Category: computersecuritynews

What I got out of BlackHat and DEFCON

First I must say I did not go to Las Vegas, all I did is hunt the Internet for pieces of information and did not copy completely,  but edited to make it easier to understand when reading only (versus giving presentation within the hall):

“Controlled Chaos” the Inevitable Marriage of DevOps & Security   (Kelly Shortridge and Nicole Forsgren)  is an interesting and thought provoking presentation.

This presentation is listed at this page: https://www.blackhat.com/us-19/briefings/schedule/

Here is the relevant information in the presentation:

What are the principles of chaotic security engineering?

  1. Expect that security controls will fail & prepare accordingly
  2. Don’t try to avoid incidents – hone your ability to respond to them
  3. What are the benefits of the chaos/ resilience approach?

Time to D.I.E. instead of the C.I.A. triad, which is commonly used as a model to balance infosec priorities.

CIA first – Confidentiality – Integrity -Availability

Confidentiality: Withhold info from people unauthorized to view it.

Integrity: Data is a trustworthy representation of the original info.

Availability: Organization’s services are available to end users

But these are security values, not qualities that create security. Thus we need a model promoting qualities that make systems more secure.

D.I.E. model: Distributed, Immutable, Ephemeral

Distributed: Multiple systems supporting the same overarching goal.  This model reduces DOS attacks by design.

Immutable: Infrastructure that doesn’t change after it’s deployed and servers are now disposable “cattle” rather than cherished “pets”. The infrastructure is more secure by design – ban shell access entirely and although lack of control is scary, unlimited lives are better than nightmare mode.

Ephemeral: Infrastructure with a very short lifespan(dies after task). Where ephemerality creates uncertainty for attackers (persistence=nightmare). I.e. installing a rootkit on a resource that dies in minutes is a wasted effort.

Optimize for D.I.E. reduce your risk by design and support resilience

So what metrics are important in resilient security engineering?

TTR is equally as important for infosec as it is for DevOps.

Time Between Failure(TBF) will lead your infosec program astray.

Extended downtime is bad (makes users sad) not more frequent but trivial blips.

Prioritizing failure inhibits innovation

Instead, harness failure as a tool to help you prepare for the inevitable

TTR>TTD – who cares if you detect quickly if you don’t fix it?

Determine the attacker’s least-cost path (hint: does not involve 0day)

Architecting Chaos

 

Begin with ‘dumb’ testing before moving to ‘fancy’ testing

  • Controlling Chaos: Availability
  • Existing tools should cover availability
  • turning security events into availability events appeals to DevOps
    • Tools: chaos Monkey, Azure fault analysis, Chaos-Lambda, Kube-monkey, PowerfulSeal, Podreaper, Pumba, Blockade

 

  • Controlling Chaos: Confidentiality
  • microservices use multiple layers of auth that preserve confidentiality
  • A service mesh is like an on-demand VPN at the application level
  • Attackers are forced to escalate privileges to access the iptables layer
  • Test by injecting failure into your service mesh to test authentication controls

 

  • Controlling Chaos: Integrity
  • Test by swapping out certs in your ZTNs all transactions should fail
  • Test modified encrypted data and see if your FIM alerts on it.

 

  • Controlling Chaos: Distributed
  • Distributed overlaps with availability in context of infrastructure
  • Multi-region services present a fun opportunity to mess with attackers
  • Shuffle IP blocks regularly to change attackers’ lateral movement

 

  • Controlling Chaos: Immutable
  • Immutable infrastructure is like a phoenix – it disappears and comes back
  • Volatile environments with continually moving parts raise the cost of attack
  • Create rules like: “If there is a write to disk, crash the node”
  • Attackers must stay in-memory, which hopefully makes them cry
  • Metasploit Meterpreter and webshell: Touch passwords.txt & gone
  • Mark Garbage files as “unreadable” to craft enticing bait for attackers
  • Possible goals: Architect immutability turtles all the way down

 

  • Controlling Chaos: Ephemeral
  • Infosec bugs are stated-related so get rid of state, get rid of bugs
  • Reverse uptime: longer host uptime adds greater security risk
  • Test: change API tokens and test if services still accept old tokens
  • Test: inject hashes of old pieces of data to ensure no data persistence
  • Use “arcade tokens” instead of using direct references to data
  • Leverage lessons from toll fraud – cloud billing becomes security signal
  • Test: exfil TBs or run a cryptominer to inform billing spike detection

How should infosec and DevOps come together and develop all of these concepts?

Has to be done as a cultural “marriage” cultivate buy-in for resilience and chaos engineering.

This is a marathon not a sprint and changing culture : change what people do , not what they think.

———————————————

There are a lot more suggestions, but the main themes that I took out of this presentation slides is that you can make your defense more resilient and tougher by making it a little bit chaotic.  I.e. Immutable and ephemeral are some good concepts to think about and use in your infrastructure. Every environment is different and will require co-ordination and rethinking of how things work, but it is good to work some of the concepts into your environment.

Here is a great piece of thinking: Don’t keep your systems up as long as possible, as it is also a security risk (besides patching and other issues).

Using  short lifespan hardware with frequent rebooting (relatively – like every day for example) makes the attacker’s life much more difficult. Of course patching requires some rebooting, but monthly or quarterly reboots are not frequent enough.

Also here are some links from DEFCON

First the Media presentation  webpages: https://media.defcon.org/DEF%20CON%2027/DEF%20CON%2027%20presentations/

(I always include the full link instead of Media.defcon.org link so one can see where it will go)

First I look at the Speaker’s bio and quick overview of the presentation given at this link: https://www.defcon.org/html/defcon-27/dc-27-speakers.html

Then I download the information freely available on the Internet.  I will have more posts on the presentations at DEFCON and Blackhat.

 

 

Threat Hunting in Your Network

We should hunt for threats in our network – i.e. find possible attacks in our network to see what is being attacked and whether we  can start to counter the attacker’s moves.

In case you don’t know below is the ATT&CK MITRE framework green highlights are the items you may want to pay attention to.

Olaf Hartong has a few scripts developed that will help find the potential  Sysmon Indicators of Compromise(IOC).  He uses sysmon (Microsoft events created by Sysmon)  that will help us find the IOC’s.

Focus on events that

  • Process creation (with full command line and hashes)
  • Process termination
  • Network connections
  • Various file events
  • Driver/image loading
  • Create remote threads
  • Raw disk access
  • Process memory access
  • Registry access (create, modify, delete)
  • Named pipes
  • WMI events

Olaf’s sysmon-modular github repository

The idea is to use a ruleset that works in your environment that is not noisy(has too many log events which are not useful)

I found Olaf’s page from a youtube presentation on my Security news Analyzed page from  IronGeek’s Bsides Cleveland Videos Specifically “Operationalizing MITRE ATT&CK Framework”

Here is the relevant screenshot:

So we can use sysmon to see specific events on the MITRE framework which will help us understand whether we have an attacker in our network.

This will further enhance our ability to make adjustments to our network  as we see attacks move from system to system. Each network is different and thus requires  unique methods. But it is good for some automation as the number of log events can be staggering. We do not want to drink from a firehose.  We will just get wet.

Contact us to help you evaluate this for your environment.

What is Threat Landscape Now?2019-July?

What kind of bad things are going on today on the Internet?

 

Have you heard of formjacking, cryptojacking, and ransomware?

Formjacking is where a retailer’s credit card “form” was hacked by criminals and the credit card information is sent to the criminal as well as or instead of the vendor you are expecting to buy something from.

For example: you are on XYZ company website and are buying a product. On this website the webpage is called a “form”. So when a form is hacked some call it ‘jacked’. I.e. Formjacking. Guess which websites got hacked? Ticketmaster and British Airways.

From: Theinquirer.net

Interesting to note the story said that the 3rd party software at fault was Inbenta, which apparently is an AI and natural language processing software.

Forbes also had a story to say that 380,000 passengers were affected by a malicious hack. This particular hack was done on the main website of British Airways, which holds your personal information (name/address/passport#/and other financial info).

 

The next threat is cryptojacking, here the hacker tries to insert software in any systems that you run which tries to run cryptomining software so that your computers are used to mine cryptocurrencies. although some currencies are no longer as valuable, this is still a moneymaker.  The malicious software is easy to install and let run, so even though the returns are not as high… the risk for the criminal may be lower.

 

Ransomware is always a threat, and usually inserted when people click on spam.  The spam is linked to software that downloads and then overwrites your data. Ony if you pay a ransom will the data be released .

 

It is interesting to note that most of these issues can be fixed by patching your software and systems . But if you do have an ecommerce website then you have to hire someone to attempt to hack the ecommerce software.

Keep An Eye On Google ‘Security’ Projects

There are quite a few Google projects of which some are focused on security(there are many more projects, but these are the ones that could be cybersecurity. The explanation which is in italics- i.e. copied from theGoogle project webpages):

https://opensource.google.com/projects/

Abseil   Abseil  an open-source collection of library code.   also at https://abseil.io/

Abseil C++ code is designed to augment the C++ standard library. In some cases, Abseil provides pieces missing from the C++ standard; in others, Abseil provides alternatives to the standard. Abseil is not meant to be competitor to any standard library code; we’ve found that many of these utilities serve a purpose within our code base, and we now want to provide those resources to the C++ community as a whole.  

AdaNet  Fast and flexible AutoML(Machine Learning) with learning guarantees  also at https://github.com/tensorflow/adanet

AdaNet is a lightweight TensorFlow-based framework for automatically learning high-quality models with minimal expert intervention. It uses the AdaNet algorithm by Cortes et al. 2017 to learn the structure of a neural network as an ensemble of subnetworks while providing learning guarantees. Importantly, AdaNet provides a general framework for not only learning a neural network architecture, but also for learning to ensemble to obtain even better models.

Angular – a web application framework for mobile, desktop, and web. also at https://angular.io/

Angular is a development platform that aims to make web development feel effortless, focused on developer productivity, speed and testability. Applications built with Angular can be deployed to mobile devices and desktops as websites and native applications.

Apache Beam – unified model to define and execute processing pipelines. also at https://beam.apache.org/

Apache Beam provides an advanced unified programming model, allowing you to implement batch and streaming data processing jobs that can run on any execution engine. It is easy to use with Apache Apex, Apache Flink, Apache Spark, and Google Cloud Dataflow among other distributed processing back-ends.

badssl.com – memorable site for testing clients against bad configs – also at Apache Beam

badssl.com has a suite of subdomains with various HTTPS configurations. These can be used to test browsers and other TLS clients to see how they behave when they encounter sites with various security-sensitive issues on the web.

Bazel –  a Build System for fast and correct builds – also at.  https://bazel.build/

Bazel is Google’s own build tool. Bazel has built-in support for building both client and server software, including client applications for both Android and iOS platforms. It also provides an extensible framework that you can use to develop your own build rules.

Blockly -Open Source Library for adding drag and drop block coding to apps. also at https://developers.google.com/blockly

Blockly is a library for adding drag and drop block coding to an app. This is primarily used for computer science education, but can also give users a way to write their own scripts or configuration for an app. Blockly has libraries for Web (JavaScript), Android (Java), and iOS (Swift/Obj-C).

BoringSSL

BoringSSL is a fork of OpenSSL that is designed to meet Google’s needs. also at https://boringssl.googlesource.com/boringssl/

Although BoringSSL is an open source project, it is not intended for general use, as OpenSSL is. We don’t recommend that third parties depend upon it. Doing so is likely to be frustrating because there are no guarantees of API or ABI stability.

Programs ship their own copies of BoringSSL when they use it and we update everything as needed when deciding to make API changes. This allows us to mostly avoid compromises in the name of compatibility. It works for us, but it may not work for you.

Bullet Physics SDK – Real-time collision detection and multi-physics simulation  for VR, games, visual effects and robotics. also at http://bulletphysics.org/

The Bullet Physics SDK is a professional open source collision detection, rigid body and soft body dynamics library written in portable C++. The library is primarily designed for use in games, visual effects and robotic simulation. The library is free for commercial use under the zlib license.

Portable laser range-finders and simultaneous localization and mapping (SLAM) are an efficient method of acquiring as-built floor plans. Generating and visualizing floor plans in real-time helps the operator assess the quality and coverage of capture data. Building a portable capture platform necessitates operating under limited computational resources.

Cauliflower Vest – A recovery key escrow solution. also at https://github.com/google/cauliflowervest

The goal of this project is to streamline cross-platform enterprise management of disk encryption technologies. The project initially started with end-to-end Mac OS X FileVault 2 support, and later added support for BitLocker (Windows), LUKS (Linux), and Duplicity.

Cauliflower Vest offers the ability to:

  • Automatically escrow recovery keys to a secure Google App Engine server.
  • Delegate secure access to recovery keys so that volumes may be unlocked or reverted.
  • Forcefully enable FileVault 2 encryption.
  • Sync BitLocker recovery keys from Active Directory.

Chromium – A safer , faster, and more stable web browser. also at  https://www.chromium.org/

Chromium is the web browser that Google Chrome is built on. It is meant to feel lightweight (cognitively and physically) and fast. When released, it brought a sandbox security model, minimalist user interface, and tabbed window manager that many other browsers have since adopted.

Copybara – A tool for transforming and moving code between repositories. also at https://github.com/google/copybara

Often, source code needs to exist in multiple repositories, and Copybara allows you to transform and move source code between these repositories. A common case is a project that involves maintaining a confidential repository and a public repository in sync.

Copybara requires you to choose one of the repositories to be the authoritative repository, so that there is always one source of truth. However, the tool allows contributions to any repository, and any repository can be used to cut a release.

 

dart – a language designed to be productive, stable, and free of surprises. also at https://www.dartlang.org/

Dart is a programming language developed at Google and approved as a standard by Ecma. It is ideal for web development and can be transcompiled to JavaScript, but can also be used to build server, desktop, and mobile applications. Dart is designed with a ‘batteries included’ philosophy and minimizes magic, such as automatic type coercion in order to avoid surprises when developing large applications.

deepMind lab a customizable 3D platform for agent-based AI research. also at https://github.com/deepmind/lab

DeepMind Lab is a first-person 3D game platform designed for research and development of general artificial intelligence and machine learning systems. It provides a suite of challenging navigation and puzzle-solving tasks that are especially useful for deep reinforcement learning. Its simple and flexible API enables creative task-designs and novel AI-designs to be explored and quickly iterated upon.

Dopamine – A research framework for fast prototyping of reinforcement learning algorithms. also at  https://github.com/google/dopamine

Dopamine is a TensorFlow-based research framework for fast prototyping of reinforcement learning algorithms. It aims to fill the need for a small, easily grokked codebase in which users can freely experiment with wild ideas (speculative research).

fastlane – automate building and releasing iOS and Android apps. also at https://fastlane.tools/

fastlane allows you to automate the complete release process of your iOS and Android apps. It handles tedious tasks like generating screenshots, dealing with code signing and releasing your application.

Firebase SDK – An app development platform to develop high-quality apps. Also at https://firebase.google.com/

Firebase is an app development platform that provides integrated tools to help you build, grow and monetize your apps. The Firebase SDK enables access to the Firebase services in an intuitive and idiomatic manner on several platforms.

FlatBuffers – A serialization library for games and other memory constrained apps. Also at  http://google.github.io/flatbuffers

FlatBuffers is an efficient cross platform serialization library for C++, C#, C, Go, Java, JavaScript, PHP, and Python. It was originally created at Google for game development and other performance-critical applications. It allows you to directly access serialized data without unpacking/parsing it first, while still having great forwards/backwards compatibility.

Flutter – Build apps for iOS and Android from a single codebase. Also at Flutter

Flutter is a mobile app SDK for building high-performance, high-fidelity apps for iOS and Android, from a single codebase. The goal is to deliver apps that feel natural on different platforms, embracing differences in scrolling behaviors, typography, icons, and more.

FontDiff – tool for finding visual differences between font versions. Also at Flutter

FontDiff is a utility for testing fonts. When you modify a TrueType or OpenType font, FontDiff generates a PDF showing the typeset text both before and after the change. You can use this PDF to easily review the changes and spot any errors caused by a font switch.

FontView– demo app displays fonts using a free stack. Also at https://github.com/googlei18n/fontview

FontView is a little demo app that shows the contents of a font file. It opens *.ttf, *.otf, *.ttc, *.otc, *.pfa, and *.pfb files. To render text, FontView uses open-source libraries.

Forseti Security – Open source tools for Google Cloud Platform(GCP) Security. Also at  Forseti Security

Forseti Security helps you secure your Google Cloud Platform organization.

Keep track of your environment

Gerrit – web-based code review system for projects using Git. Also at https://www.gerritcodereview.com/

Gerrit is a highly extensible and configurable tool for web-based code review and repository management for projects using the Git version control system. It allows teams to discuss code, serve Git as an integrated experience within the larger code review flow, and manage workflows with deeply integrated and delegatable access controls.

Go – open source programming language to make it easy to build simple, reliable and efficient software. Also at https://golang.org/

Go is expressive, concise, clean, and efficient. Its concurrency mechanisms make it easy to write programs that get the most out of multicore and networked machines, while its novel type system enables flexible and modular program construction. Go compiles quickly to machine code yet has the convenience of garbage collection and the power of run-time reflection. It’s a fast, statically typed, compiled language that feels like a dynamically typed, interpreted language.

Google Cloud datalab

 

Kritis – open source solution for securingyour software supply chain for Kubernetes applications, by enforcing deploy-time security. Also at https://github.com/grafeas/kritis

Kritis (“judge” in Greek), is an open source solution for securing your software supply chain for Kubernetes applications. Kritis enforces deploy-time security policies using the Google Cloud Container Analysis API, which uses Grafeas underneath.

MOE: Make Open Easy – Synchronizes, translates, and scrubs source code repositories. Also at  https://github.com/google/moe

MOE is a system for synchronizing, translating, and scrubbing source code repositories. Often, a project needs to exist in two forms, typically because it is released in open-source, which may use a different build system, only be a subset of the wider project, etc. Maintaining code in two repositories is burdensome.

mtail – extract whitebox monitoring data from application logs for collection in a timeseries database. Also at https://github.com/google/mtail

mtail is a tool for extracting metrics from application logs to be exported into a timeseries database or timeseries calculator for alerting and dashboarding.

It aims to fill a niche between applications that do not export their own internal state, and existing monitoring systems, without patching those applications or rewriting the same framework for custom extraction glue code.

 

Open Images Dataset

OpenScience Journal –   An app that allows one to gather information using the sensors in the Android phone. Also at https://makingscience.withgoogle.com/science-journal/

Science Journal allows you to gather data from the world around you. It uses sensors to measure your environment, like light and sound, so you can graph your data, record your experiments, and organize your questions and ideas. It’s the lab notebook you always have with you.

OpenWeave – open source implementation of Weave network app layer, secure communications backbone for NEST products. Also at OpenScience Journal

OpenWeave is an open-source implementation of the Weave network application layer, the secure, reliable communications backbone for Nest products.

At Nest, we believe the core technologies that underpin connected home products need to be open and accessible. Alignment around common fundamentals will help products securely and seamlessly communicate with one another.

Outline – an open source VPN software released by Jigsaw March 2018. also at https://getoutline.org/

The Outline software allows for the creation of a personal or corporate VPN server on a cloud provider of the user’s choice, with minimal effort. Once set up, Outline server administrators can share access with other users, who can connect to the VPN using Outline clients developed for Windows, macOS, iOS, Android and ChromeOS. Outline uses the Shadowsocks protocol (shadowsocks.org) for communication between the client and server.

Stackdriver – Monitors, logs, and diagnostics for cloud applications. Also at https://cloud.google.com/stackdriver/

Google Stackdriver provides powerful monitoring, logging, and diagnostics. It equips you with insight into the health, performance, and availability of cloud-powered applications, enabling you to find and fix issues faster.The Stackdriver agents and libraries are open source projects.

Upspin – experimental framework for sharing files securely. Also at https://upspin.io/

Upspin is an experimental project to build a framework for naming and sharing files and other data securely, uniformly, and globally: a global name system of sorts.

It is not a file system, but a set of protocols and reference implementations that can be used to join things like file systems and other storage services to the name space.

 

 

https://bugs.chromium.org/p/project-zero/issues/list

I have included several machine learning(ML) projects which I believe can be used to create many programs (including security based),  the future in security is in AI, of which ML is a piece of it.

There is an interesting article in Wall Street Journal:

Google’s Enemies Gear Up to Make Antitrust Case

The article goes into a case Yelp and TripAdvisor are making that Google is using it’s position as search engine to place it’s own services ahead of Tripadviser and Yelp.

I wonder if they know about these 70 projects on the Google projects list of which 27 have security implications in my opinion:

Abseil, Adanet, Angular, Apache beam, badssl.com, Bazel, Blockly,  Dart, Deepmind, Dopamine, Fastlane, FlatbuffersSDK, Flatbuffers, Flutter, Fontdiff, Fontview, Forseti Scurity, Gerrit, Go, Kritis, MOE(make open easy),mtail, Opensciencejournal, Openweave, Outline, Stackdrivers, Upspin

It definitely looks to me that Google is building a larger organization, does this mean that they should be broken into pieces? Maybe this was why the Sherman Antitrust act was created and passed by Congress in 1890. This law declared illegal all combinations “in restraint of trade”.  (from http://www.ushistory.org/us/43b.asp)

Google is building a future AI power house, that will make today’s search power  seem like a mouse versus a tiger.

 

Microsoft Bug Disclosed Before Patch Available

As we have mentioned before the cycle of bugs found to patches released can sometimes be long. Tavis Ormandy has disclosed this bug in Microsoft Windows’ SymCrypt. Which can cause your system to have to reboot (with the right file or data passing through).  Tavis Ormandy is a Vulnerability researcher at Google.

This bug is the underlying infrastructure for within a core crypto -library

From a Reddit post this is a good explanation:

Tavis Ormandy found a bug in Windows core crypto-library SymCrypt. PoC(Proof of Concept) is based on a crafted X.509 certificate. For example: embedding this file in a S/MIME email could crash a windows server remotely. Since more than 90 days have passed Project Zero made this bug public (Patch should follow in July)

Here is the SymCrypt page:

SymCrypt is the core cryptographic function library currently used by Windows.

History

The library was started in late 2006 with the first sources committed in Feb 2007. Initially the goal was limited to implement symmetric cryptographic operations, hence the name. Starting with Windows 8, it has been the primary crypto library for symmetric algorithms.

In 2015 we started the work of adding asymmetric algorithms to SymCrypt. Since the 1703 release of Windows 10, SymCrypt has been the primary crypto library for all algorithms in Windows.

 

So what is the true meaning of this bug?

A ‘well crafted’ certificate or otherwise another way to kick off this bug can cause your machine to hang (DOS – Denial of Service).  In general someone has not found a mass market way to hit thousands of machines (YET!).

Thus it is not a high priority problem to be fixed, but it does need to be. It is slated to come out in the July patch update (2nd Tuesday) July 9th.

Contact us to understand the patch cycle process:

If you see my image above that is Day60, so Microsoft has not forced the fix before day91 due to the low risk nature of this problem. I.e. rebooting is annoying but at least hackers are not reformatting all your data with ransomware.  So it looks like with a July 9 patchday it will be close to Day 117+

This is unfortunately typical as it is not that easy to create a patch for hundreds of different devices.  I also wonder if this issue could have been better handled by Tavis,  or if this is a small competition thing between Google and Microsoft. Either way we have to pick up the pieces and deal with the possible consequences.