Day: March 25, 2016

Posted on

Insecure of Things

During this exciting time of technological advancements, when there is an app for every facet of our lives, from letting you know the right time to take a bathroom break during a movie to how to build a space shuttle, why am I continually disappointed?  We have become a generation addicted to our apps and having the latest and greatest technologies, but that comes with a steep price. We have to continually ask ourselves with every purchase and click, what is my data and privacy worth if and when it is leaked, breached or stolen?

George Santayana wrote: “Those who cannot remember the past are condemned to repeat it.”  (The Life of Reason, 1905)

With all the massive security breaches that happen daily around the globe, why are we not learning from them and from each other? Why are we not taking the necessary precautionary steps as consumers and manufacturers? Maybe a better term for “Internet of Things” should be “Anyone Can Control my Things?”

Just because it is convenient to connect all your devices doesn’t mean you should.  The price for convenience can cost our privacy, our reputation, our livelihood, and even our lives. To the average user, a connected smart thermostat is just a thermostat. We would never imagine that it could be a fully equipped, connected and functioning computer that is able to influence the physical world. Through these in-home devices, an entry point is established to enter your home, access all of your connected devices, and ultimately your entire digital DNA. Over 70% of these devices are vulnerable to cyber-attacks, due to loopholes and backdoors that were left in the hardware and software and being exploited daily by anyone.

We, the consumers, need to band together to push these security threats back onto the responsibility of the companies that create them.  The best way to do that is by voting with our feet, our wallets and through legislation. We need to demand that companies build in security.  Not just in the beginning with the initial discovery phase when they are researching new products and services, but also carry it out all through the software/hardware development life cycle (SDLC) to include support and maintenance.

What can I do as a consumer?

  1. Research before you buy, and vote with your wallets. Read the EULA, security features and the privacy policies. Install patches, software updates and product upgrades when available.
  2. Don’t buy the first or beta version of the product. Let someone else test it out and wait for the manufacturer to rev the product.
  3. Become active with legislation to help create or change privacy laws for public and private companies to become more accountable for their products and services they bring to the market.
  4. Stop connecting everything. Don’t give up security for convenience.
  5. Use strong passwords and two factor authentication.

What can I do as an employee/manufacturer?

  1. Adopt a security focused approach, build and design security in, create use cases and test cases, write security related requirements through out every iteration. Develop threat models, pen testing and offensive security plans to test potential attacks. Ensure your Business Analysts, Project Managers, QA Engineers, Developers, Architects and Managers are measured on quality and security. Don’t be afraid to speak up if the product does not use proper encryption or privacy controls to secure user data and network services properly.
  2. Stop collecting so much user data, provide consumers with more choices to opt-out of data collection.
  3. Build in a line item into your budget just for security, and that does not mean buy more hardware and software. Invest in your employees, get them trained, cross trained or certified.
  4. Purchase and partner with key manufacturers for the memory, chips, sensors and processors who you trust, don’t pass the buck onto the consumers to pay for your laziness or cheapness.
  5. Don’t create backdoors or leave them open. Harden and secure endpoints.
  6. Listen to your customers, put quality first. Take the lead on creating a secure product line.
  7. Invest in systems that automate the detection of malicious activity so that it can be contained and remediated before data is lost or damage is done. Your network has to be configured to automatically prevent or detect these nefarious behaviors.
  8. Secure the data. Most data is unprotected in the cloud; personally identifiable information (PII) is open to anyone who wants it. The protection needs to start from the sensors and go all the way up to where the data is stored to cover data at rest and data in transit. Companies need to have and enforce a strict data retention policy and make sure they maintain a high level of security compliance.

I often get asked by friends and family, whose responsibility is security, isn’t it the companies that make it? The answer is a resounding, “no,” it is ours. It is our data, we own it and we should protect it. We need to become educated and aware of all the risks that come with surrounding ourselves with IoT connected devices. Companies are not good at securing their products or even their own infrastructures. They are starting to see and feel the effects of these poor decisions and security breaches by firing C-level executives or paying out millions in fines for lost consumer data. Security is every human’s responsibility to ensure that they are taking the necessary precautions to protect their own data. Do not rely on companies to do this on your behalf. As long as being first to market (quickly and cheaply) is their main driver, then security will most likely continue to be an afterthought and a reactionary gesture.

There is good news through all these breaches; the knowledge, experience and awareness is already here, we just need to learn from it. Listen and adapt to fit the constraints of IoT devices into our lives properly. Technology will continue to advance at a rapid pace and get better over time, but so will the bad actors.

Change your passwords frequently, install anti-malware, set up firewalls for your home networks, and most of all, never stop learning and educating yourself on security. Take control of your data and your lives, it is your responsibility. – – Wesley Simpson, COO, (ISC)²

[(ISC)² Blog]

Posted on

CSX Practitioner Boot Camp Gives Security Pros An Edge

Editor’s note: ISACA Now recently sat down with Frank Downs, ISACA’s senior manager cyber/information security, to discuss CyberSecurity Nexus’ (CSX) new CSX Practitioner Boot Camp.

What is CSX Practitioner Boot Camp?
CSX Practitioner Boot Camp is a great opportunity for cybersecurity professionals looking for a more thorough mastery of the hands-on, complex and advanced technical skills they need to protect and defend their enterprises and advance their careers.

The five-day, intensive cybersecurity course will help attendees make significant gains in their training and prepare them for the CSX Practitioner (CSXP) certification exam. It provides an environment to discuss and practice methods implemented by cybersecurity professionals in key areas aligned with global cybersecurity frameworks. The CSXP was recently named Best Professional Certification Program by the 2016 SC Magazine Awards. Becoming CSXP certified is a testament to an individual’s real-life skills and shows employers that he or she has the knowledge and technical ability to walk into an organization and do the job from day one. CSXP Boot Camp is also a great opportunity for organizations that want to develop their cyber workforces.The immersive training will prepare students for five key cybersecurity responsibilities:

  • Identify:  Identification, assessment and remediation of threats and vulnerabilities in internal and external frameworks
  • Protect:  Implementation of cybersecurity controls to protect a system for identified threats
  • Detect:  Detection of network and system incidents, events and compromise indicators and assessment of potential damage
  • Respond:  Execution of comprehensive incident response plans and mitigation of cyber incidents
  • Recover:  Recovery from incidents and disasters, including post-incident response documentation and implementation of continuity plans

What sets it apart from other cybersecurity training?
What really sets CSXP Boot Camp apart—and what makes it so exciting and innovative—is that it is conducted in an adaptive, live, hands-on cyber lab environment, which enables students to build their critical technical skills by learning complex concepts and applying industry-leading methods. Participants will use the latest open-source tools on actual, real-world scenarios. Attendees receive a complimentary 6-month subscription to the virtual cyber lab environment where they can continue practicing and building technical skills.

Another differentiating factor is the use of PerformanScore®, a learning and development tool that measures a professional’s ability to perform specific cybersecurity job tasks. PerformanScore recognizes that there are multiple ways to respond to cybersecurity threats, so it measures performance skills across the entire solution set of possibilities. It compares a professional’s actions to grading criteria, and then references those actions against an adaptive scoring rubric in real-time, allowing instructors to give immediate feedback and helping professionals to better learn and understand more efficient cybersecurity techniques.

Why should a cybersecurity professional make the investment in CSXP Boot Camp training?
Eighty-one percent of respondents to ISACA’s 2016 Cybersecurity Snapshot survey said they would be more likely to hire a candidate with a performance-based certification, so obviously a cybersecurity certification is critical to anyone interested in a cybersecurity career. The Boot Camp positions cybersecurity professionals very well for the CSXP certification exam, which is exactly what cybersecurity hiring managers are looking for. Upon completion of the course students will be prepared to serve as workforce-ready cybersecurity professionals.

Who should attend the Boot Camp?
It is for professionals with up to five years of experience in a cybersecurity role and an intermediate technical skill set. If you are interested in registering for CSXP Boot Camp, you should already demonstrate proficiency in the following areas:

  • Network scanning
  • Specialized port scans
  • Network topologies
  • Network log analysis
  • Centralized monitoring
  • Hotfix distribution
  • Vulnerability scanning
  • Traffic monitoring
  • Compromise indicators
  • False positive identification
  • Packet analysis

When/where does the Boot Camp take place?
The expert-led Boot Camp courses will be offered at five US locations in 2016:

  • Chicago, Illinois (4-8 April)
  • Washington, D.C. (11-15 April)
  • New York, New York (16-20 May)
  • Denver, Colorado (13-17 June)
  • San Francisco, California (20-24 June)

How Do I Register?
To register for the CSXP Boot Camp, please click here.

Frank Downs, Senior Manager Cyber/Information Security, ISACA

[ISACA Now Blog]

Posted on

Evolution of SamSa Malware Suggests New Ransomware Tactics In Play

Ransomware is often in the headlines as new families are discovered on an almost weekly basis. Historically, these families have shared one similarity – they have all been deployed by attackers casting a wide net and largely being victim-agnostic. In most cases, the adversaries have used phishing emails and exploit kits in a ‘spray and pray’ style tactic.

However, in recent months, a new trend seems to be emerging: targeted attacks where ransomware is deployed by threat actors after successfully gaining unauthorized access to an organization’s network. One malware family seen in such attacks is known as ‘SamSa’, ‘Samas’, ‘samsam’, or most recently, ‘MOKOPONI’. Reports on this malware family have previously been published by both Intel Security and Microsoft.

Palo Alto Networks has collected over 20 samples of this particular malware family, and we have identified over $70,000 USD in Bitcoin payments to the attacker (Cisco Talos yesterday reported this figure to be closer to $115,000 USD). This blog details the evolution of this malware family, which was first witnessed in December 2015, as well as provides various indicators of compromise (IOCs) that can be used by the security community.

How the Malware Is Installed

As reported by both Microsoft and Intel Security, the malware is installed in a very targeted manner and appears to be in use post-compromise. First, the attacker will gain unauthorized access to a victim network, then begin mapping out the network in order to move laterally and discover more potential victim hosts. Once the attacker has sufficiently found enough victim systems, SamSa is deployed manually, using common system administrator utilities, such as PSExec.

After deploying the malware on various victim hosts, it will be installed using a RSA public key that is generated specifically for that particular attack. Additionally, a batch script is deployed that is responsible for deleting volume shadow copies on the victim machine to prevent restoration of files, executing SamSa, and finally self-destructing after successful encryption.

Malware Details

With the exception of the earliest known samples of SamSa, the malware expects an RSA public key file to be provided manually as a command-line argument. This is quite different from other ransomware families that retrieve the public keys automatically from command and control servers. The initial samples of SamSa actually embedded the public RSA key within the malware itself. More information on these changes can be seen in the ‘SamSa Evolution’ section below. In the event a public key is not provided as a command-line argument, the malware will exit, which provides minimal contextual evidence when run in a sandbox environment.

Figure 1 SamSa code looking for RSA Public Key

The malware proceeds to create a directory that will subsequently be used to store a batch script that is responsible for removing the SamSa executable after it completes its operation.

The following folders have been identified over the 23 analyzed samples:

%APPDATA%\FontCachedManager
%APPDATA%\MacroReder
%APPDATA%\SystemAccountManager

These folders will eventually contain an embedded file that is dropped by the malware called either ‘selfdel.exe’ or ‘del.bat’, which is responsible for removing SamSa.

The malware then seeks out a number of files based on an embedded list of file extensions. Presumably for performance reasons, SamSa will ignore the Windows directory, paths containing ‘Reference Assemblies\\Microsoft’ and the recycle bin.

Figure 2 Malware ignoring certain directories

The number of file extensions changes slightly over the course of the malware’s evolution. It averages between 327 to 345 different file extensions.

After identified files are discovered, they are encrypted using the supplied RSA public key and have the ‘.encryptedRSA’ file extension appended to them.

Figure 3 SamSa encryption routine

The malware then writes a ‘HELP_DECRYPT_YOUR_FILES’ file with an extension of either .html or .txt. This file contains instructions on how the victim may recover their files.

Each sample has a unique bitcoin address where the victim must provide payment. Payments vary based on the victim. Some instances require the victim to pay per machine, while others require the organization to pay a lump sum. A breakdown of payments is shared later in this post.

SamSa Evolution

Since witnessing the first sample with a compile time of December 9, 2015, we’ve observed that the malware author has made a number of small changes to the code base. The oldest sample actually appears to be a test executable, where the author placed a number of obviously fake placeholders instead of actual data, as seen below:

Figure 4 Snippet of ransom page from initial test SamSa file

Only a day after this first executable was compiled, we saw the attacker create two unique samples with actual bitcoin addresses, blog addresses, and demands for 37 BTC and 50 BTC respectively.

Code Changes

As the malware continued to evolve, the author included simple code obfuscation routines, such as hex-encoding sensitive strings, adding underscores in variable and function names, and in some cases, inclusion of garbage code.

Figure 5 Code obfuscation added by the malware author

File Extension Changes

Initially, the malware authors included 344 file extensions. Starting in mid-December 2015, this number changed to eventually settle on 327 extensions. The following file types were added and removed during this transition:

Added:

‘.kbx’, ‘.php5’, ‘.phtml’, ‘.xml’, ‘.tif’, ‘.tib’

Removed:

‘.vmsn’, ‘.vmsd’, ‘.gif’, ‘.chm’, ‘.nvram’, ‘.vb’, ‘.bin’, ‘.cnf’, ‘.vmem’, ‘.cab’, ‘.dat’, ‘.log’, ‘.vbs’, ‘.data’, ‘.js’, ‘.jse’, ‘.xls’, ‘.vmdk’, ‘.jin’, ‘.vmx’, ‘.vmxf’, ‘.gz’, ‘.conf’

Another change occurred in mid-February 2016, when the attacker added the ‘.xls’ file extension. Finally, starting in mid-March 2016, the following three extensions were added:

‘.config’, ‘.asmx’, ‘.vb’

Figure 6 Number of file extensions in SamSa over time

Ransom Notice Changes

Over the course of SamSa’s lifetime, the ransom notice changed from a simple txt file to HTML files. These changes can be seen below:

Figure 7 Ransom page version 1

Figure 8 Ransom page version 2

Figure 9 Ransom page version 3

Domain Changes

Over the past four months, the attacker has changed hosting providers for the victim’s payment website. Initially, the attacker made pages using the anonymous ‘www.anonyme[.]com’ web service. Starting in January 2016, the attacker switched tactics to instead use web pages hosted by wordpress[.]com. Finally, starting in mid-February 2016, the anonymous TOR network was used to host these web pages.

Figure 10 SamSa domain changes over time

Bitcoin Demands

Unlike other ransomware families, the attacker behind SamSa will either demand a large lump sum for the decryption key for all infected machines in an organization, or will demand a smaller amount for each infected machine. Initially, in December 2015, the attacker favored a lump sum. In January 2016, the attacker changed tactics and instead asked for either 1 or 1.5 Bitcoin (BTC) per infected machine. Finally, since February 2016, the attacker appears to have returned to requesting a large sum of BTC. The breakdown can be seen below:

Compile Timestamp Payment Requested
12/9/15 23:02 50000000000 BTC (Test File)
12/10/15 0:43 37 BTC
12/10/15 15:31 50 BTC
12/16/15 22:32 50 BTC
1/1/16 19:00 1 BTC Per Machine
1/6/16 0:14 1 BTC Per Machine
1/6/16 0:14 1 BTC Per Machine
1/6/16 0:20 1 BTC Per Machine
1/6/16 0:22 1 BTC Per Machine
1/14/16 20:34 1 BTC Per Machine
1/14/16 20:46 1.5 BTC Per Machine
2/3/16 21:01 22 BTC
2/5/16 20:51 22 BTC
2/5/16 21:11 22 BTC
2/5/16 21:25 22 BTC
2/12/16 17:13 22 BTC
2/18/16 20:45 22 BTC
2/18/16 20:45 22 BTC
3/10/16 10:01 22 BTC
3/18/16 22:24 45 BTC
3/18/16 23:03 45 BTC
3/18/16 23:06 45 BTC
3/18/16 23:09 45 BTC

Internal Filename

Another curious development occurred in mid-March 2016, when the malware author changed the internal name of the malware from ‘samsam’, which is likely how the malware was originally named, to ‘MOKOPONI’. It’s unclear why this change was made. It is worth noting that all samples named ‘MOKOPONI’ have been observed using the same C2 address of ‘roe53ncs47yt564u[.]onion’ with unique URIs.

SamSa Attacker Profits Gained

By tracking the unique BTC addresses found within all of the collected samples, we were able to determine when victims made specific payments. The following table shows payments made to the various BTC wallets:

BTC Address BTC Paid
1Gmjyb9wd6Ju9phn5tREmLYwPsPFusqEx6 0.0 BTC
1FpZFUGqAkyjAGVgHXhaHrSmThJHxd2a7v 0.0 BTC
1FpZFUGqAkyjAGVgHXhaHrSmThJHxd2a7v 0.0 BTC
19CbDoaZDLTzkkT1uQrMPM42AUvfQN4Kds 2.0 BTC
19CbDoaZDLTzkkT1uQrMPM42AUvfQN4Kds 2.0 BTC
19CbDoaZDLTzkkT1uQrMPM42AUvfQN4Kds 2.0 BTC
1FESb2caoXp27gEgVhyoCGHSkGhGwkzJbF 0.0 BTC
1JnxLRQSHkCw5aEhu5VQptUq4XmxntAvL2 10.0 BTC
1KVvqPi5QivfH3SKFpFWbeRwjdKREPYoAv 0.0 BTC
175wjzT5M7XvYYW447ry4TQmHUfzTrBUcN 0.0 BTC
1Cn4YXWmjARbK459hGQz54g3KTQLB7XYZs 0.0 BTC
1KwgwwWdoL9VFcg9VuCDGBiVZ2LNzGnrov 40.0 BTC
1ETLG9xnFwZ1H9xaHz6u4MX8KYvWJesMab 22.002305 BTC
1D6ScsG2BmZu3VFDEgfnMC6CzjnWtZi6Kj 40.0 BTC
1C9YUWk2iKAxjdvcysyA1C7xzR7evhr2qA 0.0 BTC
1AFoh41i1s56Tc2cRnwvJv1Hx8YfvbWxbh 0.0 BTC
1AFoh41i1s56Tc2cRnwvJv1Hx8YfvbWxbh 0.0 BTC
136hcUpNwhpKQQL7iXXWmwUnikX7n98xsL 3.42 BTC
1KakTJ8dpYFSnBohLakqMHKonZ4HGo3ur5 0.0 BTC
1FDj6HsedzPNgVKTAHznsHUg4pKnGRarH6 45.0 BTC
15HUUDBjLD34XfCu6YtafT7ARSt2TBrLBe 0.0 BTC
1EzpHEojHsLkHTExyz45Tw6L7FNiaeyZdm 0.0 BTC

By adding up the paid amounts, we get a total of 166.422305 Bitcoin, which, based on the current Bitcoin exchange rate, amounts to roughly $70,000 USD made by the attacker since December 2015. (A report by Cisco Talos yesterday put this figure as high as $115,000 USD.)

The two payments of 40 BTC are particularly interesting, as they took place on February 3 and 5 respectively. These payments were made at roughly the same time that reports came out of the Hollywood Presbyterian Medical Center meeting demands for 40 BTC to ransomware that hit their organization. While evidence is circumstantial, it is possible that SamSa was directly responsible for this particular incident.

Another interesting piece of evidence comes in the form of public notes attached to the payments made to 1KwgwwWdoL9VFcg9VuCDGBiVZ2LNzGnrov. Specifically, the following notes are present for payments of 22 BTC and 18 BTC respectively:

Public Note: For HPMISDTJRTJBM1 and HPMGPS01
Public Note: For HPMISDTJRTJBM1 AND HPMGPS01 FOR ALL AFFECTED PC

Again, this is purely speculative, but it’s certainly possible that these strings are hostnames, and the ‘HPM’ characters may stand for Hollywood Presbyterian Medical.

Conclusion

Overall, SamSa has been a serious threat that has stayed under the radar until recently. The malware has been seen since December 2015, and is likely responsible for a number of large ransomware infections across organizations. While the malware itself is not terribly sophisticated, the tactics used by the attackers, such as the lack of command and control infrastructure, the ability to compromise external facing systems to gain unauthorized access, and movement towards more obfuscation, make SamSa a serious threat.

IOCs for SamSa collected by Palo Alto Networks can be found here.

Palo Alto Networks’ customers are protected from this threat in the following ways:

  1. WildFire accurately identifies all SamSa malware samples as malicious.
  2. Domains used by SamSa have been flagged as malicious in Threat Prevention.
  3. AutoFocus users can view malware related to this attack using the SamSa

and

[Palo Alto Networks Research Center]

English
English
Exit mobile version