Special Edition is the blog for security testing business SE Labs. It explains how we test security products, reports on the internet threats we find and provides security tips for businesses, other organisations and home users.
Friday, 24 March 2017
At the start of March came the first part of yet another Wikileaks document dump, this time detailing the CIA's hacking capabilities. The world suddenly feared spooks watching them through their TVs and smartphones. It all made for great headlines.
The Agency has developed scores of interesting projects, not to mention a stash of hitherto unknown zero day vulnerabilities. The dump also gives notes on how to create well-behaved, professional malware that stands the least chance of detection, analysis and attribution to Langley. We've also learned some useful techniques for defeating antivirus software, which the Agency calls Personal Security Products (PSPs).
There's also a deeper tale to tell. It's about the personalities behind the redacted names working on these tools and techniques. They don’t seem so different from anyone else working in infosec.
User #524297 says he is a "Coffee addict, Connoisseur of International Barbecues, and Varied Malt Beverage Enthusiast." Thanks to his comments, we know an ex-boss (nicknamed "Panty-Raider") was considered "really odd". Another had a large, carved wooden desk that went with him from job to job.
User #524297 also maintains a page dedicated to some interesting ideas. One is to use the OpenDNS DNSCrypt service to hide DNS requests emanating from a compromised host.
Another fun-loving User is #71473. He has a page called "List of ideas for fun and interesting ways to kill/crash a process", which enumerates a dozen homebrew techniques and variations. Most are still at the concept stage, but under the list of uses to which they may be put, he includes "Knockover (sic) PSPs" and "Troll people".
He also describes several proof-of-concept tools for his process crashing techniques. One is called DisorderlyShutdown, which waits a programmable amount of time (plus a random offset to make things seem natural) to select a random process to crash in the hope of leading to "data loss and gnashing of teeth". Another is WarheadsToForeheads, which attempts to crash processes. About this tool, he says: "Considering making this an infinite enumeration to squash all user processes and make the user experience especially horrific."
Revealingly, User #71473 also likes to hack the home pages of other Users: " Its 11:30... time to deface people's unprotected user pages..."
User #11628962 was deeply impressed by Subramaniam and Hunt's "Practices of an Agile Developer", and went to great lengths to enumerate the principles behind the work for others in his group.
Meanwhile, we learn that User # 71475 loves to listen to music online and lists several streaming services and YouTube channels. He's also an avid collector of ASCII-based emoticons. Everyone needs a hobby, right? ¯\_(ツ)_/¯
Amusingly, User #20873595 is keen for people understand that his last name does not begin with C, implying that it is in fact Hunt. There was also some debate about what User #72907's office nickname should be. "Monster Lite" was the apparent front runner.
Hearthstone, which unfriendly foreign state actors are likely now feverishly trying to hack.
The public at large has moved on, and the first of the vulnerabilities highlighted in the dump has been patched, but the industrious CIA hackers who originally found them are still beavering away, creating new tools to replace the old ones, finding new zero-days, thinking up new nicknames, trolling each other, and of course playing Hearthstone.
Tuesday, 7 March 2017
The UK media recently exploded with news of a new phone-based scam. Apparently, all that's needed for fraudsters to drain your bank account is a recording of you saying "yes". It runs as follows:
- Someone calls and asks if you can hear them
- They record you saying "Yes"
- They take your ID and money
Whether it's a hoax or not, it's certainly easy to see how cyber-scammers can take advantage of the generated fear. Your "bank" calls, says you've been the victim of this very scam, and asks you to visit a special web site to enter your details and get your money back. Previous cybersecurity incidents certainly provide good evidence that such secondary scams may soon plague a phone near you.
Remember the TalkTalk hack of October 2015 and the scandalised headlines that followed? Four million customers were suddenly at risk, according to some ill-informed reports. The supposed Russian jihadist gang behind the attack was ransoming the purloined data. The Daily Express even reported that they were already raiding the accounts to fund their evil deeds.
The truth was far more mundane. A 17-year-old boy from Norwich had discovered an SQL injection using a vulnerability scanner, and syphoned off about 157,000 account records. However, with this data potentially in the wild, any attempted fraud experienced by TalkTalk customers was suddenly blamed on the hack.
In fact, telephone-based cyber-fraud is a numbers game. The more calls you make, the more likely it is that you'll hit the right set of circumstances. It's a brute force attack, and that's exactly what the scammers started to do. Nearly 18 months later, they're still finding ways to use the hack as a pretext to call unsuspecting customers.
At the time, some customers even reported that their broadband was being deliberately slowed by criminals, who then called them offering to fix the problem in exchange for visiting a phishing site and entering account details to get a special refund. Again, this is a numbers game: for every set of circumstances that make the scam work, there might be thousands of calls to people with the wrong broadband provider or who have no bandwidth problems. It's never the precision spear phishing attack it's reported to be by the bemused victims.
So, high profile hacks can subsequently spawn profitable campaigns for fraudulent callers keen to cash in on the chaos and fear. The problem is, juicy high profile hacks come along at random. What's needed is something more dependable.
This brings us back to the supposed "Can you hear me?" scam. Several reports in the past few days on Who Called and other very active nuisance call sites have mentioned the scam in passing as something else to look out for, but none say that this was the focus of the call being reported. The story has begun to take on a life of its own, but without any direct evidence that the scam actually exists.
Could it be that scammers themselves have concocted and spread a fake news story, which they intend to subsequently exploit with a campaign? It's not that great a leap of imagination, given the innovations developing in other areas of bulk cybercrime, such as ransomware. Only time will tell, but the next few months should be fascinating for both threat watchers and cyber-criminals alike.
Wednesday, 15 February 2017
No one publishes successful phishing and ransomware emails. Jon Thompson thinks he knows why.
The headlines say phishing scams are at an all-time high, and ransomware is growing exponentially, but conspicuous by their absence are examples of the emails behind successful attacks. It's becoming the cliché in the room, but there may be a reason: embarrassment.
Running an email honeypot network, you receive a flood of malicious email every day. Most is littered with glaring errors that point to lazy, inarticulate crooks trying to make the quickest buck from the least effort. When you do come across a rare, well though-out campaign, it shines like a jewel in a sea of criminal mediocrity.
To the average spammer, however, it's all just a numbers game. He cranks the handle on the botnet, so to speak, and money comes out.
This poses an important question: why, given the quality of most malicious spam, are new ransomware infections and high profile phishing attacks still making headlines almost every single day? Clearly, we're massively overestimating the amount of effort and intelligence invested by spammers.
With that in mind, what follows is a short list of 17 mistakes I routinely see, all of which immediately guarantee that an email is malicious. There are others, but these are the main ones. If this list reflects the mistakes found in the spam behind the headlines, then the size yet lack of sophistication of the problem should become apparent.
1. No Subject HeaderThis error is particularly prevalent in ransomware campaigns. Messages whose payloads have very low VirusTotal scores are being sent with no subject header. Maybe the sender thinks it'll pique the curiosity of the recipient, but it should also alert spam filters even before they examine the attachment.
2. No Set Dressing
3. Generic Companies
4. Multiple RecipientsThis is another example of laziness on the part of spammers. OK, they may have found an open relay to willingly spread messages rather than buy extra time on a botnet, but anything other than a one-to-one sender to recipient ratio should be an instant red flag.
5. Poor SalutationMuch apparently personalised spam doesn’t use a competent salutation, or uses a salutation that is simply the user name part of the email address (i.e.: "Dear fred.smith"). It would take effort to code a script that personalises the messages by stripping off the first name and capitalising the initial. Effort is the enemy of the fast buck.
6. No Body TextSending an email with a tantalizing subject header such as "Overdue – Please Respond!" but no body text explaining what or why it's overdue is as common in commodity ransomware as having no subject header. The attack again relies entirely on the natural curiosity of the recipient, who can and should simply ignore it. Spam filters should also take a keen interest.
7. Auto-translated Body Text
8. The Third PersonThis is a great example of a spam writer trying to distance himself from his crime. "PayPal has detected an anomaly in your account" and "they require you to log in to verify your account" just look weird in the context of a security challenge. This is supposed to be from PayPal, isn't it?
9. Finger Trouble
10. Unexpected Plurals and TensesUsing "informations" instead of "information" is a dead giveaway for spam and should be blocked when in combination with other indicators. Phrases such as "we detect a problem" instead of "we detected a problem" also stick out a mile.
11. Missing Definite ArticleMany spam emails stand out as somehow "wrong" because they miss out the definite article. One recent example I saw read: "Access is blocked because we detect credit card linked to your PayPal account has expired." An associated Yandex.ru return address gave the whole thing a distinct whiff of vodka.
12. The Wrong Word"Please review the document and revert back to us immediately". Revert? Really? Surely, you mean "get back", not "revert back". It may be difficult for spam filters to weed out this kind of error, but humans should spot it without difficulty.
13. Misplaced Emphasis
14. Tautological Terrors
What they really meant was: "To mark the release of our new software". The whole message was also riddled with the most outrageous auto-translate errors that it made difficult reading.
16. Overly-grand TitlesWhy would the Microsoft Chief Support Manager be contacting me personally all the way from the US to give me a refund? Wouldn't he delegate this important work to a local minion? Similarly, the head of the IMF doesn’t usually spend their days emailing strangers about ATM cards stacked high with cash.
17. Obfuscated URLsIf the collar doesn't match the cuffs, it's a lie. In other words, if the message contains the name of a high-street bank (for example) and a URL from a shortening service such as bit.ly, spam filters should be blocking the message without question, regardless of the rest of the content.
Friday, 27 January 2017
There is, according to former Mozilla developer Robert O'Callahan, negligible evidence that anti-malware software produced by third-parties provides any additional security. His arguments have spread from his blog to Twitter and then to IT news websites like IT Pro and The Register.
We test anti-malware software and have, as a team, being doing so for years. We think we have plenty of strong evidence that third-party anti-malware software provides improved security over that which comes with Windows by default. Our enterprise, small business and consumer reports are free to download.
There is no doubt that updating your operating system makes it more secure. We've run tests to prove that this oft-quoted advice is based on real, reproducible data. But what we've also seen is that adding a decent anti-virus package to a good patching schedule raises protection levels even higher.
There is a difference
Our position on the Microsoft anti-malware included with Windows is that it is far better than it used to be, but that some commercial third-party packages are consistently stronger.
Why do people bash 'anti-virus' all the time?
Different individuals and companies have axes to grind when it comes to anti-virus or, to use a more modern and appropriate term, 'anti-malware' software.
- New anti-malware vendors sometimes disparage more established vendors as providing less sophisticated products as a marketing tool.
- Windows developers at Microsoft don't like the perception (which is sometimes the truth) that anti-malware products slow down Windows. When a user has a bad Windows experience, for whatever reason, Microsoft feels the impact.
- Other developers hate that anti-malware products embed themselves into Windows in sometimes strange and unusual ways, causing potential havoc with their own efforts and possibly introducing new and powerful security vulnerabilities. Anti-malware vendors argue that they need to do this to prevent particularly nasty threats from digging in at the lowest security levels within the operating system.
- Users who have never (knowingly) suffered a malware attack often question the very necessity for anti-malware.
- Some testers/ researchers make it their life's mission to discover technical problems with anti-malware, sometimes apparently taking the position that "anti-malware is bad for you," rather than, "you need it, it's a bit broken but here's how to fix it."
So is anti-virus the ultimate solution?
We can throw away our anti-malware software when our operating systems are fully secure; we, as users, stop clicking on links to malware; and criminals and other 'agencies' stop attacking our computers en-masse.
Tuesday, 10 January 2017
Latest reports now online
Welcome to the final set of endpoint security tests for 2016. We've spent the entire year scanning the internet for prevalent threats that affect real people and exposing popular security products to those same threats in real-time.
If you want an answer to the question, "How well does my anti-malware product protect me?" the reports we've published throughout the year should go some way to helping you either feel safe or make an informed decision on which product to change to. You can find these, and earlier reports, on our website.
But helping you, our readers, choose the best products is only part of our mission. We want products to improve, because even the best are not perfect. We offer the developers of these products the chance to engage with us and learn where the problems lie. At the end of each test we could say to them, "bad luck, you missed these threats. Better luck next time!"
But what we do is provide a huge amount of useful data to companies that want to work with us. This includes extremely detailed analyses of the threat itself, how it worked against individual products and forensic data proving what happened.
This data provides two benefits to the security companies: the first is proof that we're not just making everything up! The second is an unbiased, third-party quality assurance service that can identify problems overlooked by in-house teams. In the end they benefit and so do you, if you use their products.
We're trying to make things better. Thanks for your support throughout the year.
Our latest reports, for enterprise, small business and home users are now available for free from our website. Please download them and follow us on Twitter to receive updates and future reports.
Thursday, 5 January 2017
and stares horrified into 2017.
Prediction is difficult. Who would have thought a year ago that ransomware would now come with customer care, or that Russia would be openly accused of hacking a bombastic businessman into the Whitehouse. Who even dreamed Yahoo would admit to a billion-account compromise?
So, with that in mind, it's time to gaze into the abyss and despair…
Let's get the obvious stuff out of the way first. Mega credential breaches won't go away. With so many acres of forgotten code handling access to back end databases, it's inevitable that the record currently held by Yahoo for the largest account breach will be beaten.
Similarly, ransomware is only just beginning. Already a billion-dollar industry, it's cheap to buy into and easy to profit from. New techniques are already emerging as gangs become more sophisticated. First came the audacious concept of customer service desks to help victims through the process of forking over the ransom. By the end of 2016, the Popcorn Time ransomware gang was offering decryption for your data if you infect two of your friends who subsequently pay up. With this depth of innovation already in place, 2017 will hold even greater horrors for those who naively click attachments.
Targeted social engineering and phishing attacks will also continue to thrive, with innovative
It's also obvious that the Internet of Things will continue to be outrageously insecure, leading to DDoS attacks that will make the 1.1Tbps attack on hosting company OVH look trivial. The IoT will also make ransomware delivery even more efficient, as increasing armies of compromised devices pump out the pink stuff. By the end of 2017, I predict hacking groups (government-backed or otherwise) will have amassed enough IoT firepower to knock small nations offline. November's test of a Mirai botnet against Liberia was a prelude to the carnage to come.
Bitcoin recently passed the $1,000 mark for the first time in three years, which means criminals will want even more than ever to steal the anonymous cryptocurrency. However, a flash crash in value is also likely as investors take profits and the market panics in response to a sudden fall. It's happened before, most noticeably at the end of 2013. There's also the distinct possibility that the growth in value is due to ransomware, in which case the underlying rally will continue regardless of profit takers.
The state-sponsored use of third party hacking groups brings with it plausible deniability, but proof cannot stay hidden forever. One infiltration, one defection, one prick of conscience, and someone will spill the beans regardless of the personal cost. It's highly likely that 2017 will include major revelations of widespread state-sponsored hacking.
This leads me neatly on to Donald Trump and his mercurial grasp of "the cyber". We've already delved into what he may do as president, and much of what we know comes straight from the man himself. For example, we already know he skips his daily security briefings because they are "repetitive", and prefers to ask people around him what's going on because "You know, I'm, like, a smart person."
Trump's insistence on cracking down on foreign workers will have a direct impact on the ability of the US to defend itself in cyberspace. The shift from filling jobs with overseas expertise to training homegrown talent has no discernible transition plan. This will leave a growing skills gap for several years as new college graduates find their way to the workplace. This shortfall will be exploited by foreign threat actors.
Then there's Trump's pompous and wildly indiscreet Twitter feed. Does the world really need to know when secret security briefings are postponed, or what he thinks of the intelligence presented in those meetings? In espionage circles, everything is information, and Trump needs to understand that. I predict that his continued use of social media will lead to internal conflict and resignations this year, as those charged with national cybersecurity finally run out of patience.
There's also a huge hole in "fake news" just begging to be filled. I predict that 2017 will see the establishment of an infosec satire site. Just as The Onion has unwittingly duped lazy journalists in the past, there's scope for the same level of hilarity in the cybersecurity community.
However, by far the biggest threat to life online in 2017 will continue to be the end user. Without serious primetime TV and radio campaigns explicitly showing exactly what to look for, users will continue to casually infect themselves and the companies they work for with ransomware, and to give up their credentials to phishing sites. When challenged, I also predict that governments will insist the problem is being addressed.
So, all in all, it's business as usual.
Monday, 5 December 2016
If phishing sites want data, they'll get it!
Running a honeypot, you soon realise there are four types of spam. The first is basically just adverts. Next comes social engineering spam, which is mostly advanced fee fraud. There's a ton of cash or a pretty girl waiting if you send a small processing fee. By far the largest category is ransomware, but this is closely followed by that perennial favourite, phishing spam.
Phishing works. Its "product" nets huge profits in two ways. First, by direct use of the stolen data. Second, from sales of that data to other criminals. This got me thinking about how to fight back.
Phishing sites tend to be static replicas of the real thing, with a set of input boxes and a submit button. That is their major weakness. Another is that, though the inputs might be scrubbed to remove the possibility of a sneaky SQL injection, the information being entered might not be checked. Who's to say that the date of birth, password, bank details etc. that you enter are real? What if you were to enter a thousand different sets of bogus information? How about a million, or even ten million?
What I propose is that when a phishing site is discovered, it would be fun to deploy a script to flood it with random data of the appropriate format for each input field. Finding real data in the collected noise would become nearly impossible, and so would help protect the innocent. If such poor-quality data is sold on to third parties, then Mr Big will soon want his money back and probably a lot more besides.
Diluting phished data to homeopathic strengths is one thing, but the general idea could be applied in other ways. One of the main tasks in running a spam honeypot is "seeding". This involves generating email addresses to accidentally-on-purpose leave in plain sight for later harvesting by spammers. If someone were to set up a honeypot with a huge number of domains pointing to it, and with a huge number of active login accounts, those accounts can be leaked or even sold (with all profits going to charity, naturally!) as being demonstrably live and real. If the buyer tests any of them, they'll work. Set up the honeypot in enough interesting detail, and Mr Big won't be able to tell he's been duped for quite some time.
Phishing is popular because it's easy, relatively safe for the perpetrator, and highly profitable. Frustrating the efforts of criminals, casting doubt on the phished data being sold, and hopefully causing wars between cybergangs is certainly one potentially very entertaining way of fighting back.
Of course, flooding phishing sites with bogus data may already be quietly happening. I certainly hope so…