Mobile Rootkit Protection Is a Leprechaun

Mobile security is in it’s infancy. There are a number of players out there, and as is such with any new technology type, there’s no “one size fits all.” Some of these technologies cover mobile access control, some cover “rogue apps”, others cover the characteristics of the operating system itself, and whether or not it has been “jailbroken.” I recently sat through a vendor demo where they claimed that they could “detect jailbroken iphones and prevent them from operating via policy.”

Hi, I'm Mobile Rootkit Protection!

 

Let’s talk about “jailbreak detection and protection” for a minute. Maybe I’m missing something. When you jailbreak your iphone, you’re effectively running an exploit for a known security vulnerability in the phone, and subsequently installing a rootkit on it. In most cases, the iphone’s running kernel is replaced with one that can support unsigned apps.

So, if hacked iphones are modifications to the kernel, and anyone can write their own jailbreak code once a vulnerability is found, then how is this magical “mobile security technology” supposed to work?

In fact, there was a presentation by Eric Monti in 2010 where he demonstrated a stealth rootkit that could hijack existing processes and turn basic feature utilization on and off.

Ok so, to recap:

·      Jailbreaking isn’t magic.

·      The kernel is an unknown quantity.

·      Existing processes can be hijacked or replaced.

·      Certain features of running processes can be altered.

I fail to see how anyone can be expected to run an application or a kernel level process that claims to be able to control security in an environment with this degree of hostility.

I know I haven’t discussed which vendors we’re talking about here, but that’s almost a moot point when features like “lockdown security (camera, SD, Bluetooth, Wi-Fi)” are more science fiction than computer science.

Reflecting on ICS/SCADA Software and Hardware Security Vulnerabilities

On a fairly regular basis someone will send me a link about a newly disclosed vulnerability in ICS/SCADA control system software or hardware and ask me what I think about it.  Recent examples include backdoor remote access embedded into hardware with trivial authentication and weak cryptography, systems that are left unpatched due to lack of vendor support, control system software and hardware with a myriad of security holes and vulnerabilities, etc.  The list is long, and seems to be increasing at an alarming rate.  My guess is because there are an increasing number of security researchers who are actively trying to get the message out about the insecurity of these systems.  Many of these, like trivial authentication and lack of patch management, are dirty little secrets that are not surprising to those that work in the industry.  What is different is the press and attention they are receiving of late.

I won't comment on the motives of these researchers, but some of them definitely have a vested interest in the attention it draws to the security problems in ICS/SCADA, in the hopes that it will generate buzz and attention to their company and to the security problems in general with the ICS/SCADA equipment.  Nevertheless, these vulnerabilities and problems do exist, are pervasive, and neither the industry nor the vendors seem to be acting very quickly to correct the situation.  Trying to correct these security issues after the fact just doesn't work very well.  As security professionals, we understand that security must be integrated into the entire development life-cycle of hardware and software.  

So who is responsible for the security of these systems and what can we do?  ICS/SCADA manufacturers and integrators need to step up their game and create solutions that meet security best practice standards, at the very least. If they want to continue providing products and services in the Electrical Energy Sector (or many other SCADA environments), they also need to be able to demonstrate that their products are not only secure but are compliant with, and facilitate compliance with, NERC CIP and other regulatory standards.

End user entities of ICS/SCADA hardware and software need to "Trust, but verify", to coin a phrase.  These entities should be asking questions.  Lots of questions.  Create and ask for validation and verification testing that the equipment, designs, and other solutions are going to meet your operational, security, and compliance requirements.  Do this early in the process of selection and procurement.  Engage with your vendors and let them know your concerns and find out what their path forward is for creating and supporting security throughout the life-cycle of their products.

If you aren't comfortable with putting your vendors to task, enlist the services of a company like Critical Assets.  We can help you develop design selection and testing criteria that meets your specific needs as well as facilitate testing in your facility or ours.  Ensuring that your ICS/SCADA hardware and software is secure, compliant, and operational can be a difficult task, but it can be done and there is help available.

Anatomy of a Spear Phishing Attack

Most large organizations employ an impressive technological arsenal of perimeter and internal technical security controls.  From IDS and application firewalls to web content scanning and endpoint antivirus, the typical CSO or IS management team typically feels they have positioned the company to effectively detect and respond to attack.

No matter the degree of sophistication employed in an organization’s security program, there often remains one significant vulnerability that is completely neglected – the people and processes that are behind each system.  A lack of education, policy, or procedure can lead to devastating compromise via the actions of a single unwitting employee.

Critical Assets was recently asked to respond to an incident at a leading online services company where a series of targeted messages led to total compromise of a company’s production servers.  Along with root access to these servers, illicitly obtained data included primary intellectual property (product source code), firewall configuration files, SSL keys, and the organizations entire credit card database.  The company utilized state-of-the-art security devices and employed talented staff -- How could a simple email result in such catastrophic intrusion?

Two email messages were sent to separate organizations within the company.  The first was targeted at product developers -- those who created and maintained the company’s products. As is true with many technology product companies, the developers were afforded a certain amount of latitude with respect to implementing company-required security controls.  The second email was focused on the company’s social media outlet (a large number of corporate bloggers.)

The BLOG-O-SPEAR
The message received by the bloggers was relatively sophisticated in that it contained corporate branding (logos, look-and-feel), and used the name of a real employee – the “chief blogger” as it were.  It took advantage of a recent post indicating that the company had moved to a new blog platform, and solicited employees to provide feedback on some new features by clicking on a hyperlink.  Both the linked site and the return address of the “real” employee used a simple variant of the company’s actual domain name.  Note all images shown have been redacted, and the company logos have been changed where appropriate.

The site itself was an insecure replica of the employee portal, which was designed to simply allow input of a user’s credentials, and then immediately reload without dialog or error.


Many users assumed something was wrong with the site, but rather than report the anomaly, they continued to try various combinations of username and password and eventually gave up.


The resulting passwords generated by this incident were used to gain access to the employee portal, which granted full access to the corporate blog, product licensing servers, transactional data, and even remote workstation access.  The blog itself was compromised, the ability to generate license keys for core products was obtained, and other sensitive information was divulged.

C # STICK HEADED STRAIGHT FOR EYE
The message sent to the group of developers was similar in form, but far more insidious in function.

The attackers certainly did their homework -   Like the first message, it utilized corporate look-and-feel and appeared to arrive from the company’s event coordinator.  To pique interest, the email covered a relevant topic (a product development seminar sponsored by another company), and included the enticing prospect of free food and an “Open Bar!” at a local restaurant.  To provide an even greater sense of urgency, the message boldly proclaimed that seating was limited and time was running out!  Fortunately for the intruder, most people have an affinity for both food and happy hour - thus a response was almost guaranteed.

Any respondent was sent to an external website that appeared to require the use of a Java application in order to register for the event.  Though the application was unsigned, several users elected to run it anyway.  Unbeknownst to these employees, execution of the Java application appeared to do nothing at all, but behind the scenes, a “reverse shell” session was made to an external system under control of the attacker.  This session gave the attacker almost total control of a highly privileged developer workstation, and was not detected by internal security controls.  The application was platform-agnostic, and was most effective on OSX and Linux machines – the bulk of the development population.

The remote attacker used this connection to take advantage of lax internal security, often the result of a well-intentioned attempt to facilitate unhindered collaboration and efficient workflow for developers.  Once on the inside, an insecure NFS volume containing developer “home” folders was discovered and scoured for usernames, passwords, configuration files, and other data needed to further penetrate the company’s systems.  Discovered credentials were then used to take advantage of an implicit trust relationship between a single Linux host and every production server.  At that point, the game was over – totally undetected, and all in the space of a few hours.

Remediation of this incident required the realization of a few important factors:

• Employees must be educated on how to recognize spoofed websites and phishing attempts.


• Employees must have a simple, readily available mechanism to report suspected security incidents, and should be incentivized to do so.


• The most robust perimeter security is never a substitute for poor internal security.

 

Breaches of this magnitude make headlines, and have the potential to put a company out of business.  Fortunately, this was a sponsored penetration test conducted by Critical Assets which served to greatly strengthen the company’s overall security posture.  Would your organization pass the test?

Google blames China for phishing attack. China Denies Allegations.

War Games II. This time it's Matthew Broderick against a whole city full of trained Chinese hackers.

 

http://online.wsj.com/article/SB10001424052702304563104576361300123816450.html?mod=WSJ_hp_LEFTTopStories

OWASP San Diego: Jeremiah Grossman To Present on 6/14

The Open Web Application Security Project (OWASP) Chapter in San Diego is holding a meeting to discuss the latest developments in the OWASP organization and new ideas in leading-edge secure web development. Join us in welcoming Jeremiah Grossman to present details of the many notable and new web hacking techniques revealed in 2010, as well as some of the prevalent security issues emerging in 2011. Attendees will be treated to a step-by-step guided tour of the newest threats targeting today's corporate websites and enterprise users. Enjoy Sushi and Sake refreshments from our friends at Whitehat Security as you network with some of the best security auditors, researchers, and developers in the San Diego area. We look forward to seeing you there!

Date: June 14th, 2011
Time: 6:00pm - 8:00pm
Location: 10240 Sorrento Valley Rd
San Diego, California 92121

Please RSVP: rsvp@owasp-sd.org
858-754-9701

About OWASP:
The Open Web Application Security Project (OWASP.ORG) is a non-profit community devoted to improving focus on application security. OWASP continues to grow and deliver exceptional resources to security conscious individuals who are required to make informed decisions about true application security risks. A plethora of funded open-source products, new coding principals that have been adopted by PCI standards, and a unique list of involved security professionals make OWASP an invaluable forum to attend.

RSA: Who is the doctor's doctor?

[caption id="attachment_150" align="alignnone" width="348" caption="Some solid security logic."][/caption]

It's pretty clear at this point that there's a trending of attacks focused on security solution providers. The most recent victim in the post-HBGary landscape is RSA.

A lot of people seem to be talking about what they believe actually happened during the breach. The company has yet to officially comment on the details of the incident and seems to be wordsmithing any communication to the outside world pretty heavily. While I'm sure the technical facts will be interesting, and that they will make their way around the rumor mill eventually, I'd like to talk instead about something that I feel is more important - due and reciprocal care.

The medical industry seems to have this concept pretty well wrapped up. If you ask a psychologist, "who listens to your problems?" they will tell you that their psychologist does. This is because it is considered unprofessional, and in some cases a violation of ethics code to self-diagnose, self-prescribe, and self-medicate. Of course, this begs the question of who treats the psychologist that treated the first psychologist? Well, another psychologist of course. So, theoretically, as long as there are at least 3 physicians in the world who practice psychology, this model will continue to function, and we won't end up with a bunch of mentally disturbed psychologists.

I doubt anyone on the professional services end of the information security industry would argue that there's a shortage of proprietors offering security assessment and remediation. So then why do things like the RSA incident happen? It's because nobody is examining the physician. In fact, I'd be willing to bet that if you took a sample set of posture assessments from top 10 information security product and service vendors, the results of what's already left the building would be staggering. Further, most people close to the steam will tell you that things have not changed dramatically from the days when the entire Solaris source tree was essentially public domain in the hacker underground, and Larry Ellison's personal passwords were in a t-file.

Why? It's simple. Just because your company's primary business is security does not mean that you possess said security. What it does mean, however is that the risk you take is not only limited your standard business risk, but that your reputation is predicated on your ability to protect own your assets in the same manner that you would help the customer protect theirs.

So that you don't think we're calling the kettle black, we have in fact engaged an outside advisor to look at the company footprint, assess security, and make recommendations for remediation. If you're a security vendor, shouldn't you?

The Final Word on Hiring Hackers.

I'm addressing this about 6 months too late, but there was an extremely repetitive, relatively ignorant article that was written by M. E. Kabay which rehashes the topic of whether or not you should hire hackers for what seems to be the hundredth time. There are additional comments on Brad Johnson's blog here:  http://systemexperts.blogspot.com/2009/10/hiring-hackers-please-dont-by-brad.html

The only people who argue against hiring hackers are people who are riding their coat tails, or trying to create controversy that simply isn't there. Put simply, the information security industry was -created- by the very  hackers that the article suggests you shouldn't trust. The concept of compliance regimes, security standards, controls, and technologies like firewalls, IDS/IPS, DLP, etc... wouldn't exist without the need for security, and the need for security is addressed by these companies... right... the ones created by hackers.

In fact, suggesting that you shouldn't ever hire a hacker to work on your security project is analogous to suggesting that a doctor who has performed exploratory surgery on a patient with success is somehow less qualified to address your ailment.

Chris and Al,  both of whom I have seen own various parts of our nation's infrastructure first hand, are two of the most respected early security technology executives in the industry. Maybe you've heard of their companies: Secure Networks, and ISS.  Sorry guys, you're outed. It's been like 20 years, so I'm pretty sure you're safe from a statutes perspective. Point being that hackers are the primary people who are responsible for you having an industry to work in.

Its just funny to me that people are still having this conversation, because the argument that no one should hire hackers is silly. If you want to buy a product or have a service executed that even remotely involves security, you WILL be hiring a hacker, and you don't really have a choice in the matter. If you end up with zero hacker involvement, you may want to review the efficacy of the product or service you just bought.