No More Ransom - Detecting and unlocking ransomware without paying

Data is valuable. Ransomware takes advantage of the financial or sentimental value of our data, as well as the fact that most homes and organizations do not have adequate data backup solutions in place.

Once a computer is infected with ransomware, individual files are normally encrypted and users are asked to pay a ransom to unlock their data. If the victim pays, the data may or may not be unlocked. Ransomware started off like most viruses, targeting average computer users opportunistically. Ransomware groups, however, started targeting hospitals, police organizations and others.

So what can you do if you are infected with ransomware? Internet vendors and law enforcement have come together to create No More Ransom. This website gives users information about current types of ransomware, download unlocking tools (for free), provides prevention information and even has a tool to analyze your encrypted files and recommends which unlocking tool to use.

The Problem

Ransomware is possible because people do not have backups in place.

The Solution

Backups.

If you have an extra hard-drive that you are not using, or even another computer that is often on, CrashPlan is a pretty straightforward backup solution that is free if you save data to your own computers.

Note: DropBox or similar are not good backup solutions because they constantly sync changes. If ransomware infects your systems, the changes may be synced to your cloud storage. With a backup solution like CrashPlan, 1) backup is not instantaneous and 2) CrashPlan keeps track of prior versions of data. So if encrypted files were backed up, you can still restore prior versions. Best of all, CrashPlan provides end-to-end encryption (if enabled).

Read More

[How-To] Installing thc Hydra in Ubuntu

The steps below are how to easily install thc Hydra in Ubuntu with the majority of required libraries for common tasks. Hydra is a pretty well-known remote authentication service brute force cracker. It can perform rapid dictionary attacks against more then 30 protocols, including telnet, ftp, http, https, smb, several databases, and much more. I usually use it to test web forms on apps I'm making.

Please note: The main thc-Hydra website as malicious. Do not visit there on your main system. All of the links on this page go straight to the source at github.

First you need to install git and tools to build the code. We will use this to get the source for thc-Hydra, and to update it from time to time.

sudo apt-get install git build-essential

Next, we need to get the source for thc-Hydra from github:

cd /opt/
git clone https://github.com/vanhauser-thc/thc-hydra.git
sudo chown -R [your username] thc-hydra
sudo chmod -R 755 thc-hydra

Now you should have the source code, but most likely if you install now it will be missing a lot of the libraries it needs. Install some of the most common libraries from the packages below:

sudo apt-get install zlib1g-dev libssl-dev libidn11-dev libcurses-ocaml-dev libpcre3-dev libpq-dev libsvn-dev libafpclient-dev libssh-dev

Now try to build hydra

./configure

Check the output and see if you can find any missing libraries.

./configure
make -jX
sudo make install

Here "make -jX" where X is the number of processors your system has.

Now hydra should be installed. Type which hydra to see the install location. You can test ssh with a password list with the following command:

/usr/local/bin/hydra -l root -P PW.list -f -s 22 -t 4 -e ns  127.0.0.1 ssh

Read More

Revisiting the Four Grand Challenges in Trustworthy Computing: Challenge 2

A while back we looked at Challenge 1 in the Four Grand Challenges in Trustworthy Computing from 2003. In my opinion, we have fallen quite short on Challenge 1, that is "eliminating epidemic attacks by 2014". Today, we will look at Challenge 2.

Challenge 2, is generally defined as "ensure[ing] that new, critical systems currently on the drawing board are immune from destructive attack".

Challenge 2 looks at systems of critical importance that are currently being designed and implemented. Unlike Challenge 1, that focuses on systems that are already deployed, Challenge 2 focuses on security, reliability and trustability of systems that are (or were at that time) currently being developed.

The metric of success is based on the CIA model, focusing on systems that ensure:

• Confidentiality
• Integrity
• Availability

and is extended with:

• "Auditability"
• Global Accessibility

The group identified a number of critical systems (Figure 1), and stated that "there is very little reason to believe that such systems, if developed under current technology, will be trustworthy".

Figure 1. Critical systems and infrastructure identified by the CRA group in 2003.

This statement comes almost five years after the U.S. Presidential Directive 63, which had a national goal stating:

No later than the year 2000, the United States shall have achieved an initial operating capability and no later than five years from today the United States shall have achieved and shall maintain the ability to protect the nation's critical infrastructures from intentional acts that would significantly diminish the abilities of:

• the Federal Government to perform essential national security missions and to ensure the general public health and safety;
• state and local governments to maintain order and to deliver minimum essential public services.
• the private sector to ensure the orderly functioning of the economy and the delivery of essential telecommunications, energy, financial and transportation services.

The Colloquium for Information Systems Security Education in 2008 again put critical systems, and specifically SCADA systems, as a priority area in need of organized research. There has been a growing amount of research into critical system defense, security and forensics, but the 2011 alleged hacking of an Illinois water system, as well as some infrastructures we have seen, lead me to believe that research is not being practically implemented.

From discussions with people dealing with critical infrastructure, there seems to be an attitude much like a home computer user. They know there is a risk, but in many cases don't feel like there is a big enough risk to justify investing the amount of money necessary to update, secure and monitor their systems (even some physical systems). In the U.S., government regulation to that would allow the DHS to "enforce minimum cybersecurity standards on infrastructure computer systems that, if damaged, would lead to mass casualties or economic loss". Regulation, however, was opposed.

I somewhat understand why some critical infrastructure providers may find it hard to justify large investment in cybersecurity. Last year, 198 cyber incidents were reported to DHS across all critical infrastructure sectors, most of which were reportedly spear-phishing attempts. Granted, many more attacks probably took place that were not discovered / reported, but with numbers like that, a director may be thinking that it is statistically unlikely that they would get hit.

For me, the takeaway is that critical systems are still not being designed with cybersecurity, and sometimes even physical security, in mind. Further, critical infrastructure providers have the same problems as any other business; their people - as well as technology - can be a security gap. Since critical infrastructure is a hot topic right now, I hope security and risk awareness increased, but I have yet to see any real changes implemented in many countries. Almost 10 years after the grand challenge was proposed, I would say that not only are we not designing systems that are "immune from destructive attack", but we are still not designing critical systems with basic cybersecurity in mind.

Image: FreeDigitalPhotos.net

Read More

Revisiting the Four Grand Challenges in Trustworthy Computing: Challenge 1

Almost a decade ago, the Computing Research Association published Four Grand Challenges in Trustworthy Computing. Working in a rapidly-evolving digital field it is easy to think everything we see is new, especially when it comes to digital crime. On a technological level this may be true, but if we look at higher level concepts has anything changed in 9 years, and what progress have we made?

In the introduction to the challenges, references are made to "increasingly portable systems in every aspect of life", cyber defense/war, threats relating to power outages, transportation and communications system (critical infrastructure) denial of service (DoS); insider attacks; "loss of privacy; alteration of critical data; and new forms of theft and fraud on an unprecedented scale". Each of the mentioned advancement of technology topics and identified threat areas are still relevant today. Most of which are gaining increasing awareness from the general public.

The group's overall goal was "to create an alternative future in which spam, viruses and worms... have been eliminated. In this vision of the future individuals would control their own privacy and could count on the infrastructure to deliver uninterrupted services... In such a world, policy and technology fit together in a rational way, balancing human needs with regulation and law enforcement."

"In short, it would be a world in which information technology could be trusted."

To this end, the four identified grand challenges of trustworthy computing are:

1. Develop new approaches for eradicating widespread, epidemic attacks in cyberspace.
2. Ensure that new, critical systems currently on the drawing board are immune from destructive attack.
3. Provide tools to decision-makers in government and industry to guide future investment in information security.
4. Design new computing systems so that the security and privacy aspects of those systems are understandable and controllable by the average user.

This post will focus on Challenge 1. The other challenges will be looked at in later posts.

Challenge 1: Eliminate Epidemic Attacks by 2014
Epidemic attacks, or "Cyber Epidemics", in this case are basically categorized as viruses and worms, spam, and Distributed Denial of Service (DDoS) attacks.

Suggested approaches to achieve this goal are summarized as follows:

• Immune System for Networks - respond to and disable viruses and worms by dynamically managed connectivity
• Composability - two systems operating together will not introduce vulnerabilities that neither have individually
• Knowledge Confinement - partitioning information so an attacker never has enough knowledge to propagate through the network
• Malice Tolerance - continue to operating in spite of arbitrarily destructive behavior of a minority of system components
• Trusted Hardware - tie software and services guarantees to the physical security of hardware devices

With the 9th of July 2012 recently past, the first DoS attack that comes to mind is DNSchanger. And with the increase of cyber activism / terrorism, DDoS is a relatively common issue for businesses and government entities. Looking at the Q1 2012 reports from McAfee and Trend Micro, viruses and malware are at all time highs for all platforms. Spam is also still increasing, with Norton's Cyber Crime Index projecting spam to be about 68% of all sent email traffic as total email traffic continues to increase.

Some advancements have been made in the suggested areas, for example Malice Tolerance, has been improved as a natural consequence to massively distributed computing. Trusted hardware became a big topic when Windows Visa used trusted platform modules (TPM) with BitLocker for disk encryption. TPM is still used, mostly in businesses, but did not really catch on with the public, seemingly because of privacy concerns and general lack of interest.

Immune System for Networks has advanced, but there are limitations. Security management platforms have to account for activities from many different sources, where malicious activities may not be known, or even suspicious. For businesses, targeted attacks using social engineering are increasing. The weak link continues to be a lack of awareness on the part of the user that allows many attacks to be successful. In these situations, current security systems are not robust enough to detect, and deal with, all types of incidents introduced by the users, while at the same time allowing flexibility and access that they require. Further, many organizations have not given proper consideration, or devoted enough resources, to their cyber security. For example, many business do not fully consider their cyber security, and are being targeted because of it [Irish Times][Infosec Island][CBS News].

As far as systems operating together that will not introduce vulnerabilities that neither have individually, I immediately think of application programming interfaces (API). APIs have become a common way for software components to communicate with each other, but many additional risks exist on both client and server sides when APIs are used [Dark Reading]. The Cloud Security Alliance even listed "Insecure Interfaces and APIs" as one of the top threats to Cloud computing (v1.0).

Finally, making sure an attacker never has enough information to propagate through the network. Unfortunately, this reminds me of Stuxnet. In the case of Stuxnet, the the malware propagates across Windows machines via network/USB, and checks for Seimens software. If the software is known to run on, or interface with, Windows machines, then the attacker just needs to take advantage of a vulnerability (or three) that is likely to exist in the system. There is not really much information that is needed to propagate through the network if network connectivity exits, and both systems are vulnerable to the same attack. Knowledge confinement could potentially be done by using non-standard configurations, but, then again, Verizon claim that in 2011, "97% of breaches were avoidable through simple or intermediate controls".

So looking at Challenge 1 as it was defined in 2003, eliminating cyber epidemics by 2014 seems unrealistic at this stage. While some of the suggested approaches have been developed, the application of these ideas into the practices of people, businesses, and even governments has not come to fruition on a large scale. This does not mean we are less secure. WhiteHat Security claims that in Q1 of 2012 there are less (web) vulnerabilities, and those that are identified are being fixed faster than in previous years. But, like Verizon, they also found that basic mitigation techniques, such as application firewalls, could have reduced the risk of 71% of all custom Web application vulnerabilities.

Until everyone begins to understand cyber security and their role (and take it seriously), the challenge will not be met. Will the Challenge 1 recommendations ever completely eliminate cyber epidemics? I don't think so. They can most definitely help, just like implementing basic security measures, but the Internet is not a closed system, and it only takes one weak link.


Image: FreeDigitalPhotos.net

Read More