Saturday, September 16, 2017

NEW! and Ridiculously Simple! Wapack Labs RiskWatch

Ridiculously simple is going to be my mantra. Wapack Lab's RiskWatch makes monitoring threat Ridiculously Simple. Define Ridiculously Simple you say?

We can do it for you, or you can do it yourself.

For the individual: Sign in, enter an email. That domain gets checked and monitored. When we see something, you get a report. Simple right?

RiskWatch tally's the number of times any of domains, IP, or domains are seen in our intelligence. If it is, a report is generated and you get an email.

When the recipient of one of our emails logs in (for free), they'll see a dashboard that will give them enough information to fix the problem. For a small fee (starting at $9 per month) the victim can sign up for a detailed look, including raw logs and a notification service.

Think credit monitoring, but we're watching for malicious activity targeting you.

For your company: Today, our analysts screen thousands of companies. When we find issues, we'll enter a point of contact and you'll get the report. Fix away. Interested in having one of these in your own company? Use it for reporting security concerns, risks, threats to your suppliers? Partners? Easy.  Interested? Drop us a note. We're working on that console as we speak.  We'll call you when we're ready.

I was told "think Equifax report".

As of this morning, we've sent out over 1300 suspicious activity reports to individual users in the last two days.  Received one? No sweat.  Sign in. We'll build your report on the fly.

Want to be proactive? Sign up on the site. If we see something, we'll tell you!

Simple right?

RiskWatch is Patent Pending.

Saturday, September 09, 2017

Could we have stopped the Equifax breach? Leading Indicators?

I have this friend (it seems like all the best stories start this way —or with This is a no sh*tter!). Regardless.. I have this friend. He's a long time friend that I worked with years ago during the days when I spent my morse code shifts with the positions glass door closed, head sets on to drown out external  noise, studying calculus while I waited for the next AMVER, or worse yet …- - -…  …- - -…  …- - -…

After leaving the Coast Guard, he went on to become a sales giant with Big Blue, and of course you know where I ended up!

This old friend, we'll call him Mike (I call everyone Mike when I want to anonymize them) was working us through a 'so what' exercise on Thursday night when the phone rang at about 6:00 —it was WMUR, the local ABC Affiliate, who wanted to come to the lab and interview us for comments on the Equifax breach. At that point I hadn't really kept up. Equifax is bad, but so are all of the others —OPM for example (of which most of my team were included). Equifax was just one more breach from a company who likely let their guard down for a moment, and ended up getting screwed as a result.

In preparing for the interview, I quickly pulled up our internal Kibana instance (you've heard me talk about Cyber Threat Analysis Center? An ELK stack is one of the tools that we make available to our members. So.. I pulled up our internal Kibana and punched in the search term *equifax* with a one year time window —and whadya know…


At the time, we knew that Equifax claimed to have identified the breach in late July. We suspected they'd actually suffered the breach earlier; it's rare to catch the breach on Day 0. I wouldn't surprise me to hear that this incredibly talented security team at Equifax probably caught it much earlier. I've met and had beers with these guys. The are scary smart like I was at that age ;) , and my bet is, they followed the same smart process that any large company would follow before reporting out… they identify the breach, investigate the breach, and at the same time, fix the hole and assess just how bad it is. They then break out the mop. The legal team decides how far it extends and what the reporting requirements are, and then, if they choose, the PR engine fires up. This entire effort could take anywhere from days to months. My estimate would have been that they would have actually suffered the breach approximately two to three months before they announced —sometime between late April and late May. Apparently I was close. Scuttlebutt says May.

So why the chart? We monitor all kinds of proprietary intelligence sources that give us leading indicators of when we think something might be coming. We had early warning on Amazon when Jeff Bezos was portrayed as the Devil Boss in the press a few years ago. We had increased levels of cyber activity (although we had no idea what it meant at the time) before the Paris shootings, and we had a leading edge spike in cyber indicators leading into the time when Equifax was believed breached. Of course this is all speculation at this time, but… what did we see?

  • A trojan was sent, several times, to three people —a senior account manager in Mexico, the Information Security Officer in Costa Rica, and an email account that appears to be associated with an unemployment claims service.
We identified these indicators —none of which were delivered —but we see only a small sample. My suspicion is that we saw only the unsuccessful indicators, but in many cases, there are several others occurring at the same time; we just don't have eyes on those sources.  The indicators that we identified were associated with emails sent to these users, with a trojan attached, delivering ransomware that sometimes (not always) uses a C2. 

There were other indicators from open source and misc others, but they didn't appear, at least on the surface to hold any kind of meaning. 

From an analytic perspective: 
  • FACT - We saw activity on the leading edge of the currently believed timeline of the incident. 
  • FACT - That activity targeted three locations (people and email accounts) that would have had significant access:
    • The Senior Account Manager would have had access to Equifax's customer relationship management (CRM) systems —that database that contains all of the customers information, easily access by sales and marketing teams to allow tracking of sales efforts.
    • The Information Security Officer, if breached would probably have administrative rights on some systems but not all. He would have knowledge of detailed local business unit operations, systems and locations of sensitive data.
    • The targeted email that we identified in our collections was associated with unemployment claims -and one (one that we saw), appeared to be sent from an Equifax user to a hospital —apparently looking for health information to support some kind of claim argument. 
  • ANALYTIC GAP - Did Equifax receive other emails like the ones that we saw, but with successful delivery?
  • ANALYTIC GAP - Why the spike in activity on that day anyway? Why was that day so special, as to have received almost three times as much activity as any other day in the preceding twelve months, and to date following? 
SPECULATION
  • We saw only part of the storm.. the derivative of the storm. I believe that we may have seen activity generated by automated sensors, but it may have been only a small piece of what was actually happening. 
  • My bet is, others were targeted at the same time. In this case, we was emails with, at the time, a virus total detection rate of 2 out of 57 attempts, and others were probably compromised.
  • Some of what we saw were attempts to deliver ransomware —a diversion? Noise?
I'd make a low confidence assessment that goes something like this… I'm going out on a limb here. This is a first SWAG (Scientific Wild Ass Guess) at what may have occurred. Equifax is neither a customer or are we under NDA with them, so lets have a little fun. This is a total SWAG.
  • Access occurred in Latin America (Central America if our indicators are true).
  • The ISO was targeted to help him from working
  • The Salesperson was targeted because sales people have access, and are easy targets.
  • The unemployment line? No idea. Maybe because it was on the list?? 
Of course, that assessment will change over time as more information becomes available and as our sensor systems collect more information. Let's see how close I come to the real story. I'm betting we'll hear it in the future. It's to big to be swept under the Trump carpet (the noise that happens when he tweets in the middle of the night). 

So, for my sales buddy? He wanted to know… Could Wapack Labs have stopped this attack? 

Probably not. Could we have given them warning that might put them on higher alert, positioning them to stop an attack? Absolutely, yes. We would have put them on alert —for good cause.

For many customers (albeit, not Equifax), we deliver as-it-happens and weekly reports that show these pieces of information as we know them. Equifax most certainly may have benefited from our identification of a 3x spike in cyber activity targeting them on that that particular day. At a minimum, the security team would have been issued a warning, and would probably have taken a more heavily monitored perspective. I told you, that team is scary smart. I'm certain they would not have let our warning pass.
This is where humans have value. Machines are cool. AI is cool. But this set of indicators needed to be interpreted by a human (me), who can read between the lines and think in the gray areas. Humans have value, and information sharing has value. This analysis is posted in Red Sky Alliance, and this is where information sharing has value. We'll let our membership to evaluate our data with their own eyes and participate in the discussion 

For others? Drop me a note. We'll sign you up.

Traveling today. 
Have a great weekend!
Jeff




Saturday, September 02, 2017

There ya go again Stutzman. You're selling the steak!

On Thursday, an old friend from my enlisted Coast Guard days stopped in for a visit. We'd left the Guard at about the same time; he went to work for IBM and stayed there for 21 years to become an expert salesman. I went to Navy OCS and became an intelligence officer and a professional analyst.

For the first half hour in my office, we walked through our offerings. I could see in his expressions that he was thinking critically about what I was telling him. All the while, he kept asking me "So what"? "So what?" "So what?" This is the same thing that I do to my analysts when they present me with an idea for a paper.. I "so what?" them until we can't "so what?" any more to get to the root of why anyone would want to read that piece of analysis. In this case, the tables were turned on me. He kept saying "you have to make it simple". You're selling the steak when you really need to explain, and make them sense, the feeling of sitting in the restaurant, and the first cut into that perfectly done filet. He told me that ours was some of the best intelligence he'd seen in the space, but our messaging was complicated and didn't represent our product line as well as it should. 

Yesterday I received an email today from a company (a $3 billion per year company). We'd been demo'ing our firehose of intelligence.  He explained that they created their Infosec team small by design. They told me that they have an MSSP that handles their firewalls, and outsource other parts of their world to keep their internal team lean and mean. They'd considered our services but felt it was overkill for what they need. 

We sell lots of things, but they all boil down to two primary lines —you can do it yourself (DIY) using our tools, or we can do it for you.  In either case, you get access to Red Sky Alliance where you can share information, ask questions, and compare notes.

The DIY approach consists of accounts in our Cyber Threat Analysis Center (CTAC for short) —a place where we've loaded up a SaaS environment with suite of amazing analytic tools ranging from Elastic to CyberChef and H20. We've got Zeppelin, and GitBook/GitHub for sharing code and documentation. On the backend we've loaded our intelligence, pre-built some queries, and essentially, built an expert level sandbox for highly skilled analysts who love twisting and turning data. DIYers LOVE this offering —it puts everything they need at their fingertips. In fact, I joke and tell people that I'm following Bloomberg's business model! We supply the data, tools, and training. You supply the brain cells. 

At the other end of the offering, we've had several companies who tell us "we don't want to invest in intelligence", or, "we've already spent enough money on infrastructure", or, "we've intentionally kept our team small".  In those cases, we become their intelligence and analysis team, supplying inputs into their Information Security, Fraud, Physical, Risk and Intellectual Property teams.

So Jeff (my Coastie turned IBM friend) looked at me and and asked "How much would it cost if you sent me a weekly report, specifically for me and my company?

I gave him a price. That's easy I said. We do it all the time.

Back to my $3 billion per year prospect —They also told me that they couldn't handle intelligence inputs into their security team —they leave that to their MSSP and a small team. The head guy didn't want to invest in the DIY program. But, on more than one occasion we'd given them both compromises in their supply chain, and internal networks —things their MSSP should have seen, but missed. And when we did, in every case (three times), the analyst that we presented with our findings, acknowledged them in a positive way, once publicly.

I'd made a fundamental error.

I'd been trying to sell them on DIY, when whey they really wanted and needed, was option 2.

We're hearing this more and more… There's to much intelligence. We don't have a good way to process it. We're not interested in building an intelligence team. We rely on our MSSP for that. Or maybe it's what my old pal Jerome calls the 'green light syndrome' (where security people watch for the green light, and if it's green, they're good).  Not everyone wants to grill their own steak. Maybe they just want to pay a little more to sit at a nice restaurant and have a perfectly cooked filet mignon be placed in front of them. 

Wapack Labs is working hard to make this ridiculously simple. In the next few weeks, we'll be launching a tool to drip out the most important stuff -in chewable byte sized chunks. We've assigned primary analysts to each of our customers as their go-to analyst. And we've begun sending out reports and ad-hoc warnings. If you still want to be a DIY'er, please! By all means! But if you're one of those "we need it simple" types of folks, you're going to love this.

Interested in having a look? Check out wapacklabs.com, or sign up here for more information.

BT

For those affected in Texas, we're thinking of you. As of this morning when I last watched the news, 39 dead, not to mention untold numbers of folks displaced or stranded. We're thinking of, and praying for you.

Until next week.
Jeff

Saturday, August 26, 2017

What's the thinking on the USS John F McCain? Directed Energy?

During the Presidential primaries, we authored an intelligence assessment regarding the North Korean potential for an Electro Magnetic Pulse (EMP) floated over a city in the US and detonated, leaving electronics for miles on their death beds. Last week we published a piece on GPS Spoofing in the Black Sea, showing three ships nearly 25 miles away from where GPS put them —in an inland Russian airport. And tonight I'm seeing a number of youtube videos talking about directed energy weapons (DEW) having been used (speculation of course) against the John F. McCain. The video shown below is one of many, now speculating on the idea that a DEW may have been used against the JFMc.


Regardless of your thinking on this (I happen to believe that human error could not have caused this crash), the idea that an EMP or DEW may have been employed in this incident should not be that far fetched.

You see, (ahem) years ago, we had this thing called TEMPEST. TEMPEST was essentially the hardening of computing gear by wrapping it in grounded shielding, sealing seams with braided wire, and ensuring that all of our communications gear was protected from both eavesdropping, and external interference. Just hours before the McCain collision, we reported on GPS spoofing by someone in Russia against three ships in the Black Sea, showing their position nearly 25 miles off, and inland at an airport. This report of course caused my phone to explode. Reporters everywhere wanted to know if I thought this could have been the cause of the collisions in both the Fitzgerald and McCain. I have no idea, but, it's not out of the realm of possibility that someone from shore could have offered a stronger GPS signal that that of the birds, thereby causing the onboard systems —either on the warships or on the commercial vessels, to associate with it, rather than the satellites.. much like your laptop associating with a stronger wireless access point when you're sitting in a coffee shop. And after linking with shipboard receivers with a false signal, showing the ships on very different courses than originally thought. 

I'm not saying it happened, but it isn't crazy either.  A DEW —directed energy attack, is similar except the attacker doesn't care about about modifying GPS, their goal is to scramble or block electrons, leaving scopes unreliable.

So, is this a cyber attack? What's the thinking? We think it is, but not from the network. In this case, assuming a DEW was employed, it could easily overwhelm non-TEMPEST bridge instruments… I'm not much into speculation, but damn. 

Why do we care? 

First, we lost lives on two ships.  Second, About 20 years ago I gave a talk at a SANS conference where I retold a story that had appeared in a WSJ article. It goes like this… a nondescript van drives through the financial district in NYC, and as it passes, computers monitors flicker and die and electronics mysteriously fall off line. I told the story, coupled with (slightly fictionalized) accounts of incidents I'd worked, both as one of the first Internet Storm Center (then called the GIAC) watch standers, and from my work in the Navy.  I was given poor reviews, with one calling me out as a snake oil salesman. Until a few years ago, I gave that exact talk at the Navy War College for Admiral Hogg's Strategic Studies group. 

DEW and EMP are a threat to cyber, and the world knows how much we rely on it.

If your cyber threat intelligence shop isn't considering the likelihood and impact these external threats, and if you're not thinking about how you might deal with a catastrophic electronic event caused by more than just skids, hactivists, or APT, without thinking risk and resilience for a larger scale attack, you might be missing something in your enterprise risk management plan.

If you'd like to read our assessments, call me or join our Read Board community.

For now, I'm off. 

Have a great weekend.
Jeff


Tuesday, August 22, 2017

An analysis of China's Military Cyber Force: PLA Third Department and its Technical Reconnaissance Bureaus

We recently published a detailed, but unclassified paper entitled "China's Military Cyber Force: PLA Third Department and its Technical Reconnaissance Bureaus". The paper is being provided at no charge. 

EXECUTIVE SUMMARY

Several elements of China’s People’s Liberation Army (PLA) General Staff Third Department have been identified by Western analysts as involved in cyber intrusions into U.S. and other foreign networks.  These include the Second and Twelfth Bureaus of the Third Department, also known as the 61398 Unit and 61486 Unit, respectively, which have been profiled by Mandiant and CrowdStrike.  The Third Department’s Technical Reconnaissance Bureaus (TRB’s) are also suspected of involvement in cyber operations.  The Chengdu Second TRB (78020 Unit) was identified by ThreatConnect/DGI in 2015 as also conducting intrusions.

Based on this information, Wapack Labs conducted research on other Third Department elements to determine their possible involvement in these cyber operations mission for China.  Third Department units were profiled based on their published academic work, which revealed a subset of elements whose research was predominantly of cyber issues rather than SIGINT-related topics.  The elements identified were:

  • Third Department Computer Center (61539 Unit) in Beijing.  This center has a network security research mission and publishes extensively on computer security issues.
  • Chengdu Military Region Second TRB (78020 Unit) in Kunming.  Identified as a cyber actor, its academic work focused almost exclusively on computer security issues.
  • Lanzhou Military Region First TRB (68002 Unit) in Lanzhou.  There were 20 personnel at this unit identified as authors on cyber topics.
  • Lanzhou Military Region Second TRB (69010 Unit) in Urumqi.  Facilities for possible cyber operations have been built at a base separate from SIGINT operations.
  • Chengdu Military Region First TRB (78006 Unit) in Chengdu.  Addresses for authors of computer articles correspond to a Headquarters base separate from SIGINT operations.

     The paper may be downloaded here. "China's Military Cyber Force: PLA Third Department and its Technical Reconnaissance Bureaus"

    As a precaution, I've implemented a 24 hour delay between sign-up and paper delivery to allow verification of the request and user. 

Saturday, August 19, 2017

Ridiculously Simple - Wapack Labs CTAC fully integrated with ThreatQ

I haven't blogged as much as I normally do this summer. The kids are getting older and vacations and… well… at any rate, it doesn't mean work stops, nor does it mean that we stop pushing to make it ridiculously simple for users at any level access intelligence needed in their SOC, in their risk programs, or as we're starting to find, even the physical security guys are reading our stuff.

Last year we worked hard to get data into a foundational tool that could be used to serve our data up to any number of different applications. Unfortunately for a number of reasons, we didn't get it done, but late last year after a few organizational shifts we went live in a VERY alpha state in January, followed by an MVP launch in March, and now, I'm happy to say, we're seeing new products and applications come alive, bolting on themselves to us.

Our 2013's Threat Recon(R) was our first real push into serving up data (IOCs) through an API.  It remains a popular, Wapack Labs low cost API. Today in 2017,  I'm happy to say, our Cyber Threat Analysis Center (CTAC for short) is online and rolling nicely. Now, users can access more than just our Threat Recon(R) data. They can also search, manipulate and download nearly every collection acquired by the team. CTAC serves up not only Threat Recon(R) data, but also key logger outputs and sinkholes; 'bin' scrapes, early warning, and more.

As a result? Greater interest in accessing and integrating our data into their analytics and tools. One that we were really happy to see was ThreatQ.



Why do I say 'ridiculously simple'? ThreatQ has completely integrated our stuff to the point where an analyst only has to point at our reporting, ingest it into ThreatQ, and after a very simple process of letting the machine do its thing, the data is parsed, correlated against other ThreatQ sources, evaluated, prioritized, and even recommends action.

Mike Clark is an old friend. He and I were early guys in the Honeynet Project together years ago. Mike headed up development on the ThreatQ side. Mike, as always was a pleasure to work with. He worked closely with our team and within a couple of weeks we were integrated and running.

We've integrated with others. You can pull data from Threat Recon(R) from ThreatConnect, and limited data from Anomali, but ThreatQ really did it right. You get not only the indicators but the full range of collections, analysis, and human analyzed outputs in one pane of glass.

If you'd like to read more about the integration, or get more information on ThreatQ, one example of the integration is shown on Mike's ThreatQ blog.

If you'd like more information on Red Sky Alliance, our CTAC, shoot us a note. We're here to help.

Until next time,
Have a great week!
Jeff

Saturday, July 22, 2017

The Camera Adds 20 Pounds!

Yesterday, WMUR, Manchester, NH's local ABC affiliate, released a three minute news piece on Wapack Labs.  As many of you who've done one of these television pieces know, they come on site and tape for three and a half hours and cut that down into a three minute piece. There's a ton of material that ends up being left on the cutting room floor. 



We were interviewed on the heals of Wannacry, and the WMUR folks, recognizing that NH is made up primarily of small companies, wanted to do the piece. 

During the morning of Wannacry, I'd been at three small local companies —all who'd been directly effected by the ransomware. In one, a florist, I'd spent 45 minutes waiting for an arrangement to be made up for my mothers 'celebration of life'.  While I waited and watched the floral designer piece the arrangement together, I chatted with the owner, who when she found out what I did, immediately told me that she'd lost her entire accounting, inventory, and customer list because the one computer used to run the business had been hit.  She had an IT consultant who was managing the systems, but the backups used to attempt the restore didn't work and they were forced to either pay, or reconsitute the drive through piecemeal backups and manual reentry, or, pay the ransom. 

Here's the math… 

  • Pay $300 in ransom and get the key to simply unlock the system (and then go fire the IT consultant).
  • Or spend days (more?) rebuilding the companies administrative operations. 

The company probably does $2 million per year in revenue; I'm guessing —it's a nice place and they're always hopping. At $2 mil per year, they generate approximately $5495 per day, and my bet is they make about 20% profit on that day — $1100 — after they pay their inventory (flowers come in daily), labor, etc. 

As the business owner, what would you do? 

As a security pro, what would you recommend? 

I recommended paying the ransom, then firing the IT consultant (I recommended a good one —a partner we've used in the past —Ezentria in Nashua), instructing the new IT consultant to build the system new and up to date, and getting back to business. 

DHS recommended (publicly, and spread by every news outlet out there) to NOT pay the ransom. Why? Because they take their outside council from larger companies who had full, clean backups and disaster recovery plans. Guess what? They don't need to pay the ransom. They were prepared and had a plan. 

In 2012, according to U.S. Census Bureau data, there were 5.73 million employer firms in the US. 99.7% of them had fewer than 500 employees. 89.6% had less than 20 workers. Add in the number of nonemployer businesses (solo practitioners) – there were 23.0 million in 2013 – and the number of US businesses with less than 20 workers increases to 97.9 percent

97.9% of companies are small businesses with less than 20 employees!  How many of them were consulted when DHS recommended that they not pay the ransom? Out of those, how many were prepared for a business critical ransomware attack? Not the ones we talked to that day. This florist could resort back to catalogs and the internet —and she did, but what about others who were stopped dead in their tracks? 

Look, there're a million ways to skin this cat, but common sense tells me that the DHS guidance doesn't apply to every company, and when a florist tells me that the government recommends she not pay the ransom (and take the $1100 per day hit to her bottom line), my stomach hurts and my face contorts. I can't help it. It's my natural reaction to stupidity. 

My point is, government paints with a very wide brush  from taxes to gun control to health care to cyber guidance. And for those companies who had strong Information Security teams who had kept the systems up to date, and had a good disaster recovery process, well, they weren't affected. For this who didn't, they were. And if that company didn't have backups, or a way to reconstitute data, and the system were business critical, what would be the right answer? What happens in this case, where Wannacry stopped business?

That day, the morning of Wannacry, we put up a website where we allowed users to contact us for help for free. Some told us they were fine but wanted to know what to do for next time. Others had questions on their current state. We answered what we could and sent others a referral to Ezentria.

We thought WMUR did a terrific job on this. And thank you to Ezentria for handling any calls that we pushed their way. 

Until next time,
Have a great weekend!
Jeff