Saturday, March 17, 2018

Breaking Botnets and Wrestling Ransomware Webcast

Microsoft has an event

Webcast: Microsoft Security Intelligence Report Volume 23—Breaking Botnets and Wrestling Ransomware

The security threat landscape is constantly evolving, and Microsoft has spent over a decade tracking and analyzing software vulnerabilities, exploits, malware, unwanted software, and attacker group methods and tactics via the Security Intelligence Report. As organizations move to the cloud and invest into modern technologies, Microsoft continues its commitment to analyzing and informing the security community with deep insights on the latest threats.
During this webinar, we will discuss learnings from the Security Intelligence Report Volume 23 that include analysis of the top security threat trends we saw in 2017, dive deep into insights on attack vectors, and actionable recommendations from a security industry veteran and a former CISO for your organization to protect and defend itself against these threats. Key takeaways from this webinar include:
  • Learn about the top security threat trends in 2017
  • Gain insight into attack vectors and attacker techniques
  • Hear recommendations and approaches on how to protect your organization from the latest threats

Webcast: Microsoft Security Intelligence Report Volume 23—Breaking Botnets and Wrestling Ransomware
April 10, 2018
1:00 PM ET / 10:00 AM PT


Tuesday, March 13, 2018

4G LTE Under Attack

Over the past few years, Fourth Generation Long Term Evolution or 4G LTE has become the standard for cellular communications. Security vulnerabilities affecting 4G LTE need to be taken seriously as any disruption to the network can have serious consequences to life in 2018 and beyond. Billions of people around the world depend on the integrity of 4G LTE for daily activities in both their personal and professional lives.
A recent study conducted by a group of researchers from Purdue and Iowa University has uncovered a bundle of vulnerabilities affecting 4G LTE cellular networks. These protocol level vulnerabilities can be exploited for malicious purposes in numerous ways. The researchers have proven that these flaws can allow an attacker to intercept calls and text messages, kick a device off of the network, and even track a user’s location. These may sound like far-fetched scenarios; however eight of the ten attacks discovered have been proven in a testing environment using devices with SIM cards from real US carriers.
The discovery of this set of vulnerabilities may sound like just another security story; however, the potential for abuse here is enormous. In addition to tracking an individual’s location, their location can also be spoofed or altered. This presents unique challenges for criminal investigations as criminals can use this to provide false alibis or even frame another person. The research also proves it possible for an attacker to generate and distribute fake emergency alerts. As seen in the recent case of the false alarm for a threat against Hawaii, this could be abused to create massive disruption.
All of these potential attack scenarios are made possible by authentication relay attacks. A successful authentication relay attack will allow an attacker to bypass network authentication defenses without any legitimate credentials and disguise their identity. Once authenticated an attacker has access to the network core where they can essentially block a target device from receiving notifications altogether.
The major cellular carriers have been notified of these flaws and are in the process of releasing fixes. The research team has agreed to not release their proof of concept code until the fixes have been applied. Perhaps the most troubling part of this story is that these types of attacks can be conducted for as little as $1,300, which is negligible to a well-organized criminal effort

Saturday, March 3, 2018

Re-purposing Lucrative Exploits

Last month Adobe released a Flash security update to remediate the zero-day Remote Code Execution (RCE) CVE-2018-4878 vulnerability that was most visibly being utilized by the North Koreans to spy upon the south. The South Korean CERT team noted that the exploit was being actively used by the North to target valuable information assets in the south as early as 31, January 2017. The vulnerability, scoring a 9.8 out of 10 base score from the National Vulnerability Database (NVD) was quickly acknowledged by Adobe who posted a bulletin (APSA18-01) with security advisory details for the critical vulnerability including mitigations. The 9.8 base score from the NVD was due to the flaw being exploitable over the internet, requiring low skill to execute the attack, without any privileges on the target machine, and no user interaction with the target. The exploit is realized by a malicious malformed flash object being embedded in Office documents. Once opened the embedded SWF flash file would execute, downloading an additional payload from the web, the Remote Access Trojan ROKRAT.

Adobe released a patch for the troubling zero-day on 6 of February to address CVE-2018- 4878 aiming to protect victims from the RCE vulnerability, but attackers found a new way to exploit CVE-2018-4878 as noted by TREND MICRO in their February 27, 2018 report stating "The campaign involves the use of malicious spam - specifically with a spam email that with an embedded link that directs the recipient to a Microsoft Word lure document (Detected by Trend Micro as TROJ_CVE20184878.A and SWF_CVE20184878.A) stored on the malicious website safe-storage[.]biz. After the file is downloaded and executed, it will prompt the user to enable editing mode to view what's inside the document. This document is what triggers the exploitation of CVE-2018-4878 - in particular, a cmd.exe window is opened that is remotely injected with a malicious shellcode."
 This reviving of CVE-2018-4878 illustrates not only the classic "cat and mouse" dance between attacker and defender but also the ability and keenness of attackers to adapt methods to keep exploiting lucrative vulnerabilities such as those with high NVD scores.

Sources: exploits/new-campaign-exploits-cve-2018-4878-anew-via-malicious-microsoft- word-documents

Thanks to Peraton CIP report for this information

Malware: The New DRM Solution

Software piracy has been an issue for about as long as there has been software to pirate. Companies are constantly developing new Digital Rights Management (DRM) solutions to protect their products, while software pirates, known as crackers, are constantly finding new ways to bypass these technologies. However, FlightSimLabs (FSLabs) recently thought of a new DRM strategy: place malware within their installer.

FlightSimLabs develops add-ons for Microsoft’s Flight Simulator game. These add-ons allow customers to buy additional planes to fly, expanding the game experience. Some Reddit users noticed a strange file, test.exe, which was extracted into a temporary folder when the A320X add-on was installed. Upon further investigation, the executable turned out to be malware purposefully placed by FSLabs to steal usernames and passwords stored in Google Chrome when a pirated copy is installed.

The malware is designed to run only when a flagged serial number is detected. The application is actually the command-line tool Chrome Password Dump

created by SecurityXploded which retrieves and displays usernames and passwords from Chrome in an easy-to-read format. The .bin file provided with the FSLabs application calls the test.exe file and sends the output to a Log.txt file. As if this wasn’t bad enough, the text file is then encoded with Base64.exe and sent back to an FSLabs site, over an HTTP connection (not even

HTTPS). Security researchers at Fidus Information Security determined that the malware was not called when the application is run with a legitimate serial number.
The founder and owner of FSLabs, Lefteris Kalamaras, states "First of all – there are no tools used to reveal any sensitive information of any customer who has legitimately purchased our products." The malware was intended to collect information on people using pirated copies only. However, stealing credentials may still violate multiple sections of the Computer Fraud and Abuse Act. Also, even though the malware is not activated by the add-on for legitimate users, it was still extracted and puts their systems at risk of someone else activating it. FSLabs has offered another version of the installer without the test.exe file.

Thanks to Peraton CIP report for this information



National Consumer Protection Week

Original release date: March 02, 2018

March 4–10 is National Consumer Protection Week (NCPW), an event to encourage people and businesses to learn more about avoiding scams and understanding consumer rights. During NCPW, the Federal Trade Commission (FTC) and its partners highlight free resources to help protect consumers.

NCCIC/US-CERT recommends consumers participate in the FTC/Facebook live chats and review the following NCCIC/US-CERT security tips:

Thursday, February 22, 2018

Winter Olympics Cyberattack

The Olympic Games have always been a symbol of global unity and cooperation, mixed in with friendly competition of course. However, this can also mark the games as a target for groups that don’t share that worldview. This year, the Winter Olympics opening ceremony was targeted by a cyberattack focused on disruption and destruction of systems. The attack resulted in the official website being offline for roughly 12 hours, preventing attendees from accessing tickets and information, as well as disrupting the Wi-Fi at the stadium and various news coverage feeds.

Security researchers at Cisco’s Talos group analyzed the malware and have dubbed it Olympic Destroyer. While it is still unclear how the systems became initially infected, Talos has disclosed some details of how the malware operates. The malware is contained within a binary file which is responsible for propagation across the network. It checks the Address Resolution Protocol (ARP) table on the system to discover additional targets, as well as using the Windows Management Instrumentation Query Language (WQL) to run the request "SELECT ds_cn FROM ds_computer" to find other systems. These are carried out using legitimate administrative tools included with Windows, PsExec and WMI. The other function of the binary file is to drop 2 modules, the credential stealers.
The stealer modules focus on different types of credentials: a web browser module and a system module. The web browser stealer parses the SQLite file in the registry to access stored credentials for Internet Explorer, Firefox, and Chrome. The system module gathers credentials from the Local Security Authority Subsystem Service (LSASS), a Windows process that enforces security policy for the system. Once credentials have been gathered, the binary file is updated to include the credentials hardcoded in, to be used on newly infected systems for further access.
After reconnaissance, the malware begins a destruction phase to disable the system. Using the Windows command line (cmd.exe), various tasks are carried out to prevent recovery of the system: deletion of all shadow copies on the system, deletion of the wbadmin catalog, using bcdedit to change the boot configuration and disable Windows recovery, and deleting the System and Security Windows Event logs. Finally, the malware stops and disables all Windows services and shuts down the system, preventing it from being restarted in a usable state.

Olympic Destroyer used well-known Sysinternal tools included with Windows, implying the attacker knew the targets were Windows-based. Talos also suggested the attacker knew a “lot of technical details of the Olympic Game infrastructure such as username, domain name, server name, and
obviously password.”

Sources: yeongchang-2018-winter-olympics.html

and The CIP from Peraton

Final Public Draft of Special Publication (SP) 800-171A, Assessing Security Requirements for Controlled Unclassified Information

NIST Computer Security Division Releases the Final Public Draft of Special Publication (SP) 800-171A, Assessing Security Requirements for Controlled Unclassified Information

NIST Computer Security Division releases the Final Public Draft of Special Publication (SP) 800-171A, Assessing Security Requirements for Controlled Unclassified Information is now available for public comment.  See below for further details.

Learn about the updates to the Final Draft SP 800-171A on the NIST CSRC website at:

Below is the link to the Draft SP 800-171A publication record where links to the document, the comment template and other supplemental information is available:

Deadline to submit comments to draft SP 800-171A: March 23, 2017

Email comments or questions about this draft document to: