“Action is the true measure of intelligence.” There is much truth in these words by Napoleon Hill; and, even though they are aimed at personal improvement, they also apply to cybersecurity. Intelligence allows for better organization, prioritization, and display of network and threat data. Intelligence, applied in the right way to network security, leads to informed and fast action necessary to prevent cyberattacks from succeeding.
Having actionable, well-organized information about network traffic and threats at your fingertips is more crucial today than ever before. IT and security organizations are inundated with unmanageable and uncorrelated amounts of data from multiple, independent security deployments, making it impossible to find critical threats buried in mountains of information.
Frequently it is not a lack of data that leads to a data breach but a lack of appropriately prioritized, actionable data. When it comes to network security management, complexity really is your enemy. Today’s security environment results in multiple independent interfaces and policy engines, or loosely integrated security solutions with several bolted-on technologies falsely marketed as unified products. Companies these days usually have a legacy web security product, many firewalls, a mobile and an endpoint security deployment, and more. IT teams have to manage too many data sources. Security teams don’t have the time or the resources to pinpoint critical threats among the mountains of data. Both teams are simply too overwhelmed to find the needle in the haystack and, as a result, can’t prioritize responses appropriately. That becomes a dangerous problem because real threats slip through among thousands of alerts.
What is needed is a platform that simplifies and consolidates data flows, highlights critical data, offers quick answers to security questions, and streamlines creation and management. A well-designed security platform should provide:
Visual Display of Data– A visual interface is critical because the overwhelming amounts of data in today’s cybersecurity space are just too confusing.
Customization– Every network administrator has different needs. Customization of the UI allows the system to display exactly what the user is looking for in the best possible way.
Interaction– When you are searching for answers, you need them fast. Easy drill-down capabilities within the UI should provide these answers with just a few clicks.
Automation– Automation is critical in today’s security environment. Automation eliminates duplication of work, cuts back on manual research, and reduces human error and oversight.
Palo Alto Networks Next Generation Security Platform offers all of these benefits in its UI. Learn more about how we provide actionable intelligence within our UI by downloading the Actionable Threat Intelligence whitepaper.
The Sofacy group, also known as APT28 and Sednit, is a fairly well known cyber espionage group believed to have ties to Russia. Their targets have spanned all across the world, with a focus on government, defense organizations and various Eastern European governments. There have been numerous reports on their activities, to the extent that a Wikipedia entry has even been created for them.
From these reports, we know that the group uses an abundance of tools and tactics, ranging across zero-day exploits targeting common applications such as Java or Microsoft Office, heavy use of spear-phishing attacks, compromising legitimate websites to stage watering-hole attacks, and targeting over a variety of operating systems – Windows, OSX, Linux, even mobile iOS.
The Linux malware Fysbis is a preferred tool of Sofacy, and though it is not particularly sophisticated, Linux security in general is still a maturing area, especially in regards to malware. In short, it is entirely plausible that this tool has contributed to the success of associated attacks by this group. This blog post focuses specifically on this Linux tool preferred by Sofacy and describes considerations and implications when it comes to Linux malware.
Malware Assessment
Fysbis is a modular Linux trojan / backdoor that implements plug-in and controller modules as distinct classes. For reference, some vendors categorize this malware under the Sednit attacker group naming designation. This malware includes both 32-bit and 64-bit versions of Executable and Linking Format (ELF) binaries. Additionally, Fysbis can install itself to a victim system with or without root privileges. This increases the options available to an adversary when it comes to selecting accounts for installation.
Summary information for the three binaries we analyzed follows:
Table 3: Sample 3 – Late 2015 Sofacy 64-bit Fysbis
Overall, these binaries are assessed as low sophistication, but effective. They epitomize the grudging reality that Advanced Persistent Threat (APT) actors often don’t require advanced means to affect their objectives. Rather, these actors more often than not hold their advanced malware and zero day exploits in reserve and employ just enough resources to meet their goals. It is only fair that defenders use any shortcuts or tricks at their disposal to shorten the amount of time it takes to assess threats. In other words, defenders should always look for ways to work smarter before they have to work harder.
Getting the Most Out of Strings
Binary strings alone revealed a good amount about these files, increasing the efficacy of activities such as static analysis categorization (e.g., Yara). One example of this is Fysbis installation and platform targeting information for the samples in Table 1 and Table 2.
Figure 1: Sofacy Fysbis installation and platform targeting found in strings
In this case, we can see the binary installation path and local reconnaissance to determine which flavor of Linux the malware is running. This is followed by a number of Linux shell command style commands related to the malware establishing persistence.
Another example of easily obtained information from these samples is capability based.
Figure 2: Sofacy Fysbis capability related leakage through strings
Figure 2 shows interactive status / feedback strings that can give a defender an initial profile of capabilities. In addition to contributing to static analysis detections, this can be useful as a starting point for further incident response prioritization and qualification of the threat.
Symbolic Information Can Shorten Analysis Time
Interestingly, the most recent ELF 64-bit binary we analyzed (Table 3) was not stripped prior to delivery, which offered additional context in the form of symbolic information. Defenders more familiar with Windows Portable Executable (PE) binaries can equate this with compilation of a Debug version versus a Release version. For comparison, if we were to inspect Fysbis “RemoteShell” associated strings in one of the stripped variants, we would only see the following:
Little static analysis gifts like these can help to speed defender enumeration of capabilities and – more importantly – further contribute to correlation and detection across related samples.
Additionally, this latest sample demonstrated minor evolution of the threat, most notably in terms of obfuscation. Specifically, both samples in Table 1 and Table 2 leaked installation information in the clear within binary strings. This was not the case with the sample in Table 3. Taking a closer look at this non-stripped binary using a disassembler, the following corresponds to decoding malware installation information for a root-privilege account.
Figure 5: Assembly code view of Sample 3 installation decoding
In this case, the symbolic information hints at the method used for decoding, with references to mask, path, name, and info byte arrays.
Figure 6: Assembly view of Sample 3 root installation related byte arrays
As it turns out, the referenced byte mask is applied to the other byte arrays using a rolling double-XOR algorithm to construct malware installation paths, filenames, and descriptions for a Linux root account. Corresponding INSTALLUSER byte arrays exist, which facilitate the non-root installation for the trojan. The same masking method is also used by the binary to decode malware configuration C2 information, further showcasing how a little symbolic information can go a long way towards completeness and higher confidence in assessment of a malware sample.
If you would like to learn more about how Fysbis works, the samples analyzed remain fairly consistent with the sample analysis found here.
Infrastructure Analysis
As Unit 42 has discussed in depth in other blog articles, we have observed that adversaries in general are seemingly hesitant in changing their infrastructure. This may be due to not wanting to commit additional resources, or simply a matter of retaining familiarity for the sake of timeliness. In either case, we see the same type of behavior here with the Fysbis samples in use by Sofacy.
The oldest sample (Table 1), was found to beacon to the domain azureon-line[.]com, which had already been widely publicized as a known command and control domain for the Sofacy group. Using passive DNS, we can see that two of the original IPs this domain resolved to, 193.169.244[.]190 and 111.90.148[.]148 also mapped to a number of other domains that had been in use by the Sofacy group during that time period.
Figure 7: Sample 1 C2 resolutions
The first of the newer samples (Table 2), continues the trend and beacons to an IP also widely associated with the Sofacy group, 198.105.125[.]74. This IP has been mostly associated with the tool specifically known as CHOPSTICK, which can be read about here.
Figure 8: Sample 2 C2 resolutions
The newest sample (Table 3), introduces a previously unknown command and control beacon to mozilla-plugins[.]com. This activity aligns with the previously observed Sofacy group tactic of integrating legitimate company references into their infrastructure naming convention. Neither this new domain nor the IP it resolves to have been observed in the past, indicating that the sample in Table 3 may be associated with a newer campaign. Comparing this sample’s binary with the other two however, shows there are significant similarities on the code level as well as in terms of shared behavior.
Figure 9: Sample 3 C2 resolutions
Conclusion
Linux is used across business and home environments and appears in a variety of form factors. It is a preferred platform within data centers and the cloud for businesses, as well as an ongoing favorite when it comes to a majority of Internet-facing web and application servers. Linux is also at the foundation of Android devices and a number of other embedded systems. The value proposition of Linux – especially when it comes to its use in the enterprise – can be broken out into three perceived benefits: lower total cost of ownership (TCO), security, and feature set. While numbers and comparison alone can contribute to measurement of TCO and feature set, security requires further qualification. Expertise in the Linux platform is highly sought after across all industries for multiple disciplines, from system administration to big data analytics to incident response.
The majority of businesses still maintain Windows-heavy user environments where certain core infrastructure components also operate under Windows servers (e.g., Active Directory, SharePoint, etc.). This means, from a practical perspective, most of a business’s focus remains on supporting and protecting Windows assets. Linux remains a mystery to a number of enterprise IT specialists –most critically for network defenders. Identifying and qualifying potential incidents requires a familiarity with what constitutes normal operation in order to isolate anomalies. The same is true for any other asset in an environment, normal operation is entirely dependent on a given asset’s role / function in the enterprise.
Lack of expertise and visibility into non-Windows platforms combine in some environments to present significant risks against an organization’s security posture. As a recent caution, the Linux vulnerability described under CVE-2016-0728 further demonstrates the potential breadth of real-world risks to associated platforms. A natural extension of this exposure is increased targeting by both dedicated and opportunistic attackers across various malicious actor motivations. Despite the lingering belief (and false sense of security) that Linux inherently yields higher degrees of protection from malicious actors, Linux malware and vulnerabilities do exist and are in use by advanced adversaries. To mitigate associated risks requires tailored integration of the people, processes, and technology in support of prevention, monitoring, and detection within an environment.
Linux malware detection and prevention is not prevalent at this time, but Palo Alto Networks customers are protected through our next-generation security platform:
IPS signature 14917 deployed to identify and prevent command and control activity
The C2 domains and files mentioned in this report are blocked in our Threat Prevention product.
If you’re looking for a new car, you may be considering a hybrid – one that combines electric power for efficiency and mileage with traditional internal combustion to recharge the engine and extend the travel range. For many buyers, it is the best of both worlds, providing greater flexibility to extend your trip as needed. The same concept applies to a hybrid data center – one that combines your own, dedicated on-premises resources with the scalability and agility of on-demand compute, networking and storage resources such as those from Amazon Web Services (AWS).
As the insatiable appetite for compute and storage resources to support the business continues unabated, customers are using the public cloud as a way to augment their data centers more quickly and more efficiently than in the past. Initially, a hybrid approach was viewed as a step toward migrating all applications and data to the public cloud. In reality, many customers are settling on a hybrid approach as their new data center architecture.
In a recent conversation I had with a customer, two new physical data centers had just come online, and they were already over-subscribed. They were looking to AWS as a way to extend the life of their data center using a hybrid approach. When you think about it, a hybrid approach makes the most sense. First off, it allows you to start small and establish some guidelines around which applications and data should reside in the cloud. There will be legacy applications that cannot or should not be migrated. There will be data that, after careful internal analysis, does not belong in the public cloud. For new applications, you might look at adopting a simple cloud-first mentality that says: for new applications, look to the cloud as the deployment location. A more advanced cloud-first approach entails changing your application development methodology to one that is componentized, makes heavy use of APIs, can be updated rapidly, and can be deployed globally – in the cloud first.
From a security architecture perspective, a hybrid data center is an extension of your data center and therefore should be treated no differently than your physical data. This means that you should:
Know exactly which applications are running in the cloud and whitelist them to ensure they are the only ones allowed in the cloud
Segment the applications to control which can talk to which and limit lateral movement
Enable applications based on the user credentials and the business need
Apply threat prevention to block threats from accessing your cloud applications and data while also blocking them from moving laterally
When deployed in AWS, the Palo Alto Networks VM-Series can securely enable your hybrid data center, acting as an IPSec VPN termination point and as a virtualized next-generation firewall, protecting your AWS deployment with application control and advanced threat prevention. More advanced use cases include segmentation for added security and compliance purposes through VPC to VPC and subnet to subnet policies. In effect, you can mimic your physical data center security in AWS.
To learn more about how a hybrid data center with AWS might benefit your organization, check out these resources:
The cynical would suggest that cyber insurance is growing as some look for a cheaper route to manage risk. However many see the cyber insurance industry as potentially the new enforcer of good security practices.
Over the last decade, we have seen regulation being applied, be it by nations or industry groups, and most have faced the same challenge; that is, regulation moves at a snail’s pace compared to the rocket ship that is the evolution in IT and cybersecurity. There is a clash between dynamic, evolving cybersecurity in which the bar of what is state-of-the-art continuously evolves, be it from new IT technology use cases, changing threats, or new practices to mitigate these risks.
The impending EU regulations, the Network Information Security Directive and the Data Protection Regulation Reform, both leverage the term and concept of state-of-the-art, suggesting that, in the latter, business should have regard for this cybersecurity capability relevant to the risk and, in the former, businesses should have at least state-of-the-art security technology.
Could the cyber insurance industry, in effect, become the dynamic new regulator of this in the future as cyber insurance adoption grows? Businesses will be eager to prove they are applying such state-of-the-art practices to reduce their premiums, and insurers will be looking to validate if a business can be insured and just what level of premium they should be offered based on the business’ capabilities.
As the cyber insurance market grows, it will surely become more competitive, and so, such analysis would seem key to being able to offer better premiums where the risk posture allows. An example of this is IASME (a UK consortium for small- to mid-sized businesses) tying cyber liability insurance coverage for small businesses to the UK Cyber Essentials program certification that aims to assure a basic level of cybersecurity. They are 1 of 4 accreditation bodies for Cyber Essentials certification in the UK.
The question all this raises is whether those in the insurance industry will have to become cybersecurity experts, and the likely reality is not, as there is already a skills’ shortage in the cyber market. What seems more likely is partnerships will be formed with the security industry so they can gather better intelligence on both the current threat landscape and capabilities, looking to validate their real-world effectiveness and identify best practices.
Much as home insurance is linked to where you live, cyber insurance will be linked to the industry you are in, and where you do business, to better identify the likelihood and scope of claims. Today some cybersecurity vendors, including Palo Alto Networks, already track such data and, with the Cyber Threat Alliance, can track and advise on advance threats.
As cyber insurance evolves, it will require a tripartite relationship amongst knowledge of the risk, relevant state-of-the-art capabilities to prevent the impact, and the skills to validate the ongoing application. It will be interesting to see if, in the longer term, insurers will build out their own list of approved requirements and capabilities. However, unlike most insurance services, which have been built from decades of knowledge to generate the actuarial data that balances premiums against claims, cyber insurance is still relatively nascent. I would challenge there are probably very few insurance markets that are as dynamic as cybersecurity. Only time will tell if the potential benefits for all, with insurers growing involvement in the cybersecurity space, come to fruition.
Current research in cybersecurity often has a narrow focus, detailing recently successful attacks and how those attacks were accomplished. Attackers are often represented as shadowy, nameless figures, with a special kind of mystique surrounding them. That Hollywood image couldn’t be further from the truth. In a new study released today, “Flipping the Economics of Attacks,” Palo Alto Networks has partnered with the Ponemon Institute to understand not only what motivates these attackers but also how we can turn the tables on them by taking away their financial incentives to attack.
The data also shows us a clear path to shift the economic motivation of attacks with two compelling facts:
Increasing the time it takes to breach an organization by less than 2 days (40 hours) will deter 60 percent of attacks.
Organizations rated as having “excellent security,” as compared to “typical,” took double the time to breach (140 hours).
To understand how to influence an attacker’s economic motivation, we must consider what I call the “adversary arithmetic,” which boils down to the cost of an attack versus the potential outcome of a successful data breach. If malicious actors are putting in more resources than they are getting out, or we decrease their profit, being an attacker becomes much less attractive. Using the survey findings as a guideline, let’s walk through what we can do to reverse this trend.
An Attacker’s ROI
Here is the situation today: we found that 53 percent surveyed believe that the cost of executing successful attacks has gone down, with more available malware and exploits, better attacker skills, and more effective toolkits as the primary drivers. This is important because as Moore’s Law shows us, increasing computing power over time, and in this case the automation and sophistication of hacking tools, makes launching a successful attack cheaper.
The survey also found that 69 percent of adversaries were motivated solely by profit, meaning that changing the arithmetic to increase the cost of attacks could prevent the majority of them from ever being launched. It is important to note that there is a spectrum of malicious actors, and organizations must always maintain awareness of potentially dangerous, highly targeted attacks, or nation-state led activity such as cyber espionage or cyber warfare. However, if we can de-incentivize anywhere near that number of attackers, we will see seismic change in the threat landscape.
There’s a common notion that attackers are motivated by big potential paydays. We found this to be the exception, rather than the rule, with average annual earnings from malicious activity totaling less than $30,000. This limited earning power becomes even less attractive when you consider the added legal risks, including fines and jail time.
The next step in our equation is how attack targets are selected. We found that the majority of attackers (72 percent) were opportunistic, not wasting time on efforts that do not quickly yield high-value information. While advanced nation-state actors employ lots of planning, think about the average attacker as the mugger on the street, versus the Ocean’s Eleven crew that spends weeks planning a complicated high stakes heist. When put into this context, organizations that prioritize making themselves a harder target will actively prevent a significant number of potential breaches.
Taken together, we have a simple picture of an average adversary: motivated by profit and going after easy targets in an environment where attacks are becoming cheaper. There is reason for hope though, as this same attacker is making a relatively small income, especially compared to cybersecurity professionals, with the added element of risk they face.
Time is the defining factor to change the adversary’s arithmetic. As network defenders, the more we delay adversaries, the more resources they will waste, and the higher their cost will be. We can interrupt the march toward more and more lower-cost attacks by taking a slightly different perspective on the problem. We need a prevention-based focus on the right investments in the right people, process and technology to defend the organization. Working together as a community to shift the economics of this problem, we can hit the core motivation for attackers and shift their behavior over time, bringing us to a world where cyberattacks are the exception, not the norm.
Read the full report for additional findings, including key recommendations for preventing attacks.
