Threat Geek

Increasing Visibility to the Kill Chain: Detecting Earlier and Digging Deeper

A priority for network defenders is to find a potential threat at the earliest possible stage. While it is important to identify a system has been infected by observing the outbound command and control communication, the real benefit both in remediation time and potential data and financial loss is to detect the malicious file entering the network prior to the infection. Better still is to detect the exploit vector attempting to compromise a system before the malicious file is downloaded. Defense-in-depth not only applies to maintaining multiple solutions, but also ensuring those solutions scan several steps of the campaign lifecycle.

ThreatToons: Network Forensics: The Modern-Day Sherlock Holmes

Want a THREATtoon on your blog or website? Great! Simply cite the cartoons original Threat Geek URL under the image and you’re good to go.

Threat Geek Weekly Update - April 11, 2013

Hiding in Plain Sight

“Engage people with what they expect; it is what they are able to discern and confirms their projections. It settles them into predictable patterns of response, occupying their minds while you wait for the extraordinary moment — that which they cannot anticipate.” ― Sun Tzu, The Art of War

If you find yourself having difficulty identifying with the quote above, try re-reading it with the understanding that you and your organization are the target.

Cyber warfare is an asymmetric challenge in which the advisory holds almost all of the cards. There are an endless variety of methods by which those wishing to compromise your systems can attempt to do so, however we are quickly gaining ground in the fight through hard earned knowledge and have begun to lay down best practices which when applied and enforced can significantly lower the avenues of approach to your sensitive data, intellectual property or financial assets.

THREATTOONS: IS YOUR CSO PLAYING APRIL FOOLS' JOKES?

Want a THREATtoon on your blog or website? Great! Simply cite the cartoons original Threat Geek URL under the image and you’re good to go.

THREAT GEEK WEEKLY UPDATE - April 4, 2013

1. Advanced Persistent Threats: Not-So-Advanced Methods After All

Article Introduction: “Cybercriminals behind heavily funded hacking operations are not necessarily using highly sophisticated malware to gain access to sensitive data or to spy on employees, according to a study released this week by IBM (NYSE:IBM).”

2. Blocking zero-day application exploits: A new approach for APT prevention

Article Introduction: “Cybercriminals continue to develop new methods to bypass security controls in order to install malware on corporate endpoints. The recently discovered advanced persistent threat (APT) malware, Trojan.APT.BaneChant, uses multiple evasion techniques to bypass some of the newer detection approaches being utilized. First, the malware evades virtual machines by only executing the second stage of the attack after mouse activity is detected.”

3. Advanced vSkimmer botnet targets card payment terminals

Article Introduction: “The next evolution of credit card payment details extraction has hit Russian underground hacking forums in the form of the vSkimmer malware, a botnet that directly targets card payment terminals using Windows.”

4. Data Breach No Longer An IT Issue, It's A Business Issue

Article Introduction: “As enterprise go increasingly mobile and Bring Your Own Device (BYOD) becoming a way of corporate life, CISOs are facing a tough time maintaining a secure IT infrastructure. In conversation with Biztech2.com, John Kendall, Director, National Security Program, Unisys APAC reveals some critical challenges that stand in the CISO’s way and shares pointers on how to deal with them.”

5. Network Security Trumps Server Security in the Enterprise

Article Introduction: “There is a historical conundrum in cybersecurity about where to concentrate security skills, controls, and oversight. Hackers penetrate networks in order to compromise hosts and steal data. Given this obvious workflow, should CISOs focus security resources on networks, hosts, or a balanced combination of both?”

The Threat Geek Top 5 is a weekly post that identifies relevant industry news and stories. Check in to stay up to date with the latest happenings throughout the industry

THREATTOONS: WHERE ARE THE HIDING SPOTS IN YOUR NETWORK?

Want a THREATtoon on your blog or website? Great! Simply cite the cartoons original Threat Geek URL under the image and you’re good to go.

THREAT GEEK WEEKLY UPDATE - MARCH 28, 2013

1. New study finds malware variants skirting AV, mostly delivered via web

Article Introduction: “A recent study finds that a majority of malware variants have been delivered through the web, going completely undetected by anti-virus (AV) solutions.”

2. New malware shows Android has target on its back

Article Introduction: “Recently discovered Android malware used in targeted attacks against Tibetan and Uyghur activists in Europe is a warning to U.S. companies that mobile devices will likely be the mark in future cyberespionage attacks, experts say.”

3. The state of data breaches

Article Introduction: “The implications of data breaches can be severe for companies with potential financial losses and loss of customer trust.”

4. IT Concerns About Targeted Malware Rising

Article Introduction: “When it comes to servers, IT and security professionals' concerns about targeted malware and data breaches are escalating while their confidence in their ability to identify and stop advanced threats is on the decline, according to a new survey by security firm Bit9.”

5. Check Point: 63 Percent of Organizations Infected with Bots

Article Introduction: “Sixty-three percent of organizations were infected with bots, and more than half were infected with new malware at least once a day, according to the 2013 security report from Check Point.”

The ThreatGeek Top 5 is a weekly post that identifies relevant industry news and stories. Check in to stay up to date with the latest happenings throughout the industry

FIDELIS THREAT ADVISORY #1008: DARKSEOUL/JOKRA ANALYSIS AND RECOVERY

Fidelis Threat Advisory #1008

                                             DARKSEOUL/JOKRA ANALYSIS AND RECOVERY

A recent cyber-attack reported within the South Korean broadcasting and banking infrastructure reportedly brought down over 35,000 systems. This attack has drawn comparisons in intent and method to the recent wiping attack against Saudi Aramco by the Shamoon malware. Shamoon has been covered extensively by the community, and was covered in Fidelis Threat Advisory #1007. Naturally our curiosity was peaked and we acquired samples of the malware and started analysis.

The initial analysis has been posted on the Fidelis Threat Geek blog and will be expanded upon in this advisory. This write-up will focus on the wiper malware used and the recovery techniques that are possible.

From preliminary analysis it is known that the malware will overwrite the Master Boot Record (MBR) and Volume Boot Record (VBR). The records and files overwritten by the malware so far have been wiped with patterns of 'HASTATI' or 'PR!NCPES’.

The malware samples that have been analyzed by our team are different in code and function from the Shamoon malware. However, by using the same recovery methods found in advisory #1007 the files and data are indeed recoverable.

Download FTA 1008 - Darkseoul-Jokra Analysis and Recovery

THREATTOONS: IS SOMEONE AFTER YOUR POT OF GOLD?

Want a THREATtoon on your blog or website? Great! Simply cite the cartoons original Threat Geek URL under the image and you’re good to go.