Cross-Domain Innovation: Using a PAM solution for efficient mitigation of Pass-the-Hash attacks

25 October 2016

During the ‘Move Laterally’ phase of a cyber-attack the Pass-the-Hash (PtH) method is often used to jump from one system to another in Windows networks. The best way to deal with PtH attacks is to use only locally defined privileged accounts with individual passwords because the related hashes are not valid on other systems. For more details please see the NSA IAD guideline ‘Reducing the effectiveness of Pass-the-Hash‘.

Using individual passwords on thousands of Windows systems is a really big challenge. In addition, since network login with local users has to be deactivated, the effort for the administrators is significantly increased. With this, the NSA suggestions will, if at all, only be implemented in very few organization.

Today, I participated in a great presentation of BeyondTrust’s Enterprise Password Management solution. Although primarily designed for privileged account management, the solution provides all the capabilities for the efficient management of local privileged accounts, and even with one-time passwords and automated creation of rdp sessions to the target systems. With this, PtH attacks can be mitigated nearly without any extra effort for the administrators.

Have a good day.

IBM Webinar: Force the Bad Guys to Use Zero Day Exploits with Continuous Endpoint Enforcement and Patching

22 October 2016

On Tuesday, I watched the IBM webinar ‘Force the Bad Guys to Use Zero Day Exploits with Continuous Endpoint Enforcement and Patching’.

On slide 3 one could read the really interesting statement ‘NSA: no zero days were used in any high profile breaches over last 24 months’.

Slide 3 - Force the Bad Guys to Use Zero Day Exploits — and Why That’s a Good Thing

Slide 3 – Force the Bad Guys to Use Zero Day Exploits — and Why That’s a Good Thing

Curtis Dukes, deputy national manager of security systems within the NSA, said that NSA has been involved in incident response or mitigation efforts for all ‘high profile incidents’ one has read about in the Washington Post or the New York times.

In all this incidents hacker used somewhat simple technology like spear phishing, water holing and USB-drive delivery to get onto the victim’s networks.

In the last 24 months, not one zero day has been used in these high profile intrusions.

That is a very interesting insight. Moreover, Curtis Dukes said that

The fundamental problem we faced in every one of those incidents was poor cyber hygiene.

The central idea of the webinar is to harden all systems by applying at least all existing patches to the known vulnerabilities, and in a timely manner. For most of the organizations this is a great challenge: Applying an endless stream of operating system and application patches to thousands of servers and endpoints is a never-ending nightmare. But essential to hinder an attacker, who managed to get on the network, in his lateral movement across the network.

If an attacker cannot exploit existing vulnerabilities, he is forced to install hacking tools from his C&C server. But this will increase the likelihood of detection because the attacker creates anomalies which can be detected e.g. by a current anti-malware solution or a well-tuned SIEM system.

It is important to recognize that cyber hygiene shall not be restricted to patching and password rules. Operating systems offer lots of powerful inbuilt tools, e.g. PowerShell, which can be used by an attacker to move laterally across the network. Such movements a much harder to detect, because they are very similar to standard user behavior. Pass-the-hash attacks are another example where patching is of limited value only.

It is very important to understand what threats a security solution mitigates. But it is of crucial importance to know the gaps and to have some ideas on how to deal with them effectively.

Have a good weekend.

G7 sets common cyber-security guidelines for financial sector – Part II

16 October 2016

On Tuesday the Group of the Seven industrial powers agreed on guidelines for protecting the global financial sector from cyber-attacks. At the same time, reports about a new trojan called Odinaff appeared in the media. Financial institutions all over the world have been attacked in the past 9 months. And also SWIFT users. For technical details please see the excellent post ‘Odinaff: New Trojan used in high level financial attacks’ published in the Symantec Blog.

The G7 cyber-security guidelines have come just at the right time. Or, perhaps too late? From the Symantec report one learns that the technology used by the trojan is not new at all. For example, payloads hidden in password secured rar-files have already been used in the past.

It almost seems as though the cyber security groups of the banks haven’t learned from the past: Password protected attachments are potentially dangerous, and should be blocked in the first instance. Never deliver those files to the end-users!

In addition, cyber-security awareness campaigns for end-users had not been effective or had not taken place. ‘One’s mind is the best weapon’, hence well-trained people are the most effective preventive measure in the protection against cyber-attacks.

Have a good weekend.

G7 sets common cyber-security guidelines for financial sector

13 October 2016

On Tuesday the Group of the Seven industrial powers agreed on guidelines for protecting the global financial sector from cyber-attacks.  Although the guidelines are not binding for the financial sector they will definitely make a difference:

Cyber security receives at last the governmental attention which is required to safeguard the global economy. This is long overdue, hopefully not too late because it will take some years until the global financial system has implemented the guidelines.

The initial work is done. Now some more governmental attention is required to ensure international competitiveness at a high level. Lots of work to do for the Group of the Seven industrial powers.

Have a good day.

Cybersecurity is just too much trouble for the general public, claims study

8 October 2016

In report ‘Cybersecurity is just too much trouble for the general public, claims study’ published on 6 October at the Tripwire state-of-security blog, Graham Cluley cites from the NIST study Security Fatigue:

“Participants expressed a sense of resignation, loss of control, fatalism, risk minimization, and decision avoidance, all characteristics of security fatigue. The authors found that the security fatigue users experience contributes to their cost-benefit analyses in how to incorporate security practices and reinforces their ideas of lack of benefit for following security advice.”

We should not be surprised ‘that the public is suffering from “security fatigue” and a feeling of helplessness when it comes to their online security’. Most of the advice for end users in the information security domain is just puzzling. Let me make this clear with an example.

Renowned German Stiftung Warentest assessed 15 e-mail providers in the October 2016 edition of the Test magazine. Focus of the assessment was data privacy, ‘the protection of customers and emails against unwanted looks’. And, of course, usability. Table 1 below shows the Stiftung Warentest quality ranking.

Provider Quality Ranking (1) Tarif Mail 1.4
Posteo 1.4 Plusmail 2.2
GMX Topmail 2.3 Club 2.3 Freemail 2.5
GMX Freemail 2.6
Telekom Freemail 2.6
Freenetmail Basic 2.7
Telekom Mail / Cloud M 2.7
1&1 Mail Basic 3.1
AOL Mail 3.1
Yahoo Mail 3.2
Microsoft 3.3
Google Gmail 3.4

Table 1: Stiftung Warentest rankings

(1)    Quality Ranking: 0.5 .. 1.5: Very good, 1.6 .. 2.5: Good, 2.6 .. 3.5: Average

At a first glance, the table suggests that it is sufficient to use one of these providers (all were rated from very good to average) and security is guaranteed.

Unfortunately, this assessment is very misleading. Email encryption is just one aspect of information security. It protects against cyber criminals, state-sponsored attackers or insider attacks because the information is not readable unless the attacker has access to the encryption key.

If an attacker is able to compromise a user’s account, e.g. through a password phishing attack, he might have full access to all emails, although they are encrypted.

To secure an account against phishing with frequent password changes and the use of individual passwords for different services, is not sufficient. And usability is bad, even if password managers are used. Two-Factor Authentication (TFA) or one-time passwords are the tools of choice to enhance security against phishing attacks.

Table 2 shows the Stiftung Warentest results updated with details about TFA availability.

Provider Quality Ranking (1) TFA available With soft token With SMS With hard token Tarif Mail 1.4 (2) Yes Yes Yes
Posteo 1.4 Yes Yes Plusmail 2.2 Yes Yes Yes
GMX Topmail 2.3 No Club 2.3 No Freemail 2.5 No
GMX Freemail 2.6 No
Telekom Freemail 2.6 No
Freenetmail Basic 2.7 No
Telekom Mail / Cloud M 2.7 No
1&1 Mail Basic 3.1 Undef. (2)
AOL Mail 3.1 Yes Yes
Yahoo Mail 3.2 Yes   Yes  
Microsoft 3.3 Yes Yes Yes
Google Gmail 3.4 Yes Yes Yes Yes

Table 2: Rankings updated with details about TFA

(1)    Quality Ranking: 0.5 .. 1.5: Very good, 1.6 .. 2.5: Good, 2.6 .. 3.5: Average

(2)    It was not possible to determine whether TFA is available from the provider’s homepage

Only 7 of the 15 email providers allow the use of a second factor. The limitation to one aspect of information security creates puzzling results and a false sense of security. It is therefore no wonder that consumers show the ‘characteristics of security fatigue’.

TFA with soft tokens is under normal conditions activated within seconds, and very easy to use. From my point of view, service providers should create the needed attention and force the use of TFA. It is not sufficient to notify the users of new waves of phishing attacks.

Have a good weekend.

Senators accuse Yahoo of ‘unacceptable’ delay in hack discovery

4 October 2016

Six Senators demanded that Yahoo should explain why it took about 2 years before the massive data leak came to light.

In Reuters Technology News of 27 September 2016 Dustin Volz and Lisa Lambert wrote:

The lawmakers, all Democrats, said they were “disturbed” that the 2014 intrusion, which was disclosed by the company on Thursday, was detected so long after it occurred.

“That means millions of Americans’ data may have been compromised for two years,” the senators wrote in a letter to Yahoo Chief Executive Marissa Mayer. “This is unacceptable.”

This is a very interesting turn on events, but entirely justified.

In report ‘Yahoo breach calls into question detection and remediation practices’ published on SearchSecurity on 28 Sep 2016, Michael Heller discussed the question about Yahoo’s detection and response practices. I haven’t seen any discussions about missing preventive controls, although these are the foundation for the rapid detection of cyber-attacks.

The goal of prevention is to force the attacker to make errors by isolating him from his and our environment. A well-tuned SIEM system should then rapidly detect such anomalies and create incidents from them. A good mixture of detection and prevention is required for the rapid detection of cyber attacks.

For a comprehensive discussion on prevention and detection see post Cyber Security Investments: Experts Discuss Detection vs. Prevention published in the Digital Guardian blog.

In briefing document ‘The Strategic Game of ? and ?’ John Richard Boyd shows the direction to cyber security:

The Strategic Game is one of Interaction and Isolation. A game in which we must be able to diminish adversary’s ability to communicate or interact with his environment while sustaining or improving ours.

Have a good week.