Two new threat intelligence papers CSO's will want to read

Industrial Espionage in the Global Energy Market

Since 2005, HBGary has been tracking variants of malware created and originated in China that indicate a complex cyber espionage operation targeting multiple industries, including the energy sector. In this new whitepaper, "Industrial Espionage in the Global Energy Market," HBGary provides technical details about these cyberattacks as well as the type of critical data targeted and successfully obtained and sent back to China. This report is restricted release to qualified executives, government, and law enforcement only. Available from hbgary.com

Threats in the Age of WikiLeaks

HBGary has released its threat report ‘Threats in the age of WikiLeaks’ – CSO's will want to read this report. Cyber-threats are evolving fast but we must stay ahead if we are to secure our information systems and our brands. With leak platforms (WikiLeaks, AnonLeaks, CrowdLeaks, InfoLeaks, People’s Liberation Front) comes the increased risk of insider threats and acts of information terrorism. Unlike traditional APT which damages over years, leak platforms represent immediate damage to stock value, profitability, and brand. Acts of cyber terrorism can disrupt systems and business continuity. To date, the severity of this threat has been underplayed in the press – this report exposes the true and dangerous nature of the threat. The report provides immediate and actionable data to help you detect potential insider threats and attacks. This report is restricted release to qualified executives, government, and law enforcement only. Available from hbgary.com

Rootkit Evolution

Over the last few years HBGary has researched significant advancements in rootkit technology. We are pushing the envelope of what’s possible in the windows kernel. I’m glad to say that we haven’t seen anything in the wild that is remotely close to what we have developed in our labs. So, we are still ahead of the threat. This keeps our Digital DNA ‘frosty’ so-to-speak, but probably further ahead of the threat curve than it needs to be. That’s not a bad thing for people protecting against APT – we want to stay one step ahead of the bad guys. For those who have followed my work in rootkits over the years you probably noticed I stopped releasing public material on the subject years ago. This is because I didn't want to educate the bad guys on how to develop this stuff. But, that doesn’t mean the research has stopped – just that some things should only be briefed behind closed doors.

Cyber Conflict and State Power

There has been a rapid change in the global security paradigm. Cyberspace has fundamentally changed the stability between state and society. New conflict groups are not tied to any one state. There is a boom in conflict. Dangers come from many sources, not just military. The distinction between civilian, domestic, guerilla, terrorist, and criminal is blurred – small numbers of individuals can inflict great harm upon the establishment – perhaps more-so than any army. Recent activities have been directed at states themselves (Egypt/Iran/US/Estonia/Georgia). International bodies have been notably absent in their duties to protect its members (UN/NATO).

The security environment is defined by the state’s weakness in cyberspace. The borders are permeable because the information flow is weakly controlled – there is no better example than Wiki-Leaks. The threat today is not from the projection of power, but instead from the projection of instability. Power projection defines a state's ability to influence and enforce their policy globally, which can be seriously harmed by not applying equal effort in cyberspace (Georgian conflict). You need a passport to travel to a foreign land but can reach that country's marketplace in milliseconds via cyberspace, without ever crossing a checkpoint. Any group can influence a state's population using social media outlets, including but not limited to instigating riots or uprisings (Egypt/Iran), as well as spreading disinformation.

The U.S. war on terrorism is an example of this fight. The shadowy cell-based terrorist network cannot be linked to any one state. We live in an increasingly borderless world system. Groups are recruited and mustered entirely on the international stage of cyberspace, and include members from many countries. New conflict actors are flocking to cyberspace for communication, organization, and as a medium of attack – both directly through criminal assault and through influence campaigns and control of media. Threat actors include transnational criminals, warlords for profit, economic insurgents, state intelligence, and agents of industrial espionage.

Cyber is a zone of lawlessness and conflict. While not armed in the traditional sense of explosives, the landscape is ripe for soft munitions that can alter industrial operations with a few lines of code (Stuxnet). The traditional means of peaceful activists have migrated to acts of criminal nature, favoring methods such as denial of service, intimidation, theft, harassment, defamation, disinformation, hacking, and cyber-thuggery. Peaceful protests such as sit-ins or boycotts have been replaced by violations of Federal statutes without fear of prosecution, and states are increasingly challenged to bring charges against the perpetrators due to the ability to exploit the world stage of cyberspace.

When the citizens of one nation wage cyberwar against the government of another, the international treaties that trigger the right to wage war (jus ad bellum) are absent, and the conduct of protecting a nation under these acts are not governed (jus ad bello).

The implications of all nations not cooperating to develop and enforce regulations, treaties, extradition, and establishing cyber checkpoints will continue to occur with increasing severity.

-Greg Hoglund

Malware Persistence in the Cloud

The cloud is certainly going to change some things about malware infection. When a desktop is reset to clean state every time an employee logs in, you now have to wonder how malicious attackers are going to maintain persistent access to the Enterprise. This is similar to what happens when an infected computer is re-imaged only to end-up infected all over again.

There are several ways to maintain persistent access without having an executable-in-waiting on the filesystem. Memory-only based injection is an old concept. It has the advantage of defeating disk-based security. One common observation is that such malware doesn't survive reboot. That is true in the sense that the malware is not a service or a driver - but this doesn't mean the malware will go away. Stated differently, the malware can still be persistent even without a registry key to survive reboot. This applies to the problem of re-infection after re-imaging (a serious and expensive problem today in the Enterprise) and it also applies to the future of cloud computing (where desktop reset is considered a way to combat malware persistence).

The most common method for persistence without reboot is re-infecting the system from a neighboring, already infected system. It has sometimes been called the "Hack Finn" model - two or more malware programs that know about each other. Unless you kill both of them simultaneously the one will re-create the other. In today's world, the neighbor doesn't need to be physically nearby - it can be anything that has some access path to the other machine. This neighbor could be a social networking peer, a shared desktop (think exploited .ini), or a machine with lateral domain credentials.

Another way to maintain access is to store crafted (exploit) data in a commonly used document - think PDF exploit but for google docs. User's in a cloud based environment are going to have persistent data storage, whether this is up in the cloud or down on a USB stick. When the execution environment is constantly reset, as it might in a desktop cloud, the attacker can move method of persistence to the data itself. The malicious code must obtain execution cycles - think of the cloud based desktop simply as an execution space. The user opens said boobytrapped document every day as part of their work, and the malicious code activates. Or it can be delivered via a system used on a daily basis, such as an exploited image on an ad-banner, or the little calendar program in the corner of your timecard system.

For the window of time the user is interacting with the desktop, the code has execution cycles. This is when data is most at risk - this is when other documents are open, other social network contacts are online, and the user's access token is live and can be used to access other resources.

Remember, the attackers always adapt to new environments. The cloud just provides new ways for our adversaries to attack us.

Intel Validates the End Node

In the security industry, there is an obsession with the perimeter, which is why this Intel-McAfee announcement, at first glance, seems so surprising. McAfee represents visibility and control at the end node - the environment where the bad guys actually live. Intel's investment into end-node security is significant because it represents a fundamental shift in security . Adoption of mobile technology is faster than ever before and the chip-war cannot continue to be based solely on horsepower or power consumption - there needs to be a platform and security has to play a big part. An integration between hardware and software is natural and can create a platform for the future mobile user. To understand this acquisition, you have to think ahead. Intel knows the future is in small, always-on access-to-the-cloud -- and they can obviously deliver the horsepower required for immersive environments such as High-Def, 3D that will become the norm. But the future is not without risk. To create a secure online experience for the user, Intel understands that the security features in the chip need to be united with application layer surfaces. While the benefits for Intel are clear, this deal also might be the best thing that ever happened to McAfee. They have the domain knowledge about hooking into software flows and scanning for patterns, but the end-node for McAfee is the PC -- not the future devices. Intel's business has always been about massive scale and this might push McAfee into the future. This event may signal an emergence period of security integration into the end node. The perimeter is vanishing daily - this event just validates that the end-point is where the action is.

Blackhat is almost here again! This has always been one of the coolest security shows with great research presentation. The show is a great place to catch up with friends and colleagues (most of whom I only see once a year). In many ways, Blackhat is the reason I decided to get into the security industry back in the late 90's - I lived very near Jeff (the founder of Blackhat and Defcon) and he inspired me to reach for something beyond just a network admin job. I am glad to see that both Jeff and Blackhat have survived. Hope to see you all at the show!

A dose of clarity for the "APT"

Finally a dose of clarity for the "APT". It is an overused word, one used to sell security products, even if these are the 'same' security products you have been using for the past 10 years. In his recent Spotlight report, Josh Corman of The 451 Group really laid out the term, where it came from, what it means, and more importantly WHAT IT DOES NOT mean. I posted a similar blog on the topic a while ago and got comments like “it’s the person, not the malware”. I know that. I’ve been saying that for years, but how the term APT is used today by most people make it sound like it's ONLY malware. In fact, it’s not only malware - it’s the actors and their intent. Josh gets this -- more importantly he felt the need to speak up about it. I agree, it’s about the ADVERSARY. Malware is just a tool, one of MANY that these adversaries use. Focusing on one aspect of security is not going to make you secure; rather, it’s understanding what they are trying to get. I would argue a 'slightly' different take in that I don’t necessarily believe it’s only scarce resources these adversaries are after. They want actually anything that gets them 'closer' to the info they are seeking. This could be money, IP, marketing plans, hiring plans, IT resources, or personally identifying information. Because while APT were at one time ONLY focused on military, they’ve expanded.

I also applaud Josh’s note that APT uses existing tools. Other experts seems to think this is not the case, or that they don’t use packed malware, or that APT don't use botnets. Why wouldn’t they? It seems the more that someone tells me what APT isn't, the more it becomes clear they have no idea what APT really is. If APT use existing malware, which I’ve always maintained, then packing is par for the course, because it's a cheap way to defeat signature based detection definitions at the gateway and host alike. Perhaps the APT did some recon into the network and learned that using XYZ packer would defeat the AV solution at the desktop. The US government created the term APT to characterize a class of threats originating from Chinese and Russian state sponsored and criminal elements, not to classify a type of malware.

Since the government coined the term "APT" it has always been about Russian and Chinese attackers, BOTH criminal and state sponsored. For the government, it's very difficult to draw a line between the two. If you understand information operations, then you know that APT will use any and all means at their disposal to achieve the mission objective. If this means use of packers, so be it. The same applies to _any_ rule or definition someone puts in my face telling me what APT is and is not. An IO campaign will include a full spectrum of capabilities. In the context of cyber, each attack on a government facility, contractor, or commercial entity could be a single operation that is part of a larger campaign. Operations could be designed to assume false personas such as impersonating college students in a dorm room, or even a false-flag - impersonating the intelligence service of another foreign country. If you truly know what APT is about, you know that you can't start boxing it up and packaging it.

As Josh pointed out, the adversaries are constantly evolving and adapting. The old models are being defeated. The government has known about APT for a while and that new approaches to enterprise security had to emerge. This is one of the reasons that the USAF and DHS both funded HBGary to address this evolving threat. Our company and our technology are pushing the envelope forward.