Earlier today at Ignite 2016, our annual user conference, we announcedthat we are joining forces with PwC’s Cybersecurity Practice to help customers establish security architectures, organizational structures and computing processes optimized to prevent cyber breaches.
Together, we are designing a next-generation security framework to guide customers through establishing a breach prevention-oriented security architecture. This framework incorporates the latest advances in security technology and addresses the modern threat landscape.
To learn more about our partnership, visit Palo Alto Networks & PwC page to read the press release, download an executive overview, and register for a webinar featuring the security framework.
With the release of its white paper Information Systems Auditing Tools and Techniques: Creating Audit Programs, ISACA describes the basic steps to create an audit program. This white paper is part of a series created to deliver practical guidance on how to perform an audit engagement—from planning to reporting and closing—that is consistent with ISACA Auditing Standards (ITAF) as well as those issued by the Public Company Accounting Oversight Board (PCAOB), the Institute of Internal Auditors (IIA), and the American Institute of Certified Public Accountants (AICPA).
Information systems (IS) audits help enterprises ensure effective, efficient, secure and reliable operation of information technology. Audits can also help confirm compliance with numerous legal and administrative regulations, and help management determine if the business is functioning well and meeting challenges. Most importantly, audits assure stakeholders of the organization’s financial, operational and ethical well-being. All of these outcomes are supported by IS audits, especially the information and related technology and systems that most businesses and public institutions rely upon for a competitive advantage.
An important component of the audit plan is the audit program. Audit programs are commonly used to document the specific procedures and steps of testing and verifying control effectiveness. The audit program’s quality has significant impact on the consistency and quality of the audit results, so it is imperative that IS auditors understand how to develop comprehensive audit programs.
The many benefits of an effective audit depend on proper and thorough planning of the audit engagement. To make this happen, the auditor and the area being audited must understand and accept the scope and objective of the audit. Once the purpose is defined, the next step is to create an audit plan that captures the agreed scope, objectives and procedures required to get the relevant, reliable and sufficient evidence to draw and support audit conclusions and opinions.
To demonstrate the process described in the white paper, ISACA has released a sample audit and assurance program developed using a five-step process to gather the necessary information to define the audit subject, objective, scope and audit methodology. The sample audit program for a virtual private network can be customized to create a specific audit and assurance program tailored to your unique needs.
The documents are intended for IT audit professionals who are either new to the profession preparing to the Certified Information Systems Auditor (CISA) or simply want to brush up on their skills.
In October 2014, Malwarebytes identified a campaign based on thousands of compromised websites that kicked off an infection chain to Angler exploit kit (EK). It was named “EITest” campaign, because “EITest” was a variable consistently found in injected scripts across all of the compromised websites. Malwarebytes noted some changes in this campaign in 2015 and2016.
Like others in the cybersecurity threat research community, we have been tracking the EITest campaign. This blog post focuses on network traffic and how indicators have changed over time.
The Evolution of EITest
We first saw traffic related to this campaign in September 2014. Since then, patterns for injected script in the compromised websites have remained consistent. Only the URLs and variable names have changed.
Figure 1: Injected script from the EITest campaign in September 2014.
Figure 2: Injected script from the EITest campaign in March 2016.
The EITest gate occasionally changes IP addresses, but since January 2016, this campaign used the 85.93.0.0/24 block. So far this year, the TLD for these domains has most often been .tk, but other TLDs are also used. Below is a list with the date, IP address, and domain we have seen for the EITest gate URL
When we first noticed the EITest gate in September 2014, the URL format was:[domain]/player.php?pid=[long hexadecimal string]. Sometime in 2015, player.php switched to[random word].php and ?pid changed to ?sid. By mid-February 2016, the EITest gate URL experienced more drastic changes. See figure 3 for details.
Figure 3: Changes in EITest gate URLs since 2016-02-15.
Flash File for Redirection
The EITest gate URL continues to return a Flash file that redirects traffic to Angler EK. This gate URL always generates two HTTP GET requests. The first request retrieves the Flash file and the second request returns script pointing to an Angler EK landing page.
Figure 4: First HTTP GET request to EITest gate returns a Flash file.
Figure 5: Second HTTP GET request to EITest gate returns script pointing to Angler EK.
Differences in Angler EK Used by This Campaign
Angler EK used by this campaign is somewhat different than Angler EK for other actors. Campaigns like pseudo-Darkleech tend to distribute ransomware like CryptoWall or TeslaCrypt. However, the group behind EITest pushes a variety of malware. Below are examples of the Angler EK caused by the EITest campaign and the associated malware.
2014-09-22: Vawtrak
2014-10-02: Pushdo.s
2015-06-08: Vawtrak
2015-11-10: Tinba
2015-12-04: TeslaCrypt
2016-01-19: Bedep and Kovter.B
2016-01-25: Fareit/Pony and Pusdo.s
2016-01-26: Bedep and TeslaCrypt
2016-02-03: HydraCrypt
2016-02-10: Ursnif variant
2016-02-15: TeslaCrypt
2016-02-18: TeslaCrypt
2016-03-03: TeslaCrypt
2016-03-04: dropper, possible Andromeda
2016-03-07: dropper, undetermined
2016-03-09: TeslaCrypt
2016-03-14: Zeus variant
2016-03-29: Bedep and possible Neutrino/Andromeda malware
Conclusion
The EITest campaign has been active since at least September 2014. Patterns of injected scripts sent by the websites compromised in this campaign have remained fairly static. However, the gate URL has evolved considerably since the campaign first started. The EITest gate leads to Angler EK and delivers a variety of malware. This campaign is not limited to ransomware like other campaigns that use Angler EK.
Palo Alto Networks customers are protected from the EITest campaign through our next-generation security platform. Associated domains have been flagged as malicious in Threat Prevention, and WildFire classifies the Flash files used in this campaign as malicious.
We are days away from Ignite Conference 2016! Take a look at the top five things you need to know before heading to our biggest security conference of the year.
1. Build Your Agenda
Use Agenda Builder to create an event that is customized to your interests. Workshops and sessions are designed to be modular, so no matter how you stack them, you’ll get an integrated approach to preventing cyber breaches and securing your organization. Don’t forget to register for the sessions that interest you and reserve your spot before heading to the event.
Learn more about the Agenda Builder, available tracks and sessions, and event highlights.
2. Check Out Cyber Range
Come watch our Cyber Range Threat Prevention workshops in the Expo Hall and cheer on your favorite team. Don’t forget to follow along and join the conversation on Twitter using the#IgniteRanger hashtag.
Session Times:
Tuesday, April 5 | 12:30 – 3:30 PM PT
Wednesday, April 6 | 9:00 AM – 12:00 PM PT
3. Get Certified
We are offering a special rate to all Ignite 2016 attendees – 50 percent off your Palo Alto Networks Certified Network Security Engineer (PCNSE) exams .
With the Ignite 2016 mobile app, you’ll have everything you need to navigate the event right in the palm of your hands. Access your daily agenda, read up on speakers, and join the#igniteconf16 Twitter conversation.
Step 3: Open the app and input your activation code you were emailed, or input your email address and you will be emailed your code.
5. Win Great Prizes
We have two contests this year where you’ll have an opportunity to win some great prizes.
Passport to Prizes contest
Access your “digital passport” from the Ignite 2016 mobile app and scan each sponsor booth’s QR code by 6:00 PM PT on Tuesday, April 5. Once you scan all 27 QR codes, you’re automatically entered to win this Sphero BB-B App-Enabled Droid.
The drawing for each booth will take place in the Expo Hall at 6:30 PM on Tuesday, April 5.
Most Active Mobile App User contest
Be a power user of the Ignite 2016 mobile app and be eligible to win a $250 gift certificate to the Palo Alto Networks Ignite Shop.
Point system:
Get 4 points for every completed survey
Get 2 points for every post to the activity feed
You have until 5:30 PM PT on Tuesday, April 5 to complete your surveys and your submit your posts. The lucky winner will be announced at 6:00 PM on Tuesday, April 5.
We’re looking forward to seeing you next week at Ignite Conference 2016!
About Ignite 2016
April 3-6, 2016 at The Cosmopolitan Hotel Las Vegas Ignite is a live, four-day conference designed for today’s security professionals. Hear from innovators and experts, gain real-world skills through hands-on sessions and interactive workshops, and find out how breach prevention is changing the security industry. Visit the Ignite 2016 website for more on tracks, workshops and marquee sessions, and register today.
Earlier this month, I had the privilege of attending the Cyber 9/12 Student Challenge at American University, sponsored by the Atlantic Council. The Cyber 9/12 Student Challenge is an annual cyber policy competition for students across the globe to compete in developing national security policy recommendations tackling a fictional cyber catastrophe. During the Cyber 9/12 Student Challenge, teams were evaluated on their:
Understanding of cyber conflict policy concepts and guidance
Ability to identify key issues and fully respond to critical cyber conflict policy issues posed by a serious cyber-related scenario
Analysis of policy response alternatives, including the trade-offs involved
Ability to organize and provide clear and concise policy response options with supporting analysis
Presentation of original, creative and innovative solutions to the scenario
Each team had to do all of this in a decision document limited to two pages, as well as deliver an oral presentation – no easy task, for sure!
I had the distinct honor and true pleasure to participate in this important event in multiple ways throughout the two days, including in a panel discussion with former U.S. Under Secretary of Defense for Policy Dr. Jim Miller, moderated by Jason Healey, Senior Research Scholar at Columbia School of International and Public Affairs. I also had the opportunity to be a judge in the “final four” competition, awarding the Cyber 9/12 competition. Finally, I presented the Military Cyber Professionals Association’s (MCPA) “Order of Thor” medals to the best military college team, the Air University at Maxwell Air Force Base, Alabama, which just so happened to be the winner of the Cyber 9/12 competition.
I believe that events such as this are both rare and critical to our national security and international economic competitiveness. There’s no shortage of the more technical cyber competitions, such as Capture the Flag. However, there aren’t many events that pit college teams against each other over the development and delivery of clear, precise, well thought out governmental policy options when dealing with the growing cyberthreats and challenges that we face in today’s digital age.
Kudos to the sponsors, hosts, speakers and other contributors to this world-class event, but mostly I want to thank the 39 college teams that competed. They were all magnificent, and I sincerely wish them the very best of success in something that’s of critical importance to our country and the world!
Please take a minute to check out the photos from the Cyber 9/12 Student Challenge.
