Linux/Moose: Still Breathing

What is a Moose – Introduction

Linux/Moose is a malware family that primarily targets Linux-based consumer routers but that can also infect other Linux-based embedded systems in its path. The compromised devices are used to steal unencrypted network traffic and offer proxying services to the botnet operator. In practice, these capabilities are used to steal HTTP Cookies on popular social network sites and perform fraudulent actions such as non-legitimate “follows”, “views” and “likes”.

In May 2015 ESET released a whitepaper on the malware family we named Linux/Moose. After publication, Linux/Moose’s command and control servers went down and we lost track of the animal. A few months later, in September 2015, we got a new sample of Linux/Moose —with, as expected, some evolution after our publication.

For the past year, ESET and the security firm GoSecure combined their skills in order to research Linux/Moose further. GoSecure investigated the social media fraud aspect and shed some light on an unknown market they called “The Ego Market”. This market is highlighted in a new whitepaper published by GoSecure. This blog will cover the technical changes between the Moose variants we described in our whitepaper and the new variants that appeared in September 2015.

Moose in the bushes – Hiding the address of C&C

The first thing we noticed when we got the new sample was that there was no more command and control (C&C) IP address inside the binary. It seems that the operators read our report carefully and decided to make things a little bit harder for us. In this new version the C&C IP address is given as an encrypted command line argument, as shown in the following output:

Read the full story on

http://www.welivesecurity.com/2016/11/02/linuxmoose-still-breathing/?utm_source=newsletter&utm_medium=email&utm_campaign=wls-newsletter-041116

Estonia: Digital powerhouse offering e-residency to non-nationals

 Ask anyone what the most digitally advanced country in the world is and it’s a safe bet that they’ll say either the US or China, followed by Japan or even the UK. Not many would think of a tiny northern European country in the former Soviet Block, but Estonia is a decade ahead of other developed countries in terms of technological advancement.

Because of this, Estonian residents enjoy a range of benefits. All residents are issued an ID card that offers access to around 4,000 services – allowing them to manage their finances, register businesses, pay parking tickets, order prescriptions and even vote – entirely online.

With a population of only 1.3 million, Estonia’s forward-looking approach to digital technology is partly due to its small size. As Siim Sikkut, digital policy adviser for Estonia, told the Guardian in 2014: “Estonian government and society have always understood that as small economy, we have to be open to the world – especially in trade and investment.”

It’s in this context that Estonia has become the first ever country to offer e-residency permits to any world citizen.

Benefits of an e-identity

As a government-issued digital identity, the program allows non-Estonians access to Estonian services such as company registration, banking, payment processing and taxation.

The benefits of this are that any entrepreneur or freelancer running a “location-independent international business” can enjoy low startup and maintenance costs; 0% income tax until distributions are made; minimal bureaucracy; and inclusion in the EU’s legal framework – all whilst remotely administrating their businesses from anywhere in the world.

However, as advantageous as this is – as well as groundbreaking – the concept of a government-issued digital identity has come under much scrutiny in the past, with many expressing concerns over its security and others seeing it as a threat to personal privacy.

Ensuring data-security

The Estonian government ensures security of its citizen and e-resident database by using a government-run technology infrastructure called the X-Road. Launched in the 1990s, the X-Road is not a centralized database; rather, it links public and private databases to the country’s digital services. As such, it has no central gateway or hub. The network therefore remains safer because information is kept on separate servers.

So far the system hasn’t experienced any major data breach. However, in 2009, Estonian web servers were subject to sustained attacks for weeks when huge amounts of traffic, instigated by infected machines, overwhelmed the country’s systems. Although this wasn’t due to a security gap or glitch in the system, attacks of this sort can be a major inconvenience … or worse.

During a speech in October 2014, Andrus Ansip, Estonia’s former prime minister and current vice president for the digital single market at the European Commission, said: “We have to protect everyone’s privacy, trust is a basic principle. If people can’t trust e-services, they will never use them.”

Estonian residents are given peace of mind in the form of 2048-bit public key encryption on all ID cards. In addition to this, Estonians have complete control over their personal data, with full transparency over who has accessed their information available in their online portal. If individuals see activities that they do not like or did not authorize, they can report these activities to the data ombudsman, who is then required to justify the intrusion. 

The economic benefits of an e-society

One reason why Estonia is one of the most successful e-societies is historical. After the collapse of the Soviet Union in the 1990s, the newly independent nation found itself in the position where it desperately needed to modernize.

Lack of physical infrastructure and a small population meant that the Estonian government turned to the internet, embedding digital solutions into the foundations of the country’s infrastructure. Estonia’s growth as an independent state is therefore entwined with the digital revolution; its citizens are very open to digital technology; and the Estonian government is not tasked with convincing a population of sceptics on the benefits of an e-identity.

When looking at Estonia’s track record, it would be hard to argue that this open attitude to technological progress doesn’t have significant economic and social benefits — Estonia is notably the least corrupt and most prosperous of all the post-Soviet countries.

Taking Estonian services international by becoming the first country to extend e-identities to non-nationals is only the next step in ensuring a prosperous future. By creating an electronic diaspora that now has a stake in the country’s progress, Estonia is cleverly shoring up its future in the complicated digital and economic landscape.

http://www.welivesecurity.com/2016/11/03/estonia-digital-powerhouse-offering-e-residency-non-nationals/?utm_source=feedburner&utm_medium=email&utm_campaign=Feed%3A+eset%2Fblog+%28ESET+Blog%3A+We+Live+Security%29

Software AG et Bosch Partenaires en technologie, ils développent ensemble de nouvelles fonctionnalités pour le cloud IoT

Software AG (Frankfort TecDAX: SOW) et Bosch collaborent au développement de nouveaux services et solutions dans les domaines de l’IoT et d’Industry 4.0 . Les fonctionnalités de Bosch IoT Cloud  sont complétées et les deux entreprises travaillent à la création de de nouvelles solutions IoT. Les partenaires et clients dans les domaines de la production, la logistique te la distribution  profiteront de cette collaboration.

La Digital Business Platform de Software AG devient une composante disponible dans le cloud IoT de Bosch avec des modules pour l’analyse de données en temps réel et la prise de décisions. Le but principal de  cette collaboration est le développement d’outils d’analyse prédicative sur la Digital Business Platform. Cette collaboration réunit le meilleur de deux mondes : l’évolutivité du cloud IoT de Bosch rend cette application particulièrement intéressante pour de nombreux partenaires et utilisateurs. Universal Messaging de Software AG  qui fait fonction de couche de transport et de file d’attente, permet que le logiciel les appareils et les capteurs puissent communiquer et s’intégrer de manière souple.

Pour les clients et partenaires des deux entreprises, ce partenariat stratégique signifie qu’ils pourront utiliser directement les nouvelles solutions IoT intelligentes que Bosch et Software AG développent conjointement. L’analyse en temps réel des données utilise des capteurs  et de systèmes d’évaluation de risques et connecte ces données aux outils d’analyse prédicative ce qui accélère, sécurise et rend plus efficace les processus d’approvisionnement, de production et de logistique.

Bosch est la seule entreprise au monde à être active sur les trois niveaux de l’IoT. Elle développe des technologies – capteurs et logiciels – et offre aussi des services qui utilisent ces technologies. De Plus, avec le cloud Bosch IoT, l’entreprise dispose d’une plate-forme qui permet d’interconnecter les  services IoT.

Volkmar Denner, président du conseil d’administration de Bosch, explique la collaboration avec Software AG: « En tant que partenaires technologiques, nous pouvons fournir plus rapidement  et plus efficacement des solutions innovantes dans le cloud Bosch IoT à nos clients. »

"Des bonbons ou une menace !" Comment les objets connectés devenus zombies ont surpris Internet

 « Des bonbons ou un sort ! » crient les enfants aux portes de leurs voisins : « Si vous ne me donnez pas de bonbons, vous serez la  cible de farces ! »

Dans le même genre, des millions de routeurs, de caméras de sécurité et autres objets connectés (IoT) ont frappé à la porte du serveur DNS Dyn une semaine avant Halloween sans offrir d’autres choix que de recevoir un sort. Ils ont formé une armée géante de zombies ayant pour but l’interruption d’Internet et de certains de ses services les plus  populaires.

Il y a peu, ESET avait prédit avec précision que l’Internet des objets deviendrait un sujet très important. La préoccupation principale étant la fuite de données via ces appareils et que ces derniers deviennent une cible à cause de leur niveau, assez faible, de sécurité.

La semaine dernière les attaques massives par DDoS ont démontré qu’actuellement les informations privées n’étaient pas la principale cible des criminels. Leur objectif était de contrôler des millions d’appareils connectés et de diriger cette puissance vers la cible de leur choix.

Cette attaque illustre que des dizaines de millions d’appareils peuvent être exploités à cause de leurs vulnérabilités de sécurité. Celles-ci  sont généralement liées à l’utilisation des identifiants et mots de passe mis par défaut. Et même si Dyn a pu atténuer la portée des attaques en quelques heures, on retrouve ici les prémices d’une « guerre DDoS » qui s’étalera sur les prochains mois.

Pour avoir une idée de l’ampleur que peut prendre une telle attaque, il suffit de regarder les chiffres : selon les estimations de Gartner, il y aurait près de 5 milliards d’appareils IoT sur le marché (y compris l’industrie automobile) à la fin de l’année 2015. Si ces estimations sont correctes, en 2020, ce chiffre passera à plus de 25 milliards.

Sans un accroissement de la sécurité dans le domaine de l’IoT à tous les niveaux (constructeurs qui doivent penser aux logiciels et matériels de sécurité à inclure dans leurs modèles, organismes de règlementation qui doivent imposer des mesures pour à améliorer les normes déjà en place) ce problème pourrait avoir de graves conséquences.

De plus les utilisateurs finaux peuvent contribuer à améliorer la sécurité de ces objets connectés. La première étape serait d’acheter des objets connectés de qualité conformes aux normes de sécurité actuelles.  On peut tester ses appareils afin de détecter d’éventuelles vulnérabilités (mots de passe mis par défaut) et y remédier.

10 gadgets every white hat hacker needs in their toolkit

By Lucas Paus

Sometimes, during security audits, we may encounter a situation where everything is being managed correctly. In other words security patches, policies, network segmentation, antivirus, and user awareness, to name just a few measures, are being applied properly. That’s when, in order to continue the analysis from the perspective of a security researcher or consultant, social engineering and a number of other tools, some of which we will look at in this post, start to play more importance, being perhaps the only ones that can allow an attacker to penetrate the target system.

The tools in question are mainly pieces of hardware designed for security research or projects. So here’s a list of the 10 tools every white hat hacker needs.

#1 Raspberry Pi 3

We are now on the third generation of these low-budget computers, which can be used in multiple ways. A classic example in security audits is to use a Raspberry Pi with its appropriate battery pack, a distribution platform like Kali Linux, and applications like FruityWifi, which together act like the Swiss army knife of pen testing.

#2 WiFi Pineapple*

This set of tools for wireless penetration tests is very useful for various types of attacks, such as man-in-the-middle attack. Through an intuitive web interface, it enables you to connect using any device, such as a smartphone or a tablet. It stands out for its ease of use, workflow management, the detailed information it provides, and the possibility it offers to emulate different kinds of advanced attacks, which are always just a couple of clicks away.

As a platform, WiFi Pineapple allows the use of a great many modules, which are continually being developed by the user community, thus adding new features that widen its scope of functionality. The icing on the cake is that these modules can be installed free of charge directly via the web interface in a matter of seconds.

#3 Alfa Network Board*

A classic Wi-Fi board for injecting packets. The Alfa stands out for the quality of its materials, and for its use of chipsets which can be set to monitoring mode – a requirement for wireless audits.

#4 Rubber Ducky*

This “special” pen drive is a device that works as a programmed keyboard in the shape of a USB drive. When you plug it into a computer, it starts writing automatically to launch programs and tools which may either be available on the victim computer or loaded onto the drive’s onboard Micro SD, in order to extract information.

If you watch the hit TV series Mr. Robot, you’ll likely remember that in the second season Rubber Ducky is a crucial ally for Angela, helping her gain access to an E Corp executive’s passwords.

#5 LAN Turtle*

This type of systems admin and pen-test tool provides stealthy remote access, as it stays connected to a USB port covertly. Besides this, it allows users to harvest information from the network and has the capacity to execute a man-in-the-middle attack.

#6 HackRF One

This tool installs a powerful SDR (Software-Defined Radio) system. In other words it is essentially a radio communication device which installs software to be used in place of typically installed hardware. This way, it is capable of processing all kinds of radio signals ranging from 10 MHz to 6 GHz from a single peripheral, which can be connected to the computer via a USB port.

#7 Ubertooth One

This device is an open-source 2.4 GHz code development platform for experimenting with Bluetooth, enabling users to appreciate the different aspects of new wireless technologies.

#8 Proxmark3 Kit

The Proxmark3 is a device developed by Jonathan Westhues that can read almost any RFID (radio frequency identification) label, as well as clone and sniff them. It can also be operated in standalone mode (i.e. without a PC) through the use of batteries.

#9 Lockpicks

These tools are the main equipment used in lockpicking – in other words the art of opening a lock or a physical security device by analyzing or manipulating its components logically, without the original key. There are a great many sizes and formats or kits, which in many cases can threaten physical security.

#10 Keylogger

An old classic for logging keystrokes. This device can be connected via USB or PS/2 and creates a stealthy connection between the keyboard and PC, logging every keystroke. Of course, it tends to go undetected by most security systems.

We’re still some way from Christmas, but perhaps you might be tempted to gift some of these devices to yourself – you are sure to get many hours of testing out of them. And you never know, in your next pen test they may just act as a point of entry to a target that seemed to be impenetrable.

Also, by the way, if you are planning to visit the ESET stand at the Ekoparty Security Conference 2016, you will find various challenges offering you the chance to win some of the devices in this list—those marked with a star (*).

If you think we’ve missed any devices, tell us about it in the comments section and say why you think it should be in this list.

http://www.welivesecurity.com/2016/10/31/10-gadgets-every-white-hat-hacker-needs-toolkit/?utm_source=feedburner&utm_medium=email&utm_campaign=Feed%3A+eset%2Fblog+%28ESET+Blog%3A+We+Live+Security%29