2018: The rise of Cryptominers

They’re everywhere. Really. Everywhere. And if you don’t think they’re on your systems, think again. In the first 3 months of 2018, unique cryptominer types increased from 93,750 to over 127,000.  Compare that to ransomware, which was doing a booming business from 2016 into 2017.  New ransomware variants actually declined from 124,320 to 71,540.  Exploit kits are also down. That’s significant, because cybercrime is all about efficiency and profit. Illegal or malicious cyrptominers have evolved from a nuisance infecting individual systems to a pervasive threat on enterprise systems.

Per researchers at Cisco TALOS

“The number of ways adversaries are delivering miners to end users is staggering. It is reminiscent of the explosion of ransomware we saw several years ago. This is indicative of a major shift in the types of payloads adversaries are trying to deliver. It helps show that the effectiveness of ransomware as a payload is limited. It will always be effective to ransom specific organizations or to use in targeted attacks, but as a payload to compromise random victims its reach definitely has limits. At some point the pool of potential victims becomes too small to generate the revenue expected.”

The lure of easy money is unmistakable. Cryptominers offer “continuous passive income” versus the risk of not getting a ransom with ransomware.  And you can’t beat the return on investment. It’s pretty much pure profit, since the miners use somebody else’s resources.

The trend actually took hold in 2017, and has not stopped escalating. ZScaler reports it blocked more than 2.5 billion attempts over the past 6 months. On April 12, Infosecurity Magazine reported that cryptomining spiked 500% on corporate networks.  This is no longer a single-machine effort, but a massive, coordinated hunt by botnets for vulnerable systems. Researchers report that within the space of 24 hours, attackers tried to compromise 30% of networks globally using botnets to find vulnerable servers and web applications. PATCH people!

Mining is resource-intensive.   Monero has moved past what standard user systems can supply. Now, it requires graphics cards or preferably application specific integrated circuit ASIC chips.  We’re seeing miners shift to mining alternative currencies to Monero that can be mined using any CPU.

The impact is significant in terms of wear and tear on hardware. Miners usurp corporate bandwidth. They cause performance issues, and we know that uptime must be all the time. What enterprises should also take note of is that they could be at risk of compliance violations because of the unidentified activity on their corporate systems.

PIVOTS:  In 2016, we saw ransomware pivot and morph from attacking individuals to leveraging vulnerabilities on servers and networks and attacking institutions. We’re seeing the same thing happen with cryptominers, as criminals discover how to make better money, faster. They are hunting for web servers and applications they can exploit via unpatched vulnerabilities, both old and new.  Once they can compromise a system, they install the mining software.

Now, it appears that criminals are repurposing malware as miners, which is not a good thing when that malware happens to be ransomware. Case in point: XiaoBa. Researchers at Trend Micro report this new variation was not modified well, so that it is destructive. The sloppy code destroys files and crashes PCs. While his isn’t widespread, and will likely be reworked, the damage has been done to numerous systems. And raises the bigger issue: what will attackers rework next, and whose systems will be at risk?

MINERS: The one to watch for is Coinhive, as the most impact and pervasive.

BOTNETS:  Smominru: this is one of the biggest, most successful cryptojacking botnets active. So far, it’s netted $2.3 billion by leveraging the EternalBlue exploit to infect and enslave computers as part of the botnet. At more than half a million bots, the system is massive, and had evaded sinkhole attempts against it.

TARGETS: Because browsing time by users is high, nudity/porn sites, or those with streaming media, offer the most value for miners. However professional and marketing services are also rating high, bringing miners onto corporate networks.

Android and mobile systems: Kaspersky reports they found malicious mining apps in the Google Play store, imitating legitimate apps like games and VPNs, and notably sports streaming apps.  Some of these were downloaded over 100,000 times.  The criminals know this is a numbers game, because mobiles aren’t high performance and the risk of detection is higher.   Mining has become a frequent topic on darkweb forums, as members share knowledge, experiences and advice to improve their success.

Coinhive has evolved over time. Numerous compromised sites use JavaScript obfuscation and the final code presents itself as Google Analytics JS to viewers.

ATTACKS:  ZEALOT was discovered by researchers at F5 in late 2017.  This Monero cryptominer installed itself on vulnerable Apache Struts systems, leveraging the EternalBlue and EternalSynergy exploits.  PATCH, people!

A recent attack is leveraging an older ISS vulnerability on Windows servers. Microsoft was going to let IIS Internet Information Services 6.0 run its course and die. But there was a WebDAV exploit posted on GitHub in March 2017.  The vulnerability, CVE-2017-7269, is very similar to the NSA “Explodingcan” exploit that was part of the infamous Shadow Broker’s Good Friday dump. Attackers used that flaw to install cryptominers.  We all know that once a vulnerability is made known, attackers pounce and exploits follow.  In this case, the exploits has a new ASCII shellcode that contains a return ortiented programming ROP chain. This uses instructions that are already loaded in memory, so there is no need to write or execute further external code.  This enables the attackers to bypass security mechanisms, like executable space protections and code signing.

Lateral movement. Those two words should scare every security analyst. It’s what we fight to prevent. We don’t want the attacker to get to move through our networks and gather data. But this is the hallmark of sophisticated ransomware attacks on enterprises, and it’s now part of cryptominers.  In a report by Red Canary, they detail how an adversary mixed lateral movement with cryptomining on a Windows system. We know there are processes to watch over very, very carefully in Windows. In this case, they found numerous Windows command shells that were spawning from the Local Security Authority Subsystem process, lsass.exe.  This process handles user authentication for a system and typically does not have child processes. Authentication is a crown jewel so anything impacting this is critical.  The child processes that would spawn would inherit major privilege and have unrestricted access to the local system. Hello, lateral movement. This is the threat to enterprise systems we need to be monitoring.

PROTECTION:  Set up a web application firewall infront of all applications.  Keep your system patched and up to date. And monitor system performance for even small impacts.  There are numerous threat intel teams now tracking the mining bots and sharing IOCs, as in the link below from Proofpoint. That is the beauty of the security community at work.  Security teams can use this info to ensure their networks are not communicating with mining bots. Because all that glitters is not gold – it’s bitcoin.

 

ZDNet 04/05/2018 D. Palmer
Red Canary:  T. Lambert April 4
darkreading 4/5/2018 T. Kreikemeier
Comodo Cybersecurity Threat Research Labs Q1 Global Malware Report
https://www.tripwire.com/state-of-security/featured/smominru-half-million-pcs-hit-cryptomining-botnet/
https://www.proofpoint.com/us/threat-insight/post/smominru-monero-mining-botnet-making-millions-operators
https://www.bleepingcomputer.com/news/security/xiaoba-ransomware-retooled-as-coinminer-but-manages-to-ruin-your-files-anyway/
https://www.helpnetsecurity.com/2018/04/12/cryptomining-enterprise/

 

Advertisements

Today’s Advisories

CISCO scores a perfect 10 on vulnerability. Fixes available. DO IT NOW!

This vulnerability is critical.  CVE-2018-0101 is ranked 10 out of 10 for severity. That means it can be easily exploited, remotely exploited and no authentication required. There are no workarounds “so customers must either disable the ASA VPN functionality or install updated OS versions”.  Get yer patches up now!

Cisco says that an attacker can send malformed XML packets to such devices and execute malicious code on the device. Depending on the code’s nature, an attacker can gain control over the device.

It affects any devices running ASA Adaptive Security Appliance software only if they have the “webvpn” feature is enabled in the OS settings. You can find more information about  ASA Software version numbers for fixed releases in Cisco’s CWE-415 security advisory.

Per Bleeping Computer https://www.bleepingcomputer.com/news/security/cisco-fixes-remote-code-execution-bug-rated-10-out-of-10-on-severity-scale/

New Ransomware GandCrab being delivered by RIG exploit kit. 

This one requests DASH cryptocurrency which is apparently harder to trace by law enforcement. Ransom is 1.54 DASH or $1170 USD. It apends .GDCB to files it encrypts. Here’s how victims will know it’s too late:

At some point, the ransomware will relaunch itself using the command “C:\Windows\system32\wbem\wmic.exe” process call create “cmd /c start %Temp%\[launched_file_name].exe”. If a user does not respond Yes to the below prompt, it will continuously display the UAC prompt.

Be advised: there is NO decryptor currently available for GandCrab.  Follow the standard security protocols to keep your data and systems safe.

  1. Use antimalware security software that incorporates behavioral detections to combat ransomware like Malwarebytes or Emsisoft Antimalware
  2. Scan attachments with tools like VirusTotal.
  3. Have all current updates, especially for Java, Adobe, Windows

Per Bleeping Computer https://www.bleepingcomputer.com/news/security/gandcrab-ransomware-distributed-by-exploit-kits-appends-gdcb-extension/

Happy New Year 2018 – Let the Dumpster Fires Begin

Just three days into 2018,  two massive security warnings were issued for Meltdown and Spectre. About those names – for an industry that claims to hate FUD, we need to work on this. But all kidding aside, these are perhaps the biggest inherent vulnerabilities to be brought to light that I am aware of. For good reason. When almost every device we use in our online and connected lives contains the problem at hand, it’s a top-tier event. Rather than jump on the “sky is falling” bandwagon, I chose to wait things out and read all that I could. There are far more experienced and knowledgeable people who have been weighing in on this from the start, and I will share links to their excellent insights and explanations. Also, as dust settles we can seee things more clearly, which is very relevant when dealing with a situation as massive and impactful as this. More details come available; facts are verified; information about what to do is tested and shared. Worth waiting for given that there was no immediate fix and panic is never a solution.

Here is the simplest breakdown of what both are by Daniel Miessler.  What everyone is worried about is that both of these enable attackers to access information and processes that we had all thought were inherently secured, like privacy keys we use to protect our data. Daniel lays it all out here:

Both Meltdown and Spectre allow low-privilege users who execute code on your system to read sensitive information from memory via Speculative Execution.  The basic concept for these two attacks is that you should consider secrets to be attackable any place you’re allowing someone else’s code to run on an affected system.

In Meltdown that means “any secret a computer is protecting (even in the kernel) is available to any user able to execute code on the system.” (Miessler) Spectre is worse in that it “works by tricking processors into executing instructions they should not have been able to, granting access to sensitive information in other applications’ memory space.” (Miessler)    

What I have been listening for is how this may impact Cloud computing, which we only think we understand, and we need to remember is just somebody else’s server.  Jerry Bell has written a piece on his blog, “Thoughts on Cloud Computing in the Wake of Meltdown”. He happens to be one of my go-to sources as part of the Dynamic Duo on the Defensive Security Podcast. First, the good news.  As managed service providers running largely out of datacenters, these operations will have likely been told to patch ahead of most, and done so in the best interests of running their business. As well, since datacenters are large organizations managing many clients, they will be using automation to help the patching process. And patching is complicated, especially when it comes to these critical issues.

And that brings us to the not so good news. Patching virtual machines isn’t always straightforward or successful.

spec2spec1

As Jerry presents:

Meltdown provided an apparent possibility for a guest in one virtual machine to read the memory of a different virtual machine running on the same physical server.  This is a threat that doesn’t exist on private servers, or is much less concerning for private cloud.  This vulnerability existed for many years

And then there are performance issues. Interestingly, as Jerry points out, not as hard to mitigate on cloud as they would be for physical servers.

One of the big downsides to cloud therefore, seems to the risk of a sudden change in the operating environment that results in higher cloud service costs.  As problematic as that might be, firing an API to increase the execution cap or add CPUs to a cloud server is logistically much simpler than private physical servers experiencing the same performance hit and needing to be replaced, which requires the arduous process of obtaining approval for a new server, placing the order, waiting, racking, cabling, set up, and so on.

Based on this, and what has been occurring across 2016 and 2017, I predict we will see more of these events where something we did in the past comes back to “haunt” us, from a time when we did not have any idea of how technology would develop. We are now uncovering what lies beneath the surface of frameworks we rely on that others laid down before us. Simon Segars is CEO of ARM Holdings, which designs mobile chips. He warned at CES 2018 in Vegas last week that we need to expect more of these discoveries. He states one of my chief concerns here:

“The reality is there are probably other things out there like it that have been deemed safe for years.. Somebody whose mind is sufficiently warped toward think about security threats may find other ways to exploit systems which had otherwise been considered comletely safe.”

We don’t know what we don’t know unfortunately in this case, so we need to be prepared for similar discoveries. More importantly, we need to be ready to assess, then share the information in a controlled and constructive fashion while we mobilize immediate and long term responses to the event. My watchword now is “prudence”, both in terms of patching, and then in terms of vigilance as we watch over all our systems with new eyes and insights. Haste makes waste. Because as time has borne out, and is once again, patches can go sideways very badly. Whether you brick a device or you brick an enterprise, both outcomes are severe.

UPDATE ON PATCHES

Per Steve Ragan’s piece in CSO Online, Microsoft has suspended Windows security updates related to this issue on systems with older AMD CPUs, after a documentation mix-up led to the systems being unable to boot after patches were applied.

In order to “prevent AMD customers from getting into an unbootable state,” Microsoft  has temporarily paused sending the following Windows updates to devices with impacted AMD processors:

  • January 3, 2018—KB4056897 (Security-only update)
  • January 9, 2018—KB4056894 (Monthly Rollup)
  • January 3, 2018—KB4056888 (OS Build 10586.1356)
  • January 3, 2018—KB4056892 (OS Build 16299.192)
  • January 3, 2018—KB4056891 (OS Build 15063.850)
  • January 3, 2018—KB4056890 (OS Build 14393.2007)
  • January 3, 2018—KB4056898 (Security-only update)
  • January 3, 2018—KB4056893 (OS Build 10240.17735)
  • January 9, 2018—KB4056895 (Monthly Rollup)

 

There are some excellent writeups out there. Here are some suggestions:

https://www.csoonline.com/article/3245770/security/spectre-and-meltdown-what-you-need-to-know-going-forward.html

https://blog.malwarebytes.com/security-world/2018/01/meltdown-and-spectre-what-you-need-to-know/

https://www.renditioninfosec.com/2018/01/meltdown-and-spectre-vulnerability-slides/

https://infosec.engineering/thoughts-on-cloud-computing-in-the-wake-of-meltdown/

Quickhits: Monday Dec 18 2018

New attack on Apache Struts: We’ve seen patches issued in March, May and agin this fall for exploits against vulnerabilities in this widespread open source web development  framework used to build JAVA web applications. In this report by F5 labs,  a sophisticated new campaign, “Zealot”, is leveraging ShadowBroker exploits EternalBlue and EternalSynergy.  Zealot is described as a “highly obfuscated and multi-staged attack”, in keeping with these exploits, and utilizes Powershell in Windows attacks, and Python in Linux attacks. Zealot mines the cryptocurrency Moneris, popular amongst cybercriminals.

Potential for Uptick in Iranian-based attacks:  The nuclear deal between Iran and the US seems tenuous at best. There is growing concern that should Trump end things, there will be a corresponding response from Iranian-based hackers. Iranian attacks are state-sponsored, so these won’t be cybercrime cash-grabs, but targeted espionage or worse, damaging attacks against infrastructure, like Shamoon wiperware. And since the attackers do the recon well in advance of the big event, I’d be watching IP addresses and any data exfil carefully.

Banking Trojan Emotet:  There is an increase in banking trojan activity. Malware hunters are sharing reports on new activity for Emotet, which made a resurgence in July this year.  A dedicated group of researchers has been steadily updating and sharing their findings on Pastebin here. 

VirusBulletin and Critical Flaws:  VirusBulletin is a very widely used forum for security analysts to test and share malware or suspect findings. Two researchers claim there are unpatched critical flaws that have yet to be remediated and that VirusBulletin has been advised.

 

 

 

 

 

Quickhits: Thursday Dec 14 2018

Attacks on ICS:  FireEye has identified a new targeted attack on ICS. “Triton” is designed to cause physically damage and harm operations. Thanksfully, this latest attack failed, but the lessons and warning are huge. Consider the implications of this against water ppurification plants; nublear power plants; major processing plants that cannot sustain downtime. Triton goes after the SIS or safety implemented system controllers. The FIreEye report describes the malware as follows:

TRITON is one of a limited number of publicly identified malicious software families targeted at industrial control systems (ICS). It follows Stuxnet which was used against Iran in 2010 and Industroyer which we believe was deployed by Sandworm Team against Ukraine in 2016. TRITON is consistent with these attacks, in that it could prevent safety mechanisms from executing their intended function, resulting in a physical consequence.

 

While FireEye cannot attribute the actor, they suggest with some certainty this is the act of a nationstate, they back it up with this statement:

The attacker targeted the SIS suggesting an interest in causing a high-impact attack with physical consequences. This is an attack objective not typically seen from cyber-crime groups.

New Banking APT:  The discovery of a new long term attack on banks was revealed this week.  Dubbed “MoneyTaker”, a report issued by Group-IB Security  details how the group has taken over $11 million across 18 months from over 20 targets in the UK, Russia and US, including banks and legal firms. Dmitry Volkov, co-founder of Group-IB and head of intelligence, stated:

“MoneyTaker uses publicly available tools, which makes the attribution and investigation process a non-trivial exercise,” says. “In addition, incidents occur in different regions worldwide and at least one of the US Banks targeted had documents successfully exfiltrated from their networks, twice. Group-IB specialists expect new thefts in the near future.”

The twist here is that MoneyTaker is leveraging pentesting tools like Metasploit, NirCmd, psexec, Mimikatz, Powershell Empire. They used PSExec to propogate across the network, per The Hackernews.   The article reports they are also using Citadel and Kronos banking trojans to deliver a specific point of sale or POS malware known as ScanPOS.

The group has been targetting card processing systems, like the Russian Interbank System AWS CBR and SWIFT which prompted Group-IB to warn that Latin America is a tempting target because of their broad use of STAR. I’ll be writing more about this as a separate piece. Stay tuned.

My First Keynote: Lookout S(h)ecurity Bootcamp Toronto

Lookout Security in Toronto is hosting an exciting event on January 12 2018 for women who are interested in  cybersecurity, and currently in the tech field.  I am honoured to have been asked to be the keynote speaker at this event. This will be my first keynote! I love that this happens with something I really care about: encouraging women in tech, specifically in cybersecurity.

This is what it’s all about.  Encourage learning, growth and opportunity. Events like these grow far beyond the one day they are held, as I can attest from my work with The Diana Initiative. Friendships form, bonds are made, contacts and networking happen. It’s all good!

This is going to be a fantastic and fun day of learning. You had me at reverse engineering! What a great opportunity. Thank you Lookout!

Getting Things Done

Dedication. Vision. Accomplishment. Passion. These are the forces of change within cyber security, and just some of the distinctive qualities about the guests Dr. Gary McGraw featured for an entire year on his Silver Bullet podcast.

We know there is a shortage of women, of diversity, in science and technology careers, particularly in cyber security.  Rather than make that the focus, this series and these women tell stories that resonate. They share their experiences, and their passion for what they do enfuses each conversation.  There are no rockstars or grandstanders here because there is no room for ego when there is work to be done.

These are my role models, my teachers, my heroes. They illuminate the darkness of our own ignorance about medical device security; making security meaningful to those outside our security enclave; understanding the power of digital forensics; crafting not just secure code but a security mindset within development.

This series is so much more than just an homage to women in tech. There is tremendous strength to be realized in our diversity; within our differences are the tools and solutions we seek for what lies ahead. I am so honoured to have been included. Thank you!