Pay Attention to this Samba Vulnerability

We have a feeling that this recent Samba vulnerability should be at the top of your mind. We are seeing a lot of attention to this across a variety of platforms and we wanted to make sure you saw it. It should be patched as soon as possible, especially on highly sensitive data stores and critical systems.

Let us know if you have any questions.

Spike in HITME NTP Probes Following Recent Exploits

For those of you that are unfamiliar with the HITME project, it is a set of deployed HoneyPoints that gather real-world, real-time attacker data from around the world. The sensors gather attack sources, frequency, targeting information, vulnerability patterns, exploits, malware and other crucial event data for the technical team at MSI to analyze. We frequently feed these attack signatures into our vulnerability management service to ensure that our customers are tested against the most current forms of attacks being used on the Internet.
 
On a monthly basis, we have been taking a step back and looking at our HITME data from a bird’s eye view to find common attack patterns.  Throughout December, we observed a significant increase in attacks against Port 123 (NTP).  This is due to the recent discovery of a vulnerability within NTP.
 
A majority of the attacks we observed against Port 123 appeared to originate out of the United States of America, Germany, Switzerland, Russia, and China. 
 
PastedGraphic 2
This vulnerability should be addressed as soon as possible as exploits are publicly available.  All NTP Version 4 releases prior to Version 4.2.8 are vulnerable and need to be updated to Version 4.2.8.  Do not hesitate to contact us at info@microsolved.com if you require any assistance in responding to this vulnerability.

This blog post by Adam Luck.

5 Ways My Medical Background Makes Me a Better Intelligence Analyst

When I first started for MicroSolved, Inc.(MSI), I wasn’t sure what to think, but now that I have been here for nearly three months I feel I am starting to get the hang of  what it is to be an intelligence analyst. At least a little bit anyhow. Now mind you I am not your typical intelligence analyst, nor am I a new college graduate, but rather I am coming to MSI from the health care industry with over twenty years of work experience in that industry. This was a completely different mindset, with a whole host of new things for me to experience and learn. For me this was totally refreshing and exactly what I wanted and more importantly, needed! There are a few things that I have noticed in my short time here that could be considered pearls of wisdom rather than actual characteristics of a good employee that I feel make me a good intelligence analyst for MSI. Perhaps they are one and the same. At least that is my hope 😉

First, while I am not a seasoned IT professional like so many others that I work with, I am not naive to the fact that there are deadlines and expectations thrust upon all of us. This in my opinion is no different than in being in the hospital setting where people expect you to act quickly and in the best interests of your patient at all times. Couldn’t we say the same is true working for a company like MSI?  In that it is the expectation to be professional, performing your best at all times, and the like? I would like to think that is what I strive for.

After thinking a bit longer perhaps it is that we share a tenacity for getting to the bottom of whatever mystery that we are looking at. Whether it is a series of questions that we may be asking our patients in an effort to try to figure out what ailment they be suffering from. This is not unlike when we are looking for a key bit of code for an algorithm to help us do our work more efficiently. Regardless, it is this mentality of never giving up! To keep fighting, keep looking, to keep trying. Just keep chipping away at it. 

I think the next characteristic would have to be patience. Something that we all have often heard from our grandparents growing up as children. Something that in my mind and in my experience has played a provocative role in both my dealings with patients, their families and with challenging projects in the IT world. Now while as I previously stated in the above paragraph that tenacity plays a role, I also think having a measure of patience does too. There are times in the medical world where even the most experienced physician stands there for a moment and scratches his or her head and says “I don’t know”. Now to a patient that is the last thing that they want to here, but sometimes we truly have to “wait and see”. Sometimes grandma was right! There have been times while working on projects with MSI, where sitting back even if it’s just a few moments, allowed me to gain a better “bird’s eye view” of a given project and really helped me figure out what it was that I was looking for and ultimately aided the project.

Another area that I think gives me an edge would be that I am willing to go the extra mile and I am not afraid to work hard to attain my goals. It isn’t enough to just punch a clock or be mediocre! I have told this to my children, my patients and my friends. Never give up, always work your butt off for what you want in life! It may take time for what you want to come to fruition, but if you’re willing to put the time, energy and effort into it, then it will come!  It takes sacrifice to get to your goals. Others will recognize your efforts and aid you in your path. That’s what I feel MSI has done and is continuing to do for me!

Lastly, laugh! I have not laughed so hard in any of my previous work experiences as compared to working for MSI these past few months. Don’t get me wrong there were plenty of wonderful times, but here at MSI it is a whole new animal! Yes, we work hard, but I think having a healthy sense of humor and a desire to see others laugh is what really sets MSI apart. If you are down, they help pick you up! So often we spend our work lives with people that aren’t our family for hours on end. Shouldn’t we have some fun while we work? If you are lucky enough you do. Then, by choice those people that aren’t your family start to become them and find a place in your heart. Then, your work doesn’t seem like work anymore. 

Yes it’s true that I am new to the world of information technology as a career choice, but that doesn’t mean that I don’t have some very real life experiences to draw upon. Remember, it is a combination of work ethic, tenacity, patience, a sense of humor and ultimately a willingness to never give up. These are the things that will make you successful, not only in your career path, but in life as well. These are my little pearls of wisdom, just a few tidbits of information to help you get to where you want to be in life. Who knows it might even be right here at MSI.

This post by Preston Kershner.

Heads Up, ICS & SCADA Folks, Especially!

Remotely exploitable vulnerabilities have been identified & published in NTP (network time protocol). This is often a CRITICAL protocol/instance for ICS environments and can be widely located in many control networks. 

The fix currently appears to be an upgrade to 4.2.8 or later.

This should be considered a HIGH PRIORITY for critical infrastructure networks. Exploits are expected as this is an unauthenticated remotely triggered buffer overflow, which should be easily implemented into existing exploit kits.

Please let us know if we can assist you in any way. Stay safe out there! 

Update: 12/19/14 2pm Eastern – According to this article, exploits are now publicly available.

Here’s Why You Don’t Want RDP on the Internet

For those of you that are unfamiliar with the HITME project, it is a set of deployed HoneyPoints that gather real-world, real-time attacker data from around the world. The sensors gather attack sources, frequency, targeting information, vulnerability patterns, exploits, malware and other crucial event data for the technical team at MSI to analyze. We frequently feed these attack signatures into our vulnerability management service to ensure that our customers are tested against the most current forms of attacks being used on the Internet.

It’s also important that we take a step back and look at our HITME data from a bird’s-eye view to find common attack patterns. This allows us to give our customers a preemptive warning in the event that we identify a significant increase in a specific threat activity. We recently analyzed  some of the data that we collected during the month of November. We found that over 47% of the observed attacks in the public data set were against the Remote Desktop Protocol (RDP)(often also known as Microsoft Terminal Services). This was more than attacks against web servers, telnet servers and FTP servers combined!

Be sure that all recommended security measures are applied to RDP systems. This should include requiring the use of RDP clients that leverage high levels of encryption. If you need any assistance verifying that you are protected against attacks against your terminal servers, feel free to contact us by sending an email to info(at)microsolved(dot)com.

This post by Adam Luck.

Hacktivism on the Rise

With all of the attention to the Ferguson case and the new issues around the public response to the New York Police Department Grand Jury verdict, your organization should expect to be extra vigilant if you have any connection to these events. This could include supply chain/vendor relationships, locations or even staff members speaking out publicly about the issues. 

Pay careful attention to remote access logs, egress traffic and malware detections during the ongoing social focus on these issues and press coverage.

As always, if MSI can be of assistance to you in any security incident, please don’t hesitate to let us know! 

Accepting Identity Theft

I can recall a time when I wasn’t concerned about data theft. Eventually, buzz words such as “breach” and “identity theft” became a regular part of my vocabulary.  I began to wonder if I would ever be affected by a data breach. In 2003, I received a letter in the mail informing me that my personal data had been stolen. I remember asking myself, “when will this happen next?” In 2004, I once again became a victim of a data breach. Despite my young age at the time, I had already started to think of identity theft in the cynical terms of “not if but when”. It then became apparent to me that I could no longer think in terms of “if” or “when” but I should focus on “how often”.

I find it helpful to compare identity theft to personal health care. Eating the right foods, taking all the trendy vitamins and getting the recommended amount of exercise isn’t enough to guarantee perfect health. You are still susceptible to diseases that you can’t detect on your own. This is why you typically see a doctor for checkups on a regular basis. You should use the same thought process when considering the possibility of identity theft. Regardless of how much effort you put into securing your identity, your personal data will be stolen. This is why I feel strongly that we should focus on monitoring and preparing for identity theft with the same time and energy that we devote to trying to prevent it.

Just like your health care, it’s also worthwhile to take a proactive approach to handling identity theft. It’s important to have multiple methods of discovering if you are a victim of fraud. This can be as simple as checking your debit/credit card statements and using an automated solution (such as LifeLock) to monitor for irregularities in your credit report. Don’t just wait to receive a notice in the mail or find out about the latest hack on the news. It can take the companies that handle your personal data and process your credit cards months before they realize that they have been hacked. This gives the attackers ample time to take advantage of your stolen data.

It’s also worthwhile to prepare yourself for how to handle an incident when it occurs. This can be as simple as keeping a list of the contact information for all of your financial institutions so that you can notify them as soon as you detect suspicious activity. Also, a majority of the aforementioned credit monitoring solutions include assistance services in the event that a criminal begins using your identity. Be sure to take advantage of these resources as these organizations have the necessary institutional knowledge to help assist you.

In short, continue doing what you can to prevent your identity from being stolen. Simple things like setting complex passwords and avoiding the reuse of your passwords between different services can go a long way to prevent you from becoming a victim of identity theft. However, the next time you’re configuring a lengthy password, be sure to ask yourself “Am I prepared for identity theft?”

This article courtesy of Adam Luck – @adamjluck.

Shellshock: Got Inventory?

Im sure youve all heard of Shellshock by now? If not, its a security flaw in Bash that allows attackers to take control of systems. Bash is really an acronym/pun meaning Bourne-again shellthat was written as a free software replacement for the Bourne shell that preceded it. It is a UNIX shell that acts as a command processor and also reads commands from scripts. The problem is that Bash is present in all kinds of things including Web servers and operating systems. This is a very serious flaw! Worse than any other code vulnerability I can name off hand. There are several serious exploits already extant in the wild. Hundreds of millions of devices and credit cards are at immediate risk of compromise across the globe. Institutions are strongly recommending that people not use their credit cards to make Internet purchases for at least the next several days. Imagine the loss in revenue and buyer confidence this is going to cause! Productivity may well go down and prices may well go up as a consequence of this flaw.

Luckily there are good patches already available to combat this glitch, and I’m sure additional fixes and tweaks are in the offing. But to have any level of safety you need to patch everything on your network that is vulnerable, and you need to do it quickly. Do you know exactly what devices are a part of your network and exactly what operating systems, software and firmware versions are installed on them? Specifically, do you know where Bash is running? If you dont, you may install patches furiously over the next few days and still end up being vulnerable without knowing it. Can you in all good conscience assure your Web customers that their transactions and private information are safe?

Shellshock may have one hidden benefit though; it may be the cold dose of reality that causes organizations to finally get serious about information security and adopt best practices security recommendations, especially where inventories of devices and software are concerned. There is a reason why guidance such as the MSI 80/20 Rule of Information Security and the Top 20 Critical Controls for Effective Cyber-Security list making inventories their number one information security project. If you dont know what you have, how can you possibly secure it?!

Right now, if you are among the prescient few who do keep complete dynamic inventories, ensure that input to all available software fields is validated and have configured each device on your network with a unique admin password, you are sitting pretty! You have the knowledge and time necessary to deal with this problem, and will probably earn kudos and market share from you customers. Isnt that kind of assurance worth spending some time and money on America? 

This blog post contributed by John Davis.

Patch for ShellShock ASAP!

If you haven’t paid attention to the Bash Shellshock vulnerability – NOW IS THE TIME!

Source IPs for probes looking for the vulnerability are growing slowly in number and scope of scans. (As of 9/30/14, 10am Eastern).

There are many vulnerable devices and systems available to exploit and a variety of exploitation vectors exist – including web CGIs, DHCP clients, OpenVPN, SSH, etc. It is highly likely that a wide variety of embedded systems are also vulnerable that meet these capabilities. So far, we have seen attack traffic in the HITME coming from a few SOHO routers and a couple of other embedded network devices. Items like printers, some routers & managed switches, home gadgets, cameras, etc. are likely targets as well.

In the industrial control world, there are a variety of embedded devices leveraging Linux at the core, and many with exposed CGI mechanisms for remote management and monitoring. These need to be inspected as well, as they may also prove vulnerable and potentially exploitable via one or more vectors. Patching may require firmware upgrades in some cases. Contact the vendor for more information.

But, no matter what systems you use and manage, NOW IS THE TIME. Pay attention to this issue and get moving on patching, adding compensating controls and rolling forward with enhanced detection mechanisms. GET BUSY!

As always, if we can assist, feel free to give us a call or drop us a line. We have HoneyPoint emulations for HPSS clients that can help identify sources of traffic and we have assessment signatures for up to the moment known attack vectors. Let us know if we can help!

Thanks for reading, and stay safe out there! 

UPDATE: Good news on Shellshock for embedded devices: If it runs BusyBox, it’s likely NOT vulnerable.

Crypto Locker Down, but NOT Out

So, the US govt and law enforcement claim to have managed the disruption of crypto locker. And officials are either touting it as a total victory or a more realistic slowdown of the criminals leveraging the malware and bot-nets.

Even as the govt was touting their takedown, threat intelligence companies around the world (including MSI), were already noticing that the attackers were mutating, adapting and re-building a new platform to continue their attacks. The attackers involved aren’t likely to stay down for long, especially given how lucrative the crypto locker malware has been. Many estimates exist for the number of infections, and the amount of payments received, but most of them are, in a word, staggering. With that much money on the line, you can expect a return of the nastiness and you can expect it rather quickly.

Takedowns are effective for short term management of specific threats, and they make great PR, but they do little, in most cases, to actually turn the tide. The criminals, who often escape prosecution or real penalties, usually just re-focus and rebuild. 

This is just another reminder that even older malware remains a profit center. Mutations, variants and enhancements can turn old problems like Zeus, back into new problems. Expect that with crypto locker and its ilk. This is not a problem that is likely to go away soon and not a problem that a simple takedown can solve.