing services and security within the enterprise. Part of what makes the role of the CSO so challenging is that trends introduce change, and the changes are cumulative. Few of the old security concerns go away; yet emerging technology trends introduce new risks while amplifying traditional concerns in novel and unexpected ways. Over the years computer viruses have evolved from sometimes amusing nuisances to more sophisticated hacking attacks that have become technically advanced, persistent, well-funded, and motivated by profit or strategic advantage.

5.      MyBART Hack by Anonymous Could Have Been Worse

The disclosure of 2,000 usernames and passwords by the hacking collective Anonymous against a San Francisco transportation website could have been more damaging, according to a doctoral candidate at the University of Cambridge. Joseph Bonneau, who is working on a thesis on password security, analyzed the disclosed passwords and found that more than 1,300 were randomly generated when users signed up for accounts at myBART, a marketing site for Bay Area Rapid Transit (BART).

 

The ThreatGeek Top 5 is a weekly post that identifies relevant industry news and stories. Check in to stay up to date with the latest happenings throughout the industry.

The Analysis is Complete and Fidelis Has Been Named a Visionary!

Gartner Research just released the findings of its 2011 Magic Quadrant for Content-Aware Data Loss Prevention, and has recognized Fidelis for our completeness of vision and ability to execute by placing us in the Visionaries Quadrant.   For those of you who may not be familiar with the Gartner MQ system, they define it as follows:

“Gartner Magic Quadrants are a culmination of research in a specific market, giving you a wide-angle view of the relative positions of the market's competitors. By applying a graphical treat­ment and a uniform set of evaluation criteria, a Gartner Magic Quadrant quickly helps you digest how well technology providers are executing against their stated vision.”

Third party validation from a respected industry source such as Gartner is always high praise; it was also extremely gratifying seeing our partner Verdasys—who OEMs Fidelis network DLP technology—positioned as a Leader in the Quadrant based on its ability to execute with Fidelis technology.

We at Fidelis are fond of the expression that our technology vision goes beyond ‘catching stupid.’ Anyone can do that.  We focus our efforts on providing the most powerful security solutions that uncover even the most sophisticated attacks.  With Gartner recognizing us as having the vision to make this happen and the proven execution and leadership of our technology, it would seem we are well on our way of accomplishing these goals.

- Peter George

THREAT GEEK WEEKLY UPDATE – AUGUST 18, 2011

1.      SpyEye source code leaks could fuel new wave of attacks

The source code of the notorious SpyEye toolkit has been leaked, fueling speculation that one of the largest criminal malware families could become an even bigger threat. SpyEye, which surfaced in late 2009 and immediately started to compete against users of the Zeus banking malware toolkits, targets account credentials and other sensitive data. Leaking the SpyEye source code gives security researchers valuable information about the malware and the techniques of the code writers, but it also opens the door for other cybercriminals to create new variants and attack techniques. 

2.      Chrome improves anti-malware blocking score by 340%

Google's Chrome blocked four times more malicious sites and malware than a year ago, but Firefox 4 was much less effective at warning users of danger than Mozilla's browser last year, according to a report released Monday. Both were thrashed by Microsoft's Internet Explorer 9 (IE9), however, which easily retained its crown, said NSS Labs in a reprise of a 2010 study of browser anti-malware technologies.

3.      Anonymous Breaches San Francisco’s Public Transport Site

The hacking collective Anonymous released personal data on Sunday belonging to more than 2,000 public transport customers in the San Francisco area in retaliation for the Bay Area Rapid Transit (BART) system's shutdown of mobile phone service on Thursday night.

4.      Shady RAT Hid Malware In Digital Images

The attackers behind the "Operation Shady RAT" targeted cyber-espionage hacks hid some of their activities behind digital images. They used steganography, a relatively rarely deployed technique for hiding malicious code or data behind image files or other innocuous-looking files. In its analysis of Operation Shady RAT, Symantec found rigged images--everything from images of a pastoral waterside scene to a suggestive photo of a woman in a hat--that were masking commands ordering the infected machines to phone home to the command-and-control (C&C) server.

5.      Can the Obama Administration fix your identity management problems?

Can the Obama administration fix your identity management problems? Too many passwords and usernames for websites, and what level of assurance is there in the identity of the individual anyway? How can anyone prove their age online? Back in April, when it was announced, the White House took on these tough questions with its "National Strategy for Trusted Identities in Cyberspace" initiative, now known as NSTIC.

The ThreatGeek Top 5 is a weekly post that identifies relevant industry news and stories. Check in to stay up to date with the latest happenings throughout the industry.

What’s Your Content IQ?

Now, don’t get me wrong – I can appreciate a good piece of marketing hyperbole as much as the next guy.  But at some point it starts to irk me enough that I just have to say something about it.  In this case it’s the fact that virtually every IPS, “next-generation firewall” and network forensics  system out there claims to be “content aware” or to provide “content visibility” or “content security”.  Since most modern threats are content-level threats (i.e. they’re embedded in the documents or files that are being transported over the network and they target the applications that open them), and since data leakage and data theft is all about content, it’s easy to understand why everybody feels they have to make this claim.

But the fact is firewalls, IPS’s, network forensics systems and other “deep packet inspection” systems are not “content aware” and they don’t provide “content visibility”.  They are packet aware, and they provide visibility over packet payloads. But packet payloads and “content” are not the same thing, and the fact that a network security device can see what’s in the packets doesn’t mean it can see the “content”.  As noted in the table below, there are many cases in which the content you are interested in is not visible in the packets that are used to transfer it across the network because it has been embedded, encoded and/or compressed beyond all recognition.

 
I got so exercised about the fact that so many people don’t understand the difference between “packets” and “content” - and the fact that so many vendors exploit this - that I built a little web site you can use to test the Content IQ™ (level of content awareness) of your next-gen FW, IPS and/or network forensics system.  All you have to do is:

• Go to http://www.contentiqtest.com/
• Set up your network security system to look for a particular target string that’s been embedded in a set of test files,
• Download the test files over your network, and
• See how many of them your network security system can catch (FWs and IPSs) or find (network forensics systems).

If your network security system can identify all of the network sessions that contain the test files, then you have a very high Content IQ.  If not, well, you may be the victim of overly enthusiastic marketing on the part of your network security vendor.

If you’d like to see a demonstration of a Fidelis XPS system taking the Content IQ test, you can watch the video on our site or see it below:

- Kurt Bertone

THREAT GEEK WEEKLY UPDATE – AUGUST 11, 2011

1.      Anatomy Of A Mac APT Attack

You've heard it all before: If you're a Mac, then you're immune from most of the latest security threats. That has led some organizations worried about cyberespionage-type attacks to consider ditching their target-prone Windows machines for their Mac iOS counterparts, according to a team of researchers who spoke at Black Hat USA last week in Las Vegas.

2.      The danger of misconstruing the most serious security threats

Unlike in politics, it’s rather important in the world of cybersecurity that words and labels mean something specific. Routinely mislabeling hacking and other incidents of computer mischief could lead to overreactions to garden-variety illicit activity or a tendency to downplay the need for a new kind of response to truly dangerous threats.

3.      Citigroup Hit Again by Security Breach

The company's Japanese credit card unit reported in a message to its user base that personal information of about 92,400 customers "has allegedly been obtained and sold to a third party illegally." Multinational financial service provider Citigroup appears to be snake-bitten by security problems, and not just through Web hacking.

4.      Hackers attack zero-day flaw in WordPress themes

Malicious hackers have pounced on a zero-day vulnerability in a widely used image-resizing utility that ships with themes for the popular WordPress blogging platform. The timthumb utility, used to handle cropping, zooming and resizing web images, is used by millions of blogs running certain themes and because it writes files into a directory during the image-resizing process, it can be used to launch web attacks.

5.      Microsoft patches 1990s-era ‘Ping of Death’

Microsoft today issued 13 security updates that patched 22 vulnerabilities in Internet Explorer, Windows, Office and other software, including one that harked back two decades to something dubbed "Ping of Death." Of Tuesday's 13 updates, called "bulletins" by Microsoft, two were labeled "critical" -- the most-serious rating in the company's four-step score -- nine were marked "important," the next-most-dangerous category, and two were pegged as "moderate."

The ThreatGeek Top 5 is a weekly post that identifies relevant industry news and stories. Check in to stay up to date with the latest happenings throughout the industry.

Thinking Cap Meets Black Hat – Ruminations on Head Coverings and Hacking (but Mostly Hacking)

My job at Fidelis is to write rules and policies for our XPS product to detect and prevent potential security incidents, so my primary priority at Black Hat was to attend briefings that might give me ideas for new rules, ideas from the bleeding edge of the security research field that malicious hackers will adopt or might have already adopted. My secondary priority was simply to indulge my intellectual curiosity. Black Hat was a successful endeavor on both fronts. In fact just about my only point of dissatisfaction was that I couldn’t attend every briefing I wanted to. 

When there are five talks during each time slot you have to make your choice and hope it pans out. In this way, attending a conference is like a choose your own adventure book, only you can’t keep your finger at the decision point to reverse your choice when it leads to your character’s untimely demise, and there are five choices, but none of them kill you, but some lead to boring talks where death might be considered a sweet release, but then you get the DVD which contains the content of all the branches thus rendering your choices ultimately irrelevant. So…maybe it’s not like a choose your own adventure book at all. Hmm…anyway, on with the ruminations. 

Mario Vuksan and Tomislav Pericin from Reversing Labs gave a talk titled “Constant Insecurity: Things you didn't know about (PE) Portable Executable file format”. This talk, properly applied, is basically a how-to for malware authors on stymieing reverse engineering, but also for reverse engineers on detecting such attempts. For those who don’t know, the PE format has been around since the dawn of Windows NT and is the data structure defining all Windows executables. Parsing this format is how all Windows operating systems load and execute binaries and DLLs. The talk mainly focused on disparities between the documentation on the file format and the actual implementation, and how those discrepancies can be used to undermine the inherent assumptions made about executable files by static analysis tools, and other tricks of the reverse engineering trade.

As an example, the general PE format consists of a DOS header followed by a PE header, inside the DOS header is a pointer to the start of the PE header, technically the pointer should just point to the end of the DOS header, since that’s where the PE header is supposed to reside, but in reality it can point anywhere and Windows will happily parse the pointer and continue loading the executable. Now the very first question I had was “Hmm, but can it point outside the boundaries of the executable file?” Funny story, it totally can. Now since this is already an EXE loaded on to a system and executed, it’s not quite as exciting as a writeable EIP register, but it’s neat nonetheless. More interesting, and dangerous is the ability to encrypt binaries and decrypt them on the fly using the Relocation table. The relocation table is basically a mathematical offset between the base address at which an EXE is supposed to be loaded (as specified in the PE header), and where it is actually loaded. So how do you ensure that the OS won’t  be able to load your EXE at the requested base address? By defining your base address within the memory of the Windows kernel of course. Using this trick the file will look like an EXE full of incomprehensible gibberish up until it’s executed at which point the relocation table will work its magic, decrypt the file on the fly and execute like normal. A virus from 2010, Win32/Lerock, used this technique to avoid detection.

Thankfully, the examples above and the other malformations outlined in the talk have no legitimate use, and thus can be detected simply due to their aberrant nature.

- Ben Greenberg

Black Hat Round Up

Black Hat was better than ever this year. I spent most of my time at our booth, but managed to squeeze a few briefings in as well. Highlights:

• Joe Skehan talked about SSH. Are you sure SSH1 has been eradicated from your network? Are you using 2048-bit keys? Are you managing your pre-shared keys? Most enterprises reply on SSH to manage access to all sorts of critical resources, but without good key management processes none of that fabulous crypto is going to help anybody. "Cryptography is the opiate of the naive," said Richard Thieme. More on him below.
  
  
• Mudge unveiled DARPA-RA-11-52, an initiative designed to harness the rising popularity of hackerspaces by giving them funding to innovate, plus freedom from the prohibitive red tape that's normally involved when dealing with the government. (Inventors keep their intellectual property, the feds get a license to use it.)
  
  
• Katie Moussouris from Microsoft announced their Blue Hat $200K prize. They're looking for "a novel runtime mitigation technology designed to prevent the exploitation of memory safety vulnerabilities." (Aren't we all: ASLR hasn't been good enough.)
  
  
• Richard Thieme delivered some...well, one of the attendees called it "visceral truth." It was a wide-ranging talk about individual world views being dominated by our personal narratives, about security sucking when it's merely a strategy for mitigating fear and not risk, about staring into the abyss, about the invisible corruption and dishonesty that permeates our lives. His advice? "Ask yourself: what am I doing?" 
  
  
• We gave away a thousand bucks. If you want to take a crack at our puzzle, it's still up—with all the hints included. Here's my favorite spoiler:
  
  

The Final Hint.

Stay tuned for some more technical Black Hat/DEFCON tidbits from Ben later in the week. So long geeks!

- Will Irace

WE HAVE A WINNER

Today, Rob Elkind solved our Decode This contest at the 2011 BlackHat USA Conference and won $1,000. Congratulations, Rob! You can still play, see here for full rules of the contest. The last hint will be announced at 4pm PDT today.

THREAT GEEK WEEKLY UPDATE – AUGUST 4, 2011

 

1.      Advanced Persistent Treats force IT to Rethink Security Priorities

The biggest business challenge today, in the minds of many information security officers, is the stealthy online infiltration by attackers to steal valuable proprietary information. The reality, they say, is that these so-called "advanced persistent threats" are so rampant and unrelenting they are forcing IT to rethink network security.

 

2.      How to Survive Black Hat and Defcon Without Getting Hacked -- Maybe

Among the thousands of security experts at the Black Hat, Defcon and Security BSides conferences next week in Las Vegas, some will surely test whether they can break into nearby laptops, phones, networks -- even RFID-enabled room keys and credit cards. Based on hacks in previous years, conference veterans realize the possibility of being owned, and some who blog have issued tips for how to use electronic devices safely and lock them down.

 

3.      Cyber Threat Resembles Pre-9/11 Terror Threat: Black Hat

Today's threat of cyber attacks is analogous to that from terrorists in the mid-1990s, Cofer Black, chairman of Total Intelligence Solutions and director of the CIA's counterterrorist center on 9/11, said in a keynote at Black Hat, a UBM TechWeb event, on Wednesday. When al Qaeda was in the rise in the mid-1990s, and even until the 9/11 attacks, Black said, terrorist threats were not well understood and were new to the country's top decision makers. "They didn't understand it. They had no personal experience with it," he said. "The decision-makers of today are in the same boat [with cyber]. They hear it, but they don't understand it."

 

4.      Take cyberthreats seriously, says counterterrorism expert

LAS VEGAS --Warnings about emerging cyberthreats shouldn't be treated with the same skepticism that many government officials showed toward the alarms sounded prior to the Sept. 11, 2001, terrorist attacks, warned a leading counterterrorism at the BlackHat security conference here Wednesday. Though many security experts agree that future conflicts will likely be fought in cyberspace, military and government officials have shown a hesitancy to act until they see a validation of the threats, said Cofer Black, former director of the CIA's Counterterrorism Center.

 

5.      Shady Rat Attacks Hit 70 Organizations, 14 Countries

Operation Shady Rat, a massive cyber-espionage campaign, has been under way for five years against national governments, global companies, nonprofits, and others, says McAfee. A massive advanced persistent threat (APT)-type attack campaign has been ongoing worldwide for five years that has stolen intellectual property from 70 government agencies, international corporations, nonprofits, and others in 14 countries, according to a new published report in Vanity Fair.

 

The ThreatGeek Top 5 is a weekly post that identifies relevant industry news and stories. Check in to stay up to date with the latest happenings throughout the industry.