Threat Geek

What Type of Kit Do You Take With You?

It seems like there is a kit for everything these days. There are first aid kits, cooking kits, car repair kits, even applications such as web kits. What type of kit is out there for the World Wide Web? Do you even need a kit, and if so what should be in it?

THREATtoons: Can Your CSO Identify a Threat

Want a THREATtoon on your blog or website? Great! Simply cite the cartoons original Threat Geek URL under the image and you’re good to go.

Are We At a Cybersecurity Inflection Point?

Recently we hosted a group of journalists at the opening of our new Forensics Lab in Columbia, MD. In characterizing the state of cybersecurity, I told them that I think we are at a very important moment which we are going to look back on and realize this is when the public and private sector came together to begin to deal with the problem of cyber threats and attacks a different way.

FIDELIS THREAT ADVISORY #1008: DARKSEOUL/JOKRA ANALYSIS AND RECOVERY

Fidelis Threat Advisory #1008

                                             DARKSEOUL/JOKRA ANALYSIS AND RECOVERY

A recent cyber-attack reported within the South Korean broadcasting and banking infrastructure reportedly brought down over 35,000 systems. This attack has drawn comparisons in intent and method to the recent wiping attack against Saudi Aramco by the Shamoon malware. Shamoon has been covered extensively by the community, and was covered in Fidelis Threat Advisory #1007. Naturally our curiosity was peaked and we acquired samples of the malware and started analysis.

The initial analysis has been posted on the Fidelis Threat Geek blog and will be expanded upon in this advisory. This write-up will focus on the wiper malware used and the recovery techniques that are possible.

From preliminary analysis it is known that the malware will overwrite the Master Boot Record (MBR) and Volume Boot Record (VBR). The records and files overwritten by the malware so far have been wiped with patterns of 'HASTATI' or 'PR!NCPES’.

The malware samples that have been analyzed by our team are different in code and function from the Shamoon malware. However, by using the same recovery methods found in advisory #1007 the files and data are indeed recoverable.

Download FTA 1008 - Darkseoul-Jokra Analysis and Recovery

ON YESTERDAY'S CYBER ATTACKS IN SOUTH KOREA

Yesterday brought news that a cyber attack caused widespread data destruction in the South Korean banking and media sectors. Researchers at General Dynamics Fidelis Cybersecurity Solutions obtained a copy of the malware involved in the attack and have some preliminary results to share. Our compliments to the talented folks at Alien Vault Labs, whose research on this subject can be viewed on their blog.

For purposes of our research, we’ll call this specimen “239ed75323.exe." It’s a malicious file capable of wiping data in disk drives. One of the areas it targets is the disk’s Master Boot Record (MBR), without which a computer cannot load its operating system. Multiple variants of this malware were observed in the community.

The malware writes a 512 bytes pattern to the disk. This pattern contains a repeating pattern of the word “HASTATI."

It was observed that the malware didn’t overwrite this pattern over the whole disk, so there is still data that can be recovered. We will release further information on a recovery process in an advisory to follow shortly.

The malware also tries to shut down security tools from the following two South Korean companies:

     - AhnLab, Inc. (AhnLab Policy Agent process)

     - HAURI Inc. (ViRobot ISMS process)

The file we examined has the following attributes:

         File Size:  24576 bytes
         MD5: 5fcd6e1dace6b0599429d913850f0364
         SHA1: 9f69da40dda6367789041aaff01cf61d562b7c21
         PE Time: 0x510A4706 [Thu Jan 31 10:27:18 2013 UTC]
         Sections (3):
           Name      Entropy MD5
           .text     5.42    0dcfb44a4e0fe644774322087d904c8e
           .rdata   2.97     95998eb10fd4f37dae63af28f22e1c97
           .data    0.58    0962d66235e80031b7bcfcbdb4335546

         At time of analysis, antivirus tools identified the file as follows:

AV Tool	Common Name
Malwarebytes	Trojan.MBR.Killer
Symantec	Trojan.Jokra
TrendMicro	TROJ_INJECTO.BDE
Sophos	Mal/EncPk-ACE
ViRobot	Trojan.Win32.U.KillMBR.24576.A
AhnLab-V3	Win-Trojan/Agent.24576.JPG
PCTools	Trojan.Jokra

Reversing the file revealed some of the following code responsible for writing the wiping pattern to the disk:

General Dynamics Fidelis Cybersecurity Solutions researchers detonated the malware in a controlled environment and confirmed it does indeed overwrite the disk with a repeating “HASTATI” pattern. The following will show the area in the VMDK disk before and after it was overwritten with the pattern:

First area at disk offset 0x3D0000 (location of MBR in virtual disk):

(before)

(after)

Second area at disk offset 0x3D7000 (location of VBR in virtual disk):

(before)

(after)

According to Wikipedia, the word “HASTATI” refers to “a class of infantry in the armies of the early Roman Republic who originally fought as spearmen, and later as swordsmen. They were originally some of the poorest men in the legion, and could afford only modest equipment, light amour and a large shield, in their service as the lighter infantry of the legion. Later, the Hastati contained the younger men rather than just the poorer, though most men of their age were relatively poor. Their usual position was the front battle line of the legion. They fought in a quincunx formation, supported by light troops.” J. Rickard, writing in a December 2002 article on HistoryOfWar.org, adds “the Hastati were expected to take the first clash of battle and blunt the enemy attack before the second line, the Principes took over and won the battle.”

The following are the two processes the malware tries to shutdown/kill:

“pasvc.exe”

• Command executed: “taskkill /F /IM pasvc.exe”
• Online research associates the “pasvc.exe” with a process from a company called AhnLab, Inc.
• AhnLab, Inc. is a security software company in South Korea. The company sells antivirus software.
• In specific, online research suggests that this process is associated with the AhnLab Policy Agent process.

“Clisvc.exe”

• Command executed: “taskkill /F /IM Clisvc.exe”
• Online research associates the “Clisvc.exe” with a process from a company called HAURI Inc.
• HAURI Inc. is a security software company in South Korea.
• In specific, online research suggests that this process is associated with the HAURI Inc. ViRobot ISMS security tool.

Researchers from the General Dynamics Fidelis Cybersecurity Solutions Network Defense and Forensics and Threat Research teams continue to monitor and study this event. Results of our research into a process for recovering a system infected by this attack will be released shortly.

Further Reading:

Alien Vault Labs:  Information about the South Korean banks and media systems attacks
http://labs.alienvault.com/labs/index.php/2013/information-about-the-south-korean-banks-and-media-systems-attacks/

Dark Reading: 'Loud' Data-Annihilation Cyberattacks Hit South Korean Banks, Media Outlets
http://www.darkreading.com/database-security/167901020/security/attacks-breaches/240151292/loud-data-annihilation-cyberattacks-hit-south-korean-banks-media-outlets.html

Naked Security: DarkSeoul: SophosLabs identifies malware used in South Korean internet attack
http://nakedsecurity.sophos.com/2013/03/20/south-korea-cyber-attack/

SecureList: South Korean 'Whois Team' attacks
http://www.securelist.com/en/blog/208194183/South_Korean_Whois_Team_attacks

THREATTOONS: BEWARE THE IDES OF MARCH!

Want a THREATtoon on your blog or website? Great! Simply cite the cartoons original Threat Geek URL under the image and you’re good to go.

THREATTOONS: DO YOU NEED TO PICK UP YOUR NETWORK DEFENSE?

Want a THREATtoon on your blog or website? Great! Simply cite the cartoons original Threat Geek URL under the image and you’re good to go.

THREATTOONS: DOES YOUR CSO HAVE WHAT IT TAKES TO WIN THE BIG PRIZE?

Want a THREATtoon on your blog or website? Great! Simply cite the cartoons original Threat Geek URL under the image and you’re good to go.

KEYS TO DEVELOPING SOUND CYBERSECURITY POSTURE

Microsoft’s report (Special Edition Microsoft Security Intelligence Report: Linking Cybersecurity Policy and Performance, http://aka.ms/securityatlas) correlates malware infections with the level of cybersecurity policy involvement of a country. While this publication will undoubtedly receive a lot of press, readers must take the data as only a starting point. The authors, Aaron Kleiner, Paul Nicholas and Kevin Sullivan, present clear and repeatable statistical analysis, and while they state that their conclusions are based on correlation, they can easily be taken as causal. In other words, a country’s cybersecurity posture may not necessarily be a cause of their malware infection effect or vulnerability. Additionally, the report only speaks to Microsoft OS malware and not other operating systems or appliances that may be vulnerable.

Their statistics are sound and their conclusions will be debated as cybersecurity policy continues to make headlines. The statistics do not take into account the impact of one piece of malware versus another. What experience has shown me is that a person or company’s security posture is driven by industry standards, government regulation and revenue-influencing measures. Thus, when I consult, I always begin and end with a security-in-depth methodology. Starting with the self, a company has a responsibility to shareholders, employees, customers and the bottom line. Any perceived or actual impact to any of these stakeholders has an impact to revenue-generating numbers either in profit or in cost. Securing an infrastructure for the “self” is the first area. The second area is with industry, which is going to be less specific than a company’s “self.” Many industries have guidelines, standards or best practices that ensure good faith business-to-business interaction at a minimum and foundations for legal business requirements at its strictest. Then there are government regulations that could originate from either the government directly or from indirect sources via government mandates. Strengthening a company’s posture paying attention to the self, to the industry and to the regulations is the first place to start for cybersecurity posturing.

Microsoft’s report correlates country policies to malware infections on their operating systems within that country. The correlation is an interesting read, but to develop a foundation for more in-depth analysis other factors must be taken into consideration. Simply because a country does not have a lot of malware infections, then should they not worry about cybersecurity policies? Or, if a country has a very high number of infections, should they scrap their existing cybersecurity efforts? The answer to both of these is obviously no. Cybersecurity is a global landscape without country borders, without language barriers and without cultural walls. All countries whether they think they have a cybersecurity problem or not should be paying attention to cyber policies.  A key in building safety in the cyberspace is to participate in policy strategy management where emphasis and effort is placed on securing their “self,” their people, their infrastructure and their ICT. Regional groups and global exchanges are also effective tactics in developing regional policies and increasing the overall awareness in the cybersecurity industry.

I commend Microsoft’s Global and Security Strategy and Diplomacy team in allowing the world to review their statistics. While it is a big drop in the bucket, Microsoft is only a portion of the larger picture. The most significant result of this paper is a reiteration that 1) we only have the potential smarts based on the information we have available, and 2) we only are as smart as how we use that information. We need to know what infected our computer yesterday, what is stealing our data today and what will hack into our network tomorrow. Only with this knowledge can we can determine how to protect our network, protect our country, and protect our world.

-Ryan Vela

THREATTOONS: IS YOUR CSO FAST ENOUGH TO OUTRUN THREATS IN THE BIG GAME?

Want a THREATtoon on your blog or website? Great! Simply cite the cartoons original Threat Geek URL under the image and you’re good to go.