cybersecurity

Safeguarding against the insider threat

Eric Vanderburg

The insider is still one of the most vulnerable elements of cybersecurity and it was the discussion of the recent Modern Workplace webcast on cyber intelligence and the human element.  Insiders are those who are authorized to work on company systems or in company facilities and they include trusted employees and contractors.  Whether it is through human error, social engineering, or intentional action, insiders are the cause of a significant portion of malware infections, data breaches, information theft, and privacy violations.

There are some key strategies you can use to safeguard against the insider threat.  First, technical controls can reduce the burden placed on insiders or minimize the potential damage done by insiders.  However, the insider threat cannot be solved entirely by implementing more technical controls.  No, human behavior is far different from a computer system and cannot be changed with by flipping a switch or changing a bit.  Companies need effective security leadership, security awareness training, and assessments and metrics.

Technical controls

Technical controls need to be implemented in such a way that they make it easy for users to do their job, while still remaining secure.  Systems that become too difficult to use when security controls are applied are the systems that will see less use as employees find workarounds.  For example, a company may implement more stringent password policies and change intervals only to find that users are storing the passwords unencrypted in phones, memo pads, or on the calendar at their desk.

Not implementing technical controls can have the same effect.  A company without adequate spam filtering could see users utilizing personal cloud email accounts for company email to avoid having to sift through mass amounts of spam.

Security leadership

Leaders should set an example for other employees and their subordinates by following secure computing practices.  They can also set an example by choosing where to spend money.  Information security needs to have an adequate budget and spending should be consistent and proactive rather than spike immediately following a security incident.  In the Modern Workplace webcast on cyber intelligence and the human element, Phil Ferraro, Nielsen CISO, said that it is essential for business leaders to understand that cyber risk is business risk.  This is more than an IT problem.

Awareness training

Awareness training is essential for teaching employees how to do their jobs safely.  Almost everyone uses a computer on the job and this means that they are interacting with organizational apps and data.  End users need to understand how to recognize phishing messages, including targeted spear phishing messages, as well as other social engineering schemes such as fake social media accounts, unsafe instant messages and text messages, or deceptive phone calls and voice mails.

People need regular reminders in order for information to stay top of mind.  It is not enough to conduct training once a year.  Training should be augmented with emails that inform users of new techniques and attacks or remind them of what they learned in training.  Posters and signs can also help employees remember their training.

Assessment and metrics

Follow up security awareness training with assessments such as online quizzes or questionnaires.  You may also consider conducting social engineering penetration testing by phishing your own users.  These assessments can help identify those that still make mistakes or do not fully understand the material so that you can focus additional training on those users.

It is also helpful to establish meaningful metrics on security performance.  Report on these metrics in company meetings so that employees know that it is important to the organization.  Use security metrics in employee reviews and reward employees and groups when security goals are met.

Special thanks to Microsoft Office, the sponsor of this article.  As always, all thoughts and opinions are my own.

How ransomware extortionists hide their tracks

Eric Vanderburg

Cybercriminals extorted about one billion dollars from ransomware victims last year, according to the FBI. And nearly all of those perpetrators went unprosecuted because of the innovative methods they use to protect their identities and hide their funds. They go to great lengths to keep authorities from seizing or freezing their money. By and large, their efforts have paid off. Here’s how they do it:

Hidden identities, disposable email
Extortionists protect their identities whenever interacting with victims. This generally occurs when they distribute ransomware, and when they collect ransom payments from victims in exchange for decryption keys.

Extortionists use disposable email accounts and when sending out phishing emails that target victims. These accounts have fake names associated with them and no useful contact information. In some cases, the accounts are owned by another individual—a person whose account was compromised, taken over and used to send malicious emails.

Layered like an onion
Extortionists often protect themselves during the collection phase by using so-called “onion routing” tools like Tor, which use multiple layers of encryption to ensure anonymous networking and communications. Tor is a network of computers that exchange encrypted data among themselves to obscure the source of the data. This prevents researchers and law enforcement from identifying where the decryption keys are stored.

Cryptocurrency enables anonymity
The cybercriminals responsible for disseminating ransomware typically demand payment in some form of cryptocurrency. Bitcoin is the most popular cryptocurrency with Litecoin and Dogecoin coming in second and third place, respectively. Bitcoin currency is stored in a digital wallet and bought and sold over bitcoin exchanges, through peer-to-peer marketplaces, and via person-to-person trades using an intermediary. Bitcoin transactions are logged publically but transactions only reference the wallet IDs of each partner in the transaction, not the names of the individuals themselves. Wallet IDs have no identifying information associated with them other than their number.

Cybercriminals typically keep a wallet ID for a short period of time and may only use it for a few transactions before switching to a new wallet ID. This ensures that specific wallet IDs are not identified as major bitcoin traders. They also use bitcoin laundering services or anonymizers like bitmixer.

Gift cards and money mules
Some forms of ransomware accept vouchers for payment. These include gift cards and CashU, MoneyPak, MoneXy, Paysafecard and UKash vouchers. These may be used to purchase goods that “money mules” then sell over the internet for cash. Money mules are also used to liquidate cards by selling them to individuals at less than face value. Cybercriminals prefer cryptocurrency because it allows them to keep a greater percentage of the profits.

For more news and information on the battle against ransomware, visit the FightRansomware.com homepage today.

Resume Ransomware: GoldenEye targets hiring managers, recruiters and HR

Eric Vanderburg

People charged with filling career positions at their companies need to be on the lookout for ransomware—especially GoldenEye ransomware.

GoldenEye is a new form ransomware written by the same cybercriminal who gave us the Petya and Mischa ransomware attacks. The author has applied some of the same distribution tactics that Petya and Mischa are known for by masking the ransomware as a job application. GoldenEye attacks typically begin with an email that appears to be from someone interested in a position. The inboxes of human resource personnel and hiring managers are often swamped with emails from potential candidates. As a result, very little time may be spent reviewing each email. Instead, recruiters and HR managers open the attachments and quickly screen resumes or cover letters to determine if the applicant is qualified for the position. GoldenEye takes advantage of this behavior. GoldenEye is currently targeting potential victims in German-speaking countries, but that could change at any moment.

GoldenEye emails include two attachments; a PDF cover letter and an Excel spreadsheet with a file name that includes the phony applicant’s last name, a dash and the word “application” in German. The cover letter looks entirely legitimate. The cover letter has an introductory statement, photograph and then states that the Excel file contains references and results from an aptitude test. The PDF attachment does not include any malicious code but the presence of a well-written cover letter aids in convincing the victim to open the second attachment, an Excel file.

The Excel file contains the ransomware as a macro. The file displays a flower logo that appears to be loading something. Microsoft Office blocks the macro unless macros have been enabled by the victim. Victims are enticed to enable the macros so that the loading screen will disappear to display the resume content. However, once enabled by the victim, the macro will save code into an executable file in the victim’s temp directory and then launch the ransomware. The program encrypts files and displays a ransom message. However, after the initial ransom message is displayed, GoldenEye restarts the machine and encrypts the Master File Table (MFT) and replaces it with a custom boot loader that shows the ransom message upon computer startup.

GoldenEye essentially performs the file encryption activities of Mischa and then restarts to perform the MFG encryption activity of Petya. Both encryption methods have been improved, and decryption methods for Petya and Mischa will not work on GoldenEye.

GoldenEye’s ransom message instructs victims go to a URL on the dark web to obtain their decryption key. Victims will need the decryption code presented in the ransom message to pay the ransom.

Be careful when opening any attachments from an unknown person and ensure you have a backup of critical files so that GoldenEye does not claim a ransom from you.

For more news and information on the battle against ransomware, visit the FightRansomware.com homepage today.

PopcornTime offers victims a choice: Pay the ransom or infect your friends

Eric Vanderburg

PopcornTime is a newly-discovered form or ransomware that is still in the development stages but operates off a disturbing principle: Victims who have their files encrypted by PopcornTime can agree to pay the ransom, or they can choose to send the ransomware to friends. If two or more of those friends become infected and pay the ransom, the original victim gets their files decrypted for free.

The process is reminiscent of the movie, “The Ring,” where victims who had watched a film had seven days to make a copy of a killer movie, or they would die.

Researchers on the MalwareHunterTeam discovered PopcornTime, which shouldn’t be confused with another application with the same name that is used for streaming and downloading movie torrents.

PopcornTime is also similar to the chain emails or chain letters of days past, where the recipient is told to forward the communication or bad things will happen. The key difference between PopcornTime and chain emails is that with the latter, there’s usually no teeth behind the threats. Most chain emails and letters are proven to be hoaxes. With PopcornTime, the looming threat to your data is real.

PopcornTime is still in development so the final version could differ from what MalwareHunterTeam discovered.

A third choice that makes better sense
It’s worth mentioning that if your files are properly backed up, PopcornTime can’t make you do anything. You can simply delete all infected files, remove the virus from your computer, and download clean versions of your files from backup. Don’t let the criminals coerce you.

For more news and information on the battle against ransomware, visit the FightRansomware.com homepage today.

Ransomware distributor gets hacked: A look behind the curtain

Eric Vanderburg

Two email accounts of a ransomware distributor were recently compromised. The analysis of these accounts gives an interesting “behind the curtain” view of a ransomware distributor. It appears that even malicious hackers use a bit of security advice.

The email account, cryptom27@yandex.com, which was used by the attacker behind the recent San Francisco Municipal Transportation Agency (SFMTA) ransomware incident, had an easily-guessable secret question. That allowed a security researcher to take over the account. The unidentified attacker had a backup email account, cryptom2016@yandex.com, that used the same secret question and was also compromised.

The analysis of these emails was reported by IT security blogger Brian Krebs, and it reveals a lot about ransomware distribution. First, the ransomware distributed by this attacker was not targeting specific organizations but was targeting an industry instead. The attacks focused primarily on U.S. construction and manufacturing firms. However, the attacker did not turn away business from those he had inadvertently exploited while launching the attack. The attacker also used an exploit designed take control of Oracle servers and use them to distribute more ransomware.

The attacker used various threats to coerce victims into paying ransom demands. Victims were told they would never get their data back if they did not pay up. The attacker demanded payment within 48 hours, or the data would be deleted, and in some cases told victims that the ransom demand would increase the longer they spent thinking about it.

The attacker used Mamba (HDDCryptor) ransomware, which encrypts entire hard drives. And after the hard drives are encrypted, the attacker’s victims were presented with a message telling them to send an email to one of the aforementioned email addresses to get payment instructions. The attacker apparently used a third email address, but this one did not use the same secret question, and the researcher could not obtain access to it.

The analysis also shows how profitable ransomware can be. The attacker using these email addresses collected $45,000 from a previous attack on a U.S. manufacturing firm. This money was collected through various attacks over the course of a few months. This information was obtained from the two compromised email accounts. These attacks appear to have been committed by a single individual, but it is possible that multiple individuals were involved.

This case demonstrates the ease with which ransomware attacks can be carried out, as well as their massive earning potential.  It’s important for individuals and companies to protect themselves primarily by ensuring that all important data and systems are backed up and that those backups are stored in a location segmented from production systems.

A wide variety of technical controls can help detect ransomware and prevent its spread. User awareness training can help reduce the effectiveness of ransomware distribution through phishing. However, none of these methods are 100% effective. That is why backups are essential to any defense strategy. Take a lesson from this analysis and protect yourself because this threat is far from over.

For more news and information on the battle against ransomware, visit the FightRansomware.com homepage today.

Protecting against APTs with Machine learning

Eric Vanderburg

Machine learning is a science that uses existing data on a subject to train a computer how to identify related data.  Just like with humans, the more training a machine learning algorithm gets, the more likely it is to succeed at its task.  We have an extensive amount of information on attacks that can be used to train machines.  After all, new attacks come out every day and over a hundred million malware samples have been collected each year since 2014.  This information, as well as the historical information, can be fed into machine learning algorithms to better understand the attacks that haven’t happened yet.  Machine learning systems are comprised of algorithms that determine how the program will interpret, understand, and correlate information to make decisions.  As new data is added to a machine learning system, it can produce results which are tested and then refinements can be made to the algorithm or to assumptions or predictions that were made. 

Advanced Persistent Threats (APT) are an especially big problem for enterprises.  These attacks are intelligently designed by teams of attackers and are highly targeted.  They utilize some of the latest technology and are usually based on extensive information gathered about the target from sources such as social media, the dark web, probes of public sources, dumps from previous hacks, and social engineering.  Once in place, APTs can operate covertly over an extended period of time, causing significant damage to the organization, its customers, services, and ability to do business.  Intelligent solutions are needed to combat these threats.  For example, Bitdefender’s machine learning system analyzes programs as they run to identify anomalous behavior.  It can identify potentially vulnerable software and alert administrators to this before those vulnerabilities are exploited by attackers.  This puts the enterprise on the proactive rather than the reactive side of security. 

Machine learning systems need to be quite powerful so they utilize the power of the cloud to process large amounts of data and millions of distributed clients to collect it from around the globe.  Machine learning systems are comprised of multiple machine learning algorithms that each process the data in different ways looking for patterns of attacks or anomalous behavior.  What once was science fiction is now science fact. 

Such systems are proven technologies, not futuristic fantasies.  Bitdefender’s anti-exploit technology identified 100% of the Adobe Flash exploits of 2016 and an astounding 99.99% of malware.  Microsoft is using machine learning in their SmartScreen filter and Google uses it in their Safe Browsing initiative.  When tested against traditional security systems, machine learning systems resulted in fewer false positives as well as fewer false negatives, meaning that more attacks were thwarted and less time was wasted chasing false alerts. 

For companies, this is a big savings to the bottom line and a cost-effective way to implement security.  Cybersecurity systems are more effective and keep their sensitive data away from prying eyes and key systems available for use while IT and security personnel are not distracted by as many false alarms so they can be focused on what matters, keeping the company safe. 

Does your cybersecurity strategy include machine learning technologies? 

As always, thoughts and ideas are my own. This insight wouldn’t be possible without the help of my associates at Bitdefender.

Cloud 2.0 – Built on security refinements from cloud technologies

Eric Vanderburg

In the world of technology, paradigms shift quickly.  Not long ago, we focused organizational security efforts on the perimeter of the network.  We assumed that systems would be secure if we could just keep the bad guys outside of the trusted network.  Phishing and malware, however, among other things, proved this to be a false assumption – perimeter defense alone would not be enough. 

Responses to this often included efforts to seize control of information assets.  Control implied security.   When the cloud stepped onto the stage, lack of organizational control stood out as a primary barrier to adoption. 

I am by no means diminishing the role control has in securing information, but control wasn’t really the issue with reluctance to cloud adoption.  The cloud has actually gone a long way in securing systems on-premise and in the cloud.  When key systems were decoupled from the perceived safety of the corporate network, secure methods of transmitting data between them had to be developed. Such methods also had to be easy for enterprises to adopt. 

We realized that we might not want our cloud vendors to have access to back-end data so we encrypted the data and distributed keys such that cloud providers could not access the data they hosted.  Robust APIs were created to integrate systems while providing only the minimum required service access.  Likewise, communications between system components such as databases and web services were also encrypted. 

The cloud offered a perception of insecurity that prompted a positive change in organizational security architectures, but a key fact here is that many of the organizational systems that moved to the cloud were not secure to being with.  They only became secure as they adopted secure practices.   The risks that were present in moving applications as they were to the cloud were already present in the application architectures.  Shortcuts like advertising services and ports, allowing back-end components to communicate unrestricted, and giving IT the keys to the kingdom, may have been overlooked in the organization but they were clearly a bad practice in the cloud. 

The cloud gave us the chance to re-architect the monolithic technology systems that had evolved over decades of growth and in response to the immediate threats of the era. These were replaced with scalable, virtual servers that were flexible enough yet specialized and hardened.  Cloud systems also offered effective ways to plug-in best of breed security technologies such as application whitelisting, monitoring and control, identity and access management (IAM), Data loss prevention (DLP), and robust anti-exploit anomaly detection to combat the latest Advanced Persistent Threat (APT).  

Some are still adopting these practices while others are taking it to the next level.  The cloud made us realize how big the gap was and now it is time to serve the attackers an eviction notice.  We can’t assume in our virtualized cloud environments that administrators or vendors will implement adequate malware protection on virtual machines, nor should we compromise with solutions that can only see a piece of the puzzle when technologies like hypervisor introspection analyze virtual machines at the hypervisor level. 

It is time to tell the bots and the ransomware that it’s not welcome here anymore.  The attackers have improved their tactics, but so have security partners.  We can now collectively say, “We confronted our fear in the cloud and emerged stronger.” 

As always, thoughts and ideas are my own. This insight wouldn’t be possible without the help of my associates at Bitdefender.