In the last months and years we have seen multiple DDoS attacks based on amplification techniques (DNS, NTP, Chargen, SSDP)
A new amplification attack was spotted in the last week of February (25th – 27th of February).
It is, by far, the strongest amplification attack we had and it is based on the Memcached protocol running on UDP port 11211.
Sources at CloudFlare state the attack reached 257Gbps.
Why the Memcached Protocol?
The answer is simple, it supports UDP which is stateless (which is necessary for amplification attacks), it lacks any form of authentication, and when it turns out it provides excellent ratio in amplification (the difference between the size of the trigger packet and the response).
Amplification ratio in the attack was around x10000 times but the protocol itself is capable of x51200.
The attack stats detected on CloudFlare show UDP datagrams with 1400B size. The number of packets peaked to 23Mpps which measures to the reported total 257Gbps of bandwidth. And that is a lot, it can cause very serious outages.
How does an amplification attack work and how it can be prevented?
To successfully lunch an amplification attack you need 3 components:
- Capability to spoof IP packets, meaning access to a high-bandwidth pipe on ISP that does not do a solid job in securing anti-spoofing
- Application/Protocol that is amplification friendly – UDP based, no authentication, protocol allowing large responses to be created based on small requests
- Reflector servers running a suitable protocol – These are servers that are reachable from Internet and that are going to respond to requests
How does the attack work?
The attackers send a large number of very small requests from a high-bandwidth pipe behind ISP(s), that allow ip spoofing, destined at a large list of publicly accessible application servers. The attacker is spoofing the source IP on all these requests to the target public IP address. All servers are made to respond with much larger packets to the requests, wrongfully directing all that traffic towards the unsuspecting target. The idea is to cripple either the target server/device or to congest its internet pipe, both causing Denial of Service.
How can Amp Attacks be prevented?
If any of the three components outlined above is not available, then there is no way to perform a successful Amplification attack.
Simple steps can make a bit difference.
- ISP should always adhere to the strict anti-spoofing rules and allow outbound traffic only from sources belonging to their IP ranges.
- Developers should think about security when creating new applications and protocols. UDP should be avoided unless low-latency is needed, and if UDP is used, the protocol should have some form of authentication and should never allow a reply to a request ratio bigger than 1. Meaning all replies should be smaller or equal to the request that generate them.
- Administrators should correctly “firewall” their servers and allow access to the services to whomever needs them; and not the whole Internet. Certain types of responses might be blocked from within the application or at Firewall level.
Malware is evolving constantly. The threat landscape is so dynamic that yesterday’s news is not news today. The malware business is a full-blown industry that can easily size up with the IT security industry.
Recent major security breaches:
NiceHash, the largest Bitcoin mining marketplace, has been hacked, which resulted in the theft of more than 4,700 Bitcoins worth over $57 million (at the time of breach) – more than 70 million now. The breach is reported to have happened via vulnerability on their website.
Teamviewer vulnerability – critical vulnerability discovered in the software that could allow users sharing a desktop session to gain complete control of the other’s PC without permission.
By using naked inline hooking and direct memory modification, in addition, the PoC allows users to harness control of the mouse without altering settings and permissions.
Uber – Uber’s October 2016 data breach affected some 2.7 million UK users, it has now been revealed. Uber did not disclose until now and paid a ransom (100k USD). Lawsuits to follow. Information held by a third-party cloud service provider used by Uber was accessed by the two hackers.
PayPal subsidiary breach – ID Theft for 1.6 Million Customers. PayPal Holdings Inc. said that a review of its recently acquired company TIO Networks showed evidence of unauthorized access to the company’s network, including some confidential parts where the personal information of TIO’s customers were stored.
Numerous unidentified security vulnerabilities were found in the platform (bugs that lead to security related vulnerabilities). Evidence of a breach discovered. Forensics are under way.
Equifax – breach allowed 15.2 million UK records to be made public (and 145 Million US records). Bad guys used a known vulnerability in an internet accessible service for initial penetration.
Recent Apple Root vulnerability – Any Mac system running macOS High Sierra 10.13.1 or 10.13.2 beta was vulnerable. There was no real exploit, you just typed root for username and keep the password empty and keep pressing enter and after several tries you are logged in with root rights. A logic error existed in the validation of credentials or simply a bug.
Making malware today has become more available. Malware development processes does not differentiate much from any software development, people use online available sources for much of the code, and will combine it together to their liking and purpose. A lot of the bad guys would also release the code for their creations which can later be changed and further modified (example Petya and NotPetya). Even code stolen from the government cyber agencies is now used in modern malware (example EternalBlue use in multiple malware as a way of effective horizontal spread – used in WannaCry).
Another typical trend in malware these days is to be modular. It will install and run multiple services on the infected host in specific order after the initial infection.
1st stage – there is always the initial infection – usual methods here are unpatched vulnerability of a running service or in the cases of more advanced malware – the use of Zero-Day vulnerability. Example here is the EternalBlue exploit of the SMBv1 service. Usually the delivery of the exploit is via Internet on accessible services or once inside the organization, horizontally meaning within the internal networks of the organization. That stage ends with having temporary access to the system and dropping off the malware in questions
2nd stage – privilege escalation – will try to gather credentials from the infected device in different ways – cracking the specific files on the system that holds the accounts, trying to locate account information on the local drives, or even brute-forcing credentials. These credentials will be leveraged for either privilege escalation on that machine or access to other similar machines on the network and infecting them.
3rd stage – installing a backdoor. Making sure the access is permanent
4th stage – doing the job. Downloading all necessary pieces of malware to finish the job. If that is a crypto virus it will download the tools to encrypt the sensitive files, also change desktop or even download application to show the user the ransom note, a tool to clean keys and traces of the encryption etc.
5th stage – spread, can be done again by using vulnerable services within the organization or by leveraging any credentials that are discovered in the privilege escalating process and using legit sys admin management channels such as WMI and PSExec. Sometimes the spread can be done before or simultaneously with the 4th stage as not to warn the organization of its presence before it managed to infect multiple systems.
Types of malware:
It is very hard to categorize malware these days. Most traditional classification such as: virus, worm, trojan, backdoor does not really cut it anymore as most modern malware shares the features of all of them (again example WannaCry, it is a virus, it is a worm as it spreads itself and it is a backdoor as it does install a hidden unauthorized way into the compromised system, and on top of that does encryption).
Ransomware – attacks aimed at making money by forcing victims to pay for accessing again their personal files
DDoS attacks – attacks aimed at crippling or disabling services at the victim
Attacks aimed at stealing sensitive information – attacks aimed at spying on users and gathering sensitive data – credentials, S/N, banking details, impersonating info (DOB etc.), private communications etc
Zombie/Botnet – attacks that rely on the collective resources of multiple compromised hosts that are managed by a central C&C (command and control). Can be used for multiple things, DDoS, span relay, stealing sensitive information from users
APT attacks – Advanced Persistent Attacks. Specially crafted attacks, usually used in nation-state cyber activities. Example could be the attack versus Iranian Nuclear Program
IoT related attacks – again these blur with other, as normally the compromised IoT devices are used for other kind of attacks (DDoS). This kind of IoT are very typical these days, the IoT devices are cheap network connected devices that were not designed with security in mind. The Mirai attack was a shining example on how powerful attacks can be executed using a Botnet of compromised IoT devices (DYN case). Furthermore, the number of IoT will continue to grow.
Mobile devices – attacks that are specific for mobile devices, most dangerous ones are compromised apps that go under the radar and give away sensitive information from the smart phone (ID theft, or sell personal info to ad companies, or steal financial data (credit card info etc.)). There are no such thing as free apps, they steal data from you and use it in illegal way to monetize it and make profit.
Phishing / Spear-Headed Phishing – Becoming more and more popular, bad actors will put in the effort now to get to know the victim so they can deliver the malware content in a shape and form that is interesting to the target
Some top Cyber Security Trends:
- Less number of security breaches (due to more investments in in IT Security) reported globally but more impact upon breach.
- More time is needed for the detection of breached (average time in 2016 was 80.6 days, in 2017 it is 92.2 days)
- Predictions of crime damage costs to sky rocket in the next 3 years (by 2021) to 6 Trillion USD
- Successful phishing and ransomware attacks are climbing
- Global ransomware damage cost estimated to exceed 5 Billion USD by the end of 2017
Data was gathered by CSO 2017 Cyber Security report (csoonline.com)
Summary of the evolution of Security Controls
- Intrusion Prevention (Advanced Network Threat Detection) becomes a must
Advanced IPS systems have replaced the traditional status firewalls. They incorporate multiple security technologies (signatures, behavior analytics, heuristics, sandboxing, central intelligence feeds etc.), to be able to successfully detect intrusion events and malware.
- Logging and Alerting platforms more important than ever
Logging and alerting are hugely important for each organization to be able to both proactively secure your network but in case of a breach to re-actively do forensics
- Data Loss Prevention is gaining momentum
DLP is becoming more popular as numerous breaches that year were connected to leaked sensitive information (ID theft in the Equifax and Uber)
- Endpoint security/malware is again in the front lines of combating malware
The focus of the security has shifted in the recent years from the network to the endpoint. Network and endpoint security controls should collaborate to create a strong security posture for your organization
- Systemwide threat defense is becoming necessary to adequately protect your organization
Security has become closely connected to intelligence. All major security vendors syphon off as much data from the internet as they can just, so they can filter through it in a strive to find first the zero-day exploits and provide first adequate protection for their customers. All parts of the network infrastructure can be used as sensors and deliver intelligence data to a centralized place that provides the analysis (big data).
New extremely large Botnet is being built – Nicknamed IoTroop or IoT Reaper
Remember Mira? The worm that prayed on unsecure IoT devices. It managed to spread and gain control using quite a simple method to gain entry – reusing the hard-coded or default password for IoT devices which were well-known by then, and the spreading was done via the EthernalBlue SMB exploit.
Now security researchers at CheckPoint and NetLab360 claim there is a new botnet being formed (called IoTroop or Reaper). This time the methods used to gain unauthorized entry are more sophisticated – no more trying to exploit traditional hardcoded and default password or to brute-force easy passwords, the Reaper malware tries to exploit different known vulnerabilities that IoT and home network devices have (more than 12 different popular vendors including Linksys, Netgear, D-Link, AVTECH and GoAhead have numerous vulnerabilities already discovered, list and links in the related articles below). The Reaper code constantly evolves, the guys behind it seems to add new exploits into the code based on new vulnerabilities being published openly on the Internet.
Another key difference between Mirai and Reaper is that as Mirai was extremely aggressive in scanning and trying to hop between network and infect other systems (which makes it easily detectable by security controls), the Reaper is stealthier in its way of spreading and tries to stay under the radar for as long as possible.
The likelihood of a successful exploit is quite high due to the fact that traditional home users do not tend to pay much attention to security and are very likely not to have patched their devices.
All sources claim this new botnet will be much bigger and stronger than Mirai – The NetLab360 researchers are claiming the C2 communication they see confirms more than 20k bots per control server and they have estimated more than 2 million vulnerable devices out there that are ripe for the infection. There is a great possibility the total number of bots can swell quite heavily in the coming weeks.
What is at stake here? How will this botnet be used?
At this stage, it is still very early to predict how this botnet will be used but most likely DDoS attacks are on the roadmap – the previous smaller Mirai successfully managed to do a DDoS with more than 1Tbps of traffic (both to Dyn internet infrastructure giant which brought down many popular web services down and French hosting company OVH).
IoT general security problems
The problems with IoT is the inherited lack of security (saying inherited because manufactures do not take security into account when building the devices) and the ever-growing number of IoT devices being deployed by users who are not savvy in networking or security best-practices (changing of default passwords, patching, lowering the attack surface). These two large issues combined with the large number of devices out there (the trend is more and more IoT devices to be manufactured and connected online) really poses quite a large security threat to the Internet community.
Some good news:
Different efforts to secure IoT devices are on the roadmap, US lawmakers are trying to pass a legislative action into forcing hardware IoT manufactures to start taking security into account and not spill out junky unsecure devices.
Also, some of the creators and botnet administrators of the Mirai, have now been arrested and expecting trial and effective sentences. This clearly shows there will be consequence for all actions related to running a botnet and malicious cyber behavior, this must be a deterrent for any future black-hats out there.
New ransomware on the loose
Remember WannaCry and Nyatya, aka NotPetya (a variant of Petya) ransomwares. There is a new one around the corner (initial spotting is on the 24th Oct), again spread predominately in the East Europe (Ukraine, Poland, Bulgaria) and Russia but also in Japan, Germany, South Korea and the USA. It is a changed version of NotPetya. It uses usually a drive-by download on hacked sites to trick the user to run a fake Flash Player installer. The horizontal spread within the compromised network this time is NOT based on the EthernalBlue SMB exploit, but Bad Rabbit uses an open tool MimiKatz to try to extract any login credentials on the infected machine and reuse them to spread itself via legit Windows management protocols such as WMI and SMB to other devices. It also uses a hard-coded list with most commonly used passwords to try to brute-force credentials access.
Most current antivirus and endpoint protection software will detect Bad Rabbit and there is a known Windows Registry based vaccination that can prevent a machine from getting infected, but Bad Rabbit shows the ransomware trend is still strong and not likely to quiet down anytime soon.
As you might be aware this Friday (12th of May 2017) there was a massive outbreak of a new type of crypto virus dubbed WannaCrypto aka WannaCry. The UK was hit the hardest, especially in the Health Sector, with Spanish Telecom – Telefonica, along with Portuguese & Argentinian telecoms and Russia.
How does that affect the UK? – The NHS is badly crippled (more than 30 hospitals reported malware spread), patients are being turned away, important data such as scans and personal test results are lost and planned surgeries are cancelled. We could easily say that lives are at stake as sometimes more critical operations had to be postponed or done without important tests/scan results.
About the attack:
The WannaCry outbreak is the quickest spread of malware ever (over 100 countries with many affected endpoints in a matter of hours).
This link shows the spread over time. The animation was made possible because the authors of MalwareTech, could hack into one of the Command and Control domains and gain control over it so they can trace the incoming call home requests from the hacked machines (keep in mind that this does not depict the whole spread of the virus as MalwareTech operated in EST time and the spread in Europe and Asia was already going for some hours).
Another unique thing – the virus exploited a vulnerability in Windows OS systems that was used for years by the NSA and GCHQ government agencies but only revealed for the public a couple of months ago (by the ShadowBroker dump on the 14th of April)
Here the Security Industry in the world are divided in their opinions.
One opinion is that the vulnerability should have never been leaked so bad guys would not be aware of it and hence would not be able to exploit it. This is usually the opinion of non-hardened security guys since it loudly shouts – Security through Obscurity or the ostrich effect.
The second opinion is that not a single discovered vulnerability should remain hidden, the more people are aware of the threat, the more people can react to it. General security admins had more than two months to patch their systems as official patch from Microsoft was released quickly after the leak (official patch was released on the March 14th). One important note was that many government, slow and big organization (due their sheer size and bureaucracy) are still running Windows XP and since XP is out of life and support, there was no patch for it – An example for such organization was the NHS.
The virus had a kill switch designed by its creators, a hidden nonsense long domain that if alive will make the virus stop spreading. A researcher found it by looking at the malware (reverse engineering it) and he was not sure why is was there, so he registered the domain and luckily helped in stopping the spread (the malware checks if that domain is alive before attempting worm like spread in the same L2 network)
The Onion Router
Botnet Command and Control centres are located in TOR (the onion router)
OK, that has been done before so not quite unique but very hard to implement as the malware needs to download a whole lot of files to the end user device to make this work. The technique is adding anonymity to the guys running the botnet (hence the creators of the malware). CC is very important for Crypto Viruses as these are usually created not to destroy but to extort money out of people who want their files recovered and recovery is done via this backchannel by supplying the key. If people pay and their files do not get recovered the rumour spreads and people accept their losses and do not pay anything. The current estimation for infected systems with encrypted files is more than $55 000 and attackers want an average of £300 for endpoint recovery, that amounts to a hefty ransom sum (if 20 000 users pay, that is over 6 million dollars).
Heavily customised and detailed interaction user/victim – The information displayed to the user explains in detail what has happened and what needs to be done (how to pay) to recover your files and it is translated and shown in 28 languages. The presentation (ransom note below) is done via an executable file and offers many options.
How does the attack work?
The malware uses a vulnerability in the SMBv2 remote code execution in Microsoft Windows. The exploit (codenamed “EternalBlue”) has been made available on the internet through the Shadowbrokers dump on April 14th, 2017 and patched by Microsoft on March 14. Usually, SMB’s are not directly connected to the outside world, the attack point was via email as well as the spread or a quick vertical scan for port TCP 445. After initial infection, the virus spread like a worm, probing all hosts within the subnet for open SMB ports and trying to infect them. Also, quite unique for this virus is that it uses different services for performing different tasks, aka Modular Service approach – for example, it uses different services for file dumping, for finding files with particularly important extensions and encrypting them, for disabling the shadow copy/system restore, for presenting the screen with the note/demands/payment information – yes that is a separate executable file.
- Patch – regular/automated patching of windows systems would have prevented the malware to do any damage by removing the vulnerability that should be exploited
- Security Training – organisation employees should be aware of the dangers of executing files from emails or clicking on links
- Advanced malware protection on the endpoints – could stop the execution of the malware in the first stage or downloading and installation of the malware in the second stage
- Email security – strong email security would have greatly reduced the spread of the malware or disabled any executable files from being delivered to the users (depends on tuning, but even files with unknown status should be held back and guaranteed before further analysis can be done) or will check URLs in mails and you determine if you able to click on them (more modern Email protection systems have built in Web URL protections)
- Web security controls – would help in cases when the infection point happens by URL link in email
- Advanced IPS with Command and Control botnet detection – would not be effective in the first minutes of the spread but will quickly update itself (depending on vendor) and will detect/drop outgoing CC connections. Traditional firewalls with stateful technology would not help except by blocking SMB traffic based on TCP 139/445 ports (however traditional firewall deployment does not scan east to west traffic and traffic in the same L2 network)
- Backup your important information in a separate secure location – a reactive approach but very effective towards crypto viruses
Mitigation techniques (after the attack)
Unfortunately, after files are encrypted, it is close to impossible to decrypt them without having the proper key. Most endpoint protection companies give you a list of things to do to remove the virus, hinder its spread, and be immune in the future but not to recover files. General recommendation varies between different vendors but most of them follow these steps.
- Make sure your endpoint protection software is running and not disabled by virus.
- Download latest signatures
- Install the PATCH from Microsoft (MS17-010) which fixed the SMBv2 vulnerability
- Scan all systems, the virus is detected (usually by the name MEM: Trojan.Win64.EquationDrug.gen), and reboot the system (before that make sure you have the patch installed).
Indicators of compromise
How to check if your network has the malware. Typical indications are listed in the link below
Basically, you must request certain IPs on the Internet and you have seen a file transfer with the mentioned SHA-256 fingerprint (keep in mind there is small variations of the virus so there is multiple fingerprints)
+44 (0) 131 516 9771
1745 Broadway, 17th Floor, New York, New York 10019
001 646 2572 160
88 Wood Street, 10th Floor, Wood Street, London, EC2V 7RS
0203 697 0353
Waterfront Plaza, 1750 Montgomery Street, First Floor, San Francisco, Ca 94111
001 415 275 3363