Wednesday, April 11, 2018

Cloudflare Public DNS Service

Domain Name Service (DNS) is an integral part of today’s public Internet infrastructure. The purpose of DNS is to resolve names to IP addresses and the technology itself was invented in 1983 when security was an afterthought. As a result, over the years many types of DNS attacks have been seen such as DNS spoofing, cache poisoning, and many others. These attacks often consist of sending incorrect DNS responses back to clients in the hope the clients will communicate with network nodes across the internet, which are controlled by attackers instead of the originally requested legitimate nodes.

In response to the security shortcomings of DNS, additional protocols have been created to mitigate security risks such as Domain Name System Security Extensions (DNSSEC). DNSSEC essentially forms a signed chain of trust within the hierarchical infrastructure of DNS nodes so when a client queries a node’s IP address there is verification that the resolved response is legitimate. Cloudflare, a cloud-based company that is known for its content delivery network, DDOS mitigation, and security services has recently made mainstream news with its new DNS public consumer services offering. What makes Cloudflare’s public DNS so attractive is that they can compete, if not surpass, Google’s DNS services in both performance and security. In their recent blog post published this past Sunday, they boast their “fast and highly distributed network, and claim they are the fastest authoritative DNS provider on the Internet with seven million Internet properties.” Additionally, their new public DNS service supports DNS over HTTPS and DNS over TLS for added encrypted communication across the Internet.

What seems to make Cloudflare more attractive than Google is their emphasis on privacy and speed. Their goal according to their blog is to keep expanding their infrastructure until everyone is within 10 milliseconds of at least one of their DNS locations. Additionally, Cloudflare uses protocols such as DNS Query Name Minimization to minimize captured public information as it crosses DNS nodes. Furthermore, Cloudflare states they will never store any information in their logs that identifies end users. All logs collected by public resolvers will be deleted within 24 hours. Their resolvers are built from the open source DNS resolver and the modular designed Knot Resolver, which was released about two years ago and currently has a large and active user base.

To check if you are currently using DNSSEC, you can visit  To try out Cloudflare’s DNS service visit

Sources   

Thursday, March 29, 2018

IC3 Issues Alert on Tech Support Fraud

National Cyber Awareness System:

03/29/2018 01:00 PM EDT
Original release date: March 29, 2018
The Internet Crime Complaint Center (IC3) has released an alert on tech support fraud.
Tech support fraud involves criminals claiming to provide technical support to fix problems
that don't exist. Their methods include placing calls, sending pop-ups, engaging misleading
 lock screens, and sending emails to entice users to accept fraudulent tech support services.
Users should not give control of their computers or mobile devices to any stranger offering
to fix problems. NCCIC/US-CERT encourages users and administrators to refer to the
 IC3 Alert and the NCCIC Tip on Avoiding Social Engineering and Phishing Attacks for more
 information. If you believe you are a victim of a tech support scam, file a complaint with
the IC3 at

Wednesday, March 21, 2018

Windows Server 2019 – now available in preview

This blog post was authored by Erin Chapple, Director of Program Management, Windows Server.

Today is a big day for Windows Server! On behalf of the entire Windows Server team, I am delighted to announce Windows Server 2019 will be generally available in the second half of calendar year 2018. Starting now, you can access the preview build through our Insiders program.

What’s new in Windows Server 2019

Windows Server 2019 is built on the strong foundation of Windows Server 2016 – which continues to see great momentum in customer adoption. Windows Server 2016 is the fastest adopted version of Windows Server, ever! We’ve been busy since its launch at Ignite 2016 drawing insights from your feedback and product telemetry to make this release even better.

We also spent a lot of time with customers to understand the future challenges and where the industry is going. Four themes were consistent – Hybrid, Security, Application Platform, and Hyper-converged infrastructure. We bring numerous innovations on these four themes in Windows Server 2019.

Hybrid cloud scenarios:

We know that the move to the cloud is a journey and often, a hybrid approach, one that combines on-premises and cloud environments working together, is what makes sense to our customers. Extending Active Directory, synchronizing file servers, and backup in the cloud are just a few examples of what customers are already doing today to extend their datacenters to the public cloud. In addition, a hybrid approach also allows for apps running on-premises to take advantage of innovation in the cloud such as Artificial Intelligence and IoT. Hybrid cloud enables a future-proof, long-term approach – which is exactly why we see it playing a central role in cloud strategies for the foreseeable future.
At Ignite in September 2017, we announced the Technical Preview of Project Honolulu – our reimagined experience for management of Windows and Windows Server. Project Honolulu is a flexible, lightweight browser-based locally-deployed platform and a solution for management scenarios. One of our goals with Project Honolulu is to make it simpler and easier to connect existing deployments of Windows Server to Azure services. With Windows Server 2019 and Project Honolulu, customers will be able to easily integrate Azure services such as Azure Backup, Azure File Sync, disaster recovery, and much more so they will be able to leverage these Azure services without disrupting their applications and infrastructure.

Security continues to be a top priority for our customers. The number of cyber-security incidents continue to grow, and the impact of these incidents is escalating quickly. A Microsoft study shows that attackers take, on average, just 24-48 hours to penetrate an environment after infecting the first machine. In addition, attackers can stay in the penetrated environment – without being noticed – for up to 99 days on average, according to a report by FireEye/Mandiant. We continue on our journey to help our customers improve their security posture by working on features that bring together learnings from running global-scale datacenters for Microsoft Azure, Office 365, and several other online services.

Our approach to security is three-fold – Protect, Detect and Respond. We bring security features in all three areas in Windows Server 2019.
On the Protect front, we introduced Shielded VMs in Windows Server 2016, which was enthusiastically received by our customers. Shielded VMs protect virtual machines (VM) from compromised or malicious administrators in the fabric so only VM admins can access it on known, healthy, and attested guarded fabric. In Windows Server 2019, Shielded VMs will now support Linux VMs. We are also extending VMConnect to improve troubleshooting of Shielded VMs for Windows Server and Linux. We are adding Encrypted Networks that will let admins encrypt network segments, with a flip of a switch to protect the network layer between servers.

On the Detect and Respond front, in Windows Server 2019, we are embedding Windows Defender Advanced Threat Protection (ATP) that provides preventative protection, detects attacks and zero-day exploits among other capabilities, into the operating system. This gives customers access to deep kernel and memory sensors, improving performance and anti-tampering, and enabling response actions on server machines.

Application Platform:
A key guiding principle for us on the Windows Server team is a relentless focus on the developer experience. Two key aspects to call out for the developer community are improvements to Windows Server containers and Windows Subsystem on Linux (WSL).
Since the introduction of containers in Windows Server 2016, we have seen great momentum in its adoption. Tens of millions of container images have been downloaded from the Docker Hub. The team learned from feedback that a smaller container image size will significantly improve experience of developers and IT Pros who are modernizing their existing applications using containers. In Windows Server 2019, our goal is to reduce the Server Core base container image to a third of its current size of 5 GB. This will reduce download time of the image by 72%, further optimizing the development time and performance.
We are also continuing to improve the choices available when it comes to orchestrating Windows Server container deployments. Kubernetes support is currently in beta, and in Windows Server 2019, we are introducing significant improvements to compute, storage, and networking components of a Kubernetes cluster.
A feedback we constantly hear from developers is the complexity in navigating environments with Linux and Windows deployments. To address that, we previously extended Windows Subsystem on Linux (WSL) into insider builds for Windows Server, so that customers can run Linux containers side-by-side with Windows containers on a Windows Server. In Windows Server 2019, we are continuing on this journey to improve WSL, helping Linux users bring their scripts to Windows while using industry standards like OpenSSH, Curl & Tar.
Finally, Window Server customers using System Center will be excited to know that System Center 2019 is coming and will support Windows Server 2019.
We have much more to share between now and the launch later this year. We will bring more details on the goodness of Windows Server 2019 in a blog series that will cover the areas above.
Sign up for the Insiders program to access Windows Server 2019
We know you probably cannot wait to get your hands on the next release, and the good news is that the preview build is available today to Windows Insiders. Join the program to ensure you have access to the bits. For more details on this preview build, check out the Release Notes.
We love hearing from you, so don’t forget to provide feedback using the Windows Feedback Hub app, or the Windows Server space in the Tech community.


Saturday, March 17, 2018

Breaking Botnets and Wrestling Ransomware Webcast

Microsoft has an event

Webcast: Microsoft Security Intelligence Report Volume 23—Breaking Botnets and Wrestling Ransomware

The security threat landscape is constantly evolving, and Microsoft has spent over a decade tracking and analyzing software vulnerabilities, exploits, malware, unwanted software, and attacker group methods and tactics via the Security Intelligence Report. As organizations move to the cloud and invest into modern technologies, Microsoft continues its commitment to analyzing and informing the security community with deep insights on the latest threats.
During this webinar, we will discuss learnings from the Security Intelligence Report Volume 23 that include analysis of the top security threat trends we saw in 2017, dive deep into insights on attack vectors, and actionable recommendations from a security industry veteran and a former CISO for your organization to protect and defend itself against these threats. Key takeaways from this webinar include:
  • Learn about the top security threat trends in 2017
  • Gain insight into attack vectors and attacker techniques
  • Hear recommendations and approaches on how to protect your organization from the latest threats

Webcast: Microsoft Security Intelligence Report Volume 23—Breaking Botnets and Wrestling Ransomware
April 10, 2018
1:00 PM ET / 10:00 AM PT


Tuesday, March 13, 2018

4G LTE Under Attack

Over the past few years, Fourth Generation Long Term Evolution or 4G LTE has become the standard for cellular communications. Security vulnerabilities affecting 4G LTE need to be taken seriously as any disruption to the network can have serious consequences to life in 2018 and beyond. Billions of people around the world depend on the integrity of 4G LTE for daily activities in both their personal and professional lives.
A recent study conducted by a group of researchers from Purdue and Iowa University has uncovered a bundle of vulnerabilities affecting 4G LTE cellular networks. These protocol level vulnerabilities can be exploited for malicious purposes in numerous ways. The researchers have proven that these flaws can allow an attacker to intercept calls and text messages, kick a device off of the network, and even track a user’s location. These may sound like far-fetched scenarios; however eight of the ten attacks discovered have been proven in a testing environment using devices with SIM cards from real US carriers.
The discovery of this set of vulnerabilities may sound like just another security story; however, the potential for abuse here is enormous. In addition to tracking an individual’s location, their location can also be spoofed or altered. This presents unique challenges for criminal investigations as criminals can use this to provide false alibis or even frame another person. The research also proves it possible for an attacker to generate and distribute fake emergency alerts. As seen in the recent case of the false alarm for a threat against Hawaii, this could be abused to create massive disruption.
All of these potential attack scenarios are made possible by authentication relay attacks. A successful authentication relay attack will allow an attacker to bypass network authentication defenses without any legitimate credentials and disguise their identity. Once authenticated an attacker has access to the network core where they can essentially block a target device from receiving notifications altogether.
The major cellular carriers have been notified of these flaws and are in the process of releasing fixes. The research team has agreed to not release their proof of concept code until the fixes have been applied. Perhaps the most troubling part of this story is that these types of attacks can be conducted for as little as $1,300, which is negligible to a well-organized criminal effort

Saturday, March 3, 2018

Re-purposing Lucrative Exploits

Last month Adobe released a Flash security update to remediate the zero-day Remote Code Execution (RCE) CVE-2018-4878 vulnerability that was most visibly being utilized by the North Koreans to spy upon the south. The South Korean CERT team noted that the exploit was being actively used by the North to target valuable information assets in the south as early as 31, January 2017. The vulnerability, scoring a 9.8 out of 10 base score from the National Vulnerability Database (NVD) was quickly acknowledged by Adobe who posted a bulletin (APSA18-01) with security advisory details for the critical vulnerability including mitigations. The 9.8 base score from the NVD was due to the flaw being exploitable over the internet, requiring low skill to execute the attack, without any privileges on the target machine, and no user interaction with the target. The exploit is realized by a malicious malformed flash object being embedded in Office documents. Once opened the embedded SWF flash file would execute, downloading an additional payload from the web, the Remote Access Trojan ROKRAT.

Adobe released a patch for the troubling zero-day on 6 of February to address CVE-2018- 4878 aiming to protect victims from the RCE vulnerability, but attackers found a new way to exploit CVE-2018-4878 as noted by TREND MICRO in their February 27, 2018 report stating "The campaign involves the use of malicious spam - specifically with a spam email that with an embedded link that directs the recipient to a Microsoft Word lure document (Detected by Trend Micro as TROJ_CVE20184878.A and SWF_CVE20184878.A) stored on the malicious website safe-storage[.]biz. After the file is downloaded and executed, it will prompt the user to enable editing mode to view what's inside the document. This document is what triggers the exploitation of CVE-2018-4878 - in particular, a cmd.exe window is opened that is remotely injected with a malicious shellcode."
 This reviving of CVE-2018-4878 illustrates not only the classic "cat and mouse" dance between attacker and defender but also the ability and keenness of attackers to adapt methods to keep exploiting lucrative vulnerabilities such as those with high NVD scores.

Sources: exploits/new-campaign-exploits-cve-2018-4878-anew-via-malicious-microsoft- word-documents

Thanks to Peraton CIP report for this information

Malware: The New DRM Solution

Software piracy has been an issue for about as long as there has been software to pirate. Companies are constantly developing new Digital Rights Management (DRM) solutions to protect their products, while software pirates, known as crackers, are constantly finding new ways to bypass these technologies. However, FlightSimLabs (FSLabs) recently thought of a new DRM strategy: place malware within their installer.

FlightSimLabs develops add-ons for Microsoft’s Flight Simulator game. These add-ons allow customers to buy additional planes to fly, expanding the game experience. Some Reddit users noticed a strange file, test.exe, which was extracted into a temporary folder when the A320X add-on was installed. Upon further investigation, the executable turned out to be malware purposefully placed by FSLabs to steal usernames and passwords stored in Google Chrome when a pirated copy is installed.

The malware is designed to run only when a flagged serial number is detected. The application is actually the command-line tool Chrome Password Dump

created by SecurityXploded which retrieves and displays usernames and passwords from Chrome in an easy-to-read format. The .bin file provided with the FSLabs application calls the test.exe file and sends the output to a Log.txt file. As if this wasn’t bad enough, the text file is then encoded with Base64.exe and sent back to an FSLabs site, over an HTTP connection (not even

HTTPS). Security researchers at Fidus Information Security determined that the malware was not called when the application is run with a legitimate serial number.
The founder and owner of FSLabs, Lefteris Kalamaras, states "First of all – there are no tools used to reveal any sensitive information of any customer who has legitimately purchased our products." The malware was intended to collect information on people using pirated copies only. However, stealing credentials may still violate multiple sections of the Computer Fraud and Abuse Act. Also, even though the malware is not activated by the add-on for legitimate users, it was still extracted and puts their systems at risk of someone else activating it. FSLabs has offered another version of the installer without the test.exe file.

Thanks to Peraton CIP report for this information



National Consumer Protection Week

Original release date: March 02, 2018

March 4–10 is National Consumer Protection Week (NCPW), an event to encourage people and businesses to learn more about avoiding scams and understanding consumer rights. During NCPW, the Federal Trade Commission (FTC) and its partners highlight free resources to help protect consumers.

NCCIC/US-CERT recommends consumers participate in the FTC/Facebook live chats and review the following NCCIC/US-CERT security tips:

Thursday, February 22, 2018

Winter Olympics Cyberattack

The Olympic Games have always been a symbol of global unity and cooperation, mixed in with friendly competition of course. However, this can also mark the games as a target for groups that don’t share that worldview. This year, the Winter Olympics opening ceremony was targeted by a cyberattack focused on disruption and destruction of systems. The attack resulted in the official website being offline for roughly 12 hours, preventing attendees from accessing tickets and information, as well as disrupting the Wi-Fi at the stadium and various news coverage feeds.

Security researchers at Cisco’s Talos group analyzed the malware and have dubbed it Olympic Destroyer. While it is still unclear how the systems became initially infected, Talos has disclosed some details of how the malware operates. The malware is contained within a binary file which is responsible for propagation across the network. It checks the Address Resolution Protocol (ARP) table on the system to discover additional targets, as well as using the Windows Management Instrumentation Query Language (WQL) to run the request "SELECT ds_cn FROM ds_computer" to find other systems. These are carried out using legitimate administrative tools included with Windows, PsExec and WMI. The other function of the binary file is to drop 2 modules, the credential stealers.
The stealer modules focus on different types of credentials: a web browser module and a system module. The web browser stealer parses the SQLite file in the registry to access stored credentials for Internet Explorer, Firefox, and Chrome. The system module gathers credentials from the Local Security Authority Subsystem Service (LSASS), a Windows process that enforces security policy for the system. Once credentials have been gathered, the binary file is updated to include the credentials hardcoded in, to be used on newly infected systems for further access.
After reconnaissance, the malware begins a destruction phase to disable the system. Using the Windows command line (cmd.exe), various tasks are carried out to prevent recovery of the system: deletion of all shadow copies on the system, deletion of the wbadmin catalog, using bcdedit to change the boot configuration and disable Windows recovery, and deleting the System and Security Windows Event logs. Finally, the malware stops and disables all Windows services and shuts down the system, preventing it from being restarted in a usable state.

Olympic Destroyer used well-known Sysinternal tools included with Windows, implying the attacker knew the targets were Windows-based. Talos also suggested the attacker knew a “lot of technical details of the Olympic Game infrastructure such as username, domain name, server name, and
obviously password.”

Sources: yeongchang-2018-winter-olympics.html

and The CIP from Peraton

Final Public Draft of Special Publication (SP) 800-171A, Assessing Security Requirements for Controlled Unclassified Information

NIST Computer Security Division Releases the Final Public Draft of Special Publication (SP) 800-171A, Assessing Security Requirements for Controlled Unclassified Information

NIST Computer Security Division releases the Final Public Draft of Special Publication (SP) 800-171A, Assessing Security Requirements for Controlled Unclassified Information is now available for public comment.  See below for further details.

Learn about the updates to the Final Draft SP 800-171A on the NIST CSRC website at:

Below is the link to the Draft SP 800-171A publication record where links to the document, the comment template and other supplemental information is available:

Deadline to submit comments to draft SP 800-171A: March 23, 2017

Email comments or questions about this draft document to:

Monday, February 12, 2018

Tips for Tax Time

A 2017 Identity Fraud Study by Javelin Strategy & Research revealed that nearly one in three consumers notified that their data has been breached become victims of identity fraud. With the recent Equifax cyberattack still fresh in our minds, more than 145 million Americans’ names, addresses, birthdates, Social Security numbers and other sensitive information may be at risk. Cybercriminals are crafty and continuously looking for ways to steal your personal information. The Internal Revenue Service (IRS) indicates that phishing schemes continue to lead its “dirty dozen” list of 2017 tax scams. So what is the average American to do? The National Cyber Security Alliance (NCSA) and the Identity Theft Resource Center (ITRC) have once again joined forces to help consumers keep safe during tax season with tips for identifying cyber scams, actionable online safety steps and what to do if you fall victim to tax identity theft.

Tuesday, February 6, 2018

The ten immutable laws of security administration revisited and updated

Law #1: If a bad guy can persuade you to run his program on your computer, it’s not solely your computer anymore.

Phishing scams, link bait, hacked software, hacks for software, keygens, screensavers, games, codecs, media files… the list goes on and on. Search for anything online you might wish to download, and odds are extremely good that you will find the majority of the links on the first page of your search results will go to downloads that are for anything other than what you really want to download. Check out torrent sites or other sources for what includes binaries of questionable origin, and I guarantee you that most of those downloads are crawling with badness. Everyone wants something for nothing, and the bad guys are happy to use that to their advantage. Set aside the morality and the legality of downloading copyrighted content without paying for it… is it really worth the risk that your computer won’t be yours anymore?

Law #2: If a bad guy can alter the operating system on your computer, it’s not your computer anymore.

Consider how many “fixes” are “documented” online to correct this behavior or to patch that bug. How many posts consist of “download this file from my site to fix that error” and how many of those sites have nothing at all to do with the vendor of your operating system? This is NOT just a problem for Windows users, so don’t think that all repos can be trusted. When you are considering patching, upgrading, or recompiling your operating system, whether it’s a binary or new source you want to compile from scratch… if you cannot read and understand the code yourself, and it’s not coming from the maker directly, don’t trust it. If it is coming from the vendor, make sure that either the digital signatures or the checksums of the downloads check out okay or abandon the file(s) as bad.

Law #3: If a bad guy has unrestricted physical access to your computer, it’s not your computer anymore.

If they can touch it, they can own it. Any system a bad guy has direct physical access to is his or hers to do with as they please. Don’t leave your computer unlocked when you are away from it. Don’t leave it out in the open in a hotel room when you travel. Ensure your workplace provides adequate physical security for all systems. You know that PC the receptionist uses that is sitting in the elevator lobby which anyone can walk up to? Yeah, if your building is not locked down so you need a badge to even get onto your floor, then that PC needs to be locked away every day at the end of the shift.

Law #4: If you allow a bad guy to run active content on your website, it’s not your website any more.

Limit what can and cannot be uploaded to your website or forums. Quarantine and scan any files that are uploaded by users. Regularly and frequently run security scans of your website and all content, and ensure it cannot be exploited by injection or cross-site scripting. One of the most common ways end users’ machines are infected is by visiting a trusted site that is unaware it is hosting bad things.

 Law #5: Weak passwords trump strong security.

There is no variant of P@ssw0rd or p@$$word or Password1 or even b70w$$@q that hasn’t been used by someone enough times that it won’t be in the first 10,000 passwords tried by a brute force attack. And since it will take less than .007 seconds to go through those 10,000 passwords using even the underpowered processing capabilities of a discount tablet, you really want better. I’m going to let you in on a little secret. All passwords are weak. There is no such thing as a strong password, at least when you measure it up against the strength of a dedicated adversary determined to crack it.
The best thing you can do is use multifactor authentication, period. Whether you use a smart card, or a token, or an app on your mobile phone, even if someone does guess a user’s password (or tricks them into giving it away) without that second factor of authentication, it’s of no use to them. You can even go with biometrics if you have the budget for it, but 2FA using a mobile device can be used from any system, and doesn’t have the SciFi creep factor associated with it!

Law #6: A computer is only as secure as the administrator is trustworthy.

Reference checks, employment checks, credit checks, criminal record checks, background investigations… how far does your HR team take their responsibility of looking into new hires? You may not need to do a full scope background investigation on the receptionist or the delivery driver, but IT sysadmins have access to everything that is on the network. They can read the CEO’s emails, pull the payroll history for anyone in the company, learn just what the secret recipe of the Colonel’s chicken is that makes you crave it fortnightly! Ensure that anyone with privileges to any system is fully checked out before hiring.

Law #7: Encrypted data is only as secure as its decryption key.

Which means if the key exchange is weak, or the key itself is, then your encryption is at risk. The only thing worse than an insecure key is using a proprietary algorithm. Stick with commercially recognized encryption protocols, and if you must use and exchange a pre-shared key, do so out of band to the data exchange. In other words, don’t email someone the password to decrypt the file you just emailed them! Call them, text them, send them smoke signals, anything but sending the password using the same method as you sent the data.

Law #8: An out-of-date antimalware scanner is only marginally better than no scanner at all.

I always go one further than this and say it’s worse. If I am on a machine that has no antimalware, I won’t download or install anything that I am not absolutely sure of. I’d say most others would feel the same way. But if antimalware is on the machine, I may not be as circumspect, opting instead to count on the antimalware to keep me safe. Of course, if it is out of date, it’s useless, but that won’t stop me from being stupid!

Law #9: Absolute anonymity isn’t practically achievable, online or offline.

Sure, you can live in a cave and bounce your signal off a neighbor’s insecure Wi-Fi, routing it through three different TOR networks and an open web proxy, then through a Ukrainian satellite before you reach your goal… but wait, this isn’t a Hollywood spy thriller so that isn’t practical or even realistic. There is always a log somewhere, and anything you do online you should assume will stay online forever, and eventually be seen by your grandmother. Don’t be stupid, don’t be rude, and don’t do something your meemaw would be ashamed of!

Law #10: Technology is not a panacea.

There is no firewall that cannot be bypassed. There is no hardening procedure that is bulletproof. There does not exist encryption that cannot be broken given enough CPU cycles, nor is there code written without vulnerabilities. Technology is not a panacea and there is no one solution that can make you 100% guaranteed secure. Work on the human aspect, minimize the opportunities for attackers to find something to exploit, keep up to date on patching and malware definitions, and use a layered defense to do the best you can.

Learn them. Live them. Love them. Make them a part of who you are, and help instill in your users, your friends, and your family an awareness of the same. These ten laws are not just for sysadmins, they are for anyone using technology. But stay tuned!

In future post in this series, we are going to take a look at a related set of laws laid down by Microsoft Director  Scott Culp – The 10 Immutable Laws of Security Administration.

BlueHat IL 2018 - David Weston - Windows: Hardening with Hardware Video

The security features of modern PC hardware are enabling new trust boundaries and attack resistance capabilities unparalleled in software alone. These hardware capabilities help to improve resistance to a wide range of attacks including physical attacks against DMA and disk encryption, kernel and remote code exploits, and even application isolation through virtualization. In this talk, we will review the metamorphosis and fundamental re-architecture of Windows to take advantage of emerging hardware security capabilities. We will also examine in-depth the hardware security features provided by vendors such as Intel, AMD, ARM and others, and explain how Windows takes advantage of these features to create new and powerful security boundaries and exploit mitigations. Finally, we will discuss the new attack surface that hardware provides and review exploit case studies, lessons learned, and mitigations for attacks that target PC hardware and firmware.

Link to Video

Detecting Lateral Movement through Tracking Event Logs

Many recent cyberattacks have been confirmed in which malware infects a host and in turn spreads to other hosts and internal servers, resulting in the whole organization becoming compromised. In such cases, many points need to be investigated. Accordingly, an approach for quickly and thoroughly investigating such critical events, ascertaining the overall picture of the damage as accurately as possible, and collecting facts necessary for devising remedial measures is required.

While the configuration of the network that is targeted by an attack varies depending on the organization, there are some common patterns in the attack methods. First, an attacker that has infiltrated a network collects information of the host it has infected using "ipconfig", "systeminfo", and other tools installed on Windows by default. Then, they examine information of other hosts connected to the network, domain information, account information, and other information using "net" and other tools. After choosing a host to infect next based on the examined information, the attacker obtains the credential information of the user using "mimikatz", "pwdump", or other password dump tools. Then, by fully utilizing "net", "at", or other tools, the attacker infects other hosts and collects confidential information.

For such conventional attack methods, limited set of tools are used in many different incidents. The many points that need to be investigated can be dealt with quickly and systematically by understanding typical tools often used by such attackers, and what kind of and where evidence is left.

For such use of tools, the Japan Computer Emergency Response Team Coordination Center (JPCERT/CC) extracted tools used by many attackers by investigating recently confirmed cases of targeted attacks. Then, a research was conducted to investigate what kind of logs were left on the server and clients by using such tools, and what settings need to be configured to obtain logs that contain sufficient evidential information. This report is a summary of the results of this research.
The details of traces (event logs and forensic architecture) generated upon execution of the tools are compiled in "Tool Analysis Result Sheet" and published on GitHub.

Tool Analysis Result Sheet

This repository summarizes the results of examining logs recorded in Windows upon execution of the 49 tools which are likely to be used by the attacker that has infiltrated a network.
Tool Analysis Result Sheet is created in HTML and can be checked from the following URL.

A report that outlines and usage of this research is published below. When using Tool Analysis Result Sheet, we recommend you to check the report.

We hope this document is useful in incident investigation.
Article was copied from the Japan Computer Emergency Response Team Coordination Center

Friday, February 2, 2018

Cisco VPN Danger

Earlier this week Cisco revealed a major vulnerability affecting devices configured with their WebVPN clientless VPN software. This VPN software is featured in the Secure Sockets Layer (SSL) of numerous Cisco hardware devices. Companies around the world use WebVPN so that their employees can connect to the corporate intranet from the outside. The successful exploitation of this vulnerability could have potentially devastating consequences for an organization.
When WebVPN functionality is enabled, devices are vulnerable to a flaw that allows hackers to "double-free" memory on the system. To accomplish this, an attacker submits custom crafted XML messages to the WebVPN interface of the target device. The messages instruct the system to free a specific memory address multiple times, which may lead to memory leakage, giving an attacker the power to write malicious commands to memory. With this power an attacker has the ability to execute arbitrary code, monitor traffic, and corrupt memory. This flaw can even be exploited for the purposes of a DDoS attack by forcing the system to continuously reboot itself.

Figure 1: Affected Cisco Devices


The vulnerability has been labeled CVE-2018-0101 and has been given a 10/10, or critical rating, on the Common Vulnerability Scoring System (CVSS) scale. WebVPN is often enabled on edge firewalls, meaning that is possible for an attacker to exploit this from the outside over the Internet. Although this vulnerability seems simple to exploit, successfully crafting the necessary XML messages would require a deep understanding of the system memory layout of an affected device. Patches for the vulnerability have been released; however it is the responsibility of the company to make sure they are applied. We have yet to observe any exploits built to take advantage of this flaw, but this warning should not be taken lightly as successful exploitation would likely lead to massive consequences.

• vulnerability-alert-for-vpn-devices/
• vulnerability-patched-against-remote-attacks

Source CIP report

Thursday, February 1, 2018

Changes to Office and Windows servicing and support

This is a summary of a blog post on Microsoft site the full article can be found here.

Servicing extensions for Windows 10

Windows 10 is being adopted rapidly by organizations of all sizes, and as customers deploy the product they are implementing a modern servicing methodology we refer to as Windows as a service.
Many customers – including MARS, Independence Blue Cross, and Accenture – have made significant progress in moving to Windows as a Service, but some have requested an extension to the standard 18 months of support for Windows 10 releases.  To help these customers, we are announcing an additional six months of servicing for the Enterprise and Education editions of Windows 10, versions 1607, 1703, and 1709. (Additional servicing for Windows 10, version 1511 was announced in November.)  This extension will be offered via normal channels.  The chart below outlines the impact of these extensions for each of the last four Windows 10 releases.
Release date
End of support
End of additional servicing for Enterprise, Education
Windows 10, version 1511
November 10, 2015
October 10, 2017
April 10, 2018
Windows 10, version 1607
August 2, 2016
April 10, 2018
October 9, 2018
Windows 10, version 1703
April 5, 2017
October 9, 2018
April 9, 2019
Windows 10, version 1709
October 17, 2017
April 9, 2019
October 8, 2019
We will also offer additional paid servicing options for Windows 10 Enterprise and Education releases starting with Windows 10 version 1607. For more information, contact your Microsoft account team.
Office 2019
Last year at Ignite, we announced Office 2019 – the next perpetual version of Office that includes apps (including Word, Excel, PowerPoint, and Outlook, and Skype for Business) and servers (including Exchange, SharePoint, and Skype for Business). Today we’re pleased to share the following updates:
  • Office 2019 will ship in H2 of 2018. Previews of the new apps and servers will start shipping in the second quarter of 2018.
  • Office 2019 apps will be supported on:
    • Any supported Windows 10 SAC release
    • Windows 10 Enterprise LTSC 2018
    • The next LTSC release of Windows Server
  • The Office 2019 client apps will be released with Click-to-Run installation technology only. We will not provide MSI as a deployment methodology for Office 2019 clients. We will continue to provide MSI for Office Server products.
Office 2019 will provide 5 years of mainstream support and approximately 2 years of extended support. This is an exception to our Fixed Lifecycle Policy to align with the support period for Office 2016. Extended support will end 10/14/2025

Tuesday, January 30, 2018

Data Privacy Day 2018 – Live From LinkedIn Event Highlights

In honor of Data Privacy Day – an international effort held annually on Jan. 28 to generate awareness about the importance of respecting privacy, safeguarding data and enabling trust – the National Cyber Security Alliance (NCSA) hosted a daylong event streamed live from LinkedIn’s offices in San Francisco, CA, on Thursday, Jan. 25. The event showcased fast-paced, cutting-edge discussions and TED-style talks with leading experts focusing on what businesses and consumers must know about privacy.

The day's discussions focused on the following privacy hot topics:
  • Looking Into a Crystal Ball: What Your Data Says About You
  • Five Things You Can Do to Manage Your Privacy Now
  • What You Should Know About the Internet of Me and Your Privacy
  • Tracking My Location – Business Uses and Consumer Choices
  • Staying Competitive – Why Privacy Is Good for Your Business
  • The Problem With Your Online Privacy
  • Balancing Act: Privacy and Innovation
  • What's an Algorithm Got to Do With It?

Missed the event? Check out the full video here – and the full event recap, including photos, here