Jason Ross's presentation at the Blackhat DC conference related the
issues about checkbox compliance, that companies are using checkbox
compliance as a means to indicate whether they are secure. When in fact
it should be deemed as the lowest possible level of acceptance a
baseline of acceptance and he points out as others have that some of
the largest privacy compromises of personal information were done at
companies that had past their external PCI audits. Compliance is
absolutely wonderful it enforces at least a baseline of requirements
but it should not be used as a means that you have a seal that protects
you from exploits and non-publicized holes in the grid.
Jason points out the difficulties of detecting Malware in enterprise environments, that by the time the antivirus sends off an alert about a malware or virus being seen it's usually too late you have already been owned, as Dan Geer pointed out a few years ago at the Gartner Risk Conference it's hard to get exact metrics on what is happening because by the time that alert kicks off 6 other events have already happened that were not detected.
For IT and Security administrators that have been through some of these malware wars with Downloaders and Polymorphic attacks know that just because the antivirus says it's cleaning up there are way too many other things happening. I once saw some thing interesting it was a Polymorphic virus that was loaded on a system that had Microsoft's development studio on it, that we could watch as the polymorphic virus recompiled other malware from it's code that would attempt many ways to infect the machine and other machines quickly and one time there was a downloader. Even Microsoft writes about recovering the operating system and files from a known state from before this activity started unfortunately with out historical view of activity on this node and user that information and the correlation of events will be difficult.
Jason Ross points out the goals of malware now is to have Business support models. Their objective is not to be noisy but to be very quietly performing their tasks of infecting other hosts and using a network of hosts to make money and the use of malware like URL Zone and Monkif
In the presentation he talks about Spider Monkey - By Didier Stevens a tool for helping to analyze malcode. The use of SAN NETS to isolate malcode in action so that it can be analyzed to determine what it wants to connect with or what services or files it wants to abuse with Polymorphic viruses that constantly change it's usually interesting to observe them in action in a closed environment.
Years ago I can't remember the movie name, but the analyst in the movie were collecting them and keeping the code and binaries for sale and redistribution or modifying them in some way not to be detected.
Another point from the presentation is that Malcode writers are now
writing them so they can not be easily detected by signatures by using
multicode that each binary performs a small function of the code.
netForensics will be at HP Universe in Hamburg Germany this week.
On December 16th through the 18th at HP Universe 2009 we will be featuring how our Information Security Management tools integrate with HP uCMDB and HP Operation Center Management. IT Enterprise frame works including the OCG's ITIL v3 and the ISACA's COBIT 4.1 call for Information Security Management, Change management. Service Asset and Configuration Management processes to be implemented across the ITIL Service Lifecycle from the Service Strategy, Service Design, Service Transition and Service Operation.
nFX SimOne provides the ability for Information Security Management and Operations Management to be closely aligned throughout the Service Life Cycle, by integrating with HP uCMDB, HP Operations Manager (OVO) and Information Security Management ( SIEM tools ), organizations will have common view of the relationships of host and host resources and applications and automatic change history. This provides organizations a common view of the Service Design and it's control environment allowing Information Security management to create effective correlation event scenarios based on the enterprise framework and business processes, providing effective event management and incident management.
The mission and function of the task force will be to provide advice to the Attorney General for the investigation and prosecution of cases of banks, mortgage, loan, lending fraud; securities and commodities fraud, mail and wire fraud, retirement fraud, tax crimes, false claims, unfair competition, discrimination, and other financial crimes and violations.
Federal Register Executive Order 13519--Establishment of the Financial Fraud Enforcement Task
Force
"That the nation faces unprecedented challenges in responding to the financial crisis that has gripped the economy for the past year. Mortgage, securities and corporate fraud schemes have eroded the public's confidence in the nation's financial markets and have led to a growing sentiment that Wall Street does not play by the same rules as Main Street."
Recently in the Brazilian Power outage events, even an implied weakness in the controls of Critical Infrastructure could be used to destabilize the financial stability in markets, subverting the controls that are involved in financial trading. There have been conflicting reports about whether the attack was caused by an attack on the controls of its Dam's systems. Employees and Contractors of the system complained that their pay checks and statements had been modified to include a message from the attackers.
With all of this talk on financial fraud and critical infrastructure vulnerabilities, I could not help but be reminded of the 1983 movie Superman III where Robert Vaughn's character sites "Computers rule the world today and the fellow that rules the computer, rules the world." and Richard Pryor hacking into secret defense systems to ruin the coffee crop for the next 5 years, Superman III: Tornado Scene.
While it all may seem very tongue and cheek and some what unrealistic, the simultaneous collapse of the financial markets due to fraudulent transactions combined with the failure of major Scada Systems would have a serious effect on a nation's stability. In 2002 the U.S. Naval War College conducted a study that concluded it would probably take about 5 years to plan and cost about 290 million dollars to plan a significant electronic attack.
Digital Stenography: The advantage of steganography, over cryptography alone, is that messages do not attract attention to themselves.
Infosectoday's article: Digital Steganography Threat or Hype: by James E. Wingate - Summary:
Use of steganography will never be detected if no one ever looks for it.
This document covers the People's Liberation Army conceptual framework for delivering "integrated Network Electronic Warfare". This includes Space and Satellite warfare and EMP attacks. The document also points out the the U.S. Military NIPRET are a high priority of attack. The article mentions that organizations are still not doing enough to use analyzer tools like SIEM products. While the article sites that SIEM products may rely on signature based solutions, nFX One products correlate events beyond IDS/IPS based signature events from a number of disparate Operating Systems, Netflows, and other host and network security devices to alert on abnormal behavior and provides built-in Incident Response Management work flow and integratrion with ITIL uCMDB processes.
The document provides a graphic on the "Timeline of Significant Chinese Related Cyber Events 1999-Present, including pointers to the very public GhostNet cyber espionage events as well as information on the National University of Defense Technology (NUDT)."
Brian Krebs from Security Fix at the Washington Post cautions business users to use LIVE CD Operating Systems to to perform online banking. Live CD distributions are generally free, Linux Based operating systems that one can down load and burn to a CD-Rom.
This allows the user to boot the operating system off of the CD everything is just run in memory and when your done with your transactions everything that was performed is now not available on any disk. The advise is just to use the LiveCD for Online Banking transactions and not to visit other sites.
Brian Krebs also points out that this is not only his recommendation but the recommendation of the Financial Services Information Sharing and Analysis Center
(FS-ISAC)
I just want to point out that one needs to be sure where you are acquiring these distributions, simply obtaining one from a download or from an expert does not verify the validity of the distribution make sure that you can verify the distribution before running it.
A response noted by "neversaylie"
"Some Windows malware perform DNS spoofing/ARP poisoning/DHCP spoofing, so even a LiveCD won't help you if you're on a network with some infected Windows machines."
So if you are using Live CD but your DNS or DHCP servers are spoofing IP's your still resolving fake addresses to your on line banking institution and not free of man in the middle attacks.
Neil deGasse Tyson once said, "To a discoverer all data is valuable even bad data." When looking at data individually, you may believe that the data is not valuable and does not tell you anything. But, when combined with other types of information that are within a relevant time frame, the information becomes very valuablle and the more layers of information being presented more useful.
Some of the most valuable data that you get does not even come within the realm of logical data gathering. It is the information from outside of logical analysis of data which brings to mind Sam Walton's expression "I know what I know but tell me what you know." According to Kevin Mitnick, the most effective approach is to try to exploit the weakest link -- not operating systems, firewalls or encryption algorithms -- but people. In information security, knowing what is of value, where is it located, who has access to it, and what are the trust zones and controls that allow access to it is core to aligning information security with business goals.
Monitoring perimeter scans for known intruders and bogons is information that we all need, but knowing how trust zone can be compromised to gain access to valuable or confidential data is critical. It's the continual discovery process and breaking through the silos of knowledge and control that will help provide additional layers needed in developing an effective information security program.
Why is my executive office printer using https and ftp outbound traffic to a Home ISP DHCP range or using Goto My PC?
A Vietnam based security organization, Bkis Internet Security, is a member of APCERT (Asia Pacific Computer Emergency Response Team) was asked by the Korean CERT Team KrCERT to investigate the recent July 2009 DDOS Botnet attacks. Bkis Internet Security analyzed what it received from KrCERT, located 8 command and control centers, and obtained access to two of the command centers. After analyzing the traffic, Bkis reported that the original estimates of 20,000 to 50,000 infected systems involved in the Botnet was really more in the line of 166,909 zombies from 74 countries.
The U.S. Cert Teams and the Korean Cert Teams continue to investigate these incidents in the hopes of identifying the source of the attacks.
The Korea Herald reports that North Korea is the suspected source involved in a DDOS attack against South Korean government agencies, banks, and Internet portals and all the network range of the attack may point to North Korea, this may not have been done under the direct orders of the Kim Jon-il Government. South Korea believes that the North Korean Government has also stepped up their cyber-warfare initiatives including developing cyber-warfare simulation applications call "100 combat methods." Just as physical weapons have been for sale, are there now Botnets and warfare simulators that could be used as tools for those that may want to have a sneak peak at cyber defenses and forensics abilities - kind of like testing radar abilities but from a distributed source - to see at what point the counter attacks begin?
While there have been these types of reports coming from South Korea on suspecting the DDOS attacks may have originated from North Korea, other professional forensics experts are not ruling out that the cyber attacks that occurred over the 4th of July Holiday need to be further analyzed, that it just may haven been a smoke screen for an intrusion that would have been masked in all the noise. This method of trying to disguise a real intrusion with a cloud of DDOS attacks is a known tactic that Managed Security Service providers know when looking at distributed attacks. The attackers want to draw everyone's attention to one or many DDOS attacks while there is a valuable trust that has been compromised somewhere else that has nothing to do with the DDOS attack.
Ahnlabs believe the attacks were a modified versions of the MyDoom worm that used botnets to initiate the attack.
Rented Botnets seems be a new method of Cloud Computing to either test defenses, distract attention from what is really taking place, or simply making a political protest.
The Malaysian Ministry of Science and Technology announced that within the next few months it will provide an Emergency Assistance Service for Internet users experiencing Cybersecurity issues. By next year the service is expected to provide the expertise of 1,500 IT Security Specialists. The Deputy Minister of Science, Technology and Innovation, Datuk Fadillah Yuso said "Businesses cannot merely rely on the use of traditional aspects of security i.e., firewalls intrusion detection systems and virus scans because they are no longer enough to protect an organisation from threats and breaches."
He said the Hacker Halted Asia Pacific 2009 event which will be held from November 10 to 13 will expose the latest flaws in information security that affect the global community.
This update contains support for several vulnerabilities because the modifications that are required to address these issues are located in related files. Instead of having to install several updates that are almost the same, customers need to install this update only.
Fortinet - "All three vulnerabilities lie in 'excel.exe', which is used when processing an Excel file. A maliciously crafted document may contain a malformed 1) BRAI (0x1051) record or 2) Object (0x5d) record or 3) Formula record (0x06) that, when processed, will result in memory corruption and allow a remote attacker to arbitrarily execute code on the victim's machine."
Telus Security Labs - "A buffer overflow vulnerability exists in Microsoft Office Excel products. The vulnerability is due to improper parsing of an Excel file that includes a malformed set of records. Remote attackers can exploit this vulnerability by enticing target users to open a malicious Excel file, potentially causing arbitrary code to be injected and executed in the security context of the current user."
Acknowledgments:
Microsoft thanks the following for working with us to help protect customers:
Bing Liu of Fortinet's FortiGuard Global Security Research Team for reporting the Pointer Corruption Vulnerability (CVE-2009-0549), the Object Record Corruption Vulnerability (CVE-2009-0557), and the the Field Sanitization Memory Corruption Vulnerability (CVE-2009-0560).
Carsten H. Eiram of Secunia for reporting the Array Indexing Memory Corruption Vulnerability (CVE-2009-0558) and the Record Integer Overflow Vulnerability (CVE-2009-0561).
Sean Larsson and Joshua Drake of VeriSign iDefense Labs for reporting the Record Integer Overflow Vulnerability (CVE-2009-0561).
TELUS Security Labs Vulnerability Research Team for reporting the String Copy Stack-Based Overrun Vulnerability (CVE-2009-0559).
TippingPoint and the Zero Day Initiative, for reporting the Record Pointer Corruption Vulnerability (CVE-2009-1134)
![Reblog this post [with Zemanta]](http://img.zemanta.com/reblog_e.png?x-id=748a0e9e-5394-4503-9062-a44fa2f55524)
![Reblog this post [with Zemanta]](http://img.zemanta.com/reblog_e.png?x-id=4011c3f1-5552-4ee7-9262-2c11a7a6670f)
![Reblog this post [with Zemanta]](http://img.zemanta.com/reblog_e.png?x-id=a62363bc-497f-4d21-a8bc-d8da436859ff)
![Reblog this post [with Zemanta]](http://img.zemanta.com/reblog_e.png?x-id=24caacab-f4c1-4232-9731-cf30fac13171)
