Three Tough Questions with Aaron Bedra

Posted on by
4

This time I interviewed Aaron Bedra about his newest creation ~ RepSheet. Check it out here:


Aaron’s Bio:

Aaron is the Application Security Lead at Braintree Payments. He is the co-author of Programming Clojure, 2nd Edition as well as a frequent contributor to the Clojure language. He is also the creator of Repsheet, a reputation based intelligence and security tool for web applications.


Question #1:  You created a tool called Repsheet that takes a reputational approach to web application security. How does it work and why is it important to approach the problem differently than traditional web application firewalling?

I built Repsheet after finding lots of gaps in traditional web application security. Simply put, it is a web server module that records data about requests, and either blocks traffic or notifies downstream applications of what is going on. It also has a backend to process information over time and outside the request cycle, and a visualization component that lets you see the current state of the world. If you break down the different critical pieces that are involved in protecting a web application, you will find several parts:

* Solid and secure programming practices

* Identity and access management

* Visibility (what’s happening right now)

* Response (make the bad actors go away)

* HELP!!!! (DDoS and other upstream based ideas)

* A way to manage all of the information in a usable way

This is a pretty big list. There are certainly some things on this list that I haven’t mentioned as well (crypto management, etc), but this covers the high level. Coordinating all of this can be difficult. There are a lot of tools out there that help with pieces of this, but don’t really help solve the problem at large.

The other problem I have is that although I think having a WAF is important, I don’t necessarily believe in using it to block traffic. There are just too many false positives and things that can go wrong. I want to be certain about a situation before I act aggressively towards it. This being the case, I decided to start by simply making a system that records activity and listens to ModSecurity. It stores what has happened and provides an interface that lets the user manually act based on the information. You can think of it as a half baked SIEM.

That alone actually proved to be useful, but there are many more things I wanted to do with it. The issue was doing so in a manner that didn’t add overhead to the request. This is when I created the Repsheet backend. It takes in the recorded information and acts on it based on additional observation. This can be done in any form and it is completely pluggable. If you have other systems that detect bad behavior, you can plug them into Repsheet to help manage bad actors.  

The visualization component gives you the detailed and granular view of offenses in progress, and gives you the power to blacklist with the click of a button. There is also a global view that lets you see patterns of data based on GeoIP information. This has proven to be extremely useful in detecting localized botnet behavior.

So, with all of this, I am now able to manage the bottom part of my list. One of the pieces that was recently added was upstream integration with Cloudflare, where the backend will automatically blacklist via the Cloudflare API, so any actors that trigger blacklisting will be dealt with by upstream resources. This helps shed attack traffic in a meaningful way.

The piece that was left unanswered is the top part of my list. I don’t want to automate good programming practices. That is a culture thing. You can, of course, use automated tools to help make it better, but you need to buy in. The identity and access management piece was still interesting to me, though. Once I realized that I already had data on bad actors, I saw a way to start to integrate this data that I was using in a defensive manner all the way down to the application layer itself. It became obvious that with a little more effort, I could start to create situations where security controls were dynamic based on what I know or don’t know about an actor. This is where the idea of increased security and decreased friction really set it and I saw Repsheet become more than just a tool for defending web applications.

All of Repsheet is open sourced with a friendly license. You can find it on Github at:

https://github.com/repsheet

There are multiple projects that represent the different layers that Repsheet offers. There is also a brochureware site at http://getrepsheet.com that will soon include tutorial information and additional implementation examples.

Question #2: What is the future of reputational interactions with users? How far do you see reputational interaction going in an enterprise environment?

For me, the future of reputation based tooling is not strictly bound to defending against attacks. I think once the tooling matures and we start to understand how to derive intent from behavior, we can start to create much more dynamic security for our applications. If we compare web security maturity to the state of web application techniques, we would be sitting right around the late 90s. I’m not strictly talking about our approach to preventing breaches (although we haven’t progressed much there either), I’m talking about the static nature of security and the impact it has on the users of our systems. For me the holy grail is an increase in security and a decrease in friction.

A very common example is the captcha. Why do we always show it? Shouldn’t we be able to conditionally show it based on what we know or don’t know about an actor? Going deeper, why do we force users to log in? Why can’t we provide a more seamless experience if we have enough information about devices, IP address history, behavior, etc? There has to be a way to have our security be as dynamic as our applications have become. I don’t think this is an easy problem to solve, but I do think that the companies that do this will be the ones that succeed in the future.

Tools like Repsheet aim to provide this information so that we can help defend against attacks, but also build up the knowledge needed to move toward this kind of dynamic security. Repsheet is by no means there yet, but I am focusing a lot of attention on trying to derive intent through behavior and make these types of ideas easier to accomplish.

Question #3: What are the challenges of using something like Repsheet? Do you think it’s a fit for all web sites or only specific content?

I would like to say yes, but realistically I would say no. The first group that this doesn’t make sense for are sites without a lot of exposure or potential loss. If you have nothing to protect, then there is no reason to go through the trouble of setting up these kinds of systems. They basically become a part of your application infrastructure and it takes dedicated time to make them work properly. Along those lines, static sites with no users and no real security restrictions don’t necessarily see the full benefit. That being said, there is still a benefit from visibility into what is going on from a security standpoint and can help spot events in progress or even pending attacks. I have seen lots of interesting things since I started deploying Repsheet, even botnets sizing up a site before launching an attack. Now that I have seen that, I have started to turn it into an early warning system of sorts to help prepare.

The target audience for Repsheet are companies that have already done the web security basics and want to take the next step forward. A full Repsheet deployment involves WAF and GeoIP based tools as well as changes to the application under the hood. All of this requires time and people to make it work properly, so it is a significant investment. That being said, the benefits of visibility, response to attacks, and dynamic security are a huge advantage. Like every good investment into infrastructure, it can set a company apart from others if done properly.

Thanks to Aaron for his work and for spending time with us! Check him out on Twitter, @abedra, for more great insights!

New threats: Unknown Cyber Threats & APT according to InfoSec Researchers in the Peoples’s Republic of China 新型威胁：未知威胁与APT 中華人民共和國

Posted on by
1

 New threats: Unknown Cyber Threats & APT according to InfoSec Researchers in the Peoples’s Republic of China 新型威胁：未知威胁与APT 中華人民共和國

 http://www.vulnhunt.com/nextgen/apt/

Good day folks;

Here’s an article about how information security researchers within the People’s Republic of China, 中華人民共和國 define ‘Unknown Cyber Threats & the innocuous Western term “APT”.

Enjoy!

Semper Fi,

謝謝您

紅龍

 

安全威胁近些年来发生巨大的变化，黑客攻击从传统带有恶作剧与技术炫耀性质逐步转变为利益化、商业化。为了突破传统的安全防御方法，一种名为APT的攻击迅速发展起来。APT是advanced persistent threat的缩写，译为高级持续性威胁。它是指近年来,专业且有组织的黑客（甚至可能有国家背景支持），针对重要目标和系统发起的一种攻击手段。

APT的主要特征:

 持续性： 攻击者为了重要的目标长时间持续攻击直到攻破为止。攻击成功用上一年到三年，攻击成功后持续潜伏五年到十年的案例都有。这种持续性攻击下，让攻击完全处于动态发展之中，而当前我们的防护体系都是强调静态对抗能力很少有防护者有动态对抗能力，因此防护者或许能挡住一时的攻击，但随时间的发展，系统不断有新的漏洞被发现，防御体系也会存在一定的空窗期：比如设备升级、应用需要的兼容性测试环境等等，最终导致系统的失守。

终端性： 攻击者虽然针对的是重要的资产目标，但是入手点却是终端为主。再重要的目标，也是由终端的人来访问的。而人在一个大型组织里，是难以保证所有人的安全能力与安全意识都处于一个很高水准之上的。而做好每个人的终端防护比服务器端防护要困难很多。通过SQL注射攻击了WEB服务器，一般也是希望利用他攻击使用这些WEB服务器的终端用户作为跳板渗透进内网。

广谱信息收集性： 攻击者会花上很长的时间和资源，依靠互联网搜集，主动扫描，甚至真实物理访问方式，收集被攻击目标的信息，主要包括：组织架构，人际关系，常用软件，常用防御策略与产品，内部网络部署等信息。

针对性： 攻击者会针对收集到的常用软件，常用防御策略与产品，内部网络部署等信息，搭建专门的环境，用于寻找有针对性安全漏洞，测试特定的木马是否能饶过检测。

未知性： 攻击者依据找到的针对性安全漏洞，特别是0DAY，根据应用本身构造专门的触发攻击的代码。并编写符合自己攻击目标，但能饶过现有防护者检测体系的特种木马。这些0DAY漏洞和特种木马，都是防护者或防护体系所不知道的。

渗透性社工： 攻击者为了让被攻击者目标更容易信任，往往会先从被攻击者目标容易信任的对象着手，比如攻击一个被攻击者目标的电脑小白好友或家人，或者被攻击者目标使用的内部论坛，通过他们的身份再对组织内的被攻击者目标发起0DAY攻击，成功率会高很多。再利用组织内的已被攻击成功的身份再去渗透攻击他的上级，逐步拿到对核心资产有访问权限的目标。

隐蔽合法性： 攻击者访问到重要资产后，往往通过控制的客户端，分布使用合法加密的数据通道，将信息窃取出来，以饶过我们的审计和异常检测的防护。

长期潜伏与控制： 攻击者长期控制重要目标获取的利益更大。一般都会长期潜伏下来，控制和窃取重要目标。当然也不排除在关键时候破坏型爆发。

从以上特性来看，可以获得如下结论

APT攻击的成本很高（专业的团队，长期的信息收集，挖掘0DAY和利用，特马，环境测试，渗透性社工与潜伏，多种检测对抗），因此只适合专业的网络犯罪团伙或有组织和国家支持的特种攻击团队

因此APT攻击是针对有重要价值资产或重要战略意义的目标，一般军工、能源、金融、军事、政府、重要高科技企业等最容易遭受APT攻击。

虽然普通网民不会遭受APT攻击的眷顾，但是如果你是APT攻击目标组织的一名普通员工甚至只是与APT攻击目标组织的一名普通员工是好友或亲戚关系，你依然可能成为APT攻击的中间跳板，当然作为普通个人，APT攻击本身不会窃走你个人什么东西（你本身就是重要人物如组织中的高级管理人员或个人主机里保存有重要资料的除外）。

不要以为你重要的信息资产只在内网甚至物理隔离就能不遭受APT攻击，因为即使物理阻止了网络层流，也阻止不了逻辑上的信息流。RSA被APT攻击利用FLASH 0DAY偷走了在内网严密保护的SECURID令牌种子，震网利用7个0DAY和摆渡成功渗透进了伊朗核设施级的物理隔离网络。

 New threats: unknown threats and APT

Security threats change dramatically in recent years, with a mischievous hacker attacks from the traditional sports and technology gradually changed the nature of the interests and commercialization. In order to break through the traditional method of security and defense, called APT attacks developed rapidly. APT is the advanced persistent threat acronym, translated advanced persistent threats. It refers to recent years, professional and organized hackers (and may even have national context support), an important goal and system for initiating a means of attack.

APT main features:

 

Sustainability: an important target for attackers continued to attack until a long break so far. A successful attack to spend one to three years, a successful attack lurking five to ten years after the last case has. This persistent attack, the attacker completely dynamically evolving, and the current emphasis of our protection system are rarely static protective ability against those who have the dynamic ability to fight, so those who may be able to block the protective moment of attack, but with the time of development, the system constantly new vulnerabilities are discovered, there will still be some defense system window period: for example, equipment upgrades, application compatibility testing environment and so require, eventually leading to the fall of the system.

Terminal resistance: Although the attacker is an important asset for a goal, but starting point is the main terminal. Further important objective, but also by people to access the terminal. And people in a large organization, it is difficult to ensure the safety of all ability and safety awareness are at a very high level above. And do everyone’s terminal protective than the server-side protection to be much more difficult. SQL injection attacks via the WEB server, are generally hoping to use him against the use of these WEB server as a springboard to penetrate into the end-user within the network.

Broad spectrum of information collection: the attacker will take a long time and resources, relying on the Internet to collect, active scanning, and even real physical access, to collect information about the target to be attacked, including: organizational structure, interpersonal relationships, commonly used software, common defense strategy and products, internal network deployment and other information.

Targeted: The attacker will be collected from the commonly used software for commonly used defense strategy and products, internal network deployment and other information, to build a dedicated environment for finding security vulnerabilities targeted to test whether a particular Trojan bypass detection.

Unknown sex: the attacker targeted basis to find security vulnerabilities, especially 0DAY, depending on the application itself is constructed of specialized trigger an attack code. And prepared in line with their targets, but it can bypass the existing system of special protection by detecting Trojans. These 0DAY loopholes and special Trojans, are protective or protective system does not know.

Permeability social workers: the attacker to allow an attacker to target more likely to trust, they tend to start with the easy confidence by attackers target object to proceed, such as attacking a target computer to be attacked by white friends or family, or the attacker targets Using the internal forum, through their identity and then the organization launched by attackers target 0DAY attack, the success rate would be much higher. Re-use within the organization’s identity has been successful attack penetration attacks his superiors to go step by step to get to the core assets have access goals.

Covert Legitimacy: the attacker access to critical assets, often through the control of the client, using the legitimate distribution of encrypted data channel, the information to steal out to bypass our audit and anomaly detection protection.

Long-term potential and control: an attacker to obtain long-term control of the interests of more important goals. Usually long-simmering down, control and steal important goals. Of course, does not rule out sabotage outbreak at a critical time.

From the point of view the above characteristics, the following conclusions can be obtained

APT attack is costly (professional team, long-term information gathering, mining and utilization 0DAY, Tema, environmental testing, permeability and latent social workers, a variety of detection confrontation) is intended only for professional or organized cybercrime gangs and national support team special attack

Therefore APT attacks are of great value for the asset or strategically important objectives, general military, energy, finance, military, government, and other key high-tech enterprise most vulnerable to APT attacks.

While ordinary users will not suffer APT attacks attention, but if you are APT attacks target tissue or even just an ordinary employee organization with APT attack targets a general staff are friends or relatives, you are still likely to be in the middle of APT attack springboard, of course, as an ordinary person, APT attack itself will not steal your personal anything (such as your own is an important figure in the senior management of the organization or individual host inside except the preservation of important data).

Do not think you important information assets are physically isolated from the internal network can not even suffer APT attacks because even if the physical network layer prevents flow logically can stop the flow of information. RSA APT attacks use FLASH 0DAY was stolen including network closely guarded SECURID token seed, Stuxnet and ferry use 7 0DAY successful penetration into the Iranian nuclear facility-level physical isolation network.

http://www.vulnhunt.com/nextgen/apt/

Cyber Situational Awareness (SA)…People’s Republic of Hacking, Cybercrime and so much more….

Posted on by
5

Good day Folks;

Today’s post about Cyber Situational Awareness (SA)…includes the People’s Republic of Hacking, Cybercrime and so much more….please particular attention to China’s Number One State Owned Enterprise (SOE), Huawei…they cannot seem to get out of their own way when comes to cyber espionage and claims of compromise…
Another story of note is the post about a Chinese Professor teaching Offensive Security…discovered this interesting gem from a French website in Ghana…go figure…
Finally – way at the bottom is a post about BLACKHAT 2013…if you dare read that far…

Enjoy!

People’s Republic of China’s Huawei Strikes Back at Ex-CIA Head
http://blogs.wsj.com/chinarealtime/2013/08/01/huawei-strikes-back-at-ex-cia-head/?mod=WSJBlog
In-Depth: People’s Republic of China’s Huawei Strikes Back at Ex-CIA Head
http://blogs.wsj.com/digits/2013/08/01/huawei-strikes-back-at-ex-cia-head-2/
People’s Republic of Chain’s Huawei hunting Australian ICT companies
http://www.itwire.com/it-policy-news/govenrment-tech-policy/60958-huawei-hunting-australian-ict-companies
The Real U.S.-People’s Republic of Chinese Cyber Problem | The National Interest
http://nationalinterest.org/commentary/the-real-us-chinese-cyber-problem-8796

Offensive Cyber Security taught by Chinese Professor….
Taught by a Chinese professor – learn Offensive Cyber Security from the Master….Prof. Xiuwen Liu (homepage: http://www.cs.fsu.edu/~liux/)
http://www.cs.fsu.edu/~redwood/OffensiveSecurity/
Why Chinese Companies Should Take the Rest of the World Seriously
http://www.techinasia.com/sina-weibos-failure-chinese-companies-rest-world/?
People’s Republic of China – Hong Kong Technical Hub Number 1
http://www.techinasia.com/hong-kong-chinas-number-tech-hub-infographic/

Mail from the (Velvet) Cybercrime Underground — Krebs on Security
http://krebsonsecurity.com/2013/07/mail-from-the-velvet-cybercrime-underground/
A 30 Year-Old Hacker Just Cursed At The Most Powerful Man In Global Surveillance
http://www.businessinsider.com/keith-alexander-gets-heckled-at-black-hat-2013-7
5 scariest cybersecurity threats @ BlackHat DEFCON…
http://www.cbsnews.com/8301-205_162-57596263/5-scariest-cybersecurity-threats-at-black-hat-defcon/
NSA XKeyscore Tool ‘Could Crack VPNs And Expose The Anonymous’
http://www.techweekeurope.co.uk/news/nsa-xkeyscore-vpn-cracking-123499?
NSA chief: Snooping is crucial to fighting terrorism
http://www.cnn.com/2013/07/31/tech/web/nsa-alexander-black-hat/index.html
Ex-USAF Chief Scientist Likens U.S. Cybersecurity Challenge to Whac-A-Mole: Scientific American |
http://www.scientificamerican.com/article.cfm?id=usaf-cybersecurity-drones-qa-maybury

Britain ‘Not Winning War on Cyber Crime’ MPs Warn
http://www.ibtimes.co.uk/articles/495541/20130730/britain-winning-cyber-crime-war-home-affairs.htm
UK report: Banks let e-criminals pinch gobs of money underneath the law’s nose |
http://nakedsecurity.sophos.com/2013/07/30/uk-report-banks-let-e-criminals-pinch-gobs-of-money-underneath-the-laws-nose/?

Ghana Government develops cyber security policy |
http://www.modernghana.com/news/478715/1/government-develops-cyber-security-policy.html

Syrian Electronic Army Hacks Major Communications Websites
http://www.fireeye.com/blog/technical/cyber-exploits/2013/07/syrian-electronic-army-hacks-major-communications-websites.html?
Cyber Jihadists, State Department Now In Full-Blown Twitter War
http://thecable.foreignpolicy.com/posts/2013/07/29/jihadis_ape_state_department#.UfgW1Rss8CI.twitter

2013 BLACKHAT Presentations….
https://www.blackhat.com/us-13/archives.html#Healey

Semper Fi;

謝謝
紅龍

Save The Date: August 12 is CMHSecLunch

Posted on by
2

Just a heads up, mainly because it seems late this month, but the next CMHSecLunch is Monday, August 12, 2013. Location is the North Market, beginning at 11:30am. 

You can find out more here, as well as sign up for reminders and such.

Thanks to all who make it out, we always enjoy seeing you and the amazing conversations that happen there! 

Quick PHP Malware vs AV Update

Posted on by
Reply

It’s been a while since I checked on the status of PHP malware versus anti-virus. So, here is a quick catch up post. (I’ve been talking about this for a while now. Here is an old example.)

I took a randomly selected piece of PHP malware from the HITME and checked it out this afternoon. Much to my surprise, the malware detection via AV has gotten better.

The malware I grabbed for the test turned out to be a multi-stage PHP backdoor. The scanner thought it was exploiting a vulnerable WordPress installation. 

I unpacked the malware parts into plain text and presented both the original packed version from the log and the unpacked version to VirusTotal for detection testing. As you know, in the past, detection of malware PHP was sub single digits in many cases. That, at least to some extent has changed. For those interested, here are the links to see what was tripped.

Decoded to plain text vs Encoded, as received

As you can see, decoded to plain text scored a detection of 44% (19/43), which is significantly improved from a year or so ago. Additionally, excitingly, undecoded, the attack in raw form triggered a detection rate of 30% (13/44)! The undecoded result is HUGE, given that the same test a year or so ago often yielded 0-2% detection rates. So, it’s getting better, just SLOWLY.

Sadly though, even with the improvements, we are still well below half (50%) detection rates and many of the AV solutions that fail to catch the PHP malware are big name vendors with commercial products that organizations running PHP in commercial environments would likely be depending on. Is your AV in the missing zone? If so, you might want to consider other forms of more nuanced detection. 

Now, obviously, organizations aren’t just depending on AV alone for detection of web malware. But, many may be. In fact, a quick search for the dropped backdoor file on Google showed 58,800 systems with the dropped page name (a semi-unique indicator of compromise). With that many targets already victim to this single variant of PHP backdoors, it might be worth checking into if you are a corporate PHP user.

Until next time, take a look around for PHP in your organization. It is a commonly missed item in the patch and update cycles. It also has a pretty wide security posture with a long list of known attack tools and common vulnerabilities in the coding patterns used by many popular products. Give any PHP servers you have a deeper inspection and consider adding more detection capability around them. As always, thanks for reading and stay safe out there! 

Chinese Cyber Military Situational Awareness & other fun stories from ‘Cybernia”

Posted on by
2

Good day Folks;

Some very peculiar chatter from within the People’s Republic of China today lends itself to this edition of Chinese Cyber Military Situational Awareness & other fun stories from ‘Cybernia”…
Make note of the Huawei stories as well the PLA’s 86th birthday…while China’s President Xi Jinping tell’s the army in China how to behave…

People’s Republic of China’s Hackers, bloggers & professors team up to tap into blocked microblog content
http://www.globaltimes.cn/content/799621.shtml
Asian Spying Said to Focus on U.S. Radiation-Hardened Electronics
http://www.nationaljournal.com/global-security-newswire/asian-spying-said-to-focus-on-u-s-radiation-hardened-electronics-20130725
Move over Huawei, there’s a new People’s Republic of China bogeyman in town and it’s called Lenovo
http://qz.com/109356/move-over-huawei-theres-a-new-bogeyman-in-town-and-its-called-lenovo/
Intelligence Agencies Ban People’s Republic of China’s Lenovo
http://www.ibtimes.com/lenovo-banned-international-intelligence-agencies-deem-computers-vulnerable-hacking-1363611?ft=j979o
People’s Republic of China’s Huawei announces successful completion of Boracay-Palawan submarine cable system
China’s OP Middle Kingdom now completes Phase V in the Philippines…
http://www.telegeography.com/products/commsupdate/articles/2013/07/30/huawei-announces-successful-completion-of-boracay-palawan-submarine-cable-system/?
French Scholar Challenges Western Preoccupation With Chinese ‘Threat’
People’s Republic of China’s OP Middle Kingdom now completes Phase VI in France…Manadrin Chinese classes no longer optional at university….
http://www.ibtimes.com/china-not-threat-nature-qa-dr-lionel-vairon-1363679?ft=a73y7

People’s Republic of China’s Economic Strategy Series…观察者网-中国关怀 全球视野
Detailed Operational Panning Documents for Operation Middle Kingdom…
http://www.guancha.cn/strategy-book/

People’s Republic of China’s Xi: Troops must strictly follow CPC leadership – Xinhua |
PLA Troops must demonstrate IDEOLOGICAL PURITY…
http://news.xinhuanet.com/english/china/2013-07/29/c_132584552.htm
China’s Ambassador Cui Tiankai Celebrating the 86th Anniversary of the Founding of the PLA |
Soldiers of People’s Republic of China’s female special forces unit – Xinhua |
http://news.xinhuanet.com/english/photo/2013-07/30/c_132585113.htm

How much does it cost to buy one thousand Russian/Eastern European based malware-infected hosts
http://blog.webroot.com/2013/07/29/how-much-does-it-cost-to-buy-one-thousand-russianeastern-european-based-malware-infected-hosts/

Iran’s Next Cabinet: Technocratic and Security-Focused
http://www.washingtoninstitute.org/policy-analysis/view/irans-next-cabinet-technocratic-and-security-focused

Navy awards contract to Boeing to prepare EA-18G Growler electronic warfare jet to accept Next-Generation Jammer
How long before BOEING admits they were targeted and hacked again by the People’s Republic of China….?
http://www.avionics-intelligence.com/articles/2013/07/ai-boeing-ngj.html

Battle line: Cyberspace –
http://dawn.com/news/1032735/battle-line-cyberspace/?view=print

When Would Cyber War Lead to Real War?
http://www.defenseone.com/technology/2013/07/when-would-cyber-war-lead-real-war/67580/#.

Enjoy!

謝謝
紅龍

People’s Republic of Cyber Conflict & Operation Middle Kingdom….

Posted on by
5

Good Monday Morning Friends;

Much cyber conflict news related to the People’s Republic of China’s HUAWEI over the weekend.
Take particular note of both India and the United Kingdom’s leadership being pawned by HUAWEI…
Also worth mentioning is that the former head of the US Central Intelligence Agency knows and is now revealing that the People’s Republic of China’s Huawei so pies for the People’s Republic of China…oh dear no! Really…<>

Enjoy –

How Mao Tse T’ung created the People’s Republic of China’s capitalist revolution [Straits Times]
http://wanderingchina.org/2013/07/27/how-mao-created-chinas-capitalist-revolution-straits-times-risingchina-reform-mao/

Ex-CIA chief accuses People’s Republic of China’s Huawei of industrial espionage – Telegraph
http://www.telegraph.co.uk/technology/news/10191154/Ex-CIA-chief-accuses-Huawei-of-industrial-espionage.html
Why is the former head of the NSA convinced Huawei is a threat to US communication networks? | Digital Trends
http://www.digitaltrends.com/mobile/huawei-threat-to-the-us/
People’s Republic of China’s Huawei in charge of UK TalkTalk’s net filtering
Operation Middle Kingdom…Chinese colonization of United Kingdom near complete as Phase V is accomplished…
http://www.computerworlduk.com/news/security/3460990/huawei-in-charge-of-talktalks-net-filtering/
People’s Republic of China’s Huawei says it ‘shares the same cyber security goals’ as the UK government
Operation Middle Kingdom…Chinese colonization of United Kingdom near complete as Phase V is accomplished…
http://www.pcadvisor.co.uk/news/security/3459981/huawei-says-it-shares-the-same-cyber-security-goals-as-the-uk-government/
People’s Republic of China’s Huawei gets closer to its users by P@WNing India…
Operation Middle Kingdom…Chinese colonization of India near complete as Phase V is accomplished…
http://www.thehindu.com/sci-tech/technology/huawei-gets-closer-to-its-users/article4960652.ece
People’s Republic of China’s Huawei lashes out at spying allegations from former CIA head
http://gigaom.com/2013/07/19/huawei-lashes-out-at-spying-allegations-from-former-cia-head/
People’s Republic of China’s Huawei revenue grows |
http://www.itweb.co.za/index.php?option=com_content&view=article&id=65959:Huawei-revenue-grows&catid=118
Australians ‘should not fear Chinese investment’, especially People’s Republic of Huawei, says Bob Carr
http://www.scmp.com/news/hong-kong/article/1291670/australians-should-not-fear-chinese-investment-says-foreign-minister

Spy agencies ban People’s Republic of China’s Lenovo PCs on security concerns
Recall friends that Lenovo has DIRECT ties to the Chinese Academy of Sciences and the People’s Liberation Army….
http://www.afr.com/p/technology/spy_agencies_ban_lenovo_pcs_on_security_HVgcKTHp4bIA4ulCPqC7SL
Intelligence services fear People’s Republic of China’s Lenovo products due to back-doors
http://www.neowin.net/news/intelligence-services-fear-lenovo-products-due-to-back-doors
Rare Glimpse into a Real-Life Command-and-Control Server | “Dragon Eye – Mini”
http://www.crowdstrike.com/blog/rare-glimpse-real-life-command-and-control-server/index.html

Record malware growth in People’s Republic of China…
http://www.net-security.org/malware_news.php?id=2546

How America’s Top Tech Companies Created the Surveillance State
http://www.nationaljournal.com/magazine/how-america-s-top-tech-companies-created-the-surveillance-state-20130725

Security Vendors: Do No Harm, Heal Thyself — Krebs on Security
Symantec quietly releasedsecurity updates to fix serious vulnerabilities in itsSymantec Web Gateway, a popular line of security appliances designed to help “protect organizations against multiple types of Web-borne malware.”
http://krebsonsecurity.com/2013/07/security-vendors-do-no-harm-heal-thyself/

CreepyDOL…Cheap Monitoring Highlights Dangers Of Internet Of Things — Dark Reading
http://www.darkreading.com/monitoring/cheap-monitoring-highlights-dangers-of-i/240159061

U.K. Ministry of Defence hit by cyberattack, data stolen | ZDNet
http://www.zdnet.com/u-k-ministry-of-defence-hit-by-cyberattack-data-stolen-7000017831/
People’s Republic of China’s Huawei slammed for locking GCHQ personnel out of security cell
http://www.v3.co.uk/v3-uk/news/2283330/huawei-slammed-for-locking-gchq-personnel-out-of-security-cell?
China’s UK censorwall will also block “terrorist content,” “violence,” “circumvention tools,” “forums”

UK censorwall will also block “terrorist content,” “violence,” “circumvention tools,” “forums,” and more

Russian hackers got 160 million bank card numbers, but that wasn’t worst part
Federal prosecutors say they’ve blown open the largest hacking ring in US history, indicting four Russians and a Ukrainian. The biggest worry: One of them hacked into NASDAQ.
http://www.csmonitor.com/USA/Justice/2013/0725/Russian-hackers-got-160-million-bank-card-numbers-but-that-wasn-t-worst-part

Semper Fi,

謝謝
紅龍

Ask The Experts: Too Much Data

Posted on by
2

Q: “I have massive amounts of log files I have to dig through every day. I have tried a full blown SEIM, but can’t get it to work right or my management to support it with budget. Right now I have Windows logs, firewall logs and AV logs going to a syslog server. That gives me a huge set of text files every day. How can I make sense of all that text? What tools and processes do you suggest? What should I be looking for? HELP!!!!”

 

Adam Hostetler answered with:

 

I would say give OSSEC a try. It’s a free log analyzer/SEIM. It doesn’t

have a GUI with100 different dashboards and graphs, it’s all cli and

e-mail based (though there is a simple web interface for it also). It is

easy to write rules for, and it has default rules for many things,

except for your AV. You can write simple rules for that, especially if

you are just looking for items AV caught. It does take some tuning, as

with all analysis tools, but isn’t difficult after learning how OSSEC

works. If you want to step it up a bit, you can feed OSSEC alerts into

Splunk where you can trend alerts, or create other rules and reports in it.

 

Bill Hagestad added:

 

First things first – don’t be or feel overwhelmed – log files are what they are much disparate data from a variety of resources that need reviewing sooner rather than later.

 

Rather than looking at another new set to tools or the latest software gizmo the trade rags might suggest based on the flair of the month, try a much different and more effective approach to the potential threat surface to your network and enterprise information network.

 

First take a look at what resources need to be protected in order of importance to your business. Once you have prioritized these assets then begin to  determine what is the minimum level of acceptable risk you can assign to each resource you have just prioritized.

 

Next, make two columns on a either a piece of paper or a white board. In one column list your resources in order of protection requirements, i.e.; servers with customer data, servers with intellectual property, so and so forth. In a column to the right of the first assets list plug in your varying assigned levels of risk. Soon you will see what areas/assets within your organization/enterprise you should pay the most attention to in terms of threat mitigation.

 

After you have taken the steps to determine your own self- assessment of risk contact MicroSolved for both a vulnerability assessment and penetration test to provide additional objective perspective on threats to your IT infrastructure and commercial enterprise. 

 

Finally, Jim Klun weighed in with: 

 

You are way ahead of the game by just having a central log repository.  You can go to one server and look back in time to the point where you expect a security incident.

 

And what you have – Windows logs, firewall logs, and AV – is fantastic.  Make sure all your apps are logging as well ( logon success, logon failure).

Too often I have seen apps attacked and all I had in syslog was OS events that showed nothing.

 

Adam’s suggestion, OSSEC, is the way to go to keep cost down… but don’t just install and hope for the best.

You will have to tweak the OSSEC rules and come up with what works.

 

Here’s the rub: there is no substitute for knowing your logs – in their raw format, not pre-digested by a commercial SIEM or OSSEC.

 

That can seem overwhelming. And to that, some Unix commands and regular expressions are your friend.

 

So:

 

zcat auth.log | grep ssh | egrep -i ‘failed|accepted’

 

produces:

 

Jul  4 16:32:16 dmz-server01 sshd[8786]: Failed password for user02 from 192.168.105.51 port 38143 ssh2

Jul  4 16:33:53 dmz-server01 sshd[8786]: Accepted password for user01 from 192.168.105.38 port 38143 ssh2

Jul  4 16:36:05 dmz-server01 sshd[9010]: Accepted password for user01 from 192.168.105.38 port 38315 ssh2

Jul  5 01:04:00 dmz-server01 sshd[9308]: Accepted password for user01 from 192.168.105.38 port 60351 ssh2

Jul  5 08:21:58 dmz-server01 sshd[9802]: Accepted password for user01 from 192.168.105.38 port 51436 ssh2

Jul  6 10:21:52 dmz-server01 sshd[21912]: Accepted password for user01 from 192.168.105.38 port 36486 ssh2

Jul  6 13:43:10 dmz-server01 sshd[31701]: Accepted password for user01 from 192.168.105.30 port 34703 ssh2

Jun 26 11:21:02 dmz-server01 sshd[31950]: Accepted password for user01 from 192.168.105.70 port 37209 ssh2

 

 

Instead of miles of gibberish the log gets reduced to passed/fail authentication attempts.

 

You can spend an hour with each log source ( firewall, AV, etc) and quickly pare them down to whats interesting.

 

Then make SURE your OSSEC  rules cover what you want to see.

If that does not work – cron a script to parse the logs of interest using your regular expression expertise and have an email sent to you when something goes awry.

 

Revisist the logs manually periodically – they will change. New stuff will happen.  Only a human can catch that.

 

Take a look at:

http://www.securitywarriorconsulting.com/logtools/

 

The site lists a number of tools that may be useful

 

John Davis added:

 

You voice one of the biggest problems we see in information security programs: monitoring! People tell us that they don’t have the proper tools and, especially, they don’t have the manpower to perform effective logging and monitoring. And what they are saying is true, but unfortunately doesn’t let them out from having to do it. If you have peoples financial data, health data (HIPAA) or credit card information (PCI) you are bound by regulation or mandate to properly monitor your environment – and that means management processes, equipment, vulnerabilities and software as well as logs and tool outputs. The basic problem here is that most organizations don’t have any dedicated information security personnel at all, or the team they have isn’t adequate for the work load. Money is tight and employees are expensive so it is very difficult for senior management to justify the expenditure – paying a third party to monitor firewall logs is cheaper. But for real security there is no substitute for actual humans in the security loop – they simply cannot be replaced by technology. Unfortunately, I feel the only answer to your problem is for government and industry to realize this truth and mandate dedicated security personnel in organizations that process protected data.

 

As always, thanks for reading and if you have a question for the experts, either leave it in the comments, email us or drop us a line on Twitter at (@lbhuston). 

People’s Republic of China & Operation Middle Kingdom…oh yes, Huawei and the colonization of Africa & India….

Posted on by
2

Good day my curious friends…much in the cyber news to amuse and entrain, but never alarm you…

Pay particular attention the articles below related to Huawei and their colonization of India via BSNL and Ethiopia via massive telco rollouts. People’s Republic of China & Operation Middle Kingdom…oh yes, Huawei and the colonization of Africa & India….always remember that a significant amount of cyber threat news and alerts will be released on Friday, saturdays and Sundays…when no one is paying attention…

Enjoy –

People’s Republic of Hacking, er…China is stealing intellectual property to boost its economic development…
Don’t let Snowden overshadow the real cyber threat
http://www.ft.com/intl/cms/s/0/d18f1e6a-ef97-11e2-a237-00144feabdc0.html

UK’s Cameron recommended porn filter controlled by People’s Republic of China’s Huawei
http://www.computing.co.uk/ctg/news/2285074/camerons-recommended-porn-filter-controlled-by-huawei

Baidu’s guide to the eight biggest Internet scams in People’s Republic of China
http://www.danwei.com/baidus-guide-to-the-eight-biggest-internet-scams-in-china/

Chinese can be pressured into accepting global cybersecurity norms
http://www.fiercegovernmentit.com/story/lewis-chinese-can-be-pressured-accepting-global-cybersecurity-norms/2013-07-24
Chinese hacker who once targeted the US switches sides to help defend Western companies… |
http://www.abc.net.au/news/2013-07-22/chinese-hacker-switches-from-attack-to-defence/4836572
Chinese hacker to help defend Western companies
http://au.news.yahoo.com/latest/a/-/article/18104751/chinese-hacker-who-once-targeted-the-us-switches-sides-to-help-defend-western-companies/
The Decline of China’s Internet Cafes
http://thediplomat.com/china-power/the-decline-of-chinas-internet-cafes/?
The great firewall of China gets metaphorical
The Chinese government’s increasingly sophisticated approach to censorship demands a new interpretation
http://www.guardian.co.uk/technology/2013/jul/14/china-great-firewall-put-out
Hengqin New Area Aims to Skirt Great Firewall – China Digital Times (CDT)
http://chinadigitaltimes.net/2013/07/hengqin-new-area-aims-to-skirt-great-firewall/?

BSNL to switch to People’s Republic of China’s Huawei’s next generation networks
China’s colonization of India is now complete as Operation Middle Kingdom continues…
http://www.thehindu.com/business/Industry/bsnl-to-switch-to-huaweis-next-generation-networks/article4953441.ece
Huawei Hits 100th 100G Deployment Milestone, Paving an Information Super Highway for the Next Decade
http://www.webwire.com/ViewPressRel.asp?aId=177824
Ethiopia signs $700 mn mobile network deal with People’s Republic of China’s Huawei
Operation Middle Kingdom continues in Africa as People’s Republic of China colonizes with their business development instead of weapon systems…US AFRICOM puzzled by lack of success…
http://nazret.com/blog/index.php/2013/07/25/ethiopia-signs-700-mn-mobile-network-deal-with-china-s-huawei

Find Out Why Apple’s Revenues in China Dropped 43% in Q2
http://www.techinasia.com/apple-china-revenues-drop-q2-2013/
Insight: How Samsung is beating Apple in the People’s Republic of China
http://www.reuters.com/article/2013/07/26/us-samsung-apple-china-insight-idUSBRE96P05F20130726
Apple Developer site hack: doubts cast on Turkish hacker’s claims
Guardian investigation raises questions over claims by Turkish researcher that he hacked into Apple’s Developer portal
http://www.guardian.co.uk/technology/2013/jul/26/apple-developer-site-hack

Japanese Minister Proposes More Active Military Presence in Region
http://www.nytimes.com/2013/07/27/world/asia/japanese-minister-proposes-more-active-military-presence-in-region.html?&pagewanted=all

$300 million Russian cyber crime ring broken by US feds
http://www.scmagazineuk.com/300-million-russian-cyber-crime-ring-broken-by-us-feds/article/304680/
Five Charged in Massive Financial Hacking Case | TIME.com
http://techland.time.com/2013/07/26/five-charged-in-massive-financial-hacking-case/

US Marines Focused at Tactical Edge of Cyber, Commander Says…
http://www.defense.gov/news/newsarticle.aspx?id=120246
USAF pleads with airmen to think about business of cyber…http://www.defense.gov/news/newsarticle.aspx?id=120222

A historical overview of the cyberattack landscape
http://www.net-security.org/secworld.php?id=15284
US Military: Forget cold war — Here comes cyber war
http://www.digitaljournal.com/article/355119
“What Is That Box?” — When The NSA Shows Up At Your Internet Company
http://www.buzzfeed.com/justinesharrock/what-is-that-box-when-the-nsa-shows-up-at-your-internet-comp

Hacked in 276 Seconds – Timely Intelligence Improves Ability to Thwart Cyber Attacks: Survey |
http://www.securityweek.com/hacked-276-seconds-timely-intelligence-improves-ability-thwart-cyber-attacks-survey

KPMG red-faced after being found w/data leak Reverse assessment reveals KPMGs publicly accessible data |
http://www.scmagazineuk.com/exclusive-reverse-assessment-reveals-kpmgs-publicly-accessible-data/article/304295/

Semper Fi,

謝謝
紅龍

YAPT: Yet Another Phishing Template

Posted on by
4

Earlier this week, we gave you the touchdown task for July, which was to go phishing. In that post, we described a common scam email. I wanted to post an example, since some folks reached out on Twitter and asked about it. Here is a sample of the email I was discussing.

<paste>

Hi My name is Mrs. Hilda Abdul , widow to late Dr. Abdul A. Osman, former owner of Petroleum & Gas Company, here in Kuwait. I am 67 years old, suffering from long time Cancer of the breast.

From all indications my condition is really deteriorating and it’s quite obvious that I won’t live more than 3 months according to my doctors. This is because the cancer stage has gotten to a very bad stage.

I don’t want your pity but I need your trust. My late husband died early last year from Heart attack, and during the period of our marriage we couldn’t produce any child. My late husband was very wealthy and after his death, I inherited all his businesses and wealth .The doctor has advised me that I will not live for more than 3 months ,so I have now decided to spread all my wealth, to contribute mainly to the development of charity in Africa, America,

Asia and Europe .Am sorry if you are embarrassed by my mail. I found your e-mail address in the web directory, and I have decided to contact you, but if for any reason  you find this mail offensive, you can ignore it and please accept my apology. Before my late husband died he was major oil tycoon in Kuwait and (Eighteen Million Dollars)was deposited  in a Bank in cote d ivoire some years ago, that’s  all I have left now,

I need you to collect this funds and distribute it yourself to charity .so that when I die my soul can rest in peace. The funds will be entirely in hands and management. I hope God gives you the wisdom to touch very many lives that is my main concern. 20% of this money will be for your time and effort includin any expensese,while 80% goes to charity. You can get back to me via my private e-mail: (hilda.abdul@yahoo.com) God bless you.
1. Full name :
2. Current Address :
3. Telephone N° :
4. Occupation :
5. Age :
6. Country :

MRS. Hilda Abdul

<end paste>

As you can see, this is a common format of a phishing scam. In this case, you might want to edit the targeting mechanism a bit, so that they have to click through to a web page to answer or maybe even include a URL as supposed proof of the claim. That way you would have two ways to catch them, one by email reply and two by click through to the simple phish application.

As always your milage and paranoia may vary, but it is still pretty easy to get people to click or reply ~ even with age old spam phish attacks like this. What kind of return percentages did you get? What lessons did you learn? Drop us a line on Twitter (@lbhuston) and let us know.