Hackmageddon.com

Botnets, ISPs, and The Role of The Cloud

Paolo Passeri — Thu, 24 May 2012 21:49:12 +0000

One interesting comment on my previous post on Botnets, gave me a cue for another consideration concerning the role of the cloud inside the fight against botnets.

The fact that ISPs are evaluating an Anti Botnet Conduct Code means their are feeling responsible for what resides inside (and leaves) their networks, and hence are supposed to take technical, organizational and educational countermeasures.

Anyway, in order to be effective, anti-bot controls should be enforced inside the customers’ networks, or at least before any source NAT is performed, otherwise IP addresses of the infected machines would be hidden, making impossible to detect and block them directly. A huge task for an ISP unless one were able to centralize the security enforcement point where the traffic is monitored and compromised endpoints members of a bot detected.

Said in few words I believe that ISPs will soon offer advanced anti-malware (read anti-bot) services in the cloud by routing (or better switching) the customer’s traffic on their data centers where it is checked and the customers notifyed in real time about the presence of bots inside their networks. You may think to the same approach used for URL filtering services on the cloud with the difference that in this scenario the clients should arrive to the ISP’s Data Center with their original IP Address or a statically NATed address so that it could always be possible to recognize the original source. Another difference is also that in this scenario the purpose in not only to protect the customers’ networks from the external world but also (and maybe most of all) to protect the external world from the customers’ (dirty) networks.

Another contribution of the cloud against Botnets that I forgot to mention in the original post.

I, BOT (Coming To A C&C Server Near You) (hackmageddon.com)

I, BOT (Coming To A C&C Server Near You)

Paolo Passeri — Tue, 22 May 2012 21:15:42 +0000

Few days ago I have discovered that the City I leave in (Rome), ranks at number two in the World for the number of BOT infections, at least according to Symantec Internet Security Threat Report Edition XVII.

Of course reports must be taken with caution, but it is undoubted that Bot infections are becoming a huge problem for the Information Security Community (a modern Biblical Plague), so huge to deserve the attentions of The Federal Communication Commission. As a matter of fact, on March 2012, FCC, working with communications companies including Verizon, Cox, and Comcast, has passed a voluntary code that delineates the steps that ISPs must take to combat botnets. As you will probably know, botnets may be used by cybercrookers for making money with different criminal purposes ranging from information theft to the execution of DDoS Attacks: have a look to this interview to a botnet operator to have an idea (and to discover that botnets are used also to counterfeit virtual currency).

Such a similar plague is pushing a major change to the traditional security paradigm, a change that can be summarized in few words: if yesterday the refrain for system administrators was “Beware of what enters your network” (so all the security warfare was focused in checking the ingress traffic), today it is becoming: “Beware of what leaves your network“.

This is nothing else than a consequence of the fact that traditional endpoints technologies are proving not to be so effective against Bots, so a new approach, which aims to control the egress traffic generated by compromised endpoints and leaving the organization, is needed. The effectiveness of traditional endpoint technologies is not optimal since new variants (capable of evading antivirus controls) come out much faster than the related signatures developed by vendors: try to have a look at the average antivirus detection rate against Zeus (the god of bots), and you will probably be disappointed in noticing that it is stable at a poor 38%). On the other hand, recognizing the communication patterns at the perimeter is a more profitable strategy, since the different variants generally do not change deeply the communication protocols with the C&C Server (unless a P2P protocol is used, see below).

The strategy to mitigate botnets relies on the fact that each botnet has (in theory) a single point of failure: it is the C&C Server to which Cyber Hunters and Law Enforcement Agencies address their takeover attempts to take them down definitively or to turn them into sinkholes for studying the exact morphology and extension of the infection). Depending on the botnet configuration, each infected endpoint polls the C&C server for new instructions at a given time interval and that is the point of the process in which good guys may act: detecting (and blocking) that traffic allows to identify infected machines (and my experience indicate that too often those machines are equipped with an updated and blind antivirus).

For the chronicle the C&C Server is only a theoretical single point of failure since C&C Servers are generally highly volatile and dynamic so it is not so easy to intercept and block them (the only way to take down a botnet), hence in my opinion, it should be more correct to say that a botnet has has many single points of failure (an information security oxymoron!).

As if not enough, in order to make life harder for good guys, the next generation botnets are deploying P2P protocols for decentralizing the C&C function and make their takedown even tougher.

But good guys have a further weapon in this cat and mouse game: the cloud intelligence. Even if I am not a cloud enthusiast, I must confess that this technology is proving to be a crucial element to thwart botnets since it allows to collect real time information about new threats and to centralize the “intelligence” needed to dynamically (and quickly) classify them. Real time information is collected directly from the enforcement points placed at the perimeter, which analyze the egress traffic from an organization containing compromised machines. Of course after the successful analysis and classification, the new patterns may be shared among the enforcement points all over the five continents in order to provide real time detection (and hence protection) against new threats. This approach is clearly much more efficient than an endpoint based enforcement (which would need to share the information among a larger amount of devices), provided the enforcement point are positioned adequately, that is they are capable to monitor all the egress traffic.

The combination of the analysis of egress traffic and cloud intelligence is a good starting points for mitigating the botnet effects (for sure it is necessary to identify infected machines) but, as usual, do not forget that the user is the first barrier so a good level of education is a key factor together with consolidated processes and procedures to handle the infections.

1-15 May 2012 Cyber Attacks Statistics

Paolo Passeri — Sun, 20 May 2012 14:14:37 +0000

As I did in the last month, I have summarized the data collected in my Cyber Attacks Sample for the first half of May, (whose thumbnail is on the right), in order to provide some aggregated statistics. Collected Data have been summarized in three charts representing: Motivations Behind Attacks, Distribution of Targets and Distribution of Attack Techniques. Although the 60 attacks sample does not intend to be comprehensive (and hence the results must be taken with caution), the charts provide a quick overview, which in turn might be useful to identify trends and hopefully to address countermeasures. Apparently the trend is quite (un)stable with Cyber Crime, ranking at number one as the primary motivation for the attacks, and Governments that continue to be the preferred targets for cybercrookers.

As far as Motivations Behind Attacks are concerned, once again Cyber Crime ranks at number one with nearly the 70% of occurrences. Hacktivism is well behind with “only” the 23% followed by Cyber Warfare and Cyber Espionage that triggered singularly the 10% of attacks. If compared with April, the trend shows a growth of Cyber Crime and a corresponding reduction of hacktivism. As far as Cyber Espionage is concerned, particularly interesting om this month have been the Attack to U.K. Ministry Of Defence and to some undisclosed U.S. Natural Gas Companies.

The Distribution of Targets chart confirms that Governments continue to be the preferred targets for Cyber Criminals and Hacktivists with nearly one third (30%) of occurrences. With respect to April, targets belonging to educational sector have gained one position ranking at number two with the 15% of occurrences and before the LEAs which shifted at the third place with the 7% of occurrences. If we sum up military targets to LEAs we have the 12%. In any case the trend is in line with the previous month.

SQL Injection is the number one among Attack Techniques, with the 36% of occurrences taking over, at least in the first two weeks of may, Distributed Denial Of Service, that ranks at number two with the 18%. Summing up the “conclamated” SQLi Attacks with the “uncertain” SQLi Attacks, leads to the surprising result that nearly one attack on two (46%) has been performed exploiting this kind of vulnerability. So definitively run and patch your applications!

If you want to have an idea of how fragile our data are inside the cyberspace, have a look at the timelines of the main Cyber Attacks in 2011 and 2012 (regularly updated), and follow @paulsparrows on Twitter for the latest updates. Also feel free to submit at ppasseri@gmail.com details about Cyber attacks in order to make the timelines even more detailed and meaningful.

April 2012 Cyber Attacks Statistics (hackmageddon.com)
May 2012 Cyber Attacks Timeline (Part I) (hackmageddon.com)

May 2012 Cyber Attacks Timeline (Part I)

Paolo Passeri — Thu, 17 May 2012 12:24:32 +0000

As usual here it is the timeline of the Main Cyber Attacks occurred in May (at least according to my evaluation criteria).

This first half of the month has seen the arrival of a new hacking collective, “The Unknowns”, who has performed an impressive trail of attacks during the first days of May, targeting Space Agencies, Universities, and several other organizations. Although these events appear to be closer to cyber crime actions rather than hactivistim-driven attacks, they have not been the most remarkable ones of these days: as a matter of fact chronicles report of a massive breach at the Hangzhou Dianzi University, targeting approximately 150.000 acccounts.

As far as hacktivism is concerned, this first half of May has confirmed the constant trend of DDoS attacks targeting high profile websites such as SOCA and CIA (once again) and the Supreme Court in retaliation for the U.K. extradition laws.

Interesting to mention is also an alleged Cyber Espionage campaign targeting networks belonging to US natural gas pipeline companies.

April Cyber Attacks Timeline (Part II) (hackmageddon.com)
April 2012 Cyber Attacks Statistics (hackmageddon.com)
April 2012 Cyber Attacks Timeline (Part I) (hackmageddon.com)

A New Beginning For The Middle East Cyberwar?

Paolo Passeri — Thu, 17 May 2012 07:19:46 +0000

After several months of silence, a new resounding dump in Middle East.

I have just received an email message from you-r!-k@n, one of the early pro-Israeli contenders of the Middle East Cyber War, advising me of a new huge dump against an Iranian Server (irimo.ir, Iranian Meteorological Organization), which is currently unavailable. He claims to have acquired administrator privileges for the domain (1500 computers and server, 400 users), and has posted some screenshot as evidence, and the list of 400 Active Directory Users.

Of course I have decided not to publish the list except a small sample (which appears to come from a Windows 2000 Server), but cannot help but notice that, after a couple of months of silence, this is the first new event that closely resembles the resounding dumps which characterized the very first stage of the Middle East Cyber War.

Will this be an isolated episode or a brand new precursor of a new wave of attacks in the Middle East?

Update: Irimo.ir is currently unavailable, however, I was given a screenshot of the site before it was taken down. Looking at the messages left on the devastated site (which announced the erase of the Active Directory), it is interesting to notice that the reference to the Nuclerar as to reaffirm that the standoff between Israel and Iran about the Nuclear Strategy of Tehran, is influencing also the Cyber Space.

Beware Of Linkedin Scams

Paolo Passeri — Fri, 11 May 2012 11:52:55 +0000

You know, social media have become the last fronteer of spam and and scam. Yesterday I received a strange message from an unkown (i.e. non-existant, at least when I checked) LinkedIn Profile, inviting me to message my email address for a purpotred “undervalued $tock bid”. In this hard times the perpsective of easy money sounds appealing but…

…Always remember that LinkedIn is particularly attractive for cybercrookers since contacts have a bigger level of trust and confidence and the victims are lead to lower the barreers of mistrust (the human firewall).

Anyway, in case of suspect messages from LinkedIn always check the LinkedIn Checkbox (in this case, needless to say, the message was not listed, nor was the linkedin profile existant).

April 2012 Cyber Attacks Statistics

Paolo Passeri — Sun, 06 May 2012 14:58:27 +0000

I have aggregated the data collected related to cyber attacks occurred in April 2012 (that you may find in the links on the right) in order to provide a consolidated view for the month. The statistics have been taken according to three parameters: Motivations Behind Attacks, Distribution of Targets and Distribution of Attack Techniques. Of course the information does not pretend to be exhaustive, in any case it is useful to provide a snapshot on the cyber landscape of the last month.

As far as the Motivations Behind Attacks are concerned, Cyber Crime ranks undoubtedly at number one with the 51% of the occurrences. Hacktivism is at number two with “only” the 39% of the occurrences. Other motivations such as Cyber Warfare or Cyber Espionage are far behind with respectively the 7 and 2 percent. This is not a surprise since attacks motivated by Cyber Espionage should be supposed to be subtle and hidden and this explains their rank (unlike the attacks motivated by hacktivism that use to attract the greatest attention by media).

As far as the Distribution Of Targets is concerned, Governements keep on to be preferred targets, with nearly one third of the occurrences. Law Enforcement Agencies rank at number two with 9% immediately followed by Educational Institutions with 7%. Online Platforms such as Online Games or other kind of platforms (such as email services) are behind with the 6% of occurrences for both of them. Of course the high position for governments and LEAs is quite simple to explain: both categories are the preferred targets for hactkivists.

A month characterized by Distributed Denial of Service, at least according to the Distribution of Attack Techniques chart. SQL Injection ranks at number two, immediately followed by Defacement. If we sum up also the indirect occurrences of SQLi (that is those cases whose symptoms seem the ones proper of SQLi but no direct evidences were found) the distribution of the two techniques is nearly the same (respectively 29% for DDoS and 27% for SQLi). Of course DDoS is the preferedd cyber weapon for hacktivists and this explain its dominion on this unwelcomed chart.

April Cyber Attacks Timeline (Part II) (hackmageddon.com)
April Cyber Attacks Timenile (Part I) (hackmageddon.com)

April 2012 Cyber Attacks Timeline (Part II)

Paolo Passeri — Thu, 03 May 2012 13:34:41 +0000

Here the first part covering the cyber attacks from 1 to 15 April.

April is over and here it is the second half of the Cyber Attacks Timeline covering the time period spanning from 16 to 30 april 2012.

The last two weeks of this month have been characterized by several remarkable events (at least for the newspapers), such as the #OpBahrain which unleashed a trail of attacks from the Anonymous against websites related to the Formula 1 GP in Bahrain. Other noticeable events triggered by hacktivism include several DDoS attacks against CIA, MI6, Department of Justice, and a couple of Law Enforcement Agencies which continue to be a preferred target for hackers.

On the Cyber Crime front (still the major apparent motivation for the attacks) this month reports, among the events, a breach to Nissan and other DDoS attacks against the District of Columbia, the State of Washington and Nasdaq (I would not define them just motivated by hacktivism). Other events include a couple of 0-day vulnerabilities targeting popular e-mail services and affecting potentially million of users.

Last but not least, April has brought a new cyber attack to Iran crude oil industry, despite, so far, there are no clear evidences of a new Stuxnet-like Cyber Attack. This is not the only episode targeting Iran which also suffered 3 million of banks accounts compromised.

For the chronicle I decided to insert in the timeline also the breach to the game publisher Cryptic Studios. Although it happened in 2010 (sic) it was discovered only few days ago…

Philippines and China, on The Edge of a New Cyber Conflict?

Paolo Passeri — Tue, 01 May 2012 17:10:29 +0000

05/11/12: Updated timeline. The tension between Philippines and China escalates and new cyber attacks target both sides.

The month of April has suddenly revealed a new unexpected Cyber Conflict between two very different countries: Philippines and China.

Of course the Chinese Cyber Activity is not that surprising, differently from the Philippines which had not shown any bellicose intention in the Cyber Domain. At least until these days when the cyber peace between the two countries has been broken because of a dispute concerning the sovereignty on the Scarborough Shoal and the Spratly Islands claimed from both countries. As often happens, the dispute has crossed the boundaries between the real and the cyber worlds and has hence unleashed an endless and unexpected trail of mutual cyber attacks.

According to Roy Espiritu, spokesman of the government’s information technology office, all the attacks came after Philippine ships faced off with Chinese patrol vessels in April 8 in the disputed Scarborough Shoal in the South China Sea. Before that, there had been no such eventsm at least until April 2o, when some hackers, identifying themselves as Chinese, attacked to the University of the Philippines. In that circumstance they defaced the UP website (up.edu.ph) with a map, labeled with Chinese characters, showing the Scarborough Shoal (Panatag as called by the Philippines and Huangyan by China).

Needless to say, the latter episode has started an endless line of mutual attacks that are still continuing despite the calls to end the attacks from Manila.

Will the cyber conflict be limited to “simple” defacements, or will it take the shape of the first phase of the Middle East Cyber War when both parties faced themselves leaking credit card details of innocent individuals? Moreover, are critical infrastructure really in danger as suggested by Filipino IT professionals?

Based on the current events, maybe this latter scenario is exaggerated, in any case once again, the upsetting evidence shows that the Cyber World has become a consolidated further battlefield for the disputes inflicting the real world.

If you want to have an idea of how fragile is the equlibrium inside the cyberspace, have a look at the timelines of the main Cyber Attacks in 2011 and 2012 (regularly updated), and follow @paulsparrows on Twitter for the latest updates.

1.http://www.philstar.com/nation/article.aspx?publicationsubcategoryid=200&articleid=798961

2.http://www.gmanetwork.com/news/story/255765/scitech/technology/pinoy-hackers-strike-back-at-china-websites-up-site-restored

3.http://www.abs-cbnnews.com/nation/04/22/12/palace-calls-restraint-amid-cyber-attacks-between-ph-china

4.http://www.gmanetwork.com/news/story/255935/scitech/technology/palace-websites-targeted-by-suspected-chinese-hackers

5.http://www.abs-cbnnews.com/-depth/04/24/12/pinoy-hackers-strike-back-china-websites

6.http://www.abs-cbnnews.com/-depth/04/25/12/chinese-hackers-target-more-ph-websites

7.http://www.gmanetwork.com/news/story/256173/scitech/technology/dbm-site-defaced-other-govt-sites-down

8.http://www.gmanetwork.com/news/story/256140/scitech/technology/phl-govt-doesnt-condone-hacking-of-chinese-websites-says-dost

9.http://www.abs-cbnnews.com/nation/04/26/12/more-chinese-websites-hacked

10.http://www.abs-cbnnews.com/-depth/04/30/12/hackers-continue-attacks-china-websites

11.http://www.abs-cbnnews.com/-depth/05/03/12/pentagon-help-philippines-vs-hackers

12.http://www.abs-cbnnews.com/nation/05/04/12/philippine-stars-website-hacked

13.http://www.journal.com.ph/index.php/news/top-stories/29326-end-to-cyber-attacks-called

14.http://www.abs-cbnnews.com/-depth/05/10/12/hackers-join-may-11-protests-against-china

Law Enforcement Agencies Under Attack… Again

Paolo Passeri — Sat, 28 Apr 2012 17:26:18 +0000

A Friday back in time… The last weekend of April has reserved a bitter surprise for two Law Enforcement Agencies which suffered an equal number of attacks from Hackers affiliated to Anonymous.

For a moment I was believing to have gone a couple of months back in time, with the calendar set in the first half of February when @ItsKahuna and @CabinCr3w put in place a long trail of attacks against Law Enforcement Agencies. (Un)Fortunately they left several cyber fingerprints in the crime scene which allowed the LEAs to take their revenge and stop the long line of attacks.

Today, nearly in contemporary, the IPA, International Police Association (ipa-iac.org) has been defaced “for the lulz” and the same fate, with more serious consequences, has happened to Lake County Sheriff’s Office (LCSO.org). In the latter circumstance it looks like the attackers were able to leak 40 Gigabytes of internal files.

Despite the number of attacks suffered (and the consequent arrests made) Law Enforcement Agencies continue to be vulnerable and, even worse, the techniques used and the exploited vulnerabilities are apparently always the same.

Hackmageddon.com

Botnets, ISPs, and The Role of The Cloud

Related articles

I, BOT (Coming To A C&C Server Near You)

1-15 May 2012 Cyber Attacks Statistics

Related articles

May 2012 Cyber Attacks Timeline (Part I)

Related articles

A New Beginning For The Middle East Cyberwar?

Beware Of Linkedin Scams

April 2012 Cyber Attacks Statistics

Related articles

April 2012 Cyber Attacks Timeline (Part II)

Philippines and China, on The Edge of a New Cyber Conflict?

Law Enforcement Agencies Under Attack… Again