Day: March 23, 2016

Posted on

Lose the Audit-speak for Clearer Communications

Every professional can easily fall into industry-speak. I even do this with my kids, who often find my words incomprehensible. My kids really pushed me to take a step back and re-assess how I communicate.

In classes I teach, we frequently discuss the best level for auditors to write to—most say the junior high grades. What level should auditors speak to? The answer is the same. I am not saying talk down to anyone; I am saying be comprehendible to everyone.

Auditors tend to use industry-speak or, what I call, safe words. They make us feel like we are auditing. In reality, we can lose our audience (e.g., clients) quickly using industry-speak. In fact, some words do not fit the scope of internal auditing; they have seeped into our subconscious from too many years of external auditing.

We should speak in layman’s terms to facilitate change and assist organizations in achieving their objectives. I have compiled a list of “watch out words” auditors should eliminate from their vocabularies or use appropriately. These include:

Mysterious Action Words

These words—including discovered, appeared, revealed and captured—come mostly from our schooling. Auditors overthink everything (we ARE auditors, after all) and try to make the audit process sound more exciting than it actually is. Instead of action words, be more specific, straightforward and comprehendible. Technical writing suggests varying words to maintain reader attention, but for audit reports word consistency is best.

Emotional Triggers

Auditors often throw around words like adequate, inadequate, fail, opinion and fraud without understanding how emotionally driven they can be to clients. I am not saying never use them—if they are bad, they need to be called out as bad—but use these words appropriately.

The terms adequate and inadequate are very emotional and hurtful. Being a failure is actually better than being inadequate; the latter sounds like “I am so awful I could not meet the minimal standards to fail.”

The term fraud is obviously well-known and understood but when some clients see this, they might shut down and even stop reading. Suggested replacements include the words misappropriation and inconsistencies.

There are a number of phrases that, when used to begin a statement, the conversation goes downhill quickly. One is “In my opinion.” In an audit report, I try not to use the term opinion. We definitely give opinions in reports but I try to stick to facts and circumstances.

Definitive Terms

I am working to curb the use of definitive terms—such as absolutely, never, always, must—with my eight-year-old, Caleb. He loves to generalize and include everything. “Always” might be his most frequently used word. These words do not apply in audit; there are usually exceptions to any rule.

Ambiguous Terms

Here is an example of why you should not use ambiguous terms like reasonable and should:
When my son asks me if his homework is correct, I would not answer “It appears reasonable.” I understand why we use the word, but we can communicate much more clearly without it. Instead of saying “The control structure appears reasonable,” why not say “Based on Internal Audit’s testing of XYZ, the risk is mitigated to an acceptable level.” This may be wordy, but it is much clearer.

I believe that independence is a thick gray line; as auditors, we must be able to operate in the gray. Regarding “should,” I believe by using it we do not sound independent. When I tell someone they “should” do something, it can be interpreted that I am telling them what to do. The best—yes, using an absolute here—replacement word is recommend. It shows independence and leaves to management how to address the issue. Now we can “strongly recommend” (verbally, not written—strongly is unnecessary) and make sure they understand the ramifications of inaction while we still adhere to our independence standards.

First/Third Person (We/I)

I do not see the first/third person used in audit reports as often as I did 5-10 years ago, but it is important to depersonalize the message.

Danny Goldberg, CISA, CGEIT, CRISC, is founder of GoldSRD, a provider of high-quality, interactive internal audit training. He will present two sessions (PC Skills: Communication, and Open Debate:  Is IA the 3rd Line of Defense?) at the NACACS in New Orleans, Louisiana, 2-4 May 2016. Learn the latest in information systems audit, control and security at the CACS Conference. Knowledge, tools and strategies will be shared at all levels of expertise.

Danny Goldberg, CISA, CGEIT, CRISC, founder of GoldSRD

[ISACA Now Blog]

Posted on

Achieving Continuous Protection with Highly Available Next-Generation Firewall Deployments

Network outages and cyberattacks cause unplanned downtime. And most organizations are seeing dramatic growth both in data center traffic and the use of web-scale ready applications. These trends have resulted in an increased density of business-critical workloads driving requirements for high availability network designs that can handle workload mobility and business continuity.

To ensure highly available and continuous protection of network infrastructures, Palo Alto Networks Next-Generation Security Platform supports active/passive and active/active high availability deployment modes. Active/passive high availability remains the most commonly deployed method of stateful failover for three reasons:

  • Active/passive (A/P) designs are simple to implement and maintain over a period of time.
  • State information associated with all network flows is synchronized with no loss of connectivity between endpoints on either side of the next-generation firewall.
  • With A/P high availability implementation, the passive unit can effectively handle the network load in case of active unit failure.

In certain networks requiring continuous protection and the ability to handle asymmetric traffic, or run active routing protocols on all firewalls within a high availability configuration, active/active high availability features can address those requirements.

Palo Alto Networks next-generation firewalls provide comprehensive high availability options with features such as sub-second stateful failover, link and path monitoring capabilities. Organizations have the flexibility to implement advanced high availability deployments in full mesh active/passive and active/active failover configurations. This provides customers with continued protection from network-based attacks and secures connectivity to meet today’s business requirements.

For more information, please visit:               

[Palo Alto Networks Research Center]

Posted on

Campaign Evolution: Darkleech to Pseudo-Darkleech and Beyond

In 2015, Sucuri published two blog posts, one in March describing a pseudo-Darkleech campaign targeting WordPress sites, and another about its evolution the following December. Sites compromised by this campaign redirected unsuspecting users to an exploit kit (EK). The Sucuri posts describe patterns in the injected script related to this campaign. Since December 2015, patterns associated with pseudo-Darkleech have continued to evolve. Our blog post today will examine these changes.

However, before we look at the recent developments, we should understand how EKs fit into the overall picture and review the history of Darkleech.

Path to an Exploit Kit

An EK is used by criminals to infect unsuspecting users while they are browsing the web. EKs are hosted on servers dedicated to the EK. The EK will check if a user’s computer is vulnerable and send the appropriate exploit. That exploit is used by the EK to send malware, execute it as a background process, and infect the user’s computer.

This malware is the EK payload. Most payloads are designed to infect computers running Microsoft Windows. Different EKs are available to criminals for this purpose. Notable EKs in recent months include Angler, Neutrino, Nuclear, and Rig.

How are web browsers directed to these EK severs? Since users won’t intentionally view an EK, criminals must establish a path behind-the-scenes. The first step in this process is a compromised website. These compromised websites are legitimate pages with hidden script that initiates a network connection to the EK. This is the most direct path to an EK.

Criminals sometimes use another server as a gate between the compromised website and the EK server. In some cases, you’ll find more than one gate in this path. However, pseudo-Darkleech traffic doesn’t appear to rely on gates. From what we can tell, the injected script most often points directly to an EK’s landing page.

Enter Darkleech

Darkleech is the name of a campaign that infected thousands of Apache servers starting in 2012. More specifically, Darkleech refers to an Apache module available on the black market that was used for malware distribution. In 2013, many organizations had reported on Darkleech. At the time, servers infected with Darkleech led to Blackhole EK.

Below are examples of injected script from compromised websites running the Darkleech module in July and August 2012.

Figure 1: Example of injected script from July 2012.

Figure 2: Example of injected script from August 2012.

Patterns for this injected script remained relatively consistent throughout 2013. But changes were coming. By October 2013, Russian authorities had arrested Paunch, who allegedly created the Blackhole EK. Within a few months, Blackhole EK disappeared from the scene. By early 2014, the same Darkleech pattern was pointing to No-IP.com domains (hopto.org, ddns.net, myftp.biz, serveftp.com, etc). These No-IP domains were either gates to an EK, or they directly hosted EKs like Fiesta.

Figure 3: Injected script from March 2014 pointing to Fiesta EK.

Figure 4: Another example of injected script from November 2014.

Enter Pseudo-Darkleech

In March of 2015, Sucuri published a blog identifying these newer patterns of injected script from early 2014 as “pseudo-Darkleech.” Why use “pseudo” to describe this campaign, especially if the injected script looked the same as before? Because the injected script was now seen from IIS sites, where previously it had only been noticed on Apache servers. As the year progressed, pseudo-Darkleech script was found pointing to Angler EK and delivering ransomware like CryptoWall].

Figure 5: Injected script pointing to an Angler EK landing page in July 2015.

These patterns remained consistent until late September 2015. At that time, injected script caused by pseudo-Darkleech dramatically changed. The script became highly-obfuscated. It looked nothing like previous Darkleech patterns, and you couldn’t easily determine the URL it would generate.

Figure 6: Injected script from September 2015.

An example of this injected script from October 2015 has been isolated and posted to Pastebin. Using a tool named Revelo from Kahu Security, you can quickly see what the script does. As shown below, the script tries to access a URL, and the URL matches patterns for Angler EK.

Figure 7: Injected script from October 2015 run through Revelo.

Later in 2015, pseudo-Darkleech injected script occasionally switched between Angler EK or Neutrino EK as it delivered ransomware like CryptoWall or TeslaCrypt. By December 2015, Sucuri published a new blog post covering these most recent updates on pseudo-Darkleech injected script. Even with the injected script’s new patterns, Sucuri reported that server-side indicators remained the same as it had reported in March 2015. This activity was still pseudo-Darkleech.

Recent Developments

Since September 2015, patterns associated with pseudo-Darkleech have evolved. Any changes were minor until early February 2016, when we saw the addition of a sizable block containing numeric characters in the injected script.

Figure 8: Start of pseudo-Darkleech injected script from early February 2015.

Figure 9: End of pseudo-Darkleech injected script from early February 2015.

Since that time, the characters separating the numbers in that large block of numeric characters have changed. For example, on 2016-02-24 they switched from spaces to commas. By 2016-02-29, pseudo-Darkleech had switched to semicolons. By 2016-03-07, we saw asterisks. On 2016-03-14, the patterns had changed yet again.

Figure 10: Start of pseudo-Darkleech injected script from 2016-03-07.

Figure 11: Start of pseudo-Darkleech injected script from 2016-03-14.

Conclusion

Since it was first called pseudo-Darkleech by Sucuri in March 2015, members of the security community have found websites compromised through this campaign on a daily basis. Withtens of thousands of compromised sites reported in 2013 under the original Darkleech banner, pseudo-Darkleech continues the onslaught with no signs of slowing down.

In recent weeks, this campaign has led to Angler EK delivering a ransomware payload, especially TeslaCrypt. Pseudo-Darkleech and the associated Angler EK traffic remain a persistent and evolving threat. Both Darkleech and Angler frequently change patterns to avoid detection. Palo Alto Networks researchers have already examined Angler EK and published an in-depth report containing indicators in January 2016. We continue to investigate pseudo-Darkleech and Angler EK for applicable indicators to inform the community and further enhance our threat prevention platform.

Indicators of Compromise

Domains and IP addresses from websites compromised through this campaign are continually changing. Below are recent examples of the injected script caused by pseudo-Darkleech that have been isolated and posted to Pastebin:

[Palo Alto Networks Research Center]

Posted on

Locky Ransomware Installed Through Nuclear EK

In February 2016, Unit 42 published detailed analysis of Locky ransomware. We certainly weren’t the only ones who saw this malware, and many others have also reported on it. Since that time, Locky has been frequently noted in various campaigns using malicious spam (malspam) to spread this relatively new strain of ransomware.

When we initially reported on Locky, attackers were distributing the malware using Microsoft Office documents with malicious macros to download and execute the ransomware. Attackers quickly added another tactic, sending e-mails with zip attachments containing malicious Javascript files to accomplish the same goal. However, exploit kits (EKs) have also been used to infect users with Locky from casual web browsing. This activity suggests that there are effectively two paths to Locky: one through malspam and another through EK traffic.

Figure 1: An example of two paths to Locky from February 2016.

The EK path is rarely mentioned. So far, we have seen very little reporting on Locky’s propagation through EK traffic. Some sources noted Neutrino EK was used to send this malware, but no more has been publicly announced on the subject.

In recent days we have noticed Locky attempting to infect systems using the Nuclear EK.

Details

In February 2016 when Neutrino EK was first reported delivering Locky, we found a pcap of the traffic and saw the following pattern:

Figure 2: Wireshark display of Locky sent by Neutrino EK on 2016-02-16.

Proofpoint reported similar traffic and stated it was Locky distributed by a Neutrino EK thread known for spreading Necurs. This month, we ran across the same type of gate. This time, traffic patterns after the gate were similar to what we’ve seen for Nuclear EK. The payload was either Locky, or it was a downloader that retrieved Locky from another domain.

Figure 3: Wireshark display of Locky sent by Nuclear EK on 2016-03-15.

Figure 4: Wireshark display of Nuclear EK on 2016-03-16 sending a payload that downloaded Locky.

A Windows host infected with these Locky samples looks similar to previously-infected hosts when we first reported about the ransomware in February 2016.

Figure 5: A Windows host after being infected with Locky on 2016-03-16.

Conclusion

As noted in our previous blog post about Locky, Palo Alto Networks customers are protected from Locky through our next-generation security platform. WildFire continues to detect Locky, and AutoFocus identifies this threat under the Unit 42 “Locky” tag.

We continue to investigate Locky and EK traffic for applicable indicators to inform the community and further enhance our threat prevention platform.

Indicators of Compromise

Date/time range: 2016-03-15 and 2016-03-16
Gate IP address: 91.195.12.177
Gate domain: sed.poudelkamal.com.np
Nuclear EK IP address: 46.101.8.169
Nuclear EK domains: lotos.castrumtelcom.com.br , here.jninmobilaria.com.ar
Follow-up malware IP address: 46.148.20.32
Follow-up malware domain: js.cefora.com.ar
IP addresses from post-infection traffic caused by Locky ransomware:

  • 51.254.181.122
  • 51.255.107.8
  • 78.40.108.39
  • 149.202.109.205

Exploits and malware noted:

  • Description: 2016-03-15 Nuclear EK Flash exploit
  • SHA256 hash: 94bd74514cc9e579edf55dd1bac653ceca1837d930d109c6e701afe309b23310
  • Description: 2016-03-16 Nuclear EK Flash exploit
  • SHA256 hash: 4228036684f4f519704a102cd9322ac9edb1bfb5b20558a7a6873818f0e6a7b4
  • Description: 2016-03-15 Nuclear EK payload – Locky ransomware
  • SHA256 hash: faf4f689683f3347738ef0a8370a78d504b513d44f3a70f833c50de3d138c3b2
  • Description: 2016-03-16 Nuclear EK payload – file that downloaded Locky ransomware
  • SHA256 hash: a9dac0a0389c463b063cb30f647b3d1610e6052570efe2dfb1fca749d8f039fc
  • Description: Locky ransomware downloaded by Nuclear EK payload (soft.exe)
  • SHA256 hash: cc2355cc6d265cd90b71282980abcf0a7f3dcb3a608a5c98e7697598696481af

[Palo Alto Networks Research Center]

English
English
Exit mobile version