Monthly threat update #15: August

• This month we have learnt about two interesting NSA/GCHQ capabilities: ORBs (Operational Relay Boxes) harvesting by 5-eyes and GCHQ catalog of exploit tools which sheds some light on GCHQ cyber capabilities.

• Verizon RISK Team blogged about particulary interesting defense concept.

Threat update #14

Study about surveillance by eavesdropping on Web Cookies.

Threat update #13

XML-RPC functionality in Wordpress (and probably other CMS tools) is used for DDoS attacks.

Threat update #12

Attack on SSL by hacking the CA and creating rouge certificates.

Threat update #11

Example of simple GPS jamming technique.

Threat update #10

Excellent overview and analysis of Stuxnet and whole 'Olympic Games' campaign. Good reading that complements very detailed technical analysis of this malware.

Threat update #9

(in Polish)

Wreszcie coś o APT (Advanced Persistent Threat) w polskim internecie:

- Nowe formy wirtualnej wojny

- Cyberataki typu APT nowym frontem wojny

- Instytucje rządowe i firmy ofiarami ataków typu APT

- Ocena ryzyka lekarstwem na cyberataki typu APT

A wszystko to za sprawą raportu firmy Deloite zatytułowanego Cyber Espionage The harsh reality of advanced security threats.

Dla jeszcze nie przekonanych o potrzebie zaadresowania ryzyka związanego z APT odsyłam tutaj: top five threats to global businesses.

Threat update #8

Recently disclosed privacy threats posed by the US and UK goverments:

- PRISM

- Collecting phone records

- Undersea cable tapping

Threat update #7

Some insights about corporate cyber episonage in Great Britan from director of GCHQ (interview from pre-PRISM era).

Threat update #6

Internet census experiment showed us all how easy it is to create a botnet. AusCERT further analyzed data available from the experiment..

Key facts:
1) there is ~8.88 vulnerable devices per 100 class C ranges out there;
2) scanning 10 IPs/sec would take 4.78 minutes to find such device;
3) due to huge number of such unprotected devices (~1.2 million) available, it could pose threat similar to one with open DNS resolvers issue (threat update #4).

Threat update #5

Some network attacks (with proposed countermeasures) that every security conscious organization should take into account in it's threat model.

Threat update #4

Some insights about ... "the largest known DDoS attack ever on the Internet" ... (according to New York Times), from ClouldFlare (service provider that helped mitigate the attack).

Some conclusions:
1) as this attack showed anycast technology seems to be very effective against this kind of attacks.
2) open DNS resolvers are nowadays threat number one when it comes to DDoS attacks (according to Open Resolver Project there are 28 million of resolvers that pose a significant threat).

Threat update #3

According to Microsoft's latest threat report HTTP based malware are on the rise:

... "Detections of the generic family JS/IframeRef increased fivefold in 4Q12 after falling off significantly between 2Q12 and 3Q12. IframeRef is a generic detection for specially formed HTML inline frame (IFrame) tags that redirect to remote websites that contain malicious content. The increased IframeRef detections in 2Q12 and 4Q12 resulted from the discovery of a pair of widely used new variants in April and November 2012." ...

Here's some statistics (also from the report):

Family 1Q12 2Q12 3Q12 4Q12
JS/IframeRef* 2.3% 11.3% 1.7% 13.6%
Blacole* 7.0% 5.4% 5.0% 5.1%
JS/BlacoleRef* 3.3% 4.1% 5.8% 4.2%

More client machines infected probably means more web servers spreading the malware.

Threat update #2

Linux/Cdorked.A malware (backdoor) has been detected recently. It is known to affect Apache, nginx & Lighttpd web servers. Detailed analysis can be found here and is continued here.

It is also worth to note another Linux malware (rootkit) that has been recently found in the wild and was analyzed by CrowdStrike.

Threat update #1

Exploit for CVE-2013-2094 (Linux local privilege escalation vulnerability) is publicly available here.