[infosecurity-magazine] NSF Awards $15m to Develop Secure Internet Architecture

The National Science Foundation (NSF) is awarding $15 million in grants for the development, deployment and testing of future internet architectures that are designed to enhance security, respond to emerging service challenges and increase scalability.

In 2010, the Directorate for Computer and Information Science and Engineering (CISE) at the NSF announced awards for four  projects, each worth up to $8 million over three years, as part of the Future Internet Architecture (FIA) program. The awards enabled researchers at dozens of institutions across the US to pursue new ways to build a more trustworthy and robust internet. That was mostly an exploratory phase; now, new grants are funding trial deployments for three of them to test the concepts in a real-world scenario.

“The objective of the new awards is to move the FIA efforts from the design stage to piloted deployments that assess how the designs work at large-scale and within challenging, realistic environments,” the NSF said. “Cities, non-profit organizations, academic institutions and industrial partners across the nation will collaborate with researchers to test the new designs.”

Two notable projects from the cybersecurity perspective are Named Data Networking (NDN) and eXpressive Internet Architecture (XIA). The third awardee is the MobilityFirst project.

"These projects are just the beginning of what it would take to create a full-scale Future Internet," said Keith Marzullo, director for NSF's Computer and Network Systems Division, "but the ultimate goal is the design and deployment of a network that serves all the needs of society."

NDN will trade in the internet’s existing client-server model of interaction for a new model centered on content creation, dissemination and delivery. It will include mechanisms to support secure content-oriented functionality, regardless of the specific physical location where the content resides. The architecture thus moves the communication paradigm from today's focus on "where", i.e., addresses, servers and hosts, to "what", i.e., the content that users and applications care about.

“By naming data instead of their location (IP address), NDN transforms data into first-class entities,” the NSF explained. “While the current Internet secures the communication channel or path between two communication points and sometimes the data with encryption, NDN secures the content and provides essential context for security.”

This approach allows the decoupling of trust in data from trust in hosts and servers, enabling trustworthiness as well as several radically scalable communication mechanisms; for example, automatic caching to optimize bandwidth and the potential to move content along multiple paths to the destination. This project addresses the technical challenges in creating NDN, including routing scalability, fast forwarding, trust models, network security, content protection and privacy, and a new fundamental communication theory enabling its design.

The NDN project is partnering with Open mHealth, a non-profit, patient-centric health ecosystem, and with UCLA Facilities Management, which operates the second largest Siemens building monitoring system on the West Coast, to test actual implementation.

When it comes to XIA, researchers at Carnegie-Mellon University and three other institutions are planning to use a $5 million, two-year grant to test a next-generation internet architecture they've developed, geared to eliminate bottlenecks and incorporate intrinsic security features that can assure users that the websites they access and documents they download are legitimate.

The trials will involve delivering online video on a national scale, and setting up a vehicular network in Pittsburgh.

XIA also includes caching features – the researchers said the network will be able “to directly access content where it is most accessible, not necessarily on a host website.” The details of the actual deployments have yet to be worked out, according to Peter Steenkiste, professor of computer science and electrical and computer engineering at Carnegie-Mellon and XIA's principal investigator. However, in the online video case, it will probably involve various nodes spread across the US.

In that trial, the researchers will test the XIA network's ability to eliminate bottlenecks in the transmission of video, which now accounts for a majority of internet traffic and is slated to grow and strain the network further. Loss of even a few data packets in a high-definition video stream is of course readily apparent, Steenkiste noted, so this will be a critical test of XIA's reliability.

Meanwhile, vehicles can use wireless communication channels called dedicated short-range communications, or DSRC, that are similar to Wi-Fi. Creating DSRC networks is challenging, however, because cars and trucks quickly pass from one DSRC access point to the next. Again, because XIA enables computer users to directly access content wherever it might be on the network, rather than always accessing a host website, it should enable vehicles to solve this issue.

Plans are underway to deploy XIA in a network in and around the CMU campus, or possibly piggybacking atop downtown Pittsburgh's free Wi-Fi network, to enable vehicles to share information about road and traffic conditions and to enable occupants to access the internet and entertainment options.

Simply finding a way to evaluate network architectures will be part of the research effort, Steenkiste said, noting no widely accepted benchmarks yet exist. "It's not like the network is simply faster — it's more abstract than that," he explained. Security and reliability are some of the properties that must be evaluated.

"These deployments will leverage, and enable us to deepen, our work on secure network operations, including providing a highly available infrastructure and secure authentication mechanisms," Steenkiste said. "They will enable us to build and test a robust XIA network and establish best practices for using our architecture, including support for mobility and enhanced cybersecurity."

XIA is designed to evolve with the internet, so that it will enable future users to accommodate communications with entities that no one has dreamed of yet, researchers said. Also it’s being architected so that it can be deployed piecemeal, so that the entire internet need not be transformed before people can start seeing XIA's benefits.

http://www.infosecurity-magazine.com/view/38434/nsf-awards-15m-to-develop-secure-internet-architecture/

[fireeye] Operation Saffron Rose

There is evolution and development underway within Iranian-based hacker groups that coincides with Iran’s efforts at controlling political dissent and expanding offensive cyber capabilities. The capabilities of threat actors operating from Iran have traditionally been considered limited and have focused on politically motivated website defacement and DDoS attacks.

Our team has published a report that documents the activities of an Iran-based group, known as the Ajax Security Team, which has been targeting both US defense companies as well as those in Iran who are using popular anti-censorship tools to bypass Internet censorship controls in the country.

This group, which has its roots in popular Iranian hacker forums such as Ashiyane and Shabgard, has engaged in website defacements since 2010. However, by 2014, this group had transitioned to malware-based espionage, using a methodology consistent with other advanced persistent threats in this region.

It is unclear if the Ajax Security Team operates in isolation or if they are a part of a larger coordinated effort. We have observed this group leverage varied social engineering tactics as a means to lure their targets into infecting themselves with malware. They use malware tools that do not appear to be publicly available. Although we have not observed the use of exploits as a means to infect victims, members of the Ajax Security Team have previously used exploit code in web site defacement operations.

The objectives of this group are consistent with Iran’s efforts at controlling political dissent and expanding offensive cyber capabilities, but we believe that members of the group may also be dabbling in traditional cybercrime. This indicates that there is a considerable grey area between the cyber espionage capabilities of Iran’s hacker groups and any direct Iranian government or military involvement.

Although the Ajax Security Team’s capabilities remain unclear, we believe that their current operations have been somewhat successful. We assess that if these actors continue the current pace of their operations they will improve their capabilities in the mid-term.

To view a full version of the report on “Operation Saffron Rose,” please visit: http://www.fireeye.com/resources/pdfs/fireeye-operation-saffron-rose.pdf.

[fireeye] Managed Defense – Reducing the Time to Detect and Resolve Threats

Working in FireEye Managed Defense presents an interesting perspective into some of the most advanced threats. Our service meshes a team of experts with a powerful technology stack. We combine host- and network-based forensic technologies with highly experienced and skilled analysts, incident responders, and reverse engineers around the clock and across the globe. The foundation of Managed Defense is our partnership with our customers to detect evil and contain compromise. We work together to investigate the compromise, determine a remediation strategy, extract intelligence, and deploy new intelligence into our operations. This ability to leverage expertise to create intelligence and apply it consistently to the endpoint and to network traffic enables our team to adapt and respond quickly. In the face of a campaign like Operation Clandestine Fox, it ensures our clients are protected from even the most advanced attacker groups.

The last 10 days have shown us once again why our mission of defeating the adversary is so critical. On Friday, April 25, we discovered a new IE 0-day exploited as part of a campaign later dubbed Operation Clandestine Fox. In this post, we present an inside look into the discovery and exploitation of this vulnerability and how we were able to help not only the original Managed Defense customer but also others.

The Initial Detection

This story begins on April 25, when a group of our analysts working with a Managed Defense client detected an active APT backdoor using one of the many indicators of compromise (IOCs) we check for within Managed Defense

At first glance, it might have been reasonable to characterize the initial compromise as fairly typical. We knew at the time that the attackers had been able to deploy at least one backdoor, and were communicating interactively with it to escalate the attack. After containing the host, the usual questions emerged:

• How was the machine compromised?
• Was the scope of the compromise limited to a single host?
• What did the attackers accomplish?
• Who was the Threat Actor behind the attack?

That evening, a deeper analysis of the host revealed that the backdoor was resident only in memory and communicating out to remote attacker infrastructure. While we had seen similar malware variants, analysis of JavaScript and Flash objects from this host indicated that we were possibly at the forefront of discovering a previously unknown vulnerability being exploited.

Evaluating the malware and the tactics employed pointed to a threat group that we had seen before. This group had been the first group to have access to a select number of browser-based 0-day exploits (e.g. IE, Firefox, and Flash) in the past. They are extremely proficient at lateral movement and are difficult to track, as they typically do not reuse command and control infrastructure.

Expanding Detection Across Managed Defense

The new 0-day was, of course, the big news. But just as important to our Managed Defense customers were lesser-known details that we tend to dig up every day on threats big and small.

For instance, during the early stages of investigation, we produced evidence of the targeted spear phishing campaign that served as the initial attack vector. The campaign morphed four times, altering the content and remote locations of the payloads. Not only were we able to help our initial client detect and contain the threat, but continuously updating our applied intelligence led to other detections of the same campaign elsewhere.

Immediately after we deployed host-based indicators for the first-stage backdoor as well as network-based indicators for the command and control (C2) channels, we found a compromise at two additional Managed Defense customers. This meant we could pivot quickly into a focused investigation and response for our other customers – all of this in a matter of hours.

The analysis performed within the first few hours allowed our team to deploy these network-based indicators across the globe and ensure that we were positioned between our customers and their adversaries to detect the attack early in the attack lifecycle. Not long after, as an added countermeasure, we further augmented our detection capability by deploying host-based indicators specifically focused on rapidly surfacing additional variants of the first-stage backdoor. All told, we built new intelligence around the phishing emails, the backdoors used, use of the 0-day exploit, and evidence of backdoor installation via an in-memory mutex. This is handy as memory-only enterprise sweeps are much faster than filesystem ones.

Within 24 hours, we had gathered and reviewed results from nearly a million endpoints across the Managed Defense customer base. The additional activity we observed solidified our theory that at least one APT threat actor group was broadly and aggressively targeting an array of key industries, including aerospace, energy, financial, and the federal sector.

We published all of the intelligence we could glean as the investigation progressed so our customers could have insight on the threat actor and their tactics. This also supported customers discussing the threat with their peer groups to help drive the ultimate goal of protection, remediation and recovery.

Our work here resulted in new detection capabilities to find compromise through the attack lifecycle, ranging from initial targeting to successful exploitation and subsequent escalation through the establishment of more persistent backdoors. Thanks to our rapid deployment of relevant intelligence across our platform and the quick action of our clients, the eleven Managed Defense clients targeted by this campaign were all able to successfully contain the compromises at the initial stage, preventing further attacker activity within client environments.

Looking Back (and Forward)

Given the relative ubiquity of the vulnerability and the scope of the opportunity presented to attackers, we were unsurprised to see the attackers carry on through the week of April 28th. The Managed Defense team continued to work with our customers in a few ways:

• We continued to monitor our customers’ global infrastructure 24×7 for related activity;
• Over the course of 7 days, we published compromise reports that described related attacker activity at a dozen unique enterprises, spanning multiple industries;
• We were easily able to pivot into Incident Response where necessary and applied additional horsepower to analyze a variety of forensic artifacts and accelerate response time;
• We published additional intelligence to our customers so that each team could augment their own legacy detection capabilities and potentially prevent compromise.

With Microsoft’s recent patch release, we’ve already witnessed a shift in attacker activity, including a substantial decrease in phishing activity. This once wide-open door is closing shut, but we know our adversaries’ unrelenting search for new attack surfaces undoubtedly continues. For those of us in Managed Defense, events like those detailed above are common occurrences, but they nonetheless serve as inspiring reminders of the gravity of our mission: to help protect our clients from skilled and determined adversaries. The best analysts in the industry, a global deployment of detection technology, superior threat intelligence, and an ability to rapidly escalate and deploy that new intelligence, when combined with the close partnerships we have with our clients ensures we are well prepared for the inevitable next round of attacks.

http://www.fireeye.com/blog/corporate/2014/05/managed-defense-reducing-the-time-to-detect-and-resolve-threats.html

[infosecinstitute] Exploiting Windows 2003 Server Reverse Shell

This paper is intended to explain several Metasploit approaches to exploit the vulnerable Windows 2003 server operating system, especially through msfconsole and msfcli modules, and demonstrates how to access the target computer in a comprehensive hacking life-cycle manner. Metasploit is quite useful in penetration testing, in terms of detecting vulnerabilities in the target Windows 2003 operating system, as well as for exploiting its loopholes. Metasploit could be utilized by both offensive and defensive professionals.

[infosecurity-magazine] World’s Most Advanced Hackers are in Russia and Eastern Europe

At Infosecurity Europe 2014, Eleanor Dallaway caught up with Ross Brewer, vice president and managing director for international markets, and Mike Reagan, CMO at LogRhythm to talk insider threats, and the global threat landscape…

[infosecinstitute] Encrypted Code Reverse Engineering: Bypassing Obfuscation

Abstract

Obfuscation is a distinctive mechanism equivalent to hiding, often applied by security developers, to harden or protect the source code (which is deemed as intellectual property of the vendor) from reversing. The goal of such an approach is to transform the source code into new encrypted byzantine source code symbols which have the same computational effect as the original program. By applying effective obfuscation over the source code, it is difficult for a vicious-intentioned person to analyze or subvert the unique functionality of software as per his requirements. Vendors typically seem to be safe by ensuring obfuscation over their intellectual property, but unfortunately, software code is not safe from being modified even after applying obfuscation; it still can be cracked. However, this phenomenon can be illustrated by applying sort of rare tactics to bypass the obfuscation mechanism in order to reverse engineer or alter the inherent functionality of software.

[infosecinstitute] Cloud-Based File Sharing Websites: A Data Security Disaster Waiting to Happen?

Have you ever stopped to consider the sensitivity and potential value of the information you have distributed using the many widely available file sharing websites?

These types of sites have seen considerable uptake in recent years, as users struggle to share large files whilst battling standard email file size and gateway limits imposed by IT departments. Many users would argue that restrictions placed on them by central IT policies leave them with no choice but to look for alternative ways to send ‘must share’ data. However, although these sites may seem easy to use, they also pose a considerable data security and compliancy risk to corporate networks.