Keeping Your Account Safe

Posted on 2017-05-10 by mike

We are seeing an increase in the number of compromised accounts due to various forms of attack, and decided to highlight some core protections for your account. If your account is compromised, you may find yourself locked out of the account at an inconvenient time (Google does this automatically), find yourself sending huge quantities of spam, or more serious repercussions.

So it is well worthwhile sticking to at least some but preferably all of the following safety tips :-

  1. Use a long and strong password for your account.
  2. Do not share passwords – neither with other people nor with other sites. Your ebay account should have a different password to your University account.
  3. Avoid using your University username on other sites. If one of the other sites is compromised and the account details leaked, it can look like your University account is also compromised.
  4. Enable two-factor authentication.
  5. Be wary of entering your account credentials into a web-based form. You of course need to authenticate to use Google (for example), but you need to be sure it is actually Google asking for authentication.
  6. Don’t follow email links and enter your account credentials. In fact be very careful about following links in email full stop. And yes that applies to trusted correspondents too – once someone has their account compromised, one of the first things to occur is the attacker will use their account to email a form to everyone asking them to login.
Posted in Active Attacks, Passwords | Comments Off on Keeping Your Account Safe

‘Phishing’ Emails With Your Home Address

Posted on 2017-04-04 by mike

This article is currently being drafted, and will be added to over time. In the meantime, Sophos have an article that goes into some detail about what is going on here. Some key points :-

  1. Don’t click on the encrypted attachment (named something.dot).
  2. Don’t decrypt the attachment.
  3. To the best of our knowledge, the personal data contained within the email is from web site data leaks – which web sites is unknown.

The email in question can be identified because it :-

  1. Contains your residential address.
  2. Has a password-protected (and encrypted) attachment and the email lets you know what that password is … very poor security.
  3. The language of the email is odd.

The attachment itself contains Word macros which (when enabled) in turn pulls down some malware to infect your computer.

Posted in Active Attacks, Email | Tagged | Comments Off on ‘Phishing’ Emails With Your Home Address

Is IS Aware Of What Password You Have?

Posted on 2017-03-16 by mike

One of the more interesting questions that arose from the recent password audit is whether IS is aware of account passwords – i.e. do we know your password.

The short answer to that is: No, but with a caveat.

First of all, only one person in IS has any authorised access at all to any disclosed passwords. The password auditor (that’s me).

Secondly, only weak passwords are available. Strong passwords – those passwords that cannot be “cracked” within a reasonable time-frame – are not available.

Finally, I don’t want access to the passwords, so although I have theoretical access to the weak account passwords I make sure that the association between usernames and passwords is broken very quickly – I may know that “fred” has a weak password but not what password it is, and I may know that X is a widely used password, but I don’t know who uses that password.

Posted in Passwords | Comments Off on Is IS Aware Of What Password You Have?

How SHA-1 Is Broken

Posted on 2017-02-24 by mike

(This gets very esoteric very quickly)

Those of you paying attention may have realised that very recently (January this year), browsers started complaining about security when connecting to sites whose SSL certificates used the SHA-1 hashing algorithm within the certificate. This was due to a theoretical weakness in the algorithm known about as far back as 2005.

What has changed since then is that Google researchers have now demonstrated the attack, and whilst it is not practicable (with the possible exception of nation state attackers), it is now well past time that SHA-1 was gracefully retired. Especially when you consider that a methodology that is not sensibly practicable today may well be usable in 5-10 years.

SHA-1 is a cryptographic hashing algorithm whereby any individual lump of data can be uniquely expressed with a single hash and no other lump of data can share that hash value. Or more precisely it is difficult to generate a collision whereby two lumps of data hash to the same value. If you run a SHA-1 tool against a file, it should return a unique value unless the file is identical :-

The first command shows incorrect behaviour whereby two different files result in identical hash values; the second command shows the correct behaviour demonstrating that the files contain different contents.

In practice, an attacker would have to produce a lump of data that generates the same SHA-1 hash value as a the lump of data that she wanted to ‘impersonate’, which has not been demonstrated. Google’s researchers have simply generated two lumps of data which generate the same SHA-1 hash value … which is somewhat easier.

Cryptographic hash functions are used as a building block to build secure cryptography, and using a weak hashing algorithm will fundamentally result in less secure cryptography.

Posted in Technical | Tagged , , | Comments Off on How SHA-1 Is Broken

Phishing: What To Do In The Aftermath

Posted on 2017-01-26 by mike

In the event that you have given away your account details in response to a phishing attack, and either discovered yourself that your account is compromised or you have been told so by IS, then there are some steps to take in the aftermath :-

  1. Change your password to one that is long and strong.
  2. Turn on “two factor” authentication.
  3. Check the signature set for your account; phishers are known to have set inappropriate signatures to be attached to all outgoing emails. The quick check? Send a quick email to your personal email address and check what the signature says.
  4. Check the “rules” for incoming email messages to make sure nothing has been added. Phishers have been known to set up new rules to delete all incoming messages.

 

Posted in Email, Passwords | Comments Off on Phishing: What To Do In The Aftermath

Don’t Automatically Trust Email!

Posted on 2016-12-01 by mike

Email is a very easy to forge – so easy that if you try to impress a hacker by claiming to have forged email, they’ll fall about the floor laughing. So you should not automatically trust email – there are usually indicators showing the origin is suspicious …

2016-12-01_0920

This example is a bit obvious and not only because it has a big warning added by Google :-

  • Look at the email address (“Golan <jjulio@unifap.br>”) – why does the email address not match the name? The name at the end of the email is “Ella Golan” which is included as a comment to the email address, but bears no relation to the actual email address (“jjulio@unifap.br”). Now legitimate emails can have this signature, but it is a useful indicator.
  • The email contents mention Israel, so why is a Brazilian email address being used – the .br at the end of the domain name is a country-based domain using the ISO 3166-1 two letter country code.
  • The subject (“Hey”) is informal to an extreme degree (as well as an example of a poor subject), yet the contents of the email are formal. Suspicious?
  • The wording of the actual email itself are somewhat odd. Of course people don’t always write perfect English, but it is still a useful indicator.

The more dangerous emails tend to be ones that ask you to do something directly :-

Good Day

Please do check attached document
It is secure via Adobe file
Awaiting to read from you
Many thanks

Andrew

Again the English is a little odd. But there are still some additional indicators here :-

  • Is it usual for an attachment to be included? And without mentioning anything about what is inside?
  • Secured by something written by Adobe? Well that is probably more a security insider’s joke. But do you commonly deal with attachments secured in this way?
  • If it is supposedly from someone within your organisation, why are they not using your organisation’s method of sharing files?

The key thing to grasp is that email itself cannot be trusted, but emails not worthy of trust often give themselves away in little ways. Learn to pick up on those untrustworthy little ways, and mark each email with a trustworthiness score … and if it comes out as a bit suspicious, try contacting the sender to confirm they really did send it.

You can of course always ask a colleague to check the email as well.

Posted in Email | Comments Off on Don’t Automatically Trust Email!

Analysis Of A Phishing Attack

Posted on 2016-11-29 by mike

The following is the analysis of a real phishing attack that we have seen, together with some indications of how a phishing attack can be detected. For the impatient, some of those indicators are listed below :-

  1. Are you expecting to receive a document from the person sending it? You may want to check back with them to be sure they really intended to send it.
  2. Don’t open suspicious attachments, but if you do, does it contain something sensible? Sending a PDF document containing a link to a shared cloud storage folder doesn’t actually make sense – the link could be contained within the original email.
  3. Are there inconsistencies in the words? For example does the message mention Google Drive, but the link say Dropbox?
  4. Don’t follow suspicious links contained within suspicious attachments, but if you do, and it takes you to a Google logon screen :-
    1. Are you already logged into Google? You shouldn’t need to re-authenticate that quickly.
    2. Does it actually look like the Google logon screen? It might look similar but are there differences?
    3. Does the location bar (where your browser shows the address of the current page) mention Google? If it doesn’t, back away from the page slowly.
    4. Does the location bar contain a green padlock? If it doesn’t, your login credentials won’t be encrypted which is very suspicious.

And onto the analysis …

A number of people received an email “from” someone at the University containing a PDF attachment together with a suggestion that it contained something worth reading. Opening the attachment from a previously unknown correspondent and with an oddly worded email was the first mistake.

If you do receive such attachments, it is worth checking with the sender to see if it is legitimate.

If you do make the mistake of opening it, the first odd thing to notice is that the attachment is named “Scan…” but contains content that obviously isn’t scanned :-

2016-11-29_1003

So if this is a google drive document, why isn’t it being shared in the normal way? Which looks more like :-

2016-11-29_1009-ano

(I’ve erased the name of the sharer and the name of the document)

In addition, if you hover your mouse over the button you get a pop-up with the link address in :-

2016-11-29-10-04-38

So the text says “Google Drive” and the link says “Dropbox”? Another suspicious indication.

If you download the link from Dropbox (in a controlled manner!), the “document” is actually a web page with a base64 encoded content (with a page title of “Zeuxhaxor” (if that doesn’t look suspicious to you, your suspiciousness needs tweaking)) that sends you onto another web page hosted at http://freecabin.net/.

If you visit the page, you end up faced with the following (without the hand-drawn lines) :-

2016-11-28_1350-hi

This also has plenty of indications that something is wrong :-

  1. Aren’t you already logged into Google? Why do you need to login again?
  2. Look at the location bar (where the two black hand drawn lines are): Why is the address “freecabin.net”?
  3. Look at the location bar again: Where is the green padlock you would see on a secure page? Do you really want to send out your username and password insecurely?

Phishing attacks are intended to dupe you into leaking your username and password combination, and as such the attacker tries to make things look as authentic as possible. However there are usually many small signs that something is wrong – at least wrong enough to check with someone before you leak your account details.

Posted in Active Attacks, Email | Tagged , | Comments Off on Analysis Of A Phishing Attack

How Often Should I Patch?

Posted on 2016-10-27 by mike

The short version: “It varies”.

“Have you applies the latest security fixes from your operating system vendor to your machines?” I asked, trying to a learn a little more about Fred’s security posture.

Fred replies with hesitation, “We apply security patches every three months. The last time we deployed fixes was … um … two-and-a-half months ago.”

I scratched my aching head and said, “Two major buffer overflow attacks were released last week.”

  • From the first edition of Counter Hack by Ed Skoudis, and very outdated.

Applying operating system patches to a system reduces the known risk associated with the operating system to zero, but that known risk starts increasing the moment the system finishes it’s final post-patch reboot. The risk might increase very quickly or very slowly, but the increase in risk looks something like …

risk

 

You might choose to patch when the level of risk reaches 50, but to do so you will need to assess the level of risk associated with every security vulnerability that each patch fixes. And that level will vary on the nature of the vulnerability, and the nature of the server in question.

As an example, a patch that fixes a privilege escalation vulnerability that requires an authenticated account to work with can be assessed as being very low risk for a server that is not widely available (i.e. no Internet access). Whereas the risk assessment for a server that is open to the Internet, and has a very large number of accounts that can authenticate, should be very high.

However carrying out a full risk assessment for each server on the network, and for each patch that is released would be exceptionally expensive.

As an alternative we resort to patching every N days where N is a balance between the risk of known security vulnerabilities, and the disruption to the business of patching. Of course if the disruption of patching is exceptionally damaging to the business, ways to design the infrastructure that allows for patching without disruption should be pursued.

Looking at how long N can be, there is no value of N that is safe. Even if you patch every day, there is still a small window of opportunity when an attacker may succeed. All we can do is reduce the risk.

So is patching every three months sufficient? Well it is better than not patching at all, but no security professional could possibly say that it is sufficient without risking being accused of professional misconduct. And yes there will be occasions like that given in the quote at the top where patching every three months will allow an attacker in.

Posted in General | Tagged , | Comments Off on How Often Should I Patch?

Friday’s DDoS Attack And The Mirai IoT Worm

Posted on 2016-10-25 by mike

It may have reached your attention that there was a significant denial of service attack against a widely used DNS provider – the service provider for organisations such as Twitter, Github, and Amazon. The effect was to make certain services unreachable leading some to believe that the Internet was down!

Some of the major links may provide additional information :-

The details of the attack are still being disclosed, but it appears very likely that a widely known ‘bot army of compromised “Internet of Things” devices was used to perpetrate a simplistic denial of service attack against Dyn DNS. Specifically their DNS infrastructure in the US which may or may not have been a specific Dyn DNS customer.

As a result, their DNS infrastructure was clobbered and because many sites chose a very short caching value, the names disappeared off the Internet.

This sort of attack could be mitigated in a number of ways (not all are realistic or possible) :-

  • Dyn DNS could increase their defences against denial of service attacks. Which I am sure they are doing – they already had defences, but not sufficient for this level of attack.
  • People who run DNS for their company should consider increasing the amount of time the names are cached for. If the Dyn DNS servers disappear off the Internet, it won’t be as noticeable if the values they would have returned are already cached elsewhere.
  • IoT manufacturers should pay far greater attention to the security of their devices. Most IoT customers are not likely to have sophisticated IT professionals available to deal with security updates.
  • ISPs should look at blocking traffic from infected machines to prevent denial of service attacks. There is always the argument that the average customer of an ISP isn’t sophisticated enough to know that his Internet connected curling-tongs are joining into a co-operative effort to blast a DNS server into rubble, but there does come a point where being nice to the naive needs to take second place to protecting the Internet as a whole.

To get a quick peek under the curtain of the problem, let’s take a look at the size of the problem we see here. For October so far, we have denied :-

mirai

Each of those bars represents a single day in October, and the height corresponds with the millions of connection attempts we have blocked. Individual infected devices (cameras or DVRs apparently) is making many connection attempts of course, the following shows the number of unique devices making telnet connections (don’t be confused by the scale – it’s hundreds of thousands so the peak is approximately 1 million) :-

mirai-ip

This is a big problem.

Posted in Active Attacks, Technical | Tagged , | Comments Off on Friday’s DDoS Attack And The Mirai IoT Worm

Free Converters May Come With Unwanted Gifts

Posted on 2016-09-13 by mike

I read this morning a post on another blog site about an experiment that someone tried. They converted a PDF file to a DOC file using five different free web-based converters and found that three of the results were malware-infected.

And previously we have had issues where people have downloaded free software by carelessly searching for it on the Internet, and found versions packed with malware.

The moral of the story? Be wary of searching for tools on the Internet; there are very many useful tools out there – indeed the Internet is constructed to a very major extent from free tools – but there are also many sources of malware.

Posted in General, Malware | Comments Off on Free Converters May Come With Unwanted Gifts