Audio Blog Post: MicroSolved Inc. Labs

Brent Huston, CEO and Founder of MicroSolved, Inc., talks with Chris Lay, Account Executive, about MicroSolved’s lab. In this audio blog post, you’ll learn:

  • Some of the things we’re testing now
  • The types of operating systems we’re testing
  • Brent’s favorite “testing” story

Grab a drink and take a listen. As always, let us know what you think!

Click here to listen.

And don’t forget, you can follow Brent Huston on Twitter at @lbhuston and Chris Lay at @getinfosechere!

Audio Blog Post: Malware Trends

Brent Huston, CEO and Founder of MicroSolved, Inc., discusses with Chris Lay, Account Executive, the new malware trends and a new perspective needed in dealing with attacks. In this audio blog post, you’ll learn:

  • How language is making a difference
  • How the attackers are getting more clever
  • What infected USB keys are now doing
  • What is ‘Flame’?
  • What to do when you identify malware in your organization

Grab a drink and take a listen. As always, let us know what you think!

Click here to listen.

And don’t forget, you can follow Brent Huston on Twitter at @lbhuston and Chris Lay at @getinfosechere!

MicroSolved, Inc. Receives U.S. Patent For HoneyPoint Defensive Fuzzing InfoSec Tool

MicroSolved, Inc. is pleased to announce that they have received a U.S. Patent (8,196,204 B2) on June 5, 2012, on technology components of their product HoneyPoint Security Server. This technology, known as “defensive fuzzing,” and the improvement mechanisms associated with it are a core component of creating self-defending implementations with HoneyPoint. 

The defensive fuzzing mechanism allows a computer network’s HoneyPoints to listen for an incoming connection from an attacker, and then disrupt that connection by tampering with the expected responses — in essence “fuzzing” the conversation. In many cases, this can confuse or crash the attacker’s tools or malware, limiting their capability to perform further attacks or damage.

The patent also covers a quality improvement technique for HoneyPoint technology. As the defensive fuzzing occurs, HoneyPoint tracks how successful it was with a given fuzzing technique. It has the ability to share that knowledge among various HoneyPoints so that as the system gets better with defensive fuzzing, the entire distributed system gets better at protecting the user’s environment.

This feature of MSI’s HoneyPoint detection system takes a passive defense and turns it into an active defense that can protect itself without human intervention.

“At MSI, we are truly committed to helping organizations protect their information assets, and we see this patent on defensive fuzzing as the next logical extension in helping organizations achieve high levels of protection with lower levels of resource requirements,” said Brent Huston, CEO and Founder of MicroSolved, Inc. “We are truly dedicated to extending even further in the future, the capability for organizations to defend their intellectual property.”

For more information about HoneyPoint, please visit our HoneyPoint webpage. To learn more about MicroSolved, Inc., visit wwww.microsolved.com.

 

Audio Blog Post: Spear Phishing

Brent Huston, CEO and Founder of MicroSolved, Inc., discusses with Chris Lay, Account Executive, the new trends with spear phishing. In this audio blog post, you’ll learn:

  • How traditional spear phishing has changed
  • The new approach attackers are now using
  • The LinkedIn password breach and how it could be used in phishing attacks
  • Some non-traditional spear phishing campaigns

Grab a drink and take a listen. As always, let us know what you think!

Click here to listen.

How Honeypots Can Help Safeguard Your Information Systems

 

 

 

 

 

 

 

A honeypot is a trap set to detect or deflect attempts at unauthorized use of information systems. Generally it consists of a computer, data or a network site that appears to be part of a network but which is actually isolated and protected, and which seems to contain information that would be of value to attackers.

It is important to note that honeypots are not a solution in themselves. They are a tool. How much they can help you depends upon what you are trying to achieve.

There are two different types of honeypots: production and research. Production honeypots are typically used by companies and corporations. They’re easy to use and capture only limited information.

Research honeypots are more complex. They capture extensive information, and used primarily by research, military, or government organizations.

The purpose of a production honeypot is to mitigate risk to an organization. It’s part of the larger security strategy to detect threats. The purpose of a research honeypot is to collect data on the blackhat community. They are used to gather the general threats against an organization, enabling the organization to strategize their response and protect their data.

The value of honeypots lies in their simplicity. It’s technology that is intended to be compromised. There is little or no production traffic going to or from the device. This means that any time a connection is sent to the honeypot, it is most likely to be a probe, scan, or even attack. Any time a connection is initiated from the honeypot, this most likely means the honeypot was compromised. As we say about our HoneyPoint Security Server, any traffic going to or from the honeypot is, by definition, suspicious at best, malicious at worst. Now, this is not always the case. Mistakes do happen, such as an incorrect DNS entry or someone from accounting inputting the wrong IP address. But in general, most honeypot traffic represents unauthorized activity. What are the advantages to using honeypots?

  1. Honeypots collect very little data. What they do collect is normally of high value. This eliminates the noise, making it much easier to collect and archive data. One of the greatest problems in security is sifting through gigabytes of useless data to find something meaningful. Honeypots can give users the exact information they need in a quick and easy to understand format.
     
  2. Many security tools can drown in bandwidth usage or activity. NIDs (Network Intrusion Detection devices) may not be able to handle network activity, and important data can fall through the cracks. Centralized log servers may not be able to collect all the system logs, potentially dropping logs. The beauty of honeypots is that they only capture that which comes to them.

Many of our clients swear by our HoneyPoint family of products to help save resources. With its advantages, it’s easy to see why! Leveraging the power of honeypots is an excellent way to safeguard your data.

 

How HoneyPoint Security Server Minimizes Risk For Your Network

If you’re looking for a security tool that goes beyond NIDS, you’re in luck.

MicroSolved’s HoneyPoint Security Server has revolutionized the ease and power of what honeypots can do and be. With the emergence of HoneyPoint Wasp, you can also apply the HoneyPoint magic to your Windows desktops. 

HoneyPoint Wasp monitors your desktops for any new applications it has not seen before (Anomaly Detection). Should Wasp detect new code, the end-user will never see a pop-up alert. Instead, you will be notified and able to quickly take action. Should the notification go without follow-up action, HoneyPoint Wasp assumes the allowed application, and no future notification will be sent to the console (Self-Tuning White Listing).

As you’ll see in a moment, the HoneyPoint Security Server is much more than a mere intrusion detection system.. It’s an underlying framework of rock-solid code that’s been built to achieve three important goals: identify real threats, isolate and tamper with the attacker’s results, and “smart” detection processes that allow you to target attacker availability.

Let’s take a look at each of these goals, and why they matter to what you’re doing online…

Click to continue…

MicroSolved, Inc. Receives Prestigious BBB Center for Character Ethics Torch Award

MicroSolved, Inc. is honored to announce that they are the recipient of the prestigious 2012 BBB Center for Character Ethics 18th annual Torch Awards for EthicalEnterprising℠. 

The recipients will be honored at the Torch Award Centennial Gala Luncheon, held at the Hyatt Regency Ballroom in downtown Columbus on September 6, 2012.

Five businesses and one non-profit organization have been selected as recipients of the prestigious 2012 Torch Award.

Founded in 1994, the national award-winning “educate & recognize” program is the premier public recognition of organizations that intentionally pursue the six TRUST! Principles of EthicalEnterprising. The award embodies the BBB Center’s mission of advancing marketplace trust.

A panel of judges selected these organizations based on the six EthicalEnterprising criteria and demonstrated a high level of trust among their employees, customers and their communities. 

“We are deeply honored to be selected for this award,” said Brent Huston, CEO and Founder of MicroSolved, Inc. “We have always worked hard to build and maintain relationships of trust with our customers. Our employees also realize that trust is a vital part of our company ethos and they work together to strengthen it each day. The Torch Award helps encourage ethical business practices. We’re quite humbled to stand beside other organizations who also value the same commitment to best practices and benchmarks.”

MicroSolved, Inc. has been providing information security services to Fortune 500 companies, government, financial institutions, and education systems for twenty years.

To learn more about MicroSolved, Inc., visit wwww.microsolved.com.

 

Brent Huston Receives ISSA Senior Award

MicroSolved, Inc. is pleased to announce that Brent Huston, CEO and Founder of MicroSolved, Inc., received ISSA’s International Senior Member Award, presented at the 5th Annual Central Ohio ISSA InfoSec Summit in Columbus, Ohio. Mr. Huston is the first member of the Central Ohio Chapter to receive this award.

The International Senior Member Award is given to those who have contributed to the security community and sustained membership in the association. Mr Huston has been an ISSA member for 7 years and has twenty years of work experience in the information security field. Huston has spoken at many ISSA chapter meetings and also is a popular presenter at regional ISSA conferences.

“My mission is to continue to evangelize and help organizations go beyond protecting their confidential data from attacks, to actively detecting attacks so they can take action quickly and minimize their risk,” said Huston. “I’m fortunate to work with great people and we’re all committed to the same goal: to keep data safe.”

MicroSolved, Inc. has been providing information security services to Fortune 500 companies, government, financial institutions, and education systems for twenty years.

To learn more about MicroSolved, Inc., visit www.microsolved.com.

HoneyPoint Agent Helps Another Client

Just got an interesting report in from another client helped by HoneyPoint Agent. This time, the client detected a probe against a SQLServer port that seemed to be coming from several hosts on their internal network.
 
The probe was aimed at identifying SQLServer installations, and while the story seems familiar, the probe itself was different. In this case, the client had network-based intrusion detection tools and other elements of signature-based visibility. However, the probe they were seeing was a new type of probe and signatures had not yet been created. Thus, the signature-based tools were basically blind to detecting the scans of this malware, even while it was beginning to spread across their environment.
 
HoneyPoint Agent on the other hand, simply detected the illicit traffic. Since deployed HoneyPoints are not real services, any contact with them should be considered suspicious at best or malicious at worst. In this case, the traffic was indeed malicious. HoneyPoint tipped them off to the source IP’s of the scanning and even gave them the data they needed to build network signatures for their network-based detection tools. Several hours later, they had significant intelligence into the scope, capability, source and methods of what they were facing. HoneyPoint had not only served as an early warning system, but had also given them the knowledge to grow their visibility to the overall impact of the security incident.
 
I love it when customers tell us about how HoneyPoint helped them in a time of need. I truly appreciate it when they catch malware early on and get to take quick, decisive defensive action. We might not win all of the battles in the infosec war, but when we do win a few and something we made helps turn the tide, it makes the MSI team very happy indeed!

Search for Malware by MD5 Hash

Got a file that you want to know more about? Have the MD5 hash for it, and want to know if it is known to be malware? This seems to be a common problem. 

 Here are three links that might help you:
 
1. Search VirusTotal by hash (simply put the hash in the search box): https://www.virustotal.com/#search
 
 
3. Search Eureca by hash (replace xxx with your hash): http://eureka.cyber-ta.org/OUTPUT/xxx/
 
Even if these sites don’t turn anything up, the file still might be malware. It may simply have been modified or specially crafted. However, if these sites turn up hits, you should be extra secret squid careful with the binary, since it is very likely to actually be malware of some sort.
 
Hope that helps folks. Thanks for reading!