Interesting, but scary story:
http://www.reuters.com/article/domesticNews/idUSN1638118020070717
"What is most worrying is that this particular sample of malware wasn't recognized by existing antivirus software. It was able to slip through enterprise defenses,"
Like I said, the AV industry is getting its ass kicked.
Tuesday, July 17, 2007
The Most Valuable ArcSight Filters of The Summer
Without a doubt, 2007 will be remembered by infosec professionals as the year that malware came into its own. Client-side exploits and malware are nothing new. But this year there is a lot more of it, it's a lot better put together, the malware authors are handily kicking the anti-virus industry's ass, but most of all its being run like a business. If you doubted it before, ecard should be proof positive that very smart, very organized people are behind malware distribution. That's not to say that they can't be beaten, but it's definitely an arms race, and if you aren't doing your part to gather intel, well, what you don't know can definitely send your docs to .ru.
These days, I spend a lot of my time in front of two ArcSight grids ("active channels") because they are the best tools I have for finding malware as it's on its way in to the environment. So here they are.
First, this filter is built to look for McAfee ePolicy Orchestrator (ePO) events that involve an actual virus signature. When a VirusScan alert event is passed back to ePO, it stores the signature name in a device string.
(Device_Product = "ePolicy Orchestrator" And Device_Vendor = "McAfee" And Device_Custom_String1 NOT Is "NULL")
The second filter should work for any proxy or firewall log where URLs are present in the log. In my case the source is Check Point firewalls using WebSense for content filtering. Even if WebSense doesn't block them, the URLs are recorded in the log. Basically, we want to know about all of the standard executable file types and then look for suspicious downloads. Depending on your network's configuration and size, you may need to tune this to make it useful. For instance, if you don't have a WSUS server and your workstations get updates directly over the Internet, this channel will be very busy for 2-3 days every month.
(Request_Url EndsWith [IgnoreCase] ".exe" OR Request_Url EndsWith [IgnoreCase] ".msi" OR Request_Url EndsWith [IgnoreCase] ".pif" OR Request_Url EndsWith [IgnoreCase] ".cmd" OR Request_Url EndsWith [IgnoreCase] ".bat")
Update: Someone told me that he didn't think it made sense to monitor anti-virus alerts when trying to combat malware, after all this is the stuff that your anti-virus did detect and stop. Aren't we interested in the stuff that got through?
Yes, absolutely. It has been my experience (and perhaps yours, too) that it is common for a dropper to attempt to install multiple pieces of malware. The malware authors are regularly repacking to defeat AV detection, but they can't win every time. It is common, at least 50% of cases I've handled since March, for the anti-virus to detect and remove some, but not all of the malware being dropped. It's my advice that AV detects should be investigated to see if there were other downloads, suspicious network traffic, etc. from machines that did generate alerts, as they may still be compromised.
These days, I spend a lot of my time in front of two ArcSight grids ("active channels") because they are the best tools I have for finding malware as it's on its way in to the environment. So here they are.
First, this filter is built to look for McAfee ePolicy Orchestrator (ePO) events that involve an actual virus signature. When a VirusScan alert event is passed back to ePO, it stores the signature name in a device string.
(Device_Product = "ePolicy Orchestrator" And Device_Vendor = "McAfee" And Device_Custom_String1 NOT Is "NULL")
The second filter should work for any proxy or firewall log where URLs are present in the log. In my case the source is Check Point firewalls using WebSense for content filtering. Even if WebSense doesn't block them, the URLs are recorded in the log. Basically, we want to know about all of the standard executable file types and then look for suspicious downloads. Depending on your network's configuration and size, you may need to tune this to make it useful. For instance, if you don't have a WSUS server and your workstations get updates directly over the Internet, this channel will be very busy for 2-3 days every month.
(Request_Url EndsWith [IgnoreCase] ".exe" OR Request_Url EndsWith [IgnoreCase] ".msi" OR Request_Url EndsWith [IgnoreCase] ".pif" OR Request_Url EndsWith [IgnoreCase] ".cmd" OR Request_Url EndsWith [IgnoreCase] ".bat")
Update: Someone told me that he didn't think it made sense to monitor anti-virus alerts when trying to combat malware, after all this is the stuff that your anti-virus did detect and stop. Aren't we interested in the stuff that got through?
Yes, absolutely. It has been my experience (and perhaps yours, too) that it is common for a dropper to attempt to install multiple pieces of malware. The malware authors are regularly repacking to defeat AV detection, but they can't win every time. It is common, at least 50% of cases I've handled since March, for the anti-virus to detect and remove some, but not all of the malware being dropped. It's my advice that AV detects should be investigated to see if there were other downloads, suspicious network traffic, etc. from machines that did generate alerts, as they may still be compromised.
Friday, July 13, 2007
Guest Spot on Security Skeptic
Security Skeptic Dave Piscitello has reposted to his blog (with my blessing) one of my posts to the fw-wiz mailing list. It's a couple of lessons-learned from my days of implementing Entercept and CSA for clients. I recommend that you read Dave's blog. He's like Mike Rothman without the book deal. To say he's a veteran is to understate his expertise and experience. He was doing network programming for Unisys back in '82, when I was still watching the Electric Company and wearing my Members Only jacket. :-)
Members Only: VM Security
If you're not going to Black Hat this year, but you'd still like to hear what Matasano has to say about VM security, attacks, security architecture, and the continuing saga of the $400K rootkit, then look no further. Tom Ptacek and Dave Goldsmith, in conjunction with the Institute for Applied Network Security, gave a webinar on Tuesday that is now online. Members only, I'm afraid, but it's still gotta be cheaper than airfare, hotel, and registration.I vattended (not a typo, I'm trying to coin a new word for remote spectatorship of things like webinars) their talk on Tuesday and it was quite good. We invited our infrastructure teams even though I was worried they wouldn't get much out of it. But they did. Unlike what I presume Tom and Nate's Black Hat talk will be like, Tom and Dave talked about high-to-medium- level stuff like network blind spots, the risks of access to the host/hypervisor CPU.
Along those same lines, Jeff Mayrand gave a nice preso on VI3 security to Grand Rapids ISSA back in February. Those of you interested in the specifics of network blind spots and VM networking best practices should read Jeff's slide deck. Members only again, but joining the GR-ISSA mailing list is free.
On Wireless Hackers and The Law (Again)
This week, an appeals court upheld the sentence of one of the Lowe's hackers. He got 9 years, the longest sentence given to a hacker in the U.S. ever!
In case you don't already know, two hackers broke into a Detroit Lowe's store via open WiFi access point and were attempting to steal credit card numbers from Lowe's transactions. By all accounts, this attack would have worked but for the fact that the 2 men were arrested before they could return to collect the card numbers.
As I read this, it put into perspective for me just how completely dumb the arrest of Sam Peterson (also in Michigan) was.
In case you don't already know, two hackers broke into a Detroit Lowe's store via open WiFi access point and were attempting to steal credit card numbers from Lowe's transactions. By all accounts, this attack would have worked but for the fact that the 2 men were arrested before they could return to collect the card numbers.
As I read this, it put into perspective for me just how completely dumb the arrest of Sam Peterson (also in Michigan) was.
Thursday, July 12, 2007
My Feeds
Hi, my name is Paul, and I'm an addict.
So, I've been using Sage for Firefox for a couple of years now, and it's become a problem. It's a problem because if a web site that I find interesting has an RSS feed, I add it to my Sage feeds instead of bookmarking it. As part of the first step toward recovery, I know I must admit that I have a problem. And here is the scope of said problem:
And of course, if you have Sage, or if your RSS reader supports feed discovery, you can automagically add all of my feeds to your feeds. Share the love. Spread the disease.
So, I've been using Sage for Firefox for a couple of years now, and it's become a problem. It's a problem because if a web site that I find interesting has an RSS feed, I add it to my Sage feeds instead of bookmarking it. As part of the first step toward recovery, I know I must admit that I have a problem. And here is the scope of said problem:
- InfoSec
- Alerts & Vulns
- Newsy Stuff
- Logs/Analysis
- Tastes Good
- Good For You
- Aviv Raff On .NET - Security
- CastleCops Web Malware Links
- Checkmate
- honeyblog
- Jeremiah Grossman
- Mark's Blog
- Matasano Chargen
- Michael Sutton's Blog
- Offensive Computing blogs
- Open Source Information Security
- OSX, and other stuff
- rdist: setuid just for you
- SecuriTeam Blogs
- Security Sauce
- Support Intelligence
- TaoSecurity
- The Ethical Hacker Network RSS News Feed
- Uninformed Journal
- Websense Security Labs Blog
- Zero in a bit
And of course, if you have Sage, or if your RSS reader supports feed discovery, you can automagically add all of my feeds to your feeds. Share the love. Spread the disease.
Tuesday, July 10, 2007
Arrests in TJX, Polo Breaches
Evan Schumann at The Hack Report reports today that some Cuban nationals were arrested in Florida with card dumps from the Polo and TJX breaches. The interesting thing to note is that the Secret Service says these guys in FL received the data from Eastern Europe. But from what we already know about TJX, the original hackers weren't from Europe, they were in and likely from Minnesota.
It'd be pretty cool to see a path analysis of these card numbers if one could be put together. How many times are the cards sold before they're actually used?
It'd be pretty cool to see a path analysis of these card numbers if one could be put together. How many times are the cards sold before they're actually used?
Subscribe to:
Posts (Atom)