Diagnosing a Phishing Attack

I was clearing out some older emails today and encountered an attempt to phish Apple credentials; although this one was specific to Apple, the general lessons apply to all phishing attacks … and indeed more general malicious spam.

The attack was immediately obvious simply from the email addresses within the “To” and “From” headers without opening the body of the email :-

To: customer@apple.bill.com
From: suρρort@aρρlе.com <srvcsiyaccntse19sr345icdoeh@pesawwaatadaka.com>

First of all, look at the “To” header :-

  1. It doesn’t contain your (or in this case my) email address. This is a mark of suspicion; not enough on it’s own to make it spam, but on the way.
  2. Look how “apple” is a sub-domain of “bill.com”. Is Apple likely to allow anything significant to be branded with anything other than “apple”? More suspicious.

Next look at the “From” header … it may well be that your mail client does not show the full version of this – it would show just the “suρρort@aρρlе.com” rather than the real email address which is contained within “<” and “>” (“srvcsiyaccntse19sr345icdoeh@pesawwaatadaka.com”). So some of the first indicators may not be visible to you :-

  1. The real email address (“srvcsiyaccntse19sr345icdoeh@pesawwaatadaka.com”) is very odd, and the domain part (“pesawwaatadaka.com”) has no apparent connections with Apple.
  2. The supposed email address (“suρρort@aρρlе.com”) appears where a full name would normally appear – this is a clear mark of suspicion.
  3. Look closely at the “p”s in “aρρlе.com” and “suρρort”. Magnify the screen if you wish; not quite right are they? That’s because they’re not “p”s but a Greek rho letter with a similar but not identical appearance to a “p”. Using deceptive Unicode letters like this is doubly suspicious – enough to treat the email very carefully.

The subject itself also has lots of suspicious keywords selected (in some cases) to fool you into treating it more urgently and less suspiciously :-

  1. “Fwd:”: This is commonly added when someone manually forwards an email on – why is this sort of email being forwarded and not sent directly? Do you have a personal assistant who handles emails for you?
  2. “Daily-Reminder”: If it’s a daily reminder, what is so urgent about it?
  3. “Receipt-Document due”: Are you behind on your paperwork with Apple?
  4. “Alert!”: Is it really?

And lastly, there is the message body itself, although by now there is enough information leading to suspicion that there is no need to examine the body. But the body consists of just an attachment; no serious email from an organisation like Apple will consist of just an attachment with no explanation as to the contents. I have never sent an email to someone with just an attachment – even when they know such a thing is on the way; there is always an explanation.

I (and don’t do this unless you know you are running it in a prepared environment with full protection against infection) downloaded the attachment and passed it through some checks :-

  1. It isn’t detected as malware by VirusTotal (which passes an uploaded file through 61 anti-malware engines).
  2. The document contains lots of scary words plus a link to a suspicious site. The link was to csactivityremember.ddns.${obfuscated}. The “ddns” bit indicates that this site moved around to different servers on a regular basis. Not the sort of thing that Apple would do; and Apple certainly wouldn’t use a name like that.

Note how there was enough information in the “To” and “From” headers to indicate that this was a suspicious email – all the rest of it was further analysis to confirm my suspicions. You can (and should) reject such suspicious emails at the earliest possible stage.

Posted in Active Attacks, Email | Tagged , | Comments Off on Diagnosing a Phishing Attack

German University Forced To Reset All Passwords

According to this story in The Register (the source material is reasonably enough in German), one of our German competitors has recently been forced to reset every single account password causing significant queues for service. Plus a significant amount of malware cleansing.

Reading between the lines, and making possibly unwarranted assumptions based on my knowledge of how attacks work, it seems likely that this incident came about because :-

  1. A significant malware outbreak occurred despite anti-virus protection (everyone has that these days) making a cause for “next generation endpoint protection” (detecting malware by behaviour rather than signature).
  2. At least one infected workstation was used by someone with “domain admin” level privileges allowing access to the Active Directory database.
  3. And presumably some indication was found that the Active Directory database was “stolen” in theory allowing accounts with relatively weak passwords to be compromised.

Security is one of those tasks that can seem kind of like wasted time; until you look at events like this!

Posted in General | Tagged , , | Comments Off on German University Forced To Reset All Passwords

The Anti-Phishing “Gold Star”

Recently a query to a UK HE security list came with a link to https://www.phishingscorecard.com/ScoreCard/United-Kingdom/Education/MTEtMTE%3d which gives us a classification of “Security rockstar” for anti-phishing security measures :-

(The “DKIM” green flag only shows up if you upload an appropriate DKIM key).

Whilst it might be a bit of an exaggeration, we do compare quite favourably with the rest of the UK HE sector – only 11 organisations have a green shield under “DMARC”, but there is room for improvement as we have yet to implement DNSSEC.

The Phishing score card is published by “Dmarcian” who are behind the creation of “DMARC”. All three (DMARC, DKIM, and SPF) are a combination of technologies built on top of the basic email standard to make it harder for email addresses to be forged.

DNSSEC is slightly different in that it secures the DNS making it harder to forge DMARC, DKIM and SPF records within the DNS.

Posted in Email | Comments Off on The Anti-Phishing “Gold Star”

Keeping Secret Google Meetings Secret

It is possible that some people are unaware (certainly I wasn’t; at least not this week) that it is possible that information about meetings can be seen not by looking at someone’s shared diary but looking at the room booked.

Specifically you can see the subject and the agenda of meetings (if it was included) if you can view a room’s “diary”.

If you happen to set up meetings that involve sensitive information, you may want to be aware and either do not include any sensitive information in the meeting subject/agenda (the one within the Google calendar). Or …

Whilst setting up a meeting, you can change the visibility of the meeting from “Default visibility” to “Private” and the details of your meeting will not show up. See :-

The relevant drop-down appears alongside “Busy”.

Just for the record, I’ve never booked a meeting with a location specified as vaguely as “Somewhere with a bar”.

Posted in General | Tagged , , | Comments Off on Keeping Secret Google Meetings Secret

Careful With That Link Eugene

Over the last few weeks, I have noticed an increasing number of very suspicious looking links blocked by our “DNS firewall” – links like “xwhdg.read-this-hot-stuff.today”.

The suspicion is that people are being sent emails with links within and they are clicking on the links for further information rather than checking the link first and refusing to follow the link because the destination looks suspicious.

Check the link you are about to click on! And if it looks suspicious, don’t click on it.

When your mouse “hovers” over a link, the status bar at the bottom of your browser (Firefox and Chrome at least) will show the address it will take you too :-

It is not as conveniently obvious as a pop-up display of the link you are about to click on, but it does make it possible to check links in (for example) emails.

As to what makes a web address suspicious, that’s more of an art than a science but some indications :-

  1. If it includes nonsense strings of letters (such as “xwhdg”).
  2. Anything embedded within the string of labels which tries to hurry you up (“click-now”) or encourage you (“read-this-hot-stuff”).
  3. Any domain that ends with a word (“.today”) rather than the old country specific domains (“.co.uk”) or organisation types (“.com”, “.org”, or “.net”) probably gets a ½ point towards suspicious.
Posted in Email, Firewall | Comments Off on Careful With That Link Eugene

‘Shoulder Surfing’ or Is Your Screen Showing Others Information It Shouldn’t?

Every time I travel by train during working hours, I get reminded of the old “shoulder surfing” attack; a surprising number of people are working away on their laptops seeming unaware that anyone peaking over their shoulders has a good chance of catching what they are doing.

Which is all very well if it is something innocuous, but what if the work involves sensitive information?

It may seem unlikely that any serious compromise could take place in such a way, but it has been known to happen. Besides it’s a good excuse to put away the laptop and get on with something more fun.

Posted in General | Tagged | Comments Off on ‘Shoulder Surfing’ or Is Your Screen Showing Others Information It Shouldn’t?

Imaging PCs for Offline Analysis

This is going to be a technical post with requirements for access rights that most people do not have, so it can be ignored. The intention is to file this information in a place that can be widely seen for the benefit of others needing this information.

In some circumstances, it can be helpful to “clone” a hard disk to a file image that can be used independently of the machine itself. This list of actions indicates how it can be done in the UoP environment :-

  1. Make some firmware changes :-
    1. Turn off ‘Secure Boot’
    2. Enable ‘Network Booting’ (not sure why it’s ever disabled)
    3. Enable “Legacy booting” (as many ipxe recipes require it)
  2. Turn off BitLocker encryption (an encrypted blob is tricky to analyse) :-
    1. Start → Control Panel → System and Security → BitLocker Drive Encryption
    2. Select drive, and “Turn Off BitLocker” (presumably needs admin)
    3. One turned off, the laptop becomes toxic and must remain on site in a physically secure environment.
  3. Perform the imaging :-
    1. Boot off the network (PXE)
    2. Continue to the iPXE menu and (currently) the testing menu.
    3. Select “Ghost for Linux” (either 1 or 2)
    4. Go through the wordage and select backup to a local filesystem – turn
      off compression (the default of “lzo” is rather useless and the usual destination performs compression transparently).
    5. Start an sshfs (sshfs username@148.197.8.78:)
    6. Create an image name – YYYYMMDD-description.img
    7. Start the backup
    8. Restore firmware settings.
  4. Turn BitLocker encryption back on.

Posted in Technical | Tagged | Comments Off on Imaging PCs for Offline Analysis

Zoom Desktop Vulnerability for macOS

Update: Apple is now silently pushing out an update to remove the Zoom “hidden feature” so you will be please to know that the geeky removal is no longer necessary. Just make sure you have opted in to all recent updates from Apple, and let it “phone home” for malware updates.

Update 2: It turns out (not entirely unexpectedly) that the little web server that Zoom installs is not only a vulnerability in itself, but it is also vulnerable to exploitation allowing an attacker to do just about everything with your computer that you can.

Update 3: In addition to Zoom, it seems that Bluejeans and Ring Central for Meetings may be licensed copies of Zoom and also install a little “helper” web server. It should be assumed that they are similarly vulnerable.

According to the security researcher who found the vulnerability (warning it gets quite technical quite quickly), when you install Zoom – usually at the last minute before a conference call where it is suggested that you install Zoom to show presentation slides – you open yourself to a vulnerability that allows a rogue web site to open your webcam without notification.

Indeed the vulnerability is still present after the Zoom client is removed in the ordinary way. Zoom apparently in addition to the actual client software also installs a web server to make re-installing the client software easier. On the down side, a malicious web site can redirect requests via that web server.

Not good news!

The current Zoom response amounts to “make sure your web cam is turned off” when inside the Zoom client (‘go into the Zoom settings window and enable the “Turn off my video when joining a meeting” setting.’)

Which doesn’t seem quite adequate.

The currently known fix for removing that hidden web server is unfortunately limited to terminal commands :-

$ sudo lsof -i :19421
{Look for the "PID" of the process listed - which may be nothing}
$ sudo kill PID
{meaning enter the number you used previously}
$ rm -rf ~/.zoomus
{if you want to be ultra cautious you could rename it instead: mv ~/.zoomus ~/that-dodgy-zoom-thing}

In addition you will want to remove the Zoom desktop client in the normal way (drag from the Applications folder to the trash icon).

Whilst this is being actively exploited, the current damage seems to be limited to suddenly finding yourself attached to a conference call with a bunch of random strangers all looking rather startled. Whilst this might sound amusing, this is probably the least of what might result.

Posted in Active Attacks, Technical | Tagged | Comments Off on Zoom Desktop Vulnerability for macOS

DNS Firewalls: What They Are, and What They’re Not

This posting is really a description of so-called “DNS Firewalls” intended for those who have to deal with security vendors regularly. Having said that, there are DNS firewalls for home users (I cannot make any specific recommendations), so it may be of wider interest.

Calling them “DNS Firewalls” is a bit deceptive (and it is even possible to persuade a security vendor’s salesperson to admit that it’s a bad name for them). Firewalls control network traffic whereas “DNS firewalls” allow you to apply a policy to DNS lookups.

To be fair, the implementation for the most common DNS server is called “Response Policy Zones” (RPZ) which is a little bit on the geeky side. But to be summed up, it allows you to specify a policy when looking up names in the DNS.

What Does It Do?

When you look up names in the DNS – which happens in the background whenever you make a network connection – the DNS server performs that lookup on your behalf. If a “DNS Firewall” is turned on, it can do one of two things :-

  • Return a value indicating that the name doesn’t exist (a web browser will show an error page saying something similar to “foo.zonky.org’s server IP address could not be found.”)
  • Return an answer to a query that is not the correct answer. Or in other words lie. This can be used to provide an alternate service, or to present a web page explaining why the page is being blocked.

Of course high-end commercial “DNS firewalls” offer to do quite a bit more, but the chief cost is really the threat information feeds that gets turned into a policy. Catching phishing attacks automatically and rapidly.

Posted in Firewall, General | Tagged | Comments Off on DNS Firewalls: What They Are, and What They’re Not

The Future of Windows 7

As you may be aware, Microsoft have expectations that everyone running Windows 7 will upgrade to Windows 10 (and some refuseniks are so upset that they are ditching Windows for Linux!). As part of that, Microsoft will no longer be supporting Windows 7 from January 2020 which is approximately half a year away.

As such, there will be significant security issues with running a Windows 7 machine on any network (both wired and wireless).

University Build Machines

University build machines that login using Active Directory credentials (i.e. the standard network login username/password) will cease working from the 1st August 2019. There are currently warning banners appearing on logins.

Extensions to this deadline are being granted in exceptional circumstances where the justification is sufficient.

Non-standard Machines

Machines running Windows 7 that do not connect to Active Directory (or specifically pick up a group policy) will not be troubled by the 1st August deadline. However they are very much subject to the January 2020 deadline; after that date Windows 7 machines may very well be removed from the network simply for running Windows 7.

Those still running Windows 7 need to be aware of this, and start making plans for a migration. There are numerous possibilities that include (but are not necessarily limited to) :-

  1. Contacting the vendor of the machine querying about an upgrade path. Many specialised manufacturers will already have upgrade plans in place.
  2. Remove the machine from the network; if the network connection is merely required for convenience, it may be easiest to remove the network connection and rely on USB memory sticks.
  3. Migration to the “legacy” network with severe network restrictions in place; this is a separate network with only permitted traffic allowed through the firewall. Required network traffic will have to be requested, approved and allowed for any network connections to succeed.

Posted in Uncategorized | Comments Off on The Future of Windows 7