Threat Intelligence Platform is Live

For those of you that have shown an interest you will be receiving a trial of our threat intelligence search platform within the next few weeks. The system is being rolled out in Beta. All that we ask is that you provide any feedback you may have if you find any bugs or issues. In addition we will be rolling out new features and visual tools over the next few weeks as well.

To obtain a trial account email your name, organization and email address to soc(a-t)slcsecurity.com and we will create your trial account.

Web Scanning Engine

SLC Security Services LLC has just launched a web scanning engine with capabilities to find similar registered domain names, blacklist checker and link analysis tools for domains and threat intelligence data. The new system will be integrated into our Threat Intelligence Beta program. If you would like to be a part of the threat intelligence beta program please joint the mailing list and request access by emailing soc(-at-)slcsecurity(D-o-t.)com for access.

Disbelief, Legal Threats, Admissions of Guilt... What a week...

So it's been an interesting week at SLC Security. We have been doing many security notifications over the past few weeks and the number one reaction to put things in perspective is disbelief. One company that we previously reported on actually called us back in disbelief. From what we can gather they have been owned for quite some time but have failed to resolve the issue (and we are still seeing problems from their network).

We have been providing grace periods before we report the issues and it's funny because until we post information on a company nobody even cares. They ignore the notifications and then as soon as the post hits the blog they want to call in a panic when if they responded to our notifications in the first place we would have not posted the information in the first place.

Also here's the biggest issue. Many times we remove the post if requested if we feel that the company is doing something to resolve their issues but guess what happens 95% of the time? They get added to the blacklist and our system detects activity and we know that they are still vulnerable to the same issue that we attempted to notify them of in the first place. So what should a group of security professional volunteers to do? Do we let the public vulnerable? That's what most of these companies would like to see us do. No we simply block them in our blacklist and then it goes out to our clients and customers that subscribe to our feeds.

It's a shame really that these companies can make money off of the Internet yet they don't want to invest in a secure environment for their computing requirements. In fact the number one issue we see is that people just don't seem to care. They would rather deny that they have an issue or try and brush the activity under a rug. Well guess what? You can't stop foreign companies from calling you out and the blacklist are still showing a problem.

Here is what you should do. Hire us! We reported on issues at BCBS (2 months prior to them becoming public), we reported issues at JP Morgan Chase (prior to them acknowledging an issue). We all know the PR nightmares that were caused by these cases and there are a few others that we detected ahead of time. The reality here is that our subscriptions and solutions are way cheaper than the PR nightmare of actually having to disclose a breach so my suggestion is to consider the fact that we are detecting problems faster than some of the larger infosec companies out there and our technology is completely different than what is being used in a traditional security model.

It really makes you stop and wonder as in the case of one of the big breaches several other entities that were named never publicly disclosed any issues yet after the big breach notification we stopped seeing the malicious activity. Do you think it is possible that they decided to fix the issue and sweep it under the rug?

--

SLC Security Services LLC is a private intelligence company located in Raleigh, NC. The company has been making breach notifications to companies and organizations that are not customers in order to help protect clients that could be affected by security issues on their corporate networks. The company has been providing notifications with a 2 day grace period before posting the notifications.

SLC Security provides threat intelligence products that can be directly consumed by your IDS, Firewall and monitoring solutions. We also provide outsourced monitoring to companies that want to augment their security staff and do not want to have to hire expensive analyst in house. By outsourcing your monitoring you are allowing your security teams to fix problems while you leave the detection and notifications to our highly skilled analyst.

NEWS: FBI investigating two St Louis area attacks as hate crimes

The FBI is investigating whether hate crimes were committed during two St. Louis area attacks where suspects allegedly made reference to Ferguson, including the assault of former St. Louis Cardinals outfielder Curt Ford, investigators said Monday.

Both attacks happened in March, one involving a white victim and black attackers, the other a black victim attacked by a white man. The suspects in both cases allegedly made references to Ferguson, the St. Louis suburb at the center of racial strife since a white police officer in August fatally shot 18-year-old Michael Brown, who was black and unarmed.

FBI spokeswoman Rebecca Wu said the agency is looking into both cases for possible hate crimes. Anyone found guilty of a federal hate crime involving bodily injury could face up to 10 years in prison.

Dyre and Upatre Evolving - Emerging Threats gets it right

We were just reading a report from Emerging Threats concerning the development and frequent changes and variations to these malware products. What this indicates is that the malware is under active development making it extremely difficult to catch all the variants.

Read the original document here.

The article was well written and very concise and on point.

Traffic drops on our sensors

Last night our security engineers noted some very interesting things happening with our sensors. After midnight some coordinated attacks that we have been seeing for weeks suddenly dropped off. We have not see a single attack since midnight yesterday.

This is highly unusual since we have been under sustained attacks since 2005. What this may indicate is that the organized attackers are starting to realize that by attacking our infrastructure they are denying themselves access to many other targets. You see by attacking us you allow us to send out updates to thousands of Internet users thereby protecting them from attack.

Only time will tell if this strange, eerily silence continues. Keep in mind though Mr. Attacker that we have visibility on thousands of endpoints and we will continue to protect our customers regardless on who you decide to attack. If we see it, we will block you, end of story!

Hackers Steal Up To $1 Billion From Banks

Now that's a headline that will just reach out and grab your attention. The obvious question here is why did they do it and secondly what will they be using that money for to finance. Pay attention friends things are getting very interesting these days.

Original Article

Memex Toolset Released...

DARPA has publicly presented for the first time a new set of search tools called Memex which will improve also researches into the “Deep Web”.

In 2014, the U.S. Defense Advance Research Projects Agency (DARPA) launched a the MEMEX project to design advanced search tools that could be also used to scan the deep web, which isn’t indexed by Google and other commercial search engines.

The Memex  search engine was started to allow search of not indexed content, an operation that in the majority of cases is still run manually by Intelligence Agency.

Read the Full Article Here

NEWS ROUNDUP 2/10/2015

Twitter Request from the NSA top 1.9 Million Account Request
UPI posted a story today on the 190 million users on twitter stating that the NSA has requested the information on less than 1% of Twitter users. So that means they have received information on 1.9 million Twitter accounts. That's a little different than stating 1% huh?

Read the original article here. 

American hostage Mueller's death confirmed by Obama, family

 

US to unveil new Cyber Security Agency
The U.S. government is creating a cybersecurity agency that will monitor and share information about threats against the government and private businesses in the wake of high-profile cyberattacks at Sony Pictures, Anthem Inc. and several major retailers.

NCTC director who is now executive vice president at Leidos, a national security contractor.

CyberCaliphate at it again
The Twitter feeds of Newsweek and veterans' group Military Spouses of Strength were hacked Tuesday morning by a group identifying itself as CyberCaliphate, the same organization that was confirmed to have hacked the twitter account for U.S. Central Command earlier this year.

Anthem Breach Prompts New York To Conduct Cybersecurity Reviews

Meanwhile, Anthem victims are now being harassed by scammers trying to collect even more personal information.  

CFAA may stall cyber security research unless Government exempts security researchers

All of this at a time when we need to share information more than ever.

In the wake of news-making attacks on Sony Pictures, Home Depot and many others, the federal government is establishing a new information integration center to focus on cyber threats. The center will analyze intelligence contributed by several agencies, along with the private sector, a model that will face some serious hurdles.
The proposed Cyber Threat Intelligence Integration Center will fall under the Office of the Director of National Intelligence and it will not be responsible for actually gathering any threat intelligence. Rather, it will serve as an aggregation point for information collected by intelligence agencies and, the Obama administration hopes, private companies.

Note
Please tell me on one hand you are looking to share information and the other hand you are increasing the penalties without excluding research and development? Doesn't make sense to our team.

Delay in actionable intelligence creating additional risk, additional malware seen

With the recent Anthem incident it goes without saying that organizations need to share information to protect other entities from similar attacks. In the case of Anthem the information has been shared with only 2 organizations and the information being put out by commercial vendors is incomplete and in some cases completely inaccurate. What we are seeing is that many people are making guesses as to what the actual threat is.

It seems like this recent issue and with the Sony issue that in both cases the information coming out of the analysis of these events is being withheld from commercial security vendors. This does nothing to protect others that may face similar attacks. It should be noted however that the attackers in this case have moved on to other attacks.

This is a concerted effort to infiltrate many businesses and Government. As of yet we have not seen any real and meaningful cooperation between Anthem, Sony or the Government. If they really wanted to protect the masses clear and concise information would be put out for everyone.

This leads me to believe that nobody really knows the exact methods. I can tell you that there are zero day attacks being used as well as a known browser flaw that is not being fixed by vendors. If hackers know about it and vendors choose to ignore it there is really nothing the average person can do to protect themselves from the threats that loom.

I have predicted that the educational space will be the next to have issue based on what we have seen. Because of this we will offer educational institutions access to our blocklist in the hope that some will be proactive and save themselves some embarrassment. There have been several attackers on Twitter posting educational information and much of the stolen information is available on Darknet and being shared between hackers.

This open sharing initiative that everybody speaks of is non existent and probably will not come to pass. It's a shame really as there are power in numbers. We need a distributed protection system that can incorporate actual information between vendors in near real time. Until this happens we will continue to see disinformation. In addition the naming conventions between commercial products is horrible and confusing and interoperability between companies is horrible as well.

The additional malware being seen that is NOT being tracked by any of the major vendors was previously posted.

Indicator Information

IP Addresses Involved:
196.203.89.134
194.105.9.85
82.81.128.61
50.56.56.125

Also it goes without saying that certain file extensions should be dropped by your email gateways.

NEWS ROUNDUP 2/9/2015

Hard to Tackle Malware being used in University Breaches:
Many security professionals including our company have been warning Universities to activity that indicate a large scale problem on their networks. Many of the Universities have chosen to ignore the issue. Earlier today at one of our client sites we saw for the first time a malware that was running completely in memory and that is not detected by any of the major anti-virus products. The malware is currently being studied but it appears to be related to earlier reports of activity that we have been picking up on our sensors. We believe that the malware probably will be used to perform farther damage in the future. We have submitted the memory dump to several anti-virus vendors and are awaiting additional details.

Company's Doing one of Two Things:
Either companies that we are notifying are acknowledging issues or they are quietly cleaning their issues. We noted several of the Universities originally on our University post that have since dropped off our sensors so that's good in that they are no longer infected. The bad part is that they may not know what information has been stolen or damaged on their respective networks. So companies or entities are either acknowledging they are in over their heads or covering it up completely.

Collaboration in the Works

We wanted to let the readers know that we are working on a collaboration with several security providers to provide our intelligence products to help improve situational awareness against threats to infrastructure. We are currently working on integrating our data sources into several open source and commercial products to help make the security landscape of individual computer users (home users), business users (corporate users) and Government entities. 

Stay tuned in the coming weeks as new service offerings are provided to existing commercial products and open source software and hardware products. Here are some of the things we are working on in the lab. 

• Threat Feeds to Commercial Products - We will provide a list of products soon
• Threat Feeds to Open Source - Integration with Snort and Linux based systems as well as the release of our SLC Security Platform for Windows machines (coming spring 2015)
• Bulletin Service where we send out flash alerts directly to customers via the security platforms that we manage to include our OSINT-X platform and OSINT-X security appliance
• Open integration of our products (build a solution with our data)
• Security alert mailing list (Active now - You can subscribe from our website and blogs)

There will be much more coming so stay tuned.... And have a great weekend. 

How we monitor for problems and detect issues before the attack...

Utilizing our cloud based computing platform we are able to see attack information as it happens in real time. We are able to monitor Dark Net, Usenet and OSINT sources for relevant information concerning the activity of hackers and cyber criminals. We have been warning companies and advising them on what to look for but they don't seem to take our warnings seriously. And months later we read about issues in the news once they finally figure out that we were right in the first place.

It has happened numerous times in the past and will happen in the future unless these entities take our alerts seriously. Companies are too busy looking at their perimeter's to really get an understanding of what is really taking place. All too often the information is available to indicate a problem because once a site is breached typically other attacks are launched from that same infrastructure to other organizations. Using link analysis between companies and attacks that are being reported is a smart way to connect the dots folks. These technologies exist for a reason and as systems evolve they get better and better at predictive analysis based on past activity.

We sincerely hope you start putting the pieces together because the time of breach until there are actual notifications are usually around 12 months out. Anthem just caught the problem in 4 months but that means that they are better than average at detecting the problem but not stopping it.

If any of these companies took their security seriously they would consider utilizing big data to highlight problems before they are nightmares for the companies involved.

Quite honestly our team of volunteers are extremely good at detecting issues but we simply do not have the resources to do our analysis on a large scale. If we had the funding and additional resources we could certainly assist with these investigations but as of now we will continue to do large data analysis and warn the companies that we note as having problems in the hope that at some point a company will notice that we are way ahead of the "average" and help us get to a place where we can really be effective and assist law enforcement in containing these issues and actually finding the entities responsible for these data breaches. Until that happens we will continue to research, blog and watch from the sidelines.

If the Government were to really fund the cyber security initiatives and get private industry to bring technologies that work to market we could be a much bigger help in these cases but until that happens we will sit back and watch.

It's a shame really.

So here's what we suggest to help prevent these large breaches in the future. Stop withholding data when it comes to cyber security. Provide a clearinghouse where we can report issues and use the indicators of compromise that we have developed. I'm sorry but 95% of the technologies in use are reactive. You need analytics that can find trends and identify suspicious activity over the entire Internet connected infrastructure.

Until we have a view of the entire Internet we are confined to our own little LAN connected world and chances are somebody has already infiltrated your infrastructure. If you want to wait 12 months while they steal your data be my guest or hire us to come in a get rid of the badness and save yourselves some major embarrassment.

Later this week we will for the first time every compile a list of all of the organizations that we are more than 80% confident that have issues that need to be addressed. Our system is reporting on real world attacks and since we report on these attacks we are a major target. One good thing about being a target is that it forces attackers to show their infrastructure that they are using to attack us (and many others). Using this data we can quite quickly build out a clear picture of bad activity being directed at us and others.

Have a great week and we look forward to working with the ones that value their security posture.

Krebs Post about Physical Attack

Yeah hackers are changing their tactics. Like I said last week while everybody is concentrating on the network hackers are actively using hardware and physical attacks. Read my original post here.

If you want a firm that can actually find problems and not just give you a false sense of security contact our SOC by email to schedule a no obligation audit. If we don't find problems you don't pay...

Kreb's story can be read here. 

We have seen everything you can imagine over the last 25 years. Cell phones are still one of the biggest threats as they are cheap, can be untraceable and have long battery lives but attacking corporations is even easier since they rely on old technologies that are not even checked during most audits. Our audits are complete and concise and when you companies realize that we can actually give you piece of mind instead of just talking about it give us a call and let us prove to you that security is our main business.

Private Security Companies more of a threat than Government Snooping

You may think that the Governments warrantless wiretapping and surveillance programs are troubling but private companies and operators are more of a threat than even the Government. Think about it this way. When Government wants to do long term surveillance they are supposed to follow CALEA and FISA rules to conduct the surveillance and they are supposed to terminate that surveillance if the collected data exonerates the targets of that investigation. At least some of the time judges and secret courts place restrictions on the surveillance authorizing the surveillance for a certain period of time.

It should also be noted that nearly all of the request that go to the FISA court are approved. Sometimes even without a very good justification. But private operators are even more dangerous than the Government because they don't have to follow any legal rules.

Just look at rules on electronic interception that fall under 18 USC as one example. There were no prosecutions under these rules last year or the year before that. Even when there are prosecutions they usually are for associated crimes and not the interception itself.

So the next time you think that the Government is your biggest threat you should really think again. The private operators collect, store and share information about targets more easily and with virtually no oversight.

Hackers for Hire Getting Publicity

I was quite surprised the NY Times published a recent article on "Hackers for Hire".

The website in case you were curious is at http://neighborhoodhacker.com/

There are many other sites as well but this is the one getting publicity right now.

NEWS: NY Post Twitter Hacked

The New York Post on Friday said that one of its Twitter feeds focused on business news had been hacked, following a series of inaccurate Tweets on the Federal Reserve, Bank of America and military engagement with China.

"Our Twitter feed has been hacked," the newspaper said on its "@NYPostBiz" account.

ThreatStream Picking Up our Feeds - Feeds Will Be Changing to Customer Only Certs Soon!

If your a ThreatStream customer and would like our indicators make sure you opt in the control panel. Check out our accuracy and you will see that we are good at what we do.

In addition we have many new products and services for 2015. Our company is leading the way in the intelligence space. Some much larger security firms are snagging our data and reselling it. For this reason we are about to change to a certificate based authentication mechanism so we can get compensated for the long hours we put into keeping you safe.

Hey where did the domain monitoring go?

We wanted to let you all know that we are no longer offering notification services on domains. In order to get this information you will be required to subscribe to OSINT-X or purchase a system to host the solution at your location. Our business model has changed significantly over the past year and it is not longer in our best interest to provide a notification service that you can setup for yourself in the OSINT-X product line.

"This change may affect some people but at the end of the day the information being ingested into OSINT-X is more up to date than the system that scours our feeds for your companies information. This move is a win for our customers." said Kevin Wetzel of SLC Security.

The Grinch?? Alert Logic's Claim's Not Adding Up

So as penetration testers we immediately took the information provided by Alert Logic in a recent notification concerning a vulnerability in Linux systems known as "the grinch". Our technical staff have all tried to confirm the information provided with the information provided in their post. Guess what?! We can't get any of the systems we have been testing to actually prove this exploit exist.

We have tested on RHEL, Fedora, Ubuntu and a few other distros and as of 5PM EST have not seen a single system that will allow us to exploit this vulnerability.

If anybody has more specific details on how this is accomplished we would love to hear about it.