Category: #IT/CYBER/TECHNOLOGY

Executive Summary

On the occasion of the 12th U.S. National Cyber Security Awareness Month, threat prevention comes to the forefront as something that the community has rediscovered as a security innovation. We used to do this as a matter of course, but sort of lost our way for a while. Today, smart network defenders have learned that threat prevention is inextricably linked to detection and mitigation. You should not have one without the other two.

Introduction

Twelve years ago, the Department of Homeland Security designated October as National Cyber Security Awareness Month for the United States. [1] When I noticed that this year’s installment was approaching, I began to wonder if there were any new developments in the cybersecurity community of which most people were not aware. Part of my job is to travel around the world talking to smart people about how they do security, and it has been an education these past two years. Every network defender whom I talk to does it differently, and they all have good reasons why they are different. But the one thing that is clear to me is that most do not realize that there is a quiet revolution going on right under their noses. The cybersecurity community is rediscovering the idea that threat prevention is an atomic piece of the overall defensive strategy for any organization.

A Little History

When I started in the industry some 25 years ago, all we had in our toolbox was threat prevention controls: stateful inspection firewalls, intrusion detection systems and antivirus engines to name a few. Sometime in the mid-2000s, innovative companies started selling some very good niche products that could detect adversaries once they had breached the typical threat prevention defenses that we all had deployed in our networks. Some of these new tools were very good and we started finding all kinds of bad guys in our systems.

In 2010, state-sponsored cyber espionage adversaries attacked Google, and for the first time in history, a commercial company went public with the information.  [2] Before the Google attacks, referred to as Operation Aurora in the press, no commercial company would dare go public with the fact that a cyber adversary had been successful in breaching their network. Common wisdom in the industry at the time was that such an admission would wreck the bottom line of the company by hurting the brand name. But with Google’s public admission and a plethora of state-passed, public breach notification laws on the books that came later [3], it seems that you can’t get through a week of cybersecurity news today without one or two companies announcing they have been breached.

Somewhere between the Google attacks and today, the security vendor community threw up their hands in dismay and declared that it was not possible to prevent bad guys from penetrating our networks.  Our only hope, they would say, was to quickly detect them, once they were successful, and eradicate them from the network as soon as possible. The security vendors seemed to declare that threat prevention was dead, and our only hope was detection and mitigation.

That is the dumbest notion I have ever heard.

Threat Prevention as a Rediscovered Innovation

We can absolutely stop most of the known badness that black hat adversaries throw at our networks. We can’t stop all of it, for sure, but we can stop most of it. As a network defender, why would you leave that option off the table to simply rely on a detection and mitigation strategy? That obvious question has started to pop up on the radar of many network defenders whom I have talked to this year.

My CTO, Nir Zuk, is fond of saying that, if you are okay with the idea that some adversary will steal your most precious secrets right out from under your very noses, and your risk mitigation plan involves noticing that they were there after they are gone,  then you should probably consider another line of work. [4] And he is absolutely right. When you say it out loud like that, you realize how crazy that sounds.

What I have noticed this past year is that the cybersecurity community has come back around to this notion that threat prevention is a key and fundamental element to any network defender’s plan. It has to work hand in hand with the other two requisite pieces: detection and mitigation, but it cannot be left out. All three are essential to the plan, but none are sufficient by themselves. Smart network defenders have never abandoned this idea. The rest of us are just now rediscovering it.

Conclusion

As I reflect on the state of cybersecurity during this 12th U.S. National Cyber Security Awareness Month, threat prevention comes to the forefront in my mind as something that has been old in the past but is new again today. As I travel around the world talking to smart people about security, this is what they are talking about: threat prevention is key and essential to any defensive program. It is as important as detection and mitigation but, more to the point, network defenders should not choose one over the other. They are inextricably linked together.

Sources

[1] National Cyber Security Alliance. 2015. “National Cyber Security Awareness Month,”StaySafeOnline.org. Last Visited 28 September 2015.
https://www.staysafeonline.org/ncsam/about

[2] Zetter, Kim. 2010. “GOOGLE HACK ATTACK WAS ULTRA SOPHISTICATED, NEW DETAILS SHOW.” Wired. Last Visited 28 September 2015.
http://www.wired.com/2010/01/operation-aurora/

[3] National Conference of State Legislatures. 2015. “SECURITY BREACH NOTIFICATION LAWS.” National Conference of State Legislatures. Last Visited 28 September 2015.
http://www.ncsl.org/research/telecommunications-and-information-technology/security-breach-notification-laws.aspx

[4] Zuk, Nir. 2015. “Only a Platform Can Prevent Attacks.” Ignite 2015, Palo Alto Networks. Last Visited 28 September 2015.
http://researchcenter.paloaltonetworks.com/2015/05/nir-zuk-at-ignite-2015-only-a-platform-can-prevent-attacks/

Rick Howard

[Palo Alto Networks Blog]

Malicious actors employ a range of tools to achieve their objectives. One of the most damaging activities an actor pursues is the theft of authentication information, whether it applies to business or personal accounts. Unless specifically mitigated, this theft often allows an unauthorized actor to masquerade as the victim, either achieving immediate gains or creating a platform from which progressive attack campaigns may launch.

There are a number of threats that endanger the critical secrecy of credentials, including poor operational security practices, social engineering, man-in-the-middle attacks, password hash dumping and cracking, and surveillance malware. In this post, Unit 42 examines various trends in a malware threat set within the surveillance malware category: Predator Pain and its latest derivative, HawkEye.

Threat Background

Surveillance malware covers a broad range of capabilities, including:

• Capture of keyboard and / or input device (e.g., mouse) activity, with window / process awareness (keylogging)
• Taking asset display screen shots or video (display capturing)
• Assuming control of cameras and / or microphones attached to an asset (live surveillance)
• Interception of network communications (sniffing)

Each of these capabilities can be qualified by its scope (i.e., types of information collected) and method (ranging in techniques and sophistication). Additionally, some surveillance software includes its own exfiltration mechanism, while others may depend on external software to accomplish the transfer of captured information.

Both Predator Pain and HawkEye are considered keyloggers, but they also include additional features, such as web browser and e-mail client credential dumping, display capture, andcaptured information exfiltration. HawkEye is openly sold on a commercial website, whereas Predator Pain is usually acquired through underground forums. Associated features have made this set of malware popular with malicious actors across a number of motivations; however, the most prevalent motivation remains cyber crime, in which stolen information is directly exploited or sold for financial gain. (A list of additional reading links is found at the end of this blog post for anyone interested in learning more about this specific threat set.)

Trending and Analysis: July 2015-September 2015

The following sections describe Predator Pain and HawkEye trending and analysis conducted by Unit 42 from July 2015 through September 2015. We leveraged the Palo Alto NetworksAutoFocus service, under which this threat set is tagged as PredatorPain.

Target Selection

Almost all of the adversaries Unit 42 observed employing this malware threat set harvest publicly disclosed or leaked e-mail addresses to construct phishing campaign targeting lists. These lists are mostly indiscriminant, with malicious actors seeking any opportunistic gains they can glean from “shotgun” style attack campaigns. The natural exposure of businesses with publicly advertised e-mail addresses (e.g., sales@<domain> or info@<domain>) makes for easy targeting of what typically represents key organizational e-mail distributions. In other words, these distributions normally reach a number of staff at the target organization who are motivated by their importance to business, increasing the likelihood of them inadvertently executing malicious code on their systems.

Threat Volume

Figure 1 depicts July to September 2015 sessions (individual occurrences) for this threat set.

Figure 1: Predator Pain / HawkEye Sessions, Jul – Sep 2015

Observed sessions revealed an interesting pattern in distribution volume ramping up on Sunday for peaks over Monday through Wednesday, with significant volume dropping from Thursday onward. We believe this corresponds with focused business targeting early in the workweek, per the previously noted targeting process employed by most cyber crime actors.

Delivery

Figure 2 shows the delivery methods observed for the Predator Pain and HawkEye threat set over the period of interest, with e-mail by far being the preferred delivery method for adversaries.

Figure 2: Predator Pain / HawkEye delivery methods, Jul – Sep 2015

Exploring respective phishing attacks further revealed the following lure themes:

• Notification or issues with product order or shipping
• Notification or issues with payment, purchase order, invoice, or billing
• Product or service quotation request
• Confusing, random, and/or purportedly personal topics

Table 1 contains some examples of more common e-mail phishing attack subject and attached filename pairings:

Email Subject	Email Attachment Filename
Re: Purchase Order	PO #5479423.exe
M.V. Chuetsu Spirit V.62A – SI / agency appointment / PDI	CHUETSU DREAM V.26A SI HK.scr
DHL AWB# 34 5673 0015 / shipment	payment.exe
New Order	ORDER.exe
Quotation.	purchase order.exe

Table 1: Lure theming examples for e-mail attacks, July – September 2015

Respective malware delivered via malicious e-mail mainly consisted of Microsoft Windows Portable Executable (PE) 32-bit and 64-bit binaries. Microsoft Word or RTF documents constituted the remainder of malicious files. Attempted downloads of this threat from web and FTP sites were also observed; however, these represented drastically lower occurrences (session counts).

Observed Targeting

With these distribution methods in mind, Figure 3 shows an AutoFocus visualization for the 80 countries Unit 42 observed as targeted by the Predator Pain and Hawkeye threat set during the noted time period.

Figure 3: AutoFocus view of Predator Pain / HawkEye targeted countries, Jul – Sep 2015

Not surprisingly, the top-ten list of most highly targeted countries includes 7 of the 23 wealthiestin the world, based on GDP per capita:

• United States
• Australia
• Canada
• Thailand
• Taiwan ROC
• Kuwait
• Japan
• Spain
• Italy
• Sweden

The top ten targeted industries accounted for 82% of sessions:

• High Tech
• Higher Education
• Manufacturing
• Professional and Legal Services
• Transportation and Logistics
• Wholesale and Retail
• Construction
• Media and Entertainment
• Telecommunications
• Government

We suggest three reasons based on this combination of observed countries and industries targeted:

• Innovative organizations are prime targets for a number of adversary motivations due to the capabilities and intellectual capital they aggregate.
• Service oriented businesses, striving to develop customer relationships are more likely to fall victim to phishing attacks due to both organizational culture and incentives for client and customer engagement.
• Natural target saturation occurs within countries with established or thriving infrastructure, enabling malicious actors to reach a broader range of targets remotely through technology.

Prevalent Malware Capabilities

The Predator Pain and HawkEye set of malware is feature rich, compared to most other keyloggers. The following are the capabilities Unit 42 observed as most often enabled for this threat set during the focal time period (ordered by prevalence):

• E-mail client credential dump
• Web browser credential dump
• Collection of system configuration information
• Logging of web browser activity
• Logging of e-mail activity
• Screenshot grabbing

Exfiltration Method Break-Out

This threat set includes three main methods of exfiltration: E-mail, PHP-based Web Panel, and FTP. Figure 4 shows the HawkEye keylogger’s settings page, where the method employed by an instance can be specified.

Figure 4: HawkEye keylogger settings screen

The Predator Pain and HawkEye configurations analyzed by Unit 42 over the focal time period revealed the following break-out for exfiltration method, with e-mail constituting the preferred method across a number of malicious actors:

Figure 5: Predator Pain / HawkEye exfiltration method break-out, Jul – Sep 2015

Conclusion

Prevention is the best strategy when it comes to the threat posed by keyloggers, such as the Predator Pain and HawkEye set. System hardening, integrity assurance, software version and patch management, and user awareness are just the first steps towards threat mitigation.

Recommendations to protection against this class of threat include:

• Employ multi-factor authentication: Knowledge-based authentication relies on the secrecy of information. Including elements of what you have (i.e., hardware token) or what you are (i.e., biometrics) can reduce the value of respective stolen credentials for an adversary if that information only satisfies one level in the authentication process.
• Limit the impact of stolen credential information: Don’t share credentials across accounts and change those credentials periodically. Adversaries commonly engage in activities such as credential stuffing in an attempt to maximize benefits of stolen credentials.
• Maximize network control and visibility: The latest Verizon DBIR included the finding that in over 25% of breaches, the organization was notified of the breach through a third party. Inbound, outbound, and internal network traffic needs to be controlled and monitored. This is also useful for disrupting malware C2 and exfiltration channels.
• Integrate anti-malware automated dynamic analysis (e.g., sandboxing): Identify previously unknown threats before they become much larger problems on the network. Given the anti-detection tools at the disposal of adversaries, this is a modern necessity.
• Implement network segmentation: Avoid flat networks, where once an adversary is in they have unrestricted access to internal resources. Network segmentation is a best practice for exposing only enough information as is required for specific organizational processes, moving toward a “zero trust” model. In this context, it is about further limiting the access of an adversary should they successful compromise credentials.

Additional Reading

The following are some analyses for the Predator Pain and HawkEye malware threat set that expand on associated capabilities, attributed actors, and observed campaigns:

• Palo Alto Networks: Examining a VBA-Initiated Infostealer Campaign
• Palo Alto Networks: Follow-On to VBA-Initiated Infostealer Campaign: Exploring Related Malware and Actors
• Stop Malvertising: Analysis of the Predator Pain Keylogger
• Trend Micro: Predator Pain and Limitless – When Cybercrime Turns into Cyberspying (PDF)
• iSIGHT Partners: HawkEye Keylogger Campaigns Affect Multiple Industries
• SophosLabs (via Virus Bulletin): MWI-5: Operation HawkEye (PDF)

Rob Downs

[Palo Alto Networks Blog]

Technology is great. People are better. “People of Palo Alto Networks” celebrates the employees who preserve our unique culture of innovation and collaboration.

Episode 1

Warby Warburton
Manager, Technical Marketing Engineering

Want to learn more about securing your career with Palo Alto Networks?

• Visit our Careers page
• Follow us on Twitter at @WeHireLeaders
• Like us on Facebook, Palo Alto Networks Jobs

Justin Hall

[Palo Alto Networks Blog]