October 25, 2014

Palo Alto Networks News of the Week – October 25

We’ve rounded up this week’s Palo Alto Networks news right here.

To aid you in deploying Advanced Endpoint Protection in your network, take a look at this newly released Advanced Endpoint Protection 3.1 documentation.

Unit 42 discussed CryptoWall 2.0, the latest version of this malware family that uses the Tor network for command and control. Learn how you can protect yourself.

Knowledge Is Power: Kate Taylor looks at using cyber scrutiny to defend against phishing attacks and examines how cybersecurity education significantly bolsters an enterprise’s cyber defense.

Unit 42’s Ryan Olson discusses Dridex, the latest descendent of the Bugat/Feodo/Cridex banking Trojan lineage, now being distributed through word documents and how to protect yourself against this wave of Dridex attacks.

We were honored with a 2014 STAR Award for Innovation in the Delivery of Support Services. The STAR Awards, which are presented by the Technology Services Industry Association (TSIA), are among the highest honors in the technology services industry.

We wrapped up a big week at VMworld Europe, where we were featured as part of VMware CEO Pat Gelsinger’s keynote address, announcing the latest milestone in our integration with VMware. Check out scenes from show.

We shared a video of our time at AFCEA TechNet Europe, including feedback from Palo Alto Networks stakeholders and an interview with Maj. Gen. Klaus-Peter Treche (ret), AFCEA EMEA Chair.

We’re on the road across North and South America with Citrix and CA for the next few weeks to talk about how enterprises can streamline virtualized data centers, radically simply network services for delivering critical applications and reduce complexity and cost, all without sacrificing performance and security. Join us at an event near you.

It was another successful year at Black Hat Europe where we met with attendees from more than 40 countries. We captured a few great photos at our booth during the show, check them out here.

We participated in Security Leaders 2014 in Brazil, an annual gathering of about 3,000 security professionals to discuss information security and risk for enterprises. Check out some photos from our time there.

The effective date for CIP version 5 Standards is rapidly approaching and entities are beginning to implement new controls to meet the updated requirements. During this webinar on October 29, Palo Alto Networks expert Del Rodillas, along with experts from EnergySec and ENMAX, will discuss the new requirements and potential technical approaches to meeting compliance obligations.

Palo Alto Networks returns to Infosecurity: The Netherlands on October 29 and 30. Visit our booth to hear about threats hiding in plain sight on your network, plus additional important insights from our 2014 Application Usage and Threat Report.

Here are upcoming events around the world that you should know about:

Datacenter Consolidation Seminar Series – Charlotte, NC

When: October 28, 2014 2:30 PM – 6:00 PM EST
Where: Charlotte, NC

Datacenter Consolidation Seminar Series – Houston, TX

When: October 28, 2014 11:00 AM – 2:30 PM CST
Where: Houston, TX

Datacenter Consolidation Seminar Series – Minneapolis, MN

When: October 28, 2014 11:00 AM – 2:30 PM CST
Where: Eden Prairie, MN

Next-Generation Firewall Live Demo Webinar [Dutch]

When: October 28, 2014 1:00 PM – 2:00 PM MEZ
Where: Online

Presales Technical Enablement Workshop

When: October 28, 2014 9:00 AM – 5:00 PM EST
Where: Tampa, FL

Webinar Santé [French]

When: October 28, 2014 10:30 AM – 11:30 AM EET
Where: Online

Hiding in Plain Sight – What’s Really Happening on Your Network [Dutch]

When: October 29, 2014 9:30 AM – 5:00 PM EET
Where: Utrecht

Next Generation Security Technical Workshop

When: October 29, 2014 10:00 AM – 1:00 PM GMT
Where: London

Palo Alto Networks: Live Demo

When: October 29, 2014 9:00 AM – 10:00 AM PST
Where: Online

Palo Alto’s Next-Generation Security – Ultimate Test Drive

When: October 29, 2014 9:00 AM – 1:00 PM EST
Where: Hanover, MD

Datacenter Consolidation Seminar Series – Raleigh, NC

When: October 30, 2014 2:30 PM – 6:00 PM EST
Where: Raleigh, NC

Организация защиты предприятия от сложных постоянных угроз (APT) [Russian]

When: October 30, 2014 10:30 AM – 12:00 PM GMT+4:00
Where: Online

Datacenter Consolidation Seminar Series – Anaheim, CA

When: November 4, 2014 11:00 AM – 1:30 PM PST
Where: Anaheim, CA

Datacenter Consolidation Seminar Series – Denver, CO

When: November 4, 2014 11:00 AM – 2:30 PM MST
Where: Denver, CO

Datacenter Consolidation Seminar Series – Edmonton, AB

When: November 4, 2014 11:00 AM – 2:30 PM MST
Where: Edmonton, AB

Datacenter Consolidation Seminar Series – Seattle, WA

When: November 4, 2014 11:00 AM – 1:30 PM PST
Where: Seattle, WA

Palo Alto Networks & Westcon Security Seminar [Italian]

When: November 4, 2014 10:00 AM – 2:30 PM CET
Where: Roma

Datacenter Consolidation Seminar Series – Calgary, AB

When: November 5, 2014 11:00 AM – 1:00 PM MST
Where: Calgary, AB

Datacenter Consolidation Seminar Series – Dallas, TX

When: November 5, 2014 11:00 AM – 1:00 PM CST
Where: Dallas, TX

Expose the Underground with Palo Alto Networks

When: November 5, 2014 6:00 PM – 8:00 PM EST
Where: Nashville, TN

Opplev styrken i Next-Generation Brannmurer [Norwegian]

When: November 5, 2014 1:00 PM – 2:00 PM MEZ
Where: Online

Palo Alto Networks: Live Demo

When: November 5, 2014 9:00 AM – 10:00 AM PST
Where: Online Event

Advanced Endpoint Protection with Palo Alto Networks

When: November 6, 2014 1:30 PM – 2:30 PM PST
Where: Online

Datacenter Consolidation Seminar Series – Cleveland, OH

When: November 6, 2014 11:00 AM – 1:00 PM EST
Where: Independence, OH

Datacenter Consolidation Seminar Series – Portland, OR

When: November 6, 2014 11:00 AM – 1:00 PM PST
Where: Portland, OR

Datacenter Consolidation Seminar Series – Scottsdale, AZ

When: November 6, 2014 11:00 AM – 1:00 PM MST
Where: Scottsdale, AZ

Datacenter Consolidation Seminar Series – Vancouver, BC

When: November 6, 2014 11:00 AM – 1:00 PM PST
Where: Vancouver, BC

Safe Application Enablement with Palo Alto Networks

When: November 6, 2014 10:00 AM – 11:00 AM PST
Where: Online

11月7日(金)製品体感ｾﾐﾅｰ [Japanese]

When: November 7, 2014 1:30 PM – 5:00 PM GMT+9:00
Where: 千代田区

[Palo Alto Networks Blog]

October 25, 2014

Dridex Banking Trojan Distributed Through Word Documents

Dridex, the latest descendent of the Bugat/Feodo/Cridex banking Trojan lineage has been a constant source of attacks using the malware since its release in July. To date, Dridex has centered on sending executable attachments via e-mail. That seems to have changed this week, as we’ve seen a tactical shift to sending those executable attachments via Microsoft Word documents loaded with macros that download and execute the malware.

Like its precursors, Dridex is a sophisticated Banking Trojan, similar to the infamous Zeus malware. Its core functionality is to steal credentials of online banking websites and allow a criminal to use those credentials to initiate transfers and steal funds. Dridex uses an XML-based configuration file to specify which websites it should target and other options for the malware. For instance, the configuration specifies which websites to capture form submissions from, and which to ignore with the following XML.

<url type=”deny”>/isapi/ocget.dll</url>

<url type=”allow”>^https?://aol.com/.*/login/</url>

<url type=”allow”>^https?://accounts.google.com/ServiceLoginAuth</url>

<url type=”allow”>^https?://login.yahoo.com/</url>

<url type=”allow”>^https?://login.live.com/</url>

<url type=”deny”>^https?://(\w+\.)?aol.com</url>

<url type=”deny”>^https?://(\w+\.)?facebook.com/</url>

<url type=”deny”>^https?://(\w+\.)?google</url>

<url type=”deny”>^https?://(\w+\.)?yahoo</url>

<url type=”deny”>^https?://(\w+\.)?youtube.com</url>

<url type=”deny”>^https?://(\w+\.)?live.com</url>

<url type=”deny”>^https?://(\w+\.)?twitter.com</url>

<url type=”deny”>^https?://(\w+\.)?vk.com</url>

<url type=”deny”>^https.*ocsp\..+$</url>

<url type=”deny”>^https.*safebrowsing\..+$</url>

<url type=”deny”>^https?://fhr\.data\.mozilla\.com</url>

<url type=”deny”>^https://s.*\.symcd\.com</url>

<url type=”deny”>^https://s.*\.symcb\.com</url>

<url type=”deny”>^https.*ocsp2\..+$</url>

<url type=”deny”>localhost.+skypectoc/.+$</url>

<url type=”deny”>\.messenger\.live\.com</url>

<url type=”deny”>pipe\.skype\.com</url>

<url type=”deny”>\.optimatic\.com</url>

<url type=”deny”>spotxchange\.com</url>

<url type=”deny”>nielsen\.com</url>

<url type=”deny”>mapquest\.com</url>

<url type=”deny”>^https://.+\.skype\.com/api/</url>

<url type=”deny”>(//|\.)lphbs.com</url>

<url type=”deny”>(//|\.)zynga.com</url>

</formgrabber>

The first wave of this attack began on October 21, with e-mails claiming to carry invoices fromHumber Merchant’s group. On October 22 and 23 (and today) we’ve seen new brands abused but the e-mails continued to use invoice themes. The organizations we’ve seen receiving these files break down into the following countries.

With this latest wave, WildFire has detected nine distinct Word documents, each of which uses the same technique to install Dridex. The word documents contain a complex VBA macro that downloads an executable from one of the following URLs and executes it on the system.

http://gpsbah[.]com/images/1.exe
http://jvsfiles[.]com/common/1.exe
http://jvssys[.]com/js/1.exe
http://mirafarm[.]ro/html/js/bin.exe
http://palitosdepan[.]com/js/bin.exe
http://www.juglarsa.com[.]ar/images/1.exe

These are all legitimate websites that appear to be compromised by the actors running this Dridex campaign. The files are each different versions of the Dridex malware that communicate with their command and control servers over HTTP. Kimberly from StopMalvertising has a great article on how this communication process works and allows Dridex to download its main criminal components.

While the latest attack began this week, Dridex has been in the wild since late July, and since then our WildFire system has been detecting Dridex variants very effectively. As a result, we pulled data on all of the malware we’ve seen talking to known Dridex command and control servers to get an idea of the volume of Dridex activity since its release. Abuse.ch operates theFeodo Tracker, which tracks these servers and those used by earlier versions of the Trojan.

While the latest attacks are certainly significant, the volume we’ve observed has been much lower than in July and August when the first variants of Dridex were first observed.

You can protect yourself against this wave of Dridex attacks by disabling macros in Microsoft Word. Macro-based malware has been around for over well over a decade. Most organizations should have them disabled by default, enabling macros only for trusted files.

[Palo Alto Networks Blog]

October 25, 2014October 25, 2014

CIP Version 5 Approaches: How Best to Secure Energy Utilities

The effective date for CIP version 5 Standards is rapidly approaching and entities are beginning to implement new controls to meet the updated requirements.

Palo Alto Networks expert Del Rodillas, along with experts from EnergySec and ENMAX will discuss the new requirements and potential technical approaches to meeting compliance obligations.

CIP Version 5 Standards: Electronic Security Perimeters and Interactive Remote Access

Wednesday, October 29, 2014, 10 a.m. PT / 1 p.m. ET
Register now.

For more on Palo Alto Networks solutions for ICS, SCADA and utilities

[Palo Alto Networks Blog]

October 25, 2014October 25, 2014

Ransomware Attacks Subvert Ad Networks

Security vendor Proofpoint warns in a new report that a “malvertising” campaign has been launching ransomware attacks against users of numerous high-profile websites, including search site Yahoo, dating site Match.com, and an AOL real estate site.

Proofpoint says it saw a surge earlier this month of malvertising exploits involving attackers serving real-looking advertisements that harbor malware on legitimate advertising networks.

“These types of malware infections are particularly effective because often the end user is not aware they have been infected,” says Mark James, an information security researcher at anti-virus firm ESET. “What would appear as an ordinary [legitimate] advertisement on a website can contain code that once the advertisement is clicked will infect your systems and could still deliver the advertised product.” Attackers often vary their attacks based on geography, which can make related malvertising campaigns difficult to spot, at least until the related levels of activity reach a “significant” level, Proofpoint says.

In the case of this criminal campaign, attackers’ malicious advertisements first targeted website users with the FlashPack Exploit Kit, which is designed to automatically exploit a number of known vulnerabilities in users’ browsers and browser plug-ins. If successful, the exploit kit then installed ransomware – malware that encrypts all data on a user’s PC and then demands a payment for the decryption key – called Cryptowall 2.0.

Tracking Cryptowall 2.0

The 2.0 version of Cryptowall was first spotted earlier this month by Finnish anti-virus firm F-Secure, which says the malware is using a custom component that allows it to communicate with command-and-control servers via the anonymizing Tor network, which helps disguise related infections. F-Secure says it first spotted criminals testing related tweaks to Cryptowall 1.0 this past summer, after which the changes were formally packaged up and released as Cryptowall 2.0. “We expect to see a lot more of Cryptowall 2.0 in the near future,” F-Secure trainee Artturi Lehtiö said in an Oct. 2 blog post.

That prediction soon came to pass. Proofpoint says it saw the malvertising campaign begin in late September. But related attacks didn’t spike until earlier this month, when they grew to expose approximately 3 million website users daily to related attacks.

Proofpoint says it contacted affected advertising networks, and by Oct. 18, they’d blocked the accounts that were being used to serve the malware. “The sites themselves were not compromised; rather, the advertising networks upon which they relied for dynamic content were inadvertently serving malware – which in turn, was not due to an explicit compromise of the networks; rather, it was due to the networks accepting ads from a malicious source without [proper] screening,” Proofpoint says.

While AOL and Match.com didn’t immediately respond to a request for comment about the Proofpoint report, a Yahoo spokeswoman confirms that the company has taken measures to block such attacks. “As soon as we detected the incident, we promptly removed the advertising and have continued to monitor and block any advertising being used for this activity,” she says.

Meanwhile, attackers continue to use Cryptowall for other in-the-wild attacks. Firewall vendorPalo Alto Networks reports that since Sept. 30, it’s spotted 84 new Cryptowall 2.0 variants. These variants target consumers “primarily through e-mail attachments but also through malicious PDFs and Web exploit kits,” it says. Those malicious PDFs would target users via phishing attacks, meaning the malicious documents would arrive attached to fake but real-looking e-mails.

Exploit Kits

While attackers continue to develop and refine their ransomware, the exploit kits they’re using to install Cryptoware – and numerous other types of malware – on victims’ PCs likewise continue to evolve. That’s due in large part to market demand: Exploit kits are predicated on exploiting a user’s PC through any means available, and security experts say there’s fierce competition among exploit-kit authors in search of more paying subscribers for their crimeware.

One currently popular crimeware kit, for example, is the Fiesta exploit kit, which security researchers at Cisco describe as being “aggressive” because it includes the ability to exploit not only common Java vulnerabilities, but also bugs in Microsoft Silverlight. While Oracle and Microsoft have released related patches, many users and businesses fail to install those updates in a timely manner, thus leaving them vulnerable to exploit-kit attacks.

After vendors release a security update for a product to fix flaws, exploit kit authors typically reverse-engineer the fixes to identify the flaws, and then add the ability to exploit those vulnerabilities to their kit.

How quickly do exploit kits get updated to take advantage of the latest flaws? This week, the Fiesta exploit kit reportedly received an update that allows it to exploit a Flash flaw that was patched by Adobe only last week. The “weaponized” version of the Flash flaw – an integer-overflow bug that’s been designated CVE-2014-0569 – was discovered by the malware researcher “Kafeine,” who maintains the “Malware don’t need Coffee” blog. Kafeine reports that the competing Angler exploit kit may also now be able to exploit the flaw.

In other words, just one week – or less – elapsed between Adobe issuing a public warning as well as related update that fixes the flaw, and attackers integrating the vulnerability into an exploit kit. That short timeframe shows the challenges facing consumers and enterprises that must keep their browser plug-ins – especially Flash and Java – up to date, or face a nearly constant risk of being hacked.

“The bad guys are not going to run short of vulnerabilities they can weaponize at a quicker rate than ever before,” security researcher Jérôme Segura, who works for anti-malware software firm Malwarebytes, says in a blog post. “This leaves end users with very little room for mistakes, such as failing to diligently apply security patches sooner rather than later.”

Follow Mathew J. Schwartz on Twitter: @euroinfosec

[Gov InfoSecurity]

Share this:

Share this:

For more on Palo Alto Networks solutions for ICS, SCADA and utilities

Share this:

Tracking Cryptowall 2.0

Exploit Kits

Share this: