Month: February 2015

Posted on

Security Resolutions for 2015

As we begin the New Year, it is critical for companies to understand the impact of cybersecurity breaches and attacks—and young professionals can play a key role in this.

As a young professional, I believe our objective should be to help our senior leaders define security levels and protect their key assets this year. How can we plan to do that? Here are some of my ideas for the New Year’s resolutions for young professionals (though professionals of any age will benefit from these tips):

Knowledge-sharing: It is very important to share our knowledge with others because the world is too big to know everything. ISACA provides good support for knowledge sharing through publications, blog posts, guidelines and the community around it, including at conferences and local chapter events. Furthermore, using social media is a good way to exchange with people.

Also, I recommend planning meetings, security breakfasts and trainings with your colleagues to help them understand the objective.

Personal training plan: Each day, new security features appear and we need to continuously update our cybersecurity skills. This is why a personal training plan is useful. The Cybersecurity Fundamentals Certificatefrom ISACA’s Cybersecurity Nexus (CSX) or the Certified Information Security Manager (CISM) Certified in the Governance of Enterprise IT (CGEIT) certification can be a good way to upgrade your skills and get recognized. Also, the virtualization age allows us to create labs for making tests with few resources. Personally, I focus on enhancing my capabilities in risk and governance management, such as penetration testing.

Educating users, management and the board: Many times, a user clicks on a link and downloads malware or something of that nature. Educating people takes time and patience, but allows you to create a strong security culture that lasts through time. Do not hesitate to explain the importance of security with a pragmatic view that relates to their own interests. Some people are more careful about finance and others about personal responsibilities. Create some user-friendly guidelines such as a guide on how to protect your privacy on Facebook to help convey your message.

Discovering new cultures: All countries are different and we need to respect them and be aware about local cultures we work with. Personally, I want to leave my country this year to discover a new working method, a new way of thinking and to increase my comprehension about the world. One benefit about being a young professional at ISACA is that the global association connects you with fellow professionals from around the world.
And you, what do you plan for 2015?

Damien Bertero
Security Engineer, France

[ISACA]

Posted on

Filmkan: Mysterious Turkish Botnet Grows Through Facebook

On January 31, a security researcher named Mohammad Faghani posted an analysis of malware that was being distributed through Facebook posts. Based on the number of “likes” the malware had generated, Faghani estimated that over 100,000 users had been infected with the malware. We have not been able to identify a common name for this malware and have given it the designation “Filmkan” based on domains it uses for command and control.

Based on our analysis, this malware was most likely created by a Turkish actor. The malware contains many comments written in Turkish, the domains used for command and control were registered through a Turkish company and the social network profiles involved in the attack belong to Turkish speakers.  Filmkan is very flexible, giving it more capability than simple interaction with social networks. The overall motivation of this attack is not clear at this time, but the author of Filmkan has successfully assembled a large botnet in a short amount of time.

Filmkan Functionality

While the initial report only contained sparse details, Faghani followed up with additional analysis on February 2, exposing more functionality related to the malware. Our WildFire analysis cloud first picked up samples of this malware on January 22 and thus far we’ve collected 44 distinct samples the display the behavior described by Faghani.

At a high level, this malware consists of four components:

  • Windows Executable Dropper (Based on AutoHotkey)
  • A wget for Windows executable(Legitimate)
  • A malicious Google Chrome Extension
  • Dynamic JavaScript code delivered by the attacker’s server

The initial infection occurs when a user clicks on a link in a Facebook post, which claims to be a pornographic video. After a few seconds the video tells the user they need to download an update for Flash player, which is the initial dropper executable. The attacker hosted the linked executables through Google’s cloud storage at the following URLs:

  • hxxp://storage.googleapis .com /aytackurst/install_flashplayer14x32_x64m
  • hxxp://storage.googleapis .com /aytackurst/install_flashplayer14x32_x63m
  • hxxp://storage.googleapis .com /aytackurst/install_flashplayer14x32_x86m

Filmkan Dropper

The Filmkan dropper has a Flash icon to help make it appear as a legitimate update.

The author of Filmkan created the dropper using AutoHotkey (AHK), a legitimate tool for creating Windows applications using a custom scripting language. AHK scripts are compiled into binaries that interpret the script code, making them portable to any Windows system. The AHK scripts included in the Filmkan binaries contain many debugging strings written in Turkish. The scripts have the following functionality:

  • Check if Google Chrome is installed on the system
  • If Google Chrome is not installed, install it and add a shortcut to the desktop
  • Copy the dropper binary to Application Data directory as “Chromium.exe”
  • Set a run-key to start Chromium.exe on system start
  • Delete files named chromenet.exe and Chromium_Launcher.exe (Possibly older versions of the dropper)
  • Install a legitimate wget.exe executable from within the binary
  • Check with three command and control servers for updated executables
  • Download an updated executable and replace itself
  • Install a malicious Chrome plug-in containing content downloaded from the command and control server

While the dropper is responsible for the initial installation and updating itself, the remaining functionality is contained in the Filmkan Chrome extension.

Filmkan Chrome Extension

Chrome extensions  allow developers to extend Google’s Chrome browser, typically by adding new functionality. Developers write extensions in JavaScript and HTML, which is typically included in a package along with resources necessary to operate the extension.  The Filmkan dropper retrieves JavaScript using the installed wget.exe program from one of the three defined C2 servers. The dropper saves this JavaScript code as “bg.txt”, which is defined in the installed Chrome extension manifest as a “background” script. This script will run whenever the Chrome browser is open on the system.

The content of the bg.txt file can be changed any time the attacker chooses. The current version of the script contains three primary functions.

The chrome extension closes any tab the user opens that matches the following URLs, effectively preventing the user from discovering or removing the extension.

  • “chrome://extension”
  • “chrome://chrome/extension”
  • “chrome://settings/resetProfileSettings”
  • “opera://extensions/”
  • “browser://tune/”
  • “chrome://help/”

The extension downloads an array of JSON data from hxxp://www.filmver .com/ahk/get.js. The extension uses this data as a blacklist, preventing the browser from loading URLs that contain any of the following strings.

  • avast.com
  • eset.com
  • microsoft.com
  • virusscan.jotti.org
  • jotti.org
  • avg.com
  • kaspersky.com.tr
  • kaspersky.com
  • facebook.com/ajax/webstorage/process_keys.php
  • facebook.com/checkpoint/malware/cr_ext_config
  • facebook.com/checkpoint/malware/cr_ext_log
  • dl.dropboxusercontent.com
  • docs.google.com
  • drive.google.com
  • facebook.com/ajax/follow/unfollow_profile.php
  • vuupc.com
  • mcafee.com
  • googlecode.com
  • akamai.net
  • facebook.com/xti.php
  • .exe
  • exelansdealers.com
  • facebook.com/ajax/profile/removefriendconfirm.php
  • facebook.com/ajax/report/social.php
  • joygame.com
  • senakadir.org
  • yllix.com
  • blogspot
  • .scr
  • hebacanak.xyz
  • milyoncu.xyz
  • ez123.ezgo123.com
  • ezgo123.com
  • deactivate.php

Blocking antivirus and security-related domains is a common tactic malware authors use to prevent users from removing an infection, but many of the domains included in this list are mysterious. JoyGame.com is a Turkish video game website, while exelansdealers.com was previously used to host a similar malicious Chrome extension.

The third primary function of this extension is to download and execute JavaScript code from hxxp://www.filmver .com/ahk/user.php. This function makes the Filmkan extension very flexible, as the attacker can modify the script at any time.

When Faghani first published his analysis this component of the malware was forcing the user’s Facebook account to “like” specific posts on a community page titled Sabır. Some of these posts garnered over 100,000 likes, despite containing very little content.

The latest version of the script no longer forces the user to like these posts, instead it causes the user to follow two accounts on Twitter and a third account on Facebook.

Other than all three of these accounts belonging to Turkish individuals, the connection between these accounts and this attack is unclear.  The script also includes a tracking URL hosted by amung.us, which allows the attacker to identify how many users are actively infected with the malware. A snapshot of the current number of infections follows:

hxxp:// whos.amung .us/swidget/hcfj8xyq9p94

The attacker frequently updates this tracking URL, most likely to keep track of users who are currently executing the latest malicious extension code.  The full content of the latest script follows.

Protection Against Filmkan

Filmkan does not exploit any software vulnerabilities and thus far has relied on social engineering to infect users. Users should be suspicious of any message indicating that an update for Flash is available in Google Chrome, as Chrome contains an integrated Flash runtime that is updated by Google.

Organizations should block access to the following domains to prevent Filmkan from receiving updates from the attacker. These domains are the primary weakness of Filmkan, as shutting all three of them down simultaneously would remove the attackers access to the botnet.

  • filmver.com
  • pornokan.com
  • neran.net

Thus far, WildFire has automatically identified Filmkan droppers with the following MD5 hashes:

  • 417a4e511b5e545c7ca291bc0cce07ba
  • 5c2fa20538ddeaa51d4926f848077eed
  • 2b7b5e29892e337ab33da34d9c157904
  • 153648a45acce90bfdf025d741551048
  • 1028c910bf1ad2c2c168ca87927063f2
  • f9b19fc9cacaf8aeee52dbe8004b58f7
  • ed216da31992540897d3bb3b2043482f
  • 1fa02f74b4a5aca28aabbd908dfe5726
  • d2c9c770f15093b8ba9f045d99154e50
  • 5dafa69051a4f13b204db38d0ffcad5e
  • 877648fccf8334230c1d601068939003
  • fd34c0f5b3a9cd9c41964a8808ea0f5a
  • 4e56b2d83913d9ad904aef12ded609a6
  • 2c4bc730f6c644adf21c58384340bf2e
  • cdcc132fad2e819e7ab94e5e564e8968
  • 787c710de749b2122a08c907b972f804
  • 90d761bc351107bb17c34787df8d6e1e
  • 6ae4da20732ec857df06d860a669c538
  • 3192a69f3fa8607f65b4182ec21f13dd
  • f1f6b616ce9b4067ce11fc610af2c631
  • 04eaec8ede8bfb00eadbebd9d8d11686
  • c1e0316109febbef60c4d7c44357a5d5
  • a24bab7b2c69672ee6ffc7451f61e495
  • c7fa3651b5f5ec390f9223648aae485b
  • e6d884d39bd4b4cbd1fea96bfa613afd
  • a0740e7317eddd47e535fd71b11874b6
  • 59424fa04bb09030c83c19539a299eec
  • 4908c5c2fcc75330ffd05461bbd207fd
  • abbe325c98aaca9f878c42f0ef4e850e
  • dbabc3c28cf05310051879b938b20e6b
  • df1cf305f3d9dfa38991b20f31468f20
  • ac97ffd114fe251e0fd03436f7caaaf2
  • a2722a389a8adff57cb1b4406f968312
  • c08fd88643b0bebec428b04debfc0762
  • 4d72ce68998aa816b19573b74672b795
  • 060df3a1a3df7da258d674f15b17e7b9
  • 36ad93a8c46de731545bfeb5694b446d
  • 344ea3db8cddf4f6cbe9dbee36850e0e
  • cf693e029b68e01e7585ea5fe446c812
  • d3324773197893bdb796dbacdd4a54ec
  • 4718e54bee474ddb42f230a4326e6678
  • ff4afca6cb9b108111a902d8d4b73301
  • 85c199554b0b4b25516b27f5f2705ec1
  • 1e3d6ddd804e52b3123d295bf57be71f

[Palo Alto Networks Blog]

Posted on

Palo Alto Networks: Solving Government’s Data Center Security Challenges

Governments worldwide are working hard to implement a number of changes in their data center infrastructures. Some have major data center consolidation projects underway, such as the Federal Data Center Consolidation Initiative in the U.S. Others are taking advantage of the benefits of virtualization or moving to Shared Services models. Finally, many are deciding if a public cloud infrastructure is appropriate for some of their government business. To cater to the U.S. government’s interest in the public cloud, Amazon Web Services (AWS) has developed specialized cloud services, GovCloud and Commercial Cloud Services (C2S) for the Intelligence Community, designed specifically for U.S. government customers.

Having so much to consider for their data center infrastructure plans, security is certainly top of mind.  Here at Palo Alto Networks, we’re doing all we can to support governments as they secure their cyber infrastructure. We have been working with numerous customers – including many in the U.S. federal sector – to evolve their infrastructure, securely, regardless of the stage in their data center transitions.

Recently, we worked with MeriTalk to develop a “health check” with U.S. federal government agencies (read the full report here). The survey queried 300 U.S. Federal IT managers about what security issues were top of mind as they implement changes to their data centers. The results are fascinating and show that many government agencies share common security concerns in their data center and cloud planning.

The good news is that our portfolio provides security solutions that protect customer data no matter where the government is in their data center evolution. Palo Alto Networks is able to solve many of the security challenges the survey respondents identified with their current data center security solutions. Let’s look at a few of them:

Integration challenges

Integration can mean many things, but when it comes to data center security it typically refers to how well the solution can tie into the existing physical or virtualized network infrastructure. To integrate easily into an existing physical data center network, each Palo Alto Networks Next-Generation Firewall supports a range of network modes, including L2, L3, Virtual Wire and mixed mode. Virtual Wire makes our Next-Generation Firewalls truly transparent network device, looking much like a bump in the wire which solves many customer network integration challenges and can be used in both Active-Passive and Active-Active high availability modes.

From a virtualized computing environment perspective, integration means how tightly the security solution ties into the hypervisor and orchestration tools in use. The Palo Alto Networks VM-Series of virtualized firewalls allows customers to deploy the exact same next-generation firewall and advanced threat prevention features used in our physical appliances in private, public or hybrid cloud computing environments. The VM-Series supports a range of hypervisors including VMware ESXi and NSX, Amazon Web Services and KVM with OpenStack. In each of these environments, customers analyze traffic moving into and across the cloud environment, protecting both applications and data from advanced threats. Additionally, the VM-Series incorporates a fully-documented XML API to simplify integration of third party orchestration and management tools. Our ease of provisioning, noted below, helps ensure seamless integration as changes happen within the data center or cloud, regardless of your platform choice or data center instantiation.

Time to provision

In both physical and virtualized network environments, customers struggle with managing the discrepancies that may occur between compute workload additions, removals or changes and how quickly a security policy can be deployed. To help minimize these delays, Palo Alto Networks firewalls provide a rich set of native management features that streamline policy deployment so that security keeps pace with the changes in your compute workloads (physical and virtual).

As compute workloads change, are added or removed, features within the PAN-OS security operating system will see those contextual changes, proactively learning which IP addresses are changing, then apply those updates to the security policy automatically. The result is a dramatic reduction in the delay that can occur between workload changes and security policy updates. In the event that many virtual or physical Palo Alto Networks next-generation firewalls are deployed, our Panorama technology makes managing them easy and ensures that security policies are applied consistently and cohesively. Panorama also provides centralized logging and reporting capabilities that give users visibility into virtualized applications, users and content.

Performance shortcomings

In order to address the computationally intensive nature of full application traffic classification and inspection, Palo Alto Networks Next-Generation Firewall appliances are purpose-built to deliver predictable performance with security features enabled. A single-pass software architecture performs its defined functions only once on a given set of traffic, eliminating the multi-pass scan and decision making process that UTMs and other security solutions follow. This single pass software architecture is matched to purpose-built hardware that uses dedicated processing for the key areas of networking, security, content inspection and management. The end result is a next-generation firewall architecture that is fully capable of 120 Gbps of cyber security processing. Customers who have used proxy-based firewalls and UTMs are astonished at the performance gains our platforms provide.

Fragmented solutions

One of the advantages of the Palo Alto Networks Enterprise Security Platform is the contextual control it provides by knowing what applications are being used, who is using them and what data they contain. All visibility, policy control, logging, reporting and forensics features within our enterprise security platform take full advantage of this contextual awareness to provide a closed-loop feedback platform for network and data center security. All security functions employed – advanced threat prevention with WildFire™, known threat prevention with IPS, network anti-virus and anti-spyware, mobile security management with GlobalProtect™– are correlated and shared across the platform to continuously update and employ the very latest attack preventions for the data center and your network.

Lack of security for virtual machines

Palo Alto Networks VM-Series virtualizes the functions of its enterprise security platform, allowing customers to secure virtualized workloads while preventing advanced cyberattacks. In fact, it was a global government customer who gave us the idea years ago to create a virtualized instance of our platform and customers love it. If you use AWS GovCloud, the VM-Series for AWS is available as a Bring Your Own License (BYOL) model and the VM-Series also supports VMware ESXi/NSX, KVM or Citrix SDX. You can purchase the VM-Series from your authorized Palo Alto Networks partner.

With the power of the Palo Alto Networks Enterprise Security Platform, we can protect your north-south traffic as well as your east-west traffic. We ensure that attackers are not only blocked as they enter your overall network, but are also blocked as they attempt to move laterally into and through your data center.

Additional resources to assist you in your data center to cloud security needs:

See what the media has to say about the results of the MeriTalk survey:

[Palo Alto Networks Blog]

Posted on

Providing Assurance on Data Quality

Many organizations are putting data governance on their strategic agenda, primarily because of the amount of data that is available to, generated by and utilized by the organization. Professionals who provide assurance services are now faced with the task of providing advice on the data quality issues, which if not addressed can lead to a number of adverse effects, including:

  • Lack of compliance with statutory requirements
  • Losing a competitive edge
  • Dissatisfied clients
  • A delay or scrapping of a new information system implementation
  • Failure to meet a significant contractual requirement or service level agreement

To address data quality, the organization must agree to and document data quality metrics that are relevant to the kind of data in use by the organization. Philip Nousak and Rob Phelps propose a score-based approach with predefined metrics. In general, data quality metrics may include:

  • Accuracy: Data reflects reality
  • Integrity: There is a possibility to uniquely identify data records
  • Consistency: There are no contradictions in the data
  • Completeness: All the necessary data is present
  • Validity: Data values are acceptable and fall within defined ranges
  • Timeliness: Data values represent the most current information for the specific use
  • Accessibility: Data can be obtained with ease, is comprehensible and usable
  • Granularity: Data is available at a sufficient level of detail

The data quality metrics in themselves are not sufficient for an assurance professional to provide an opinion on data quality. Other factors that should be considered can be categorized in the following three groups:

  • Technical:
    • What is the underlying database structure that is used for data storage?
    • What application is being used to process or manipulate the data?
    • While the original data may be of good quality, errors may be introduced as a result for poor database structures or bugs in the applications being used to process the data (e.g., a data value that is required to be unique by its nature)
  • Operational:
    • What business processes create or use the data?
    • What business rules are in place to provide validation of data captured or produced?
  • Governance:
    • Are the data roles and responsibilities clearly defined in the organization?
    • What monitoring and reporting requirements are in place?

In conclusion, investigating data quality practices to provide assurance, or as part of an IS audit, will add value to the organization. Assurance professionals should consider regular checks on data quality in the process of carrying out their work.

Carina K. Wangwe
Social Security Regulatory Authority, Tanzania

[ISACA]

English
English
Exit mobile version