executive summary
Any Organization – big or small, can be target of any Cyber-attack. Password only protection are weak authentications and are too risky. Also, with the adoption of Cloud based IT Infrastructure, Organizations are expected to secure what they don’t own, manage or control. Users want the complete freedom to browse on web, not only when and how but also with the devices of their own choice. Cyber criminals are taking advantage of today’s “any-to-any” world where individuals are using any device. The threats targets are across domains without discriminating by Industry, Businesses, size or Country. Cyber criminals are constantly evolving new techniques to bypass security. “IntSec” is special CCFIS monthly Series Bulletin based on Internet Security as per research work done by CCFIS Team, who is constantly watching vigilantly all new advanced techniques and cyberspace threats.
As per recent survey by one of reputed Research Center, 50% of Organizations had experienced at least one occurrence of economic crime in last 1 year. Instances of such frauds losing billions of dollars. Those, who commit frauds have become craftier and are launching more complex plan. However, only few of the Organizations are responding to growing threats by tightening up their controls and investing in fraud detection and prevention as per professionals/expert opinion.
The “any-to any” evolution already involves billions of internet connected devices and is expected to grow many folds in next few years. IntSec Bulletin is a small step to make our Users aware about Internet Security.
Cloud computing is the technology that brings a complete changing the way we use internet for personal and business use. From running a complete web application on virtual server to baking up our personal files on online storages, we use cloud technology. Researchers have developed many encryption technologies to keep our files secure and encrypted on cloud. But the issue we found in our CCFIS research labs in the channel through which our files are sent. Unfortunately, our files are only encrypted once they reach the server, not in-transit.
The biggest issue with this attack vector is that incredibly popular services like Dropbox and Google Drive that are used for business as well as personal purposes are vulnerable to in-transit encryption. As per researched conducted at CCFIS HQ, we found that data sent to these services are only encrypted once it is stored on the service, not in transit to the service.
In simpler words, the photos of files which you are uploaded are not encrypted the moment it leaves the system. Hence the data is not encrypted and ultimately not protected before it reaches the cloud, and a hacker with advance knowledge of Man in the Middle attack or sniffing can steal these data.
There should be a mechanisms of local encryption of encrypting the data before it leaves the system. But the challenge is that if the encryption algorithm is locally stored on systems then hackers can reverse engineer it to generate the decryption algorithm and again the encrypted data can be captured in-transit and can be decrypted.
To resolve this issue, CCFIS team has already started working on open-source cloud based encryption tool that will act as a middle man agent between cloud based services and users. This tool will give GUI interface to users for uploading data on cloud. The file will be automatically encrypted before leaving the system and hence the data will be encrypted even during transit. Hence the data will be protected during the transit and even if the cloud storage of a user is compromised then also the data which attacker will get will be encrypted.
mayhem
Linux botnet 'Mayhem' spreads through Shellshock exploits
We all know about shell shock, a bug that is game over for any of Linux user. Shell shock bug was discovered recently and it left many systems & servers vulnerable.
Earlier in 2014, when we deployed out Advance Threat Protection Sensor (ATP Sensor) which captures malware and attacks in different national as well as international location, we captured a sophisticated malware called Mayhem. After malware analysis and reverse engineering our malware analysis team conformed that it gets installed through a PHP script that attackers upload on servers via compromised FTP passwords, website vulnerabilities or brute-forced site administration credentials.
Mayhem’s main component is a malicious ELF (Executable and Linkable Format) library file that, after installation, downloads additional plug-ins and stores them in a hidden and encrypted file system.
Recently we captured another variant of Mayhem. After deep analysis, our malware analysis team found that that Mayhem’s authors have added Shellshock exploits to the botnet’s arsenal.We also found that the Shellshock attacks originating from the Mayhem botnet target Web servers with CGI support. The bots probe Web servers to determine if they’re vulnerable to the Bash flaws and then exploit them to execute a Perl script.
This upgraded script contains malicious Mayhem ELF binary files for both 32-bit and 64-bit CPU architectures embedded into it as hexadecimal data and uses the LD_PRELOAD function to extract and run them on the system.
badUSB
We use USB every day, from phones to laptops to servers and whatnot. We all have more than 10 devices in our offices and homes that interacts with USB. Now days, almost every device has USB connection functionality. Even healthcare equipment has feature to connect USB ports for different purposes. We knew about possibility of hardware backdooring but the procedure and programs were confidential and wasn’t accessible to common peoples. But in a recent Blackhat conference, the process was demonstrated publically and source code has been uploaded on Github to anyone to download and tinker with.
CCFIS research lab found that these backdooring are not only possible in USB drives but can be done very easily in keyboard, cameras, printers and almost all components that can be connected with via USB. The vulnerability exists in USB controller chip’s firmware which offers no protection from reprogramming and reverse engineering. After reverse engineering, even a thumb drive can be used to compromise a computer or an entire network. Following are some BadUSB threats –
· Any USB device can emulate a keyboard and issue commands on behalf of the logged-in user, for installing malicious files or malwares.
· A small pendrive can spoof network card and can change the computer’s DNS settings and can redirect entire traffic to hacker’s IP.
· It can also be configured to infect system before the system boots up. The malware can detect when the computer is booting up and it can plant a small virus on boot
Backdooring is possible by many other techniques too. Hackers can read the program stored on keyboard’s microcontroller and bind the program with a malicious code and then write it back to keyboard. If installed microcontroller doesn’t allow rewriting then hackers can install a new microcontroller with malicious code. We also found that addition another microcontroller along with original microcontroller is also possible. Now this keyboard will send all the data typed through this malicious keyboard to a hacker’s FTP.
Unfortunately there isn’t any effective way to detect a malicious USB device because malware scanner or antivirus cannot access the firmware running on any USB device. USB firewalls that block certain device classes do not exists till date. Also behavioral analysis is quite difficult since a BadUSB device’s behavior when it changes its persona looks as through a user has simply plugged a new device.
windows 10 technical preview keylogger
Microsoft is gathering information from its Windows 10 Technical Preview in every way possible.
Microsoft is keeping a very close eye on those participating in the Windows 10 Technical Preview—closer than you might think, in fact.
The Technical Preview has been released for two reasons. First, it gives the demo to crowd users to try out the next big thing Windows 10. But the other, more important reason for Microsoft is to gather data on both how Windows 10 is running on your system, and how you’re using the OS and maybe that’s why as per researchers they have installed a keylogger in their new Windows 10.
Well, how many of you actually read the “Terms of Service” and “Privacy Policy” documents before downloading or installing the Preview release of Windows 10? I believe none of us even read those documents, because most computer users have habit of ignoring that lengthy paragraphs and simply clicking "I Agree" and then "Next", which is not at all a good practice. Do you really know what permissions you have granted to Microsoft by installing Free Windows 10 Technical Preview edition? You actually gave permission to keylog your system.
If you are unaware of Microsoft’s new privacy policy, then now you should pay attention to what the policy says. Microsoft is watching your every move on the latest Windows 10 Technical Preview, as mentioned in Microsoft's privacy policy, which indicates that the technology giant is using keylogger to collect and use user’s data in a variety of ways without the information of user.
“If you open a file, we may collect information about the file, the application used to open the file, and how long it takes any use [of] it for purposes such as improving performance, or [if you] enter text, we may collect typed characters, we may collect typed characters and use them for purposes such as improving autocomplete and spell check features,” the privacy policy states.
Essentially by accepting the Windows 10 privacy policy you are allowing Microsoft to screen your files and log your keystrokes. This means, if you open a file and type, Microsoft have access to what you type, and the file info within. In our research lab, we found that all the keystrokes that were typed in Internet Explorer of Windows 10 were stored in below hidden location -
C:\Users\CCFIS\AppData\Local\Microsoft\Windows\inetcache\low\ie\ZPBXU1LL
Microsoft says it may collect even more data. The company will be watching your apps for compatibility, and collect voice information when you use speech to text. This information will be used to improve speech processing, according to Microsoft.
The data Microsoft collects could have thousands of username and password combinations stored in a database somewhere.
Several researchers over security blogs has already started talking that Microsoft might have started a mass surveillance program with collaboration with some intelligence agencies. Whatever the rumors are, at least Microsoft is asking you before using your data.
bot based bruteforce ‘ylmf-pc’
SMTP connection at HELO/EHLO matching machine name
We all use mailservers, cPanel and many more other service in which are somehow vulnerable to bruteforce attacks. There are many best practices to block a bruteforce attack but everything fails when it’s a targeted bruteforce attack.
Recently our team received a case from one of our major client that their mailboxes are being compromised, no matter how complex password they are using, their mailboxes arecompromised and confidential information about organizations is leaked. During investigation, we came to know that it was a successful bruteforce attack in their Smartermail even after properly updated server and password policies properly defined.
To conform this, we clustered several systems of our cyber lab and launched a bruteforce attack and we were able to crack the password using bots installed on all machines. We created one Command & Control server and controlled all systems to launch bruteforce attack on one dummy account which was using a strong password. The test attack was successful and account was compromised. Then we realize that even after implementing all best practices, one cannot stop a bruteforce attack.
Performing bruteforce to break a 12 character long password will take more than a year if attack is performed with single system and user has used combination of small caps, large caps, numbers and special characters.
But now days, attackers have developed a malware based bot. This bot search for vulnerable machines and servers connected to internet to compromise it and connect back to Command & Control server which is actually the master of all these bots. If this bot has compromised 10000 systems, then the same password which it was cracking in 1 year, can be crack it in few minutes.
Enabling CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) image verification doesn’t work always as hackers have already identified to bypass it because almost all of the CAPTCHA verification API’s relied on plain text HTTP protocol to perform CAPTCHA validation. Because of this, the CAPTCHA provider’s identity are not validated, message authentication checks are not performed and the entire CAPTCHA validation are performed on an unencrypted channel. Also one cannot implement CAPTCHA when bruteforce is coming to SMTP. Blocking an IP after few failed login attempts will also not work as in an organization, 1000s of users share the same gateway IP and if one user fails to login into his account and cross the limit then the gateway IP will be blocked by server and no one from that organization will be able to access their mails.
On later stage, we found a bot, representing itself as ‘ylmf-pc’ which was used to perform the bruteforce attack to break password of email accounts. The bot first compromised users across the globe and then performed the bruteforce attack through these compromised users to hide its original IP and to remain untraceable. In our research lab, we performed pattern analysis on logs of mail sever and we found the bot’s behaviour and we were able to locate the Command & Control Server.
