Today marks Data Privacy Day, and ISACA is proud to be a champion of this initiative. The purpose of Data Privacy Day is to raise awareness and promote privacy and data protection best practices. The debate over privacy seems to have shifted to a larger discussion about new types of personal information, such as location information, browsing history, Internet of Things data, individual rights and enterprise use of personal data. This expanding debate results from the proliferation of technologies, opportunities for enterprises to gain value by leveraging new data items and government’s interest in e-government initiatives. This includes taking action to protect citizens and promoting the economic opportunities that personal data use brings. The volume of personal, and often sensitive, data being collected and shared by organizations today is growing exponentially—largely because of technology advances, lower data storage costs, the rise of the Internet of Things and the emergence of major data brokerage companies.
To help the global community implement a corresponding privacy management program, ISACA created a Privacy Guidance Task Force. Its first task was to conduct a survey regarding enterprises’ privacy governance structures and how various privacy issues and concerns are addressed. Clearly, one of the main obstacles is the complex international legal and regulatory landscape. While everybody may be in agreement on the principles, their implementation through laws and/or regulation differs across the world and, in some cases, in the same country, by state and industry sector. Obviously, business may only influence the lawmakers to try to harmonize their position. This will be difficult as privacy is a cultural issue. ISACA’s survey was recently conducted, and results will be published in the near future.
Enterprises need to embed privacy as an integral component of their overall governance, risk management and compliance (GRC) frameworks. Embedding privacy into GRC frameworks requires a holistic approach. COBIT 5 defines a set of enablers to support the implementation of a comprehensive governance and management system for enterprise IT and information.
As a result, the next Task Force action is to create practical guidance explaining how the COBIT 5 enablers may be used for implementing privacy in practice. It will provide specific guidance related to all enablers:
Information privacy policies, principles and frameworks
Processes, including personal data privacy—specific details and activities
Privacy-specific organisational structures
In terms of culture, ethics and behaviour, factors determining the success of privacy governance and management
Privacy-specific information types for enabling information security governance and management within the enterprise
Service capabilities required to provide privacy and related functions to an enterprise
People, skills and competencies specific for privacy
This will constitute a framework that can be tailored to any organization. Large companies with locations in multiple jurisdictions may need to consider different internal oversight mechanisms than small or medium sized companies with a single establishment. Similarly, programs for companies that deal with large volumes of personal data will need to be more comprehensive than those of companies who handle only limited amounts of personal data. The sensitivity of the data processed may also impact the nature of a privacy management program, as even a very small company may handle extremely sensitive personal data.
With the survey and practical guidance targeted to be published in 2015, ISACA will continue on its mission to contribute effectively to the promotion of privacy and data protection best practices.
Yves LeRoux, CISM, CISSP
Principal Consultant at CA Technologies
The Cybersecurity Canon is official, and you can now see our website here. We modeled it after the Baseball or Rock & Roll Hall-of-Fame, except for cybersecurity books. We have 20 books on the initial candidate list but we are soliciting help from the cybersecurity community to increase the number to be much more than that. Please write a review and nominate your favorite.
The Cybersecurity Canon is a real thing for our community. We have designed it so that you can directly participate in the process. Please do so!
Remember: public Internet voting begins on February 1, and your vote counts!
Book Review: Countdown to Zero Day: Stuxnet and the Launch of the World’s First Digital Weapon by Kim Zetter
Executive Summary
Operation Olympic Games is the US military code name that refers to the first ever act of real cyber warfare. Many journalists have told bits and pieces of the story since the attacks became public back in 2010, but none have come close to telling the complete story. In Countdown to Zero Day: Stuxnet and the Launch of the World’s First Digital Weapon, Kim Zetter changes that situation. She takes an extremely complicated subject in terms of technical detail, political fallout and philosophical conundrums and makes it easy for the security practitioner to understand. It is a masterful bit of juggling and storytelling. It is Cybersecurity Canon-worthy and you should have read it by now.
Introduction
Kim Zetter has been at Wired Magazine since 2003 and has become one of the cybersecurity community’s go-to journalists to explain what is really happening within the space. When I heard that she was writing a book about the Stuxnet attacks, I was thrilled. I knew if anybody could take on this complicated subject, Zetter could.
One of the annoying truisms of keeping up with cybersecurity events in the news is that journalists rarely go back and attempt to tell a complete story. When cybersecurity events occur – like the Target breach, the Sony breach, and the Home Depot breach to name three — news organization print the big headlines initially and then trickle out new information over the next days and weeks as it becomes available. For cybersecurity professionals trying to remain current, we rarely get the opportunity to see the big picture in one lump sum. We are not going to get that kind of story in a news article. You need a book to cover the detail and there have been some good ones in the past. Mark Bowden’s Worm — about the Conficker Worm and the cabal that tried to stop it — is one good example. Cuckoo’s Egg – about the first publically documented cyber espionage attack back in the late 1980s – is another one. Zetter’s book,Countdown to Zero Day: Stuxnet and the Launch of the World’s First Digital Weapon, is the latest in this line and it is really good.
The Story
Operation Olympic Games is the US military code name that refers to the first ever act of real cyber warfare. Many journalists have told bits and pieces of the story since the attacks became public back in 2010, but none have come close to telling the complete story.
In both the articles and the book, he gave details about the cyber operation called Operation Olympic Games that I consider to be the first act of cyber warfare in the world. But because the story was so new and so complicated, many of the technical details surrounding the attacks did not fully emerge until well after Sanger published his book. I have tried to keep up with the story myself over the years and even presented versions of it at DEFCON and RSA, based on the information available. But I do not have the journalistic chops to tell the complete story and this is where Zetter’s book shines.
Where Sanger’s book focused on the US foreign policy implications of offensive cyber warfare using government insiders as the main source, Zetter’s book fills in the technical story behind the attacks by interviewing everybody in the public space that was involved in unraveling the Stuxnet mystery. Zetter writes clearly and succinctly about the timing of key researchers discovering new facts, describes how the researchers determined when the attackers first used key pieces of the attack code and then feathered those technical events with what was happening in the political arena at the same time. It is a masterful bit of juggling and storytelling.
The Code
Because of Countdown to Zero, we now have a complete picture of how the attack code worked. Zetter goes into great detail about how the malware proliferated within the Iranian power plant at Natanz and after it escaped into the wild. She puts to bed the question of how may zero day exploits the attackers used in the complete code set, what they were and how effective they all were. She covers all of the versions of the malware from Stuxnet, to DuQu, to Flame and to Wiper. She even covers some of the researcher’s Tools-of-the-Trade that they used to decipher the code base.
SCADA
In Countdown to Zero, Zetter explains the significance of the critical and mostly unsecured SCADA (Supervisory Control and Data Acquisition) environments deployed in the US today. These systems automatically control the flow of all power, water, and gas systems used within the US and throughout most of the world. According to Zetter,
“There are 2,800 power plants in the United States and 300,000 sites producing oil and natural gas. Another 170,000 Bottom of Form facilities form the public water system in the United States, which includes reservoirs, dams, wells, treatment facilities, pumping stations, and pipelines. But 85 percent of these and other critical infrastructure facilities are in the hands of the private sector, which means that aside from a few government-regulated industries—such as the nuclear power industry—the government can do little to force companies to secure their systems.”
In my experience, the SCADA industry has always been at least 10 to 15 years behind the rest of the commercial sector in adopting modern defensive techniques. From Zetter,
“Why spend money on security, they argued, when none of their competitors were doing it and no one was attacking them?”
The significance of that statement becomes obvious when you realize that the same kinds of Programmable Logic Controllers or PLCs that the US exploited to attack Iran are deployed in droves to support the world’s own SCADA environments. The point is that if the US can leverage the security weaknesses of these systems, then it is only a matter of time before other organizations do the same thing and the rest of the world is no better defended against them than the Iranians were.
(And by the way, Palo Alto Networks expert Del Rodillas has done plenty of strong analysis into securing ICS and SCADA networks and what it’s going to take to protect these specialized networks going forward. Go here to read some of Del’s thoughts.)
The Philosophical Conundrum
In a broader context, Countdown to Zero highlights some philosophical conundrums that our community is just now starting to wrestle with. We have known about these issues for years but Zetter’s telling of the story makes us reconsider them. Operation Olympic Games proved to the world that cyber warfare is no longer just a theoretical construct. It is a living and breathing option in the utility belt for nation states to use to exercise political power. With Operation Olympic Games, the US proved to the world that it is possible to cause physical destruction of another nation state’s critical infrastructure using nothing but a cyber weapon alone. With that comes a lot of baggage.
The first conundrum is the intelligence dilemma. At what point do network defenders stop watching adversaries misbehave within their networks before they act to stop them? By acting, we tip our hand that we know what they are about. This will most likely cause the adversary team to change their tactics. Intelligence organizations want to watch adversaries as long as possible. Network defenders only want to stop the pain. This is an example of classic Information Theory. I first learned about Information Theory when I read about the code breakers at Bletchley Park during WWII. Because the allies had broken the Enigma cipher, the Bletchley Park code breakers collected German war plans before the German commanders in the field received them. But the Allies couldn’t act on all of the information because the Germans would become suspicious about the broken cipher. The Allies had to pick and choose what to act on. This is similar to what the Stuxnet researchers were wrestling with too. Many of them had discovered this amazing and dangerous new piece of malware. When do they tell the world about it?
The next conundrum involves the national government and vulnerability discovery. Zetter discusses the six zero-day exploits used by Operation Olympic Games in the attacks against Iran. That means that the US government knew about at least six high-impact vulnerabilities within common software that the entire nation depends upon and did nothing to warn the nation about them. If another attacker decided to leverage those vulnerabilities against the US critical infrastructure in the same way that the US leveraged them against Iran, the results could have been devastating. The nation’s ethical position here is murky at best, and added to that is the well-known practice of the private sector selling zero-day exploits to the government. Should the government even be in the business of buying weapons grade software from private parties? Zetter offers no solutions here but she definitely gives us something to think about.
Conclusion
Zetter fills in a lot of holes in the Stuxnet story. In a way, it is a shame that it has taken five years to get to a point where the security community can feel like we understand what actually happened. On the other hand, without Zetter putting the pieces together for us, we might never have gotten there. I have said for years that the Stuxnet story marked the beginning of a new era for the cybersecurity community. In the coming years, when it is common practice for nation-states to lob cyber-attacks across borders with the intent to destroy other nation’s critical infrastructure, we will remember fondly how simple defending the Internet was before Stuxnet. Zetter’s book helps us understand why that is possible. She takes a complicated subject and makes it easy to understand. It is Cybersecurity Canon-worthy and you should have read it by now.
CTB-Locker is a well-known ransomware Trojan used by crimeware groups to encrypt files on the victim’s endpoints and demand ransom payment to decrypt the files back to their original state, but most antiviruses detect it by mistake as CryptoLocker (only one vendor correctly detects it as CTB-Locker). The attack vector is very basic and repeats itself: It begins with a spear phishing email sent with SCR attachments (double zipped). Once executed by the user the first stage malware downloads and executes the ransomware from a fixed hardcoded server list.
The Origins
The first known campaign was launched by Crimeware on November 2014. The first stage downloaded the ransomware from these sites:
pubbliemme.com (5.134.122.150)
agatecom.fr (213.186.33.19)
n23.fr (213.186.33.4)
baselineproduction.fr (213.186.33.4)
The Attack: A Legacy Nightmare
A very serious campaign was launched between January 19, 2015 and January 20, 2015, and Palo Alto Networks Enterprise Security Platform has discovered more than 1000 unique attacks since. The attacker used a polymorphic malware builder to generate malware with a unique hash for each victim, preventing signature-based solutions from detecting the new attacks before it was too late for the victim. This tactic is a nightmare for legacy security products that are based on legacy techniques such as bytes signatures, since they can only detect attacks after the damage is done instead of preventing it as a true preventive solution should. Palo Alto Networks Enterprise Security Platform offers multilayer protection to prevent this attack along with other attacks without the need for prior knowledge of the specific attack.
Some IOCs and statistics
breteau-photographe.com (213.186.33.150)
voigt-its.de (188.93.8.7)
maisondessources.com (213.186.33.19)
jbmsystem.fr (213.186.33.3)
pleiade.asso.fr (213.186.33.19)
scolapedia.org (213.186.33.19)
We can see here that server hostnames were changed but they didn’t change the server IP address – see the attached file with results for files from last week’s campaign fromVirusTotal. Most legacy security programs could not detect this malware at the time it was posted. If you re-test these hashes again from last week you can see an average of 49/57 engines that detect last week’s threat – but that’s too little, too late for anyone who already lost data.
The new (currently ongoing) campaign
This campaign started earlier today, and the malware uses the same techniques and even the same IOCs:
same mutex name: wuqntwklyxwhac
same job name: cderkbm.job
And only added two new hostnames:
joefel.com (64.71.33.177)
m-a-metare.fr (213.186.33.4) – same IP as before.
By now you shouldn’t be surprised that one of them is on the same known malicious IP address. We found 147 new unique pieces of malware today alone, two of them fully undetectable by the legacy security solutions in VirusTotal and most of them barely detected by one vendor (few have 4/57 detection rate).
See below:
So basically you have two choices:
Update hashes every week and pray … (see hash list section, we’re happy to help those still trapped using legacy solutions)
Implement next generation security products that can actually prevent this from happening.
IOCs for the latest campaign
The most surprising fact about this campaign is that almost all the IOCs haven’t been changed:
Palo Alto Networks Enterprise Security Platform would have stopped this ransomware attack campaign thanks to the platform’s unique integration between the network, endpoint and the cloud to maximize security. Attacks aren’t getting any less sophisticated, so it is time to leave legacy security solutions behind and upgrade to real, prevention-based security.
