Feed aggregator

Infocon: green

ISC Stormcast For Wednesday, May 24th 2017 https://isc.sans.edu/podcastdetail.html?id=5514
Categories: Security Posts

<div class="feedflare">

Room362.com - 2 hours 58 min ago
Categories: Security Posts

about

Room362.com - 2 hours 58 min ago
Mubix “Rob” Fuller Rob has over 11 years of experience covering all facets of information security. He has been behind the lines helping to design, build, and defend the US Marine Corps, US Senate, and Pentagon networks - as well as performing penetration tests and Red Team assessments against those same networks. More recently, Rob has performed numerous successful Red Team assessments against commercial Fortune 50 companies representing some of the best defensive teams in the industry.
Categories: Security Posts

Cómo ejecutar en red Telefónica WannaCry File Restorer usando Active Directory

Un informático en el lado del mal - 5 hours 41 min ago
La semana pasada publicábamos Telefónica WannaCry File Restorer, un script escrito en Powershell con el que se podía recuperar archivos temporales afectados por el ransomware Wannacry. El script funciona bastante bien en los casos en los que el ransomware ha sido “cortado”, es decir, en un momento dado el proceso ha dejado de funcionar, ya sea porque haya sido parado con un error - muchos casos -  o porque se haya apagado o hibernado el equipo.

Figura 1: Cómo ejecutar en red Telefónica WannaCry File Restorer usando Active Directory
Lo interesante, y por lo que primero nos focalizamos en crear un script en Powershell - además de luego dotar a los usuarios de una versión escritorio de Telefónica WannaCry File Restorer,  es que cualquier equipo de IT que se haya visto afectado por este ransomware puede lanzarlo en su dominio/s con el objetivo de recuperar archivos, sin necesidad de que el usuario final participe en el proceso, aprovechando las posibilidades de Active Directory.


Figura 2: Telefonica WannaCry File Restorer (PowerShell Script)

Para mostrar cómo hacerlo hemos querido montar un pequeño entorno que conste de un dominio Microsoft con un Domain Controller en Windows Server 2016  en y con un par de máquinas Windows cliente.


Figura 3: Telefónica WannaCry File Restores Desktop Version

Por supuesto, se podría proveer la herramienta de escritorio a todos los usuarios, pero la idea es mostrar cómo un administrador del dominio podría lanzar el script Telefonica WannaCry File Restorer con el objetivo de que se ejecute en cada máquina del dominio de forma, totalmente, transparente al usuario, como vamos a ver en la PoC.

PoC:  Ejecutado en TWCFR usando AD

El escenario es sencillo: un controlador de dominio desde dónde invocaremos el script con una instrucción de Powershell, un par de máquinas con sistemas operativos cliente de Windows. Todo el proceso, por parte del equipo de IT, ocurre de forma transparente al usuario, lo cual es un proceso interesante, ya que no genera ruido en el trabajo del usuario.

En la siguiente imagen, se puede ver como invocamos al script de Telefonica Wannacry File Restorer. El comando Invoke-Command es utilizado en Powershell para ejecutar cualquier comando en Powershell y tiene la característica de poder ser ejecutado en un entorno remoto. Si las credenciales que se proporcionan son las de un administrador de dominio, el script podrá ser ejecutado en otras máquinas pertenecientes al dominio.

Figura 4: comando para invocar el script TWCFR desde Powershell
El parámetro –FilePath indica el script que debe ser ejecutado. Cuando el script comienza su ejecución podemos detectar sobre qué path se está ejecutando, en este caso sobre la carpeta %localappdata%\temp del usuario1. Esto puede verse en la siguiente imagen.

Figura 5: El script ejecutándose sobre la carpeta del usuario1
Sin duda, muchos equipos de IT afectados por la lacra del ransomware puede utilizar el dominio para llevar a cabo tareas de limpieza o restauración. En el caso de WannaÇry, cualquier equipo de IT afectado puede utilizar este método para recuperar archivos temporales que hayan quedado en los equipos. Os dejamos un video del funcionamiento del despliegue del script en un dominio Microsoft.

Figura 6: PoC ejecución de TWCFR en un Active Directory
Por supuesto, nosotros recomendamos el uso de herramientas de prevención para evitar cualquier ransomware que pueda afectar en el futuro a tus documentos, y como es el caso de Latch ARW.

Figura 7: Latch AntiRansomware protegiendo frente a WannaCry
Además, la utilización de políticas de backup (en un almacenamiento protegido) adecuadas es fundamental para poder luchar en igualdad de condiciones contra la lacra del ransomware.

Autores: Pablo González Pérez (@pablogonzalezpe), escritor de los libros "Metasploit para Pentesters", "Ethical Hacking", "Got Root" y “Pentesting con Powershell”, Microsoft MVP en Seguridad y Security Researcher en ElevenPaths y Fran Ramirez (@cyberhadesblog) escritor de libro "Microhistorias: anécdotas y curiosidades de la historia de la informática" e investigador en ElevenPaths
Sigue Un informático en el lado del mal - Google+ RSS 0xWord
Categories: Security Posts

ISC Stormcast For Wednesday, May 24th 2017 https://isc.sans.edu/podcastdetail.html?id=5514, (Wed, May 24th)

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Categories: Security Posts

Jaff ransomware gets a makeover, (Wed, May 24th)

Introduction Since 2017-05-11, a new ransomware named Jaff has been distributed through malicious spam (malspam) from the Necurs botnet. This malspam uses PDF attachments with embedded Word documents containing malicious macros. border-width:2px" />
Shown above: Flow chart for this infection chain. Prior to Jaff, weve seen waves of malspam using the same PDF attachment/embedded Word doc scheme to push Locky ransomware. Prior to that, this type of malspam was pushing Dridex. With all the recent news about WannaCry ransomware, people might forget Jaff is an ongoing threat. Worse yet, some people might not know about it at all since its debut about 2 weeks ago. Jaff has already gotten a makeover, so an infected host looks noticeably different now. With that in mind, todays diary reviews a wave of malspam pushing Jaff ransomware from Tuesday 2017-05-23. The emails This specific wave of malspam used a fake invoice theme. It started on Tuesday 2017-05-23 as early as 13:22 UTC and lasted until sometime after 20:00 UTC. I collected 20 emails for today border-width:2px" />
Shown above: border-width:2px" />
Shown above: border-width:2px" />
Shown above: Screenshot from one of the emails. As stated earlier, these emails all have PDF attachments, and each one contains an embedded Word document. border-width:2px" />
Shown above: border-width:2px" />
Shown above: The embedded Word document with malicious macros. The traffic Follow the entire infection chain, and youll see minimal network traffic compared to other types of malware. The Word macros generate an initial URL to download an encoded Jaff binary, then we see one other URL for post-infection callback from an infected host. The initial HTTP request for Jaff returns an encoded binary thats been XORed with the ASCII string I6cqcYo7wQ. Post-infection traffic merely returns the string Created border-width:2px" />
Shown above: border-width:2px" />
Shown above: border-width:2px" />
Shown above: border-width:2px" />
Shown above: Alerts on the traffic using Security Onion with Suricata and the EmergingThreats Open ruleset. The infected Windows host The encoded binary from this wave of malspam was stored to the users AppData\Local\Temp directory as lodockap8. Then it was decoded and stored as levinsky8.exe in the same directory. border-width:2px" />
Shown above: The users AppData\Local\Temp directory from an infected host on 2017-05-23. On Tuesday 2017-05-23, Jaff ransomware had a makeover. border-width:2px" />
Shown above: border-width:2px" />
Shown above: Desktop of a Windows host infected with a Jaff ransomware sample from 2017-05-23. Encrypted files had been previously appended with the .jaff file extension. On Tuesday 2017-05-23, encrypted files from my infected host were appended with a .wlu file extension. border-width:2px" />
Shown above: Jaff decryptor from a Windows host infected on 2017-05-23. Indicators of Compromise (IoCs) The following are examples of email subject lines and attachment names from Tuesday 2017-05-23:
  • Subject: Invoice(00-5523) -- Attachment name: 68-5182.pdf
  • Subject: Invoice(00-5832) -- Attachment name: 72-6353.pdf
  • Subject: Invoice(08-4031) -- Attachment name: 28-3137.pdf
  • Subject: Invoice(09-5337) -- Attachment name: 98-9897.pdf
  • Subject: Invoice(19-9273) -- Attachment name: 68-6414.pdf
  • Subject: Invoice(23-0458) -- Attachment name: 53-3366.pdf
  • Subject: Invoice(27-7813) -- Attachment name: 95-1750.pdf
  • Subject: Invoice(28-3137) -- Attachment name: 68-4200.pdf
  • Subject: Invoice(53-3366) -- Attachment name: 61-7808.pdf
  • Subject: Invoice(54-9434) -- Attachment name: 78-8672.pdf
  • Subject: Invoice(61-7808) -- Attachment name: 00-5832.pdf
  • Subject: Invoice(68-4200) -- Attachment name: 98-3753.pdf
  • Subject: Invoice(68-5182) -- Attachment name: 54-9434.pdf
  • Subject: Invoice(68-6414) -- Attachment name: 27-7813.pdf
  • Subject: Invoice(72-6353) -- Attachment name: 08-4031.pdf
  • Subject: Invoice(78-8672) -- Attachment name: 23-0458.pdf
  • Subject: Invoice(88-6908) -- Attachment name: 19-9273.pdf
  • Subject: Invoice(95-1750) -- Attachment name: 00-5523.pdf
  • Subject: Invoice(98-3753) -- Attachment name: 88-6908.pdf
  • Subject: Invoice(98-9897) -- Attachment name: 09-5337.pdf
The following are examples of spoofed email senders from Tuesday 2017-05-23:
  • ALISA PICKARD ALISA.PICKARD@ADAMSINSTALLATIONS.CO.UK
  • ALYSSA BUTLING ALYSSA.BUTLING@MATTRICHLING.COM
  • CAROLYN BOSTON CAROLYN.BOSTON@FLORIN.FR
  • DENIS SENIOR DENIS.SENIOR@INFOTEC.NO
  • DUSTY HAMMOND DUSTY.HAMMOND@EASTWELLIRONWORKS.CO.UK
  • ELAINE BARKER ELAINE.BARKER@SCHIONNINGDEVELOPMENT.DK
  • FREDRIC RALLI FREDRIC.RALLI@RVAGROCERYSHOPPER.COM
  • GENA CLYDE GENA.CLYDE@CORTE.CH
  • HERMINIA UREN HERMINIA.UREN@BIGBOYPUZZLES.COM
  • JENNA LAMPET JENNA.LAMPET@ALIF-INTERNATIONAL.COM
  • LILLIE TRAVERS LILLIE.TRAVERS@CHANGEAGENTS.BIZ
  • LUPE FERN LUPE.FERN@DWTAXPREP.COM
  • MEAGAN FALKENBERG MEAGAN.FALKENBERG@MIKEPRICE.INFO
  • MICAH HOG MICAH.HOG@SBINFRACON.COM
  • MOLLIE BOSCAWEN MOLLIE.BOSCAWEN@STRAYFAMILY.COM
  • ROBIN PETER ROBIN.PETER@JUSTPLUMBIT.CO.UK
  • SILVIA GASKIN SILVIA.GASKIN@RSDRUKKERIJ.NL
  • TONY SCOWBY TONY.SCOWBY@RELATIVITYCOMPUTING.COM
  • VICKY GILLESPIE VICKY.GILLESPIE@CASAXALTEVA.ORG
  • VIOLET BAGBY VIOLET.BAGBY@JAMES-FOLEY.CO.UK
The following are examples of SHA256 hashes for the PDF attachments from Tuesday 2017-05-23:
  • 0218178eec35acad7909a413d94d84ae3d465a6ea37e932093ec4c7a9b6a7394
  • 0a326eb9a416f039be104bb5f199b7f3442515f88bd5c7ad1492b1721c174b8e
  • 21da9eeded9581f6f032dea0f21b45aa096b0330ddacbb8a7a3942a2026cc8ca
  • 4458f43127bb514b19c45e086d48aba34bf31baf1793e3d0611897c2ff591843
  • 66320f4e85e3d6bd46cf00da43ca421e4d50c2218cb57238abb2fb93bef37311
  • 7dd248652f2b42f3e1ad828e686c8ba458b6bb5b06cea46606ceccdd6b6e823c
  • 8a474cdd4c03dd4a6ba6ad8945bf22f74f2f41830203f846d5437f02292bb037
  • 956e43ece563fd46e6995fae75a0015559f0a63af5059290a40c64b906be5b9b
  • 9beb67a68396375f14099055b712e22673c9a1d307a76125186127e289ab41a2
  • b2b9c02080ae6fbe1845c779e31b5f6014ec20db74d21bd9dd02c444a0d0dd9b
  • c126e731c1c43d52b52a44567de45796147aca1b331567ed706bf21b6be936b4
  • cde2ff070e86bc1d72642cb3a48299080395f1df554e948fd6e8522579dfe861
  • daf01a1f7e34e0d47ecdfcef5d27b2f7a8b096b4e6bc67fb805d4da59b932411
  • e477300e8f8954ee95451425035c7994b984d8bc1f77b4ccf2a982bb980806fe
The following are examples of SHA256 hashes and file names for the embedded word documents from Tuesday 2017-05-23:
  • 084ee31e69053e66fafe6e1c2a69ffec015f95801ce6020f7765c56d6f3c23ff - PQQIDNQM.docm
  • 0855061389b62ec6a9b95552357ff7571ae5c034b304978a533c6cba06c3f9e8 - GYTKPVM.docm
  • 1f2598dc7a7b8f84307d8c2fa41f5550c320f8192cd41e50b47570d3836e6fcc - RNJSMOVS.docm
  • 2dbf9e1c412aa1ffd32a91043642eb9cc80772c87dbbce3dd098c57d917277fb - DLDD7LH.docm
  • 3f95a7eeb1965193a4e92862c10897e04708b37b793b8e45f890d019358214c0 - DC2ZPQ.docm
  • 56cd249ff82e9bb96a73262090bc6a299ead64d6c75161520e745c2066f22430 - KAR6WLU.docm
  • 795d8312749c122fa10a93c9f3aa1c0f4ffc081714c0ddb66c141334f8ef0633 - M4SQLA2.docm
  • 8906d10a48487d8240bddd0c0cb5c076e88104c86bdf871b0143d74b6df3cc98 - NQBCXP4.docm
  • 91aa966e837c4144a1294aa912a2162397f3a6df98cf336891d234e267cd919f - RNOHLIAFU.docm
  • 933fcc1bf90716abf7c4eaf29b520d2276df895fb4dd5a76be2a55028a4da94e - PCHLUPL.docm
  • a98782bd10004bef221e58abcecc0de81747e97910b8bbaabfa0b6b30a93b66b - Q1DOEY13.docm
  • ae244ca170b6ddc285da0598d9e108713b738034119bae09eaa69b0c5d7635f8 - TH1DZZPT.docm
  • bc0b2fbe4225e544c6c9935171a7d6162bc611a82d0c6a5f3d62a3f5df71cf8c - OLZNKWSOW.docm
  • c702deaa2fe03f188a670d46401e7db71628e74b0e5e2718a19e2944282e05cd - VUG3FBFO.docm
The following is the sample of Jaff ransomware I saw on Tuesday 2017-05-23: The following are URLs generated by malicious macros from the embedded Word documents. Theyre used to download the encoded Jaff ransomware binary:
  • billiginurlaub.com - GET /fgJds2U
  • david-faber.de - GET /fgJds2U
  • elateplaza.com - GET /fgJds2U
  • electron-trade.ru - GET /fgJds2U
  • fjjslyw.com - GET /fgJds2U
  • hr991.com - GET /fgJds2U
  • jinyuxuan.de - GET /fgJds2U
  • khaosoklake.com - GET /fgJds2U
  • minnessotaswordfishh.com - GET /af/fgJds2U
  • oliverkuo.com.au - GET /fgJds2U
  • pcflame.com.au - GET /fgJds2U
  • tdtuusula.com - GET /fgJds2U
  • williams-fitness.com - GET /fgJds2U
The following is post-infection traffic from my infected Windows host:
  • 185.109.147.122 port 80 - maximusstafastoriesticks.info - GET /a5/
  • rktazuzi7hbln7sy.onion (tor domain for the decryption instructions)
Final words Much of this malspam is easy to spot among the daily deluge of spam most organizations receive. However, this PDF attachment/embedded Word doc scheme is likely an attempt to bypass spam filtering. As always, if your organization follows best security practices, youre not likely to get infected. For example, software restriction policies that deny binary execution in certain Windows directories can easily stop this infection chain. Even without software restriction policies, the intended victim receives warnings from both Adobe reader and Microsoft Word during the infection process. So why do we continue to see this malspam on a near-daily basis? I suppose as long as its profitable for the criminals behind it, well continue to see this type of malspam. If anyone knows someone whos been infected with Jaff ransomware, feel free to share your story in the comments section. Emails, malware samples, and pcaps associated with the 2017-05-23 Jaff ransomware malspam can be found here. ---
Brad Duncan
brad [at] malware-traffic-analysis.net (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Categories: Security Posts

Automating Security Operations: What It Takes to Defend Against Something Like WannaCry

Fortinet FortiGuard Blog - 11 hours 8 min ago
A major challenge facing security vendors today is that most solutions and products are developed based on knowledge of previous threats that already exist. This makes many security solutions reactive by their very design, which is not a tenable strategy for facing the volume of new attacks and strategies arising today. This arms race of identifying new threats, then reacting has been the primary strategy since the dawn of malware: A new virus is identified and then security vendors write the antivirus signature to block it; a polymorphic virus...
Categories: Security Posts

Breaking the iris scanner locking Samsung’s Galaxy S8 is laughably easy

ArsTechnica: Security Content - Tue, 2017/05/23 - 23:10
Enlarge (credit: Chaos Computer Club) Hackers have broken the iris-based authentication in Samsung's Galaxy S8 smartphone in an easy-to-execute attack that's at odds with the manufacturer's claim that the mechanism is "one of the safest ways to keep your phone locked." The cost of the hack is less than the $725 price for an unlocked Galaxy S8 phone, hackers with the Chaos Computer Club in Germany said Tuesday. All that was required was a digital camera, a laser printer (ironically, models made by Samsung provided the best results), and a contact lens. The hack required taking a picture of the subject's face, printing it on paper, superimposing the contact lens, and holding the image in front of the locked Galaxy S8. The photo need not be a close up, although using night-shot mode or removing the infrared filter helps. The hackers provided a video demonstration of the bypass. Starbug, the moniker used by one of the principal researchers behind the hack, told Ars he singled out the Samsung Galaxy S8 because it's among the first flagship phones to offer iris recognition as an alternative to passwords and PINs. He said he suspects future mobile devices that offer iris recognition may be equally easy to hack. Despite the ease, both Samsung and Princeton Identity, the manufacturer of the iris-recognition technology used in the Galaxy S8, say iris recognition provides "airtight security" that allows consumers to "finally trust that their phones are protected." Princeton Identity also said the Samsung partnership "brings us one step closer to making iris recognition the standard for user authentication." Read 4 remaining paragraphs | Comments
Categories: Security Posts

Examining the FCC claim that DDoS attacks hit net neutrality comment system

ArsTechnica: Security Content - Tue, 2017/05/23 - 21:00
Enlarge (credit: Getty Images | Valery Brozhinsky) On May 8, when the Federal Communications Commission website failed and many people were prevented from submitting comments about net neutrality, the cause seemed obvious. Comedian John Oliver had just aired a segment blasting FCC Chairman Ajit Pai's plan to gut net neutrality rules, and it appeared that the site just couldn't handle the sudden influx of comments. But when the FCC released a statement explaining the website's downtime, the commission didn't mention the Oliver show or people submitting comments opposing Pai's plan. Instead, the FCC attributed the downtime solely to "multiple distributed denial-of-service attacks (DDoS)." These were "deliberate attempts by external actors to bombard the FCC's comment system with a high amount of traffic to our commercial cloud host," performed by "actors" who "were not attempting to file comments themselves; rather, they made it difficult for legitimate commenters to access and file with the FCC." The FCC has faced skepticism from net neutrality activists who doubt the website was hit with multiple DDoS attacks at the same time that many new commenters were trying to protest the plan to eliminate the current net neutrality rules. Besides the large influx of legitimate comments, what appeared to be spam bots flooded the FCC with identical comments attributed to people whose names were drawn from data breaches, which is another possible cause of downtime. There are now more than 2.5 million comments on Pai's plan. The FCC is taking comments until August 16 and will make a final decision some time after that. Read 37 remaining paragraphs | Comments
Categories: Security Posts

Executive Insights: An Interview with Phil Quade

Fortinet FortiGuard Blog - Tue, 2017/05/23 - 18:37
We regularly do deep dive Q&A pieces with our executives to share the leadership perspectives at Fortinet. Read below for an interview with Phil Quade, Fortinet's CISO. 
Categories: Security Posts

What did we Learn from WannaCry? - Oh Wait, We Already Knew That!, (Tue, May 23rd)

SANS Internet Storm Center, InfoCON: green - Tue, 2017/05/23 - 16:59
In the aftermath of last weeks excitement over the WannaCry malware, Ive had a lot of lessons learned meetings with clients. The results are exactly what youd expect, but in some cases came as a surprise to the organizations we met with.
There was a whole outcry about not victim shaming during and after this outbreak, and I get that, but in most cases infections were process failures that the IT group didnt know they had, these lessons learned sessions have contributed to improving the situation at many organizations. The short list is below - affected companies had one or more of the issues below:
1/ Patch
Plain and simple, when vendor patches come out, apply them. In a lot of cases, Patch Tuesday means Reboot Wednesday for a lot of organizations, or worst case Reboot Saturday. If you dont have a test the patches process, then in a lot of cases simply waiting a day or two (to let all the early birds test them for you) will do the job. If you do have a test process, in todays world it truly needs to take 7 days or less.
There are some hosts that you wont be patching. The million dollar MRI machine, the IV pump or the 20 ton punch press in the factory for instance. But you know about those, and youve segmented them away (in an appropriate way) from the internet and your production assets. This outbreak wasnt about those assets, what got hammered by Wannacry was the actual workstations and servers, the hospital stations in admitting and emergency room, the tablet that the nurse enters your stats into and so on. Normal user workstations that either werent patched, or were still running Windows XP. That being said, there are always some hosts that can be patched, but cant be patched regularly. The host thats running active military operations for instance, or the host thats running the callcenter for flood/rescue operations, e-health or suicide hotline. But you cant give just up on those - in most cases there is redundancy in place so that you can update half of those clusters at a time. If there isnt, you do still need to somehow get them updated on a regular schedule. Lesson learned? If your patch cycle is longer than a week, in todays world you need to revisit your process and somehow shorten it up. Document your exceptions, put something in to mitigate that risk (network segmentation is a common one), and get Sr Management to sign off on the risk and the mitigation. 2/ Unknown Assets are waiting to Ambush You A factor in this last attack were hosts that werent in ITs inventory. In my group of clients, what this meant was hosts controlling billboards or TVs running ads in customer service areas (the menu board at the coffee shop, the screen telling you about retirement funds where you wait in line at the bank and so on). If this had been a linux worm, wed be talking about projectors, TVs and access points today. One and all, I pointed those folks back to the Critical Controls list (https://www.cisecurity.org/controls/ ). In plain english, the first item is know whats on your network and the second item is know what is running on whats on your network. If you dont have a complete picture of these two, you will always be exposed to whatever new malware (or old malware) that tests the locks at your organization. 3/ Watch the News.
.... And I dont mean the news on TV. Your vendors (in this case Microsoft) have news feeds, and there are a ton of security-related news sites, podcasts and feeds (this site is one of those, our StormCast podcast is another). Folks that watch the news knew about this issue starting back in 2015, when Microsoft started advising us to disable SMB1, then again last year (2016) when Microsoft posted their Were Pleading with you, PLEASE disable SMB1 post. We knew specifically about the vulnerabilities used by Wannacry in January when the Shadowbrokers dump happened, we knew again when the patches were released in March, and we knew (again, much more specifically) when those tools went live in April. In short, we were TOLD that this was coming, by the time this was on the TV media, this was very old news. 4/ Segment your network, use host firewalls
In most networks, workstation A does not need SMB access to workstation B. Neither of them need SMB access to the mail server or the SQL host. They do need that access to the SMB based shares on the file and print servers though. If you must have SMB version 1 at all, then you have some other significant issues to look at.
Really what this boils down to is the Critical Controls again. Know what services are needed by who, and permit that. Set up deny rules on the network or on host firewalls for the things that people dont need - or best case, set up denies for everything else. I do realize that this is not 100% practical. For instance, denying SMB between workstations is a tough one to implement, since most admin tools need that same protocol. Many organizations only allow SMB to workstations from server or management subnets, and that seems to work really nicely for them. Its tough to get sign-off on that sort of restriction, management often will see this as a drastic measure. Disabling SMB1 should have happened months ago, if not year(s) ago. 5/ Have Backups
Many clients found out *after* they were infected by Wannacry that their users were storing data locally. Dont be that company - either enforce central data storage, or make sure your users local data is backed up somehow. Getting users to sign off that their local data is ephemeral only, that its not guaranteed to be there after a security event is good advice, but after said security event IT generally finds out that even with that signoff, everyone in the organization still holds them responsible. All to often, backups fall on the shoulders of the most Jr staff in IT. Sometimes that works out really well, but all to often it means that backups arent tested, restores fail (we call that backing up air), or critical data is missed. Best just to back it your data (all your data) and be done with it. 6/ Have a Plan You cant plan for everything, but everyone should have had a plan for the aftermath of Wannacry. The remediation for this malware was the classic nuke from orbit - wipe the workstations drives, re-image and move on. This process should be crystal-clear, and the team of folks responsible to deliver on this plan should be similarly clear. I had a number of clients who even a week after infection were still building their recovery process, while they were recovering. If you dont have an Incident Response Plan that includes widespread workstation re-imaging, its likely time to revisit your IR plan! 7/ Security is not an IT thing
Security of the assets of the company are not just an IT thing, theyre a company thing. Sr Management doesnt always realize this, but this week is a good time to re-enforce this concept. Failing on securing your workstations, servers, network and especially your data can knock a company offline, either for hours, days, or forever. Putting this on the shoulders of the IT group alone isnt fair, as the budget and staffing approvals for this responsibility is often out of their hands. Looking back over this list, it comes down to: Patch, Inventory, Keep tabs on Vendor and Industry news, Segment your network, Backup, and have an IR plan. No shame and no finger-pointing, but weve all known this for 10-15-20 years (or more) - this was stuff we did in the 80s back when I started, and weve been doing since the 60s. This is not a new list - weve been at this 50 years or more, we should know this by now. But from what was on TV this past week, I guess we need a refresher? Have I missed anything? Please use our comment form if we need to add to this list! ===============
Rob VandenBrink
Compugen (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Categories: Security Posts

LaCon2k16 Call For Pulpos

48Bits Blog - Fri, 2016/07/15 - 10:54
We are proud to present the call for papers for Lacon 2016!, get your papers in now. We are accepting short talks of 30min and long talks of ~1h. [when] conf will be held from the 23rd to the 25th of Sept 2016 [where] undisclosed location [who] a bunch of crazy bastards [topics] topics include:
  • h/p/v/c/e …
  • satellites, antennas and radioactive crap
  • cryptocurrencies
  • human powered vehicles
  • knitting
  • radare2
  • cats
  • cyborgs
  • 8===========D
[submit] submit your talk proposals to lacon2k16.org@lists.48bits.com [gpgkey] gpg –keyserver pgp.mit.edu –recv-key 0BC0E27E
Categories: Security Posts

A Scheme to Encrypt the Entire Web Is Actually Working

Wired: Threat Level - Thu, 2016/04/14 - 13:00
The non-profit certificate authority Let's Encrypt is enabling a sea change toward HTTPS encryption online. The post A Scheme to Encrypt the Entire Web Is Actually Working appeared first on WIRED.









Categories: Security Posts

Matthew Keys Sentenced to Two Years for Aiding Anonymous

Wired: Threat Level - Wed, 2016/04/13 - 23:30
The former Tribune Company employee was convicted of giving Anonymous information that helped hackers access an LA Times server and alter a headline. The post Matthew Keys Sentenced to Two Years for Aiding Anonymous appeared first on WIRED.









Categories: Security Posts

Hacker Lexicon: What Are White Hat, Gray Hat, and Black Hat Hackers?

Wired: Threat Level - Wed, 2016/04/13 - 23:03
Here's how to distinguish the colors of the hacker rainbow. The post Hacker Lexicon: What Are White Hat, Gray Hat, and Black Hat Hackers? appeared first on WIRED.









Categories: Security Posts

PowerLocker

PandaLabs - Wed, 2014/03/05 - 10:53
PowerLocker, also called PrisonLocker, is a new family of ransomware which in addition to encrypting files on the victim’s computer (as with other such malware) threatens to block users’ computers until they pay a ransom (like the ‘Police virus’). Although the idea of ​​combining the two techniques may have caused more than a few sleepless nights, in this case the malware is just a prototype. During its development, the malware creator has been posting on blogs and forums describing the progress and explaining the different techniques included in the code. The malware creator’s message in pastebin In this post for example, the creator describes how PowerLocker is a ransomware written in c/c++ which encrypts files on infected computers and locks the screen, asking for a ransom. The malware encrypts the files, which is typical of this type of malware, using Blowfish as an encryption algorithm with a unique key for each encrypted file. It stores each unique key generated with an RSA-2048 public/private key algorithm, so only the holder of the private key can decrypt all the files. Also, according to the creator, PowerLocker uses anti-debugging, anti-sandbox and anti-VM features as well as disabling tools like the task manager, registry editor or the command line window. However, all the publicity surrounding PowerLocker that the creator has been generating across forums and blogs before releasing it, has led to his arrest in Florida, USA. Consequently, today there is no definitive version of this malware and there is no evidence that it is in-the-wild. Nevertheless, we still feel it’s worth analyzing the current version of PowerLocker, as someone else could be in possession of the source code or even a later version.   PowerLocker analysis The first thing PowerLocker does is to check whether two files with RSA keys are already created, and if not, it generates the public and private key in two files on the disk (pubkey.bin and privkey.bin). Unlike other ransomware specimens, which use the Windows CrytoAPI service, PowerLocker uses the openssl library for generating keys and encrypting files. Once it has the keys, PowerLocker runs a recursive search of directories looking for files to encrypt, excluding, not very effectively, files with any of the file names used by the malware: privkey.bin, pubkey.bin, countdown.txt, cryptedcount.txt. It also avoids $recycle.bin, .rans, .exe, .dll, .ini, .vxd or .drv files to prevent causing irreparable damage to the computer. The creator has however forgotten to exclude certain extensions corresponding to files which are delicate enough to affect the functionality of the system, such as .sys files. This means that any computer infected with PowerLocker would be unable to reboot. Moreover, in this version it is possible to use a parameter to control whether the ransomware encrypts or decrypts files using the pubkey.bin and privkey.bin keys generated when it was first run. This version does not include the screen lock feature described by the creator, although it displays a console with debug messages, names of the files to encrypt/decrypt, etc. and asks you to press a key before each encryption or decryption.   Conclusions At present, there is only a half-finished version of PowerLocker which could practically be labelled harmless, and which lacks many of the most important features that the creator has described on the forums and blogs, such as anti-debugging, screen locking, etc. Despite it not being fully functional we would recommend having a system for backing up critical files, not just to offer assurance in the event of hardware problems, but also to mitigate the damage of these types of malware infections. Also bear in mind that if you don’t have a backup system and your system is infected, we certainly do not recommend paying the ransom, as this only serves to encourage the perpetrators of such crimes. PowerLocker analysis performed by Javier Vicente
Categories: Security Posts

Redirecting...

Redirecting...

April 2013 Super Tuesday

April 2013 Super Tuesday

IBM X-Force 2012 Annual Trend &amp; Risk report has released!

IBM X-Force 2012 Annual Trend &amp; Risk report has released!

March 2013 Super Tuesday Update

March 2013 Super Tuesday Update
Syndicate content