Girl Scouts and OpenText empower future leaders of tomorrow with cyber resilience

The transition to a digital-first world enables us to connect, work and live in a realm where information is available at our fingertips. The children of today will be working in an environment of tomorrow that is shaped by hyperconnectivity. Operating in this...

World Backup Day reminds us all just how precious our data is

Think of all the important files sitting on your computer right now. If your computer crashed tomorrow, would you be able to retrieve your important files? Would your business suffer as a result? As more and more of our daily activities incorporate digital and online...

3 Reasons We Forget Small & Midsized Businesses are Major Targets for Ransomware

The ransomware attacks that make headlines and steer conversations among cybersecurity professionals usually involve major ransoms, huge corporations and notorious hacking groups. Kia Motors, Accenture, Acer, JBS…these companies were some of the largest to be...

How Ransomware Sneaks In

Ransomware has officially made the mainstream. Dramatic headlines announce the latest attacks and news outlets highlight the staggeringly high ransoms businesses pay to retrieve their stolen data. And it’s no wonder why – ransomware attacks are on the rise and the...

An MSP and SMB guide to disaster preparation, recovery and remediation

Introduction It’s important for a business to be prepared with an exercised business continuity and disaster recovery (BC/DR) plan plan before its hit with ransomware so that it can resume operations as quickly as possible. Key steps and solutions should be followed...

Podcast: Cyber resilience in a remote work world

The global pandemic that began to send us packing from our offices in March of last year upended our established way of working overnight. We’re still feeling the effects. Many office workers have yet to return to the office in the volumes they worked in pre-pandemic....

5 Tips to get Better Efficacy out of Your IT Security Stack

If you’re an admin, service provider, security executive, or are otherwise affiliated with the world of IT solutions, then you know that one of the biggest challenges to overcome is efficacy. Especially in terms of cybersecurity, efficacy is something of an amorphous...

How Cryptocurrency and Cybercrime Trends Influence One Another

Typically, when cryptocurrency values change, one would expect to see changes in crypto-related cybercrime. In particular, trends in Bitcoin values tend to be the bellwether you can use to predict how other currencies’ values will shift, and there are usually...

Compromising Windows via Windows Update Drivers

 

While at Blackhat 2015, I saw a very interesting presentation on compromising the Windows Update service (“WSUSpect – Compromising The Windows Enterprise Via Windows Update” – Paul Stone & Alex Chapman).

Windows UpdateThe potential vulnerabilities are there when Windows update essentially retrieves and executes code over the network and can be performed by non-privilleged users. This code isn’t always from microsoft either and can be 3rd party hardware drivers with code running from the kernel. Driver updates are definitely the most appealing when it comes to exploiting, because when you plug in a new device windows update will download and install the software for that piece of hardware automatically. Hardware vendors are the ones who submit the drivers to be distributed by Windows Update. These drivers do have to be signed, but not necessarily by Microsoft and leaves all of the code quality with vendor.

beaglebone-black-board-logicsupply_pic1The researchers then decided they would need to look at ALL the USB drivers available from Windows Update as a means of testing exploits. They used a beaglebone to emulate all the USB drivers with bruteforce vendor and product IDs along with microsoft update catalog. They scraped for all USB drivers available from Windows Update and while there were tens of thousands of duplicates they ended up with 2,284 unique USB drivers. They then installed all of these drivers while recording all details of before and after driver install.

windows-server-update-servicesWSUS is the Windows Software Update Serrvices and is basically the same thing as Windows Update, but it’s used in the enterprise environment on local servers. The idea with WSUS is it will download all the Windows updates and then cache them so an administrator can test and distribute/withold them to the rest of the local network as he sees fit. By default SSL is NOT enabled on WSUS which is what allows for exploits – the Update protocol itself also communicates via SOAP XML

This gallery illustrates how the WSUS SOAP service works when checking for updates. Their tested update was using different types of handler – specifically command line installation. With the CommandLineInstallation handler choses you can download and run any Microsoft-signed exe, provide arbitrary command-line arguments and get updates installed as SYSTEM privilege.

Since the exe for CommandLineInstallation HAS to be microsoft signed you can’t just use CMD.exe to do anything you want since it’s not signed, but you can just get around that by using PsExec which is a microsoft signed tool to execute processes on systems. This gallery illustrates how as soon the fake update was installed, the CMD window popped up and had full SYSTEM privileges. While somewhat complicated, this exploit could easily be abused on enterprise environments if SSL is not enabled… which is the default. Long story short – Enable SSL on WSUS. Learn how Webroot protects Windows devices.

AdBlock Plus exploit puts OSX users at risk

A visit to the Apple store will give any consumer a false sense of security, you will be told that by buying a Mac you are safe from threats and malware. I have even been told this even after I explain what I do for a career. A vast majority of Mac users still believe that they are safe from the threat of malware because of this, even though the magic myth of Mac immunity has long been disproven and really exploited in the past years with such concepts of Thunderstrike and root privilege exploits. However, most of the malware that we come across for Mac has been adware. The annoying pop ups or redirects that try to get you to spend money or download shady software.

Variants of VSearch and Genieo have been on top of the list for most downloaded Mac malware. Most people’s cure for this would be to install an ad blocker such as AdBlock Plus. I can’t blame them for this as I also run an ad blocker on my personal Mac. The downfall to this is that these adware companies have figured this out and added code to their program to allow their ads even with your blocker running. This is why the Mac community needs a strong security software on their machines. Researching one of these variants, we came across code that will search for your ad blocking program, download an exception text file and insert it into the settings of your ad blocker. Here is a sample of the exception text it downloaded.

[Adblock Plus 2.0] @@||search.yahoo.com^$document @@||bing.com^$document @@||genieo.com^$document @@||strtpoint.com^$document

This code allows their ads to run and the user is none the wiser. The adware creates its own rules for your security plugin. This is just the beginning of what could be a crucial change in the malware found on Macs. Malware may only be using exploits like this for advertisements currently but what is stopping it from using this same kind of exploit to send personal data out in the future? Putting your security in the hands of a software that only protects you from one type of malware simply isn’t enough anymore. It is easy to find articles that claim Apple computers are invincible but the fact is malware for Mac is real and it is getting increasingly better at ensuring its survival.

What Now After Black Hat 2015?

It’s good to see that at last some alternatives to traditional AV endpoint protection are gaining traction. A lot of the questions I was asked at the show were to compare Webroot to other exhibitors who were making similar claims. (But because we lead the Predict, Prevent, Detect, and Respond model there are really no true one to one comparisons. There is however a lot of plagiarism on our market positioning, which I take as an indirect compliment, as does my CMO).

My primary concern now is efficacy, just how good are other solutions at stopping attacks and infections? The other vendors have little or no track record and are in light use. Nor do Webroot or I really care about a kill chain, it’s too damn late if you’re looking at a kill chain. As the Financial Services industry keep saying your investment may well go up or down.

Another annoyance I and the people I talked to have is that there is also no real ‘independent’ testing of next generation AV. We have tried unsuccessfully for over three years to get endpoint tests by all the ‘big’ testers updated. But, there is too much self-interest in their keeping things the same. That’s a shame, as their credibility is truly shot as any security professional sees day in and day out the disconnect between 100% detection test results and their real-life infection rates.

Perhaps the most surprising event (given other infamous events) was the pertinence of John McAfee’s speech quickly followed by the weaknesses in Android being at last partly admitted in Public. Google are willing to let you share your full contacts with a flashlight app and still don’t see any issues. Yet the people who say “don’t worry you’ve nothing to fear if you’ve nothing to hide” are all the actors I want to stay as far away from as possible – as they are ALWAYS up to no good.

So what now after Black Hat 2015? Are we turning failure into success? I’m afraid the answer is still no. Commercial, Government and Hacker interests are still harmoniously aligned and we will not see success until they are hoisted on their own petard. Frankly that cannot come soon enough (as long as they don’t take us all down with them).

Why are we using biometrics as passwords?

After seeing a great presentation on newly discovered biometrics/fingerprint vulnerabilities (“Fingerprints On Mobile Devices: Abusing And Leaking”, by Tao Wei and Yulong Zhang) at Blackhat 2015, I have to wonder why we are even using a lone fingerprint as a password. Wouldn’t fingerprints be better implemented as a username?

When your fingerprint is compromised, it is compromised forever. We’re talking about something associated with criminal records, banking, and other fairly-critical segments of one’s identity. It only makes sense your fingerprint remain part of your identity and not some password you hope to remain secret for the rest of your life. You can’t change them. Not easily, anyways… As your username, it would simply remain a part of your identity, unable to be used against you without the secrets you can more easily hide and change: passwords, pins, etc.

casFingerprints would normally need to be physically gathered, dusting for prints and all that, making their compromise a less-than-likely situation. The issues outlined in the presentation I saw, however, showed it could be possible for their digital counterparts to be gathered remotely and en masse. Imagine if a fingerprint wasn’t the password, but only the login. That wouldn’t be that big of a deal anymore. So they know your username, so what? They still can’t log in. Email addresses are scraped up off the internet all the time. Someone’s email address is bound to be in many places they don’t want it to be, but the threat of compromise is still extremely low if they’re securing their account properly. In reality, a leaked fingerprint is a big deal because you can do things like pay someone via PayPal with it. The fingerprint is the password and the username can be gotten easily (they’re almost always stored insecurely and most of the time it’s just an email address anyways).

Other situations and issues involving fingerprints being used as a mix authentication and authorization – depending on what app you’re in – are outlined in the presentation as well. In one example, they showed malicious actors’ ability to snag fingerprints in the background, causing you to authorize a payment when unlocking your phone, for instance. Yet another situation where, if the print was your username, there wouldn’t be an issue.

At the very least, there clearly needs to be better security standards around fingerprint data and sensors. Still, making them less powerful (read: not the sole password used to access banking information) would be the best way to go.

Recap of Black Hat 2015, Day 1

This is hacker week. Well, not really that officially, but with Black Hat USA and DefCon happening in Vegas, the biggest collection of black and white hat hackers have come together with experts and companies in the security sector to talk protection, exploits, and hacking. Coming at the conference with a big approach, our threat team has attended sessions all day, taking in the lessons being shared in hopes of continuing our advancement of our threat intelligence.

So coming out of the sessions, I have asked our attending team to share their takeaways of Black Hat 2015 Day 1.

On Internet of Things

Attended the, Intel security presentation on attacking hypervisors through firmware and guest operating systerms. The data they presented verified the work we are doing in the IOT (internet of things) field in bring real time behavior monitoring to industrial endpoints.  John Sirianni – Vice President, Strategic Partners, Internet of Things

On Endpoints

Windows updates for drivers can lead to execution of malware. This isvVery interesting, but requires a proxy configured. None the less, I’d love to test this myself.  Tyler Moffitt – Senior Threat Research Analyst

On Mobile

With regards to Stagefright, everyone is going to need patches to be 100% safe. But the good news is both Google and Samsung have announced 30-day update schedules, and upates for older devices are looking more and more likely. Google is acknowledging this issue much more than we expected and things are going in a good direction for android security.  Cameron Palan – Senior Mobile Threat Research Analyst

On Exploits and Malware

The game over Zeus presentation was great. It  was interesting to see the collaboration it took to take the botnet down. The FBI is offering $3  million USD for info leading to the arrest of the main guy they attribute to the botnet. The same guy also wrote CryptoLocker. Brenden Vaughan made a good observation that the same guy is probably behind Poweliks as it came out very shortly after game over was taken offline.  Grayson Milbourne – Security Intelligence Director

Direct from the team, there is no mistaking the value of Black Hat and the surrounding events. From revelations to new ideas and concepts, day 1 has been packed with incredible information.  We look forward to tomorrow and what it has in store.

If you have any questions for our team, comment below and we will respond with our thoughts and answers.

Security in the Rough

This week marks the 18th annual BlackHat USA conference where many of the world’s brightest security minds come together to discuss and showcase techniques capable of defeating and compromising a wide array of technologies. This year’s show arrives at a critical time in the world of online security and privacy, with near daily headlines of massive breaches and widespread critical vulnerabilities, all undermining the viability of mitigating today’s threats. All the while technology marches forward, integrating itself into new devices that will make up the future Internet of Things.

There were three headlines from the past few weeks which were especially concerning. The first was the discovery of the DYLD_PRINT_TO_FILE vulnerability affecting OS X Yosemite. What is so alarming about this vulnerability is that, with a single command, you are able to modify any file as a root user, including the sudoers file which stores usernames and passwords. This vulnerability is a perfect example of security oversight during the development process and how such an oversight can have a massive impact on security integrity. At least in this case, the exploit is specific to Yosemite and has been fixed in the latest OS X release.

The second alarming headline talked about 950 million Android phones being at risk of compromise by simply receiving a MMS. The exploit exists within a piece of code, called Stagefright, which is responsible for playing MMS messages. This vulnerable piece of code is part of all Android versions between 2.2 and 5.1, with an update needed to address the flaw. Unfortunately, it is very difficult to patch all devices as updates flow through network carriers at different speeds for different devices. While there are no current examples of this exploit being used in the wild, this won’t be the case for long; and the result of this vulnerability is that there will be millions of Android devices which are vulnerable to being remotely hacked.

The third, and most alarming, headline was for the recall of 1.4 million cars by Fiat Chrysler due to the demonstrated ability to remotely hack and control vehicles through the Uconnect infotainment system. What is so concerning about this hack is that so many critical systems could be controlled remotely. Everything from the wiper blades to the brakes to killing the engine. This begs the questions of, “Why does Uconnect need to have access to the brakes or engine?” It seems obvious that for basic security, these systems would be separated. However this hack demonstrated otherwise.

But as concerning as these headlines are, there is a silver lining. Unlike many headlines, these were all the result of security researchers who were looking to validate that proper security is in place. Thankfully in these cases, the researchers came forward to disclose their findings to improve security for everyone else. I cannot stress how important this type of behavior is to the viability of the future of security. The reality is that it is very difficult to design a bulletproof OS or application and that mistakes will be made. What is important is that when mistakes are discovered, that they are disclosed and addressed rather than sold on hacking forums to be used for malicious purposes. Some companies have done a great job in creating bug bounty programs to encourage the disclosure of vulnerabilities and I hope to see more of this in the future.

So back to BlackHat and why this year’s event is so timely and important. It is because BlackHat drives awareness and attention to the critical issues facing security from all angles. The conference also provides a common ground for collaboration and innovation that often finds its way into the products and technologies of the future.

As we move forward and embrace the Internet of Things, we must learn from our past mistakes and focus on ensuring we integrate the convenience technology has to offer without losing our privacy or security along the way.

10 Tips To Survive Black Hat 2015

Black Hat USA is next week, and with it will come some of the biggest hacker news of the year. From cars to mobile devices, all the way to the hotel HVAC, nothing is really out of the reach of the teams of white hat and black hat security researchers that are about to make their way to this conference. With that though will be the thousands of attendees outside those main groups looking to still get a bit of work done while at the conference. Well, we don’t want to encourage you avoiding it all together, but want to give you some tips to survive the event even with all your devices that you need. So below you will find 10 tips to survive Black Hat 2015. You are welcome to reuse them and share them with your team going, or even as reminders of the digital landscape and threats around.

Back to School Means Back to Security

Not a week goes by where we are not hearing about, reporting on, or providing comment to another major breach. From big box chains to mom and pop shops, it seems to be a constant source of news. Beyond the commercial and financial industries though are the education sectors, with colleges and private schools under attack at the same rate as their commercial distant-cousins. And with school less than a month away for most students, we think it is time for some reminders on personal security. While you will not be able to impact the local educational institutes security layer, you can add layers to your personal protection.

  • Use two-factor authentication whenever possible.

We talk about this a lot because it is one of the easiest aspects of security to implement. Two-factor authentication adds another layer of security when logging into a website, be it e-mail, banking, or other websites.  Some websites, such as Google, will text you a code when you login to verify your identity, while others have small devices that you can carry around to generate the code.  Authentication apps are also available on all major smartphone platforms. Other types of two-factor authentication do exist as well, so look in the settings of your banking, shopping, and e-mail hosts for the option.

  • Signup for login notifications

This security layer is often used in place of two-factor authentication, including by websites such as Facebook.  If your account is accessed from an unfamiliar location, a notification is sent via e-mail, app, or text-message to the account holder.  This is a great layer of security that offers you on-the-go protection.  This feature, if offered, can usually be found in the security settings of the website, such as banking and social media, you are accessing.

  • Change your passwords before school starts

There is a reason your office requires regular password changes for your e-mail.  Even if your password is compromised, by changing it regularly across all your accounts, you remove the chance of your account being accessed.  A pro-tip would be to set a reminder for every 90 days on your calendar with a link to all your accounts settings pages.  It makes it easiest to click through and make the changes regularly.

  • Increase junk filtering and avoid clicking through on e-mails

You just received an e-mail from a teacher asking for you to login and verify your school credentials.  Many phishing schemes start with something looking very innocent and official, but lead unassuming users to websites designed to collect the information direct from you.  If you receive an e-mail from one of the account-holding websites, or even a known person, open a new tab and go direct to the website instead of clicking the links provided.  It adds only a few seconds to the access, but keeps you out of any legit-looking phishing websites. Most legitimate services will never ask you for your login credentials, so make sure to avoid giving out this information.

  • Use an up-to-date security program

Whether you use Webroot SecureAnywhere or another product on the market today, ensure you have the most up-to-date version and have the correct security settings enabled.  Security programs are designed to keep the malicious files such as keyloggers and data-miners off your computer and the user protected.  This direct layer of security ensures your devices, from phones to tablets to computers, are all protected when you are downloading and accessing files.  Note that some programs, such as Webroot SecureAnywhere, are always up-to-date and require no further action from the user..

While schools will continue to be a target, you can work to minimize any breach impact on your personal data by following these steps. And if you were to receive news that your education institution has been breached, use these steps to go back and conduct a personal audit, while also taking advantage of credit alerts and other tools out there.

Encryptor RaaS (Ransomware as a Service)

A new ransomware has emerged and its very similar to tox as it is created for hackers to easily design encrypting ransomware payloads to distrube from their botnets. Since the creator of Tox was selling his operation, this could very well be the end result of that. The idea is to contract hackers with already operational botnets and campaigns use this page to create encrypting ransomware binaries to their specifications and then hand off 20% of their succussful scams to the Encryptor RaaS author.

Creation page

All a hacker has to do with this page is just input the bitcoin wallet address they want the funds to go to. Then customize the price they want for immediate payment, late payment, and lastly a timer for what is considered a late payment.

Skip forward to infecting a victim and there is no GUI popup. Just all your documents are now encrypted and you have this new instructions text at every directory.

Typically you have to install a layered tor browser to get to here, but tor2web currently is supporting a gateway to the page even if you’re just using a normal browser like firefox or chrome. Here is what you’ll be presented with.

Instructions are fairly clear on how to install a bitcoin wallet and send money to the hackers holding your files ransom. If you wait too long then the price will go up – and is set by the generator we showed earlier. Once you have paid the ransom this page will update showing “PAYED” and will then have a link to the decryptor. The decryptor doesn’t have a GUI either and will just run in the background until all files are decrypted.

MD5 Analyzed: D87BA0BFCE1CDB17FD243B8B1D247E88
Additonal MD5 Analyzed: ECDACE57A6660D1BF75CD13CFEBEDAEE

Webroot will catch this specific variant in real time and heuristically before any encryption takes place. We’re always on the look out for more, but just in case of new zero day variants, remember that with encrypting ransomware the best protection is going to be a good backup solution. This can be either through the cloud or offline external storage. Keeping it up to date is key so as not to lose productivity. Webroot has backup features built into our consumer product that allow you to have directories constantly synced to the cloud. If you were to get infected by a zero day variant of encrypting ransomware you can just restore your files back as we save a snapshot history for each of your files up to ten previous copies. Please see our community post on best practices for securing your environment against encrypting ransomware.

Macs are immune to malware? Yet another Apple exploit…

Yesterday information was published online through www.theregister.co.uk discussing an exploit that was discovered in the Mac OSX 10.10 Yosemite operating system. The discovered exploit allows a user to gain root access on a machine without any admin credentials. The exploit uses an environment variable called DYLD_PRINT_TO_FILE that was added in the Yosemite operating system, and is used by the OS to specify where the dynamic linker logs error messages. It was discovered however that the environment variable can be used maliciously in order to modify files that are owned by the “root user” account. The bottom line is that with one basic line of code a malware author could easily do away with the password requirement for the user account being compromised, therefore giving them full reign on the system.

While this exploit has not yet been seen implemented into any new malware in the wild, it is important to be aware that such a huge vulnerability exists. As usual, Mac users should always exercise prudence when downloading and installing software onto their machines, as well as download a reliable internet security app. In addition, the exploit is not present in older versions of Mac OSX, such as Mavericks, and is not present on the 10.11 beta of El Capitan.

The vulnerable code is found below

echo ‘echo “$(whoami) ALL=(ALL) NOPASSWD:ALL” >&3’ | DYLD_PRINT_TO_FILE=/etc/sudoers newgrp; sudo -s

Another Hacking Team exploit that is CRITICAL for ALL Windows systems – CVE-2015-2426

It just doesn’t seem to end with all the exploits being revealed by the Hacking Team dump earlier this month. This vulnerability could allow remote code execution if a user opens a specially crafted document or visits an untrusted webpage that contains embedded OpenType fonts. The Adobe Type Manager module contains a memory corruption vulnerability, which can allow an attacker to obtain system privileges on an affected Windows system.

Adobe Type Manager, which is provided by atmfd.dll, is a kernel module that is provided by Windows and provides support for OpenType fonts. A memory-corruption flaw (buffer underflow) in Adobe Type Manager allows for manipulation of Windows kernel memory, which can result in a wide range of impacts.  This vulnerability can allow an attacker to gain SYSTEM privileges on an affected Windows system. Hackers would use this to infect users systems with any type of malware and gain remote control access if they desired – all without notifying the user. Also, this vulnerability can be used to bypass web browser and other OS-level sandboxing and protections.

This is a confirmed exploit on Windows XP and up and Windows Server 2003 and up. Since Windows XP and Windows Server 2003 are no longer supported by Microsoft, there is no patch for users on those operating systems so we HIGHLY advise that you migrate to a newer operating system. Windows Vista, 7, and 8 users are going to have an update rolled out shortly that will patch this vulnerability so make sure you keep an eye out for updates. More info here

Turning failure into success

As a security professional it’s hard to say ‘I told you so’ but as far back as 2009-2010 Webroot was saying that the endpoint market was broken and that a new approach to stopping malware infections on endpoints was needed. At that time the rest of the endpoint security market was particularly quiet on their efficacy at stopping attacks they just kept pointing at meaningless and some would say gamed ‘independent’ test results about how great their efficacy was.

Of course the ‘chickens came home to roost’ and that efficacy was thrown under a Mack Truck over the past couple of years by the volume and frequency of new malware and its variants that was hitting endpoints. The attack patterns changed too. No longer did you have broad-based attacks now you had targeted, individualized and especially in 2014 continuous attacks aimed at known individuals in organizations.

The availability and open nature of today’s communications plus the exploitation by the big Internet players and other actors has meant everyone’s life can be pried into and used to make life more convenient, but with that convenience comes a dark side (that for many observers is seemingly winning and cannot be thwarted.) Frankly neither I, nor Webroot believe that.

Attackers’ methods can be turned against them and the attentions of the priers thwarted by only allowing them to access what you want them to access. Lots of security vendors believe that too. If those who want manipulate get smart then we need to get smarter. We can have smarter cybersecurity and we can make it consciously work together to make life very difficult indeed.

At Black Hat Webroot will be demonstrating and talking about some of the security solutions and collective threat intelligence that by working together make endpoints, servers, networks and the Internet safer for us all and are turning previous failures into success. In the end its choosing battles and winning the wars that will matter.