About these ads


Posts Tagged ‘Advanced Persistent Threat’

One Year Of Lulz (Part I)

December 15, 2011 2 comments

Update December 26: 2011 is nearly gone and hence, here it is One Year Of Lulz (Part II)

This month I am a little late for the December Cyber Attacks Timeline. In the meantime, I decided to collect on a single table the main Cyber Attacks for this unforgettable year.

In this post I cover the first half (more or less), ranging from January to July 2011. This period has seen the infamous RSA Breach, the huge Sony and Epsilon breaches, the rise and fall of the LulzSec Group and the beginning of the hot summer of Anonymous agsainst the Law Enforcement Agencies and Cyber Contractors. Korea was also affected by a huge breach. The total cost of all the breaches occurred inthis period (computed with Ponemon Institute’s estimates according to which the cost of a single record is around 214$) is more than 25 billion USD.

As usual after the page break you find all the references.

Read more…

About these ads

November 2011 Cyber Attacks Timeline (Part II)

November 30, 2011 Leave a comment

The second half of November has confirmed the trend seen in the previous report covering the first half of the month. The period under examination has confirmed a remarkable increase in Cyber Attacks from both a quality and quantity perspective.

Although the month has been characterized by many small attacks, several remarkable events have really made the difference.

Among the victims of the month, Finland deserves a special mention in this unenviable rank: the second half of the month has confirmed the emerging trend for this country, which suffered in this period two further breaches of huge amounts of personal data, for a global cumulative cost, computed on the whole month, around $25 million.

But Finland was not the only northern European country hit by cybercrookers (maybe the term cyberprofessionals would be more appropriate): Norwegian systems associated with the country’s oil, gas and energy sectors were hit with an APT based cyber attack resulting in a loss of sensitive information including documents, drawings, user names and passwords.

But once again the crown of the most remarkable breach of the month is placed upon the head of South Korea which suffered another huge data dump affecting users of the popular MMORPG “Maple Story” affecting theoretically 13 million of users, nearly the 27% of the Korean population, for an estimated cost of the breach close to $2.8 billion.

The list of affected countries this month includes also 243,089 Nigerian users, victims of the hack of Naijaloaded, a popular forum.

Microsoft has been another victim in this November, with a phishing scam targeting Xbox Live users. Details of the scam are not clear, although each single affected user in U.K. might have lost something between £100 and £200 for a total cost of the breach assimilable to “million of Pounds”.

November will make history for showing for the first time to information security professionals the dangers hidden inside the SCADA universe (and not related to Nuclear Reactors). The echo of Stuxnet and Duqu is still alive, but this month was the the turn of SCADA water pumps, that have suffered a couple of attacks (Springfield and South Houston), the first one allegedly originated from Russia and the second one from a “lonely ranger” who considered the answer from DHS concerning the first incident, too soft and not enough satisfactory. My sixth sense (and one half) tells me that we will need to get more and more used to attacks against SCADA driven facilities.

The Anonymous continued their operations against governments with a brand new occurrence of their Friday Releases, targeting a Special Agent of the CA Department and leaking something like 38,000 emails. Besides from other some sparse “small” operations, the other remarkable action performed by the Anonymous collective involved the hacking of an United Nations (old?) server, that caused personal data of some personnel to be released on the Internet.

November Special mentions are dedicated (for opposite reasons) to HP and AT&T. HP for the issue on their printers discovered by a group of Researchers of Columbia Univerity, which could allow a malicious user to remotely control (and burn) them. AT&T deserved the special mention for the attack, unsuccessful, against the 1% of its 100 million wireless accounts customer base.

In any case, counting also the “minor” attacks of the month, the chart shows a real emergency for data protection issues: schools, e-commerce sites, TVs, government sites, etc. are increasingly becoming targets. Administrators do not show the deserved attention to data protection and maybe also the users are loosing the real perception of how much important is the safeguard of their personal information and how serious the aftermaths of a compromise are.

As usual, references for each single cyber attack are reported below. Have a (nice?) read and most of alle share among your acquaintances the awareness that everyone is virtually at risk.

Related articles

Read more…

Categories: Cyber Attacks Timeline, Security Tags: , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , ,

Moving Security Model From Content To Context

November 27, 2011 1 comment

In these days I visited several customers to talk about technology trends for 2012. With the occasion I decided to collect all the articles written in my blog concerning Advanced Persistent Threats and Related Technologies in a single, very short, presentation, and consequently uploaded it to SlideShare. Feel free to give it a look as a reference. My perception is that next year we will often hear talking about APTs and NG-IPS (and, more in general, about context-aware security Technologies).


Advanced Persistent Threats and Human Errors

November 20, 2011 1 comment

In these days many people are asking me what they can do to stop an Advanced Persistent Threat. Although security firms are running fast to develop new technologies to thwart these attack vectors (sophisticated SIEMs and a new breed of network security devices, the so called Next Generation IPSs), unfortunately I am afraid the answer is not so easy. I might spend thousands of words to figure out the answer, but I would not be able to give a better representation than this cartoon I found a couple of days ago in the Imperva Blog.

Intentional or unintentional the human error is always the first vector an Advanced Persistent Threat exploits to enter the organization: as a matter of fact all the APT attacks recorded in 2011 (and unluckily examples abound in the news), have a point in common: the initial gate which allowed the attack to enter, that is the user.

The last resounding example is not an exception to this rule: on Friday November, the 17th Norway’s National Security Authority (NSM) confirmed that systems associated with the country’s oil, gas, and energy sectors were hit with a cyber attack, resulting in a loss of sensitive information. If we look at the information available for this attack, it is really easy to find all the ingredients of a typical APT Attack: virus spread via malware-infected emails sent to “selected individuals”, sophisticated malware designed to avoid detection by anti-virus solutions, and, last but not least, sophisticated malware designed to steal information from the victim’s computer: documents, drawings, username and password.

So at the end which is the key to face an APT, before the technology itself is able to catch it? The answer (and the technology) spins around the user which is the first firewall, IPS, anomaly detector, who can stop an APT. Of course exactly like security devices must be configured to stop the intrusion attempts, analogously users must be configured educated not to accept virtual candies from strangers, hence acting as unintentional gates for the threats to enter the organizations. This often happens because of shallow behaviors or also because of behaviors in clear contrast with the internal policy (yes the infamous AUP). I use to say that security is a mindset, quite similar to distrust: you have it since you are naturally born with it, or you may simply be educated to embrace it.

Keep in mind the central role of the user inside the security process since 2012 will be the year of APTs… Would you ever buy (and heavily pay) an armored door for your home and give the key to people you do not trust?

October 2011 Cyber Attacks Timeline (Part I)

October 16, 2011 2 comments

October has come and here it is, also for this month, the first part of my Cyber Attacks Timeline covering the cyber events occurred in the first half of the current month.

Three events in particular have marked this month: The German Trojan R2-D2 (that is raising many questions and concerns inside the infosec community), the keylogger hitting U.S. Drones and a new cyber attack to Sony involving this time “only” 93,000 accounts (oops! They did it again).

Except for a couple of isolated occurrences (in Austria and UK), the Cyber Attacks by Anonymous and Antisec had a break, maybe because hacktivism efforts are being focused on the #OccupyWallStreet operation that is rapidly spreading all over the World (I wonder why in here in Rome yesterday it has not been possible to have peaceful protests as happened in all the other Capitals). Besides, albeit not directly related with Anonymous, several Syrian log files were leaked showing the control of the Government on the Internet.

Other events of the month: a couple of fashion related websites were hacked, the Cyber-Guerrilla between India and Pakistan was particularly active with the cyber armies of the two nations facing themselves in the cyber space with continual mutual defacements, @SwichSmoke was also particularly active against Venezuela Government Web Sites. Other “minor” leaks were performed by @FailRoot and @ThEhAcKeR12 but one of the victims of the latter was Camber Corporation, an U.S. Contractor.

Anyway, Camber Corporation was not the only targeted Contractor, also Raytheon Corporation (a survivor of the RSA Breach) was targeted with a cloud based spear-phishing campaign, again the attack was thwarted but, in my opinion, has deserved a mention as well. Chronicles also reports of a claimed hack to Infragard (again).

Moreover the aftermaths of the RSA breach are not completely over: this month the security firm’s CEO claimed that a couple of different Cyber Crews, under the flag of an enemy nation (and the suspects were immediately directed to China), are behind the Cyber Attack in March and acted to perform it.

But a very special mention for this month (and the consequent lowly desiderable prize), is undoubtedly deserved by Mr. Oliver Letwin, Her Majesty’s Cabinet Minister, who was caught by The Daily Mirror  in the habit of dumping private correspondence and sensitive documents detailing Al-Qaeda activities and secret service operations into park bins in St James’s Park, Westminster, close to Downing Street. Security, logical and physical, may have many unpredictable implications…

From a technical point of view SQLi and defacements were the most used lethal weapons for this month, even if a massive ASP.NET based attack, targeting 300,000 web sites,  is also worth mentioning.

This Timeline was compiled with Useful Resources by:

And my inclusion criteria do not take into consideration simple defacement attacks (unless they are particularly resounding) or small data leaks.

Last but not least: you may find all the timelines for 2011 in my Master Index. Enjoy the list(s) and share and retweet to encourage me to keep it up2date!

Date Author Description Organization Attack
Oct 1 Neatstuffs


NeatStuffs hacks filmradar.com a movie review and information site/community and releases on Mediafire a 6mb txt file containing 95167 accounts with hashed passwords. Estimated cost of the breach is $ 20,365,738.

Oct 2
Venezuela National Statistics Institute

SwichSmoke crew hacks the Venezuela National Statistics Insitute during the 2011 Census.

Oct 2

Camber Corporation (US Contractor)

Once again a US Government contractor is target of cyber crime. This time is the turn of Camber Corporation, targeted by a small hack by @ThEhAcKeR12, which releases 3 admin accounts with encrypted passwords. and admin full name.

Oct 2


Again @ThEhAcKeR12, this time the crew dumps 1500+ accounts (in encrypted format) and a database from wrestlegame.co.uk. Estimated cost of the breach is around $321,000.

wrestlegame SQLi?
Oct 2
A student arrested few days later
Thailand Prime Minister

Thailand’s Prime Minister, Yingluck Shinawatra, had her Twitter account hacked flooding her followers with a stream of messages criticising her leadership with statements like this: The final post read: “If she can’t even protect her own Twitter account, how can she protect the country?

Account Hacking
Oct 4 Austrian Economy Chamber (WKO)

WKO confirms that its webserver was infiltrated by unidentified cyber criminals. More than 6,000 data sets of customers of the chamber were published on the internet. Although Anonymous Austria leaked the data, they stressed they had not carried out the attack on WKO themselves, but had been provided with the records by someone else, adding that the security leak was exposed by using online search engine Google. Estimated cost of the Breach is around $1,284,000.

  Vulnerability on The Target Platform
Oct 5


@ThEhAcKeR12 does not stop here and dumps 3300 accounts from funniestvideosonline.com and are all encrypted passwords. Estimated cost of the Breach is around $706,200.

Oct 5 www.xvidonline.com

@FailRoot hacks and leaks  several accounts from www.xvidonline.com putting the websits offline.

xvidonline.com SQLi?
Oct 5 Optik Fiber Gmail (Claimed)

Optik Fiber releases several gmail accounts claimed to have been hacked via a known security flaw in gmail. It is not sure if this is real or not but it is meaningful as well of the global level of (in)security, real or psychological.

Known Security Flaw in Gmail (N/A)
Oct 5 ? Fashion TV India

Unknown hackers hacks Fashion TV India with the injection tool havij and obtain a list of accounts dumping usernames and passwords in clear text.

SQLi via havij
Oct 6
Syrian Internet Log Files

Internet activists from Telecomix release 54 GB of log files allegedly created by Syrian internet censors between 22 July and 5 August 2011. The data were found on a third party server.

Oct 7


An Australian University website that lists jobs is hacked by @BlackHatGhosts and has data dumped, included user logins and passwords.

Oct 7 Several Hackers

Department of Public Enterprises South Africa

Department of Public Enterprises, south Africa is hacked and had its database dumped

Oct 7 Same authors above

Ministry of Culture and Tourism, Republic of Indonesia

Another day, another government website hacked, (and its data leaked).

Indonesia SQLi
Oct 7  ? University Of Georgia

The University of Georgia discovers a data file on a publicly available Web server that contained sensitive personnel information on 18,931 members of the faculty and staff employed at the institution in 2002. The file included the social security number, name, date of birth, date of employment, sex, race, home phone number and home address of individuals employed at UGA in 2002. Estimatec Cost of the Breach is around $4,051,234.

Internal Accidental Error
Oct 8 ?
U.S. Military Drones

Wired reports that a computer virus has infected Predator drones and Reaper drones, logging pilots’ keystroke during their fly missions over Afghanistan and other warzones. The virus was detected nearly two weeks ago at the Ground Control System (GCS) at Creech Air Force Base in Nevada and has not prevented drones from flying their missions, showing an unexpected strength so that multiple efforts were necessary to remove it from Creech’s computers.

USB Stick?
Oct 8 German law Author. and Customs Dep.
German Citizens

A very strange (un)lawful Cyber Attack, against German Citizens. Chaos Computer Club discloses a “state malware”: a backdoor Trojan horse capable of spying on online activity and recording Skype internet calls. They declare the malware is used by the German police force. The malware was allegedly installed onto the computer as it passed through customs control at Munich Airport.

Germany Flag
Troian Horse
Oct 9 Turkish Energy Team
Several Government Websites

Turkish Energy Team performs (and keeps on to perform) a massive defacement against several governments websites (in certain cases some sub domains). The list (in continuous growth) is published on Zone-H.

Other Government Websites

Different Crew, same result: a massive defacement against several governments websites. Also in this case the list (in continuous growth) is published on Zone-H.

Defaced Domains 2 Defacement
Oct 9

Another Web site hosting company defaced: this time it is the turn of justonehost.com that is hacked by @FailRoot, that also dumps its Database online. The leak contains all users informations, emails, paypals and much more is 11.86mb and has been uploaded to megaupload.

Defacement SQLi
Oct 10

Congress of the State of Chihuahua

Another government website hit and leaked by @FailRoot: Congress of the state of Chihuahua Mexico. The leak contains administration usernames and (easy guessable) passwords.

Congreso del Estado de Chihuahua SQLi?
Oct 10 Q!sR QaTaR

Turkish Government Websites

A cybercriminal from Quatar defaces a large number of websites belonging to the Ankara government, leaving them non-operational.

Oct 10

40 Zimbabwe Government Websites

A crew called ISCN hacks and defaces 40 Zimbabwe government based websites leaving a polical message.

Zimbabwe Defacement
Oct 10

UKGraffiti is hacked by Anonymous_DR (Anonymous Dominicana) who also dumps usernames, emails and encrypted passwords.

Oct 11 ?

RSA reveals that it believes two groups, working on behalf of a single nation state, hacked into its servers during the infamous Breach of March and stole information related to the company’s SecurID two-factor authentication products used to attack some defense contractors. Although people are likely to assume that China might have been involved in the attack, they did not reveal the name of the nation involved.

Oct 11 ?
Sony (Playstation Network, Sony Entertainment Network and Sony Online Entertainment)

Back tho the future! Sony under cyber attack… Again! The Company reports of unauthorized attempts to verify valid user accounts on Playstation Network, Sony Entertainment Network and Sony Online Entertainment. A total of 93,000 accounts have been affected (PSN/SEN: approximately 60,000 accounts; SOE: approximately 33,000). In these cases the attempts succeeded in verifying valid sign-in IDs and passwords, so the accounts were temporalily locked.

Oct 11 ?

Unknown Hackers hack the European property Dealers website blueHOMES.com . About 500,000 Users data claim to be hacked including database with customer passwords in plaintext, full addresses, skype account, and mailboxes of bluehomes. Specified data leaked on pastebin with sample data of some users.

Oct 11 ?

Another website hit by Havij. This time is the turn of Find2Trade, an internet portal whose goal is to help small and medium enterprises to reach much higher profits while reducing costs. UserID, email and passwords, which are encrypted, were leaked.

Oct 12 ?

The U.S. Defense Contractor reveals that it was the victim of a cloud-based attack for the first time, with the incident occurring one week before. Nothing new but the fact that this was the first cloud based attack. The firm usually blocks 1.2 billion attacks a day in addition to four million spam emails each day.

Oct 12 ? WineHQ

Another Linux Project hacked! Jeremy White, Codeweavers Founder announces that access to the WineHQ database has been compromised. It looks like attackers have used phpMyAdmin to access the WineHQ project’s database and harvest users’ appdb and bugzilla access credentials.

Oct 13 ?
300,000 Websites

Google reveals another mass infection which affected hundreds of thousands of sites that relied on ASP or ASP.NET: A malicious script got injected into several locations targeting English, German, French and other language speakers surfers.

Asp.Net ASP Vulnerability
Oct 13 ?

The biotechnology company suffered a data breach on August, 17 which may have resulted in the theft of information belonging to 3,500 of the million patients who utilize the company’s support programs. Estimated Cost of The Breach is around $750,000

Unlegitimate Access
Oct 14 ?
Chili’s Grill & Bar Restaurant

Ok a Chili Breach is not a big deal, except the fact that the computer server Hackers broke into, is placed at Yokosuka Naval Base. According to Navy officials, hackers stole credit card information and run up erroneous charges.

Credit Card Thieft
Oct 14 ?
Fedora Project

This is not a direct cyber attack but a consequence of the hacks to Linux projects (Kernel.org and Linux). ThreatPost reveals that Fedora Project contacted users to change their password and SSH public key before November 30 to avoid having their accounts marked as inactive.

Fedora Logo N/A
Oct 14
Barinas State, Venezuela

Another dump of sites from @SwichSmoke coming from the state “Barinas” and the government for that state. The release note, in Spanish states that the original password is 123456, fairly lame for a government website.

Barinas SQLi
Oct 14 Vicky Singh
Pakistan Embassy in China

Another episode of the Cyberware between Pakistan and Indian Crew: Vicky Singh defaces the Pakistan Embassy in China.

Oct 14 Team Dexter

An European Content Management System provider is hacked and has a dump of administration details leaked online.

Oct 14 Oct 15 Several Authors
Club Music CPPS

Club Music CPPS is hacked: the leak contains account emails, usernames and decrypted passwords. Note: on Oct 16 the site is still defaced :(

SQLi Defacement
Oct 14
Venezuela National Graduate Advisory Council

Another cyber attack by @SwichSmoke, this time they leak the Venezuela National Graduate Advisory Council and release the leaked data on pastebin.

Oct 14 ?
Infragard Atlanta (claimed)

It seems that Infragrad has been hacked again and had a dump of accounts leaked and decrypted even if there is no source or reason or even proof that this is 100% real in anyway. Anyway it still shows that Infragard is still in the eyes of some people. The alleged leak contains emails, usernames, encrypted passwords and the decryption of the password as well.

Infragard N/A
Oct 14 ?
NSEC (Netaji Subhash Engineering College)

The Netaji Subhash Engineering College NSEC is hacked and has a fair amount of member accounts dumped on pastebin. This comes from an unknown source and unknown reasons. The leak contains full user information, emails and passwords in clear text.

Oct 14

Chinese Government

Barbaros-DZ hacks over 1,700 sites belonging to the Chinese Government defacing them and leaving a message against the Goverment itself. THe list of the sites is available on Zone-H.

Oct 14

UK Government

Special mention this month for Her Mayesty’s Cabinet Minister Oliver Letwin, who has got himself into hot water, after The Daily Mirror reported him in the habit of dumping private correspondence and sensitive documents detailing Al-Qaeda activities and secret service operations into park bins in St James’s Park, Westminster, close to Downing Street. The documents contained the personal details of the minister’s constituents, including names, phone numbers, email contacts and postal addresses.

UK Flag Defacement
Oct 15 SA3D HaCk3D
16,000+ websites

SA3D HaCk3D shows on Zone-H the results of his work of the past years: a total of 16,000+ websites defaced.

SA3D HaCk3D Defacement
Oct 15 p0xy

For an alleged personal revenge, a hacker called p0xy leaks usernames, emails and hashed passwords from the iCPPS online platform.

icpps SQLi
Oct 15 iolaka
World Miss Photogenic

This time is the turn of a fashion/model based website, which is attacked and suffers a dump of accounts leaked containing 1000+ accounts including usernames, emails and encrypted passwords by iolaka.

Oct 15
India Cyber Crime Investigation Cell

Another episode of the Cyber-Guerrilla between India and Pakistan: Pakistani hacker Shadow008 hacks and defaces India’s Most Important website of Cyber cell located at Mumbai.

Categories: Cyber Attacks Timeline, Cyberwar, Security Tags: , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , ,

Advanced Persistent Threats and Security Information Management

October 13, 2011 3 comments

Advanced Persistent Threats are probably the most remarkable events for Information Security in 2011 since they are redefining the infosec landscape from both technology and market perspective.

I consider the recent shopping in the SIEM arena made by IBM and McAfee a sign of the times and a demonstration of this trend. This is not a coincidence: as a matter of fact the only way to stop an APT before it reaches its goal (the Organization data), is an accurate analysis and correlation of data collected by security devices. An APT attack deploys different stages with different tactics, different techniques and different timeframes, which moreover affect different portion of the infrastructure. As a consequence an holistic view and an holistic information management are needed in order to correlate pieces of information spread in different pieces of the networks and collected by different, somewhat heterogeneous and apparently unrelated, security devices.

Consider for instance the typical cycle of an attack carried on by an APT:

Of course the picture does not take into consideration the user, which is the greatest vulnerability (but unfortunately an user does not generate logs except in a verbal format not so easy to analyze for a SIEM). Moreover the model should be multiplied for the numbers of victims since it is “unlikely” that such a similar attack could be performed on a single user at a time.

At the end, however, it is clear that an APT affects different components of the information security infrastructure at different times with different threat vectors:

  • Usually stage 1 of an APT attack involves a spear phishing E-mail containing appealing subject and argument, and a malicious payload in form of an attachment or a link. In both cases the Email AV or Antispam are impacted in the ingress stream (and should be supposed to detect the attack, am I naive if I suggest that a DNS lookup could have avoided attacks like this?). The impacted security device produce some logs (even if they are not straightforward to detect if the malicious E-mail has not been detected as a possible threat or also has been detected with a low confidence threshold). In this stage of the attack the time interval between the receipt of the e-mail and its reading can take from few minutes up to several hours.
  • The following stage involves user interaction. Unfortunately there is no human firewall so far (it is something we are working on) but user education (a very rare gift). As a consequence the victim is lured to follow the malicious link or click on the malicious attachment. In the first scenario the user is directed to a compromised (or crafted) web site where he downloads and installs a malware (or also insert some credentials which are used to steal his identity for instance for a remote access login). In the second scenario the user clicks on the attached file that exploits a 0-day vulnerability to install a Remote Administration Tool. The interval between reading the malicious email and installing the RAT takes likely several seconds. In any case Endpoint Security Tools may help to avoid surfing to malicious site or, if leveraging behavioral analysis, to detect anomalous pattern from an application (a 0-day is always a 0-day and often they are released after making reasonably sure not to be detected by traditional AV). Hopefully In both cases some suspicious logs are generated by the endpoint.
  • RAT Control is the following stage: after installation the malware uses the HTTP protocol to fetch commands from a remote C&C Server. Of course the malicious traffic is forged so that it may be hidden inside legitimate traffic. In any case the traffic pass through Firewalls and NIDS at the perimeter (matching allowed rules on the traffic). In this case both kind of devices should be supposed to produce related logs;
  • Once in full control of the Attacker, the compromised machine is used as a hop for the attacker to reach other hosts (now he is inside) or also to sweep the internal network looking for the target data. In this case a NIDS/anomaly detector should be able to detect the attack, monitoring, for instance, the number of attempted authentications or wrong logins: that is the way in which Lockheed Martin prevented an attack perpetrated by mean of compromised RSA seeds, and also, during the infamous breach, RSA detected the attack using a technology of anomaly detection Netwitness, acquired by EMC, its parent company immediately after the event.

At this point should be clear that this lethal blend of threats is pushing the security firms to redefine their product strategies, since they face the double crucial challenge to dramatically improve not only their 0-day detection ability, but also to dramatically improve the capability to manage and correlate the data collected from their security solutions.

As far as 0-day detection ability is concerned, next-gen technologies will include processor assisted endpoint security or also a new class of network devices such as DNS Firewalls (thanks to @nientenomi for reporting the article).

As far data management and correlation are concerned, yes of course a SIEM is beautiful concept… until one needs to face the issue of correlation, which definitively mean that often SIEM projects become useless because of correlation patterns, which are too complex and not straightforward. This is the reason why the leading vendors are rushing to include an integrated SIEM technology in their product portfolio in order to  provide an out-of-the-box correlation engine optimized for their products. The price to pay will probably be a segmentation and verticalization of SIEM Market in which lead vendors will have their own solution (not so optimized for competitor technologies) at the expense of generalist SIEM vendors.

On the other hand APT are alive and kicking, keep on targeting US Defense contractors (Raytheon is the latest) and are also learning to fly though the clouds. Moreover they are also well hidden considered that, according to the Security Intelligence Report Volume 11 issued by Microsoft, less than one per cent of exploits in the first half of 2011 were against zero-day vulnerabilities. The 1% makes the difference! And it is a big difference!

September 2011 Cyber Attacks Timeline (Part II)

October 2, 2011 5 comments

Here it is the second part of my traditional monthly Cyber Attacks Timeline (Part I available here). From an information Security Perspective the main events of this month were the infamous Diginotar breach which led to Bankrupt for the Dutch Company and also the BEAST attack to SSL, two events which, together, thumbed the Infosec Community in its stomach.

Of course these events did not divert the attention of hackers who kept on to carry on attacks against different targets.

The Anonymous continued their campaign: although mainly focused on the #OccupyWallStreet Operation (in which a Senior Officer who used pepper spray against protestors was “doxed”, they targeted several governments including Mexico, Austria, (where they also performed an unconfirmed hack against an health insurance Firm targeting 600,000 dumped users) and Syria. In particular the latter attack triggered a retaliation by Syrian Electronic Soldiers against the prestigious Harvard University.

Chronicles also report a Japan defense contractor hit by hackers, Mitsubishi Heavy Industries, (China denied its involvement on the attack), another Twitter Account hacked by The Script Kiddies (this time against USA Today), an indirect attack perpetrated against (through) Oracle by infecting its MySQL.com domain with downloadable malware and, last but not least a massive defacement of 700,000 sites hosted by Inmotion.

US Navy was also victim of defacement.

As far as the prize for the “Most Expensive Breach of the Month” is concerned, the laurel wreath is undoubtedly for SAIC (Science Applications International Corp.) which lost a tape database backup containing data of 4,900.000 users with an estimated cost of approximately 1 billion of bucks…

As usual, useful Resources for compiling the table include:

My inclusion criteria do not take into consideration simple defacement attacks (unless they are particularly resounding) or small data leaks.

Update: On 09/30/2011, Betfair reported a 3.15 million records breach with a total estimated cost of 1.3 billion USD winning the laurel wreath of the most expensive breach of the month.

Date Author Description Organization Attack
Sep 16

Websites of several Mexican government ministries

As part of OpIndipendencia, websites of several Mexican government ministries, including Defense and Public Security, are teared down in the same day of the symbolic beginning of Mexico’s independence from Spain.

Sep 16 Mikster

Clubmusic.com, a worldwide dj website. is hacked and the leak dumped on pastebin.

Sep 16 Sec Indi Security Team
Official Website of The United States Navy

An hacker crew called Sec Indi Security Team Hacker uploads a custom message on the server to warn a WebDav vulnerability.

WebDav Vulnerabilty
Sep 16 ? California State Assembly

More than 50 employees of the California State Assemby, including some lawmakers, have been warned that their personal information might have been obtained by a computer hacker.

Sep 17 ?
Intelligence And National Security Alliance

Names and email addresses of hundreds of U.S. intelligence officials have been posted on an anti-secrecy website. On Monday Sep 10 INSA published a major report warning of an urgent need for cyberdefenses. Within a couple of days, in apparent retaliation, INSA’s “secure” computer system was hacked and the entire 3,000-person membership posted on the Cryptome.org website

Sep 17 ?
Fake FBI Anonymous Report

A Fake FBI Psychological profile of the Anonymous group is published. Although not a direct cyber attack, this event can be considered an example of psychological hacking and a “sign of the times” of how information and counter information may play a crucial role in hacking.

Sep 18
Texas Police

Anonymous/Anti-sec releases a document containing a list of about 3300 members of the Texas Police Association

Sep 19


Mitsubishi Heavy Industries

Mitsubishi Heavy Industries, Japan’s biggest defense contractor, has revealed that it suffered a hacker attack in August that caused some of its networks to be infected by malware. According to the firm,  45 network servers and 38 PCs became infected with malware at ten facilities across Japan. The infected sites included its submarine manufacturing plant in Kobe and the Nagoya Guidance & Propulsion System Works, which makes engine parts for missiles.

Sep 19
City Of Rennes

TeaMp0isoN takes responsibly to hack the official website of The City Of Rennes (France) via a tweet. They also publish the reason of hack on the defacement page.

Sep 19

Hana SK

Hana SK Card Co., a South Korean credit card firm, announces that Sep 17, some 200 of its customers’ personal information has been leaked. Total cost of the breach is $42,800.

Hana SK Card
Sep 20
? Former USSR Region

Source report that at least 50 victim organizations ranging from government ministries and agencies, diplomatic missions, research institutions, and commercial entities have been hit in the former Soviet Union region and other countries in an apparent industrial espionage campaign that has been going on at least since August 2010.The advanced persistent threat (APT)-type attacks — dubbed “Lurid” after the Trojan malware family being used in it — has infected some 1,465 computers in 61 countries with more than 300 targeted attacks.

Sep 20
 Shad0w Fox Sports Website

Fox Sports website, on of the most visited Websites in the world (rank 590 in Alexa) gets hacked. An Hacker named “Shad0w” releases SQL injection Vulnerability on one of the sub domain of Fox Sports and exploit it to extract the database. Leaked database info posted on pastebin. Vulnerable link is also posted together admin password hashes.

Sep 22
Core Security Technologies

Another security Firm target of hacking: Core Security Technologies is hacked by an hacker called Snc0pe, who defaces some websites belonging to the firm. Mirror of the hack can be seen here.

Sep 24 ?

Popular IRC service UKChatterbox advises users to change their passwords following a series of hacks which culminated in an attack that may have compromised user details. The password reset follows on from a succession of outages previously attributed to maintenance upgrades, back to the start of the summer. In a notice to users, UKChatterbox advises users to change their passwords and not to re-use them on other sites. The number of hacked account is unknown.

Sep 25

Seven Major Syrian Cities and Government Web Sites

The Anonymous unleash a chain of defacement actions against the Syrian Government, hacking and defacing the official sites of seven major Syrian cities, which stayed up in their defaced version for more than 16 hours. The defacement actions kept on the following day in which 11 Syrian Government Sites were defaced as part of the same operation.

Sep 25 ?
Indira Gandhi International Airport

Although happened three months ago, it turns out that a ‘technical snag’ hittinh operations at the Indira Gandhi International Airport (IGIA) T3 Terminal was caused by a “malicious code” sent from a remote location to breach the security at the airport.

Sep 26
Inmotion Hosting Server

700,000 websites hosted on InMotion Hosting network are hacked by TiGER-M@TE. The hackers copied over the index.php in many directories (public_html, wp-admin), deleted images directory and added index.php files where not needed. List of all hacked 700,000 sites here.

 Sep 26
Austrian Police

The Austrian Anonymous branch publishes the names and addresses of nearly 25,000 police officials, raising fears for officers’ personal security. An Austrian Interior ministry spokesman said the information came from an “association closely related with the police”. Estimated cost of the breach is around $ 5,400,000.

Sep 26
USA Today Twitter Account

The USA Today Twitter account is hacked and starts to tweet false messages mentioning the other accounts hacked by the authors of the action: the Script Kiddies (already in the spotlight for hacking the FoxNews Twitter Account at the Eve of 9/11 anniversary)

Account Hacking
Sep 26

MySQL.com website is struck by cybercriminals, who hacked their way in to serve up malicious code to visiting computers with a Java exploit that downloaded and executed malicious code on visiting Windows computers. Brian Krebs reports that just few days before, he noticed on a Russian underground website that a hacker was offering to sell admin rights to MySQL.com for $3000. MySQL.com receives almost 12 million visitors a month (nearly 400,000 a day).

Java Exploit to install malware
Sep 26
Harvard University

In retaliation for the defacements performed by the Anonymous targeting Syria, Syrian Electronic Soldiers deface the website of the prestigious Harvard University. The same group came in the spotlight during July and August for defacing Anonoplus engaging a “de facto” cyberwar against The Anonymous.

Sep 26 ?

The month of September is characterized by the OccupyWallStreet Operation, started on September, the 17th and still ongoing. Although not directly configurable as an hacking action, it may rely on the support of the Anonymous who “doxed” a senior police who controversially usec pepper spray against a group of female protesters.

Sep 27
COGEL, Council On Governmental Ethical Law

Once again in this month,Snc0pe claims another resounding action. This time the alleged target is the official website of The Council on Governmental Ethics Laws (COGEL). He posts a message on pastebin, along with the database download link.

Sep 28
Tiroler Gebietskrankenkasse (TGKK)

AnonAustria in the spotlight again after the resounding hack against Austrian Police. This time the victim is an health insurance firm Tiroler Gebietskrankenkasse (TGKK) whose database of some 600,475 medical records AnonAustria claims to have hacked. The databse includes some celebrities. The total cost of the breach is around $128,500,000.00.

Sep 29 ?
SAIC (Science Applications International Corp.)

SAIC, one of the Pentagon‘s largest contractors reveals to have discovered a data breach occurred a couple of weeks before, affecting as many as 4.9 million patients who have received care from military facilities in San Antonio since 1992. The breach involved backup computer tapes from an electronic health care record. Some of the information included Social Security numbers, addresses, phone numbers and private health information for patients in 10 states. Statement of the data breach here Estimated cost of the breach is around $ 1 billion.

Car Burglary
Sep 30 ?
Laptop Virus Repair

Although not resounding as the one which targeted MySQL.com, here it is another example of a website infected with malicious code targeting a free antivirus cloud based service.

Laptop Virus Repair
Malicious Code
Sep 30 ?

Betfair reports a leak including not only the payment card details of most of its customers but also “3.15m account usernames with encrypted security questions”, “2.9m usernames with one or more addresses” and “89,744 account usernames with bank account details”. The incident occurred on 14 March 2011 but was announced only 18 months later. Estimated cost of the breach is around $1.3 billion.


Some Random Thoughts On RSA Breach

April 10, 2011 15 comments
Security tokens from RSA Security designed as ...

Image via Wikipedia

June 7 Update: RSA admits some stolen seeds were used to attack Lockeed Martin and will replace SecurID tokens for customers with concentrated user bases typically focused on protecting intellectual property and corporate networks.

May 31 Update: Wired reports that L-3, a Second Defense Contractor, has been targeted by an attack using information stolen during the RSA Breach

May 28 Update: Other Random Thoughts after Several Sources reported that Lockeed Martin the “largest U. S. Defense contractor” was presumably hit by an alleged attack led by mean of compromised seeds.

Some days have passed since the RSA breach, but the echo has not yet gone. Maybe RSA did not contribute efficiently to suppress rumors as, in the meantime, has continued to issue ambiguous advices to its customers, and, more in general to the infosec community. Only few days ago a post from the Company has explained some more details about the breach. According to the above mentioned post written by Uri Rivner, RSA Head of New Technologies, the breach was due to an APT (Advanced Persistent Threat) exploiting a zero-day Adobe Flash vulnerability (CVE-2011-0609) embedded into an excel spreadsheet attached to an email from an appealing subject “2011 Recruitment Plan”. The poisoned file injected a RAT (Remote Access Tool) used by the attackers to gain privileges and move freely into the network up to the final target.

Curiously, the subject was so appealing to convince some users to recover it from the quarantine folder: to lure victims through pecuniary topics is a consolidated method of cyber scam at all levels, and RSA has not made exception in this circumstance.

This attack deserves much attention from the infosec community as we are used to think to multi-layer protection technologies but too often forget that the individuals are the first (and weakest) layer of defense, hence also the best technology, even that from a primary manufacturer as RSA is, risks to be very little useful, or even useless, if not supported by an adequate education of users. Phishing is considered an old attack method, mainly used in the past to lure individuals. Today its combination with 0-day vulnerabilities is proving to be a devastating weapon for Cybercrime targeting enterprises. (It is not a combination that also the Night Dragon Attack, maybe amplified by McAfee Marketing in response to the attention gained by its eternal competitor Symantec for the role played in the identification of Stuxnet, was initiated by a some phishing emails). Is this the reason why, on April the 1st, RSA decided to acquire NetWitness, a company whose technology, as stated in the press release:

provide precise and pervasive network visibility, enabling security teams to detect and remediate advanced threats while automating the incident investigation process.

Without invoking philosophical considerations, the main question is: are secureID users really safe or do they need to worry about their level of security after the breach?

My opinion is that the RSA breach was conceived as the final stage of a large scale attack to a wide organization making use of RSA tokens, since in most cases (we should hope in all cases), the alleged stolen information, alone, is not enough to perpetrate a successful attack unless the RSA breach was not preceded by other attacks perpetrated by the same author(s) aimed to steal the missing piece of the puzzle.

Taking a step back, on March, the 17th when the breach was announced, the open letter on the RSA web site, stated that:

Our investigation also revealed that the attack resulted in certain information being extracted from RSA’s systems. Some of that information is specifically related to RSA’s SecurID two-factor authentication products. While at this time we are confident that the information extracted does not enable a successful direct attack on any of our RSA SecurID customers, this information could potentially be used to reduce the effectiveness of a current two-factor authentication implementation as part of a broader attack.

Of course the “potentially be used to reduce the effectiveness” sounds a little bit ambiguous. Anyway a subsequent bulletin for RSA customers was released on March, the 21th 2010, stating that:

RSA SecurID technology continues to be a very effective authentication solution. Whoever attacked RSA has certain information related to the RSA SecurID solution, but not enough to complete a successful attack without obtaining additional information that is only held by our customers.

Said in few words according to the Company, the stolen information, alone, may not be used to perform a successful attack. Even if the RSA algorithm (in its post-2003 implementation using AES hash with 128 bit ECB blocks) is not public, RSA statements sound true since some quantities used in the hash are neither related to the 128 bit random seed nor to the 64 bit standard ISO representation of Current Time: they are a 32-bit token-specific salt (supposedly the serial number of the token, which may have been subtracted in the breach, and a 32 bits padding). Today this quantities are not used for security purposes, but simply to shape the blocks to 128 bits as requested by AES hash (enjoy the math of AES hash algorithm at this link).

Courtesy of Wikipedia

Of course, together with the PIN known only by the user, there is, in theory, enough stuff to make an attack unsuccessful in case a (organized) gang of cybercrooks come in possess of the database mapping a SecurID token with its seed. But unfortunately, as often happens, reality is much worse than theory, so one discovers that someone reversed the RSA algorithm and developed Cain & Abel, which, by mean of an RSA SecurID Token Calculator is able to retrieve the One Time Password from an RSA token, provided the malicious user owns the file contained in the RSA Authentication Server (mapping the token serial number with the seed) and knows the User PIN. Small “negligible” detail: from version 4.9.10 (released in 2007), Cain & Abel supports AES-128 of post-2003 securID implementation.

So at the end, supposed the information stolen from RSA is comparable, or could be brought in some manner to be comparable (in form and content) with that contained in each RSA Authentication Server (and it should be since each RSA token must be synchronized with its own authentication server), Cain & Abel (or a similar tool) could be applied to successfully obtain the password for each token whose seed was stolen, provided the attacker come somehow in possess of the only missing information: the user PIN.

There are several ways to steal a user PIN, from Social Engineering to sniffing. Often social engineering leverages the shallowness of the user or the lack of policies of the organization (yes… In my life I have also seen some SecurID tokens with attached a post-it containing the PIN). Of course when I mention sniffing I do not mean network sniffing since both in case of an organization adopting SecurID tokens either in native ACE mode or RADIUS mode, the PIN is never transmitted in clear, anyway we have not to forget that many organizations adopt software tokens (also in mobile devices), so one might not exclude a priori that a large scale attack had deserved the development and the deployment  of a Trojan tailored to steal PIN from RSA software tokens.

This is the reason why I expect that the target of the attackers was not RSA but an important organization making use of RSA securID authenticators. As a consequence I would not be surprised if a malicious tool to sniff PINs from RSA Software authenticators were discovered.

Seeds on the Black Market?

If I fly with my imagination I do not feel to completely exclude that the stolen information one day could be available in the black market to target other major organizations besides the presumed original victim: in fact do not forget that Banks worldwide are among the bigger customers of RSA). This is the reason why, RSA users should take in serious consideration the recommendations provided by the Company the day after the breach.

Personal Note 1

The Italian Security Professional group on Linkedin dedicated an interesting post to the RSA affaire (in Italian) which is continuously updated as new information is released. Today the last controversial advice: it looks like RSA will provide hack data in exchange of customer secrecy (thanks to Andrea Zapparoli Manzoni for reporting this information). This advise comes in the same day in which I discovered a further controversial article (actually dating back to a couple of weeks ago) reporting a possible (unconfirmed) backdoor in the SecurID tokens requested by the NSA in exchange of the authorization to export the technology…  Very strange the temporal proximity with the breach, as much strange the fact that this information is passed nearly unnoticed…

Personal Note 2

I must confess I was really intrigued on better understanding how the SecureID algorithm works for understanding which is the missing part “to make the successful attack complete” (to use the same words in the RSA bulletin).

Since, as already mentioned, the RSA algorithm is not public (even if the first version pre-2003 was reversed in 2000) I only may perform some kind of speculations. In these days I searched all the possible documentation and probably in this link I found a scenario which might be quite close to reality. Please notice that what follows is a mere speculation.

Since the beginning of 2003, SecurID performs an AES hash operation, in standard ECB mode, to hash

  • a 128-bit token-specific true-random seed;
  • a 64-bit standard ISO representation of Current Time in the following format: year/month/day/hour/min/second;
  • a 32-bit token-specific salt (the serial number of the token);
  • another 32 bits of padding, which can be adapted for new functions or additional defensive layers in the future.

The latter two are not a specific security feature but are needed since the AES-Hash operation needs 128 bit multiples. The 64 bit standard ISO representation is derived from a 32-bit representation of the current time (GMT) in seconds since midnight on 01/01/86, from which, only 22 bits are used from the original value, leaving 222 or 4,194,304 total possible time values. These inputs, conflated and hashed by the AES, generate the series of 6-8 digit (or alphanumeric) token-codes that are continuously displayed on the SecurID’s LCD as a “one-time password.” Rolled over every 30 or 60 seconds. In order to implement a pure two factor authentication, the user must insert a known PIN in order to complete the authentication process (but this is configured by the administrator).

Report Symantec Q4 2010: Fate Presto… Prima che la sicurezza SCADA!

February 16, 2011 1 comment

Symantec è particolarmente attiva in questo scorcio del 2011, così, dopo la pubblicazione del Dossier Stuxnet aggiornato, ha appena rivelato alla comunità di sicurezza il Symantec Intelligence Quarterly Report: October – December, 2010 che è interessante analizzare, notando, come questo si discosti notevolmente dall’analogo report recentemente pubblicato dalla livrea rossa di McAfee, principale concorrente del produttore di sicurezza di Cupertino.

Il titolo del report è tutto un programma: “Targeted Attacks on Critical Infrastructures” e riassume quelle che sono state le caratteristiche, dal punto di vista della sicurezza, di questo fine 2010: i cybercriminali si sono concentrati sulla creazione di malware targeted (ovvero ritagliato su misura) per danneggiare infrastrutture critiche.

Gli attacchi cosiddetti targeted sono perpetrati verso una specifica organizzazione o una specifica categoria di utenti e per questo sono notevolmente pericolosi ed efficaci, anche se usano tecniche tradizionali come phishing o link malevoli, essendo ritagliati su misura per l’infrastruttura obiettivo o anche per le abitudini o caratteristiche comportamentali degli utenti.

Attacchi di questo tipo, definiti anche Advanced Persistent Threat, trovano purtroppo una vasta gamma di applicazioni che spaziano dal furto di dati confidenziali finalizzato al profitto (ad esempo la sottrazione di credenziali bancarie), sino all’interferenza con le operazioni , se non in un vero e proprio sabotaggio dell’infrastruttura obiettivo. In molti casi, come ci ha dimostrato il 2011 (ed in particolare il mai troppo abusato Stuxnet) per ottenere lo scopo è sufficiente infettare un solo host (il famigerato paziente 0) per poi utilizzarlo come ponte involontario e catalizzatore per l’ondata di attacchi successiva.

E quindi cosa è accaduto nel 2010? La risposta è relativamente semplice, come dimostrato dal Trojan Hydraq (aka Operation Aurora secondo la nomenclatura adottata dal concorrente McAfee): una volta scoperte le potenzialità dei targeted attack i Cyber-criminali ne hanno utilizzato l’energia distruttiva verso le Infrastrutture Critiche.

A sostegno di questa tesi, il documento cita appunto i casi di Hydraq e Stuxnet. Il primo è inizialmente nato come un targeted attack facente leva su una Vulnerabilità del browser di casa Microsoft (advisory number 979352) con lo scopo finale di sottrarre informazioni alla vittima ed inviarle ad un server di comando e controllo. Questo attacco, che ha caratterizzato l’inizio del 2010 si è da subito tinto di giallo, non tanto per il mistero, quanto per i sospetti che sia stata proprio la Cina ad utilizzarlo con lo scopo di rubare credenziali di dissidenti dagli Account di Google.

Del secondo sappiamo tutto, addirittura Stuxnet era talmente targeted e così interconnesso con l’infrastruttura vittima, a tal punto che, secondo i ricercatori Symantec, sono passate solo 12 ore dalla prima compilazione alla prima infezione.

Curiosamente (ma fino a un certo punto) il report Symantec non cita Night Dragon, il malware scoperto dal concorrente McAfee che a mio avviso incarna meglio di chiunque altro, nel corso dell’ultimo trimestre 2010, il concetto del targeted attack rivolto a specifiche facility (questa volta un malware con il vizio del petrolchimico) e soprattutto facente uso di metodi tradizionali (SQL Injection e soprattutto download di malware tramite tecniche di Spearphishing) al fine di penetrare le barriere iniziali di protezione ed addentrarsi intimanente all’interno della rete verso le casseforti virtuali dove sono custoditi i segreti tecnici ed economici dell’organizzazione.

Gli attacchi di tipo targeted si fanno particolarmente pericolosi quando, come nel caso di Stuxnet. incrociano il mondo SCADA (Supervisory Control and Data Acquisition), ovvero quei processi e tecnologie che sottendono al monitoraggio e controllo delle Infrastrutture Critiche e dell’Industria, e che proprio per questo motivo, soprattutto in un momento turbolento come quello che stiamo vivendo, potrebbero essere al centro dell’attenzione di paesi nemici o singoli individui guidati da motivazioni ideologiche e politiche.

La pericolosità di SCADA non è nuova (si legga ad esempio questo articolo della stessa Symantec risalente al 2006), tuttavia nel 2010, è assurta alla ribalta grazie a Stuxnet e agli eventi successivi. Solo nell’ultimo trimestre dell’anno passato Symantec ha documentato 10 vulnerabilità pubbliche di SCADA, sulle 15 totali scoperte nel corso dell’anno. Ma non facciamoci troppe illusioni… Anche se numericamente esigue a causa della natura elitaria delle ricerche di sicurezza su questa tecnologia,  l’impatto di queste vulnerabilità è immane e un malintenzionato che volesse sfruttarle saprebbe bene come rendere il proprio attacco targeted per i punti deboli di SCADA, tra i quali Symantec ha annoverato nel 2010:

  • Tre vulnerabilità nell’interfaccia Web CGI dei prodotti Intellicom Netbiter webSCADA WS100 e WS200. Le vulnerabilità rilevate non sono di poco conto poiché consentono di caricare ed eseguire codice arbitrario ed accedere di conseguenza ad informazioni potenzialmente sensibili;
  • Una vulnerabilità di tipo SQL-injection all’interno della pagina di login del sistema SCADA Industrial Technology System (ITS). La vulnerabilità in oggetto consente di compromettere l’applicazione modificando la struttura del database sottostante;
  • Tre vulnerabilità di tipo buffer-overflow per il server DATAC RealWin SCADA. Grazie a questo insperato aiuto un attaccante è in grado di eseguire codice sul server;
  • Ulteriori tre vulnerabilità sono state scoperte nel prodotto Ecava IntegraXor, di cui due di tipo remote code-execution e una terza di tipo directory-traversal. “Ambetre” le vulnerabilità di questo prodotto possono essere utilizzate da un malintenzionato per eseguire codice arbitrario o accedere a informazioni sensibili ivi contenute.

Purtroppo la situazione è ulteriormente complicata dal fatto che una architettura SCADA non deve fare i conti con le sole proprie vulnerabilità intrinseche ma è costretta a portarsi dietro anche il pesante fardello delle vulnerabilità ereditate dai sistemi operativi ospitanti (sovente Microsoft) o dal middleware e database utilizzato per l’applicazione SCADA.

L’applicazione pratica di una vulnerabilità SCADA in una infrastrutture critica è presto detta, ed il caso di Stuxnet ne è emblematico: i sistemi di controllo industriale (di cui SCADA costituisce un esempio) sono utilizzati all’interno delle infrastrutture critiche per controllare i processi operativi quotidiani. In particolare sono essenziali per controllare e processare le informazioni inviate dai sensori ed attuare di conseguenza le necessarie azioni e comandi di risposta. A questo compito si aggiungono il monitoraggio degli ambienti operativi per verificare che le attività vengono sempre effettuate all’interno dei parametri di sicurezza (sono quindi in grado di prevenire condizioni pericolose per l’uomo quali: surriscaldamento, aumento dei livelli di tossicità, incendi o potenziali sovraccarichi).

Un sistema di controllo compromesso da un malware potrebbe non essere in grado di riconoscere le condizioni di pericolosità o anche di non contrastarle efficacemente, se non addirittura di sabotare deliberatamente e in maniera subdola l’infrastruttura come nel caso di Stuxnet. Le conseguenze potrebbero essere disastrose e portare ad eventi come quello (involontario) della città di Lake Havasu rimasta a secco per un guasto nel sistema di monitoraggio delle pompe d’acqua (Luglio 2010).

E quindi?

E quindi Symantec suggerisce di limitare l’esposizione delle reti che ospitano sistemi SCADA, possibilmente  isolandole dal resto del Globo. Nel caso in cui ciò non fosse possibile, il traffico verso il mondo esterno andrebbe limitato ai soli protocolli richiesti non disdegnando di proteggere ulteriormente gli accessi individuali mediante VPN IPSec autenticate ed eventualmente integrando la difesa con tecnologie di protezione di tipo endpoint sui sistemi operativi ospitanti (che comunque andrebbero sempre aggiornate) e con sistemi di Intrusion Detection & Prevention per le minacce di rete.

Dal punto di vista infrastrutturale la sicurezza di una infrastruttura SCADA è ulteriormente minata dal fatto che spesso, a causa della complessità, non è possibile creare un ambiente di test. Inoltre le interruzioni di servizio andrebbero limitate al minimo indispensabile poiché spesso sono costose se non addirittura distruttive. Suggeriti invece i test che possono essere fatti in linea, senza interrompere l’operatività quali passive asset discovery e vulnerability scanning, mentre tutte le operazioni di aggiornamento (Antivirus e pezze patch di sistema operativo) dovrebbero essere effettuate con la massima cura e con il massimo supporto dei produttori dei sistemi di controllo per minimizzare rischi e tempi di down.

Last But Not Least, non trascurare le attività di audit e policy compliance…

I Cinque Domini Dell’Apocalisse

February 15, 2011 2 comments

Quando la sicurezza Informatica incontra (involontariamente) l’arte…

Zoom Del Grafico Infezione al Dominio E (Aprile 2010 - Dati Symantec)

Symantec ha da poco pubblicato un aggiornamento relativo al proprio documento di analisi del malware Stuxnet. In questa versione del documento, che rappresenta forse il lavoro più esaustivo dedicato al malware delle centrali nucleari, il produttore di sicurezza di Cupertino ha aggregato i dati raccolti relativi al traffico effettuato dal malware verso i server di controllo remoto, con lo scopo di tracciare la linea spazio-temporale che ha caratterizzato l’infezione.

Come molti ricorderanno Stuxnet è stato da subito caratterizzato da una notevole complessità tecnica sancita, oltre che dall’uso massiccio di vulnerabilità 0-day, anche da molteplici meccanismi di infezione. A partire dall’infezione di una qualsiasi macchina Windows connessa in rete (il paziente zero), il malware è stato in grado di propagarsi con virulenza inaudita [e con l' (in)sperato supporto delle Vulnerabilità 0-day di Microsoft] all’interno della LAN. Come ultimo livello di infezione, grazie alla possibilità di propagarsi tramite drive USB, il malware ha raggiunto il vero (presumibile) obiettivo finale costituito dai nodi di programmazione PLC (definiti field PG) dei miscelatori delle Centrali Nucleari (soprattutto quelle Iraniane), nodi che tipicamente non sono connessi in rete.

Oltre a molteplici meccanismi di infezione, il team di sviluppo di Stuxnet (perché di un team deve essersi trattato considerata la complessità dell’architettura) ha dotato il malware della possibilità di aggiornarsi (per contrastare l’aggiornamento dei sistemi operativi e dei software di protezione anti-malware) e di essere controllato da remoto. In effetti il virus delle centrali nucleari non si è fatto mancare nulla ed i suoi creatori hanno previsto, seguendo la tendenza attuale del malware evoluto, un efficiente meccanismo peer-to-peer per controllare il malware da remoto ed eventualmente aggiornarlo grazie alla possibilità di connettersi ad un Server remoto di Comando e Controllo (C&C).

Sfrtuttando questo “vizietto” del malware, a partire dal 20 luglio 2010, Symantec ha messo in opera il monitoraggio del traffico dagli host compromessi connessi in rete verso i server di comando e controllo di Stuxnet. L’analisi dei campioni di virus analizzati ha consentito difatti di rilevare che i server di comando e controllo puntavano in realtà (tramite l’usuale http 80) a due domini:


facenti riferimento a server ubicati in Malesia e Danimarca. Una volta smascherati i finti domini il traffico è stato rediretto in lidi più sicuri. Contestualmente è stato possibile monitorare e analizzare il flusso di dati, impedendo ulteriormente il controllo delle macchine compromesse, e provvedendo nello stesso tempo ad avvisare le organizzazioni infette. I dati raccolti, appartenenti unicamente ai nodi compromessi connessi in rete, si sono rivelati estremamente preziosi per comprendere l’evoluzione dell’infezione. Ogni connessione verso i server di comando e controllo difatti, contiene dati quali: indirizzi IP interni ed esterni, nome del Computer, versione del Sistema Operativo, ed inoltre un indicatore che consente di capire se la macchina infetta ospita (e fa girare) il software di controllo industriale SIMATIC Step 7.

Grazie all’analisi di questi dati è stato possibile rilevare che alla  data del 29 settembre 2010 vi erano nel mondo 100.000 host infetti dei quali oltre il 60% localizzati in Iran. Dove peò i dati cominciano a farsi interessanti, è nel modo in cui è nata l’infezione: Symantec sostiene infatti che l’infezione sia nata da 5 punti ben precisi, ovvero tutto farebbe pensare che l’operazione sia stata concepita a tavolino per far partire il suo attacco mortale da cinque domini (il produttore giallo non rivela quali), da cui poi si è diffusa in tutto il globo.

A queste conclusioni si è giunti raccogliendo 3280 campioni del virus, “in rappresentanza” delle tre varianti del malware. Dal momento che il virus, ogni volta che infetta una nuova macchina, registra un timestamp oltre ad altre informazioni del sistema infetto; ogni campione racconta la storia del computer infetto, inclusa la prima infezione, il cosiddetto Paziente 0. Ovviamente con questi dati a disposizione è stato possibile ricostruire l’evoluzione del virus e determinare le caratteristiche di questa Apocalisse informatica:

  • Il nome di dominio registrato ha rivelato che Stuxnet è stato un attacco rivolto esplicitamente a cinque organizzazioni diverse;
  • Le cinque organizzazioni hanno subito 12.000 infezioni;
  • Tre organizzazioni sono state attaccate una sola volta, una è stata attaccata due volte, ed una ulteriore addirittura tre volte;
  • Il Dominio A è stato attaccato due volte (Giugno 2009 e Aprile 2010);
  • In ambedue i casi il paziente 0 (ovvero il computer origine dell’infezione) è stato sempre lo stesso;
  • Il Dominio B è stato attaccato tre volte (Giugno 2009, Marzo 2010 e Maggio 2010);
  • Il Dominio C è stato attaccato una sola volta (Luglio 2009);
  • Il Dominio D è stato attaccato una sola volta (Luglio 2009);
  • Il Dominio E sembra essere stato attaccato una sola volta (Maggio 2010), ma con tre infezioni iniziali (ovvero la stessa chiavetta USB galeotta è stata inserita dentro tre computer differenti);
  • Da queste 10 infezioni iniziali hanno avuto origine 12000 infezioni;
  • Sono stati registrati 1800 nomi di dominio diversi;
  • Tutte le date di infezione sono riconducibili a Giugno 2009, Luglio 2009, Marzo 2010, Aprile 2010 e Maggio 2010;
  • Tutte le organizzazioni infette hanno presenza in Iran;

Il grafici seguenti mostrano le lugubri figure geometriche derivanti dalla ricostruzione dell’infezione:

Infezioni per i domini A e B a Giugno 2009 (Dati Symantec)

Dominio B: Infezione Marzo 2010 (Symantec)

Sono stati riscontrati 10 cluster di infezione, il più virulento dei quali è stato quello che ha visto protagonista il Dominio B nel marzo 2010. Gli attacchi del 2009 hanno registrato il minore impatto, forse un artefatto causato dal numero ridotto di campioni raccolti per quell’anno. Inoltre, i grafici di infezione hanno principalmente rami lineari come se una singola infezione potesse influenzare un solo computer. Questo sarebbe solo parzialmente dovuto alle caratteristiche di autolimitazione del codice, mentre, probabilmente, potrebbe essere un artifatto introdotto dal numero ridotto di campioni raccolti.

Infezioni Aprile 2010 (Dati Symantec)

I dati evidenziano inoltre un non trascurabile effetto collaterale: il fatto che dagli iniziali 5 domini ne siano stati colpiti 1800 con 12000 indezioni, dimostra che Stuxnet è riuscito a sfuggire dai confini dei domini inizialmente colpiti, probabilmente per la collaborazione involontaria di partner e fornitori che, mediante una chiavetta USB galeotta, hanno propagato l’infezione oltre il perimetro virtuale del dominio obiettivo iniziale.

Il documento Symantec è estremamente curato e dettagliato, e questo ultimo aggiornamento è ulteriormente interessante e suggestivo (i grafi di evoluzione del virus sembrano opere arte ed hanno a mio avviso un contenuto artistico molto maggiore rispetto a certe opere che ho visto al MAXXI). Curiosamente, però, non ho potuto fare a meno di osservare che il documento Symantec è stato pubblicato subito dopo il report McAfee relativo al virus Night Dragon (che attacca facility differenti, appare meno raffinato del suo predecessore Stuxnet, ed ha inoltre sollevato reazioni controverse tra altri vendor di sicurezza). Questo sembrerebbe delineare una nuova tendenza dei produttori: ieri mettevano alla prova la bontà della propria tecnologia e dei propri laboratori di ricerca sfidandosi reciprocamente nella corsa dei tempi di rilascio delle signature per le nuove infezioni; oggi la sfida risiede nello sradicare per primi le minacce di nuova generazione (i cosiddetti Advanced Persistent Threat), soprattutto quando queste, anche utilizzando metodi di infezione “tradizionali”, effettuano il salto di qualità e minano alla base le infrastrutture critiche che presiedono all’Ordine Mondiale (almeno così come lo consociamo).


Get every new post delivered to your Inbox.

Join 2,705 other followers