Threat Geek

THREATtoons: Can Your CSO Identify a Threat

Want a THREATtoon on your blog or website? Great! Simply cite the cartoons original Threat Geek URL under the image and you’re good to go.

Justifying New Security Equipment After A Cyber Incident

While leading a cyber incident response, a client asked me how they could justify buying preventive security equipment to their executives. This is the same story that security professionals are faced with all the time. In companies where IT is not the primary revenue stream, security is always, has always been, and will always be a pure cost. By pure cost, I mean that security contributes no direct income to the bottom line. Of course, academics and IT gurus blog frequently about risk and how security keeps the revenue stream from drying-up; just look at companies that have lost millions due to cyber breaches. Unfortunately, in these cases, security can only be described as having an indirect influence on the bottom line. Stockholders and members of the board (in my experience) have a hard time understanding the minor nuances of indirect influence on revenue. I’m not going to go into the details on why business analysts and consultants make a ton of money determining the true cost of anything, but suffice to say that direct costs are easy to equate and indirect costs are more challenging. Of the indirect costs, security proves to be one of the more difficult.

Are We At a Cybersecurity Inflection Point?

Recently we hosted a group of journalists at the opening of our new Forensics Lab in Columbia, MD. In characterizing the state of cybersecurity, I told them that I think we are at a very important moment which we are going to look back on and realize this is when the public and private sector came together to begin to deal with the problem of cyber threats and attacks a different way.

ThreatToons: Network Forensics: The Modern-Day Sherlock Holmes

Want a THREATtoon on your blog or website? Great! Simply cite the cartoons original Threat Geek URL under the image and you’re good to go.

Hiding in Plain Sight

“Engage people with what they expect; it is what they are able to discern and confirms their projections. It settles them into predictable patterns of response, occupying their minds while you wait for the extraordinary moment — that which they cannot anticipate.” ― Sun Tzu, The Art of War

If you find yourself having difficulty identifying with the quote above, try re-reading it with the understanding that you and your organization are the target.

Cyber warfare is an asymmetric challenge in which the advisory holds almost all of the cards. There are an endless variety of methods by which those wishing to compromise your systems can attempt to do so, however we are quickly gaining ground in the fight through hard earned knowledge and have begun to lay down best practices which when applied and enforced can significantly lower the avenues of approach to your sensitive data, intellectual property or financial assets.

THREATTOONS: IS YOUR CSO PLAYING APRIL FOOLS' JOKES?

Want a THREATtoon on your blog or website? Great! Simply cite the cartoons original Threat Geek URL under the image and you’re good to go.

FIDELIS THREAT ADVISORY #1008: DARKSEOUL/JOKRA ANALYSIS AND RECOVERY

Fidelis Threat Advisory #1008

                                             DARKSEOUL/JOKRA ANALYSIS AND RECOVERY

A recent cyber-attack reported within the South Korean broadcasting and banking infrastructure reportedly brought down over 35,000 systems. This attack has drawn comparisons in intent and method to the recent wiping attack against Saudi Aramco by the Shamoon malware. Shamoon has been covered extensively by the community, and was covered in Fidelis Threat Advisory #1007. Naturally our curiosity was peaked and we acquired samples of the malware and started analysis.

The initial analysis has been posted on the Fidelis Threat Geek blog and will be expanded upon in this advisory. This write-up will focus on the wiper malware used and the recovery techniques that are possible.

From preliminary analysis it is known that the malware will overwrite the Master Boot Record (MBR) and Volume Boot Record (VBR). The records and files overwritten by the malware so far have been wiped with patterns of 'HASTATI' or 'PR!NCPES’.

The malware samples that have been analyzed by our team are different in code and function from the Shamoon malware. However, by using the same recovery methods found in advisory #1007 the files and data are indeed recoverable.

Download FTA 1008 - Darkseoul-Jokra Analysis and Recovery

ON YESTERDAY'S CYBER ATTACKS IN SOUTH KOREA

Yesterday brought news that a cyber attack caused widespread data destruction in the South Korean banking and media sectors. Researchers at General Dynamics Fidelis Cybersecurity Solutions obtained a copy of the malware involved in the attack and have some preliminary results to share. Our compliments to the talented folks at Alien Vault Labs, whose research on this subject can be viewed on their blog.

For purposes of our research, we’ll call this specimen “239ed75323.exe." It’s a malicious file capable of wiping data in disk drives. One of the areas it targets is the disk’s Master Boot Record (MBR), without which a computer cannot load its operating system. Multiple variants of this malware were observed in the community.

The malware writes a 512 bytes pattern to the disk. This pattern contains a repeating pattern of the word “HASTATI."

It was observed that the malware didn’t overwrite this pattern over the whole disk, so there is still data that can be recovered. We will release further information on a recovery process in an advisory to follow shortly.

The malware also tries to shut down security tools from the following two South Korean companies:

     - AhnLab, Inc. (AhnLab Policy Agent process)

     - HAURI Inc. (ViRobot ISMS process)

The file we examined has the following attributes:

         File Size:  24576 bytes
         MD5: 5fcd6e1dace6b0599429d913850f0364
         SHA1: 9f69da40dda6367789041aaff01cf61d562b7c21
         PE Time: 0x510A4706 [Thu Jan 31 10:27:18 2013 UTC]
         Sections (3):
           Name      Entropy MD5
           .text     5.42    0dcfb44a4e0fe644774322087d904c8e
           .rdata   2.97     95998eb10fd4f37dae63af28f22e1c97
           .data    0.58    0962d66235e80031b7bcfcbdb4335546

         At time of analysis, antivirus tools identified the file as follows:

AV Tool	Common Name
Malwarebytes	Trojan.MBR.Killer
Symantec	Trojan.Jokra
TrendMicro	TROJ_INJECTO.BDE
Sophos	Mal/EncPk-ACE
ViRobot	Trojan.Win32.U.KillMBR.24576.A
AhnLab-V3	Win-Trojan/Agent.24576.JPG
PCTools	Trojan.Jokra

Reversing the file revealed some of the following code responsible for writing the wiping pattern to the disk:

General Dynamics Fidelis Cybersecurity Solutions researchers detonated the malware in a controlled environment and confirmed it does indeed overwrite the disk with a repeating “HASTATI” pattern. The following will show the area in the VMDK disk before and after it was overwritten with the pattern:

First area at disk offset 0x3D0000 (location of MBR in virtual disk):

(before)

(after)

Second area at disk offset 0x3D7000 (location of VBR in virtual disk):

(before)

(after)

According to Wikipedia, the word “HASTATI” refers to “a class of infantry in the armies of the early Roman Republic who originally fought as spearmen, and later as swordsmen. They were originally some of the poorest men in the legion, and could afford only modest equipment, light amour and a large shield, in their service as the lighter infantry of the legion. Later, the Hastati contained the younger men rather than just the poorer, though most men of their age were relatively poor. Their usual position was the front battle line of the legion. They fought in a quincunx formation, supported by light troops.” J. Rickard, writing in a December 2002 article on HistoryOfWar.org, adds “the Hastati were expected to take the first clash of battle and blunt the enemy attack before the second line, the Principes took over and won the battle.”

The following are the two processes the malware tries to shutdown/kill:

“pasvc.exe”

• Command executed: “taskkill /F /IM pasvc.exe”
• Online research associates the “pasvc.exe” with a process from a company called AhnLab, Inc.
• AhnLab, Inc. is a security software company in South Korea. The company sells antivirus software.
• In specific, online research suggests that this process is associated with the AhnLab Policy Agent process.

“Clisvc.exe”

• Command executed: “taskkill /F /IM Clisvc.exe”
• Online research associates the “Clisvc.exe” with a process from a company called HAURI Inc.
• HAURI Inc. is a security software company in South Korea.
• In specific, online research suggests that this process is associated with the HAURI Inc. ViRobot ISMS security tool.

Researchers from the General Dynamics Fidelis Cybersecurity Solutions Network Defense and Forensics and Threat Research teams continue to monitor and study this event. Results of our research into a process for recovering a system infected by this attack will be released shortly.

Further Reading:

Alien Vault Labs:  Information about the South Korean banks and media systems attacks
http://labs.alienvault.com/labs/index.php/2013/information-about-the-south-korean-banks-and-media-systems-attacks/

Dark Reading: 'Loud' Data-Annihilation Cyberattacks Hit South Korean Banks, Media Outlets
http://www.darkreading.com/database-security/167901020/security/attacks-breaches/240151292/loud-data-annihilation-cyberattacks-hit-south-korean-banks-media-outlets.html

Naked Security: DarkSeoul: SophosLabs identifies malware used in South Korean internet attack
http://nakedsecurity.sophos.com/2013/03/20/south-korea-cyber-attack/

SecureList: South Korean 'Whois Team' attacks
http://www.securelist.com/en/blog/208194183/South_Korean_Whois_Team_attacks

TOOLS BREED TOOLS

I recently had a conversation with a friend who is now in charge of cybersecurity for a large company (100+ virtual and physical servers). He was prepared for the age-old cybersecurity problem of justifying a security budget from company leadership. All of us who work in the industry know the chicken and egg problem that has plagued security for years:

You: Boss, we need to spend $100,000 on security tools.

Boss: Why? What happened? Did we get hacked?!? Did we lose data?!?!!!

You: No, no, this is preventative and proactive so that we do not get hacked.

Boss: Have we ever been hacked? Why should we buy a tool if we’ve never been hacked?

You: We have no knowledge of ever being hacked, but we cannot tell if we are being hacked because we do not have these tools.

Boss: If we get hacked, are being hacked, or there’s a threat of being hacked, then we can buy the tools.

You: But... uh... if we do not have the tools, then we won’t know if we are hacked.

(Pre-2003) Boss: Not my problem.

(Post-2003) Boss: Okay, you can have $50,000.

After 2003, cybersecurity leaders found it easier to get that first set of annual funding for tools and resources to run their organization. My friend found this to be true as he went through his first fiscal budget process. However, he quickly ran into the newest problem for cyber security leaders. No longer is it good enough to simply get your budget and be content. Tools breed tools; resources breed resources.

He purchased his network security monitoring tool and found things on his network that require special attention. In other words, his investment was paying off, but, at what he would find, an expensive cost. The issues he found on the network required his staff to 1) figure out what was going on, 2) log the situations, 3) respond to the situations if nefarious activities were occurring and 4) prevent the situations from occurring in the future. He found that he needed more tools for steps 1, 3, and 4. His staff includes all cybersecurity people and they know how to work with very tight budgets. In the first step, when figuring out what was going on (i.e. what type of communication is occurring, from what applications, what are the sources and destinations, etc.), his team used open-source tools. Open-source is an indispensable avenue that remains a major part of any security team’s toolbox. However, he is anxious because he knows that as the organization grows, open-source may not remain a viable solution for monitoring his network.

Luckily, the tools that he purchased to perform monitoring also provide logging. So, his team has to keep a set of Word documents for each situation. He uses a unique numbering scheme to keep track of the situations for posterity. Each situation is stored in a Word document. More elegant systems (think helpdesk tickets) could be used, but that’s a software solution that costs more money. He thought about pushing for this but said, “I need more important software than a ticketing system.” He is right.

Then he came to the part in the incident response process of responding to a situation. His staff had nothing but open-source tools and they were not adequate to provide sufficient triage and information-gathering to respond appropriately. Therefore, he needed some type of forensic software. He has no idea how he’s going to ask for more money when it was such a hassle to get 50% of what he asked for last year.

And then there is the last part dealing with the prevention of the situation from occurring in the future, which is somewhat contingent on getting verification on the bad activity happening. He already requests his normal edge protection and internal data-layer protection, but specialty appliances? What a vexing situation.

So, the last time I talked to him he was faced with a quandary where he asked for a budget. Actually, he asked for double what he needed and received half. He bought his special monitoring software and found suspicious happenings on the network. Now, because he asked for the money and installed the software, he is forced to ask for more money to respond appropriately to the suspicious findings. He said, “If I had not asked for this in the beginning, then I wouldn’t have this problem. I wonder if they don’t want to know if bad things are happening.”

I think this problem is typical of how businesses operate in general, but applying so specifically to cybersecurity, it will plague leaders for years to come. For those up-and-coming professionals in leadership roles, you should be aware that once you get security tools, you’ll need more because tools breed tools. In my experience, the only organizations that have been given blank checks for cybersecurity are those who have been breached. Believe me; you don’t want that kind of blank check.

-Ryan Vela

THREATTOONS: DOES YOUR CSO HAVE WHAT IT TAKES TO WIN THE BIG PRIZE?

Want a THREATtoon on your blog or website? Great! Simply cite the cartoons original Threat Geek URL under the image and you’re good to go.