Cyber risk is growing while confidence in internal defense resilience declining. According to Microsoft’s 2019 Global Cyber Risk Perception Survey, cyber security is a top 5 business concern for 79% of companies globally (and the top risk for 22% surveyed).

Threat intelligence (TI) is a critical component of your cybersecurity program, the defenses that mitigate cyber risk and help avoid potentially damaging incidents. For smaller businesses, this may be managed by an MSSP, but for larger enterprises, custom TI and management is a must.

What is threat intelligence?

Threat intelligence is, at its core, a collection of tagged and augmented data that can identify potential threats such as malware, ransomware, phishing attempts, botnets, cryptominers, etc. These are databased, monitored and contextually-enriched with relevant data such as IPs, URLs, system vulnerabilities targeted, implications of attack, and patterns of behaviour.

Armed with this information, your organization is able to detect incoming potential threats, set alerts and blocking, as well as engage in threat hunting activities. With a clever solution, TI is integrated with automated processes and machine learning, so analysts spend less time doing manual configuration and more time developing advanced analysis of incoming data and determining new undocumented threats. Data from external sources must seamlessly integrate into your security platforms and tools. If you can’t use it in an automated fashion, it will not likely be very helpful to your efforts.

In The Evolution of Cyber Threat Intelligence (CTI): 2019 SANS CTI Survey, 81% of respondents indicated that CTI had improved their security and response.

Why do organizations need threat intelligence?

Every day there are new threats released into the wild. Some may be obvious and/or simple to defeat; perhaps the ‘spray and pray’ type designed to impact personal data and systems which are easily detected by current organizational firewalls and network security mechanisms. Others can pose serious threats to organizational systems and data, and may even be directly targeting a particular industry, or worse still, your business itself.

Your organization needs real-time, accurate TI to give it the best chance at deflecting attacks.

Threat intelligence can help:

● Identify new threats targeting your business or industry

● Engage in threat hunting activities

● Decrease incident response time

● Prevent access to malicious resources on the Internet

● Avoid penalties and reputational losses from data exfiltration and breaches

● Identify system vulnerabilities

● Identify compromised systems

● Reduce unplanned down times

What do organizations do with threat intelligence?

TI is highly useful for cyber incident response. As per SANS Incident Handler’s Handbook, this process involves planning, identification, containment, eradication, recovery, and lessons learned.

It is also used at the identification and containment stages; incoming threats are identified, prioritized according to determined level of threat, then contained as necessary. Threats that do slip through the system can be shared with the wider community during lessons learned to keep everyone’s business healthy.

A well-functioning TIP / SIEM / SOAR and security team are both essential to ensuring threat intelligence is useful, timely, and prevents incidents. Alone, it is just one part of the process – and is only as useful as the infrastructure supporting it. It should easily integrate into your current SIEM and/or other platforms to save your security professionals’ time building out scripts to ingest data feeds.

Threat intelligence types and streams

From the SANS survey, there are four main types of threat intelligence:

● Indicators of Compromise a.k.a. IOCs (e.g. URLs, command & control centers, IP addresses, newly registered domains, etc)

● Threat behaviors, tactics, and procedures

● Digital footprint

● Strategic analysis of adversary

There are also a number of streams through which we can gather TI:

● Feeds from threat intelligence vendors

● Internally gathered information

● Community group feeds (ISACs, for example)

● Free feeds from security vendors

● Media reports

● Open source (or non-commercial) feeds

While everyone loves a freebie, open source and free feeds aren’t usually the best route to go down. The information they provide may be outdated, duplicated and/or need filtering and reformatting. Threat intelligence vendors such as Malware Patrol continuously process threat intelligence data drawn from internal and external sources to ensure it’s up-to-date, vetted, well-formatted, contextualized and enriched, before releasing it to customers.

Malware Patrol has been collecting threat data for over 15 years. Contact us to request a free evaluation of our services and to learn how our feeds and packages can be tailored to your business requirements.

Cybercrime steals an estimated $600 billion from the global economy every year. In the next several years we can expect that number to reach well into the trillions.

Phishing and spear phishing open most cybercrime attacks. At this point it’s as old as cybercrime itself. So of course it evolves. And like just about everything technological, artificial intelligence will play a greater role in that evolution, as well in the defenses against it.

Already, attackers and defenders have started to arm themselves with ever-more sophisticated approaches.

The first generation of tomorrow’s phishing attacks are in play today.

The First Wave

In these early days of AI-enabled phishing, attackers are using the new technology to more efficiently perform standard phishing tasks, like impersonation and monitoring. Think instead of a standard business email compromise attack, AI chatbots that trick users into clicking malicious links, or using AI to monitor executives’ behavior for more precise, effective, automated spearphishing.

What’s the difference between phishing and spearphishing?

Quick refresher: Spearphishing is phishing’s more targeted version.

A business phishing attack may target every employee or a subset of them. Spearphishing targets one specific individual and usually one with power, the CFO or Director of Operations for instance. Then threat actors leverage social engineering in order to perform a better con. They gather information about the individual and his/her business by following social profiles and discovering anything else they can online.

So at first contact AI-enabled spearphishing has the capacity for greater success if only because of the sheer volume of data and content that AI can search and compile into a convincing mimicry of the truth.

To belabor the metaphor a bit, AI-enabled spearphising is akin to GPS-enabled hunting with a state-of-art, no recoil, band-powered spear gun.

Machine Learning

Machine learning though goes beyond simple automation or even-deep dive research and algorithms. So AI enables not just the ability to scale at a rate beyond human capability, but fundamentally changes the architecture of attacks. Because metal makes different decisions than people it’s better equipped to avoid predictable tactics.

With this kind of paradigm shift, one particular countermeasure works quite well.

Fighting Fire with Fire: Whitehat AI to the Rescue

While it certainly presents myriad new challenges and novel phishing tactics, AI will also help businesses and cybersecurity pros combat phishing attacks. And no doubt some intrepid programmer is developing software for the individual user right now. What might these defenses look like?

Here’s a glimpse.

Simulation in Whitehat AI

TLS Certificates and their calm-inducing green locks help put users’ minds at ease. As the convention goes, if the green lock appears, a site’s encryption shields users from malicious attacks. Like anything that induces trust online, this means TLS certificates make for a big target. Phishers impersonate site certificates and do so evermore convincingly.

With the aid of classification models, neural networks can detect phishing and AI chatbots can waste hackers’ time so that they abandon their efforts and move on to easier targets.

With voice phishing on the rise in South Korea, its watchdog financial agency, in partnership with SK Telecom, plans to develop AI to prevent such attacks. Add to this impersonation detection algorithms like the ones FICO employs and you begin to get an idea of how cybersecurity has the means to stay in step with each jump in AI capabilities.

In fact, you’ve probably already benefited from profiling model technology that flags certain transactions as suspicious. Activities out of alignment with the profile are defined as “suspicious” and AI most likely had a hand in creating current profiles.

The Next Wave

Not quite revolutionary, right? How about repelling attacks before they launch? Under development with the Defense Advance Research Projects Agency and BAE, a prototype Cyber Hunting at Scale (CHASE) plans to offer proactive patrolling. CHASE’s design leverages computer automation, sophisticated algorithms and ultrafast processing speed (at least right now) to track huge volumes of data, and in real time. This allows it to leapfrog human’s abilities. But the program won’t cut people out of its cybersecurity strategy. Instead the program should provide human cyber hunters to access all that information. They’ll use that info to find attacks hidden within mountains of incoming data.

This kind of collaborative model may work best gambit in overcoming AI-enabled phishing attacks, at least for now. No doubt we exist in a watershed moment between today’s technology and tomorrow’s more advanced technoculture.

It’s quite possible the whole notion of phishing will be quaint and antiquated. This is particularly true if we continue to cede control to what were once tools and increasingly are both architect and worker in the modern world. Cue the ominous music, but while it plays don’t forget to stay abreast of the opportunities to work with AI to combat those who would use it as a weapon.

By Tenea D. Johnson

Founder, Progress By Design

 

In cybersecurity, the familiar is dangerous. Because of this, we must qualify what we already know and refresh our knowledge. Without this attention, cracks in the system grow until huge threats can fit through and shatter that complacency, along with business reputations and accumulated wealth. As in healthcare, cybersecurity continuing education isn’t just a best practice, but the only method that actually works. Phishing is a prime example.

By now, we all know phishing and the standard precautions it requires: be suspicious of links in email, double check URLs by hovering over links, and corroborate events that have supposedly triggered a message by going directly to the sender’s company website.

Easy. Almost second nature. Unfortunately, it’s also ineffective. Rote as those precautions may be, phishing remains the easiest and most prevalent way to introduce malware and steal valuable information from people and businesses. A recent Verizon report shows that email is used as an attack vector in 92.4% of the cases they compiled.

92.4%. And you can bet those phishing emails weren’t all riddled with misspellings and other obvious indicators. So, how is phishing still catching so many users?

Email Tactics: New Applications of Old Tricks

 

We can assume a certain percentage of users just don’t pay enough attention. Of course, one could debate that percentage, but I’d venture to say it’s not the majority. I feel your skepticism overworked IT department, but hear me out.

Even if most users did blindly click through whatever landed in their inbox, the automated precautions most enterprise systems use, like email scanning and quarantine programs, chop down that vulnerability.

So the question remains: how?

Let’s look at two tactics. One works consistently and the other appears to be gaining greater traction: event-specific phishing and Business Email Compromise (BEC) attacks—an oldie and a goody if you will.

Event-specific attacks succeed because they’re lent an air of legitimacy by outside events. Further, depending on the event, some users may be ill-informed about the event details and so more susceptible than usual.

Take the EU’s General Data Protection Regulation (GDPR) compliance for example. The shift to GDPR-compliant sites confused some folks, and their confusion proved an ideal phishing opportunity. As notices went out about the new privacy rules, cybercriminals capitalized both before and after GDPR came into effect, impersonating companies from Apple to Airbnb to get credit card and identity information.

Threat actors even use mundane, cyclical events, like the beginning of the year. For a more granular look at this tactic and others, check out this page of the latest scams affecting the University of Chicago. You’ll find very few strokes of genius, but you most likely will spot something innocuous and event-related.

What’s a BEC Attack?

 

The FBI started tracking Business Email Compromise attacks in 2013. This should give you some idea how much they’ve increased and the kind of threat they pose. In this gambit, emails arrive with no clickable link bait or malicious content. Instead attackers establish a relationship through impersonation and grooming. On some occasions, they even go so far as to interact with targets in real time. BEC attacks require enough information to convince targets a coworker or their boss (or even CEO) is sending the messages, and requesting money or information transfers. As such, these attacks are highly targeted, but for that reason they can also be highly effective.

But attack vectors vary. Email is only one.

Beyond Email: Alternative Phishing Vectors

 

On the other side of the coin, because users are on the alert for email phishing, they tend to drop their guard when not working in email.

As more businesses incorporate Microsoft Teams and messaging apps into their business processes, phishing has migrated right along with them. The same can be said of phishing for SaaS credentials (Slack, Dropbox and Microsoft Office 365 just to name a few), and phishing over mobile devices and cloud storage. To make no mention of search engine phishing or web ad phishing.

And bear in mind that AI-assisted phishing is just around the corner. More on that later. For now, familiarizing yourself and your team with the latest phishing tactics, say in an intranet communication (probably not via email so as not to desensitize them) or as part of your periodic releases, may be a good security practice to put in place.

You and your communications team know your organization best and what gets the word out most effectively. Just don’t forget to leverage that valuable knowledge when it’s time to broadcast information on the latest phishing threats.

By Tenea D. Johnson

Founder, Progress By Design

Want to dig deeper? Check out more posts on the Malware Patrol Blog.

Certain sites act as the cornerstones of the Internet. Even though they may change, they’re established and trusted. Many people wouldn’t consider any of them potential security risks. So companies and individuals use them as integral parts of their business processes and electronic life – Google Cloud Services and download.cnet.com for instance.

For a threat actor there are few tools handier than a trusted brand or site. It’s the perfect Trojan horse. Because of this, reputation jacking is on the rise.

What’s Reputation Jacking?

Threat actors place malicious content on trusted sites to gain access to user’s devices and spread malware. Instead of an outside attack, they wait for the victim to download software from a trusted source or otherwise insinuate themselves into a normal operation.

While phishing methods impersonate trusted brands, reputation jacking goes one step further by using the actual trusted brand or site to unknowingly host malware, while helping attackers avoid detection. And as quickly as these sites can neutralize uploaded malware, more arrives.

What Kind of Malware Is Hosted on These Trusted Sites?

Threat actors routinely use Remote Access Trojans (RATs) in these attacks. Because RATs allow control of an infected machine they’re versatile and particularly dangerous. Through this backdoor, an attacker gains total access to the infected machine and connected systems. Beyond monitoring activities, one can change settings, copy files, use the connection for even more criminal activity and a host of other unfortunate scenarios.

Often phishing emails work as the entry point to RATs into a system. First the attacker reaches out to potential victims through a malicious campaign that includes a link to a site. Standard computer security training warns people against such links, but if it connects to a trusted site or the phishing email mimics acceptable communication well enough, a RAT hosted on a reputable, established site works exceedingly well.

Also bear in mind that downloaded packages can conceal RATs too. So, if one were updating existing software or adding a new app from trusted sites this kind of Ttrojan could easily get in. After all, the SSL security certificate is valid and most people would click past the cursory warning to download from trusted sources, if they read it at all..

Threat actors are also Trojanizing actual apps to do their bidding. Unbeknownst to users and the site, download.cnet.com hosted a clipboard-replacing attack for years. The attack allowed malicious actors to replace a user’s bitcoin address with their own. That’s basically someone rerouting your bank deposits to their accounts. Given the fluctuating value of digital currency, it could even be a more expensive theft.

And it’s not just Trojans. Attackers embed malicious code into image metadata files on Google’s Content Delivery Network and can use other means like flash ads and malvertising that pop up on popular sites.

Ways to Combat Reputation Jacking

Reputation jacking works because people feel safe on certain sites. But whether the threat is on the site or in its applications, reputation jacking preys upon this trust.

So if a trusted site pops up on a potential threat list, think twice before you assume it’s an error.

Companies can overcome implicit bias, even when it’s positive. Some may find that restricting access to those on the lookout for and ready to handle potential threats puts them on a better footing. Others may need to implement a process that streamlines protocols so that everyone has simple solutions at their fingertips – cybersecurity team alerts or quarantining for example.

No one wants to slow their system or hurt productivity, but security shouldn’t be sacrificed.
Essentially, this would just mean you encounter more problems, faster. And who wants that?

Education can help. If individuals and companies expand their definition of “potential threat” to include “potential targets” it would more accurately reflect the cybersecurity terrain. Attackers target sites with the most traffic and best reputations because they make the most effective conduit. Knowing this is an important first step in cutting off that passage.

By Tenea D. Johnson

Founder, Progress By Design

The majority of recent DDoS attacks utilize source address spoofing techniques. These spoofed DDos attacks complicate mitigation efforts and hide the IP address of the originating system. It happens with TCP SYN floods as well as UDP amplification and reflection attacks. This post was created to raise awareness on the existence of best practices to prevent address spoofing. Administrators of networks connected to the Internet are urged to implement ingress filtering according to BCP 38 and RFC 3704 to prohibit the abuse of internal devices to generate spoofed packets.

DDoS attacks, as the name suggests, originate from multiple devices distributed around the Internet. Packets traversing IP networks contain a header with source and destination addresses. In spoofed DDoS attacks, source addresses are modified on purpose to point to something other than the originating device. The receiving party is fooled to believe that replies must be sent to the spoofed address. Therefore, the real address of the attacker can’t be discovered.

Network administrators must enforce policies to only allow packets with legitimate source addresses to enter the Internet. This rule applies to ingress (input) traffic to border routers. Restrictions should enforce that only traffic originating from addresses assigned to the network or networks directly connected to border router interfaces is forwarded.

For example, suppose ISP A (Internet Service Provider) runs router R1 connected to the Internet on its interface f0/0 and customer X is connected to interface f1/0 with an assigned IP address range x.y.z.0/24. Traffic originating from customer X is ingress to router R1 and only packets arriving at interface f1/0 with source addresses in the range x.y.z.0/24 should be forwarded. Packets containing any other source address should be dropped on that interface, not forwarded.

It is important to drop packets, instead of blocking them, to avoid producing additional traffic by the router back to the originating network segment.

RFCs and BCPs are formal documents published by the IETF (Internet Engineering Task Force). The acronym RFC means Request For Comments. These documents describe specifications, protocols, procedures and events and are the result of committee drafting and subsequent reviews by interested parties. A designation is assigned to each RFC from the following options: informational experimental, best current practice, historic or unknown. Some informational RFCs become Internet standards and further modifications are only allowed as a new document that obsoletes the previous one. RFCs with status best current practice are referred to as BCPs.

The first RFC was published in April, 7 1969 by Steve Crocker to archive notes related to the development of ARPANET.

RFC 1 – Host Software http://tools.ietf.org/html/rfc1.html

BCP documents receive two numbers, one as a RFC and another one as a Best Current Practice. For example, BCP 38 is also RFC 2827. BCPs describe guidelines, processes, methods and other subjects not suitable for a standard. As of this writing, the last BCP is 205 from July 2016.

BCP 38 has become a critical tool to help mitigate DDoS attacks. Implementing it means your devices won’t participate on attacks that employ source address spoofing. Notice that BCP 38 doesn’t protect against floods originating from valid source IP addresses.

All providers of Internet connectivity, operating or not an AS (Autonomous Systems), are highly urged to implement ingress filtering mechanisms according to BCP 38 and RFC 3704 to prohibit attackers from using forged source addresses.

Unfortunately, this is not implemented in many networks yet. Best practices are known for a long time, the first published RFC on this subject was 2267 in 1998, followed by 2827 (BCP 38) in 2000 and 3704 (BCP 84) in 2004.

RFC 2267 – Network Ingress Filtering: Defeating Denial of Service Attacks which employ IP Source Address Spoofing http://tools.ietf.org/html/rfc2267.html

RFC 2827 / BCP 38 – Network Ingress Filtering: Defeating Denial of Service Attacks which employ IP Source Address Spoofing http://tools.ietf.org/html/rfc2827.html

RFC 3704 / BCP 84 – Ingress Filtering for Multihomed Networkshttp://tools.ietf.org/html/rfc3704.html

There are distinct methods to implement ingress filtering in a network. The choice must be based on the topology and the advantages and disadvantages of each deployment option.

• • Ingress access lists: most common method that compares addresses of every packet against a list of acceptable prefixes. Its main disadvantages include the manual maintenance and size that may become large depending on the environment.

• • Strict Reverse Path Forwarding: is conceptually similar to access lists but Strict RPFs are dynamic. It is a simple and fast option for edge routers that advertise BGP prefixes. Implementation brings some challenges on networks that employ asymmetric routing or are multi-homed, requiring the usage of BGP communities to force longer internal (not advertised) AS paths.

• • An extension of Strict RPF used to solve some of the problems experienced on asymmetric routing or multi-homed networks. In simple terms, if the advertisement of a prefix is filtered, packets will be filtered as well.

• • For the presence of a route, including the default, to decide if packets should be forwarded or dropped. It doesn’t take into account where the route points to. It is in fact a route existence check. Problems with drop packets may occur on asymmetric routing environments.

• Loose Reverse Path Forwarding Ignoring Default Routes: is an explicit route check method that excludes default routes. Is useful when routes are created to cover all legitimate traffic and default routes only exist to catch bogus traffic.

The following additional scenarios must be taken into account when implementing BCP 38 or mitigating DDoS attacks:

• • Spoofed source addresses don’t have to belong to unassigned or reserved networks, like 10.0.0.0/8 or 192.168.0.0/16. In fact, attackers most frequently randomize source addresses, utilizing prefixes assigned to geographically distributed networks and even the few ranges still not assigned to any company.

    During a SYN flood attack, the targeted system sends SYN-ACK replies to what it believes to be the originating systems, looking to complete the 3-way TCP handshake. Because source addresses are spoofed, innocent systems receive unwanted traffic. Under certain circumstances, this may result in a secondary denial of service.

• • A situation that is not commonly taken into account during the mitigation of DDoS attacks is an attacker spoofing a certain network or networks, creating for example a SYN flood. The network administrator of the targeted infrastructure calls its network provider, ISP X, and decide to filter all traffic coming from the impersonated networks. The consequence of this action is users from non-hostile spoofed networks are denied access to all networks connected to ISP X, resulting in an unintentional denial of service. This unveils how sensitive is the task of blocking traffic originating from the Internet, without an appropriate assessment.

• • Network operators should log information on dropped packets to monitor suspicious activities.

  • If IPSec and AH (Authentication Header) are not enabled, spoofing IPv6 source addresses is as simple as in IPv4 [3]. Unfortunately, the IPv6 specification makes the usage of IPSec optional. Source routing would be another option for attackers, but versions 4 and 6 of the Internet Protocol have the routing header type 0 disabled by default.

References:

[1] BCP38 – http://www.bcp38.info/[2] DoS SYN flood attack – http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/100830-asa-pix-netattacks.html[3] IPv6 security brief – http://www.cisco.com/c/en/us/products/collateral/ios-nx-os-software/enterprise-ipv6-solution/white_paper_c11-678658.html[4] Ingress Filtering For Multihome Networks – http://tools.ietf.org/pdf/rfc3704.pdf
 
 

Protect Your Business

Malware Patrol offers a wide variety of threat intelligence feeds for use within organizations of all sizes and industries, including a real-time feed of amplification and reflection DDoS attacks that have happened in the last 24 hours. We verify our feeds constantly – every hour in most cases – to ensure they contain only actionable indicators that protect our customers against malware infections and data breaches.

For ease of use, we format the feeds for compatibility with the most popular security tools and platforms. To learn more or to request a free evaluation, you can contact us and our cybersecurity experts will get in touch with you.

The vast majority of active malware and ransomware families include some sort of communication with command and control servers (C&Cs). This connection allows them to receive instructions, such as which institutions to target, the encryption keys for ransomware, and targets for DDoS bots, as well as to exfiltrate stolen data.

Command and control systems are vital for the success of malicious campaigns and are analyzed in detail by security companies that work around the clock to shut them down. This results in a “cat and mouse” game between attackers employing new features to make the take-down process more complex and time-consuming, and security vendors striving to protect their customers. Historically, C&Cs were hosted at IP addresses or hostnames hard-coded into malware samples. Disabling such services was often easy and quick, and as such, these kinds of malicious campaigns did not remain active for too long.

Attackers evolved to more complex methods: fast-flux domains, lists of domain names, peer to peer communications, Tor services, and domains generated via algorithms (DGAs). Ransomware binaries, for example, need an encryption key known by the attacker and will not encrypt victims’ files if they cannot communicate with a command and control system. Similarly, malware that isn’t able to reach its C&C server will not relay stolen personal and financial information. Some ransomware families employ DGAs that generate hundreds or thousands of new domain names every day. Samples installed on victims’ computers try to resolve each of the domains, one at a time, until it is successful. This strategy complicates the take-down process because the attacker can register any of the hundreds or thousands of domains and that domain will be used by the malware sample only for one day. The next day, a new list is generated. Therefore, if today’s  domain is taken down, the attacker has another chance tomorrow.

DGAs are simple algorithms usually based on the current time and a random set of characters called a ‘seed’. These two pieces of information are inputted into the algorithm and a list of domains is generated. The length of the domain names as well as their TLDs vary greatly from family to family. Distinct campaigns distributing the same malware family can use different seeds yielding new lists of domains. This highlights the necessity of actively blocking access to domain names generated via DGAs, as well as to command and control URLs.

Malware Patrol tracks a large number of malware and ransomware families that employ DGAs, including their multiple seeds. We provide threat data feeds and block lists, helping organizations protect their employees, customers, and assets from infections, data exfiltration, and extortion.