If you can't detect the now infamous KAPTOXA/BlackPOS malware, boy is your InfoSec program in trouble

So we are up to 20 companies affected by the KAPTOXA/BlackPOS malware. The question is did anyone detect this easily detectable event?


"No antivirus software would have stopped the malware that attacked Neiman Marcus’ card-processing network, because it was rewritten to target the company, Kingston said. “It was very specifically designed for an attack on our systems,” he said."

First off, what is wrong with this statement? Mr. Kingston, if you are relying on Anti-Virus to catch an attack such as this APT, your Information Security Program is failing you. AV should never be expected to detect or prevent advanced attacks such as this, it is foolish to think AV would and I have news for you, AV is not designed for this type of threat... Just so you know.

Malware Management anyone?

• The Malware Management Framework

Kingston also stated that the malware had "sophisticated features making it difficult to detect". Let's look at what we know about the KAPTOXA/BlackPOS malware.

1. We will give up the fact that an endpoint was compromised and it got onto one system. I always say "Give up the Endpoint and detect things from there". Relying on, or telling Congress the malware had a ZERO (0%) detection rate by AV is well, Duh.. All APT has a 0% detection rate. That is what makes it APT and "sophisticated".

2. The malware was a memory only resident program, or was it?  K3wl, it was good malware, as expected and your Security program should be designed for such malware and threats, you know, the stuff that has a 0% detection rate by AV.

3. The malware wrote the encrypted bits to a file located at "C:\Windows\System32\Winxml.dll. OK, any NEW file that is added to \System32 on your static core systems should be reviewed as a part of a 'Malware Management' program. Might I point out this file was NOT a .DLL, rather it was a text file? Can you say look for 'MZ' in files that claim to be executables that are not, and 'MZ' in files with non-executable extensions. TripWire BTW would have detected this file over and over again as it did system checks due to the changes, so would many other security solutions. Nope, AV would not have caught this.

4. The malware ran a script that pushed ' Winxml.dll' to a remote system. Yup, lots of connections to one system from all your POS systems... Really, that is not odd? Windows logs will show this connection, but guessing your IT and InfoSec folks did not configure this, nor were they looking for this condition. Oh yeah.. Cuz you were relying on AV.  Learn what Log Management is all about or SIEM as sales folk like to call it. Got Splunk?

5.  The location and file name for the collection point was "C:\Windows\twain_32".  Why would so many systems write to the Twain_32 directory?  This is used for scanners.  Do you have scanners on your PoS systems?

6. The account used to do all of this was behaving in a way that was probably not normal for this account. So you don't or can't monitor for administrative accounts being used outside their normal operation? No need, we have AV! Again, Log Management and Account Management would be prudent.

7. Might I point out that Windows logs will also capture the process being launched. Both CMD.exe, PSExec and FTP were used in this so called sophisticated attack. These events are captured in Windows logs, but guessing Process execution (EventID 4688 or 592 in XP) was not set to capture 'Success'. Carbon Black and the Windows Logging Service (WLS) agent would have caught this command line activity as well.

c:\windows\system32\cmd.exe, c:\windows\system32\cmd.exe /c psexec /accepteula \\<EPOS_IPaddr> -u <username> -p <password> cmd /c “taskkill /im bladelogic.exe /f”

c:\windows\system32\cmd.exe, c:\windows\system32\cmd.exe /c psexec /accepteula \\        <EPOS_IPaddr> -u <username> -p <password> -d bladelogic                                         

c:\windows\system32\cmd.exe, c:\windows\system32\cmd.exe /c move \\                              <EPOS_IPaddr>\nt\twain_32a.dll c:\program files\xxxxx\xxxxx\temp\data_2014_1_16_15_30.txt

c:\windows\system32\cmd.exe, c:\windows\system32\cmd.exe /c ftp -s:c:\program files\xxxxx\xxxxx\temp\cmd.txt

8. PSExec installs as a Windows service. Logs also capture when a NEW Service is launched. So let me guess, your folks did not look for EventID 7045 either, or EventID 4697 for XP, a Security 101 item to look for in a good Log Management Program. In the quantities seen with Target and Neiman Marcus, this is really a DUH moment.  Oh wait... maybe the fact that Neiman Marcus missed almost 60,000 alerts is the 'smack your forehead moment'.

"The 59,746 alerts set off by the malware indicated “suspicious behavior” and may have been interpreted as false positives associated with legitimate software. The report, prepared for the retailer by consultancy Protiviti, doesn’t specify why the alerts weren’t investigated."

9. Network traffic, often called NetFlow would have seen odd traffic in a static PoS environment and the SMB (port 445) and FTP traffic would have set off someones spider sense if in fact they were doing what a good InfoSec program does, look for nefarious behavior. Baseline what is normal and detect what is not.

It is clear to me the memory component was sophisticated, it grab credit card numbers and encrypted them on disk; but that is about all that was sophisticated about this malware, oh, and the fact they encrypted the stolen CC numbers is just ironic.

We need to quit chasing Compliance and start doing REAL Security Engineering to detect and catch these types of attacks. All the data I, or many others in our field was present and we would have caught this long before the massive breaches they are.


So Mr. Kingston (Neiman Marcus) and Mr. Mulligan (Target) your Information Security programs, though expensive, do little to stop the real threats facing all of us today.  You might consider hiring InfoSec people who know how to defend and spend less time on Compliance and more on Detection and Response.

• Read more on the technical details of the malware
• Details on what the scripts executed
• Special report by McAfee 
• SecureState FREE BlackPoS scanning tool 

#InfoSec #HackerHurricane #KAPTOXA #BlackPOS

(N) Target warned about risk to PoS due to new Malware months before breach

It is being reported that Target was warned by their Security Staff from reports they received that new malware was targeting PoS systems. Target was in the midst of upgrading their PoS at the time and brushed off the warning. I wonder if the person who blew this warning off still works there?

Article that Target knew of risk

If this is true, and most likely is, then Target Security and/or their Corporate Security Mentality is even more ineffective than we already believe. Business in most corporations accept risk when handed reports of various 'we are vulnerable to XYZ', it's normal business practices of risk acceptance. What InfoSec professionals often can't answer is the question that is always asked..."What is the probability and what would the impact be?". Yeah yeah there are formulas for this, but as we can all guess they would have NEVER calculated out to this amount of loss and cost, or if it was calculated out, management would never believe the numbers or costs. I also think Target InfoSec has no idea how to defend their network or what they needed to actually defend such a malware impact. Maybe they do and maybe they gave 'up yours' management a budget and purchase request, but not likely.

The Malware Management Framework

This is why I promote the 'Malware Management Framework'. We no longer have a choice, we MUST manage malware threats just like we manage vulnerabilities. In the case of Target or any other company that was notified of the potential PoS malware, their InfoSec team should have analyzed the data about the malware and potential impact to their own systems and then determined if they could have detected and responded to such an event. If the answer was 'NO', then IT/InfoSec management should have made a statement that was nothing short of "We must address this or the worst WILL happen, if we don't then I/We can no longer work for you". This is where InfoSec must move towards, putting our foot down when such obvious vulnerabilities threaten our companies, or find another job. Face it, if you don't, your probably going to get thrown under the bus anyways.

Every company should do what I call a "Detect and Response Assessment". This type of assessment tests the exact kind of impact that Target was facing. Take a host, assume it is compromised, give us admin credentials and let us see what we can do (non destructive), how far we can get and what we can access. Your goal.. Detect what was done, touched or the behavior I had during the test. This is not a PenTest, this is a faster, cheaper much more effective test of your Detection and Response abilities once a host is compromised, which we all know is inevitable. You WILL get compromised, how fast you detect the compromise needs to be "The New Normal" for InfoSec programs moving forward.

Ask me how, we will discuss it at BSidesAustin 2014.

#InfoSec #HackerHurricane

How to detect a CryptoLocker type attack - FAST

There is a new pest for InfoSec to fight and it is called Ransomware. Though not new, it has become far more invasive and destructive to anyone that has experienced it.

The success of CryptoLocker has spawned new variants (Prison Locker Power Locker, etc..) that will further spread the terror to companies, people, government agencies, police departments and anyone else.  It will only get worse as CryptoLocker proved there is SERIOUS money to be made with this type of attack.

So what do we do? How do we defend against it? How do we detect such annoying and destructive attacks?  How do we know which directories and data to restore?

Anyone who hears my presentations and soapbox statements and discussions, I feel Prevention is a dead idea. If you still think you can prevent all this hacker stuff, think again. They have proved over and over again that the Bad Actors win and the Good Actors lose with there tails between their legs in defeat or worse, fired.  Just ask Target, Neiman Marcus, or the other 6 others yet to be named retailers that have also fallen to the Black PoS hack.

CryptoLocker now has 3 known variants and was re-written from C++ to C# to improve the tool.  This is bad news for InfoSec Blue Teamer's like myself.  We must evolve faster and quicker than the malwarians update, morph or create new variants.

Or do we?

I am an advocate of Detect and Respond and less on Compliance and Prevention. I personally believe Compliance is why the hackers are winning and making a fortune. We chase compliance audits, the paperwork, the check boxes and in the process fail to do Real Security. You can't prevent invention, it's the mother of necessity and can't stop clever people trying to compromise your systems, unless of course you just disconnect from the Internet...

I often tell people, if you are not logging everything, you are doing it wrong.

So how do you deal with this type of destructive malware attack?  You can block email attachments, but that won't stop them as they offer up scripting on compromised websites that will execute the script to call the loader to download and install the malware via the browser.

So what do we do?

Detect and Response is the only answer!  You can detect a CryptoLocker type event pretty easily actually, but few actually practice this particular type of defense.  'Times are a changin' and so should you, so here is how you can detect a CryptoLocker type attack.

Logging to the rescue - View of a typical CryptoLocker event.  Notice how quiet it is to the left of the event.

Step 1 - Force Advanced Auditing

The first thing you must do is force your clients to use the new Advanced Auditing features of Windows Vista, Windows Server 2008 or later operating systems.  You will find this setting under Security Options on your local system or Group Policy.  Don't worry, for older XP and Server 2003 and earlier systems, the older auditing works fine for this event.

Once you have enabled this setting, you now can set the new Advanced Audit Policies in Windows Vista, Server 2008 or later operating systems.

Step 2- Enable Object Access - File System to SUCCESS

You will only need success for this setting as you want to know which files were changed, not that failed.

This will now enable Event ID = 4663 which will add an event in the Security Log anytime a file is deleted or written to.

Now you have to decide what directories you are going to audit this for.  Unfortunately this must be enabled on every parent directory you want to monitor on the local system, manually or by scripts.  Sorry no GPO for this that I am aware of.  This means every users "My Documents" folder, data drives or file server shares.  This is a local system setting (on the actual computer) so you will need to visit each system remotely or in person, or use an automated way to enable File Auditing for specific directories.

Step 3 - Enable File Auditing for a directory you want/need to monitor.

On the local system you will navigate to the parent directory and add auditing.  Here is how to do it manually:

1.  Select a folder
2.  Right-Click - Select PROPERTIES - SECURITY - ADVANCED - AUDITING tab
3.  Edit - ADD - EVERYONE - OK

It will bring you to the following screen:

























4.  Select - "This folder, subfolders and files" (the default)
5.  Check - Create files / write data
6.  Check - Create folders / append data
7.  Check - Change permissions
8.  Check - Take ownership
* deselect everything else unless you have already set something and need it

When you select "OK" and apply, it will grind through all the folders and files enabling the file auditing.  This places minimal burden on the file server with today's systems, but by all means test it yourself.

Now when a CryptoLocker type event occurs your logs will capture the event.  If you are using a Logging solution like Splunk (my personal and professional recommendation) you can see the events and setup alerts to trigger when a threshold outside the norm of your users is reached.  I suggest "> 250 events per hour" as a place to start and adjust accordingly to your unique environment.

From the graph above and the view below you can see 3600+ events occurred and in my case an email and SMS message alerted me to the event allowing me to take immediate action.

In addition, the results can tell you what user (WHO) and what system (WHERE) along with all the files (WHAT) that were affected and therefor what to restore.

Blue Team Defender doesn't get any better than this!

Try it out on a test system and use Splunk's FREE Splunk Storm cloud offering to tweak you results and get to know Splunk.

• Splunk Storm website

This detector also works for any current or disgruntled employee that mass deletes or changes files.  Once you enable auditing on servers with large amounts of data and lots of users that can access and potentially alter it, a CryptoLocker type event can cripple your organization or at a minimum create a minor to serious outage.

SPLUNK OUT !

#InfoSec #HackerHurricane #Splunk #CryptoLocker

(humor) The NSA is coming to town

Year end humor for everyone.. 'The NSA is coming to town' spoof on Christmas classic.

NSA Christmas song video

Happy New Year everyone!!!!








2014 is year 5 for BSidesAustin, Mar 20-21

www.BSidesAustin.com

#InfoSec #HackerHurricane

Austin ISSA Malware Discovery training a HUGE success

Last Friday we held a Malware Discovery training "From Joe to Pro, how to discover malware in your environment" for the local Austin ISSA chapter.

For an all day event it went pretty quick from my perspective being the trainer, but the feedback was GREAT! We received so many great comments we will be holding another training event just before BSides Austin 2014! March 19th.

In addition we have been asked to hold the training in Dallas Jan 31st for our local NAISG, ISSA and infraGard folks and other invited guests.


What made the training really cool, was the lab infrastructure that were graciously sponsored by Rackspace! These bad boys made the training smooth and the exercises fast! How fast you ask? Well in our development of the labs we were using an Amazon AWS Windows 2008 R2 server and the Hash_Master scans took roughly 21 mins on the AWS Server. On the sponsored Rackspace servers it took.. Wait for it....... 5 mins! Yup, five whole mins to scan the entire disk. Since we had to do this 3 times, it was an impressive improvement.

Here is the screenshot of our configuration from the Virginia region.


So cloud providers are not created equal and Rackspace has my appreciation for their performance, ease of use and all around awesomeness!

So if you are in Dallas Jan 31st, sign up for the training and come see how to discover malware like a Pro!

For more information, visit our Training page at:

Malware Discovery Training page

#InfoSec #HackerHurricane #malware

Like natives, InfoSec needs to become more hunters, less gatherers

Today we are faced with an ever increasing threat of advanced malware and the attacks associated with it. Compliance has created a gathering mentality in Information Security and it is no longer adequate to defend our tribe.

We must move more towards a hunters mentality and seek out the bad stuff in order to protect our tribe. We must detect and respond to the threats and seek them out because they are sneaky prey looking to take your goods while you gather data, stats, reports and check compliance reports for auditors.

Be an InfoSec Hunter and less a gatherer.

#InfoSec #HackerHurricane

(O) E&Y Poll states 96% of organizations are not prepared for a Cyber attack.. Hmmmm

This is an article I have to render an opinion on as it is a great example of 'What the heck have you been working on all these years?'

The Ernst & Young article may be found here discussed on Naked Security:

http://nakedsecurity.sophos.com/2013/11/01/96-of-businesses-are-unprepared-for-a-cyber-attack/?utm_source=feedly

65% of larger corps stated 'Financial' as a reason they are unprepared for a large Cyber event and 71% of small Orgs under $10million.  So let me get this straight, you have staff, you have bought many tools and most likely since this is an E&Y poll, you follow some sort of compliance framework.

In Wendy Nathers talk at LasCon in Austin she discussed the results of a poll that she asked industry experts to pick the technologies if starting from scratch for a 1000 person company... What did the list look like?  I shouted out "PCI", and the next slide said... PCI.  

I was even bold enough to state that I didn't need all that technology to practice "real security," that myself and another qualified InfoSec pro could do it with a few tools, if exploited properly.  Of course someone pointed out that I would never pass an audit and he is correct.  As a former State of Texas InfoSec resource I understand compliance all too well and years at HP dealing with SOX, PCI, HIPAA, ISO and others, I understand too much how compliance is a time sucking, resource pig that does not achieve what we really need to secure our companies and nation.

So why are so many not prepared for a cyber attack?  In doing many presentations I ask the following question, "How many are confident their environment is malware free, or once you find malware that the system is malware free?"  How many hands do we get?  0-1 per Preso!

Why is InfoSec so broken, or lack confidence?  I blame compliance.  I have stated compliance does not equal security as too often it is achieved by an auditor saying "Check, you pass".   There is no real evaluation of how you are actually doing at security defense.  Many say get Penetration Testing regularly to test your defenses.  I say "Phooey" to that as well, it proves little that your defenses are good enough.

Most Pen Testers I know will find a way in or fool a person to 'Click on That', just look at Trustwave's report on hacking a reporter who asked them too and knew they were coming!  There is merit in Pen Testing, but I feel most people, say 96% will fail the Pen Test.  Why? Because the way we currently think about Information Security, in that compliance frameworks like Implementing PCI will make you secure enough, but people, almost everyone is getting popped and they have some basic security framework in place.

"Real Security" is a dirty in the trenches kind of work.  HackerHuntress stated people didn't like Blue Team jobs because it is "hard" and I said "No it's not"...  We talked some and agreed in the end it is management and lack of trained staff that can do what I and others I know that are complete defenders can do.  Maybe we just don't know how, or lack confidence to defend all that is good.

We don't need to train the users and create and give more Employee Awareness as the E&Y article indicates.  We need to teach 'Real Security' to the in the trenches blue team defenders that are employed at many, if not most companies.  We need to teach them how to actually detect and respond to any size Cyber event and do so at the speed of business so that they may move on and you can get back to defending your network.  And the policy statement... Really?  Did E&Y not read that employees will disregard company policies where BYOD was involved?  We already know they surf non-business related sites on work systems because they can.  What makes anyone think policies will prevent anything?  They are guides on how to do things, or how a person will be reprimanded if caught.  Policies are regularly broken and the Internet has become an entitlement to most employees these days... Take it away and see what happens, I dare you!

This is why I do presentations on malware, logging and I challenge people at talks, to inject some thinking, to get people thinking, 'Is there another way?'  Thawt Leadership I think it' scaled ;-)  I share what I know about logging and malware at local ISSA 1/2 day and all day events, I do presentations at many Cons all to educate and share the love and a new way of thinking.  

Most people I talk with do not have the basic Windows auditing tweaked to actually record the events needed to detect a Cyber Attack of any kind.  If they do, they have not refined their audit rules and are not alerting via email to real actionable events.  They also do not monitor well known locations for malware or suspicious changes to a Windows system and sending that to the logs either.  Example;  How many of you have enabled the Advanced Auditing Security 'create files' property for one or more Windows directories (Windows, System32, Drivers, WBEM) to detect if a new file, not replaced files by Windows Update, but new files like malware are recorded and sent to you via email by your logging solution?  Implement and refine this feature alone and you are well underway to detecting a small to large Cyber Attack!  Don't leave out actually enabling the Windows Audit Policy as it (Yay Microsoft) is off by default and record success of privileged items and others of course.

Logging is HUGE to being prepared for a Cyber event of any size.  It can detect behavior of a Malwarian or Bad Actor reaching beyond a compromised system.  It can also allow defenders to report on who did what, where and when, but not why unless you ask them.  If you also monitor key locations across your Windows systems for file additions or changes you can detect odd files, which if happening from one system to many is also suspicious and can be alerted via email if you have a solution that can do this like BigFix, Tanium or others.

We also have to give up on spending tonnage of $$$$ on protecting the endpoint.  It WILL get popped if you allow users to surf the InterWebbings without strict controls.  Bad sites serving up malware are all over and the majority are on legitimate websites.  No, FireEye will not prevent all this threat, what about Thumb Drives?  Or users on their company laptops surfing outside the company when not protected by your proxy solution like FireEye?  The endpoint WILL get popped and InfoSec really needs to move more towards Detect and Respond to this threat in their budgets and focus less on prevention to move forward.  Start thinking like hackers and be a detective, not a preventive InfoSec program as it will serve you well and prepare you for any size Cyber event.

So I leave you with this to consider...

1.  What is 'Real Securiy' to you?

2.  Do you have a robust logging solution in place?

3.  Do you alert to the items I stated above?

4.  Have you attended a local BSides event to interact with the people in the know?

5.  Do you believe you have the people that can learn these tricks and skillz?

Or do you just believe compliance will get us there?

Let me know your thawts at the next Con.

#InfoSec #Logging #Malware

(I) Cyber-Ark Threat survey says 51% of companies think they are currently compromised

Here is another report by a security tools company that has some interesting data. 'Cyber-Ark's Global Threat Landscape Survey - June 2013'.

51% of companies think they have or had an active compromise going on.. Hmmm


Later in the report it states a rather high number of companies can detect 'attacks' in minutes or hours. An important distinction here is an attack is NOT a compromise. The question should have been "How long would it take you to detect a compromise?"



There is a significant difference between 'attack detection' and 'compromise detection'. Your goal should be minutes and hours to detect a compromise as detecting attacks is almost worthless with the sheer quantity of noise we all receive from the Internet. The recent Verizon DBIR and Trustwave reports clearly show an average of 210 days to detect a compromise and the notification of compromise usually comes from outside the company! In addition less than 5% of companies could detect a compromise in hours or days. These reports are believable, not sure Cyber-Ark asked the right questions.

Companies that create these reports need to ask the right questions to help those that participate get real actionable information. Not 'Wooo Hooo, I can detect an attack fast', when in fact clearly they can not detect the more important compromise.

The fact that 51% indicated they are or have been compromised again points towards Detect and Respond is where your InfoSec efforts should focus, NOT prevention as clearly prevention techniques of buying security tools is NOT enough.

Cyber-Ark Advanced Threat Survey

#InfoSec

(I) Calling for a "Malware Reporting Standard"

So what is a "Malware Reporting Standard"?  In short, a consistent way to report data and information about malware, usable by everyone, for use by any tool.  The bits of malware information that all of us Information Technology and Infosec professionals need to enter or import into our myriad of security solutions or scripts that we may use.

Why is this an issue?  Have you ever read virus descriptions from Sophos, Seculist/Kasperski, McAfee and others and tried to glean some data to enter into a security tool or search script?  Have you read the Mandiant APT1 report with the IOC’s (MD5’s) listed in the Appendix document, the Kasperski Red October report with the MD5’s listed, or even the Kasperski WinNTI report which lacked any Indicators Of Compromise (IOC)?

So what do we need?  What we need is for all the vendors and malware researchers to provide and report data about malware in a concise format that makes it easy to identify and consume the valuable details littered throughout the above mentioned reports and virus descriptions.

For many security solutions, the following information is needed to create an analysis we use to detect any anomalies;

• Filename
• Path found
• File extension
• MD5/SHA1
• Any Digital Signature info
• Dates
• Registry entries for Windozs systems 

A security professional does not necessarily need all the details to perform or setup an analysis.  The path or location the file was found and the extension of the file is fantastic information to setup an analysis for anything odd.  Look for anything in location \XYZ with the extension of .ABC that was found in the last 24 hours for example, and give me the SHA1 or MD5 of the file and maybe compare it to a file with the MD5 or SHA1 of the known bad IOC’s (if necessary).  This is a better method as now automated scans can look for a few files and compare it to an IOC list (if necessary) versus checking every file on the system against the IOC MD5 list, which is growing daily and will soon, if not already be out of control and unusable.

I am well aware that there is unique malware tracked by Anti-Virus companies (no alert  triggered to the user)  that are purposefully kept secret.  Whatever reason they are not alerted to the end-user, legal, law enforcement and specific requests by customers not wanting any details of an identified malware released while investigations are ongoing.  We do not get to see these details that can help protect us, we are denied!  There is no reason AV companies cannot add certain minimum bits and still keep details secret.  AV companies can just add the following as a minimum to a monthly or quarterly report/list for the secret “Shhh don’t alert” malware items;

• Location/path malware was found
• File extension of the malware
• Anything else in the Malware Reporting Standard

As a part of implementing a “Malware Management Framework” (we recommend everyone start adopting), the review of malware reports, virus descriptions and any malware analysis details is a fundamental part of the “Malware ManagementFramework” process.  Look for the items mentioned above within the last 24 hours using a tool like IBM Endpoint Manager (formerly BigFix) or Tanium would allow you to detect even the “Shhh don’t alert” malware items” as suspicious or unknown files and to investigate.  If you used the "MalwareManagement Framework" approach, malware that dropped additional .OCX files in System32 would be obvious as there are only 5 or 6 .OCX files normally in C:\Windows\System32 as was seen in Gauss.  All you would need to know is to setup your analysis tools and/or scripts to look for this condition in the last 24 hours and alert you for example.

Far too often IOC's provided by many of the sources mentioned above, only provide information based on what is fed into their respective tool(s).  Mandiant's APT1 report with MD5 hashes to be fed into MIR, just as the JIB reports that Homeland Security/FBI/InfraGard provide.  I can’t use this data in my malware detection tools.  Any and all malware researchers and vendors need to provide the industry more information!  I don’t feel it is necessary to scan every file on a system to match how many MD5’s?  It is not practical with 110 million pieces of new malware detected in 2012 and growing!  This is no longer a practical approach.  60 million already by May 2013, more than all of 2011!

The "Collective Intelligent Framework" (CIF) project is a step in the right direction, but we need to take the feeds and schema used by CIF, OpenIOC and others and standardize it.  A researcher or AV company can collect all or even parts of the bits of malware, but it must report it in a standardized manner.  Also provide the data in two formats, not just the XML to be consumed or imported by a tool, but also in CSV format like CIF supports.  Maybe each vendor can provide the same info in readable reports like we see with AV descriptions as well for easy consumption.  For AV companies, please add the data in your descriptions that match the "Malware Reporting Standard" in a consistent and obvious way to make it easy for us to consume and use. 

Aren’t we just letting the malefactr's, ne`er-do-wellers and malwarians know where and what we are looking for?  Absolutely!  If we can squeeze them into a smaller and smaller target, we win, they lose.  Malware authors will have to spend more time on their warez to avoid detection. This is a good thing if we can change their behavior and reduce hiding spots.

Something needs to change, something MUST change if we are to get ahead of malware and improve our investigation, detection and response capabilities.  Support the CIF schema as the start of a Malware Reporting Standard!

Read the CIF feed config and schema here:

• https://code.google.com/p/collective-intelligence-framework/wiki/FeedConfig_v1

We will support reporting any malware bits in the format discussed, so should you!

(F) Truly secure banking from the Onion at Chase banks expense

If only we could do this kind of banking. But actually you CAN! Boot a PC with a Linux distro of your choice. Every time you finish banking, rebooting will wipe out the session and anything you might have contracted. Use a USB thumb drive with a read-only switch to allow customization. A CD is best being read-only.

If you prefer Windows, then use Virtual Box and create a small Win7 VM to run Quicken, download your data or just do online banking. Be sure to store your Quicken files on a network drive so when you revert your VM snapshot you don't lose your Quicken data.

And of course use the longest most complex password your bank allows and change it yearly if not quarterly!

This is about as secure as you can get without doing any online banking.

The Onion on Chase online banking - FUNNY

#InfoSec #SecureOnlineBanking

(F) Funny Ellen segment on password management

Clearly this is how NOT to manage passwords, but grandma and grandpa might have actually bought this solution from a late night Infomercial.

Thanks Ellen for the spoof!

Link to Ellen show clip on password management


Use LastPass! As I have stated before, the easiest way to manage passwords across all your computers and smart devices. Free Two-Factor Auth too!!!

LastPass website

#InfoSec #Ellen

(I) Time to dump AV as Endpoint Protection? Not yet

I read an article by Robert Lemos on Dark Reading and thought, 'He missed some points'. So I emailed him and shared, now I'm sharing here too.

I think many things about Anti-Virus or Anti-Malware solutions, mostly that they suck at detecting anything new or unique. Sophos states 70% of malware is unique to one company and 80% to ten or less. But they are good for the 20% of malware that is not unique like BlackHole and other wide spread malware. AV is also good for the older lingering pestware, cracks, keygens and other undesirable known applications.

So is AV dead as Endpoint Protection? Not by a long shot. I would recommend to anyone asking me, don't go spending a ton of $$$ on an AV solution, or replace one vendor with another, maybe consider a free version, or cheaper solution. Unless of course you are already using a product like McAfee EPO where you have multiple solutions integrated into one console like database, data loss prevention, encryption, etc. But I sure wouldn't spend much to maintain AV.

If you really want to maximize the security bang for your buck, consider detection solutions like BigFix or Tanium that can do analysis that you craft to look for new files in WBEM for example where malware likes to inject. Or tweak Tripwire to send email alerts on changes to the WBEM directory. You will need agents deployed on every client you want to manage, but this is no different from AV.

What about Log Management? I mean real log management with alerting to nefarious behavior like 'net use', 'cscript', PSExec, RDP, successful logins, etc. and email your admins when their accounts are used successfully so logging is actually useful. Don't forget to enable the proper logging on your Windows systems (advanced logging) and proper logs and auditing on UX systems. Yes, you will need storage, but the data you can alert on with a log management solution or SIEM solution is going to do more with your security budget then AV $$$$.

Just read the Verizon DBIR and Trustwave reports and look at 'Time to Detection after Compromise' figures... If you are not in the 'within an hour' region, you are doing it wrong. Also referred to as Mean Time to Detection (MTTD). A dump term as mean time should not be calculated as you are only as good as your maximum time to detection, the mean is irrelevant.

Spend your security budget on detection items as "Prevention is DEAD" (you read me right) as far as a reliant way to protect your ASSets. Just accept you will get p0wned and work towards a detect, respond and erradicate mentality as Time Based Security suggests. Refine and improve your detection so that you are in the minutes and hours column and laughing at how fast you caught and stopped the malefactors the next day.

And NEVER trust your default security tools installations, they will fail you! Test, test and test again using attack scenarios and a Pen Test if needed to prove they do what you expect and paid for. Implement a "Malware Management Framework" and you CAN get a leg up on the ne’er-do-wellers.

Robert Lemos Dark Reading article on Dumping AV

#InfoSec

(I) Funny video blog on Log Management

Take a watch of this video blog on log management... Sums it up.

Video Blog on Log Management

#InfoSec #LogManagement

(I) We are all doing it wrong, well you are according to the stats

At this years BSides Austin, Ian and discussed a new method for malware analysis and detection. In the presentation was a slide that indicated from the Verizon 2012 DBIR report and Trustwave's 2012 report that the industry is STOOPID slow at detecting a compromise, as the following images show.
Verizon 2012 DBIR report


Trustwave's 2013 Global Security Report


HP sent me an email with the following tag line.



I don't know where HP got 416 days, as Verizon and Trustwave both indicate around 200+ days. Nevertheless these numbers are proof InfoSec and the security vendors selling us defenses are failing us all. Or is it us using the tools?

In the presentation Ian and showed red boxes around the two images above indicating we can detect a compromise within hours or less, not weeks, months or longer. A 180 degree change from the report findings. Why? Because we tweak our security tools to do more. We do not rely on default installations of security tools and expect them to work. We heavily use the analysis feature of BigFix (Fracking AWESOME BTW) to watch areas on the systems that have been and are regularly used for malware. We also have a methodology known as the "Malware Analysis Framework" that we use to keep up and defend our networks, and analyze what we find.

For 2013 I give you the following challenge, be honest about it to, where do you sit on the Verizon and Trustwave Detection of a Compromise timeline? Here is the challenge - Do a 180 turnaround as we have done and place your origination in the minutes to hours detection and containment area that is currently at 0%-5% according to the two reports, or worse HP's number of 416 days.

It can be done! If you need help, I guess we are available to do some simple consulting to help you figure it out, but you CAN do it !!!



#InfoSec

National “Take Your Computer to Work” Day

PR / IMMEDIATE RELEASE

Today marks the inaugural “Take Your Computer to Work Day”. First conceived by security researchers Michael Gough and Ian Robertson (the Thoughtful Hackers), this day has exploded in popularity and has now become a world-wide national phenomenon.

Says Mr. Robertson of its introduction, “We always hear stories of how much productivity people gain by using their own mobile phones and tablets at work – by some studies, as much as 110%. We thought, wow, that is so smart and has absolutely no downsides. The next logical extension of that is to offer all our workers to bring in any of their computers, so we did.”

“The results were absolutely astonishing”, said Mr. Gough. “We were seeing user productivity up at least 0.5 times with Commodore 64’s alone. Our database searches got faster with home-built white-box servers, and our janitorial staff was able to clean the restrooms twice as fast thanks to their TRS-80’s.”
The duo said that they had to share their results with others. “We really can’t take full credit for this. We’re just building on the success of others.”
What’s next up for this duo? “We seem to have a lot of malware recently, so we’re working to figure out what that’s all about.”

#InfoSec

(C) BSides Austin a HUGE success and spawns additional effort - Hackers in Uganda

2 years ago I hounded the director of CODE 2600 to allow BSides Texas events (DFW, Austin & San Antonio) show his movie at our awesome Cons. He agreed and the rest is history as they say.

At the BSides DFW post Con reception I had a discussion with Jeremy on the efforts of Johnny Long and Hackers for Charity and thought it would make a good documentary. Our own HFC supporter and Austinite @Spridel11 (Justin Brown) was in attendance and I introduced the two and they talked.

A short 4 months later at BSides Austin's CODE 2600 movie showing, also the following day during the Con, Jeremy made the following announcement. Roughly stated:

'We are pleased to announce Zerchak Films and 'Hackers for Charity' have officially launched 'Hackers in Uganda' KickStarter to raise $15,000 to help fund a documentary of the impact and efforts of Hackers for Charity on the people and country of Uganda.'

I am proud to have been a part of this and look forward to seeing what comes out of this endeavor. We need films like CODE 2600 and 'Hackers in Uganda' in order for people to truly understand the Information Security and Hacker communities and the good we do.

Hackers are not bad, just curious, and we help people just like anyone else. We are the good of our community and help to find flaws in systems before the criminal element does, we are the good guys and gals of the Information Technology community.

So PLEASE support the Kickastarter "Hackers in Uganda” effort and let's make this movie and a difference. There are lots of good stuff you can get as a part of your donation, so take a look.

Hackers in Uganda website

Hackers for Charity website


CODE 2600 website


#InfoSec #HFC #HackersinUganda