How Many Companies are getting Attacked By China?

It may be hard to source some attacks, but it depends on the attack as well. We also have to decide what data to use as to who got attacked?

Following data and image is from FBI report: https://www.ic3.gov/media/annualreport/2018_IC3Report.pdf

The answer to the question is 367 entities were attacked and reported to the FBI in 2018 from China.

So that was the amount of attacks that people reported. Do you really think that everyone who gets attacked reports the attacks to the FBI?

Total attacks: 4556 India

3970 UK

2880 Canada

1227  Australia

1144 Georgia

622 Germany

605 Brazil

591 Mexico

514 Greece

511 Phillipines

471 Russian Federation

428 France

409 South Africa

384 Italy

371 Hong Kong

371 Switzerland

367 China

331 Spain

316 Portugal

311 japan

 

Total Attacks: 20379

 

I want to also warn everyone – will this count be less this year? Will we depend on digital technologies less this year?

China and many other attack points will keep coming at us.

 

Contact US to audit your defense.

It may also be time for us to reduce our Chinese exposure, as a Chinese drone manufacturer has a security flaw that allows hackers to grab  your details.  It is almost as if this is set up on purpose – make the product easy to hack and then sell them to unsuspecting Americans.  Later hack them with more data on them.

“Chinese drone giant Da-Jiang Innovations (DJI) commands more than 70 per cent of the global market, supplying products for personal, commercial, and even military use.”  from abc.net.au

I think we need to have operational risk assessments – which may include to stop buying Chinese made IT products.

 

 

Linux Rootkits Hard to Detect

First of all what is a rootkit?

A collection of software that runs and tries to hide from the computer user and administrator while also allowing the attacker access to the computer.

It does this by connecting as ‘root’ to the Operating System kernel.  In Linux ‘root’ is the administrator.

If you can masquerade as root and hijack system calls then there is a way software can be written to get  root access allowing the software to hide itself in the Linux system.

I am not going to tell you how to create rootkits, as there are many a people on the Internet who have done so and show you what they have done.

Marcus Hodges at Thotcon had a 1 hour presentation about how to hide from the operating system. To hijack operating system calls that then are used to create the rootkit.

Once system calls are hijacked the attacker can create hidden areas on the file system to stow and stay quiet until more objectives are to be pursued.

In the Cyber Kill chain the rootkit performs the function of persistence – keeping a presence on the attacked network.

A decent command to find out what different commands do on a system: strace – commands for troubleshooting and debugging Linux

Contact Us to discuss a strategy to defend your computer networks

How About Adversary Based Threat Analysis?

Another Thotcon presentation was very good, unique and moves the industry forward.

Julian Cohen presented This idea:

“Understanding Your Adversaries”

In his talk: “Adversary-Based Threat Analysis”

He explained that in the traditional Threat modeling Process  the following 6 items happen.

  1. Identify Assets
  2. Create Architecture Overview
  3. Decompose an Application
  4. Identity the Threats
  5. Document the Threats
  6. Rate the Threats

 

But his method includes rating the adversaries.

He gave some examples that are well documented (the PLA or Peoples Liberation Army) in Mandiant’s report. The report is now in a “new” mandiant web location with all of their reports.   Here is an updated link: https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf

This famous report is explained as APT1 (Advanced Persistent Threats), the fame of this report is that Mandiant did a thorough analysis how and who did the attacking from China(PLAUnit61398), down to learning where exactly the attacks came from(which building).  You can search under APT1 in any search engine and the term is attributed to the report.

Julian discusses the adversary as they have a say (or should) in how you defend.

A discussion of the intrusion Kill Chain ensued (by Lockheed Martin) i.e.  below is the action and tools that are used.

  1. Recon: Email harvesting
  2. Weapon: Office Macros
  3. Delivery: Phishing
  4. Exploit: target runs macro
  5. install: Poison Ivy
  6. C2 – Command and Control: Poison Ivy
  7. Actions: Pivot to active directory

Here is where Julian discussed “what” the adversary is using as to how effective they actually are.  The adversary is not going to do ‘everything’ , as they will do stuff that works.

There is another matrix which reviews Attacker Cost (Likelihood) focusing on these

  1. Weapon- office macros
  2. Delivery – phishing
  3. Install – Poison Ivy
  4. C2 – Poison Ivy

We all know Phishing works for them, since we are getting inundated with spam that tries their hardest to trick and get access to their machine.

Then also reviewed what is effective for defenders

  1. Delivery – Phishing
  2. Install – Poison Ivy
  3. C2 – Poison Ivy

He also mentioned this comment:

“Adversaries don’t think about winning once. They build repeatable, scalable playbooks that are cost effective at achieving their objectives over and over again against a series of targets. Adversaries don’t think about winning at all, they think about a steady stream of targets.”

Attacker efficiency: Attackers determine the least costly and most valuable attacks based on

  • Who are the targets
  • Required success rate
  • Speed of conversion

Defenses to APT1 are the following

Detect, Deny, Disrupt, Degrade, Deceive, Destroy.

All attackers are resource constrained and all attackers have a boss and a budget.

Likelihood versus Input   (in a risk calculus)

In most cases issues should be treated on likelihood alone

Do not make impact  High.

Get the most up-to-date research data to drive the likelihood information in your matrix

He is talking about this matrix I have shown in the past(in this graph likelihood = probability):

In the presentation this is the matrix he showed:

Notice the similarities even though the impact and likelihood were switched in axis, which does not actually mean much.

There is a profound meaning in this realization.

The reality is that since the attackers are not just going after you, but templates of defenders, you have to have a profile that makes you more difficult to crack. With a focus on phishing defenses, and defending against Poison Ivy the tool.

You should not just create a threat model of your systems and software, also pay attention to the attackers which are doing specific things, so that you can focus on high risk items and the likelihood of attacks on your infrastructure.

 

 

Burnout in Infosec Means All is Lost?

Thotcon (Chicago’s Hacking Conference)  thoughts…

Saw several good Cybersecurity presentations while one of the keynotes “Josh Corman” discussed the burnout of the infosec opsec community.  This is a problem for our industry as I have discussed before in past posts.  It has to do with the 3 following topics:

1. Workload  to most infosec people is 50-60 hours minimum on a regular week, and more during emergencies.  Josh mentioned 80 hours as a regular work week for many  this high workload leads to exhaustion.

2. What happens when there is no relief and it is a constant way of life to say you will work 80 hours a week forever???   Now we get to a negativity or cynicism. The constant pressure is creating a kind of relief psychology of defense by cynicism.

3. Efficacy or reduced effectiveness due to constant pressures.

What was really on Josh’ mind was the increasing number of suicides by a number of his friends.

Picture is a moment during Josh’ lecture on White hat motivations.

So Josh would like to do something about this phenomenon.  He gave an example of a Psychologist saying that the other profession with similar characteristics is nursing (high workload, and cynicism leads to lower efficacy).

He also said to not follow the herd and do not put down your fellows/ colleagues.

Above is a picture of the beginning of the second day where the Thotcon organizer was having some fun in a Wookie costume.

The main problem is to get more help so that infosec people will not burn out completely and do things that we all will regret.  Another problem is that infosec people are hard to find (or at least competent ones).

So the true issue is to get resources and eyeballs, attention of the C-suite, and generally a different level of attention.

Believe it or not for companies this is taken care of in GRC – Governance, Risk, and Compliance.

GRC – Governance, Risk, Compliance

Governance is different than just IT department run by CFO, or the CEO. The issue with Governance is that the goals of the organization are kept in mind (which is not just the mind of one person). It is the codification of the goals. WRITTEN goals and thus the group of people in charge of GRC can work toward this written goal using Risk and compliance as a way to manage things. So, the staffing of the IT department (which includes opsec or infosec) is a risk to be measured. You should not have a single person running the IT department, nor should you have 80 hours of work for 1 person. For 80 hours of work, there should be 2 people.

Setting up GRC in an organization might take a while, but once set up it can help an organization manage the compliance and regulatory risks by giving a proper Governance controlled by the people who are supposed to run the company with proper human resource goals as well.

Internet Cameras Vulnerable to Attacks With No Fix

If there is no way to fix a vulnerability what do you do if you have a camera with a vulnerability?

Here is the quote on Threatpost (from the engineer that found the flaw):

“Over 2 million vulnerable devices have been identified on the internet, including those distributed by HiChip, TENVIS, SV3C, VStarcam, Wanscam, NEO Coolcam, Sricam, Eye Sight and HVCAM,” said Paul Marrapese, a security engineer who discovered the flaws  setup the hacked.camera website

So the key from Paul’s website is the following two CVE’s:

What is CVE-2019-11219?

CVE-2019-11219 refers to an enumeration vulnerability in iLnkP2P that allows attackers to rapidly discover devices that are online. Due to the nature of P2P, attackers are then able to directly connect to arbitrary devices while bypassing firewall restrictions.

What is CVE-2019-11220?

CVE-2019-11220 refers to an authentication vulnerability in iLnkP2P that allows attackers to intercept connections to devices and perform man-in-the-middle attacks. Attackers may use this vulnerability to steal the password to a device and take control of it.

So mostly iLnkP2P  with many companies potentially affected.

This problem has just been relesed to the public, with initial advisories to vendors by Mr. Marrapese  1/15/19.

 

so in theory the vendor should have been working on this issue, but they did not respond. So vulnerability sent to CERT/CC and then the 2 official CVEs were setup by MITRE:

CVE-2019-11219 and CVE-2019-11220

Devices that use the following Android apps may be vulnerable:

  • HiChip: CamHi, P2PWIFICAM, iMega Cam, WEBVISION, P2PIPCamHi, IPCAM P
  • VStarcam: Eye4, EyeCloud, VSCAM, PnPCam
  • Wanscam: E View7
  • NEO: P2PIPCAM, COOLCAMOP
  • Sricam: APCamera
  • Various: P2PCam_HD

Time to start to make people aware and get their vendors on fixing these problems, because some vendors are foot draggers on security.

So real bad news is that the hackers now definitely  know the problems so attacks coming soon???

Coming back to original question… How can you protect cameras with this flaw? Have to put a New NGFW system in front of it to protect it.  Kind of like how one protects a WindowsXP machine, or a system that is no longer getting updates.

Here is my old post on NGFW : https://oversitesentry.com/what-is-an-advanced-firewall-utm-ngfw/

 

Contact us to discus this with you.