The Latest Hacking Craze - Old Attacks - New Technology

SLC Security provides an SDR course for beginners. What is an SDR you ask? SDR stands for "software defined radio". No longer is it the craze to go and buy or construct a tinfoil hat in 2014. In fact even if you did there are still ways to pickup very tiny signals, in much larger signals (trace signals) that used to be nearly impossible. OK, OK enough of the rambling.

One vector we are starting to see from hackers is definitely old technology. Remember TEMPEST? Well if you don't know anything about it, let me just say it's the unintentional transmission of signals from devices that are not properly shielded. Or in some cases that can't be shielded due to their design.

Everything with electrical energy passing through it has some sort of emission. Some devices such as transmitters are designed to emit this RF energy, some things like your computer monitor or your USB keyboard are not (but they do). Utilizing $20 USD in equipment it is possible to capture keystrokes and recover the text being typed at around 85% accuracy. It's possible to get about 80% of your monitors pixels also from the same methods and while the picture may be fuzzy it is somewhat readable.

Don't believe me? Well you don't have to. Here's something you can play with if you have a monitor and an AM radio. That's right your computer monitor likes to transmit AM radio...

Download "Tempest for Eliza" and give it a shot. I think you will have some fun with it. Then when your done call us and we can show you how we can recover your works screens during an audit from 21 feet away, through a wall from a parking lot, another floor, etc, etc. Oh and don't get us started on some of the lovely Cisco equipment out there that is inexpensive. That wireless router is leaking like you wouldn't believe (and not on the intended frequencies either).

We have so much fun doing our jobs. It's nice to take a break and get silly from time to time.

SLC Security Services LLC is licensed for Counterintelligence Service in the State of North Carolina. We operate in all 50 states and are available for TSCM related sweeps and consulting, RF engineering and Satcom Engineering work. Call (919)441-7353 and request to talk to a TSCM tech.

EXCLUSIVE - The Malware Hitlist

The following list is a historical look at Backoff and similar malware over the past few months. Many Retailers have been affected by this malware and the list appears to be growing rapidly. This is a 3 month time slice of malware that was detected by sensors and reported by third parties. Please keep in mind that these reports are only as accurate as the whois records and many of the offending host have been taken offline. No additional information will be released at this time.


VPLS Hosting Company - Multiple
TeleDanmark
JSC VimpelCom
Wrangler Forum
LG DACOM Corporation
Boeing
Lockheed Martin Corporation - Multiple
Hyundai Corporation
Military Networks - Multiple
OVH SAS
QUAL.IT S.A.S.
Jimmy Johns - Multiple
Department of Veterans Affairs - Multiple
Netago - Multiple
City of Georgetown Texas
USIS
L3 Communications
ANL - Multiple (Government)
Leon Lundberg
EGI Hosting
Korea Telecom
LinkedIn
Supervalu
City of Phoenix, Arizona
Sheetz Inc
Northrop Grumman Corporation
KDDI Corporation
CNCGroup China - Multiple
SONY - Multiple
P.F. Chang's - Multiple
RN Data
RMMI Inc
Starbucks- Multiple
INULOGIC France
Feedly
Yahoo
Ross Department Stores
Goodwill - Multiple
Harvard Business School
Evernote
Nieman Marcus
OVH Systems
Ionity Corporation
ACME
City of Atlanta GA
Amazon
Astro Telecommunications
Michaels Corporation
US Army Colo
VolumeDrive
Qutar Petroleum - Multiple
Extended Care Allscripts - Multiple
Western Union - Multiple
United Parcel Service - Multiple
Bartell Hotels - Multiple
US Airways
Aria Telecom
Dairy Queen - Multiple
City of Los Angeles CA
Department of Energy
LA Police Department - Multiple
Aaron Brothers
IRS
NRC Systems
NDC Systems
Prudential
OPM
Sears/KMart - Multiple
Home Depot - Multiple
Amazon Web Services - Multiple


Additional Entities:
Visafone Communications Limited
Korea Telecomm - Multiple

Webex Trollers on the Prowl

We have been asked by a company to determine who has been dialing into their Webex. The Webex session showed a phone number but the person on the other end failed to identify themselves on the call.

We quickly advised the client to password protect the Webex sessions. Why wouldn't you password protect your Webex sessions in the first place? It's the same reason passwords are reused. Ease of access.

Brian Krebs previously reported on companies using Webex without passwords. His research indicated several dozen large companies were hosting meetings without passwords. I have actually logged into the wrong Webex on two occasions because of fat fingering meeting numbers when connecting to Webex. When this occurred I told the person(s) on the call that I had inadvertently connected to their meeting and promptly hung up.

One of the vulnerabilities we have noted is that companies that use hosted Webex services in many cases fail to password protect their meetings and this is something you should probably check for in your organization. It's not a big deal in most cases unless your discussing patients or unless you are a financial institution. However all businesses should be wary as we are pretty sure China and Russia may also troll Webex for companies in order to clean intelligence information.

If you notice somebody on your Webex that you can't identify your best option is to terminate the meeting and send out new invitations with a password protected Webex.

The Learning Series: Lesson 1 Access Control List - Be specific, Be precise!

As many of you know this blog is staffed by volunteers and various individuals that have experience in computer forensics, network forensics, malware deconstruction, operating systems and other areas of expertise. SLC Security Services LLC (the sponsor of this blog) has been working to really define some of the goals of this project and one of the main items on the to do list was to provide some tutorials and write ups for network administrators and security staff to assist them with various items that may be of help when securing their networks and infrastructure.

One of the first things we notice during audits is that many corporates fail to use ACL's (access control list) effectively. When properly used and ACL may mean the difference between simply having a single machine compromised and have customer data stolen. I think we all can agree that rebuilding a single system is a better use of company resources than rebuilding an entire site or multiple sites and ACL's are one way to ensure that a simple exploited system does not result in a much larger disclosure or compromise of PHI/PII or credit card data.

When we audit most companies one of the first things we usually notice in about 90% of our audits is that administrators rarely if ever setup the correct ACL's on their systems. ACL's are a last line of defense in ensuring that even if a box is compromised that the data residing on that system cannot leave your infrastructure without you knowing about it. In about 70% of audits we have performed over the last year we have identified either incorrectly implemented ACL's, no ACL's in place at all or a major lack of understanding of the corporate network layout so ACL's are implemented only to block specific items.

Let's take a POS example of one place that ACL's should ALWAYS be implemented. POS systems by their design only have to communicate over the network to a few different servers. You would want to allow only the communication from the POS system to only the system and services required for operation and everything else should be blocked. One recent remediation after a compromise indicated that the traffic leaving the network was being sent out over the HTTPS protocol to the Internet through a proxy server that was setup externally. There were several places in which an ACL would have stopped an automated or hacker dead in their tracks had the proper ACL's been implemented on the network switch and router that was sitting between the POS system network and the Internet. The POS system in this case had a VPN client enabled on it that was an SSL VPN so blocking HTTPS entirely would not have worked but restricting HTTPS traffic with an ACL to the single host that the POS system needed to talk to would have closed those ports and not allowed the credit card data to leave the POS network. The POS system needed only to talk to 3 other IP addresses on 2 other services for proper operation. The first question we ask was why there were no ACL's on the network switches and the customers response was we didn't feel it was neccesary.

After the audit I can tell you that every location is not secured with the proper ACL's. Had the ACL's been implemented from the start this client would not have had to notify their customers of the breach and we would not have had to go in a reverse engineer a pretty nasty attack.

Some general rules:
1. Only allow these systems to talk to known systems required for proper operation. Block everything else.
2. Use multiple layers of ACL's on switches, routers and firewalls. This will ensure that if one device is compromised that there are backups to prevent traffic from leaving the network that is not authorized.
3. Know what traffic is going where. Open up services one at a time and only for the required network destinations. There should be no blanket rules allowing HTTP for example. Why would a POS system need to access the Internet? It doesn't and if it does it would only access a vendor site for updates so only allow that single system to get to the vendor sites for updates and block HTTP access to everything else.
4. Block anything not being used. Deny should be the default rule with all ACL's. Sure it takes time to build complicated ACL's in your network but it helps to keep your network secure and your machines from talking to machines that are not authorized.

We hope you have gotten something useful out of this article. Feel free to comment or ask questions and we will try and help individuals and answer any questions you may have.

This article was written by Kevin Wetzel lead investigator for SLC Security Services LLC. Mr. Wetzel has been an investigator for over 20 years and has specialized in computer forensics, private fraud investigations and computer security services for corporations, government and individual clients. Mr. Wetzel is a member of SLC Security Services LLC and is a contributor to this blog.

The Problem in Limiting a Penetration Test

When approached by a business recently we were given a list of servers that the company did not want us to audit during the penetration testing phase of the audit. While this is not uncommon the shear number of servers on the list raised some questions. Most of the servers at the organization were billing systems and systems that stored customer records. Normally this is exactly the type of servers we want to check to make sure they are secure. The business justification in this case was that the servers were too sensitive to the corporate operations and that if any of the servers were inadvertently taken offline during the penetration testing that the company would lose money to the tune of up to $1 million per hour.

After completing the rest of the audit we had a sit down meeting with the management team and they would not budge on the rules of the engagement. In addition to this limitation they also stated that we were not to test any of their phone system during the audit. We agreed to play by their rules but we reminded them that hackers don't have to play by a set of rules and that by not testing these systems they would not know if there were problems that may be identified by the enemy at a later time. The company decided to assume the risk.

17 days after the penetration testing was completed the company detected strange activity on one of their systems. We were asked to do live forensics on the system and we immediately detected applications running in memory that were not supposed to be there. Luckily through troubleshooting we were able to confirm that the files in memory were not malicious but the increased memory utilization of the update processes (for a very popular program) were the cause of large amounts of memory being available on the system to the critical applications that were running on the system. 4 days after this discovery they company requested that the additional systems be audited.

I want to remind companies that hackers don't play by rules. They don't care if a critical system crashes or if your customer database is taken offline. In fact that's the very goal of some hackers out there. The only thing they want to do is disrupt your business and some hackers will take that as a win. When doing penetration testing it's important for the team to test systems as safely as possible but the risk of having a system go offline during testing is a real concern for business. It would be best to have this occur in a controlled maintenance window as opposed to a busy time of the day where those systems are bringing in revenue.

If a company limits the scope of testing they also limit the usefulness of the audit report. It's not possible to have the best of both worlds in this case and a controlled crash is a much better outcome than a loss of income due to a hacker discovering an unpatched system during a critical time. Get the most of your audit and make sure you have all areas tested completely and documented accurately. Then if something happens in the future at least you will know the risk associated with a particular system or platform.

If you are dead set on setting rules set time based rules for the audit. Review the test plan and understand what the auditors will be doing to test your security and at a minimum don't change your day to day operations just because you are going through an audit. You want to make sure your team is adequately prepared to deal with the results whatever they may be.

BOOK: A Guide to TSCM for Corporations

Many times we get calls for prospective clients wanting us to secure their networks but they rarely call and ask us to secure their people, communications, executive meetings, etc. You don't use a wireless mic in closed meetings do you? They are all concerned about their networks, hackers, phishing and other areas but if I were to attack a company these days I wouldn't come through the door they were expecting.

Your company's security is only as good as the people they have that understand the threats. Instead of SLC Security Services LLC coming in the door, finding and eliminating the threat we take things one step farther. We have to ensure that your security team knows the signs and symptoms of other attack vectors often overlooked....

I'm our upcoming book "The TSCM Challenge" (Available on Amazon, Hardcover and Kindle) in January 2015 we finally have put together a book that we feel is the most important read for your security engineers of this decade. The book with of course cover network security, firewalls, Intrusion Detection, Servers, Workstations, Mobile Devices, Pagers, Tablets, etc, etc. But that's not the main focus of the book. The focus of the book is how to adequately safeguard your corporate data from theft, espionage, intentional failure of programs and concepts at the hands of your employees, loss of intellectual property, the selling of intellectual property to your competitors (yes it does happen and we do investigate this frequently), background checks on employees as well as follow up investigations, policies in the use of facilities as well as personnel matters to include illegal activity, financial issues, etc, etc.

We identify the key threat areas from your personnel, network devices limitations, lack or overbearing policy, treatment of employees, etc. We touch on executive management style and how it can foster a positive work place that makes people want to be loyal to their employers. We look at the psychology of a job and what can be done to eliminate the human threat.

In addition we look at the work environment. Is the workplace, secure, safe, comfortable and suitable for bringing about workers wanting to put in 110% everyday because it's a great place to work. If you have happy employees the chance of an employee selling your ideas and business plans to a competitor is greatly reduced.

Then we look at things like the way you do your job. Are there processes that put company information at risk? Does your company utilize encryption on their email? Do they have locking desk drawers or a secure area to store things in their office? Do you have a shredder in your office to get rid of old confidential documents? These are things that should be available in every office as well as some creature comforts to make your employees comfortable. Once employer replaced all the older chairs with new ergonomically correct chairs and realized that people were working more overtime (and they could because they were not in so much pain).

Do you know the signs of a problem employee. A problematic employee may not show any signs that they are angry with management and may lash out other ways by helping your competitor. Many industries are close knit industries where people of like skill will more than likely know each other outside of work. These relationships can cost businesses if they begin sharing information or talking about their work outside of work. You do have a policy against this right? Oh and you do verify people are following the rules with this right?

We will cover technology old and new in the book and it will be interesting when we delve into these and many other topics. The book will be available via Amazon on 1 January 2015 and will soon be available for pre-order as well. Look for it in January.