Suspected Palestinian malware? Why a Red Sky Associate Membership?

We sent folks to training in Vegas this week, one to Marine Corps drill weekend, another heading for a week off in Steamboat, and me holding down the fort. So, no published Fusion Reports this week. We did however have some interesting threads and analysis via the portal. We analyzed our first suspected Palestinian malware specimen which consisted of an open source RAT. While the malware was not unique, we did derive tailored mitigations to protect against future attacks from this tool. Additionally, an Associate member used their resources to help identify a substantial amount of related infrastructure which was reported out to the members.

… This is a great example of why Red Sky welcomes certain vendors to the table. We call them Associate Members, and we believe that they, if they can do what they say they can do, should be rewarded. When vendors bring great analytics to the table, like we mentioned above, and the membership sees the value in their offerings, they get rewarded -through peer reviews, networking in a great community, and exposure. We don’t allow active selling, nor do we tolerate ambulance chasing, but we do believe that vendors were probably operational security folks at one point too, but now they’re entrepreneurs in the infosec space. Just like turning management, we lose a little bit of our operational skill and situational awareness every day we’re not pounding a keyboard and scouring PCAP for the nuggets. Smart folks who chose the entrepreneurial path lose their edge as well. So in Red Sky, vendors get the benefit of being analytic members of the community. They pay a fee for membership, must pass the advisory board, and then play by the rules. In exchange they get to participate in a forum where some of the best minds in some of the best infosec teams are looking at some of the hardest problems. They participate like any other analyst, get peer reviewed like any other analyst, and are rewarded by showing off their wares. There is no better way to show what your products/services can do than to actually do it... and there’s no better way to buy, than to see what it can do first.

This week we observed our first occurrence of targeted activity which was independently reported from both Beadwindow and Red Sky members. This is to be expected and just goes to show that while we have two separate communities, the threat is sometimes the same. This activity will be detailed in an upcoming report to be released to both communities.

Those of you who know me know I’m a ‘keep it simple stupid’ kinda guy. All the data in the world, even when aggregated smartly, should never be implemented in your network without evaluating it first. So while aggregated security data may look great on paper, it still needs evaluation locally before implementing --locally meaning by your infosec team. How much time does it take to validate indicators in a security aggregation feed? My personal opinion is this... I’d rather ask someone smarter than me if the data was useful to them before I implement. I’d like to know what others found and of any lessons learned. There are two companies I’ve seen who I believe do aggregation well -they come at it from different perspectives. One is malware as the tripwire for aggregation and the other begins the process with browser-based data. Both offer real good perspectives on hard problems, but, there is a lot of malware out there, and there’s a lot of host based badness out there. Can you implement a steady stream potentially hundreds of thousands of indicators on your network and in your host based IPS in near real time? Could you evaluate all of the data coming from them? How much labor would that cost? Me? I’d rather ask someone else how they did it, and then do it my way using their lessons. That’s what Red Sky and now Beadwindow are all about.

Why do I mention this?

I had a call this week with a large enterprise company -pretty typical of the companies that we work with on a daily basis. This company had been an ‘anchor’ in another information sharing environment. The guy I talked to told me he’d dropped his membership in this other group, and asked what Red Sky does differently. It was interesting to me to hear about this one group. The claim (as they all seem to be) is aggregation of the meta-data associated with APT activities. I like to call this “Utopia” (I didn’t come up with this, a friend did), but here’s what I know. I’ve been tracking Utopia for many, many years. So far it doesn’t seem to exist. Me? I’m going to use my phone-a-friend. And yes, this company will continue to be attacked, and continue to receive aggregated open and premium sourced (ahem) security intelligence feeds, and yes, *I believe* we’ll be seeing that ‘anchor’ company joining Red Sky soon.

It’s not always about tech. Sometimes it’s about people.

Have a great weekend!
Jeff

Red Sky Weekly - Research Libraries... Rich targets?

Imagine this: You go to the research library after receiving an assignment to prepare a brief for 9:00 Tuesday morning. You’ve been tasked with preparing thoughts regarding the acquisition of a new company and its technology, and you’re waist deep in due diligence by 2:00 Saturday morning --with no end in sight until that Tuesday morning presentation. You'll be pulling all-nighters through the weekend. You’ve got financials spread out all over the table, legal documents describing issues associated with purchasing companies in this part of the world, reference material and patent searches to confirm value of the intellectual property and you’re exchanging email with researchers elsewhere, as you and your virtual team pull together the deck and details you’ll be presenting in just a few days.

Now imagine this... those library computers, electronic searches, public internet access, probably wireless access that you connect to with your personal laptop, store all of those communications and queries somewhere -if not only in simple memory or cache. Every time you enter a query, search for a reference, send an email, receive an email or prepare work product on that library network or one of their public computers, you give a would-be competitive adversary a clear view into your specific research, sources, intellectual property review, etc. If that library hasn’t done the necessary work to ensure the privacy of their visitors, and don’t have ways of maintaining security, you might be giving away more research than you're getting. I would argue that librarians are not security people, and probably don’t know the value of the electronic treasure trove that exists in these otherwise quiet, relatively uneventful places of business.

Why might I think this? Last week I told the story of a billion dollar defense company that maxed out their cyber insurance policy and now gets harvested monthly for updated technologies or those missed during earlier visits. That blog post, within one week, became my most read page since the blog's inception. Interestingly enough however, this isn’t the first time I’d heard this story. I heard exactly the same story three or four months ago in a conversation with a consultant that I’ve known for several years. The consultant lead a team of security people who did work in a large research library for about a year. He described the routine harvesting of electronic library queries, emails in/out of the library, etc., as “APT Day”. Apparently once every week, on the same day, the library is harvested for all of the previous weeks queries, emails to researchers, and work product residing on its own, and its public-use computers. Who would have thought!?  A LIBRARY!? Attackers, in one fell swoop, learn what is being researched, what forward thinking is happening here, and all of the sources used by the researchers!
We’re all at risk. If data, data about data, or communications about data exist, and someone wants it, there’s a pretty good chance they’re going to get it. Today, malware isn’t necessarily required. There are companies out there who sell VPN services using legitimate (but stolen) credentials. Bad guys are in your network using your remote access user name and password. The only way to know about them and defend your networks, computers and intellectual property is to talk with someone else who’s gone through the pain of defending against it already. You mustn't be shy. Attackers work in well orchestrated teams, choose their targets, operate with precision, and get what they want. They only have to find one way in. You have to defend every way in. This is Sun Tzu upside down, so forget that lesson of 'best to have a defensive position' and start asking questions of others -before it's too late.


BREAK BREAK

Red Sky had another terrific week. Here goes:

• Fusion Report 25 released: FR12-025 discusses the PlugX malware leveraged in the recent IE 0 day attacks. The report included an in-depth analysis on the malware's functionality and capabilities. We also identified likely targets for the 0 day activity and provided information on related infrastructure that has a high-likelihood of being leveraged in the near future. The queuing for the analysis came from a private company member who wishes to participate to both portals. As a result, the report was published to both the Red Sky private portal, and the Beadwindow private/public portal where our current state/local members can also access it.

• Beadwindow “Hoot ‘n Holler” call: We held our first Hoot ‘n Holler conference call with our Beadwindow members. The call included members from the Red Sky team, one state government and the CSO from a major metropolitan city. During the call, we assisted the government users with understanding the new TTPs from this week's Fusion Report, explained what they actually meant, and talked about how to protect from them.

• New Members: This week we signed one new member and a second was invoiced and is now in legal review. The first is a high tech/defense company, with about a billion dollars in annual revenue. The company has already started contributing to the portal and will be attending our Threat Day next week. The second is going through legal review as we speak, and when they come into the portal, they’ll bring the management lessons and visibility of their three million computer environment. The company is diversified with majority holdings in global retail, technology, real estate and energy. We’re very happy to have both companies join us in the Alliance!

So for the last several months I’ve been keeping you up to speed on the progress, growth, and significant happenings in Red Sky Alliance. The other day I was asked during lunch to quantify our membership, our business, and where we are in relation to others entering the information sharing space. I’ve done this informally before and here’s what I tell people:

We began bringing members into our empty portal in mid-February. Since then the participation has been terrific.  While the numbers are an estimate based on an informal survey of the members, we believe they’re pretty close, and very telling of the community we’re growing:

• As of today Red Sky Alliance hosts 15 large enterprise, and four associate (analytic) members. Our current membership includes major telecom, several global banks, several high tech internet companies, one global engineering/construction company, and a couple of large enterprise diversified companies engaged in everything from airplane manufacturing to electronics to energy production.
• We have five companies currently in various stages of the membership process. When these companies complete the process, we estimate that these 20 member companies will control close to 20 million devices in over 140 countries in the world in dozens of industry segments, including a global energy production, retail, real estate, and managed IT and security services. (Yes, we like MSPs. They help us scale protection while at the same time maintain opsec.)
• Financial members in Red Sky process the vast majority of credit card transactions in the world today, and manage the lion's share of money moved between stock exchanges and their clearing houses.

On the Beadwindow side, in less than a month, we’ve added a couple of new members, and now include:

• Three major US cities
• One state government
• One global bank
• One  ISAC
• One global Internet company

So, Red Sky is cooking with gas. The portal activity is picking up again post-summer, and solid activity is coming out of it. Fall is always busy until around Christmas. We’re geared up to handle it.

The Beadwindow portal is also doing well. New members mean new education. State and local governments (my first impression.. I’m learning too) seem to have very small information security budgets and little organization around managing across agencies. One CSO told us that his (one) IT Security guy was just moved out from under IT, and that neither the IT folks or the city government departments will let him look at data to perform his analysis. Whew. That must be exhausting, and a real morale dumper for the guy who’s going to be held responsible when something really does hit the fan (and it will!). There’s a major learning curve coming for these poor guys! We’re on it. We’ll do our best to help.

That’s it for now. Have a great weekend!
Jeff

EXCELLENT report by ENISA

The European Network and Information Security Agency released publicly today

Proactive detection of network security incidents, report

This report describes available external sources of information and internal monitoring tools which can be used by CERTs to improve their capabilities to detect network security incidents.

This is one of the best reports I've read in a while. Bravo Zulu (that's Navy for great job!) to the authors!

This report is co-authored by a number of folks that I recognized immediately.. many are FIRST (maybe all?) but one of the best things in the report is how CERTs share information, detailing the pros and cons. In the end however, the document calls out data sharing as the most effective way to proactively stop attacks before they're allowed to occur. Powerful stuff. Easier said than done however. 

Data formats must be lite and low in false positives;
Legal constraints are ALWAYS an issue;
Trust between participants is critical... tech feeds without knowing who's on the other end don't work;
The right information must be share in the right way... protected;
Information sharing organizations are less effective when the memberships don't know each other.


It's a long read, but a must read. 
Great job to the authors.


Jeff

On Information Sharing...

Going to tell you.. I'm a long time straight stick IT guy, gone Intel/Information Warfare then Information Security (for the last 15 years or so?), and I've not had so much fun, nor realized the value of Information Sharing until my last three years running an information security sharing organization wrapped around a CERT and Analysis shop. I'm not going to take a lot of time to tell you what that is. You can check out my bio and look at the web page; rather I'd like to take a moment and tell you about the value proposition I've come to realize over the course of my tenure.

Not a day goes by without a new story in the news depicting company losses from (ahem) Advanced Persistent Threats (APT) - a term coined by a guy named Greg Rattray several years ago during his active duty career. At the time, the term APT seemed pretty spot-on. Since however, those APT threats have become far more ubiquitous, and now I'm more convinced they should be called  Omnivorous Persistant Threats --OPT. Malware, computers beaconing, and bandwidth consumed is becoming more common than not, and most importantly, the vast majority of companies don't even know they've been successfully attacked!

I'm here to tell you, the most valuable information security lesson I've ever learned has been learned in the last five years --INFORMATION SECURITY PRACTITIONERS MUST STOP LISTENING TO VENDORS AND START TALKING TO EACH OTHER. Vendors want to sell you stuff. Your peers are working hard to stop the same attacks you are. More importantly, the threats change as your ability to protect yourself changes. Even the most sophisticated shops lack the 100% capability to foil every attack.

I'm preparing to speak at a conference for healthcare CIOs. I'm going to give them three words of wisdom:

1. Most companies attacked by APT don't know it until someone else tells them they've been owned.
2. Pick a standard infosec model, implement solid processes,  do it well, and don't shoot at protecting everything. Protect that information most important to your organization and build solid controls around the rest.
3. Talk to your peer companies. They're getting hit with the same things you are. Lone wolves starve in the cold. The packs survive.

More next time. I've got to update the block list in my UTM.

JS