Analysis

Trends and Analysis

Bug Bounty Programs are Growing Up Fast and Paying More

As more organizations crowdsource the vulnerability-hunting of their software, the process itself has become more formal, as well as more lucrative for researchers.

Top 5 Dumbest Cyber Threats That Still Pay Off

Some hackers are fairly predictable in their successful use of really dumb attacks.

CTB-Locker is back: the web server edition

Cryptolockers have become more and more sophisticated, bypassing system protections and terrifying anyone in their path.

TeslaCrypt, CryptoWall, TorrentLocker, Locky and CTB-Locker are only some of the malware we have protected from for the past two years. We have seen many shapes and colors of cryptolockers, but the new CTB-Locker variant says it all.

The world of cybercriminals is investing in how to reinvent cryptolockers. Before, CTB-Locker, or Onion Ransomware, differed from other ransomware in the usage of the Tor Project’s anonymity network to shield itself from takedown efforts that rely largely on static malware command and control servers.
Its use of Tor also helped evading detection and blocking.

Another thing that protected CTB-Locker controllers was accepting as payment only Bitcoins, the decentralized and largely anonymous crypto-currency known. A new variant of the CTB-Locker targets web servers only, and to our knowledge it has already successfully encrypted web-root files in more than 70 servers located in 10 countries. In this blogpost I will take you into the “lion’s den”, after victims were kind enough to share the cryptors that had been deployed into their web servers. Step 1: defacement This new variant aims to encrypt web servers and demand less than half a bitcoin as a ransom (~150 USD).
If payment isn’t sent on time the ransom is doubled to approximately 300 USD. When paid, the decryption key is generated and is used to decrypt the web server’s files. It has become clear that the web servers infected with this variant were targeted due to a security hole in their web server. Once exploited, the website is defaced.

Defacement is a well-known method for hacking groups to show their victims they mean business.

The most recent cases we’ve witnessed are not random, but mostly about political affiliations and cultural perspectives. In this case, the defacement, which contains a replacement of the main php/html page, is used as the message carrier and contains all the means necessary for the attack to leave the right impression on the victim. We will deep-dive into it in the next steps. It is important to mention that the original code is not deleted.
It is stored safely in the web root with a different name in an encrypted state. The message As variants of malware of this kind are based on the simple fact that a victim cares more about his content than about paying a ransom, the authors usually leave a very detailed message for everyone to see. The following quote is a part of the information that is left on the main page: The decryption key is stored on a remote server, but the attackers were “kind enough” to allow the victim to decrypt two files free, as a sign of authenticity. The other function that exists on the attacked website allows the victim to communicate with the attacker via chat: it requires a personal signature/code which is available for victims only. At the moment, no decryption tool exists in the wild, thus there is no way to decrypt the files encrypted by the new CTB-Locker.

The only way to remove this threat in a matter of seconds is to keep file backups in a separate location. Although this seems like a big concern, we tend to believe that it is not. Large websites tend to have multiple versions of their content, spreading over a number of webservers.
In many other cases, they are supervised and tested by professional security penetration testing firms and so are constantly under the magnifier. Step 2: encryption process We still don’t know how the CTB-Locker is being deployed on web servers, but there is one common thing among many of the attacked servers – they use the WordPress platform as a content management tool. WordPress contains many vulnerabilities in its non-updated versions and we already seen critical vulnerabilities presented last year.
In addition, WordPress also has another weak spot – plugins.

Those tiny enhancement features helps WordPress become what it is – a leader in the world of CMS. However, having third party plugins also makes the server more vulnerable to attacks, as plugin authors are not committed to any type of security measurements. Once the malware author is inside WordPress system, he is able to replace the main website file and execute the encryption routine.

The main file is renamed and saved in an encrypted state. Two different AES-256 keys are deployed to the victim server: create_aes_cipher($keytest) – encrypts the two files which can be decrypted free. create_aes_cipher($keypass) – encrypts the rest of the files hosted on the server web root. The two files are chosen by the authors and their names are saved in a text file. The create_aes_cipher() accepts one parameter as the key and sends it to the standard Crypt_AES() function: function create_aes_cipher($key) { $aes = new Crypt_AES(); $aes->setKeyLength(256); $aes->setKey($key); return $aes; } function create_aes_cipher($key) {          $aes = new Crypt_AES();          $aes–>setKeyLength(256);          $aes–>setKey($key);          return $aes; When encrypting the site, the script first uses the test key to encrypt the two files that will be used for free decryption.
It will then generate a list of files that match specific file extensions and encrypt them using AES-256 encryption.

The extensions that will be encrypted are read from the ./extensions.txt file and are currently: Files that contain the following strings will be excluded from the encryption process: “/crypt/” “secret_” In addition, files which are populated with data that will later assist the user with the decryption process would obviously be excluded as well. ./index.php – as described above, this file is the main door for the victim to analyze the attack and contains PHP code of the encryption/decryption routine. ./allenc.txt – contains a list of all encrypted files. ./test.txt – contains the files which are freely available for decryption. ./victims.txt – contains a list of all the files that are being encrypted or have already been encrypted. ./extensions.txt – contains the list of file extensions (see above). ./secret_ – as said, the victim is required to identify himself before the free decryption or chat is even possible. On the main page of the CTB-Locker, attackers are using JQUERY to query proxy servers and verify payments.

The following code was found in the page source code and the servers listed on the top are proxies which are used as another layer of protection, instead of the main server of the attackers: Proxy servers which are part of the decryption process: http://erdeni.ru/access.php http://studiogreystar.com/access.php http://a1hose.com/access.php The ransomware servers are not permanent and are being replaced by new ones every certain period of time. We have identified the threat actor inspecting the server logs and analytics, as sometimes different checks resulted in the server shutting down and turned back on. Step 3: proxy to C&C The attackers are utilizing servers which were already attacked to traffic through another layer of protection. On a victim server’s source code, a JavaScript code reveals how the decryption process is sent through three different servers randomly, however those are not the C&C. The above screenshot was taken from the access.php page, supposedly located in each one of the bot servers used as a proxy for the decryption process. In white block is the actual C&C which has been hardcoded on each of the PHP pages (access.php). When POST request is being sent with the right parameters, a socket instance is being created and sends a connect beam to the attacker’s C&C server. Later it is being determined if the decryption process succeeded. Free decrypt The ransomware allows the victim to freely decrypt not more than two files.
It is not for the victim to choose, since the files are pre-chosen and can be found in the malware’s designated file as listed above.

The two files are randomly picked during the course of the encryption process. The following image is an illustration of the free decrypt module: In order to decrypt the two free files, the victim is required to enter the secret_ file name. Once you click the DECRYPT IT FREE button, the client-side script builds a POST request and sends it to one of the C&C servers. We were able to imitate the PHP calculation and run the exit() function of the free decryption routine: The following is the PHP code at the back-end.

The function secret_ok() verifies the identity of the victim, based on his domain name and other indicators: if (isset($_GET[‘dectest’]) && secret_ok()) { decrypt_files(‘test.txt’, $_GET[‘dectest’]); exit(‘Congratulations! TEST FILES WAS DECRYPTED!!’); } if (isset($_GET[‘dectest’]) && secret_ok()) { decrypt_files(‘test.txt’, $_GET[‘dectest’]);                 exit(‘Congratulations! TEST FILES WAS DECRYPTED!!’); Threat actor’s chat room The ransomware also includes functionality to communicate with the malware authors.

As already said, the victim is required to use the secret_ key in order to open the chat. Without it, the chat will remain unresponsive. We have come to the conclusion that ransomware is the new-generation malware for an attacker interested in financial gain.

They are very effective, there is no solid solution against this threat thus far, and they are flexible to attack not only desktop operating systems, but now web servers as well. We strongly recommend updating software regularly.
In addition, third party software must not be trusted automatically by its hash.

This identifier can be changed by an attacker once a server has been compromised.

Be sure to use other routine checks to ensure that the software is legitimate. We urge anyone to backup all important data; and to be cautious about emails which are not specifically meant for the user, or attractive ads that appear online.

Iran Intensifies Its Cyberattack Activity

Middle East targets - namely Saudi Arabia - feeling the brunt of the attacks, but experts anticipate Iran will double down on hacking US targets.

Hacking 'Forward' With Weaponized Intelligence

Instead of hacking back and taking the fight to your adversary, what if your organization hacked forward by unearthing breach scenarios before the hackers do? It is a transformational time in IT security.

Advances in technologies associated with cloud computing, artificial intelligence and threat intelligence have sparked a new wave of innovation to counter threats against the enterprise and high value data. The problem is the hackers are innovating too.

And they are motivated.

As people and organizations rush to adopt new technologies, the bad guys are rushing to find and exploit new vulnerabilities before they are patched.
It’s a headlong cyber arms race that has frustrated more than a few business leaders. “If the hackers can attack us,” they wonder, “why can’t we hack them back?” It’s a reasonable question. However, for those of us who prefer to stay on the right side of the law, the idea of hacking back at the enemy is fraught with legal and ethical risk.

There are laws that establish boundaries and consequences for going on the offensive, and while they exist primarily to protect legitimate companies, the rule of equal protection—and concerns that cyber vigilantism would turn the Net into the Wild West—is helping to keep things from descending into total chaos. Besides, turning the good guys loose on the criminal element would do little to stem the tide of aggressive cyber attacks on any enterprise with digital assets of value to the hacker community. But what if, instead of hacking back and taking the fight to your adversary, your organization hacked forward and took the fight away? In other words, beat the hacker to the punch by unearthing the breach scenarios in your environment before they do. In order to accomplish this, industry and the IT security community must work together to do a better job of collecting threat intelligence on the hacker community.

That means not only capturing data on their strategies, tools, targets and methods, but to understand the context for each so that organizations can better apply that intelligence to their specific circumstances. As Dark Reading has covered before, context is vital to the success of threat intelligence.

All the information in the world isn’t going to help if you don’t know what it means. When correlated to your circumstances, however, you can apply the insights as a way to more effectively mitigate threats. With that level of understanding CISOs can then weaponize their threat intelligence; not for the purpose of going on the offensive but to anticipate and blunt attacks in advance.

This approach includes investment in new technology, yes.

But it also requires a re-examination of the recalcitrance companies have traditionally had when it comes to sharing security information. For industry as a whole, and specific segments, the key to overcoming the challenges of effective use of threat intelligence consists of three elements: Sharing: There must be a way for organizations to share meaningful threat intelligence using a common format that makes things easy to understand and correlate based on common factors such as industry, but that does not reveal the contributor's confidential information.
If there is no trust within the system, it simply will not succeed. Processing: As inbound volumes of threat intelligence increase there’s a real risk of being overwhelmed by big data, meaning users of threat intelligence will be right back where they started, ignoring signals because of an abundance of false positives. Making threat intelligence actionable means processing the data in more practical ways, including tracking indicators of compromise to see not just how they start, but to understand how they play out using new methods like breach simulations. Responding: The true value of actionable threat intelligence is not simply in distinguishing real threats from false positives, but in speeding incident response time.

The longer a threat goes undisrupted, the greater the chance for damage; once a hacker reaches the target, the more damage they can do.
Security teams must learn to act, but automation must be a part of the solution in order to cut response times from days and months down to minutes and seconds. As we become more adept at sharing and processing larger data sets and at making relevant correlations and responding to threats, it behooves us to take full advantage of the opportunity.

The benefits will extend broadly and within industries so that banks, for example, aren’t spending time and resources on preventing attacks that are unlikely to affect them.
Instead, organizations can direct their attention to what we know are the latest attacks targeting them. Indeed this is already happening to some extent.

The ISAO tracks industry organizations that have formed to collect and analyze industry-specific threat intelligence.

Though the effort is in its nascent stages, there are examples of progress. Recently the National Credit Union Information Sharing and Analysis Organization (NCU-ISAO) began operations in Florida. Such initiatives can only succeed through broadbased cooperation and participation that includes all stakeholders, from enterprises to technology developers, law enforcement and other governmental agencies and think tanks working together to identify best practices, provide education and awareness and encourage further innovation. As organized threat intelligence sharing yields its desired results, we can envision a turning of the tides that may not eliminate security threats, but that will certainly diminish the hackers’ chances of success and drive up their costs of doing business. Wouldn’t that be a refreshing change?  Related Content: Danelle is vice president of strategy at SafeBreach.
She has more than 15 years of experience bringing new technologies to market. Prior to SafeBreach, Danelle led strategy and marketing at Adallom, a cloud security company acquired by Microsoft.
She was also responsible for ...
View Full Bio More Insights

2.5k Twitter Accounts Hacked To Spread Links To Adult Content

May 24, 2016Share this content: Hackers compromised 2,500 Twitter accounts to earn money through affiliate programs. Cyber crooks hijacked more than 2,500 Twitter accounts and used them to post links to adult content in an attempt to cash in on affiliate programs that pay for sign-ups. Symantec researchers spotted compromises of the accounts of an electrofunk band, an international journalist from The Telegraph, and other high profile individuals during the campaign, according to a May 23 blog post. The attackers often replaced the user's profile picture with that of a scantily clad woman, altered the bio to include links to adult sites, liked tweets, and followed users with the intent of luring those curious enough to investigate the recently altered profiles, the post said. “If a user visits the compromised profile, they will see tweets that claim to offer free sign-ups to watch ‘hot shows' over webcam, or dates and sexual encounters,” researchers wrote. The new tweets on the compromised page will contain sexually suggestive photos and shortened links, using either Bitly or Google's URL shorteners, and redirect users to the adult sites, according to the post.

The links also include an affiliate tag which identifies where traffic originates from. “The incentive for the attackers is to drive users to these adult dating websites with the intention of getting users to sign-up for these sites,” Symantec Senior Security Response Manager Satnam Narang told SCMagazine.com via emailed comments. “We estimate that each successful conversion is worth $4.00 per user.” Researchers noted that several of the compromised accounts were older accounts that were orphaned by their owners and had not sent new tweets in years.

The oldest account was registered in December 2007, 27 percent of compromised accounts were created in 2011, and 73 percent were at least four years or older, researchers wrote. “We suspect that the accounts were compromised as a result of weak passwords and password re-use, where by passwords obtained from other breaches allowed attackers to gain access to these accounts,” Narang said. Giovanni Vigna, CTO and co-founder of cybersecurity firm Lastline, told SCMagazine he agreed. “They might have obtained username/password information from a breached music-exchange service and then simply tried the password combination against Twitter,” he said via emailed comments. Vigna said that a large portion of the compromised accounts being old and barely active further supported the claim.  InfoArmor Chief Intelligence Officer Andrew Komarov contended the credentials came from organized attacks on WEB-applications. “In many cases, they use such data for checking the affected users credentials across multiple online-services, including social network, in order to monetize it in more scalable way – just one pair of credentials may lead to 10-plus accounts on various services, including Twitter, e-commerce, instant messengers and profiles on various communities,” Komarov told SCMagazine.com via email. To avoid account compromise, researchers recommended users create a strong and unique password, use a password manager, and consider enabling Twitter's login verification.

Got an Industrial Network? Reduce your Risk of a Cyberattack with...

If an aggressive, all-out cyberdefense strategy isn't already on your operational technology plan for 2017, it's time to get busy.

Data Breaches Exposed 4.2 Billion Records In 2016

The 4,149 data breaches reported in 2016 shattered the all-time high of nearly 1 billion exposed records in 2013.

Threat Attribution: Misunderstood & Abused

Despite its many pitfalls, threat attribution remains an important part of any incident response plan. Here's why. Threat attribution is the process of identifying actors behind an attack, their sponsors, and their motivations.
It typically involves forensic analysis to find evidence, also known as indicators of compromise (IOCs), and derive intelligence from them. Obviously, a lack of evidence or too little of it will make attribution much more difficult, even speculative.

But the opposite is just as true, and one should not assume that an abundance of IOCs will translate into an easy path to attribution. Let’s take a simple fictional example to illustrate: François is the chief information security officer (CISO) at a large US electric company that has just suffered a breach.

François’ IT department has found a malicious rootkit on a server which, after careful examination, shows that it was compiled on a system that supported pinyin characters. In addition, the intrusion detection system (IDS) logs show that the attacker may have been using an IP address located in China to exfiltrate data.

The egress communications show connections to a server in Hong Kong that took place over a weekend with several archives containing blueprints for a new billion-dollar project getting leaked. The logical conclusion might be that François’ company was compromised by Chinese hackers stealing industrial secrets.

After all, strong evidence points in that direction and the motives make perfect sense, given many documented precedents. This is one of the issues with attribution in that evidence can be crafted in such a way that it points to a likely attacker, in order to hide the real perpetrator’s identity.

To continue with our example, the attacker was in fact another US company and direct competitor.

The rootkit was bought on an underground forum and the server used to exfiltrate data was vulnerable to a SQL injection, and had been taken over by the actual threat actor as a relay point. Another common problem leading to erroneous attribution is when the wrong IOCs have been collected or when they come with little context. How can leaders make a sound decision with flawed or limited information? Failing to properly attribute a threat to the right adversary can have moderate to more serious consequences.

Chasing down the wrong perpetrator can result in wasted resources, not to mention being blinded to the more pressing danger. But threat attribution is also a geopolitical tool where flawed IOCs can come in handy to make assumptions and have an acceptable motive to apply economic sanctions.

Alternatively, it can also be convenient to refute strong IOCs and a clear threat actor under the pretext that attribution is a useless exercise. Despite its numerous pitfalls, threat attribution remains an important part of any incident response plan.

The famous “know your enemy” quote from the ancient Chinese general Sun Tzu, is often cited when it comes to computer security to illustrate that defending against the unknown can be challenging.
IOCs can help us bridge that gap by telling us if attackers are simply opportunistic or are the ones you did not expect. More Insights

Tax Season Surprise: W-2 Fraud

W-2 fraud used to target businesses exclusively but has now set its sights on many other sectors. Here's what you can do to prevent it from happening to you.

Two Arrested For CCTV Camera Hack On Washington, DC

A British man and Swedish woman have reportedly been arrested in the UK for the cyberattack ahead of Trump's inauguration.

Data Science & Security: Overcoming The Communication Challenge

Data scientists face a tricky task -- taking raw data and making it meaningful for security operation teams. Here's how to bridge the gap. Today, CISOs and their teams are being asked lots of questions about risk by different types of stakeholders. Many of these questions require security professionals to analyze raw data from multiple sources, then communicate insight about impact exposure or priorities that's meaningful to people who are not security pros.

This goal has many challenges, such as understanding raw data and analyzing it to produce accurate information that's helpful to a particular person's decision making context.

This is a skill in itself, and one that data scientists are uniquely placed to provide. Security's Analysis and Communication ChallengeCISOs often face questions from business or governance, risk management, and compliance stakeholders that operational tools can't answer.

This is either because tools are designed to meet a single operational security need rather than correlate data to answer a business risk question, or because tools are designed to "find bad" and detect when something goes wrong rather than enumerate risk.  As a result, someone in the security team eventually must extract raw data from a technology "Frankenstack," put it into an analysis tool (spreadsheets by default), and then torture the data for answers to questions that inevitably get more complex over time.

This is all before working out how best to communicate the output of data analysis to clearly answer "So what?" and "What now?" How Data Science Can HelpAsking questions of raw data from one source, let alone multiple sources, isn't easy. First you have to understand the data that your security tools put out and any quirks that exist (such as timestamps and field names).
In data science, data preparation is one of the most important stages of producing insight.
It involves understanding what questions a data set can answer, the limits of the data set (that is, what information is missing or invalid), and looking at other data sets that can improve completeness of analysis where a single data set is not sufficient. Then comes the job of selecting the most appropriate analysis method to answer the question at hand.

Data scientists have a spectrum of methods they can use, which are suitable for extracting different information from data.

Data science as a discipline will consider multiple factors to deliver the most meaningful information in the time available, all with appropriate caveats.

For example, what is the current state of knowledge on this topic? What does the consumer of analysis want to know? The answers here will set the bar for the complexity of analysis required to learn something new.

For example, if a data set hasn't been analyzed before, simple stats can provide valuable insight quickly.

Then there's the inevitable trade-off between speed to results on one hand and precision on the other.

Based on all this, the best analysis method could be simple counts or using a machine learning algorithm.  Finally comes communication. What view of the data does a decision maker need? For example, the view of vulnerability will be different for a CISO who needs insight for a strategic quarterly meeting when compared with a vulnerability manager who needs to prioritize what to fix at a tactical level. While these views will be built from the same raw data, the summary for each requires different caveats, because as you summarize, you inevitably exclude details.  Merging Data Science and Domain ExpertiseData scientists can't, and shouldn't, work in a silo away from the security team.

Far more value is gained by combining their expertise in understanding, analyzing, and communicating data with the domain expertise of security professionals who understand the problem and the questions that need answering. As more security departments start working with data scientists, here are three key factors to bear in mind: Time: Understanding multiple data sets, applying the most relevant analysis techniques to them, and delivering meaningful insights based on what question needs answering won't happen overnight.
It takes time. Domain expertise: There will be gaps in knowledge between your data scientist and your security team. Working in close partnership is critical. Just as you're getting used to constraints the data scientist has discovered in the data you have, so too is your data scientist coming to grips with new and usually complex log formats in an effort to see what's possible. The needs of your consumers: Communicating and visualizing insight from data requires different analysis for different roles.

The CISO, control manager, IT operations, and C-suite all have different needs — and your data scientist must learn about these roles to strike the right balance between conclusions and caveats for each one. Related Content: Nik Whitfield is a noted computer scientist and cyber security technology entrepreneur. He founded Panaseer in 2014, a cybersecurity software company that gives businesses unparalleled visibility and insight into their cybersecurity weaknesses. Panaseer announced in November ...
View Full Bio More Insights