Category: Palo Alto Networks

Over the last decade we have seen a striking, but expected, trend. As we move more and more of our personal lives, business operations, and critical infrastructure into the digital arena, cyberattacks have gotten more aggressive, successful, and damaging. Not only is there more value to be stolen online, but it has also become easier and cheaper to launch successful attacks, eroding our digital trust in online systems.

Consider your bank account and total absence of tangible money or legal tender that underlies it; you trust that the assets exist because you can “see” them when you log in. But the value that sits on the servers is made up entirely of trust in those digital systems. There is a very fine line separating our smoothly functioning digital society built on this trust and the chaotic breakdown that would result from its erosion.

Today, bad actors can use existing malware and exploits, often free or inexpensive to obtain online, to launch successful intrusions and obscure their identities. These sophisticated adversaries are also developing, and selectively using, unique tools that could cause even greater harm. This all adds up to tremendous strategic leverage for the attackers.

To the extent that any of the thousands of daily threats are successfully detected, protection provided by legacy security products is highly manual in nature because there is no capability to automatically coordinate or communicate with other capabilities in your network, let alone with other networks not in your organization. But it isn’t just technology that’s fallen behind.  A lack of executive-level leadership and understanding of cybersecurity risk and governance is further complicating many organizations’ abilities to effectively address sophisticated threats.

A recent report from the Georgia Institute of Technology noted that boardroom-level focus on cybersecurity has doubled since 2012 to over 66%, but most boards still lack proper planning, review of investments, and effective reporting structures. Clearly the importance of cybersecurity is getting through, and while governments are getting serious about cybersecurity frameworks and technical guidance, a key gap remains: how to communicate the level of risk and necessary investments in people, process, and technology at the boardroom level.

Having a prevention mindset at the executive level is the first step in addressing this gap and changing the economics of the cybersecurity problem, but we have to take action to actually change our current circumstance. It’s for this reason that Palo Alto Networks has partnered with the New York Stock Exchange to produce, Navigating the Digital Age: The Definitive Cybersecurity Guide for Directors and Officers. We intend this book to be both a how-to guide and an anthology. It includes advice and cybersecurity best practices from CEOs, CISOs, lawyers, forensic experts, consultants, members of academia and current and former government officials, including the World Economic Forum, Visa, Georgia Institute of Technology and former Secretary of Homeland Security, Michael Chertoff.

Navigating the Digital Age is intended for those new to the topic, as well as seasoned leaders in the field and is a necessary addition to any corner office or boardroom. We intend for this to carry on the work started by the U.S. government’s Cybersecurity Framework and raise the bar at the executive-level for effective cybersecurity.

We also know this conversation will continue to evolve well beyond the publication of a book. That’s why today we’re also launching SecurityRoundtable.org, a community designed to share best practices, use cases, and expert advice to guide executives on managing cybersecurity risks. We hope this will help raise awareness of the importance cybersecurity has for customers, critical services, and business operations. We invite you to join us today by taking what you feel is of value and sharing your technical knowledge and expertise with your senior leaders and peers.

Not all of us have to be cybersecurity experts, but we all have a new responsibility to change the way of thinking towards preventing cyberattacks by sharing best practices, use cases, and cyber intelligence. If we take a longer view of the threat, the combination of next-generation technology and our joint efforts can vastly reduce the number of successful cyberattacks and restore trust in our digital way of life.

Davis Hake

[Palo Alto Networks Blog]

In recent weeks, we have noticed changes in the TeslaCrypt ransomware malware family’s code base. OpenDNS recently discussed some of these changes regarding the encryption techniques in this newest variant. While reverse engineering the underlying code of these samples we discovered that the author of of TeslaCrypt borrowed code from the Carberp malware family in order to obfuscate strings and dynamically load libraries/functions.

TeslaCrypt was discovered in February 2015, and has been actively developed since its initial release. The TeslaCrypt family is known as ransomware—a type of malware that encrypts a victim’s files then demands a form of payment in exchange for the decryption key. Ransomware has been very lucrative for attackers, and an ongoing challenge for consumers and businesses alike. Malware like TeslaCrypt is often delivered via spam emails or exploit kits. A recenttakedown of multiple domains used by the popular Angler exploit kit estimated that as much as $60 million in revenue was generated annually by ransomware alone.

TeslaCrypt has historically been known to borrow code or other features from various ransomware families. Older variants used a notification screen that looked nearly identical to the one used by the CryptoLocker malware family.

Figure 1. Locker notification for old variants of TeslaCrypt

The latest versions of TeslaCrypt attempt to mimic the popular CryptoWall malware family.

Figure 2. Locker notification for new variants of TeslaCrypt

As we can see from the figures, the author of TeslaCrypt has no reservations about re-using code where possible. Starting in late September, the newest version of TeslaCrypt was introduced and it included multiple updates. One of these updates involved modifications to how the victims’ files were encrypted, which was discussed by OpenDNS in their blog post.

However, when looking at the underlying code, a number of other changes caught our eye, including string obfuscation previously unseen in TelsaCrypt.

Figure 3. TeslaCrypt string obfuscation

Upon further review, we discovered that these strings are encrypted using the RC2 cryptographic algorithm, using a static key of ‘sdflk35jghs’. The initialization vector is generated by removing the first and last 4 characters, not counting the base64 padding characters. This process is shown below.

Figure 4. TeslaCrypt IV and data parsing

While examining the Carberp source code, we discovered this exact code. Carberp was a popular banking Trojan discovered in late 2011. Its main functionality included stealing online banking credentials, keystroke logging, and capturing data from various applications.

In mid-2013, the source code to Carberp was posted for sale on an underground Russian forum.  A number of weeks following this posting, the source code was leaked to the general public. This allowed any individual to modify or copy the source code to this banking Trojan, which the author of TeslaCrypt appears to have done.

Figure 5. Carberp string parsing prior to decryption

Looking further into the underlying code of TeslaCrypt, we found that the author has also implemented dynamic library and function loading.

Figure 6. Dynamic function loading in TeslaCrypt

Sure enough, this code was also copied from Carberp’s source code. Hashes used to identify function are generated via the following algorithm:

Figure 7. Hashing algorithm

In order to assist analysts and reverse-engineers working on the latest version of TeslaCrypt, please refer to the script shown in Figure 8 that will attempt to automatically convert API hashes to their actual function names.

Figure 8. Results of running IDAPython script

Overall, it appears that the author of TeslaCrypt has continued their history of re-using code and functionality from other malware families. By using the string obfuscation and dynamic API loading functionality from Carberp, it makes reverse-engineering and simple static analysis slightly more difficult. However, as the Carberp source code is so widely known by the security community, the author may have inadvertently made detection of these samples easier. This is the tradeoff of re-using code from other malware families. It’s certainly quicker and easier to do, but may result in easier detection by security software.

All new variants of the TeslaCrypt malware family samples are properly classified as malicious by Palo Alto Networks WildFire. AutoFocus users can find more information on samples and indicators related to this attack by viewing the TeslaCrypt tag.

Josh Grunzweig

[Palo Alto Networks Blog]

Tired of sorting through endless logs to find the threats in your network that matter most?

Meet AutoFocus!

Our new threat intelligence service harnesses global threat data and spotlights meaningful and pervasive events, so that you can take action now.

Ready to get started? Use the AutoFocus cheat sheet!

AutoFocus Cheat Sheet

1. Focus in on the AutoFocus dashboard for a bird’s eye view of your network, industry, and global threat landscapes.
2. Find suspicious artifacts, such as URLs, IP addresses, and domains that are highly associated with malware.
3. Set up prioritized alerts for threats identified by Unit 42, the Palo Alto Networks threat intelligence team.
4. Export suspicious artifacts from AutoFocus to support a PAN-OS firewall block list or integrate with a SIEM solution.

AutoFocus API

Bring threat intelligence into your own service or application with the AutoFocus API, which lets you search through get details on samples, sessions, tags, and more through a secure, RESTful API.

Send Us Feedback!

Have you used AutoFocus? Share your experience with AutoFocus by leaving a comment below or email us at documentation@paloaltonetworks.com! We could feature your use case in an upcoming version of the AutoFocus documentation!

Charissa Fleischer

[Palo Alto Networks Blog]

If you are like most security professionals, you probably feel overwhelmed just thinking about your to-do list: update policies, run reports, extend protections, analyze results, find hidden threats, manage multiple deployments… That list is endless.

Automation seems to be the perfect answer, but most security professionals are torn between the idea of automating and streamlining processes while maintaining manual control to enable human decision-making. There is a fear of simply letting software make security or network management decisions in their organizations. This choice can feel like the conflict in the Matrixmovies: man against machine. Many security professionals hesitate to trust automation because they often prefer to maintain manual control at the expense of a more controlled, predictable, and manageable work environment.

But let’s take a closer look at the pros and cons of automation in security environments. For sure, there are certain concerns about automating processes, especially when it comes to managing security deployments; but, in general, we will see that most concerns are more fear-based than fact-based:

• Perceived loss of control: Let’s face it, we all feel like we can do a better job at keeping our companies secure than technology alone. But the fact remains that there are limitations as to how much analysis can be done manually in any organization.
• Distrust in technology: The feeling that automated technology will overlook threats or overblock the employees in our organizations is another very powerful, yet emotional argument against automation.
• Fear of change: What will automation of security do in my organization? How will it impact my job? Most security professionals feel overwhelmed but have accepted this situation as just a part of their job. A reduction of this stress could feel like they are not protecting their companies efficiently.

Counteracting the cons is a series of very powerful fact-based pros:

• Streamlined processes and less duplication: Many processes in security deployments are complex and often result in the duplication of effort. How many policies do you manage that are duplicated across your network? Do you have to maintain and update all of these policies manually? Automation can go a long way in reducing duplication.
• Reduced complexity: Most security deployments are incredibly complex and span a variety of different technologies, all of them with their own UIs, reporting functionalities, and rule bases. Automation can bring cohesiveness and consistency, and with it, reduced complexity to the table.
• Fewer human errors: Complexity and duplication are dangerous when it comes to human work. Stress, long work hours, and confusion frequently result in human errors that can spell disaster for security organizations. Automation can significantly reduce human error.
• Improved knowledge sharing and fast decision-making: Automation can correlate information across different data sources, resulting in faster threat detection than possible with manual analysis.

Deciding when, how, and to what extent to automate is a decision that is left to each individual network administrator and security professional. When it comes to automation, it can be introduced or expanded to any organization in four main categories across your network security deployments. Breaking out the automation process into these categories will help prioritize any plans for automation.

1. Network Setup – Automation in this area allows for configuration of firewalls and policies by eliminating duplication and streamlining processes with automation tools such as templates, templates stacks, and device groups.
2. Network Management – Automation in this quadrant ensures always up-to-date network and policy with capabilities such as SIEM integration or security policy orchestration.
3. Threat Intelligence Setup – This area focuses on automatic protection against known and unknown threats with thorough analysis and prevention of successful attacks. It also can ensure that differing security technologies can learn from each other. Automated threat correlation, a common security rule base, and similar functionalities go a long way toward making things more streamlined.
4. Threat Intelligence Management – This component focuses on continuous protection with the latest information with automatic and frequent updates to software, signatures and other security components.

To learn more about the pros and cons of security management automation, please see our archived “Automation in Network Security Management – Friend or Foe?” webinar, availablehere.

Joerg Sieber

[Palo Alto Networks Blog]

The Australian Cyber Security Centre (ACSC) has released its first unclassified Threat Report [1], which describes a number of cyber adversaries targeting Australian networks, explaining their motivations, the malicious activities they are conducting, and their impact. This threat report also provides a number of examples of activity targeting Australian networks during 2014. The report further offers mitigation advice on some of the types of malicious activity targeted to Australian organisations, how best to deal with these threats, and how to both prevent and respond to these activities to limit the severity of the damage.

The report calls out a number of techniques that are being used by cyber adversaries to target Australian government and business. These include:

• Spear Phishing ‒ the process of using social engineering techniques, such as carefully crafted emails, to entice a user to click on a link or open an attachment.
• Remote Access Tools – the malicious use whereby someone accesses a computer from a remote location.
• Watering Hole – a technique which takes advantage of a user’s trust in a legitimate website by placing malware on the frequented website to compromise the computers of visitors to the site.
• Malware ‒ malicious software that is designed to facilitate unauthorised access or cause damage to a system.
• Ransomware ‒ extortion through the use of malware that often locks a computer’s content and requires victims to pay a ransom to regain access.
• Denial of Service ‒ an activity that prevents the legitimate access to online services by consuming the amount of available bandwidth or the processing capacity of the host computer. This may also include the use of ransomware.

Australian Government agencies that have implemented the ASD (Australian Signals Directorate) Top 4 Strategies to Mitigate Targeted Cyber Intrusions [2], and a number of other strategies, are improving their protection against cyber espionage activities. When implemented, the Strategies can mitigate at least 85 percent of targeted cyber intrusions responded to by the ACSC.

While the overall number of cybersecurity incidents increased in 2014, the number of confirmed significant compromises of federal Australian Government networks has decreased since 2012.

In 2014, CERT Australia responded to 11,073 cybersecurity incidents affecting Australian businesses, 153 of which involved systems of national interest, critical infrastructure and government.

In 2014, the top five non-government sectors assisted by CERT Australia in relation to cybersecurity incidents were: energy (29%), banking and financial services (20%), communications (12%), defence industry (10%), and transport (10%).

During 2014, CERT Australia handled more than 8,100 incidents involving compromised websites.

Australian organisations are urged to report cybersecurity incidents to the ACSC by following the links on the ACSC website. Australian government agencies and businesses reporting cybersecurity incidents to the ACSC can request advice and assistance on how to remediate these incidents.

The threat report calls out a number of trends, which will continue, locally and globally:

• Number of state and cybercriminals with capability will increase.
• Cybercrime-as-a-service is likely to increase, reducing the barriers for entry for cybercriminals.
• Sophistication of the current cyber adversaries will increase, making detection and response more difficult.
• Ransomware and watering-hole techniques will increases and continue to be prominent.
• An increase in the number of cyber adversaries with a destructive capability.
• Increasing amounts of web defacements and social media hijacking.

Cybersecurity efforts should aim to make Australian organisations a harder target and, thereby, increase the trust and confidence of all Australians to engage in the benefits the Internet brings. The report explains that “Effective cyber security requires a partnership between government and the private sector.” One such partnership could be around information sharing, which ultimately shifts more costs to the cyber adversaries.

Many adversaries often write one piece of malware and send it to multiple organisations. However, if we, as a community – in partnership with government and the private sector – can force cyber adversaries to create multiple unique attacks each time, forcing their costs to go up. And if we can share the information, the defender costs go down. The benefits grow exponentially if we automate this process whereby organisations do this in real time, whilst preventing the attacks.

It is unlikely we will ever stop all cyber intrusions, but through a concerted effort to share information, we can significantly raise their costs, thus making it harder for them to threaten Australian and global organisations.

[1] https://www.acsc.gov.au/publications/ACSC_Threat_Report_2015.pdf
[2] http://www.asd.gov.au/infosec/mitigationstrategies.htm

Sean Duca

[Palo Alto Networks Blog]