Archive
Are You Ready For The Next Generation IPS?
Advanced Persistent Threats are changing the information security paradigm and Next Generation IPS will probably be, together with SIEM, the new weapons in the hands of information security professionals for stopping this new category of threats that are proving to be the real nightmares for CISOs in this troubled 2011.
If you have just learned what a Next Generation Firewall is, you will probably be a little disappointed in knowing that it is not the last frontier of information security (as many security firms claim), instead the growing impact and influence of APTs, which are threats acting on different layers (user, network and applications), different timeframes and different portions of the network, are redesigning the network security paradigm, requiring additional intelligence at the perimeter, and shifting the game to a context-aware model in order to grant the holistic view that is necessary to stop them.
Traditional Firewall and IPS Technologies are rapidly shifting towards the Next Generation Firewall model, which is user aware and application aware. Unfortunately a Next-Gen Firewall is not enough to stop an APT, since, although focused on the application control, a NGF remains essentially user oriented, and consequently lacks the global vision necessary to stop a persistent threats acting on different layers besides user and application. At the same time traditional network security technologies (FW and IPS) are not enough since they are anchored to the old model: a Firewall enforces access control at the protocol level, which is useless for threats carried inside legitimate traffic, instead an IPS enforces a security model based on protocols and vulnerabilities, being completely unaware (and in certain sense blind unless complex integrations are put in place) of the context in terms of user activity, and user interaction with applications, directories, etc.
Now let us suppose to make a brand new information security recipe, taking the main features of a NGF (user awareness and application awareness), the main features of a Firewall (access control) and the main features of an IPS (protocol awareness and vulnerability awareness), blend them in a virtual pot and add a little bit of reputation (for instance obtained from a globally distributed network of sensors) and other features such as geo-location, application heuristics and, last but not least, an application anomaly detection engine (which is completely different from a traditional protocol anomaly engine). You will obtain a new information security dish: the Next Generation IPS, a new class of devices that likely represents the near future of network security.
NG-IPSs are characterized by two main features:
- They shift the enforcement of security policies from a content-based to a context-based model (where the context is defined by the interaction of user with applications);
- They leverage new technologies such as reputation and geo-location to provide the holistic view necessary to stop APTs.
So what do we have to expect at the perimeter? The traditional Firewall and IPS (or UTMs) will likely be replaced by NG-IPS, while specific “vertical” security devices, such as Web Application Firewall will remain in place in strategic portion of the netowork (just in front of Web Farms) to protect specifically Web (read HTTP and HTTPS) applications. As you may see from the following table a NG-IPS encompasses all the features of the “old” technologies plus new features allowed by a growing adoption of Reputation and Cloud-Based services.
Since WAF will follow a parallel and co-existing walk, meanwhile I reccomend you to read my Q&A on Next-Gen and Web Application Firewall.
Related articles
- Next Generation Firewalls and Web Applications Firewall Q&A (paulsparrows.wordpress.com)
Phoning Home to China
A couple of weeks ago, during the RSA Conference in London, Tom Heiser, president of RSA declared that two separate hacker groups already known to authorities were behind the serious breach affecting tbe Security Firm early this year in March, and were likely working at the behest of a government. Heiser also declared that the attackers possessed inside information about the company’s computer naming conventions that helped their activity blend in with legitimate users on the network, concluding that, due to the sophistication of the breach:
“we can only conclude it was a nation-state-sponsored attack.”
In a statement issued after the breach, the Security Firm declared that some information related to their two-factor authentication technology SecurID had been extracted during the attack, and that information could be used, as part of a broader attack, to decrease the effectiveness of the two-factor authentication.
Curiously RSA refused to name the involved nation, so not confirming the suspects directed to China. Regardless of the nation, among Security Professional it was immediately clear that the true target of the attack was not RSA but its customers: SecurID tokens are used by 40 million people in at least 30,000 organizations worldwide to allow secure access to IT systems. So it was not a surprise the fact that few weeks after the breach three Defense Contractor were attacked using compromised seeds, and although in two cases (L-3 Communications and Northrop Grumman) there was no direct evidence of a direct involvement of compromised tokens but only rumors, in one case (Lockheed Martin), RSA admitted the use of compromised tokens and offered to replace the tokens to affected customers.
Today another interesting piece of the puzzle: in his blog Brian Kerbs publishes a list of companies whose networks were shown to have been phoning home (i.e. connect to the C&C Server) to some of the same control infrastructure that was used in the attack on RSA. The first victims appear to have begun communicating with the attacker’s control networks as early as November 2010. According to the list 760 other organizations had networks compromised with some of the same resources used to hit RSA and almost 20 percent of the current Fortune 100 companies are on this list.
Scroll down the names on the list and you will find many interesting and surprising firms, even if the author correctly advises that:
- Many of the network owners listed are Internet service providers, and are likely included because some of their subscribers were hit;
- It is not clear how many systems in each of these companies or networks were compromised, for how long those intrusions persisted, or whether the attackers successfully stole sensitive information from all of the victims;
- Some of the affected organizations (there are also several antivirus firms mentioned) may be represented because they intentionally compromised internal systems in an effort to reverse engineer malware used in these attacks.
So at the end, what’s the matter with China? Simple, at the bottom of the article there is a chart reporting the location of more than 300 command and control networks that were used in these attacks. Guess where 299 of them were located…
(Thanks to @MasafumiNegishi for reporting the original blog post).
Related articles
XML Encryption Cracked!
We have not completely assimilated the BEAST vulnerability, and here it comes, from Bochum, Germany, another serious flaw involving Encryption, or better, involving XML Encryption.
XML Encryption, is a W3C standard widely used to securely transmit information inside Application-to-Application Web services connections. It was believed to be a robust standard mechanism to protect data exchange between a wide class of applications using web services and deployed in different sectors, for instance business, e-commerce, financial, healthcare, governmental and military applications. For the generic user a typical scenario involves, for example, credit card information encryption for a payment within an XML-based purchase order.
Unfortunately it lools like the mechanism is not so robust as it was supposed to be, and the discovery comes from Juraj Somorovsky and Tibor Jager, two Researchers at the Ruhr University of Bochum (RUB) who were successful in cracking parts of the XML encryption process used in web services, thus making it possible to decrypt encrypted data. They demonstrated their work at the ACM Conference on Computer and Communications Security in Chicago this week.
As far as the attack technique is concerned, once again CBC (Cipher-Block Chaining) is indicted since the new discovered vulnerability, as in case of the BEAST attack, is exploitable only in this encryption mode.
The attack strategy seems very similar to the one behind the BEAST Attack and allows to decrypt data, encrypted in AES-CBC, by sending modified ciphertexts to the server, and gathering information from the received error messages using the cryptographic weakness of the CBC mode, in particular the fact that, by conveniently manipulating the IV, ciphertexts encrypted in CBC mode can be modified so that the resulting ciphertext is related to the original ciphertext in a certain way (see the description of the BEAST attack for an example).
So, by choosing a given ciphertext, the attacker is able to recover the entire plaintext and the only prerequisite requires the availability of what the researchers define an “oracle”, that is a pattern telling the attacker if a given ciphertext contains a “correctly formed” plaintext that is a valid encoding (e.g. in UTF-8 or ASCII) of a message. Even worse XML signature is not able to mitigate the attack.
In their paper the authors showed that a moderately optimized implementation of the attack was able to decrypt 160 bytes of encrypted data within 10 seconds by issuing 2,137 queries to the Web Service, morever the complexity of the attack grows only linearly with the ciphertext size, thus allowing to recover a larger plaintext of 1,600 bytes takes about 100 seconds and 23,000 queries.
The proof of concept has been performed on a Web Service based on the Apache Axis2 XML framework and verified on JBoss, but many other vendors are affected, that is the reason why the two researchers announced the vulnerability to the W3C XML Encryption Working Group in February 2011. Vendors affected include the above mentioned Apache Software Foundation (Apache Axis2), RedHat Linux (JBoss), but also IBM and Microsoft.
Unfortunately fixing the flaw will not be that easy, the only suitable way is to replace CBC mode by using a symmetric cryptographic primitive providing confidentiality and integrity, this means to change the XML Encryption standard!
The 2011
Related articles
- Researchers crack W3C encryption standard for XML (arstechnica.com)
- XML Encryption Broken, Need To Fix W3C Standard (it.slashdot.org)
- The Beauty (RC4) and The BEAST (TLS) (paulsparrows.wordpress.com)
Another Friday, Another Dump
Anonymous and Antisec broke their apparent October silence and renewed the tradition of the Friday Dumps against law enforcement agencies releasing a 600MB data dump of confidential data belonging to Law enforcement agencies.
According to the original statement, no more available on pastebin:
In solidarity with the Occupation Movement and the International Day of Action Against Police Brutality, allied #anonymous and #antisec vessels took aim at the corrupt bootboys of the 1%: the police. We hacked, defaced, and destroyed several law enforcement targets, leaking over 600MB of private information including internal documents, membership rosters, addresses, passwords, social security numbers, and other confidential data. According to the IACP’s development documents, their systems cost several hundred thousand dollars. We are pleased to destroy it all for free, leaking their private info and defacing their websites in one swift blow.
Victims of the attack include: the International Association of Chiefs of Police (IACP), Boston Police Patrolmen’s Association (BPPA) and the Baldwin County Sheriff’s office in Alabama.
As part of the raid, Antisec hackers compromised webservers used by Matrix Group, a web development firm located in Arlington, VA (the latest example of a Contractor hacked), boasting several law enforcement and government clients. The attack on Matrix Group led to the removal of dozens of websites from the Internet, and several other defacements (with an anti-police rap video) even if unrelated sites on their servers were intentionally excluded from the attack. The defacements included Matrix Group information including sever logs and history files, financial data, client lists, and project information. The leaked 600MB of private information include internal documents, membership rosters, addresses, passwords, social security numbers, and other confidential data.
The attack, probably performed by mean of SQL Injection, was performed in support of the so-called 99% movement, a reference to the Occupy Wall Street protests spreading around the world (and comprising the 99% of the population), particularly in Boston, and also in solidarity with the dozens of alleged “Anonymous” members around the world facing charges for “hacking”.
If one does not consider the alleged threats and hacking attempts against Thomas Ryan, an independent security consultant who released a trove of e-mail communications from the Occupy Wall Street protesters, this is the second circumstance in which Anonymous backs the OccupyWallStreet movement with a direct hacking action (after the doxing of the “Pepper Spray Officer), even if in this case the size of the operation is quite huge, resembling the attacks perpetrated against BART at the end of August.
Is the World going to face another massive wave of hactivism motivated data dumps?
Related articles
Stuxnet, Duqu, Stars And Galaxies…
In few circumstances I happen to deal with my old (and short) career of Astrophysical. Except when I enjoy to tell my friends the history of the Hubble Constant, and my delusion when I discovered that its value is greater than 50 (most precise determination is 72 ± 8 km/s/Mpc implying a forever expanding Universe which will likely die of Entropy), the chances in which my current activity, information security, and my “would-have-been” career of Astrophysics overlap are really rare.
You may imagine how surprised I have been, when I came across this post by F-Secure concerning the Duqu malware and the images hidden inside the traffic generated by the malware and directed to the C&C Server.
Typically keyloggers try to hide the malicious traffic by resembling legitimate traffic, and of course the infamous Stuxnet-based keylogger is not an exception to this schema, by making the transfer look innocent in case somebody is watching network traffic.
Duqu connects to a server (206.183.111.97 a.k.a. canoyragomez.rapidns.com – which used to be in India) and sends an http request. The server will respond with a blank JPG image. After which Duqu sends back a 56kB JPG file called dsc00001.jpg and appends the stolen information (encrypted with AES) to the end of the image file.
Even if somebody is watching outbound traffic, this wouldn’t look too weird.
Nothing new except the fact that Duqu components contain different JPG files. One of them is an image of the Hubble Space Telescope: NGC 6745 also dubbed Bird’s Head (have a deep look to the image and you will discover why).
From Wikipedia:
NGC 6745 (also known as UGC 11391) is an irregular galaxy about 206 million light-years (63.5 mega-parsecs) away in the constellation Lyra. It is actually a triplet of galaxies in the process of colliding.
Why did they decide to insert an astronomical image? And why just an Image representing three galaxies colliding? A possible metaphorical reference to a cyber war between three nations? The curiosity has stimulated a funny contest by F-Secure even if no interpretation, so far, seems convincing (I also tried to brainstorm but unfortunately my residual notions of Astronomy are not enough, so at first Glance I was not able to find any correspondence.
From an information security perspective, I could not help but notice that this is not the only overlapping between Stuxnet and Astronomy. As a matter of fact the original version of Stuxnet is programmed to automatically switch off on June, 24th 2012: even if a remind to the alleged End of the World according to the Mayan Calendar is unavoidable, this date is also linked to the so-called Grand Cross, corresponding to the date that Pluto in Capricorn squares off against Uranus in Aries.
But there is also another funny aspect and coincidence: do you remember the alleged Stuxnet-like worm that Iran claimed to have detected on April 25 2011? Curiously it was called Stars, and although no evidences of the malware (and not even samples as far as I know) were collected, so that many Information Security experts stated Iran was crying wolf, again the malware was dubbed with a term recalling astronomy. At this point I inevitably (and joyfully) wonder if Stars derived its name from hidden stellar images as in case of Duqu.
Related articles
- Back to The Future of Stuxnet (paulsparrows.wordpress.com)
Back to The Future of Stuxnet
While the U.S. and U.K. are debating whether to use Cyberwarfare, someone, somewhere, has decided not to waste further time and has anticipated them, developing what appears to be a precursor of Stuxnet 2.0. In a blog post, Symantec explains how it came across the first samples of the malware thanks to a research lab with strong international connections, which, on October 14 2011, alerted the security firm to a sample that appeared to be very similar to Stuxnet.
The brand new threat has been dubbed “Duqu” [dyü-kyü] because it creates files with the file name prefix “~DQ”, and has been discovered in some computer systems located in the Old Continent. After receiving and analyzing the samples, Symantec has been able to confirm that parts of Duqu are nearly identical to Stuxnet, but with a completely different purpose.
Unlike its infamous predecessor Duqu does not target ICS but rather appears to be a RAT developed from the Stuxnet Source Code, whose main features may be summarized as follows (a detailed report is available here):
- The executables [...] appear to have been developed since the last Stuxnet file was recovered.
- The executables are designed to capture information such as keystrokes and system information.
- Current analysis shows no code related to industrial control systems, exploits, or self-replication.
- The executables have been found in a limited number of organizations, including those involved in the manufacturing of industrial control systems.
- The exfiltrated data may be used to enable a future Stuxnet-like attack.
- Two variants were recovered [...], the first recording of one of the binaries was on September 1, 2011. However, based on file compile times, attacks using these variants may have been conducted as early as December 2010.
Of course this event rises inevitably many security questions: although cyberwar is actually little more than a concept, cyber weapons are a consolidated reality, besides it is not clear if Duqu has been developed by the same authors of Stuxnet, or worst by someone else with access to the source code of the cyber biblical plague (and who knows how many other fingers in this moment will be coding new threats from the same source code).
Anyway one particular is really intriguing: only yesterday the DHS issued a Bulletin warning about Anonymous Threat to Industrial Control Systems (ICS), not event 24 hours after the statement a new (potential) threat for ICS appears in the wild… Only a coincidence?
October 2011 Cyber Attacks Timeline (Part I)
October has come and here it is, also for this month, the first part of my Cyber Attacks Timeline covering the cyber events occurred in the first half of the current month.
Three events in particular have marked this month: The German Trojan R2-D2 (that is raising many questions and concerns inside the infosec community), the keylogger hitting U.S. Drones and a new cyber attack to Sony involving this time “only” 93,000 accounts (oops! They did it again).
Except for a couple of isolated occurrences (in Austria and UK), the Cyber Attacks by Anonymous and Antisec had a break, maybe because hacktivism efforts are being focused on the #OccupyWallStreet operation that is rapidly spreading all over the World (I wonder why in here in Rome yesterday it has not been possible to have peaceful protests as happened in all the other Capitals). Besides, albeit not directly related with Anonymous, several Syrian log files were leaked showing the control of the Government on the Internet.
Other events of the month: a couple of fashion related websites were hacked, the Cyber-Guerrilla between India and Pakistan was particularly active with the cyber armies of the two nations facing themselves in the cyber space with continual mutual defacements, @SwichSmoke was also particularly active against Venezuela Government Web Sites. Other “minor” leaks were performed by @FailRoot and @ThEhAcKeR12 but one of the victims of the latter was Camber Corporation, an U.S. Contractor.
Anyway, Camber Corporation was not the only targeted Contractor, also Raytheon Corporation (a survivor of the RSA Breach) was targeted with a cloud based spear-phishing campaign, again the attack was thwarted but, in my opinion, has deserved a mention as well. Chronicles also reports of a claimed hack to Infragard (again).
Moreover the aftermaths of the RSA breach are not completely over: this month the security firm’s CEO claimed that a couple of different Cyber Crews, under the flag of an enemy nation (and the suspects were immediately directed to China), are behind the Cyber Attack in March and acted to perform it.
But a very special mention for this month (and the consequent lowly desiderable prize), is undoubtedly deserved by Mr. Oliver Letwin, Her Majesty’s Cabinet Minister, who was caught by The Daily Mirror in the habit of dumping private correspondence and sensitive documents detailing Al-Qaeda activities and secret service operations into park bins in St James’s Park, Westminster, close to Downing Street. Security, logical and physical, may have many unpredictable implications…
From a technical point of view SQLi and defacements were the most used lethal weapons for this month, even if a massive ASP.NET based attack, targeting 300,000 web sites, is also worth mentioning.
This Timeline was compiled with Useful Resources by:
- Cyber War News
- DATALOSSdb
- Naked Security
- Office Of Inadequate Security (DataBreaches.net)
- Softpedia
- The Hacker News
- Threatpost
And my inclusion criteria do not take into consideration simple defacement attacks (unless they are particularly resounding) or small data leaks.
Last but not least: you may find all the timelines for 2011 in my Master Index. Enjoy the list(s) and share and retweet to encourage me to keep it up2date!
| Date | Author | Description | Organization | Attack |
| Oct 1 |  |
NeatStuffs hacks filmradar.com a movie review and information site/community and releases on Mediafire a 6mb txt file containing 95167 accounts with hashed passwords. Estimated cost of the breach is $ 20,365,738. |
 |
SQLi? |
| Oct 2 |  |
Venezuela National Statistics Institute
SwichSmoke crew hacks the Venezuela National Statistics Insitute during the 2011 Census. |
 |
SQLi? |
| Oct 2 |
 |
Camber Corporation (US Contractor)
Once again a US Government contractor is target of cyber crime. This time is the turn of Camber Corporation, targeted by a small hack by @ThEhAcKeR12, which releases 3 admin accounts with encrypted passwords. and admin full name. |
 |
? |
| Oct 2 |
|
wrestlegame.co.uk
Again @ThEhAcKeR12, this time the crew dumps 1500+ accounts (in encrypted format) and a database from wrestlegame.co.uk. Estimated cost of the breach is around $321,000. |
wrestlegame | SQLi? |
| Oct 2 |
A student arrested few days later |
Thailand Prime Minister
Thailand’s Prime Minister, Yingluck Shinawatra, had her Twitter account hacked flooding her followers with a stream of messages criticising her leadership with statements like this: The final post read: “If she can’t even protect her own Twitter account, how can she protect the country?“ |
 |
Account Hacking |
| Oct 4 |  |
Austrian Economy Chamber (WKO) WKO confirms that its webserver was infiltrated by unidentified cyber criminals. More than 6,000 data sets of customers of the chamber were published on the internet. Although Anonymous Austria leaked the data, they stressed they had not carried out the attack on WKO themselves, but had been provided with the records by someone else, adding that the security leak was exposed by using online search engine Google. Estimated cost of the Breach is around $1,284,000. |
 |
Vulnerability on The Target Platform |
| Oct 5 | |
@ThEhAcKeR12 does not stop here and dumps 3300 accounts from funniestvideosonline.com and are all encrypted passwords. Estimated cost of the Breach is around $706,200. |
 |
SQLi? |
| Oct 5 |  |
www.xvidonline.com @FailRoot hacks and leaks several accounts from www.xvidonline.com putting the websits offline. |
xvidonline.com | SQLi? |
| Oct 5 | Optik Fiber | Gmail (Claimed) Optik Fiber releases several gmail accounts claimed to have been hacked via a known security flaw in gmail. It is not sure if this is real or not but it is meaningful as well of the global level of (in)security, real or psychological. |
 |
Known Security Flaw in Gmail (N/A) |
| Oct 5 | ? | Fashion TV India Unknown hackers hacks Fashion TV India with the injection tool havij and obtain a list of accounts dumping usernames and passwords in clear text. |
 |
SQLi via havij |
| Oct 6 |  |
Syrian Internet Log Files
Internet activists from Telecomix release 54 GB of log files allegedly created by Syrian internet censors between 22 July and 5 August 2011. The data were found on a third party server. |
 |
? |
| Oct 7 |
|
An Australian University website that lists jobs is hacked by @BlackHatGhosts and has data dumped, included user logins and passwords. |
 |
SQLi? |
| Oct 7 | Several Hackers |
Department of Public Enterprises South Africa Department of Public Enterprises, south Africa is hacked and had its database dumped |
 |
SQLi |
| Oct 7 | Same authors above |
Ministry of Culture and Tourism, Republic of Indonesia Another day, another government website hacked, (and its data leaked). |
 |
SQLi |
| Oct 7 | ? | University Of Georgia The University of Georgia discovers a data file on a publicly available Web server that contained sensitive personnel information on 18,931 members of the faculty and staff employed at the institution in 2002. The file included the social security number, name, date of birth, date of employment, sex, race, home phone number and home address of individuals employed at UGA in 2002. Estimatec Cost of the Breach is around $4,051,234. |
 |
Internal Accidental Error |
| Oct 8 | ? |
U.S. Military Drones
Wired reports that a computer virus has infected Predator drones and Reaper drones, logging pilots’ keystroke during their fly missions over Afghanistan and other warzones. The virus was detected nearly two weeks ago at the Ground Control System (GCS) at Creech Air Force Base in Nevada and has not prevented drones from flying their missions, showing an unexpected strength so that multiple efforts were necessary to remove it from Creech’s computers. |
 |
USB Stick? |
| Oct 8 | German law Author. and Customs Dep. |
German Citizens A very strange (un)lawful Cyber Attack, against German Citizens. Chaos Computer Club discloses a “state malware”: a backdoor Trojan horse capable of spying on online activity and recording Skype internet calls. They declare the malware is used by the German police force. The malware was allegedly installed onto the computer as it passed through customs control at Munich Airport. |
 |
Troian Horse |
| Oct 9 | Turkish Energy Team |
Several Government Websites
Turkish Energy Team performs (and keeps on to perform) a massive defacement against several governments websites (in certain cases some sub domains). The list (in continuous growth) is published on Zone-H. |
 |
Defacement |
| Oct 9 | MCA-CRB |
Other Government Websites
Different Crew, same result: a massive defacement against several governments websites. Also in this case the list (in continuous growth) is published on Zone-H. |
 |
Defacement |
| Oct 9 | |
justonehost.com
Another Web site hosting company defaced: this time it is the turn of justonehost.com that is hacked by @FailRoot, that also dumps its Database online. The leak contains all users informations, emails, paypals and much more is 11.86mb and has been uploaded to megaupload. |
 |
Defacement SQLi |
| Oct 10 |
|
Congress of the State of Chihuahua Another government website hit and leaked by @FailRoot: Congress of the state of Chihuahua Mexico. The leak contains administration usernames and (easy guessable) passwords. |
 |
SQLi? |
| Oct 10 | Q!sR QaTaR |
A cybercriminal from Quatar defaces a large number of websites belonging to the Ankara government, leaving them non-operational. |
 |
Margent |
| Oct 10 |
 |
40 Zimbabwe Government Websites
A crew called ISCN hacks and defaces 40 Zimbabwe government based websites leaving a polical message. |
 |
Defacement |
| Oct 10 |  |
UKGraffiti.com
UKGraffiti is hacked by Anonymous_DR (Anonymous Dominicana) who also dumps usernames, emails and encrypted passwords. |
 |
SQLi? |
| Oct 11 | ? |
RSA
RSA reveals that it believes two groups, working on behalf of a single nation state, hacked into its servers during the infamous Breach of March and stole information related to the company’s SecurID two-factor authentication products used to attack some defense contractors. Although people are likely to assume that China might have been involved in the attack, they did not reveal the name of the nation involved. |
 |
APT |
| Oct 11 | ? |
Sony (Playstation Network, Sony Entertainment Network and Sony Online Entertainment) Back tho the future! Sony under cyber attack… Again! The Company reports of unauthorized attempts to verify valid user accounts on Playstation Network, Sony Entertainment Network and Sony Online Entertainment. A total of 93,000 accounts have been affected (PSN/SEN: approximately 60,000 accounts; SOE: approximately 33,000). In these cases the attempts succeeded in verifying valid sign-in IDs and passwords, so the accounts were temporalily locked. |
 |
SQLi? |
| Oct 11 | ? |
blueHOMES.com Unknown Hackers hack the European property Dealers website blueHOMES.com . About 500,000 Users data claim to be hacked including database with customer passwords in plaintext, full addresses, skype account, and mailboxes of bluehomes. Specified data leaked on pastebin with sample data of some users. |
 |
SQLi |
| Oct 11 | ? |
Find2Trade.com
Another website hit by Havij. This time is the turn of Find2Trade, an internet portal whose goal is to help small and medium enterprises to reach much higher profits while reducing costs. UserID, email and passwords, which are encrypted, were leaked. |
 |
Havij |
| Oct 12 | ? |
Raytheon
The U.S. Defense Contractor reveals that it was the victim of a cloud-based attack for the first time, with the incident occurring one week before. Nothing new but the fact that this was the first cloud based attack. The firm usually blocks 1.2 billion attacks a day in addition to four million spam emails each day. |
 |
N/A |
| Oct 12 | ? | WineHQ
Another Linux Project hacked! Jeremy White, Codeweavers Founder announces that access to the WineHQ database has been compromised. It looks like attackers have used phpMyAdmin to access the WineHQ project’s database and harvest users’ appdb and bugzilla access credentials. |
 |
SQLi |
| Oct 13 | ? |
300,000 Websites Google reveals another mass infection which affected hundreds of thousands of sites that relied on ASP or ASP.NET: A malicious script got injected into several locations targeting English, German, French and other language speakers surfers. |
 |
ASP Vulnerability |
| Oct 13 | ? |
Genentech The biotechnology company suffered a data breach on August, 17 which may have resulted in the theft of information belonging to 3,500 of the million patients who utilize the company’s support programs. Estimated Cost of The Breach is around $750,000 |
 |
Unlegitimate Access |
| Oct 14 | ? |
Chili’s Grill & Bar Restaurant
Ok a Chili Breach is not a big deal, except the fact that the computer server Hackers broke into, is placed at Yokosuka Naval Base. According to Navy officials, hackers stole credit card information and run up erroneous charges. |
 |
Credit Card Thieft |
| Oct 14 | ? |
Fedora Project This is not a direct cyber attack but a consequence of the hacks to Linux projects (Kernel.org and Linux). ThreatPost reveals that Fedora Project contacted users to change their password and SSH public key before November 30 to avoid having their accounts marked as inactive. |
 |
N/A |
| Oct 14 | |
Barinas State, Venezuela Another dump of sites from @SwichSmoke coming from the state “Barinas” and the government for that state. The release note, in Spanish states that the original password is 123456, fairly lame for a government website. |
 |
SQLi |
| Oct 14 | Vicky Singh |
Pakistan Embassy in China Another episode of the Cyberware between Pakistan and Indian Crew: Vicky Singh defaces the Pakistan Embassy in China. |
 |
? |
| Oct 14 | Team Dexter |
Contrexx.com
An European Content Management System provider is hacked and has a dump of administration details leaked online. |
 |
N/A |
| Oct 14 Oct 15 | Several Authors |
Club Music CPPS
Club Music CPPS is hacked: the leak contains account emails, usernames and decrypted passwords. Note: on Oct 16 the site is still defaced |
 |
SQLi Defacement |
| Oct 14 | |
Venezuela National Graduate Advisory Council
Another cyber attack by @SwichSmoke, this time they leak the Venezuela National Graduate Advisory Council and release the leaked data on pastebin. |
 |
SQLi |
| Oct 14 | ? |
Infragard Atlanta (claimed)
It seems that Infragrad has been hacked again and had a dump of accounts leaked and decrypted even if there is no source or reason or even proof that this is 100% real in anyway. Anyway it still shows that Infragard is still in the eyes of some people. The alleged leak contains emails, usernames, encrypted passwords and the decryption of the password as well. |
 |
N/A |
| Oct 14 | ? |
NSEC (Netaji Subhash Engineering College)
The Netaji Subhash Engineering College NSEC is hacked and has a fair amount of member accounts dumped on pastebin. This comes from an unknown source and unknown reasons. The leak contains full user information, emails and passwords in clear text. |
 |
SQLi |
| Oct 14 |  |
Barbaros-DZ hacks over 1,700 sites belonging to the Chinese Government defacing them and leaving a message against the Goverment itself. THe list of the sites is available on Zone-H. |
 |
Defacement |
| Oct 14 |  |
Special mention this month for Her Mayesty’s Cabinet Minister Oliver Letwin, who has got himself into hot water, after The Daily Mirror reported him in the habit of dumping private correspondence and sensitive documents detailing Al-Qaeda activities and secret service operations into park bins in St James’s Park, Westminster, close to Downing Street. The documents contained the personal details of the minister’s constituents, including names, phone numbers, email contacts and postal addresses. |
 |
Defacement |
| Oct 15 | SA3D HaCk3D |
16,000+ websites
SA3D HaCk3D shows on Zone-H the results of his work of the past years: a total of 16,000+ websites defaced. |
 |
Defacement |
| Oct 15 | p0xy |
iCPPS
For an alleged personal revenge, a hacker called p0xy leaks usernames, emails and hashed passwords from the iCPPS online platform. |
 |
SQLi |
| Oct 15 | iolaka |
World Miss Photogenic
This time is the turn of a fashion/model based website, which is attacked and suffers a dump of accounts leaked containing 1000+ accounts including usernames, emails and encrypted passwords by iolaka. |
 |
SQLi |
| Oct 15 |  |
India Cyber Crime Investigation Cell Another episode of the Cyber-Guerrilla between India and Pakistan: Pakistani hacker Shadow008 hacks and defaces India’s Most Important website of Cyber cell located at Mumbai. |
 |
Defacement |
Related articles
- Just For Reference… (paulsparrows.wordpress.com)
- September 2011 Cyber Attacks Timeline (Part II) (paulsparrows.wordpress.com)
- September 2011 Cyber Attacks Timeline (Part I) (paulsparrows.wordpress.com)
Advanced Persistent Threats and Security Information Management
Advanced Persistent Threats are probably the most remarkable events for Information Security in 2011 since they are redefining the infosec landscape from both technology and market perspective.
I consider the recent shopping in the SIEM arena made by IBM and McAfee a sign of the times and a demonstration of this trend. This is not a coincidence: as a matter of fact the only way to stop an APT before it reaches its goal (the Organization data), is an accurate analysis and correlation of data collected by security devices. An APT attack deploys different stages with different tactics, different techniques and different timeframes, which moreover affect different portion of the infrastructure. As a consequence an holistic view and an holistic information management are needed in order to correlate pieces of information spread in different pieces of the networks and collected by different, somewhat heterogeneous and apparently unrelated, security devices.
Consider for instance the typical cycle of an attack carried on by an APT:
Of course the picture does not take into consideration the user, which is the greatest vulnerability (but unfortunately an user does not generate logs except in a verbal format not so easy to analyze for a SIEM). Moreover the model should be multiplied for the numbers of victims since it is “unlikely” that such a similar attack could be performed on a single user at a time.
At the end, however, it is clear that an APT affects different components of the information security infrastructure at different times with different threat vectors:
- Usually stage 1 of an APT attack involves a spear phishing E-mail containing appealing subject and argument, and a malicious payload in form of an attachment or a link. In both cases the Email AV or Antispam are impacted in the ingress stream (and should be supposed to detect the attack, am I naive if I suggest that a DNS lookup could have avoided attacks like this?). The impacted security device produce some logs (even if they are not straightforward to detect if the malicious E-mail has not been detected as a possible threat or also has been detected with a low confidence threshold). In this stage of the attack the time interval between the receipt of the e-mail and its reading can take from few minutes up to several hours.
- The following stage involves user interaction. Unfortunately there is no human firewall so far (it is something we are working on) but user education (a very rare gift). As a consequence the victim is lured to follow the malicious link or click on the malicious attachment. In the first scenario the user is directed to a compromised (or crafted) web site where he downloads and installs a malware (or also insert some credentials which are used to steal his identity for instance for a remote access login). In the second scenario the user clicks on the attached file that exploits a 0-day vulnerability to install a Remote Administration Tool. The interval between reading the malicious email and installing the RAT takes likely several seconds. In any case Endpoint Security Tools may help to avoid surfing to malicious site or, if leveraging behavioral analysis, to detect anomalous pattern from an application (a 0-day is always a 0-day and often they are released after making reasonably sure not to be detected by traditional AV). Hopefully In both cases some suspicious logs are generated by the endpoint.
- RAT Control is the following stage: after installation the malware uses the HTTP protocol to fetch commands from a remote C&C Server. Of course the malicious traffic is forged so that it may be hidden inside legitimate traffic. In any case the traffic pass through Firewalls and NIDS at the perimeter (matching allowed rules on the traffic). In this case both kind of devices should be supposed to produce related logs;
- Once in full control of the Attacker, the compromised machine is used as a hop for the attacker to reach other hosts (now he is inside) or also to sweep the internal network looking for the target data. In this case a NIDS/anomaly detector should be able to detect the attack, monitoring, for instance, the number of attempted authentications or wrong logins: that is the way in which Lockheed Martin prevented an attack perpetrated by mean of compromised RSA seeds, and also, during the infamous breach, RSA detected the attack using a technology of anomaly detection Netwitness, acquired by EMC, its parent company immediately after the event.
At this point should be clear that this lethal blend of threats is pushing the security firms to redefine their product strategies, since they face the double crucial challenge to dramatically improve not only their 0-day detection ability, but also to dramatically improve the capability to manage and correlate the data collected from their security solutions.
As far as 0-day detection ability is concerned, next-gen technologies will include processor assisted endpoint security or also a new class of network devices such as DNS Firewalls (thanks to @nientenomi for reporting the article).
As far data management and correlation are concerned, yes of course a SIEM is beautiful concept… until one needs to face the issue of correlation, which definitively mean that often SIEM projects become useless because of correlation patterns, which are too complex and not straightforward. This is the reason why the leading vendors are rushing to include an integrated SIEM technology in their product portfolio in order to provide an out-of-the-box correlation engine optimized for their products. The price to pay will probably be a segmentation and verticalization of SIEM Market in which lead vendors will have their own solution (not so optimized for competitor technologies) at the expense of generalist SIEM vendors.
On the other hand APT are alive and kicking, keep on targeting US Defense contractors (Raytheon is the latest) and are also learning to fly though the clouds. Moreover they are also well hidden considered that, according to the Security Intelligence Report Volume 11 issued by Microsoft, less than one per cent of exploits in the first half of 2011 were against zero-day vulnerabilities. The 1% makes the difference! And it is a big difference!
Related articles
- Information, The Next Battlefield (paulsparrows.wordpress.com)
Sony Under Attack… Again
Sony was under cyber attack… Again! The Company reports of unauthorized attempts to verify valid user accounts on Playstation Network, Sony Entertainment Network and Sony Online Entertainment.
Sony states than a total of 93,000 accounts corrsesponding to one tenth of one percent (i.e. 0.1%) of their PSN, SEN and SOE consumers may have been affected (PSN/SEN: approximately 60,000 accounts; SOE: approximately 33,000). In these cases the attempts succeeded in verifying valid sign-in IDs and passwords, so the accounts were temporalily locked. As a preventative measure, Sony will be sending email notifications to these account holders and will be requiring secure password resets or informing consumers of password reset procedures.
At least this time the defense were active and the Company states it was able to stop these attempts taking steps to mitigate the activity, moreover Sony also stated that credit card numbers associated with these accounts are not at risk as a result of the unauthorized attempts.
Curiously:
The attempts appear to include a large amount of data obtained from one or more compromised lists from other companies, sites or sources. These were unauthorized attempts to verify valid user accounts on our services using very large sets of sign-in IDs and passwords. Between October 7 – 10 US Pacific Daylight Time, we confirmed that these were unauthorized attempts, and took steps to thwart this activity.
A couple of hot considerations:
- The Japanese giant learned the lesson. After the infamous breaches of March (with more than 100 million users affected and estimated cost of $21 billion), Sony hired Philip Reitinger (who annouced the attack on Playstation Blog), the former deputy under secretary at the U.S. Department of Homeland Security, as senior vice president and chief information security officer at Sony. The nomination was made on September but is possible that the strategy of establishing a security strategy has already been successful: it looks like the company was able to immediately detect the attack (and also is also immediately sending email notifications to the owners of the compromised accounts);
- I cannot help but notice the strategy of the attack consisting in a “very large sets of sign-In IDs and passwords obtained from on ore more compromised lists of company”. Probably read “spearphishing”: once again old techniques with new motivations. The organizations seems to have learned how to deal with these trhreats. The users are still far from that.
Hope to have more news very soon, most of all which were the compromised lists of companies (Epsilon?).
The FAST And The Furious
Yesterday I stumbled upon a couple of really interesting news published respectively by the Chaos Computer Club, the famous German hacker community, and by CNET, concerning in both cases “new” technologies aimed to fight crime. But if the news published by the CCC is yet another example of alleged Government Malware, that is a spyware built with the purpose to spy and collect evidences on the target’s computers, the news published by CNET sounds incredible and brings our minds to the well-known scenes of Minority Report, where Police used precognition to prevent crime.
In any case, both articles mix information security, privacy and ethics, and raise many concerns about the role of technology to fight crime and its right to cross the boundaries with ethics and privacy
Let us begin from the FAST
FAST (Future Attribute Screening Technology) is the name of a project sponsored by the U.S. Department of Homeland Security which aims to prevent crime using algorithms based on ethnicity gender, breathing and heart rate (At Least no PRECOG so far). FAST seeks to develop behavioral screening technologies that will enable security officials to test the effectiveness of current screening methods at evaluating suspicious behaviors and judging the implications of those behaviors. The ultimate goal of the FAST project is to equip security officials with the tools to rapidly assess potential threats.
According to a June 2010 Document, FAST is already in operation and its test is ongoing on a Planned Limited User Evaluation after an initial test on DHS Employees. For this initial sample of Employees, the system collected video images, audio recordings, and psychophysiological measurements (i.e., heart rate, breathing pattern, thermal activity, and other physiological and behavioral cues). The data were used for Baseline. A field testing has been conducted in an undisclosed location in the Northeast, with a select group of participants on a volunteer basis.
In the latter case several data were collected such as: demographic information (age, gender, occupation, and ethnicity), medical information (heart, circulation, respiratory, and vision issues), current medications, and substance use in the last week (caffeine, tobacco, alcohol, other substances).
The document also states DHS will only have access to aggregated and anonymized data and this was confirmed to CNET by a Homeland Security spokesman.
So definitively, are the criminals really going to be captured by PRECOGs before perpetrating a crime? Not yet! DHS, provided a statement to CNET that said:
The department’s Science and Technology Directorate has conducted preliminary research in operational settings to determine the feasibility of using non-invasive physiological and behavioral sensor technology and observational techniques to detect signs of stress, which are often associated with intent to do harm. The FAST program is only in the preliminary stages of research and there are no plans for acquiring or deploying this type of technology at this time.
And Proceed with the Furious
Maybe German people would be quite furious in this moment, in knowing that they have been possible targets of a (un)lawful interception Malware allegedly crafted by the German Police Force (dubbed “0zapftis”, “Bundestrojaner” or “R2D2″) with the purpose to spy online activity and record Skype internet calls. Its discovery was announced yesterday by the Chaos Computer Club which reversed engineered and analyzed the malware.
The malware, according to its original concept, should have been a light variation of the original “Bundestrojaner” forbidden by the German constitutional court on February 27 2008. Even before this sentence, the German government introduced a less conspicuous variant of the spyware dubbed “Quellen-TKÜ” (the term means “source wiretapping” or lawful interception at the source), whose only purpose, by definition, was to wiretap internet telephony, enforced through “technical and legal” means.
Unfortunately the analysis conducted by CCC has shown that the “Bundestrojaner light” goes much further than its initial concept violating the terms set by the constitutional court and, even worse, according to the analyzers is badly written and lacks the basic security measures (for instance no mutual authentication and poor encryption), so making a malicious third party capable to intercept the captured or use the Trojan to install arbitrary programs or upload arbitrary data on the target’s computer.
This is not the first case of a Government Spyware: Sophos reports about a German state-sponsored cyber-spying in in 2008, when there were claims that German Foreign Intelligence Service deployed spyware to monitor the Ministry of Commerce and Industry in Afghanistan, and almost ten years ago when there were concerns that the FBI would ask anti-virus companies to deliberately not detect spyware that they had written – dubbed “Magic Lantern“. Even a recent occurrence also happened in Italy when, as part of an investigation against a criminal conspiracy, the police injected a spyware into the computer of an individual used to collect evidences of his role inside the conspiracy.
Easily predictable this affair will rise a political storm in Germany. Although it is not clear if it was really written by the German Police, the CCC has informed the German Ministry of the Interior. If it is true that the malware is really capable not only to gather information, but also to upload data or install other programs, it also possible that it could be (or worst has already been) used to build (and gather) artificial evidences against the target (this is the reason of my logical link with the FAST affair).
The boundary between lawful interception and privacy is blurred, maybe is time, for the legislators, to regulate the growing use of spyware for lawful interception and the consequent authorized infiltration of suspects’ computers and their secret hard drives scanning.
Related articles
About The Author
Support My Work!
Share:
News
08/13/2011 - My Post on Android Malware Mentioned on Engadget.
04/14/2011 - The Article Smart Grid: L'ultima Frontiera del Cybercrime published on ICT Security Magazine May 2011.
03/14/2011 - Security Summit 2011: Paolo Passeri guest at Round Table "Mobile Security: Rischi, Tecnologie, Mercato"
02/14/2011 - The Article Gears of Cyberwar published on ICT Security Magazine January 2011.
Visitors from…
