Category: Palo Alto Networks

General awareness for the need to improve cybersecurity in industrial control systems (ICS) has increased significantly in recent years, but there are still plenty of misconceptions. A recent incident that can be used to highlight some of these is the cyber attack on a German steel factory, described in a report from the German Federal Office of Information Security (BSI). According to an article which translated and summarized some passages of the report:

1. After the system was compromised, individual components or even entire systems started to fail frequently. Due to these failures, one of the plant’s blast furnaces could not be shut down in a controlled manner, which resulted in “massive damage to plant.”
2. The attack used spear phishing and sophisticated social engineering techniques to gain access to the factory’s office networks, from which access to production networks was gained.
3. The attack involved the compromise of a variety of different internal systems and industrial components, BSI said; not only was there evidence of a strong knowledge of IT security but also extended know-how of the industrial control and production process.

This attack effectively debunks a few myths about ICS cybersecurity. One common myth is that “Besides Stuxnet, cyber attacks to ICS have not really led to any physical damage.” To many, the Natanz Stuxnet incident just seems so one-off and far-removed from the rest of the world, that the kinds of ICS cyber risks it exposed, particularly cyber-physical damage, can be ignored. But physical damage from cyberthreats does happen and is often not publicly disclosed. This reported incident is a clear reminder that critical assets can be destroyed by cyber attacks.

Another myth challenged by the German incident is that “ICS systems can be secured by air-gapping.” There are many economic, operational and even regulatory drivers that compel ICS environments to have connectivity to internal and 3^rd party organizations. Air-gapping for the most part is not a practical option in this day and age. Organizations need to plan for connectivity outside of “Ops” and ensure it is done in a cyber-secure manner. This is not to say that internal segmentation/security can be ignored — insider threats are also very real.

The third myth that comes to mind is one I still hear a lot: “All you need are firewalls to achieve security.” This is not to say that the only security devices the steel mill had were firewalls. They could have very well had a range of security devices and technologies deployed. But the point here is that putting just legacy, stateful-inspection firewalls in the ICS environment is not enough to ensure security. Additional security capabilities at the network and endpoint levels are required to effectively stop advanced threats.

To achieve true defense in depth in an escalating threat landscape, more effective technologies such as application visibility and control, network IPS/AV/Anti-spyware, and malware sandboxing, to name a few, need to be brought in. Also, the paradigm of deploying signature-based endpoint protection technologies needs to be challenged as those technologies do nothing to stop completely new attacks. Advanced endpoint protection that prevents even zero-day attacks needs to be deployed. Furthermore, these technologies need to be brought together into a tightly integrated platform that ensures prevention, instead of just detection, and that automates security tasks as much as possible to reduce the burden on security personnel.

ISA-99 Managing Director, Joe Weiss, and I will debunk these myths and several other recurring misconceptions with regards to securing SCADA and ICS environments in a January 7 webinar: “Exposing Common Myths Around Cyberthreats to SCADA and ICS.”

We also discuss some best practices and the Palo Alto Networks enterprise security platform, with which you can address security gaps and drive change in your organization. Register for the webinar here.

[Palo Alto Networks Blog]

March 20, 2012 was a good day for cybersecurity. It was the day that the Russian police had managed to arrest the criminals behind “Carberp”, a Trojan used to compromise numerous bank accounts. Less than two years later, the minds behind this operation can add to their list of accomplishments: a major operation targeting financial institutions was successfully executed.The core malware that was used in this attack was dubbed “Anunak”: a Trojan that according to current research has been used only for targeted attacks. Unsurprisingly, within the Trojan code, parts of “Carberp” codes were found.

The attackers were able to penetrate internal networks using two major vectors: the first by leveraging existing botnets (including both botnets that were created by the group and those owned by collaborators) and the second by sending malicious spear-phishing emails. The spear-phishing emails contained an infected attachment exploiting CVE-2012-2539 and CVE-2012-0158, both of which are familiar vulnerabilities. For the process of privileged escalation, the attackers used CVE-2014-4113, a vulnerability that had recently been exploited in the wild.

This first attack of this campaign was initiated at the beginning of 2013 against a Russian bank. After using the method mention above to infect an employee computer, the attackers had spread to various servers (using privilege escalation) and eventually gained access to the Holy Grail: the banking system servers and workstations. Once the attackers managed to gain a foothold in internal banking system, malicious software was installed and remotely controlled.

The exposure of this operation comes shortly after a different campaign targeting the same sector: On December 18, Kaspersky Labs published details of a new malware threat called Torjan-Banker.Win32.Chtonic. This malware is described as an evolvement of the infamous Zeus Trojan, and as Zeus did, has been targeting the financial sector – specifically, online banking systems and customers. The spread of this malware is quite wide; Chthonic was found in over 20 payments systems and over 150 different banks in 15 countries, mainly in UK, US, Spain, Japan, Russia and Italy.

This widespread attack was carried out by the rather pervasive infection technique: a backdoor for a malicious code was embedded within a .DOC file which was sent as an email attachment or as web link. This malicious file exploits a familiar vulnerability in Microsoft Office products: CVE-2014-1761. This exploitation then initiates a series of actions in which a malicious code is being injected into the process msiexec.exe and several modules are being installed on the victim’s machine.

As is often the case in targeted attacks, the enabler of the attack in both of these cases was exploitation. The term exploitation is used quite frequently; it refers to the exact moment that a vulnerability is being leveraged to enable malicious code execution. That moment is also the basis with which Palo Alto Networks Traps was developed. Traps is our Advanced Endpoint Protection solution which proactively prevents vulnerability exploitation without prior knowledge. It is agnostic to whether the threat is familiar or new (Zero Day).

Why does Traps matter to this discussion? In these specific attack cases, all of the mentioned vulnerabilities that were used for exploitation (CVE-2012-2539, CVE-2012-0158, CVE-2014-4113 and CVE-2014-1761) would have been successfully prevented with Traps deployed.

Learn more about Advanced Endpoint Protection and Traps here.

[Palo Alto Networks Blog]

“We have about 800 users using internal and external applications, one main office and four external locations,” explains Ursula Dickmann, Head of IT Operations for RheinLand Versicherungsgruppe in Germany. “Our challenge is weighing security risks against not restricting employees to the point where it hinders their ability to do work.”

 

Like all insurance companies, RheinLand Versicherungsgruppe, manages highly sensitive financial and personal data for individuals and businesses. Its employees have to be productive, but RheinLand’s customers must trust its ability to protect their data above all else. Therefore, Ursula and her team must ensure they can safely enable business applications, control access, meet compliance regulations and protect the network, all while keeping IT costs manageable.

RheinLand had previously relied on firewalls from Check Point and WatchGuard, but were pointed to Palo Alto Networks by longtime IT advisory partners Helmich.

I invite you to read about how RheinLand’s IT decision-makers, initially skeptical, became believers in our Enterprise Security Platform. They put us to the test, did their homework — and are now saving 40% of previous time spent managing infrastructure and thousands of Euros in IT costs while getting better features, better visibility and better performance.

It can be done!

This case study is also available in German. Click here to access.

Customer Spotlight is our regular look at how various customers use Palo Alto Networks enterprise security platform to solve their toughest challenges. See below for Customer Spotlight blogs from throughout 2014:

• Solving BYOD for This Private School Didn’t Require Magic, Just a Fresh Approach
• Guarding High-Stakes Financial and Energy Data From Endpoint Exploits
• Explaining the Value of Advanced Endpoint Protection
• A Customer Perspective: VMware NSX, Next-Generation Security and Micro-Segmentation
• How a Leading Sports and Entertainment Precinct Stays Secure
• How a Manufacturing Leader Saves Millions In IT Costs
• Empowered by WildFire
• Relieving Bandwidth and Security Pressure at Animal Logic
• Solving BYOD at Japan’s Kyushu University
• WildFire A Deeper Sandbox for Nova Scotia Health
• The Heinz Endowments Replaces Cisco with Palo Alto Networks

 

[Palo Alto Networks Blog]

Unit 42 is the Palo Alto Networks threat intelligence team. Made up of accomplished cybersecurity researchers and industry experts, Unit 42 gathers, researches, analyzes, and provides insights into the latest cyber threats, then shares them with Palo Alto Networks customers, partners and the broader community to better protect enterprise, service provider, and government computing environments.

You can now have up-to-the-minute threat intelligence updates from Unit 42 delivered right to your inbox, as they’re posted. Click here to subscribe.

Regular research analysis is posted to the Unit 42 threat intelligence blog. Unit 42 also publishes whitepapers examining, in detail, threats to mobile device ecosystems, APTs, malware attack patterns and other subjects crucial to any security practitioner or business executive’s understanding of the current cyber threat landscape.

Recent Unit 42 whitepapers include:

• CoolReaper: The Coolpad Backdoor (December 2014)
• Unit 42 Threat Landscape Review – Fall (December 2014)
• WireLurker: A New Era in OS X and iOS Malware (November 2014)
• We Know It Before You Do: Predicting Malicious Domains (September 2014)
• 419 Evolution (July 2014)
• Unit 42 Threat Landscape Review – Spring (April 2014)

And here are some recent highlights from the Unit 42 threat intelligence blog:

• Google Chrome Exploitation: A Case Study
• [Infographic] Unit 42 Explores Malware Attack Vectors in Key Industries
• DTLS Vulnerabilities in CVE-2014-6321
• Code to Trigger MS14-066 ECDSA Server BOF Vulnerability
• Follow-On to VBA-Initiated Infostealer Campaign: Exploring Related Malware and Actors
• Addressing CVE-2014-6332 SWF Exploit
• Protecting Users from iOS App Provisioning Profile Abuse
• Palo Alto Networks Identifies 3 Critical Internet Explorer Vulnerabilities

 

Unit 42 team leads will lead a track at Ignite 2015, where they will discuss all your toughest security challenges and work out ways to help you solve them. Register now to join Palo Alto Networks in Las Vegas, March 30-April 1, 2015.

 

The sheer volume of malware, application vulnerabilities and advanced persistent threats makes it difficult for security teams to make the right decisions when it comes to protecting their networks. Wouldn’t it be great if there were a way to understand exactly who and what have been trying to get onto your network, and where threats are coming from?

Well, there is.

Palo Alto Networks Enterprise Risk Report (ERR) provides actionable security intel that allows you to make targeted recommendations based on an analysis of your actual network traffic. It helps you better understand the strengths and weaknesses of your current cybersecurity posture and serves as an effective tool for showing management exactly what your network is up against and how to minimize your organization’s exposure to risk.

Get your customized Enterprise Risk Report underway by registering here.

Your custom report will include:

• Total scope of unknown threats observed
• Percent of malware undetected by top AV solutions
• Malware prevented by Palo Alto Networks WildFire™
• Application threat vectors and malicious file types
• Additional threat intelligence for your organization

[Palo Alto Networks Blog]