Another day, another zero day vulnerability (Gosh, I love that term. So ominous. Like seeing a mushroom cloud). This time it’s in IE 9 and 10.

Side track: It’s amusing to me that software that a vulnerability in software that has been outdated for 3.5 months can be so devastating, but I guess that’s the corporate world.

There are a number of pretty good technical writeups on the exploits for this one seen in the wild already, so I won’t go into that. I’d rather address what you should do if you’re a medium to large company.

A senior analyst at my company was tasked with looking into this threat. He read the title of the FireEye post, sent an email that said “Upgrade to IE 11” and called it good. Not terribly helpful. There are a number of steps you should do to start looking into this.

The first question you should ask is, “Have I been attacked already?” If you have a SIEM tool this should be easy enough to determine. The first domain you’ll want to look for is the VFW site (vfw.org), since that was the site that was originally compromised.

If you don’t find traffic it is a very good sign. I wouldn’t relax quite yet, though, as someone could’ve accessed this site from their laptop at home. FireEye put together a list of the IPs and domains they’ve seen that are probably C&C servers connected to the VFW compromise, so it’s good to watch for these too:

And as long as you’re searching for traffic, look for anything hitting

A novel new method of creating a DDoS attack has been found: NTP. I’ve read a number of good technical explanations on how the attack was performed and the enormity of the data the attack sent (400 some GB), so I’d like to take a step back and talk about DDoS attacks in general.

Working on a websocket test app recently I had a connection that kept on failing.

A thought occurred to me, so I switched to wss from ws causing my traffic to be encrypted. My company doesn’t currently decrypt any SSL traffic on our security appliances, so this effectively turned my socket into a black box to my proxy, IPS, and firewall. That worked.

I ran a query on our proxy and sure enough, there was the traffic for both requests.

I decided to look on the external firewall.

Only the SSL traffic was showing up here. So something (proxy, IPS, internal firewall, or external firewall) was knocking down the unencrypted socket traffic.

For the record, I’m aware that it’s better to decrypt/recrypt SSL traffic on your proxy. Chalk it up to a mixture of old technology and budget concerns. You work with what you have.

Lessons learned here:

Websockets are cool, but might get stopped by your internal security infrastructure.

If encrypting the traffic resolves the issue, you’ve just discovered a security hole in your environment.

So I gave it a download. It was shiny and new, just as advertised. It lets you browse your Facebook news feed, has slick animations, a “flat” design (which is all the rage these days, I’m told). It’s also a news reader and allows you to add different categories of things you might be interested in such as technology, pop culture, etc. I like the app as an app, but there’s one key feature missing from the news reader: You can’t pick the news sources that make up those categories.

Let’s take a step back for a second. Facebook isn’t evil or the antichrist, but they are trying to make money. They were soaring high for quite a while when desktop browsing was the most common, but shortly after they had their IPO they crashed pretty hard. You can find a bunch of different reasons for the crash, but the fact that their desktop usage dropped off while their mobile usage surged was a huge part of that. Facebook had no ads in their mobile apps, and thus no way to make money off of them.

It’s not hard to connect the dots that Mark Zuckerberg connected: Facebook needs a way to make money off of it’s mobile apps if it wants to survive.

Their first step was Facebook Home.

Still no ads here, and no way to make money, but they’re learning. At first Home got terrible reviews, but Facebook learned and improved upon it, working towards an app people would actually use. To me Paper looks like a next iteration of that. It’s a similar strategy to how Facebook got so popular in the first place: get something cool that people want to use, then advertise to them when you have a ton of users.

Which brings us all the way back around to Facebook Paper and the fact that Facebook chooses what news articles you see in a category. Their end goal is to sell advertising and make money. To do that they want all of the information they can get about your online activity, in this case the articles you read.

So why did it make me pause? Two things.

1. If you use Facebook Paper as your only news source your news consumption is selected by Facebook, and potentially the company willing to pay them money.
2. If Paper becomes popular Facebook has an incredible gold mine of data about you and what you read online.

I send an http request by typing say “google.com” into my address bar, I get a single page back.

Simple, right? One request, one
page. No hassles. But then people wanted to add pictures to pages and the easiest way to do that was to make your web browser think you’d typed in a request for the image and send it back, so it became:

One request, one page that makes you send another couple requests for pictures.

Let’s play a game I like to call, how many requests does it generate. Here are some results:

google.com/voice:

Cnn.com:

Facebook.com (This one surprised me, I was expecting a whole lot more)

So going to one web page is really like going to anywhere between 75 and 243 pages. It’s not a problem, as long as the infrastructure of the internet can handle the load we put on it. But the next time it’s a little slow, cut it some slack. It’s handling a ton of activity to tell you how many likes your picture got.

What exploit is being presented?

Are non-vulnerable technologies being presented as scary?

Does the presenter have anything to gain?

What the malware does

When a POS system reads a card, the data travels in a path like this

Physical credit card -> Credit card reader -> USB Port -> RAM -> Application -> Encryption -> Hard disk or network

The data obviously may move back and forth between the application and the RAM a few times as it is processed, but the most vulnerable point in the path is when the data is in RAM before the application has touched it, and hence before the application can encrypt the data. So for at least a short time the data is sitting in RAM unencrypted, which is where the trojan can grab it.

Once the trojan has the data, it saves it in a DLL and then waits for a time when most stores (and consequently their networks) will be busy before sending the data to a control server over NetBIOS (which is how they get
data out without the POS having an internet connection) that can then forward the data to a server on the internet (there isn’t a ton I could find on this last step, but it would probably look like other data exfiltration).

Why Target was vulnerable

Apparently the hackers were able to get this software on a large number of POS systems at Target and scrape credit card data during the busiest time of the year (Black Friday). Every customer who comes through target has to pay some how, and a lot of them use credit cards. The high rate of customers through each POS system meant that a single compromised system would see a lot of individual’s information.

The fact that until now POS systems have not gotten much public attention for needing to be secured probably means they’re running old operating systems (I’ve personally seen a lot of XP) and probably don’t get patched
frequently may have made it easy to infect large numbers of POS systems very quickly.

How can I stay safe?

If you have an IT department capable of network segmentation, but your POS machines on a segment by themselves, and watch for any ICMP traffic coming out of them. Also lock down the ports that they are allowed to communicate with. Obviously they need to get windows updates and communicate with a server to send sale data, but you should know every port they talk to and prevent them from doing anything you don’t understand.

If you don’t have an IT department capable of doing this, make sure you patch your POS machines frequently. Run antivirus and malware detection on them. If you buy your POS machines from a vendor who handles patching, make sure your vendor is patching them and keeping them up to date.

I’ve spent a lot of time studying the different between an engineer and a help desk technician. I think it’s easiest to approach it through bullet points:

When presented with a problem

This post isn’t security oriented, or technical. It’s just what I’m working on most recently. At work a management decision recently blended our Network Infrastructure and Security Teams together and I was asked to run a project melding the two “on call responsibilities” and figure out a single point of contact or help desk setup so people would know how to contact us.

Help desks are tricky things. The ideal (most expensive) solution is to have happy, highly intelligent people on call 24 hours a day so that when the phone rings, someone who can immediately answer the question is available immediately.

But it isn’t cost effective to have your software engineers sitting on the phone all day doing nothing but waiting for a call, so you start having them do project work and and watch the phone too. But then, their project work takes priority and they can’t answer the phone so you hire a less qualified person that you can pay less to watch the phone the time the engineer can’t be available and have the engineer write documentation for the less qualified person to cover whatever they don’t know.

That solution sounds good. The less qualified person answers the phone, finds the documentation or script they need and can answer the question. But engineers write documentation for engineers. When you have someone with less experience or education than an engineer reading it, the call usually turns into this on one end or the other:

Google has been in the news a lot lately for buying a number of robotics companies. If you’re not familiar, just search “google robotics” and read an article similar to, “Google plans to take over the world with advanced robotic war machines” (or something that sounds catchier with the same meaning).

Basically, google purchased a company that builds robots (pretty advanced ones, some of them pretty creepy at the time of this writing), which sparked a lot of discussion about which Sci Fi movies were coming and if we have to start worrying about terminator or I Robot coming true.

We’re still pretty far off from either of those. Don’t get me wrong, Google’s robot’s are still scary and could be dangerous, but they’re not going to be creepy in the way I Robot or Terminator was. Google’s robot’s have strong movement ability, agility, and are able to carry a lot of weight. But they’re not advanced in AI or human interaction.

These robots are really no different than a UAV or a car with a remote control, they’ve just developed different methods of locomotion. There’s no intelligence there, no ability to decide to kill their human masters and turn them into batteries.

What should actually scare us are things like IBM’s Watson which played jeopardy really well.

Even though Watson might just look like a box it’s ability to correlate events and answer questions is a lot closer to what makes I Robot and Terminator scary. The advances IBM made building Watson brought us closer to I Robot than any “big dog” running around a parking lot. I guess the lesson here is to package your robots cute so people won’t panic.

NOTE: There’s another article about what makes robots creepy, but hopefully I’ll have another post on that later.