Posts

"It's Not All Black And White" or "Why You Should Switch From Blacklisting To Whitelisting"

I think the title says a lot here: if you want to defend your information systems, you should switch from blacklisting to whitelisting. But what does that mean? Most people hear "whitelisting" in terms of CND and think "application whitelisting". But there's so many more places to do it! You already hopefully do outbound whitelisting on your firewall. You aren't really  allowing any system to talk out on TCP/3389, right? You do have a DEFAULT:DENY or DENY ANY,ANY down at the bottom of your firewall rules, right? But have you considered whitelisting outbound web traffic at your proxy as well? Most people think of their web proxy reputation lists as block lists, and for good reason: most of them are incomplete. But did you ever consider that maybe that incompleteness as a defensive measure? If you block unknown websites at your web proxy, you're going to block a huge amount of malicious websites. You're probably thinking to yourself but what abou
Post a Comment
Read more

"WannaCry Is North Korea!" or "Rich Headers Win Again!"

http://researchcenter.paloaltonetworks.com/2017/04/unit42-the-blockbuster-sequel/ https://twitter.com/neelmehta/status/864164081116225536 Samples from Unit42: a4b3404fffc581ab06d50f3f2243cb56 cab10f19ae0a6deeb7be7bd0b46a0f5f d511fa33bb3c9a238e4b4eae7bae6e84 WannaCry sample from Neel Mehta: 9c7c7149387a1c79679a87dd1ba755bc All 4 samples share significant overlap in their Rich Headers. In fact, the set of IDs and Value pairs in the Rich Headers from the 3 samples I listed above are fully contained within the set of ID and Value pairs in the Rich Headers of the WannaCry sample from Neel Mehta's Twitter post. The WannaCry sample contains several header pairs that are not present within the other samples - I do not know what tools they represent so I am unable to determine the significance of this particular data point. I don't know how significant this overlap is, but in my own repository that particular set of ID and Value pairs was unique to WannaCry and malware att
Post a Comment
Read more

OLE: Not to beat a dead horse...

Since I keep seeing new malicious OLEs, I wanted to do a few posts about writing yara signatures for them. I don't have the time right now for a full post, but I'll share a few preliminary links that I'll be referencing for metadata extraction. [MS-OLEPS]: SummaryInformation https://msdn.microsoft.com/en-us/library/dd942545.aspx [MS-OLEPS]: FILETIME (Packet Version) https://msdn.microsoft.com/en-us/library/dd942482.aspx [MS-DTYP]: FILETIME https://msdn.microsoft.com/en-us/library/cc230324.aspx
Post a Comment
Read more

Operation Cloud Hopper

Although long, a highly recommended read: https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-report-final-updated.pdf One thing I want to call out is Table 3, where PWC clearly demonstrated an interesting composite indicator of a TTP that appears to be specific to this operation. Specifically, the use of @india.com registrants and ITITCH nameservers. If you have the ability to pivot on this TTP, then you're likely to find a significant number of other similar domains. Happy hunting, y'alls!
Post a Comment
Read more

Your report is bad and you should feel bad

Image
Kaspersky Labs published a report today discussing overlap between Turla and Moonlight Maze. https://securelist.com/blog/sas/77883/penquins-moonlit-maze/ From their conclusion: An objective view of the investigation would have to admit that a conclusion is simply premature. For shame, Kaspersky.
Post a Comment
Read more

APT Rosetta Stone or A Plea To The Industry For Shared Names

Last night one of my CTI sharing groups was discussing a report from FireEye regarding APT29 and domain fronting ( https://www.fireeye.com/blog/threat-research/2017/03/apt29_domain_frontin.html ) when we all realized we had no clue who APT29 is in our own internal systems.  One member finally shared this mess: https://www.google.com/url?sa=t&source=web&rct=j&url=https://docs.google.com/spreadsheets/d/1H9_xaxQHpWaa4O_Son4Gx0YOIzlcBWMsdvePFX68EKU/edit&ved=0ahUKEwjNhd-novjSAhVBC2MKHYglAgoQFghIMAQ&usg=AFQjCNFe0KMzzgH09bdHImCB5VxrXo2gIA&sig2=1CI3ffYHiBNLliisz6EbAw Nobody can agree on names.  Even to the untrained eye it's obvious that there's a communication issue present here. The most amazing thing is how simple it would be to fix all of this, but none of these vendors have because #branding #sorrynotsorry #aptlolwut . The excuse "but we'd have to rename everything" is silly, because if you want to present the image of being a quali
Post a Comment
Read more

[repost] Cyberespionage, and the Need for Norms

This is a quick one, but I wanted to call out a piece shared with me by a peer in the industry: http://harvardpolitics.com/covers/cyberespionage-need-norms/ A truly key point here: [C]onsider how almost every recent cybercrime is called a “cyberattack” by the media. North Korea’s hack into Sony Pictures, China’s theft of American personnel records, and Russia’s attack on Estonian online infrastructure were all dubbed "cyberattacks," despite their significant differences. The repeated use of this simplistic label has muddied dialogue surrounding this issue by obscuring the unique qualities of different cybercrimes—making it difficult to keep track of what actions warrant retaliation. This has been a pain-point of mine for a few years now, but I have yet to convince many others in my field that computer/network espionage (CNE) is explicitly NOT an attack. Also, I hate the prefix cyber. It has no meaning. For more info on this, see: http://willusingtheprefixcybermakem
Post a Comment
Read more