Archive for the ‘Malware’ Category


One of my co-workers, Rodger Wille, will be mentoring SANS’ Computer Forensic Investigations – Windows In-Depth course (FOR408) in Atlanta, Georgia starting February 20th.  This course is great for any Intrusion and Security Analyst, Incident Handlers, and other members of the security staff (or those wishing to get a job with their security teams) who are looking to gain more information and understanding on how to conduct computer forensic investigations within the windows environment and what/where artifacts can be found within a windows system.

This course will cover forensic image acquisition, analysis techniques and tools and will utilize a full-featured forensic lab students will take with them.

Topics covered in the course will include:

  • Windows File System Foundations
  • Evidence Acquisition Tools and Techniques
  • Law Enforcement Bag and Tag
  • Evidence Integrity
  • Registry Forensics
  • Windows Artifact Analysis
    • Facebook, Gmail, Hotmail, Yahoo Chat and Webmail Analysis
    • E-Mail Forensics (Host, Server, Web)
    • Microsoft Office Document Analysis
    • Windows Link File Investigation
    • Windows Recycle Bin Analysis
    • File and Picture Metadata Tracking and Examination
    • Prefetch Analysis
    • Event Log File Analysis
    • Firefox, Chrome, and Internet Explorer Browser Forensics
    • Deleted File Recovery
    • String Searching and Data Carving
    • Examination of Cases involving Windows XP, VISTA, and Windows 7, and Windows 8
    • Media Analysis And Exploitation
    • Forensic Analysis Report Writing

In addition to the great training, each participant will also receive the following:

  • Windows version of the SIFT Workstation Virtual Machine with full Windows 8 standard license
  • Full 3 month trial license to AccessData FTK and Guidance Software EnCase
  • Full 15-day trial license to MagnetForensics Internet Evidence Finder
  • Course DVD
  • Real-world Windows XP and Windows 7 cases for examination
  • Wiebetech Ultradock v5 Write Blocker Kit

SANS Mentor students get the same great SANS content and material as they would at a traditional SANS conference event in a much more relaxed and intimate environment with classes spanning 10 weekly two hour evening sessions.  This format eliminates travel costs and impact to mission by being away from the office during normal business hours and allows students more time to learn the material.  With much smaller classes, usually no more than 8-10 participants, students have the opportunity to get their questions answered in-depth and gain more hands on experience during the labs.  The Mentor, an industry professional and GIAC Certified in the course being mentored, is often available to answer questions from students between class sessions and will highlight more salient portions of the material and lead hands-on exercises each week.

About Rodger:

Rodger has over 14 years of experience in the computer security arena as an Incident Handler and Forensic Analyst. Rodger began his career as a Signals Intelligence Analyst in the US Army conducting Cyber Threat Intelligence. After serving in the Army, Rodger continued supporting the US Army as a Defense Contractor with the Army Computer Emergency Response Team (ACERT) working as an Incident Handler and later as in a Senior Incident Handler role leading a team of incident handlers for the Regional Computer Emergency Response Team CONUS (RCERT-CONUS). Previously, Rodger was the Federal Lead for the Research and Forensics team within the US Department of Health and Human Services Computer Security Incident Response Center (CSIRC) where he was responsible for leading network, memory and disk based forensics, malware analysis and incident response activities.  Currently, Rodger is a Principal Security Consultant for FireEye Labs, where he helps his customers battle advanced threats, conduct forensic analysis, respond to security incidents and develop security policy.

http://www.sans.org/mentor/class/for408-atlanta-20feb2014-rodger-wille  – Rodger can offer special pricing of exceptional savings for up to two seats in the course and 10% discount to all others.  Follow him on Twitter @RAW4n6 and direct message him for details.


This year I was interviewed by Infotech Research Group pertaining to the difference between a SOC and SOF for a solution they were developing collateral.  Prior to the interview I prepared a response to their questions.  The data they were asking is very similar to questions I’m asked regularly around security operations solutions.  Therefore, I wanted to take this opportunity to put out some content around the core topics of security operations centers and functions. 

The fundamentals

What is the different between a Security Operations Center (SOC) and a Security Operations Function (SOF) and what is required to provide a state of the art intelligent security operations function?

To begin we must first clarify the difference between the two concepts.  In general a SOC is or can be a portion of the overall SOF.  A traditional SOC will usually focus around a SIEM whereas today’s security operations need to integrate multiple products and automate intelligence and response in real time. The traditional SOC was previously a large physical security command center.  Today the SOC has shifted into more of a function where many responsibilities are spread outside of the traditional physical command center.

We should not forget that one advantage of housing the security operation within the same physical location is the capability to easily segment, secure, and control the data within the environment.  When you start opening up the function you also open up access making it harder to secure the security data in larger environments.

1.0 and 2.0 what is the difference?

What are the key differences between a traditional SOC or SOF and the next generation solution (or version 2.0) and how is the next generation going to handle the newer technologies, as well as the continual changing threat landscape associated with big data, mobile computing, and social media?

The big difference is that monitoring is now no longer contained to inside organization and in many cases the data is not either, so in many cases you will be relying on third party organizations more.  That means you must have good processes in place with defined SLA’s to understand the capabilities of each provider.  Having a good understanding of the security for that third party environment will be critical to ensuring your data is not leaked.  Also having a good way to detect malware in the environment will also be important to help prevent lateral movement across the organization and its suppliers or providers.

Also, because of the advanced threats that specifically target individual personnel the next generation of security operations solution will eventually have to enter more into the home environment to protect those key targets.  Key executives that are targeted through their children or other family members will need to have some protections in place that help mitigate the risk.  These advanced threat actors will compromise another family member’s account by sending an email with a title like “homework help” or something similar to fool the victim.  Little does the parent know this was an attacker who hacked their kids account for the entire purpose of sending a word document with malware to attack the target executives work account eventually.

Some other items that will come more into play is real time threat intelligence.  Getting automated feeds in formats like STIX or open IOC with specific data that is relevant to your organization will become the norm for large enterprises.  In some cases even a private intelligence cloud will be used.

Why Implement a SOC or SOF in the first place?

Many of you may not currently even have a security operations function in place, however due to recent attacks you are wondering if this is the right fit for your organization.  To help with that decision understand there are usually two main drivers.

  • One is that the organization has had a series of major incidents and as a result needs to implement some type of monitoring and protection function.
  • The second driver is usually for increased profits.  The large MSSP or Telecommunications organizations will implement models to sell the managed SOF to their clients and therefore will build out operations.

At some point you really need to understand the threats to your organization.  Without a clear indication of the attacks the organization faces daily it will be hard to justify the cost of a SOC/SOF and therefore you may need to consider an outsourced option.

Responsibilities of the SOF

We know that security monitoring and incident response are obviously included at some level, but how about security devices maintenance, identity and access provisioning/de-provisioning, even security solution design and implementation.  Should those all be included?

Personally I don’t think device maintenance is a good function of the SOF.  My experience in the field having done penetration tests against organizations that have MSSP’s (Managed Security Service Provider) who perform both the security and maintain functions show that many items are typically neglected.  In short, the MSSPs can do everything from monitoring to maintenance, but in many cases they end up doing a poor job at everything because there is a lack of focus on one task.  For device management and maintenance the SOF should really only be involved with reviewing security compliance around device maintenance and involved in coaching or developing the processes to ensure out of compliance items are either removed from the network until updated.

Other functions such as identity access and entitlement reviews can be a part of the SOF, but usually this is not included based on a decision around corporate cultural.  Access control in many cases resides outside of the SOF or in an isolated SOF department and unless the organization can manage the cultural issues it will not work effectively in the SOF.  The SOFs function really should be to review and compliance check on access controls and violations of access.  We also need to be careful about giving the SOC too much capability because then the SOC becomes a single point of failure for security.

Overall some core items that should be provided by the SOF are:

  • Monitoring, alerting, threat analysis, correlation and intelligence
  • Incident response, investigation, malware and threat analysis, and serving as an extension of the forensic teams in some cases
  • Advisory on corporate security solution designs

Outsourcing the SOF

How do you determine then if the SOF should be outsourced or not?  There are several drivers in the decision making process that will determine if the function should be outsourced or not.  In almost all cases this is relative to cost or that fact that the organization does not have the appropriate skills in house.  In some cases the organization may also decide that it should not be investing in services that deviate from the core business goals.

Leveraging Centralized or Distributed Response Models

A challenge in many security functions is to determine the correct response model.  This really depends on the global extent and cultural diversity of the organization.  If the organization is global there will be many challenges if a central response team is implemented.  If you have to send someone onsite half way around the world it could take days depending on where in the world that person must fly.  Also you will run into challenges around language and VISA requirements.

On the other hand having a team that is distributed and speaks or reads multiple different languages is will enhance any response team in providing a timely and adequate response.  The time to location is quicker, command and control can be done while onsite (war room), and intelligence can be shared via the coordinating or central lead team.

Key Aspects of the SOF – People, Process, and Technology

To implement and maintain a successful SOF the right defense in depth strategy is required.

People – A successful SOF must have skilled staff that can think like the adversary.  This staff must also have technical knowledge and troubleshooting abilities to understand the threats and attacks.

Technology – The technology strategy at the most basic level must have several core components.  New generation malware detection at the network egress points and endpoints is a requirement.  A SIEM or correlation engine is necessary to integrate the logs of many technologies.  Finally some custom integration between the core network, endpoint, and SIEM products is required to automate as much as possible for both identification and containment of the threat.  Threat intelligence feeds will also become a core item in the next generation SOF to provide awareness of the latest trends as well as threats to the industry and its service providers.  Most current SOC functions try to increase the function with more analysis software.  The mistake with that is it requires the time of your skilled staff where as they should be looking to automate the analysis and containment tasks as much as possible and use a series of base products required to stop the attacks.  Some other SOF based solutions will talk about risk-based decision systems.  This is really just correlation and automation of high risk threats.

Process – For process there are several components.  Sound roles and responsibilities must be defined.  Automation of trouble ticking and remediation processes need to be in place. Threat risk assessments must be conducted to identify critical targets and the threat events that are high risk to the organization.  A SOF at many levels must be integrated into every important aspect of the business.  For example, if a hurricane is coming and the BCP department says we are on hurricane watch.  The SOF should be looking for phishing attempts leveraging the hurricane as an event to try and attack the organization suspecting that employees will be reading every email and website about the hurricane. 

Challenges within a SOF

There are hundreds of challenges to run a top notch next generation SOF, but there are some fundamentals that must be addressed.  Education of staff is critical.  Without the right skills the attackers will always hard to find in the organization and even harder to remove.  Ensuring that the operators follow the procedures with little or no exception and continually update information and tactics based on the threats facing the organization is important.  The management of the SOF must also make sure executive management understands the extent of the threat otherwise funding and other critical controls will be neglected or overlooked.  Also, everyone talks about implementing more process in the next generation SOF, but in reality the real solution is to take as much human interaction out of the process and automate analysis and protection. A solution for querying the endpoint and enforcing rules based on network detections, a solution for leveraging and automating multiple technologies, and a solution for using first detection malware appliances to forward blocking information into Firewalls and Web/email gateways; these are the critical improvements and challenges required to build out the next generation SOF.

The 5 People, Process, and Technology Requirements

There are various sizes of organizations and every SOF will be different in many ways, but with respect to people, process, and technology the simple and most effective measures for providing security to an organization are:

Technology

  1. Egress malware blocking technology covering both email and web vectors combined with a web proxy and spam filter.
  2. Application blocking and anti-virus software on the endpoints
  3. SIEM for centralized logging and correlation of information
  4. Global Risk and Compliance software for integrating security with other processes within the organization
  5. After that you will augment these core components with other software for compliance and other business requirements.

People

  1. Strong leadership
  2. A strong person in network and application security
  3. A strong person in risk management and security policy
  4. A strong malware and forensic skill on staff
  5. After that you can build out the team based on the scope and mission of the security function and leverage contractors or outsourced solutions.

Process

  1. Automation of as much process as possible
  2. A strong set of core policies and procedures for change control, incident response, alerting and reporting that focus on protecting the organization and its mission.
  3. Collection of metrics
  4. A process that modifies regularly to reduce detection, containment and remediation time
  5. A process to understand the real threats to the organization

Measuring Effectiveness

As a person running a SOF you will always be asked to prove the effectiveness.  Is there some important Key Performance Indicators (KPI) to help prove the value of the SOF?  This is a difficult question and each organization may have specific KPIs based on the goals of the organization.  However in general there are some core items that should be measured.

People

To help make sure each member of the SOF is working effectively, metrics around the roles and responsibilities for individual is important to measure.  This is important to help measure the skill level of each person and that each individual is working toward the mission of the SOF.  Therefore, measuring items such as:

  • Shift logs and components captured in shift logs
  • Hours analyzing events, hours automating, and hours researching

Together these items will help determine what you need to focus spending on and to help free up resource time in the future.

Technology

There are several items around the technology to measure including:

  • How many incidents over different time metrics (week/month, etc.)
  • Amount of incidents and events detected and the percentage of those that were automatically blocked or contained
  • Timeline breakdown for each incident (When it was detected, contained, remediated)
  • The breakdown of technology detection; there will always be overlap in detection, so this overlap should be measured to help effectively determine if a control is needed

Process

In the process area you will want to track several many different things to prove the effectiveness around the incident response process including:

  • Amount of time to resolve an incident
  • Estimated cost to resolve an incident
  • Increase or decrease in security spending over time (compare against protection metrics)

One of the other items that gets overlooked sometimes it to track the time it takes collect and report on the metrics.  Inevitably, a large portion of the documentation is manual, and collecting metrics is manual due executive presentable formats not existing.  The SOF will spend days at the end of each reporting period to generate the metrics and report to management.  If you can automate the collection and reporting by using a global risk compliance system, some sort of ticketing system, or by using some custom code then that will help immensely in the long run.


With all the healthcare industry regulations around data leakage there has been a decent effort put in place to protect individual records, however the healthcare organizations are still struggling to get this under control from both a physical and cyber perspective.

Even though the medical industry is still battling to protect sensitive records they are facing another more persistent problem.  These organizations are under attack because the adversary wants to understand the underlying business practices and to obtain important intellectual property. With the aging population and billions of dollars spent on research and development for drugs, these organizations have a good deal of market cap to lose.

The recent FireEye report shows that although Healthcare is not the top malware candidate it is continually targeted by these attacks.  Also notice that the energy sector which has been heavily targeted in the past few years is tracking less than the healthcare industry.

FireEye Stats

http://www2.fireeye.com/WEB2012ATR2H_advanced-threat-report-2h2012.html

 

To understand the extent of the threat another posting was released on March 14 titled “Medical Industry Under Attack by Chinese Hackers”.  Here is one of the key quotes from this article.

“Healthcare is listed as one of China’s priorities in its 15-year science and technology development strategy for 2006 to 2020“

“Many of these victims have technology or drugs that are a monopoly. If you are the first to market with some great new technology breakthrough or drug, and you get a profit from that research … it would definitely be an issue for the Chinese to target some of these“

http://www.darkreading.com/threat-intelligence/167901121/security/attacks-breaches/240150858/medical-industry-under-attack-by-chinese-hackers.html

 

As recent as March 20th an article in The Daily Briefing was posted stating:

“Rich Barger—chief intelligence officer for CyberSquared, a data security company—said his firm can confirm that at least three Chinese advanced persistent threat groups, or APT groups, have targeted medical organizations.”

http://www.advisory.com/Daily-Briefing/2013/03/20/Hackers-target-medical-organizations

 

As you can see the industry is definitely under attack and many healthcare organizations are more than likely compromised.  The unfortunate problem is that these companies are spending all their security money to focus on the leakage of personal and medical records, but they are still implementing the wrong controls to protect against a threat that impacts their entire business model.

If the healthcare industry does not shift its current security strategy and prioritize its spending on the right prevention controls then their data and business models will be complexly assimilated in the next decade.


Whether defending against common malware or some determined Nation State, being able to proactively detect attacks and changes in the organization are required.  The past year I spent a large amount of time helping several organizations setup and put in place the right people, processes, and technology to help defend against increasing security threats.  Although many organizations spend millions of dollars on technology and hire staff to monitor security 24/7 the organizations were still lacking two fundamental items.

  1. The people although good at monitoring lacked the attack and threat mind set.  The staff was not able to figure out when an actual attack was happening.
  2. Second the organizations lacked the basic security operations processes required to keep track and make appropriate use of the vast amounts of data.

As a result I spent the past few months developing a whitepaper that specifically addresses the primary components of a SOC, which can be used to help organizations setup a centralized core and embark on developing the correct operational processes.  Although I don’t address item number one above, this paper explains in detail the following.

  • Defining the SOC
  • Determining the Processes
  • Understanding the Environment that needs protected
  • Identifying the SOC Customers
  • Staffing the SOC
  • Managing the Events
  • Leveraging ITIL compliance

Creating and Maintaining a SOC – The details behind successful Security Operations Centers

If your organization is under attack and you have invested in more people and technology be sure to implement the right processes and build a foundation for future defense.


There has been a large amount of security information and recent attacks posted in the media.  We have Mandiant’s report on China as well as several issues concerning Java.  The pure volume of information over the past year has made it difficult to keep up without a combination sources.  As a result InfoSecAlways has done a few modifications to the site.  Please check out the new “Security Feeds” in the right column (4th Block Down).  This is a combination of about 20 different security RSS feeds piping into the blog now.  You can check the site daily to get the latest news and updates in the industry.

Also, check out the links page as there are several new Threat and Vulnerability links added.  These are great if you are looking for specific attacks, breaches, or threats.


Like any other HackerCon there are good and bad things, so I will jump right into the interesting stuff.  The start of the conference was a little slow taking less of an attacker security approach, which I prefer.  In any event around midafternoon was a talk called “Wipe the Drive!!! Techniques for Malware Persistence”.    Mark Baggett and Jake Williams discussed some amazing techniques used by attackers.  I mean things that even memory forensics don’t catch.  They were discussing persistence tactics like:

  1. You remove malware and later your computer scans for a wireless access point as a part of normal activity and that scan releases the malware again.
  2. Your remove malware and later you plug in a standard clean USB key.  At this point the trigger of the key being plugged in releases the malware and infects the system.

Again their entire suggestion on the talk was to suggest wiping the drive is again the only safe way to possibly remove malware and to think otherwise might be foolish.

Day 2 and More

On the second day I ended up attending a few different sessions.  There was a talk on running a CTF that went through some of the tactics but mostly explained the amount of time it takes to setup and run a CTF.  Several of the other talks I went to were less than technical in my opinion and I felt everything could be Googled in about the same time I was in the presentation.  There was one exception, Carson Zimmerman packed the room (seriously no sitting space) with his talk on “Ten Strategies of World Class Computer Security Incident Response Team”.  I came in late, but what I saw was good.

ShmooganographyOther activities at the Con were always entertaining.  The Lockpick village always provides a good time filler in-between sessions.  I enjoyed spending some time handing out a few Hacker&Agent card decks to  kids.  Also, there was plenty of hacker and security speak in the evenings at the hotel bar.  Otherwise if you like games there were some contests on the Xbox or I would suggest testing your skills by taking a stab at Shmooganography. If you get a chance and get into the 2014 conference its worth at least taking a look.  Below is a preview of the 2013 contest.

Again overall a good Con, but I think some of the talks need to be more technical and in-depth next year.


Hands down Day 1 of Recon the Magic Bus by Travis Goodspeed and Sergey Bratus took the show.  Great informational and entertaining presentation!  I encourage anyone to check out the hardware Travis has developed and his papers if you are into understanding key security issues with the Bus.

Next I found the presentation by Rolf Rolles some of the best work I’ve seen in this field.  The presentation was focused on Syntax and Semantic based methods for reverse engineering.

Syntax Based

Under the Syntax based methods Rolf talked about looking for patterns that can help identify signatures such as packers, FLlRT, etc.  It seems like this could be a good idea for an offshoot tool.  However, it important to note that he said an attacker could possibly avert these patterns when a reverser is using Syntactic methods by recompiling or doing complex obfuscation.  Guess this is another reason we should all be doing obfuscation in the commercial world.

Semantics Based

For this discussion Rolf described scenarios for an automated key generator, automated bug discovery, etc.  Most of the talk was explaining the mathematics behind the analysis which overall appear to very basic in nature.  However the way Rolf has applied the math in the analysis is quiet interesting and very intelligent.

Without going into too much detail he simply replaced concrete semantics (i.e. x,y) with abstract semantics (i.e. +(positive), – (negative)).  Then using truth tables on Bits (standard bit analysis either 0 or 1) (unknown bit analysis using 0,1, ½; ½ represents unknown) he is able to map out patterns.

In general the rest of the day was filled with other speakers who were interesting but just didn’t seem to catch my full attention.  With that said Tarjei Mandt did a good job explaining atoms and string based attacks. 

All and all a pretty good first day especially since Montreal had a music festival running with Dissonant Nation, which made a great evening of entertainment.


On strategic risk assessments not testing the anti-virus signatures before being deployed should be considered a vulnerability.  Many of my customers believe this is ridiculous and not practical, however I report it anyway.   Whatever the case, the organization has the decision to accept the risk, as I am only there to point it out.  There is a great example published where a routine update caused serious problems forcing customers to have to re-install the operating system.

 http://news.yahoo.com/s/zd/20071206/tc_zd/221141;_ylt=AhIN_X.SMrgYGlzdK7zmNe8E1vAI

So you decide.  Should Anti-virus software be tested before deployment.


Malware is everywhere and becoming one of the most common security threats in the industry.  The link below provides some insight into the seriousness of this issue.

There really is not a great solution for this problem at this time, but how can a company that serves adds mitigate the risk.  There are several ways.

  1. Ensure all ads that are uploaded are hashed in some way to ensure the add being delivered is the add uploaded by the client.

  2. Use file monitoring tools like tripwire on image servers to help ensure that adds are not modified.  This will also help provide proof if there is an actual attack on the add server.

  3. Scan adds with anti-virus software.  Although this will not catch everything it will catch some of the files.

  4. Scan adds for known malware URL’s to prevent phishing type attacks.  (This is like a signature based solution and takes a great deal of maintenance to keep up with the attackers)

  5. Hope someone comes up with a good solution that can regularly scan all the adds for malware.

The above will help limit the liability of the ad company serving adds and has some preventive measures that can be implemented to protect both the add companies brand and their customers who may be uploading malware adds without knowing it.