Huge ransomware outbreak disrupts IT systems worldwide, WannaCryptor to blame By Michael Aguilar

By Michael Aguilar

That escalated quickly! For those of you who did not read any news on Friday (or had your heads in the sand), you need to know that a massive tidal wave of malware just struck Planet Earth, creating gigantic waves in the information security sphere and even bigger waves for the victims. The culprit? A piece of ransomware, called WannaCryptor by ESET but also going by Wanna Cry and Wcrypt, has been spreading rapidly and it is utilizing leaked NSA files, namely the eternalblue SMB exploit.

Unlike most encrypting-type malware, this one has wormlike capabilities, allowing it to spread by itself. As a result, it has spread very quickly indeed. This is what victims of the English language version see:

The story started in Spain’s telecom sector and quickly spread from that point, onward and outward. Reports of healthcare related organizations being affected in the UK began to appeared, plus various commercial websites, entire enterprise sites, and just about every type of network in between. People from around the world posted screenshots of the malware from computers in offices, hospitals, and schools. Here it is in Italian:

The worst issue that is being dealt with by victims is this: the files touched by the attack are encrypted and the attacker is the only source for the key to reverse that. This can have dire consequences, especially in the healthcare sector. Encrypted patient records, doctor’s files and other items may not be usable or accessible unless there is a good backup to restore from.

The ransom demanded for decryption of the files appears to be about $300, which is actually lower than other ransomware we have seen, but the true cost will be all the time, lost files, and other collateral damage caused by this malware.

There is also another theme emerging in the wake of this outbreak: Responsibility. The exploit that is being used, eternalblue, is openly available for download from a multitude of forums. I am all for research; however, providing a well-built exploit on a public forum that can affect hundreds of thousands of active machines seems a bit much, at least from where I am sitting currently. What happened to RESPONSIBLE disclosure???

The Responsible Response

Fortunately, to protect yourself against this latest threat, there is much that you can do, and you should probably get started sooner rather than later:

·         Install Anti-malware Software – You may have heard this over and over, and it seems very repetitive mentioning it now. However, if I had not encountered multiple instances where I was told, “It is a server, and we have firewalls, so I will leave anti-malware off of this machine” or “I have too many problems to install antivirus on this server”, I would not mention it. But, that has happened. So, I am stating it. Please install reputable anti-malware and give yourself a fighting chance at stopping this before you are affected.

·         As an example, ESET’s network protection module was already blocking attempts to exploit the leaked vulnerability at the network level before this particular malware was even created. ESET increased the protection level for this specific threat as Win32/Filecoder.WannaCryptor.D in the detection engine update 15404 (May-12-2017, 13:20 UTC/GMT +02:00). Prior to that, ESET LiveGrid protected against this particular attack starting around 11:26AM (UTC/GMT +02:00).

·         Update Your Windows Machines – Please! I know that patches can be very, very difficult to get deployed across the entire network. This one, you will want to install. It has been available since mid-April and actually stops the exploit from gaining a foothold in your environment. The patch listing for the entire listing of Equation Group files can be located here.

·         Be Intelligent! – As a person who researches infections, exploits and various other information security related items, knowing is half the battle. Especially when items are being leaked and created in this kind of rapid-fire fashion.  Using Threat Intelligence , I was able to create the appropriate YARA rules that identified the droppers, files and characteristics pertaining to the Equation Groups leaked exploitation files.  There has been a LOT of detections of these objects. My dashboard lit up like a Christmas tree within the last few weeks, and I do not expect it to stop anytime soon.  This kind of intel, and more importantly, the feeds that are provided, could help you to make better decisions on what to protect and how to protect it (as in apply MS patches, are they targeting MY business, etc.)

There is more on the WannaCryptor threat, and ESET-specific protection strategies, in this ESET Knowledge Base article. To check on the amounts that the malicious actors have received in bitcoin funds from this outrage, you can check this link.

Update: In a reflection of the severity of this threat, Microsoft released a security update overnight to patch versions of Windows than are no longer officially supported. This includes Windows XP, Vista, Windows 8, Server 2003 and 2008 Editions.

https://www.welivesecurity.com/2017/05/13/wanna-cryptor-ransomware-outbreak/

Anti-trust, EU complaints and the anti-malware industry

By Tony Anscombe

Last week Eugene Kaspersky posted a blog about his company’s – and more importantly the entire industry’s – struggle to ensure consumers have a simple and unhindered method to choose a security product.

As someone who’s been very close to the issues highlighted in Eugene’s blog I agree in principle with the majority of the points mentioned. In fact I could probably add my own list of examples, changes and concerns.

It is not surprising that Microsoft promotes Windows Defender and leverages its position as the operating system provider. Microsoft wants the operating system to be secure and the users’ experience to be free from malicious attacks. Windows 10 comes with Windows Defender switched on, and without any prompting very few people will consider installing an alternative..

An area we should also consider is that if you have a dominant vendor in any particular geography, does it increase or decrease the likelihood of being infected? A group of researchers analyzed data from over a billion machines running Microsoft’s Malicious Software Removal Tool; this runs on nearly every Windows machine to assist in removing specific, prevalent malicious software from computers.

The report was summarized by Neil Rubenking at PCMag. His article states: “Some countries exhibited a dismal diversity rating, with one product protecting the majority of all systems. These countries routinely displayed a higher-than-average infection rate, while those with more diversity had a lower rate.”

Simply put, this means if there is a dominant product in any region, there are more infections.

This is not surprising. Imagine a city where 50% of properties have the same alarm system: the thieves would only need to focus on how to breach one system and then have access to 50% of the properties. Cybercrime is a business and the bad guys know how to focus to make money; I am sure they would welcome a dominant anti-malware product.

Another concerning conclusion in the report is that people continually switch anti-malware vendors, with approximately one third doing so every four months or less. Rubenking states: “Countries with a high rate of infection also showed a high rate of ‘churn’, with many users switching antivirus products.”

The report hypothesizes that the churn is due to dissatisfaction with the anti-malware product. There are no proof points for this but it sounds plausible. Many anti-malware products expire yearly and then many people choose to run free products meaning that some switching is reasonable. I would have expected the rate of churn to be closer to 20% as opposed to the third stated in the data.

Microsoft wants Windows 10 to be a great experience for the user and the drive to make it the most secure Windows version yet is clearly top of the agenda. Taking the data points above that a single anti-malware product’s dominance increases infection and that churn is probably caused by dissatisfaction, then it’s clear that Microsoft needs the independent anti-malware vendors as much as the vendors need Microsoft.

While the industry considers its options, such as Eugene Kaspersky’s implication that his company will make a complaint to the European Commission, it would seem sensible for the industry to engage with Microsoft to explore potential dissatisfaction and assist in delivering the best Windows experience.

However, understanding the pressure that many of the companies have to monetize and return large dividends to their investors, I feel that there could be some resistance to changing the way anti-malware products communicate and behave.

https://www.welivesecurity.com/2017/05/11/93681/?utm_source=feedburner&utm_medium=email&utm_campaign=Feed%3A+eset%2Fblog+%28ESET+Blog%3A+We+Live+Security%29

Coders Co. wint Gfk Insights Challenge met RAX tijdens Wakoopa Datathon

Met RAX binnen 16 uur duizenden clickstreams van online shoppers omgezet in heldere visualisaties van typen customer journeys.

 Coders Co., het Amsterdamse vooraanstaande data scientists team, heeft op 23 april 2017 de Gfk Insights track gewonnen van de Wakoopa WHAT datathon. Dankzij zijn RAX-technologie visualiseerde het team binnen 16 uur het winkelgedrag (customer journeys) over verschillende online shops uit duizenden clickstreams (big data) in een interactief dashboard.

De wedstrijd

Hoe haal je zinvolle gedragsdata uit duizenden clickstreams van online modeshoppers? De deelnemers aan de Datathon ontvingen gebruiksgegevens van 1 maand uit de pc’s, tablets en smartphone van een Nederlands panel. Welke websites en apps zij gebruikten, wanneer en hoelang. Met duizenden webclicks en zoektermen, aangeleverd door organisator Wakoopa, die deze gegevens met haar ‘passive metering technology’ met toestemming anoniem registreert bij diverse panels.

Customer journeys over verschillende shops in kaart

“De meeste online winkeliers kunnen inmiddels het klantgedrag in hun eigen shop achterhalen, maar wat ze niet weten is:

·         Hoe verhoudt dit klantgedrag zich tot dat bij andere shops?

·         Hoe navigeren mensen door verschillende shops op hun pad naar aankoop?

“Ons doel was het klantgedrag over de verschillende online modeshops te visualiseren om interessante patronen en klantsegmenten te ontdekken”, vertelt Gosia Wrzesinska PhD, CEO van Coders Co.

De uitdaging
Elk pad dat een klant doorloopt, is echter uniek. Hoe maak je daar zinvolle visualisaties van? De nacht was lang en vol uitdagingen. Met hiërarchische clustering algoritmen en de eigen RAX-programmeertaal, leverde Coders Co. een interactief dashboard op. Dat toont in één oogopslag de 9 relevant te onderscheiden customer journeys. “Dankzij RAX, dat superefficiënt overweg kan met (big) gedragsdata, behaalden we dit resultaat in 16 uur. Kun ja nagaan wat mogelijk is als we 3 dagen hebben”, aldus Gosia.

Grote modeshops hebben veel ‘kijkers, niet kopers’
Het interactieve dashboard maakt interessante conclusies mogelijk. “Zoals te verwachten, zijn langere surfsessies een duidelijke indicator voor koopintentie. Verrassender is dat, in ieder geval Nederlandse modeshoppers, vooral aan het begin van hun customer journey veel verschillende webshops bezoeken. Nog opvallender is dat vooral de grote webshops veel customer journeys hebben van het type ‘wel kijken, niet kopen’ met lage conversie, terwijl de kleinere shops vaak een meer betrokken koperspubliek hebben”, vertelt Gosia.

Respondenten zeggen niet wat ze doen

“Marktonderzoekers doen interviewonderzoek. Maar mensen zeggen of weten vaak niet helemaal wat ze doen. Gedragsdata via registratie, de passive metering technology, zoals die van Wakoopa, wordt daarom steeds belangrijker. Deze data zijn vooral ongestructureerd en daardoor moeilijk te analyseren. De tijdsdimensie maakt de analyse nog ingewikkelder. Als marktonderzoekers deze data al verzamelen, weten ze vaak niet wat ze ermee moeten. Of het verwerken is te duur. Tijdens de Datathon hebben wij aangetoond dat je er met RAX in zeer korte tijd waardevolle inzichten uithaalt. RAX opent voor marktonderzoekers de deur naar een nieuw type op gedrag gebaseerde inzichten tegen een betaalbare prijs”, aldus Gosia Wrzesinska.

Over Coders Co. en Journeylytics

Coders Co. is een vooraanstaand team van data scientists dat in 2013 is gestart uit passie voor programmeren. Het hele team heeft een PhD in Computer Science en beschikt over jarenlange ervaring in de software-industrie. Zoals het programmeren van embedded systemen, hacken van besturingssystemen en uiteenlopende intelligente web-en mobiele toepassingen. Klanten zijn

onder meer: PGGM (Nederlands Pensioenfonds) en INTAGE (een groot market research bedrijf in Japan). Onder de naam Journeylytics heeft het team zich gespecialiseerd in big data analyse voor customer journeys. Zie www.journeylytics.com en www.codersco.com

Jackware hits the big screen in #Fast8: Fate of the Furious

By Stephen Cobb

Car hacking takes center stage in the recently released eighth episode of the enormously popular Fast and Furious film franchise: Fate of the Furious (or #Fast8 if you’re into the whole brevity thing). Having coined the term “jackware” for malicious code used to hijack vehicles, I was excited when a Twitter friend tipped me to the film’s depiction of vehicular hacking mayhem and went to the cinema to see for myself. Fortunately, for those who don’t like watching movies in cinemas, you can watch scenes of “jackware at scale” on YouTube in the Fast and Furious 8 Official Trailer #2:

From Jeep to Jeepers!

If you’ve been following the evolution of car hacking, then you will know that the WIRED Jeep hack in 2015 was a landmark event (reported and discussed here on WeLiveSecurity). And if you watch the #Fast8 trailer closely you will notice, at around the 45-second mark, that the first vehicle to go bursting through a window is a Jeep (and it looks to be the same model hacked in WIRED).

“Think ransomware for cars and malware-enabled ransoming of vehicle occupants.”

Some while after the Jeep hack, I came up with the term “jackware” to describe the use of malware to take over a vehicle, whether to extort a ransom from the owner, or to take the car somewhere other than the destination intended by the legitimate owner or operator. Think ransomware for cars and malware-enabled ransoming of vehicle occupants.

Clearly, the folks who were making Fate of the Furious had already begun imagining what a mass deployment of jackware could look like, and their version is now entering popular culture via “the biggest opening weekend in cinema history” (Forbes). In #Fast8 you see vehicular mayhem unfold as the autonomous driving features in many of today’s cars and trucks are abused by cybercriminals to create a lethal army of four-wheeled drones.

But could that really happen?

This strikes me as a reasonable question to ask, especially when you see the scene where someone in a high rise office parking garage is about to get into their car – a car that might look a lot like yours – and suddenly it speeds away. Not only does it speed away, it blasts through the garage wall to land on the street several floors below. And then there’s the scene when someone who is just out driving in New York finds their car is taken over remotely, forcing them to participate in a coordinated vehicular assault on an armored limousine.

Fortunately, while elements of the car hacking you see in this movie are real, the scenarios depicted are, I would argue, well beyond current technology and logistics. Let’s start with the fact that very few vehicles in use today have sufficient autonomous driving capabilities to participate in the kind of high-speed motor mob that is so effortlessly organized by the geeky minions of Cipher, the arch villain in #Fast8, played by Charlize Theron (“the very definition of high-tech terrorism”).

”If the automotive industry doesn’t get its collective act together in the cybersecurity department we could find ourselves having to deal with jackware in the real world.”

I certainly haven’t heard of any cases in which cybercriminals remotely seized control of a road vehicle’s steering function for malicious purposes. Indeed, my coining of the term jackware was intended to be precautionary, a warning shot to alert the public to what could be coming down the pike, so to speak. In other words: IF the automotive industry doesn’t get its collective act together in the cybersecurity department we could find ourselves having to deal with jackware in the real world.

Of course, as the Wired article in July of 2015 demonstrated, hacking of cars that have a rich set of digital features is definitely a thing, and several ESET researchers have written about it here on WeLiveSecurity, for example:

·         Jackware: When connected cars meet ransomware

·         Connected car hacking: Who’s to blame?

·         Car hacking: Defcon style

·         Cybersecurity and manufacturers: what the costly Chrysler Jeep hack reveals

·         The great car hacking debate

·         Car hacking at speed – where vulnerabilities turn from critical to fatal

·         7 things you need to know about car hacking

The two researchers behind the Jeep hack in the 2015 Wired story were Charlie Miller and Chris Valasekon, both of whom went on to work on autonomous transportation security for Uber, but not before publishing two very useful documents on vehicular hacking:

·         Remote Exploitation of an Unaltered Passenger Vehicle

·         A Survey of Remote Automotive Attack Surfaces

I consider these to be required reading for anyone seriously interested in this set of problems. For example, you can see that there are multiple barriers to the kind of hacking shown in #Fast8. When a feature like self-parking allows steering to be controlled remotely or autonomously, there will be a compensating control to restrict the speed at which this can happen. So, to do serious damage, you not only have to take over the code for the steering function, you also have to disable the code that limits the speed of the vehicle under various autonomous conditions.

Reading those reports also equips you to parse new developments in the field, like the growing list of potentially hackable features being proposed or even deployed. The news of the Jeep hack actually obscured one development, the announcement by UK-based Jaguar Land Rover that it had created a mobile app that lets drivers control their SUVs in sticky situations, from outside of their vehicles. My first reaction to this, as someone who has had to do some off-road driving in “sticky” conditions, was: “Cool!” But that was quickly followed by the question that haunts security experts, especially those that deal with malware infected mobile apps: “What could possibly go wrong?”

”One could hypothesize future abuse of V2V technology to organize the kind of motor mob that Cipher unleashes.”

In a slightly different technology development this March, Cadillac became the first carmaker to field vehicle-to-vehicle (V2V) communications in a production vehicle, which brings me back to #Fast 8. One could hypothesize future abuse of V2V technology to organize the kind of motor mob that Cipher unleashes.

You can learn more about V2V at the US Department of Transportation, which is promoting this technology. To explore how things might go wrong with V2V, check out this fascinating academic paper: Worm Epidemics in Vehicular Networks.

Zero days and movie magic

When Charlize Theron’s Cipher asks one of her hacking crew to “find all the zero days” as a prelude to remotely controlling hundreds of vehicles you know you’re in for some serious, if not entirely plausible, hacking. I would be dishonest if I said I didn’t enjoy watching #Fast8, despite its steady diet of implausibility (sorry, but zero days don’t work like that, EMP weapons don’t work like that, torpedoes don’t work like that, cars can’t be hacked like that, and no, cars can’t go as fast in reverse as they routinely do in these movies). But when did a lack of realism ever stop a movie? It’s certainly not slowing down #Fast8, which only took three weeks to hit the $1 billion mark in global box office earnings.

To be clear, I’m not endorsing either violence as a problem-solving strategy or the use of criminal means to achieve socially beneficial outcomes. I’m certainly not endorsing unsanctioned road racing or driving without a seatbelt. What I do endorse are diversity and mutual respect as keys to problem-solving, which is something these movies warmly embrace.

As for hacking cars, I encourage anyone who is inclined to do this to play to the rules, and there are rules, like these Vulnerability Disclosure Guidelines at HackerOne, which operates a bug bounty program for GM. You will find comparable Tesla and Fiat Chrysler programs at Bugcrowd.

https://www.welivesecurity.com/2017/05/09/jackware-hits-the-big-screen-in-fast8-fate-of-the-furious/?utm_source=feedburner&utm_medium=email&utm_campaign=Feed%3A+eset%2Fblog+%28ESET+Blog%3A+We+Live+Security%29

Big changes in the infosec landscape: Time to take note and take action

By Michael Aguilar

Recent events are changing the topography of the threat model and attack methodologies across the board and at record speeds – to say that the impact of the past few weeks in information security news has been small would be a complete understatement.

The Shadow Brokers releasing full-blown government hack frameworks, VAULT 7 releases, and other nefarious deeds, have elevated even the lowliest of script kiddies into valid threats to enterprise-level businesses.

If you do not believe this, please place your head back in the sand. Record numbers of breaches of entire networks and payment systems are becoming more the de-facto computer event to investigate instead of small-scale user-based infections that used to plague businesses.

It is time to up your game plan to the real world: an ongoing battle against malicious actors targeting you, your business, your home, your electronics and potentially every communication device that you own that is capable of networking.

When Windows 2008 R2 systems can be fully compromised in less than 120 seconds, it is time to get serious, fast. Here are a few things you can do to get back in the game and get your network security up to 21^st century standards.

RDP: Remote death protocol

 Do you like RDP? Good. So do attackers. Wait? What?! Yes, attackers love your weakly-defended RDP port as the payoff can be huge. Instead of having to use a pesky sometimes non-persistent terminal shell, they can just log right in with a Windows interface or use other tools to execute applications on your server remotely. The lowest hanging fruit is the abandoned credentials that have way too much access that you forgot to delete years ago, akin to helpdesk:helpdesk or other credentials that should never have existed, ever.

It is possible to compromise other, seemingly more password-protected accounts, especially if the password is derived from an aspect of your business. In this manner, an attacker could easily generate a mutation wordlist consisting of a few hundred thousand varied words located on your informative website to run as administrator against the potentially open RDP port. As an administrator, you should think about changing the port (not to 3390 but something else) or use RDP over a VPN connection, closing off outside access to unwanted parties.

Another, and even better idea is to also have a secondary control mechanism, like 2FA (two-factor authentication) to allow you to have something that a potential attacker does not: a token or OTP (one time password).

Microsoft even has the ability to lock out accounts that try to authenticate more than a certain number of times (instructions can be located here). Check out this link for more info on RDP attacks.

Windows updates, firmware updates, everything updates

With the release of various exploits from different avenues that affect Windows 8, Windows Server 2012 and SMBv3, updating Windows has become more important than ever. There are more dangerous exploits out in the wild than members in some IT departments: these are precompiled, awaiting public consumption.

As mentioned previously, the releasing of the Shadow Brokers’ decryption key for their cache of allegedly stolen “government” exploit kits is a very real cause for concern since these tools are now actually being used in real time against targets. The good news is that Microsoft has already patched the zero-day vulnerability and other security issues that created the vulnerabilities.

The question is, how up-to-date are the patches in your network? Updating is a continuous effort, as new threats arise and must be addressed and newer security holes are discovered and must be closed. Sometimes, that includes upgrading your antivirus.

Take CVE-2017-0199, a vulnerability that was recently turned into a Metasploit module for ease of use. This zero-day exploit has been discovered dropping Dridex and other malware and can be modified for multiple payloads.

This exploit started getting attention on April 11, 2017. At the time of writing, ESET was one of only nine vendors detecting attachments with this exploit payload. Sometimes, in updating your defense mechanisms, you find that you need to update your antivirus strategy as well.

Sleep better at night, play it safe

The fewer footprints you leave on the open internet, the better. Close those ports that do not need to be opened for everyone to query. If your business runs a web application that you can get to from the open internet, ensure that it is tuned, hardened, and not running vulnerable code.

The last thing you would want is your entire CRM (customer relationship management software) or other business communications platforms compromised, with client or personnel data presented to an attacker who resides halfway around the world.

Explaining this is a difficult letter to write to your client base; however, it would not be the first time this has ever happened and it definitely won’t be the last one as this latest issue regarding HipChat has proven.

The information security world spins pretty fast. If you don’t stop and look around once in a while, you could miss it. It worked for Ferris; make it work for you.

https://www.welivesecurity.com/2017/05/08/big-changes-infosec-landscape/?utm_source=feedburner&utm_medium=email&utm_campaign=Feed%3A+eset%2Fblog+%28ESET+Blog%3A+We+Live+Security%29