Another Word For It Patrick Durusau on Topic Maps and Semantic Diversity

Hacker Fantastic and x0rz have been deriding Shadow Brokers Response Team is creating open & transparent crowd-funded analysis of leaked NSA tools.

In part because whitehats will get the data at the same time.

Even if whitehats could instantly generate patches for all the vulnerabilities in each monthly release, if the vulnerabilities do have value, always an open question, they will retain that value for years, even more than a decade.

Why?

Roger Grimes recites the folk wisdom:

…
Folk wisdom says that patching habits can be divided into quarters: 25 percent of people patch within the first week; 25 percent patch within the first month; 25 percent patch after the first month, and 25 percent never apply the patch. The longer the wait, the greater the increased risk.
…

Or to put that another way:

50% of all vulnerable systems remain so 30+ days after the release.

25% of all vulnerable systems remain so forever.

Here’s a “whitehat” graphic that makes a similar point:

(From: Website Security Statistics Report 2015)

For $100 each by 2500 people, assuming there are vulnerabilities in the first Shadow Brokers monthly release, you get:

Vulnerabilities for 25% of systems forever (assuming patches are possible), vulnerabilities for 50% of systems are vulnerable for more than a month (assuming patches are possible), for some industries offer years of vulnerability, especially government systems.

For a $100 investment?

Modulo my preference for a group buy, then distribute model, that’s not a bad deal.

If there are no meaningful vulnerabilities in the first release, then don’t spend the second $100.

A commodity marketplace for malware weakens the NSA and its kindred. That’s reason enough for me to invest.

What would you do if you discovered:

…
A cache of more than 60,000 files were discovered last week on a publicly accessible Amazon server, including passwords to a US government system containing sensitive information, and the security credentials of a lead senior engineer at Booz Allen Hamilton, one of the nation’s top intelligence and defense contractors. What’s more, the roughly 28GB of data contained at least a half dozen unencrypted passwords belonging to government contractors with Top Secret Facility Clearance.
…

?

Dell Cameron reports in: Top Defense Contractor Left Sensitive Pentagon Files on Amazon Server With No Password this result:

…
UpGuard cyber risk analyst Chris Vickery discovered the Booz Allen server last week while at his Santa Rosa home running a scan for publicly accessible s3 buckets (what Amazon calls its cloud storage devices).

…

The mission of UpGuard’s Cyber Risk Team is to locate and secure leaked sensitive records, so Vickery’s first email on Wednesday was to Joe Mahaffee, Booz Allen’s chief information security officer. But after received no immediate response, he went directly the agency. “I emailed the NGA at 10:33am on Thursday. Public access to the leak was cut off nine minutes later,” he said.
…

What an unfortunate outcome.

Not faulting Chris Vickery, who was doing his job.

But responsible disclosure to Booz Allen Hamilton and then NGA, will result in no change to Booz Allen Hamilton’s position as a government IT supplier.

Public distribution of these files might not result in significant changes at government agencies and their IT contractors.

On the other hand, no consequences for agencies and their IT contractors hasn’t improved security.

Shouldn’t we give real world consequences a chance?

Dridex: A History of Evolution by Nikita Slepogin.

From the post:

The Dridex banking Trojan, which has become a major financial cyberthreat in the past years (in 2015, the damage done by the Trojan was estimated at over $40 million), stands apart from other malware because it has continually evolved and become more sophisticated since it made its first appearance in 2011. Dridex has been able to escape justice for so long by hiding its main command-and-control (C&C) servers behind proxying layers. Given that old versions stop working when new ones appear and that each new improvement is one more step forward in the systematic development of the malware, it can be concluded that the same people have been involved in the Trojan’s development this entire time. Below we provide a brief overview of the Trojan’s evolution over six years, as well as some technical details on its latest versions.
…

Compared to the 2015 GDP of the United States at ~$18 trillion, the ~$40 million damage from Dridex is a rounding error.

The Dridex authors are not killing the goose that lays golden eggs.

Compare the WannaCry ransomware attack, which provoked a worldwide, all hands on deck response, including Microsoft releasing free patches for unsupported software!

Maybe you can breach an FBI file server and dump its contents to Pastebin. That attracts a lot of attention and is likely to be your only breach of that server.

Strategy is as important in cyberwarfare as in more traditional warfare.

The chief of Europol warns the WCry/WanaCry crisis to grow Monday, May 15, 2017. That exhausted Europol’s reservoir of the useful comments for this “crisis.”

“Crisis” with parentheses because only unpatched but supported Windows systems and no longer supported Windows systems are vulnerable to WCry/Wanacry.

Exception for non-supported systems: Microsoft issued a patch for Windows XP, unfortunately, to protect against WCry/WanaCry.

Translation: If you are running Windows XP without the WCry/WanaCry patch, you can still be a victim.

For the more technically minded, Amanda Rousseau writes in: WCry/WanaCry Ransomware Technical Analysis:

As we discussed when this outbreak began, the WCry or WanaCrypt0r ransomware spread quickly across Europe and Asia, impacting almost 100 countries and disrupting or closing 45 hospitals in the UK. As the ransomware continued to propagate, I got my hands on a sample and quickly began analyzing the malware. This post will walk through my findings and provide a technical overview of the strain of WCry ransomware which caused the massive impact on Friday. Many have done great work analyzing this malware in action and helping contain its spread, and I hope my comprehensive static analysis will provide a good overall picture of this particular ransomware variant on top of that.
…

I assume you are:

1. Not running Windows
2. Are running supported and patched Windows
3. Are running patched Windows XP (please don’t tell anyone)

If any of those are true, then Rousseau’s post makes great reading material for Monday, May 15, 2017.

If you are exposed, you should take steps to end your exposure now. Rousseau’s post can wait until you are safe.

IBM shipped malware-laden USB sticks to unsuspecting customers by Chris Bing.

From the post:

Malware-laden USB sticks were accidentally sent by IBM to a series of enterprise customers that had purchased storage systems developed by the computing giant, according to a company advisory published last week.

An unidentified number of these drives were mailed as an installation tool for users setting up IBM Storewize V3700 and V5000 Gen 1 storage systems. IBM says that all of the infected USBs carried the same serial number: 01AC585.

An IBM spokesperson did not respond to CyberScoop’s inquiry. It remains unclear how the malware originally found its way onto the drives.
…

One upside of this story is you now know what a USB for the IBM Storewize V3700 and V5000 Gen 1 storage systems looks like.

Not that you would go out and create fake USBs for IBM Storewize V3700 and V5000 Gen 1 storage systems. Heaven forbid!

Another upside is the story acts as a reminder that you can purchase or sweat over find a new zero-day, versus taking the simpler route of getting a victim to infect themselves.

Professional DVD duplication is cheap and widespread. Recipients are unlikely to question the receipt of a “prize” DVD.

Selecting best DVD for a recipient is the real question. Pleading “responsible disclosure,” I have to omit details on ways to make that selection.

😉

The DVD route requires more preparation than phishing but unlike emails, due to sharing, malware DVDs are gifts that keep on giving.

Abusing Gmail to get previously unlisted e-mail addresses

From the post:

tl;dr: I discovered a glitch that allowed me to guess, in large number, existing Google accounts addresses that could otherwise be unknown. DISCLAIMER: it’s just bruteforce that wasn’t properly rate-limited, nothing too fancy, so if you’re looking for some juicy 0day please pass along 😉
… (emphasis in original)

Cutting to the chase:

…
This way I was able to guess around 40,000 valid e-mail addresses per day with a stupid unoptimized PoC.
… (emphasis in original)

When advised of the issue, Google responded its not a security bug.

Intel chip vulnerability lets hackers easily hijack fleets of PCs by Zack Whittaker.

From the post:

A vulnerability in Intel chips that went undiscovered for almost a decade allows hackers to remotely gain full control over affected Windows PCs without needing a password.

The “critical”-rated bug, disclosed by Intel last week, lies in a feature of Intel’s Active Management Technology (more commonly known as just AMT), which allows IT administrators to remotely carry out maintenance and other tasks on entire fleets of computers as if they were there in person, like software updates and wiping hard drives. AMT also allows the administrator to remotely control the computer’s keyboard and mouse, even if the PC is powered off.

To make life easier, AMT was also made available through the web browser — accessible even when the remote PC is asleep — that’s protected by a password set by the admin.

The problem is that a hacker can enter a blank password and still get into the web console, according to independent technical rundowns of the flaw by two security research labs.

Embedi researchers, credited with finding the bug, explained in a whitepaper posted Friday that a flaw in how the default “admin” account for the web interface processes the user’s passwords effectively lets anyone log in by entering nothing at the log-on prompt.
…

Opportunity to stretch your technical chops as fixes are due to roll out May 8th and thereafter.

Of course, as Verizon posted last week:

81% of hacking-related breaches leveraged either stolen and/or weak passwords. (page 3)

Decade old hardware bugs grab headlines but human fails are the bread and butter of cybersecurity.

Just in case you forgot, every packet of Internet traffic can disclose your identity.

From Twitter today:

I have no idea if this was the actual Macron leaker or an account being used to mask their true identity.

But, it’s worth a quick heads up to say:

Presume every packet from your computer is being captured (not necessarily read if encrypted) somewhere by someone.

Plan accordingly.

Instead of running afoul of It’s hard to make predictions, especially about the future, Verizon is looking backwards at hacking in 2016.

The full report runs over seventy pages of hacker success stories but if you lack the time or stomach to read it in full, consider Kelly Sweeney’s Verizon 2017 Data Breach Investigation Report Released, which reads in part:

We follow the Verizon Data Breach Investigation Report each year. It just hit the news stand and as always, is full of insights.

The report collected data from 65 organizations in 84 countries, including 42,068 cybersecurity incidents and 1,935 data breaches.

The major themes of the report are:

• No one thinks it’s going to be them. Until it is.
• Organizations think they’ve got the basics covered.
• People are also still failing to set strong passwords.
• People rely on how they’ve always done things.

The conclusion is that all organizations and industries are at risk of cyber-attacks, and 61 percent of the data breaches experienced by those responding were companies with less than 1,000 employees.
…

You should not be asking why there is so much cybercrime, but rather, why isn’t there more?

My unscientific explanation is the number of potential targets out number hackers by two or more orders of magnitude.

Yours?

Want be a successful hacker but you’re not a rocket/CS scientist? There’s hope!

Lucian Constantin writes in Cyberspies tap free tools to make powerful malware framework:

Over the past year, a group of attackers has managed to infect hundreds of computers belonging to government agencies with a malware framework stitched together from JavaScript code and publicly available tools.

The attack, analyzed by researchers from antivirus firm Bitdefender, shows that cyberespionage groups don’t necessarily need to invest a lot of money in developing unique and powerful malware programs to achieve their goals. In fact, the use of publicly available tools designed for system administration can increase an attack’s efficiency and makes it harder for security vendors to detect it and link it to a particular threat actor.

The Bitdefender researchers have dubbed the newly discovered attack group Netrepser and traced back some of its attack campaigns to May 2016. The group is still active, but to Bitdefender’s knowledge its attacks have never been publicly documented before, which might be in part because its campaigns are highly targeted.
…

Some tools were developed at public expense (read CIA) and have gained wider usage.

You may not be Stephen Hawking but the effort you are willing to invest determines your success as a hacker.

The question to ask yourself: What am I going to learn today?

Symantec continues the Sears Wish Book tradition:

for hackers with the 2017 Internet Security Threat Report (Symantec, ISTR 22).

Like the original, the Hacker Wish Book 2017 has:

Flashy graphics:

(Did you make the top ten?)

Exciting textual tidbits:

…
Our data found that 76 percent of websites scanned contained vulnerabilities—the same percentage as 2014 and just two percent less than the 2015 figure. at page 33)
…

Holiday tips (best practices):

• Targeted attacks: Espionage, subversion, & sabotage (page 22)
• Email: Malware, spam, & phishing (page 31)
• Web attacks, toolkits, & exploiting vulnerabilities online (page 36)
• Cyber crime & the underground economy (page 54)
• Ransomware: Extorting businesses & consumers (page 62)
• New frontiers: Internet of Things, mobile, & cloud threats (page 67)
• Mobile (page 72)
• Cloud (page 74)

Who Was Left Out?

Before you print a full-color copy of 2017 Internet Security Threat Report (Symantec, ISTR 22) for your “reading” room, ask who was left out?

Hackers are covered by the list of schemes, devices and strategies. Managers are interested in comparative statistics, “see, almost everybody else gets hacked too.” Hmmmm, but a class of people are missing.

Here’s a hint: Use the search function to look for salary (0 hits), hiring (0 hits), training (0 hits), compensation (0 hits).

The cyberdefense community gets no joy from the Hacker Wish Book 2017.

Not one mention of the need to pay competitive compensation for cyberdefense employees (not part-time contractors) with benefits and working conditions suitable for that community.

We have all seen legislatures flail about on cybercrime (CFAA). Not to mention management’s foolish belief that urging present staff “to do better,” is a solution to cyber-insecurity (the best practices mentioned above).

If you credit the Symantec report at all, how would you grade both of those strategies?

If your answer is anything other than “F,” contact me as I have the deed to bridges in New York City. (Apologies to other readers, it’s hard to resist clipping business types with more money than judgment.)

Anyone interested in improved cybersecurity needs to invest in cybersecurity. Including full-time staff and resources.

When I say “full-time” staff, I mean just that. Not sysadmin, DBA, webmaster, and cybersecurity all rolled into one position. Any one of those, with further sub-specialization as necessary, is a full-time job. (Just because you don’t understand a task doesn’t make it easy.)

Of course you can have your data breach figure in the Hacker Wish Book 2018. Or be the first in your industry to get tagged with punitive damages for a data breach. That’s going to happen. The question is: Will it be you?

Your call.

New Shodan Tool Can Find Malware Command and Control (C&C) Servers by Catalin Cimpanu.

From the post:

Shodan and Recorded Future have launched today a search engine for discovering malware command-and-control (C&C) servers. Named Malware Hunter, this new tool is integrated into Shodan, a search engine for discovering Internet-connected devices.

Malware Hunter works via search bots that crawl the Internet looking for computers configured to function as a botnet C&C server.

In order to trick a C&C server to reveal its location, the search bot uses various predefined requests to pretend to be infected computer that’s reporting back to the C&C server. If the scanned computer responds, Malware Hunter logs the IP and makes it available via the Shodan interface.
…

Take this news as encouragement to step up your game.

On the upside, perhaps Malware Hunter or some successor will “out” government spy malware.

A Map Of Wireless Passwords From Airports And Lounges Around The World (Updated Regularly) by Anil Polat.

From the post:

Finding an open wireless connection in many airports isn’t always easy, or possible, without a password (or local phone number which is stupid). The difficulty of getting online is why I asked you for and created an always-up-to-date list of airport wireless passwords around the world. You’ve been sending me your tips regularly and I post on the foXnoMad Facebook page when there’s a new password or airport added.

Recently, reader Zach made a great suggestion that will make it easier for you to search, add, and keep up with this airport wireless password list.
….

I applaud Polat taking the initiative and investing the effort to make this wonderful resource available. Certainly a benefit to travelers who are quite casual about WiFi security.

I say “travelers who are quite casual about WiFi security” because any false WiFi hotspot is going to set the same password as the pay-to-play airport WiFi.

Being charged for a service is no guarantee of non-abuse. Any cable subscriber knows that already.

The password list makes airports sound like great hacking locations. Free WiFi, cheap food, easy targets, but, not such a great spot after all.

Presume all faces are scanned at airports, processed and stored. Becoming a “frequent face (FF)” doesn’t carry the same benefits as “frequent flyer.? You have been warned.

Pirate Bay Founder Launches Anonymous Domain Registration Service

Does this sound anonymous to you?

…
With Njalla, customers don’t buy the domain names themselves, they let the company do it for them. This adds an extra layer of protection but also requires some trust.

A separate agreement grants the customer full usage rights to the domain. This also means that people are free to transfer it elsewhere if they want to.

“Think of us as your friendly drunk (but responsibly so) straw person that takes the blame for your expressions,” Njalla notes.
…

Njalla

Perhaps I’m being overly suspicious but what is the basis for trusting Njalla?

I would feel better if Njalla only possessed a key that would decrypt (read authenticate) messages as arriving from the owner of some.domain.

Other than payment, what other interest do they have in an owner’s actual identity?

Perhaps I should bump them about that idea.

Update: On further inquiry, registration only requires an email or jabber contact point. You can handle being anonymous to Njalla at those points. So, more anonymous than I thought.