Malware Devil

[Free Virtual Event] Managing Apps in a Multi-Cloud Environment

More Insights

Webcasts

White Papers

InformationWeek & Network Computing Report Round Up

Reports

The post ‘Bahamut’ Threat Group Targets Government & Industry in Middle East appeared first on Malware Devil.

https://malwaredevil.com/2020/10/07/bahamut-threat-group-targets-government-industry-in-middle-east/?utm_source=rss&utm_medium=rss&utm_campaign=bahamut-threat-group-targets-government-industry-in-middle-east

New ‘HEH’ Botnet Targets Exposed Telnet Services

Latest threat is one in a growing list of malware developed in the Go programming language.

A potentially destructive peer-to-peer (P2P) botnet has surfaced and is targeting a broad variety of Internet of Things (IoT) devices with exposed or weakly protected telnet services.

Researchers at China-based 360NetLab, who recently discovered the so-called HEH botnet this week, described the malware as capable of wiping all data from infected systems. According to the security vendor, the botnet poses a threat to any device with an exposed telnet service regardless of whether the device is based on x86, ARM, MIPS, PPC, or any other chip architecture.

The malware has been observed spreading via brute-force attacks against servers, routers, and other Internet-connected systems with exposed SSH ports 23 and 2323. The bot — like a growing number of malware tools — is written in GO code. It uses a proprietary P2P protocol to communicate with other infected devices and receive commands. The malware packs three separate components: a P2P module, a module for propagation, and a local HTTP service.

The bot samples 360NetLab analyzed were downloaded and executed via a malicious Shell script. The malicious code does not make any attempt to enumerate the environment it is on. Instead, it just downloads and executes malicious programs for a variety of different CPU architectures one after the other, 360NetLab said. The script and binaries the security vendor analyzed were hosted on a legitimate but likely compromised website.

Once started, the malware kills off multiple services on the infected device depending on the port (23 or 2323) that was used to gain access. Then it starts an HTTP server that initially pulls up a copy of the “Universal Declaration of Human Rights” in Chinese and seven other languages. This initial content is quickly overwritten with data pulled from another infected peer on the botnet, 360NetLab said.

According to the vendor, a self-destruct function in the malware is especially noteworthy. “When the Bot receives a [command] with code number 8, the Bot will try to wipe out everything on all the disks” through a series of Shell commands,” the vendor said.

360NetLab’s report did not offer insight into whether the HEH botnet would be used to launch distributed denial-of-service (DDoS) attacks, distribute spam and malware, or for other purposes. For the moment, at least, the botnet’s attack function has not been implemented, which suggests the HEH botnet is still in development, the security vendor said.

An Ongoing Trend
The HEH bot is part of a growing number of SSH-targeting malware tools written in the Go programming language that have been observed lately. They represent a shift from older IoT malware like Mirai that were developed C or other programming languages like Perl and C++. This year alone, multiple vendors and researchers have reported IoT bots written in Go, including Kaiji, IRCflu, and more recently FritzFrog, a peer-to-peer botnet that has been actively compromising SSH servers since the beginning of this year.

Craig Young, computer security researcher at Tripwire’s vulnerability and exposure research team, says the growing popularity of Go among threat actors in interesting. The HEH botnet is one in a series of Go-language-based botnets that appear to be coming out of a small group of malware developers. It suggests either a new generation of malware authors or a new wave of capabilities.

“Go is a very powerful programming language with a wide library of community supported modules,” Young says.

Go enables developers to manipulate very low-level behaviors, he notes.

“Malware authors may leverage this to thwart analysis attempts by using custom variations of compression or encryption algorithms,” he says.

While malware developed in Go does not necessarily complicate defenses for organizations, it does require them to update their toolkits in some circumstances, Young noted.

The HEH botnet poses little risk to organizations in its current form. For the moment, the malware has only been observed targeting exposed telnet services, which no responsible organization should have, he says.

“For most organizations, the threat of this botnet at this time is minimal, but it could certainly evolve,” Young says. “An update to the malware can be pushed out at any moment to introduce new attack and propagation techniques.”

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Recommended Reading:

More Insights

Webcasts
More Webcasts

White Papers

InformationWeek & Network Computing Report Round Up

Reports

The post New ‘HEH’ Botnet Targets Exposed Telnet Services appeared first on Malware Devil.

https://malwaredevil.com/2020/10/07/new-heh-botnet-targets-exposed-telnet-services/?utm_source=rss&utm_medium=rss&utm_campaign=new-heh-botnet-targets-exposed-telnet-services

Open Source Threat Intelligence Searches for Sustainable Communities

As long as a community is strong, so will be the intelligence it shares on open source feeds. But if that community breaks down …

When the Computer Incident Response Center in Luxembourg (CIRCL) analyzes incidents for threat information, the group deals mostly with proprietary, sensitive, and, in some cases, classified information from companies and the communities with whom the incident response team regularly works.

Yet the group also relies heavily on open source intelligence as a way to eliminate the noise of known threats and reduce the workload for the group’s operators, says Andras Iklody, a CIRCL operator and a core developer for the MISP threat-intelligence sharing platform. Open source threat intelligence lets the group bootstrap its analyses and helps reduce its workload quickly to instead focus on novel threats, he says.

“It makes our lives easier by getting the low-hanging fruit out of the way,” Iklody says. “Even though we are not using it directly for detection purposes — which we could, depending on the source — it is already a huge help in, for example, figuring out quickly what we are dealing with. Is it something that is already known? Or is it something that we should spend more time with?”

Open source intelligence feeds are getting better in many ways. For example, the information is typically more focused and better vetted than in the past. But there are potential pitfalls, say experts. Because filtering bad data out of a threat feed is time-consuming and difficult, open source threat intelligence often lags behind the intelligence provided by other sources. On the other hand, some automated or crowdsourced systems — such as AbuseIPDB, a database of Internet-address reputations — can find early indicators of maliciousness.

The good and bad represent the relationship that open source threat intelligence has to the volunteers in the community that give their time to create the tools and analyze potential threats, says Karl Sigler, senior security research manager at Trustwave. While massive efforts can result in powerful sources of threat data, often such communities can disappear if interest wanes.

“As long as the community remains strong, then the open source feeds will remain,” he says. “But the communities tend to break down, so you can’t always rely on the feeds being there.”

However, open source threat intelligence feeds and commercial feeds typically do not cover the same ground, making any decision difficult. In August research, researchers from universities in the Netherlands and Germany compared threat indicators from four open source threat intelligence feeds and two commercial feeds, finding very little overlap in the data sources. A comparison of indicators on 22 threat groups found the feeds had, at most, only 4% of threat indicators in common.

Getting Started
For most companies, the most valuable threat intelligence is data from their own network flows and security logs. Companies getting started in threat intelligence should focus on joining a sector- or industry-specific threat information exchange group, MISP’s Iklody advises. Such groups will not only alert member companies to potential threats, but they will also have industry-specific best practices that can help shore up an organization’s defenses.

“Get together with similar organization that you can exchange information with,” he says. “If you are working in a specific sector and you can join an ISAC, do that and get the information they can share with you.”

Any company using threat intelligence should make sure it is consuming the data from the feeds appropriately and with a skeptical eye. The technical indicators of a specific threat targeting one organization may be significantly different from the indicators of the same threat attacking another organization, says Andrew Morris, founder of threat-data enrichment startup GreyNoise Intelligence.

“To figure out where the badness is that’s the most relevant to you, you go through some process on your network,” he says.

Companies can combine data from their own networks and environments, and query that data, to glean information about the specific threats that impact their users.

“One of the issues is [because] there are so many threat feeds that are so large and have so little context and change so rapidly, it is very costly to try to implement all the different intel feeds and weed out false positives and derive value,” Morris says.

The public nature of open source threat intelligence feeds can also be a weakness. Not only do companies have to consider how much detail to release openly, but often such public disclosure will be a warning to attackers to change their behavior, thus becoming harder to detect, says Maurits Lucas, director of intelligence for Intel471, a commercial threat intelligence provider.

“Some of the bits you cannot publish in open source because open source is available to the very people you are observing,” he says. “So whatever you are publishing will be the first and last [indicator] that you will publish on that particular source.”

Reality Check
Can weaknesses in open source intelligence be fixed? The economics of information sharing and the value added by companies in vetting their commercial threat-intelligence feeds make it unlikely.

MISP’s Iklody points to the impact of forced sharing as an example. When an information-sharing organization in the Asia-Pacific region required members to share a certain amount of data every month to retain their membership, many smaller companies did not have regular incident information. Instead, the companies reclassified minor concerns as threats and ended up flooding the groups’ feeds with noise, he says.

Those types of approaches, meant to solve the contribution problems of open source, underscore the asymmetry between the larger companies with mature security programs and smaller industry players that primarily end up lurking on such information feeds.

“Whenever you have a requirement that people share information, it backfires,” Iklody says. “There are some exceptions to that, but in many cases organizations cannot produce data fast enough, or they start flooding the community with junk.”

Still, for companies just starting out in threat intelligence, it can be a way to work with standardized forms of reporting and analyzes that are widely taught, Trustwave’s Sigler says.

“I always recommend starting out with open source, not just with intel feeds but with all security,” he says. “It lets you dip your toe in the water without a commitment. I see so many times that people commit to a product that just sits on their shelf.”

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT’s Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline … View Full Bio

Recommended Reading:

[Free Virtual Event] Managing Apps in a Multi-Cloud Environment

More Insights

Webcasts

White Papers

InformationWeek & Network Computing Report Round Up

Reports

2019 Threat Hunting Report

The post Open Source Threat Intelligence Searches for Sustainable Communities appeared first on Malware Devil.

https://malwaredevil.com/2020/10/07/open-source-threat-intelligence-searches-for-sustainable-communities/?utm_source=rss&utm_medium=rss&utm_campaign=open-source-threat-intelligence-searches-for-sustainable-communities

Rare Firmware Rootkit Discovered Targeting Diplomats, NGOs

Second-ever sighting of a firmware exploit in the wild is a grim reminder of the dangers of these mostly invisible attacks.

It’s a silent and deadly threat long dreaded by security experts: malware entrenched in the firmware of modern computer chips that can’t be expelled by reinstalling the operating system or even wiping or replacing the hard drive.

These mostly invisible firmware rootkit — aka bootkit — attacks thus far have been very rare, but researchers at Kaspersky have discovered one in the wild. The custom rootkit compromised the Unified Extensible Firmware Interface (UEFI) in computer chips that handles system booting and loading the operating system. The malware implant, which was just one module found in a larger attack framework Kaspersky named MosaicRegressor, appears to be written by a Chinese-speaking actor, based on several artifacts and language clues in it, the researchers say.

The attackers pointed MosaicRegressor at African, Asian, and European diplomatic and nongovernmental organizations between 2017 and 2019. Two victims of were found with the UEFI bootkit infection. All of the targets had some link to North Korea interests, either as nonprofits focused on the country or with locations there.

This is only the second known case of a bootkit attack: The first, revealed two years ago by ESET, was used by the Russian nation-state hacking group Fancy Bear, aka Sednit/Sofacy/APT28, best known for its 2016 attack on the Democratic National Committee. The so-called LoJax malware basically exploited Absolute Software’s LoJack computer anti-theft software embedded in many machines.

“That was truly a significant finding,” said Mark Lechtik, senior security researcher at Kaspersky, who along with colleague Igor Kuznetsov detailed their research at Kaspersky’s [email protected] virtual event this week. What sets this second UEFI rootkit apart from the previous one, Lechtik said, is that’s a customized version of one developed by HackingTeam, the controversial zero-day exploit development firm out of Italy known for selling advanced attack modules to governments.

HackingTeam itself got hacked and doxed five years ago, and much of its code, including that of a UEFI rootkit, is now living on GitHub for researchers and attackers alike to experiment with.

“There was actually no evidence of [the HackingTeam rootkit’s] usage in the wild” until now, Lechtik said.

It was only a matter of time that an advanced threat group would employ the UEFI bootkit tool from HackingTeam. Jesse Michael, principal security researcher with Eclypsium, says he’s built proof-of-concept versions of the code in his own research to prove and study how it could be weaponized.

Bootkits are all about dwell time for an attacker, he says, even though they have not yet been widely used to date. This malware found by Kaspersky is based on “pretty simple code,” he says, and has plenty of room for enhancement. “There’s a lot you can do to take advantage of ” the UEFI bootkit, he says. “This just scratches the surface.”

The Kaspersky researchers say they weren’t able to pinpoint how the attackers were able to plant the bootkit on the victim machines and rewrite the legitimate UEFI firmware. They point to two possible scenarios: physical access to the victim machine akin to Hacking Team’s USB key tool. “Such a USB would contain a special update utility that can be generated with a designated builder provided by the company. We found a Q-flash update utility in our inspected firmware, which could have been used for such a purpose as well,” they wrote in a blog post.

Another option is via a remotely installed “patch” of the firmware with the malicious code. That would entail attacking the BIOS update authentication process to pull off.

The bootkit’s main job is to deploy malware in a targeted file directory, Lechtik said. “So when the operating system starts, this malware file will be executed.”

The attackers also appeared to have used the Winnti backdoor, a popular tool among Chinese nation-state groups. Kuznetsov said he and the team were able to get one of the DLL files, which turned out to be an information-stealing tool that had archived the contents of the recently accessed documents folder. “It suggested the whole campaign was related to espionage activities. But we don’t have evidence to have any clues about what is actually the target” information, he said. MosaicRegressor has no known ties to any other threat groups that Kaspersky tracks.

Fighting the Invisible Enemy
It’s not easy to even track these types of attacks because there’s little visibility into them, researchers say. So, how do you protect against a bootkit attack?

Encrypting the hard drive itself is one way to defend against such an attack, using Microsoft’s BitLocker, for example, Kaspersky says. There’s also Secure Boot, a feature supported on most modern computers that allows only securely signed firmware and software to boot up and run on a machine. Intel offers in its microprocessors the Secure Boot-based Intel Boot Guard, which protects UEFI firmware from tampering and malware.

“But if the motherboard is misconfigured and protections are not in place — if Boot Guard is not turned on — there are huge problems for any platform” that gets targeted, Kuznetsov said.

Michael says he worries that the bootkit capability ultimately be deployed in even more sophisticated attacks. For example, an attacker could watch and wait for a system protected by BitLocker to unlock, and then “patch” the system with bootkit malware.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise … View Full Bio

Recommended Reading:

Quantifying the Benefits of a DevOps Strategy

More Insights

Webcasts

White Papers

InformationWeek & Network Computing Report Round Up

Reports

Online Threats — and What Your Org Can Do About Them

The post Rare Firmware Rootkit Discovered Targeting Diplomats, NGOs appeared first on Malware Devil.

https://malwaredevil.com/2020/10/07/rare-firmware-rootkit-discovered-targeting-diplomats-ngos/?utm_source=rss&utm_medium=rss&utm_campaign=rare-firmware-rootkit-discovered-targeting-diplomats-ngos

3 Ways Companies are Working on Security by Design

Execs from top financial organizations and other companies share insights on building a security culture.

As cybersecurity professionals seek to bolster security culture across the enterprise, the concept of security by design has grown in prominence.

It has several interpretations: baking security fundamentals into development requirements, building less obtrusive security features for the convenience of customers, improving usability of security tools within IT organizations, or all of the above. But security by design stands at the forefront of security’s role in digital transformation.

To kick off Cybersecurity Awareness Month, the National Cyber Security Alliance yesterday held a virtual 2020 Cybersecurity Summit that featured luminaries from a number of organizations, including NIST, Bank of America, and Nasdaq. The big theme of the day was how security by design can aid in rolling out more usable security–for customers, internal users, technologists, and security personnel.

Here’s what the speakers there shared on how companies today are working on security by design:

Building Usable Software Securely

One of the highlights of the summit was a session led by Hari Gopalkrishnan, the client-facing platforms technology executive for Bank of America, who discussed the development of the firm’s virtual financial assistant, Erica. An AI-driven platform, Erica was developed from the outset with security by design principals as a core part of success requirements.

“One of the key tenets before we got to anything functional was the fact that it had to be secure by design because to us security and privacy are table stakes,” Gopalkrishnan explained.

An obvious part of that was baking security into the design lifecycle, ensuring that data flows are secure, authentication is appropriate, and so on. Additionally, AppSec best practices like code scanning and security testing of deployed software continue to remain top of mind. Other less obvious parts of the security by design ethos that has driven Erica’s development also included examining AI modeling for potential bias, as well as building robust options for customers to opt in or out of privacy-impacting choices around things like geolocation and data use.

This is huge in an era of using digital information for personalization and tailored services.

“Some could argue a lot of, wow, wouldn’t it be delightful if you could use all the data available to you, and when you be able to create a bigger aha moment for a customer, if you did that, and the answer is maybe, but we don’t get to do that,” Gopalkrishnan said. “And that’s not the role that we play. When we think about responsibility in software development and responsibility as a bank to deliver to our customers, everything needs to be transparent.”

Making Security Features Frictionless

Strengthening security functionality while removing friction from the user experience is a huge part of security by design. While security transparency is important, the goal should be to abstract security actions away from the users where possible, said Roman Shapiro, director of information security for Nasdaq.

“Candidly, I think the industry is playing a little bit of catch-up in this regard, but we’ve learned to look closely at usage patterns — where you are logging in from, how you are logging in, and so on — taking sensible steps behind the scenes to give you the assurance you need that the session you’re establishing is one you have confidence in,” Shapiro says.

Multi-factor authentication is one of the biggest friction points for users, agreed Steve Clark, managing director and business unit information security officer for Bank of America. Clark explained that AI analytics of user patterns for the sake of authentication and authorization is increasingly going to become prevalent to reduce friction on that front, both in finance and in other industries.

Improving the Usability of Security Data

As security teams monitor how users are interacting with software assets and data on a daily basis, security by design will be crucial for setting security operators up for success as well. This means that teams are thinking closely about how the systems log user activity, what data is pulled from them and made available to SOC analysts, and how it is contextualized and enriched.

“What’s difficult to do is pulling out the signal from the noise,” explained Brian Vecci, field CTO for Varonis. “The next few years are going to be not necessarily aggregating more log information or more information. It’s going to be doing two things, creating more usable profiling that combines different kinds of information, not just logs, but other metadata that we have about users’ data, the devices that are being used, where people are coming from, the services that they’re using, the access and building really useful profiles about what’s normal to identify patterns of misbehavior.”

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading. View Full Bio

Recommended Reading:

[Free Virtual Event] Managing Apps in a Multi-Cloud Environment

More Insights

Webcasts

White Papers

InformationWeek & Network Computing Report Round Up

Reports

State of Endpoint Security: How Enterprises Are Managing Endpoint Security Threats

The post 3 Ways Companies are Working on Security by Design appeared first on Malware Devil.

https://malwaredevil.com/2020/10/07/3-ways-companies-are-working-on-security-by-design/?utm_source=rss&utm_medium=rss&utm_campaign=3-ways-companies-are-working-on-security-by-design

Cyber Intelligence Suffers From ‘Snobby’ Isolationism, Focus on Rare Threats

Cyber-threat intelligence groups need to more often investigate their organization’s specific threats and better integrate with other business groups, experts say.

Cyber-threat intelligence (CTI) teams face a host of challenges — a shortage of skilled workers and a lack of resources, for example — but two of the most serious hurdles are, in many ways, self-inflicted: A “snobby” culture that isolates groups and often focuses on the latest interesting threats rather than the actual dangers facing the business, cybersecurity experts told attendees at two industry conferences last week.

Focusing on zero-day exploits and nation-state adversaries is naturally alluring for CTI teams, but the more common threats facing their organizations are cybercriminal phishing attacks and workers’ reuse of passwords, Xena Olsen, a cyber-threat analyst for Marymount University, said during a presentation on creating adversary detection pipelines at the virtual Black Hat Asia conference. To provide actionable intelligence for blue and red teams, CTI analysts should focus on the most common threats first, she said.

“Instead of looking what is actually going on in their network and threat landscape, some CTI analysts solely focus on public threat actor reporting and going for the sexy APTs, advanced persistent threats,” Olsen said, adding, “One of the main goals of adversary detection pipelines is to get really good at understanding simple attacks specific to your org[anization]’s infrastructure, controls, and detection.”

In addition, because CTI teams often collect some of the most knowledgeable security analysts into a group, they often isolate themselves from other departments in an organization. Instead, they need to become more accessible to the organization, otherwise the perception is that they are being “snobby,” Jamie Collier, CTI consultant at FireEye Mandiant, said in a presentation at the annual Virus Bulletin conference.

“It is really important that we get beyond that culture,” he said. “When it comes to someone who is ignorant about cybersecurity, and they read an article that stokes fears, there is nothing funny about that situation, and so we need to make sure we are helping these people.”

Almost half of all companies with a security-response capability have a dedicated CTI team, but the most popular forms of information consumed by the groups were open source CTI feeds, commercial feeds, and information from industry sharing groups, according to the “2020 SANS Cyber Threat Intelligence Survey.” Threat information based on internal log data from firewalls and endpoint systems ranked No. 5. Other internal sources of threat information ranked even lower.

The two cybersecurity experts presented their own critiques of CTI at the conference. Marymount University’s Olsen recommended an approach to threat intelligence that focuses on what is happening inside a company — gathering data on threats seen in email and enriching that with other internal event information — before attempting to use external threat information.

FireEye’s Collier focused on a “backcasting” scenario, where he assumed that the CTI industry failed in a decade and attempted to explain why. The top reasons: focusing on novel threats rather than the ones with the most impact, the isolationism of threat intelligence groups, and the overall skills shortage in the industry.

“They typically operate as almost a standalone function,” he said, speaking in the past tense, as his scenario deconstructed what happened to CTI from a future date. “We would have these very well written threat intelligence reports that would be produced on a variety of topics, but the audience of these reports was never clearly formulated. It was almost intelligence for the sake of intelligence.”

The allure of novel threats — both because they piqued the interest of researchers and made good marketing — poses another problem for CTI firms, he said. One reason is that threat intelligence has often become more a marketing exercise than a capability to provide actionable information to the business. Threat intelligence teams tend to focus on the novel and interesting threats — often looking to get media coverage — rather than the actual common threats for which companies have to be ready, Collier said.

“Between phishing, on one hand, and AI-enabled offense on the other, there is all these different attack vectors, but they pose really different threats,” he said. “AI-enabled threats may be interesting, but it is phishing that presents the real concern for the majority of organizations.”

Adversary detection pipelines are an approach for CTI teams to analyze the operational data coming from their own company to narrow down their focus to actual threats. Email and log files can give information on real threat that can then be enriched with information from other systems, and then open source threat intelligence can be used to gather more data on adversaries, Marymount University’s Olsen said.

The whole point it to “provide a prioritized workflow based on the attacks directed at the organization, through analysis performed by the CTI analyst,” Olsen said. “It is the focused creation of intelligence based upon specific requirements for the sole purpose of enriching other teams and improving the security posture of the organization.”

Collier advised threat intelligence teams to take a good look at how they approach their analyses.

“CTI is quite a young industry, so we need to guard against complacency,” he said. “We need to be really reflective as an industry.”

Recommended Reading:

Quantifying the Benefits of a DevOps Strategy

More Insights

Webcasts

White Papers

InformationWeek & Network Computing Report Round Up

Reports

Annual Threat Intelligence Report: Perspectives and Predictions