The Traps 5.0 and Traps management service releases include the following key features:
Cloud-delivered service—The Traps management service streamlines the deployment of your endpoint security infrastructure, thus eliminating the need to build, manage, and maintain management servers.
Integration with the Logging Service—Centralizes Traps log collection for event management, threat hunting, and incident response.
Streamlined user interface—Easy-to-use dashboards to help surface critical information, events, and workflows.
Traps OS support extended to Linux servers—Enables customers to protect critical data center and public cloud workloads.
Proactive scanning—On-demand or automated scanning to identify dormant malware before it attempts to run.
If you are ready to get started, look no further than the following Traps documentation resources:
Traps Management Service Administrator’s Guide—Includes instructions on migrating from the Traps Endpoint Security Manager, activating the Traps management service, and configuring your endpoint security policy.
Traps 5.0 Agent User Guide—Describes the requirements and how to install and use the Traps 5.0 agents (including Traps for Linux) supported with the Traps management service.
Happy reading!
Your friendly Technical Documentation team
Our recent enhancements to Traps have focused on reinforcing prevention capabilities and introducing innovative techniques for protecting against malware, exploits and ransomware. At the same time, our team has also been focused on transforming Traps into a cloud-delivered advanced endpoint protection service.
Today, we are excited to announce Traps 5.0, the most significant release for Traps to date.
Let’s take a look at what’s included in the Traps 5.0 release.
Traps Management Service
The multi-region, cloud-based Traps management service saves organizations from having to invest in building out their own global security infrastructures and ties into Palo Alto Networks Next-Generation Security Platform for additional integration and value. The service is simple to deploy and requires no server licenses, databases or other infrastructure to get started, enabling organizations to protect hundreds to millions of endpoints without incurring additional operating costs.
Palo Alto Networks Logging Service Integration
Integration into the Palo Alto Networks Logging Service allows more effective event management, threat hunting and incidence response, combining endpoint, network and cloud context.
The Traps management service and agents forward all logs to our Logging Service, which is viewable in the Traps management service itself. Logging Service becomes a central repository for the collection and storage of events and incident data captured by Traps, regardless of location.
Reimagined User Interface
You asked; we listened! Traps 5.0 brings a new user interface specifically designed to be more intuitive and minimize the operational challenges that are often associated with endpoint security management. This new interface delivers out-of-the-box protections that streamline the process of protecting new endpoints which come online, and key workflows that focus on policy and event management.
Some of the many capabilities delivered by the new interface include simplified workflows for creating and executing policies that follow the order of operations; sensitivity ranked alerts to enable quick and prioritized event triage; and dynamic grouping so, as new endpoints are added, policy associated with the appropriate policy group is immediately applied.
Additionally, WildFire reports are now viewable directly from security alerts within Traps. The WildFire reports contain critical event details including targeted users, application(s) that delivered the threats, URLs involved in the delivery of threats, and the behavior that was observed in WildFire dynamic analysis.
Linux Support
Linux rounds out the list of major OS platforms now supported by Traps, enabling customers to protect resource- and performance-sensitive cloud workloads against exploits with host-based security. With many of these Linux-based workloads moving to the cloud, the lightweight Traps agent gives you exploit protection with minimal impact on performance and system resources.
Proactive Scanning for Incident Response and Compliance
Previous versions of Traps focused on refining the ability to block malware as it attempted to execute. Traps 5.0 introduces the ability to periodically scan endpoints for dormant malware. If a malicious file is identified, Traps can automatically quarantine the file, ensuring it does not detonate and potentially infect the endpoint and spread to other endpoints.
Over the past six months, we’ve seen a major increase in the number of attack campaigns with the ultimate goal of mining cryptocurrency. It’s a subject Unit 42 has been tracking in the past year:
So, what is driving a widespread shift from attackers and creating a significant trend in the industry? There are three factors at work:
The price of many cryptocurrencies has increased dramatically in the last 12 months, making it more profitable to mine coins compared to other criminal business models.
The risk of using a compromised PC to mine cryptocurrency is currently much lower than using it for other criminal activities.
One particular cryptocurrency, Monero, provides its users with very high privacy and can be mined efficiently on a regular desktop or laptop PC. These properties are not true of other cryptocurrencies, like bitcoin.
To answer the question in more detail, it’s important to put yourself into the criminal’s shoes and consider what alternative routes they have to monetize infections. In this brief, we’ll share how this trend came to fruition, why it’s so prevalent, and how security professionals and defenders can keep an eye out for this rising type of threat.
How Attacks Monetize Infections
While targeted attacks gain the most attention from researchers and media, the majority of malware infections are untargeted and even indiscriminate. Instead of seeking out specific targets, many criminals aim to infect as many systems as possible and then turn those infections into cash. This has been true for over a decade, although the mechanisms available to criminals have shifted in that time.
To understand where we are now, it helps to look at how we got here, and to look at the evolution of common cybercriminal activities.
Back in the early 2000s, some of the earliest “botnet herders” made their income by relaying spam emails through infected computers. Over time, that business became less profitable due to anti-spam controls and ISPs preventing infected systems from directly relaying emails.
In the mid-2000s, criminals made great profits from using Banking Trojans to steal credentials for online banking websites, and subsequently draining the accounts’ associated funds. This account takeover activity continues today, but various anti-fraud measures and law enforcement actions have made it less profitable and riskier for criminals.
Another aspect of Banking Trojan infections is that, while the criminal may be infecting hosts indiscriminately, the value of the host greatly depends on the individual who owns it, and the criminals’ ability to “cash out” their bank account. Figure 1 is a capture from a book I wrote with some colleagues in 2008, “Cyber Fraud: Tactics, Techniques, and Procedures.” It shows the price that a criminal enterprise called IFRAME DOLLARS was charging to infect computers in various countries at that time.
Figure 1: Capture from Cyber Fraud: Tactics, Techniques, and Procedures showing prices of host infections by country.
In 2007, the infection of a system in Australia went for US$0.60, while an infection in Poland was only a fraction of the cost, at US$0.096. The difference in price represented the difference in value: criminals were able to make more money through a Banking Trojan account takeover from an Australian infection than they could in Poland. This was due to many factors, but chief among them was that criminals were more successful at cashing out accounts from Australian infections than they were from systems in other parts of the world.
As anti-fraud protections evolved, so did the criminals. Fast forward five years to 2013 and the rise of the Ransomware business model. This new way to generate profit had two major advantages over account takeovers:
Every system that is infected can be held for ransom, not just those belonging to users who also happen to bank online and have their credentials stolen.
Payments using cryptocurrency (primarily bitcoin) do not require interacting with banks, decreasing the risk and cost for cybercriminals of cashing out.
Put another way, the ransomware model represented both increased efficiency and decreased risk in monetizing the infection.
Anyone who’s been paying attention to cybercrime since 2013 is aware of the ransomware surge, infecting systems throughout the world and plaguing networks’ administrators. While only a tiny fraction (possibly 1 in 1000) of systems infected with a banking Trojan pay out for attackers, a much higher portion of ransomware victims pay to get their files back. While US$300 payments are less than a single account takeover could return, ransomware makes greater returns due to the volume and decreased risk in this new business model. Cybercriminals have become good business people: they saw the benefits and embraced the change.
Enter “The Bubble” – Where We Are Now
In the last two years, but particularly in the last six months, the price of bitcoin and other cryptocurrencies experienced a massive price surge with respect to the U.S. dollar and other fiat currencies. Here’s the chart for bitcoin over the last two years, showing a rise of 2,000% to 4,000% in the versus the U.S. dollar.
Figure 2: Price of bitcoin in U.S. dollars from CoinMarketCap
While botnets mining cryptocurrency is nothing new, the technique was much less profitable than using ransomware. In fact, with the rise of specialized bitcoin mining hardware, no regular PC can make any significant amount of money for an attacker.
However, there are many other “crypto coins” in the market today. The one we see mined most by attackers is called Monero. In contrast to bitcoin, Monero was designed to enable private transactions using a closed ledger, and its mining algorithm is still mined effectively by both PC CPUs and GPUs. As the chart below shows, Monero has risen even faster than bitcoin in price in the last two years, with more than a 30,000% gain in U.S. dollars.
Figure 3: Price of Monero in U.S. dollars from CoinMarketCap
A normal PC used to mine Monero can earn around US$0.25 per day at the current prices. That number is small, but it’s important to note that it doesn’t matter what country or network a Monero miner is part of: computers in Australia and Poland mine at the same speed. Every infected system is a profit-generating resource when mining Monero, and users are much less likely to identify their infection and remove the mining program than they would be with ransomware. For context, in January, we found a Monero mining campaign that infected around 15 million systems, largely in the developing world. If these systems remained infected for at least 24 hours each, the attackers could have earned well over 3 million U.S. dollars in Monero.
Additionally, the risk of arrest and conviction is significantly lower than with ransomware, as mining cryptocurrency is less likely to generate reports to law enforcement than a data-destroying ransomware infection.
What’s Next?
This wave of attacks will continue as long as it maintains a high level of profitability with a low level of risk for cybercriminals.
For defenders, it’s important to note that the techniques used to infect systems with coin mining malware are the same as they were for ransomware. Infections typically begin with emails carrying malicious macro documents, drive-by exploit kits targeting browsers, or direct attacks on servers running vulnerable software. There is no single solution to stopping these attacks, but the same technologies and policies you use to prevent other malware infections will be effective.
Across the changing landscape of botnet herders, Banking Trojans, ransomware and coin mining is one constant: the business-savvy drive to maximize profit and reduce risk. Using these as our guide, we can make sense of where we are today, how we got here, and be prepared for what has yet to develop in the future.
Here are three things to watch for:
1. A marked increase in the price of Monero or other cryptocurrencies will draw even more attackers into this business.
For many users, this could actually be a positive development, as the negative impact of having resources sapped from one’s computer is much less than paying a ransom or restoring your system from a backup due to ransomware. Conversely, a crash in the price of cryptocurrencies will decrease the profitability and drive criminals back to ransomware.
2. Listen to your fans or keep an eye on your CPU usage.
Many users realize their system is infected with coin mining malware when their laptop fans kick into high-speed mode to keep the overtaxed CPU cool. Listening to fans won’t work at the enterprise scale, but implementing widespread CPU performance monitoring could be a good way to find compromised devices. This will also help you identify the coin mining “insider threat,” as misguided administrators may see their organizations’ unused CPU time as a way to generate personal income.
3. Criminals will find ways to target these attacks.
Compromising a user’s browser or a regular home PC will net the criminal an average system for mining coins, but higher-end systems will generate more income. Attackers will soon begin targeting devices with higher specifications to get more bang for their buck. Gaming PCs with high-end GPUs and servers with large numbers of processing cores will be prime targets.
Hopefully, you saw our recent announcement of PAN-OS 8.1. This blog will highlight the top three features in 8.1 that help bolster confidence and control in the growing use of the public cloud by financial institutions, and optimize the decryption infrastructure for operational efficiencies and and improved performance.
Consistent Multi-Cloud Security
Resiliency and geographic diversity are key aspects of any business continuity plan for financial institutions. By not placing all its eggs in one basket, an IT organization limits the exposure of any technology or even supplier failures on the supported business. As workloads continue to move to the public cloud, financial institutions will prefer to spread their risk both geographically and across multiple service providers. In the end, resilient designs will be implemented for cloud-based workloads, but reduced fault domains and supplier diversity will also be key considerations for all IT teams. Consequently, financial institutions can be expected to have a multi-cloud strategy.
To maintain a consistent and effective security posture across multi-cloud environments, Palo Alto Networks VM-Series virtualized next-generation firewall is supported on three major cloud service providers: Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform. Common use cases include hybrid cloud, segmentation, internet gateway, and remote access. Integration with the native cloud infrastructure offers automation for frictionless workflows even in multi-cloud environments. Our VM-Series has the same feature set regardless of the cloud service provider and will enable financial institutions to create a consistent security policy across all three.
SaaS Application Control: Consumer vs. Enterprise
SaaS application usage continues to grow in the financial sector. For many institutions, SaaS was a first step into the cloud as subscriptions for non-mission-critical applications drove cost savings and efficiencies. Not surprisingly then, the use of SaaS apps for HR, CRM, and also Office 365 is fairly common. Some financial institutions may use Google G Suite, Dropbox, and YouTube for business purposes as well. In such cases, this creates a situation where the enterprise version of SaaS applications is indistinguishable from the consumer one. Employees may be accessing their personal email, calendar, or online storage SaaS applications from the same workstation used for the enterprise versions. At its worst, this becomes another avenue for exfiltration of corporate data by malicious insiders. Even in benign cases, the personal use of Office 365, G Suite, Dropbox, and YouTube from the office can be a questionable use of corporate resources.
With PAN-OS 8.1, Palo Alto Networks next-generation firewalls can be used to distinguish between enterprise and consumer use of common SaaS applications, and ultimately prevent access for the latter purpose. Our next-generation firewall will insert HTTP headers for Google, Office 365, Dropbox, and YouTube to signal what is desirable for enterprise use. The SaaS application recognizes this and then allows access based on the settings in the header. This prevents any data exfiltration attempts to consumer accounts on common SaaS applications and, furthermore, limits the use of corporate resources for personal purposes.
Simplified Decryption Architecture
Gartner has predicted that, by 2019, more than 80 percent of all network traffic will be encrypted. Attackers have also taken notice and may hide their communications within encrypted data streams as well. To combat this, financial institutions have already gone about decrypting internet traffic to detect and stop malicious traffic. However, this is typically done by:
Decrypting each time on every single-function security appliance in the chain (e.g., firewall, IPS, DLP, WAF, proxy) for policy enforcement, or
Introducing a dedicated appliance for SSL offload, which then sends the unencrypted data to each of the single-function security appliances.
Both approaches do allow for inspection of encrypted traffic for malicious activity, but both also have drawbacks. Decrypting multiple times adds latency and impacts end-user experience. A dedicated SSL offload appliance adds design complexity and operational costs.
In PAN-OS 8.1, Palo Alto Networks has introduced the Decryption Broker, which enables the next-generation firewall to decrypt the data and scan it using its single-pass architecture for IPS, network antivirus, and security policies before a hand-off to third-party security appliances for further enforcement. This approach reduces the total number of devices required, minimizes added latency, and increases the operational efficiency of a security chain of multi-vendor appliances. Using this simplified architecture for decryption allows for streamlined inspection for security, while minimizing the performance impact on end users.
One of three articles in a series about the VM-Series on: Google, AWS and Azure.
Organizations are adopting Google Cloud Platform to take advantage of the same technologies that drive the commonly used Google search engine and maps services. Business initiatives – such as big data, analytics and machine learning – deployed on GCP can leverage contextual data collected from billions of Google search engine data points. GCP offers a global footprint to allow you to quickly deploy enterprise-class applications and services.
Our VM-Series, deployed to protect workloads within a Google project, helps customers address their role in the shared responsibility model. GCP was designed with security as a core component and uses a variety of technologies and processes to secure information stored on Google servers. However, Google is very clear on where their security responsibilities end, and where the customer’s security responsibilities begin. As shown below, it is the customer’s responsibility to protect their operating systems packages and the applications they deploy.
Figure 1: GCP Shared Responsibility Model
That’s where the VM-Series on GCP, which we officially announced this month, can help. It complements Google Firewall by protecting your applications and data using a prevention-based approach:
Complete visibility and control: The VM-Series gives you complete visibility into the applications traversing your cloud deployment and the content within, malicious or otherwise. This knowledge allows you to deploy a more consistent, stronger security policy for inbound and outbound traffic to prevent known and unknown attacks.
Reduce the attack surface; limit data exfiltration: Using the application identity as a means of enforcing a positive security model reduces the attack surface by enabling only allowed applications and denying all else. Application usage can be aligned with business needs, extending to application functions as needed (e.g., allow SharePoint documents for all but limit SharePoint administration access to the IT group). In addition to controlling applications, policies can be enabled to block or generate alerts on file and data transfers, thereby limiting data exfiltration.
Prevent known and unknown threats: Applying application-specific threat prevention policies to allowed traffic can block known threats, including vulnerability exploits, malware, and malware-generated command-and-control traffic. Unknown and potentially malicious files are analyzed based on hundreds of behaviors. If a file is deemed malicious, a prevention mechanism is delivered in as few as five minutes. Following delivery, the information gained from file analysis is used to continually improve all other prevention capabilities.
To help eliminate security as a possible bottleneck, bootstrapping, the XML API and other VM-Series automation features, combined with GCP or Terraform templates, will allow you to embed next-generation security into your application development lifecycle. The VM-Series on GCP will be available in March 2018.
Learn More
Watch the VM-Series on Google Cloud Platform Lightboard
