Threat Geek

Increasing Visibility to the Kill Chain: Detecting Earlier and Digging Deeper

A priority for network defenders is to find a potential threat at the earliest possible stage. While it is important to identify a system has been infected by observing the outbound command and control communication, the real benefit both in remediation time and potential data and financial loss is to detect the malicious file entering the network prior to the infection. Better still is to detect the exploit vector attempting to compromise a system before the malicious file is downloaded. Defense-in-depth not only applies to maintaining multiple solutions, but also ensuring those solutions scan several steps of the campaign lifecycle.

ThreatToons: Network Forensics: The Modern-Day Sherlock Holmes

Want a THREATtoon on your blog or website? Great! Simply cite the cartoons original Threat Geek URL under the image and you’re good to go.

Hiding in Plain Sight

“Engage people with what they expect; it is what they are able to discern and confirms their projections. It settles them into predictable patterns of response, occupying their minds while you wait for the extraordinary moment — that which they cannot anticipate.” ― Sun Tzu, The Art of War

If you find yourself having difficulty identifying with the quote above, try re-reading it with the understanding that you and your organization are the target.

Cyber warfare is an asymmetric challenge in which the advisory holds almost all of the cards. There are an endless variety of methods by which those wishing to compromise your systems can attempt to do so, however we are quickly gaining ground in the fight through hard earned knowledge and have begun to lay down best practices which when applied and enforced can significantly lower the avenues of approach to your sensitive data, intellectual property or financial assets.

THREATTOONS: IS YOUR CSO PLAYING APRIL FOOLS' JOKES?

Want a THREATtoon on your blog or website? Great! Simply cite the cartoons original Threat Geek URL under the image and you’re good to go.

THREATTOONS: WHERE ARE THE HIDING SPOTS IN YOUR NETWORK?

Want a THREATtoon on your blog or website? Great! Simply cite the cartoons original Threat Geek URL under the image and you’re good to go.

FIDELIS THREAT ADVISORY #1008: DARKSEOUL/JOKRA ANALYSIS AND RECOVERY

Fidelis Threat Advisory #1008

                                             DARKSEOUL/JOKRA ANALYSIS AND RECOVERY

A recent cyber-attack reported within the South Korean broadcasting and banking infrastructure reportedly brought down over 35,000 systems. This attack has drawn comparisons in intent and method to the recent wiping attack against Saudi Aramco by the Shamoon malware. Shamoon has been covered extensively by the community, and was covered in Fidelis Threat Advisory #1007. Naturally our curiosity was peaked and we acquired samples of the malware and started analysis.

The initial analysis has been posted on the Fidelis Threat Geek blog and will be expanded upon in this advisory. This write-up will focus on the wiper malware used and the recovery techniques that are possible.

From preliminary analysis it is known that the malware will overwrite the Master Boot Record (MBR) and Volume Boot Record (VBR). The records and files overwritten by the malware so far have been wiped with patterns of 'HASTATI' or 'PR!NCPES’.

The malware samples that have been analyzed by our team are different in code and function from the Shamoon malware. However, by using the same recovery methods found in advisory #1007 the files and data are indeed recoverable.

Download FTA 1008 - Darkseoul-Jokra Analysis and Recovery

THREATTOONS: IS SOMEONE AFTER YOUR POT OF GOLD?

Want a THREATtoon on your blog or website? Great! Simply cite the cartoons original Threat Geek URL under the image and you’re good to go.

ON YESTERDAY'S CYBER ATTACKS IN SOUTH KOREA

Yesterday brought news that a cyber attack caused widespread data destruction in the South Korean banking and media sectors. Researchers at General Dynamics Fidelis Cybersecurity Solutions obtained a copy of the malware involved in the attack and have some preliminary results to share. Our compliments to the talented folks at Alien Vault Labs, whose research on this subject can be viewed on their blog.

For purposes of our research, we’ll call this specimen “239ed75323.exe." It’s a malicious file capable of wiping data in disk drives. One of the areas it targets is the disk’s Master Boot Record (MBR), without which a computer cannot load its operating system. Multiple variants of this malware were observed in the community.

The malware writes a 512 bytes pattern to the disk. This pattern contains a repeating pattern of the word “HASTATI."

It was observed that the malware didn’t overwrite this pattern over the whole disk, so there is still data that can be recovered. We will release further information on a recovery process in an advisory to follow shortly.

The malware also tries to shut down security tools from the following two South Korean companies:

     - AhnLab, Inc. (AhnLab Policy Agent process)

     - HAURI Inc. (ViRobot ISMS process)

The file we examined has the following attributes:

         File Size:  24576 bytes
         MD5: 5fcd6e1dace6b0599429d913850f0364
         SHA1: 9f69da40dda6367789041aaff01cf61d562b7c21
         PE Time: 0x510A4706 [Thu Jan 31 10:27:18 2013 UTC]
         Sections (3):
           Name      Entropy MD5
           .text     5.42    0dcfb44a4e0fe644774322087d904c8e
           .rdata   2.97     95998eb10fd4f37dae63af28f22e1c97
           .data    0.58    0962d66235e80031b7bcfcbdb4335546

         At time of analysis, antivirus tools identified the file as follows:

AV Tool	Common Name
Malwarebytes	Trojan.MBR.Killer
Symantec	Trojan.Jokra
TrendMicro	TROJ_INJECTO.BDE
Sophos	Mal/EncPk-ACE
ViRobot	Trojan.Win32.U.KillMBR.24576.A
AhnLab-V3	Win-Trojan/Agent.24576.JPG
PCTools	Trojan.Jokra

Reversing the file revealed some of the following code responsible for writing the wiping pattern to the disk:

General Dynamics Fidelis Cybersecurity Solutions researchers detonated the malware in a controlled environment and confirmed it does indeed overwrite the disk with a repeating “HASTATI” pattern. The following will show the area in the VMDK disk before and after it was overwritten with the pattern:

First area at disk offset 0x3D0000 (location of MBR in virtual disk):

(before)

(after)

Second area at disk offset 0x3D7000 (location of VBR in virtual disk):

(before)

(after)

According to Wikipedia, the word “HASTATI” refers to “a class of infantry in the armies of the early Roman Republic who originally fought as spearmen, and later as swordsmen. They were originally some of the poorest men in the legion, and could afford only modest equipment, light amour and a large shield, in their service as the lighter infantry of the legion. Later, the Hastati contained the younger men rather than just the poorer, though most men of their age were relatively poor. Their usual position was the front battle line of the legion. They fought in a quincunx formation, supported by light troops.” J. Rickard, writing in a December 2002 article on HistoryOfWar.org, adds “the Hastati were expected to take the first clash of battle and blunt the enemy attack before the second line, the Principes took over and won the battle.”

The following are the two processes the malware tries to shutdown/kill:

“pasvc.exe”

• Command executed: “taskkill /F /IM pasvc.exe”
• Online research associates the “pasvc.exe” with a process from a company called AhnLab, Inc.
• AhnLab, Inc. is a security software company in South Korea. The company sells antivirus software.
• In specific, online research suggests that this process is associated with the AhnLab Policy Agent process.

“Clisvc.exe”

• Command executed: “taskkill /F /IM Clisvc.exe”
• Online research associates the “Clisvc.exe” with a process from a company called HAURI Inc.
• HAURI Inc. is a security software company in South Korea.
• In specific, online research suggests that this process is associated with the HAURI Inc. ViRobot ISMS security tool.

Researchers from the General Dynamics Fidelis Cybersecurity Solutions Network Defense and Forensics and Threat Research teams continue to monitor and study this event. Results of our research into a process for recovering a system infected by this attack will be released shortly.

Further Reading:

Alien Vault Labs:  Information about the South Korean banks and media systems attacks
http://labs.alienvault.com/labs/index.php/2013/information-about-the-south-korean-banks-and-media-systems-attacks/

Dark Reading: 'Loud' Data-Annihilation Cyberattacks Hit South Korean Banks, Media Outlets
http://www.darkreading.com/database-security/167901020/security/attacks-breaches/240151292/loud-data-annihilation-cyberattacks-hit-south-korean-banks-media-outlets.html

Naked Security: DarkSeoul: SophosLabs identifies malware used in South Korean internet attack
http://nakedsecurity.sophos.com/2013/03/20/south-korea-cyber-attack/

SecureList: South Korean 'Whois Team' attacks
http://www.securelist.com/en/blog/208194183/South_Korean_Whois_Team_attacks

BORED BETWEEN CASES?

Bored between cases? Check out this portal that shows real-time attacks hitting Deutsche Telekom honeypots (http://www.sicherheitstacho.eu/). According to Thomas Kremer (Board Member for Data Privacy, Legal Affairs and Compliance), Deutsche Telekom has taken a proactive approach to perform threat monitoring. The company has taken the lead in coordinating attack information from over 90 honeypots, 55 of which they own. The honeypots collect over 400,000 attacks per day (that’s 4-5 attacks per second). According to its news release, the company uses the data collected from the honey pots to create or enhance defensive capabilities. The website uses a view of the globe and when an attack occurs, a red dot on the source country is pinged. Around the map are statistics from last month for the top-15 source countries, top-5 attack types, types and distribution of attack targets and the total of both attacks and attackers per day.

I would expect nothing less from a telecommunication provider. What I did not expect was to find an online portal with real-time statistics of the attack vectors directly from their honeypots – at least not without some sort of login.

Another popular real-time and graphical honeypot reporting website is honeynet.org (http://map.honeynet.org/), which was also created by two Germans.

I can understand why academic researchers like Florian Weingarten and Mark Schloesser, both from HoneyMap, would create and publish such a webpage, but why would a company that sells to businesses, governments and consumers do the same? What would justify spending money and resources in publishing a graphical interface displaying attack sources as they happen? One could make an argument for corporate social responsibility (CSR) or business ethics, but I don’t want to waste brain power on the steganographic marketing scheme that is CSR. Instead, I would like to assume that a company like Deutsche Telekom would be motivated to create a gratuitous offering of information similar to why a company would place their corporate headquarters in sharp and professional-looking buildings with trimmed foliage exteriors and inviting interiors. The goal is to present to future customers and existing customers that the company is serious about business and will be around for a long time. Similarly, presenting a honeypot attack map demonstrates to existing and future customers that the company is committed to investing in what they see as being (potential) future costs in terms of breaches into its own network or customer networks. The bottom line is that, as with most everything in cybersecurity, the ROI on investing in threat analysis rarely ties directly to short-term and direct revenue lines. Instead, companies like Deutsche Telekom realize that investing in threat analysis affects long-term and indirect revenue lines.

The Deutsche Telekom website is a product of a partnership with the Allianz für Cyber-Sicherheit (Alliance for Cyber Security), a government-sponsored joint initiative between the German Federal Office for Information Security (BSI) and the German Association for Information Technology, Telecommunication and New Media (BITKOM).

T-Systems (an operational subsidiary of Deutsche Telekom) maintains the site and is Germany’s largest and one of the largest European IT services companies. Viewers will immediately recognize the letter “T” in the company’s logo because Deutsche Telekom also owns T-Mobile. T-Systems provides primarily B2B and B2G services with other operational arms of the company providing mobile, landline, broadband and TV services. According to its 2012 annual report, Deutsche Telekom reorganized its internal IT infrastructure by consolidating them into a new Telekom IT unit. Based on my experience in working with global organizations, consolidation not only saves cost but it can foster positive collaboration and information exchange, assuming leaders promote such collaboration and exchange within the newly consolidated environment. Without knowing the inner-workings of the new IT organization, the honeypot sensors and information output appear to be very encouraging effects of positive information sharing.

-Ryan Vela

TOOLS BREED TOOLS

I recently had a conversation with a friend who is now in charge of cybersecurity for a large company (100+ virtual and physical servers). He was prepared for the age-old cybersecurity problem of justifying a security budget from company leadership. All of us who work in the industry know the chicken and egg problem that has plagued security for years:

You: Boss, we need to spend $100,000 on security tools.

Boss: Why? What happened? Did we get hacked?!? Did we lose data?!?!!!

You: No, no, this is preventative and proactive so that we do not get hacked.

Boss: Have we ever been hacked? Why should we buy a tool if we’ve never been hacked?

You: We have no knowledge of ever being hacked, but we cannot tell if we are being hacked because we do not have these tools.

Boss: If we get hacked, are being hacked, or there’s a threat of being hacked, then we can buy the tools.

You: But... uh... if we do not have the tools, then we won’t know if we are hacked.

(Pre-2003) Boss: Not my problem.

(Post-2003) Boss: Okay, you can have $50,000.

After 2003, cybersecurity leaders found it easier to get that first set of annual funding for tools and resources to run their organization. My friend found this to be true as he went through his first fiscal budget process. However, he quickly ran into the newest problem for cyber security leaders. No longer is it good enough to simply get your budget and be content. Tools breed tools; resources breed resources.

He purchased his network security monitoring tool and found things on his network that require special attention. In other words, his investment was paying off, but, at what he would find, an expensive cost. The issues he found on the network required his staff to 1) figure out what was going on, 2) log the situations, 3) respond to the situations if nefarious activities were occurring and 4) prevent the situations from occurring in the future. He found that he needed more tools for steps 1, 3, and 4. His staff includes all cybersecurity people and they know how to work with very tight budgets. In the first step, when figuring out what was going on (i.e. what type of communication is occurring, from what applications, what are the sources and destinations, etc.), his team used open-source tools. Open-source is an indispensable avenue that remains a major part of any security team’s toolbox. However, he is anxious because he knows that as the organization grows, open-source may not remain a viable solution for monitoring his network.

Luckily, the tools that he purchased to perform monitoring also provide logging. So, his team has to keep a set of Word documents for each situation. He uses a unique numbering scheme to keep track of the situations for posterity. Each situation is stored in a Word document. More elegant systems (think helpdesk tickets) could be used, but that’s a software solution that costs more money. He thought about pushing for this but said, “I need more important software than a ticketing system.” He is right.

Then he came to the part in the incident response process of responding to a situation. His staff had nothing but open-source tools and they were not adequate to provide sufficient triage and information-gathering to respond appropriately. Therefore, he needed some type of forensic software. He has no idea how he’s going to ask for more money when it was such a hassle to get 50% of what he asked for last year.

And then there is the last part dealing with the prevention of the situation from occurring in the future, which is somewhat contingent on getting verification on the bad activity happening. He already requests his normal edge protection and internal data-layer protection, but specialty appliances? What a vexing situation.

So, the last time I talked to him he was faced with a quandary where he asked for a budget. Actually, he asked for double what he needed and received half. He bought his special monitoring software and found suspicious happenings on the network. Now, because he asked for the money and installed the software, he is forced to ask for more money to respond appropriately to the suspicious findings. He said, “If I had not asked for this in the beginning, then I wouldn’t have this problem. I wonder if they don’t want to know if bad things are happening.”

I think this problem is typical of how businesses operate in general, but applying so specifically to cybersecurity, it will plague leaders for years to come. For those up-and-coming professionals in leadership roles, you should be aware that once you get security tools, you’ll need more because tools breed tools. In my experience, the only organizations that have been given blank checks for cybersecurity are those who have been breached. Believe me; you don’t want that kind of blank check.

-Ryan Vela