Over the course of the last few days we have been seeing a ton of traffic being exfiltrated to 101 Ave of the America's, 10th Floor (registrations in Whois and through some other utilities in our stack). When checking these host it appears as though they are mostly porn hosting and cloud computing computers. As we researched more we started finding certificates with strange references to legitimate Government organizations.
Would these people be so stupid to use real certificates on fake sites to collect data from suspects and users. In addition these same nodes are Tor exit nodes meaning that traffic on Tor could be sniffed as it exits the network.
A little more research is needed but it appears as though some of these host are being disquised albeit poorly to look like porn sites and other web servers when in fact their true purpose is not known. One IP that is sticking out in the ordeal is 37.139.6.7. This IP is showing up in all sorts of indicators and is also being picked up by multiple sensors on the Internet as Tor, Malicious, SSH Attacking, etc, etc.
Due to the nature of businesses being attacked from this IP and a few others that we are not currently disclosing it appears as though this is a concerted effort to get into the infrastructure of some heavy industry to include Healthcare, Communications Companies as well as Intelligence providers.
We will be keeping an eye on this and will let you know if anything changes as we are monitoring for any traffic to these host and alerting our SOC to review immediately.
The purpose of this page is to provide awareness to individuals and organizations that are leaking information and the information of their customers. The entities listed on this site are verified to be leaking personal information sometimes without the company even being aware. SLC Security is now owned and operated by Jigsaw Security Enterprise. We are currently in process and as such this blog will eventually be taken offline and merged with Jigsaw Security resources.
Sunday, February 22, 2015
Saturday, February 21, 2015
Defacement: We noted that cctec.cornell.edu was defaced
Our OSINT-X noted that cctec.cornell.edu was defaced by AnonSec. I'm sure this is only the begining. We have been reporting on many of these vulnerable universities for awhile now.
The message on the page stated that if Cornell would like to contact them through Twitter that they can be reached at www.twitter.com/Mrlele1337
The message on the page stated that if Cornell would like to contact them through Twitter that they can be reached at www.twitter.com/Mrlele1337
Thursday, February 19, 2015
Wall of Shame
Here's some of the latest traffic we are seeing today:
US Traffic
1. Boston University - Compromised System (Infiltrated Blacklist)
2. University of Washington - Compromised System (Infiltrated Blacklist, SLC Security Blacklist)
3. Utah State University - Compromised System (Infiltrated Blacklist, SLC Security Blacklist)
4. Yale University - Compromised System/SSH Attacks (Infiltrated Blacklist, Private Feed)
Foreign Traffic
No reports today
Analyst Notes:
We are seeing an increase in US colleges and Universities that may be related to recent hacking activities previously noted. While we have attempted to contact as many organizations as we can we have noted that many have not acknowledged the activity even though some data has been seen on Darknet and some forums.
In addition some recent Twitter activity shows that some of these hackers are posting specific information that was able to be verified. Many Universities have chosen not to report such issues.
The main attack vector at these organizations was mostly SQL injections according to the Twitter post. Specific intelligence is available by subscribing to our intelligence services. In addition we have started noting strange traffic on DNS ports specifically UDP 53 from some of these organizations.
US Traffic
1. Boston University - Compromised System (Infiltrated Blacklist)
2. University of Washington - Compromised System (Infiltrated Blacklist, SLC Security Blacklist)
3. Utah State University - Compromised System (Infiltrated Blacklist, SLC Security Blacklist)
4. Yale University - Compromised System/SSH Attacks (Infiltrated Blacklist, Private Feed)
Foreign Traffic
No reports today
Analyst Notes:
We are seeing an increase in US colleges and Universities that may be related to recent hacking activities previously noted. While we have attempted to contact as many organizations as we can we have noted that many have not acknowledged the activity even though some data has been seen on Darknet and some forums.
In addition some recent Twitter activity shows that some of these hackers are posting specific information that was able to be verified. Many Universities have chosen not to report such issues.
The main attack vector at these organizations was mostly SQL injections according to the Twitter post. Specific intelligence is available by subscribing to our intelligence services. In addition we have started noting strange traffic on DNS ports specifically UDP 53 from some of these organizations.
Wednesday, February 18, 2015
Dyre and Upatre Evolving - Emerging Threats gets it right
We were just reading a report from Emerging Threats concerning the development and frequent changes and variations to these malware products. What this indicates is that the malware is under active development making it extremely difficult to catch all the variants.
Read the original document here.
The article was well written and very concise and on point.
Read the original document here.
The article was well written and very concise and on point.
Tuesday, February 17, 2015
Spina & Lavelle Attorneys Trying to Penetrate our Infrastructure
Either these attorneys are owned or they are probing for information. Just letting you know we see you. Have a great day!
Monday, February 16, 2015
Traffic drops on our sensors
Last night our security engineers noted some very interesting things happening with our sensors. After midnight some coordinated attacks that we have been seeing for weeks suddenly dropped off. We have not see a single attack since midnight yesterday.
This is highly unusual since we have been under sustained attacks since 2005. What this may indicate is that the organized attackers are starting to realize that by attacking our infrastructure they are denying themselves access to many other targets. You see by attacking us you allow us to send out updates to thousands of Internet users thereby protecting them from attack.
Only time will tell if this strange, eerily silence continues. Keep in mind though Mr. Attacker that we have visibility on thousands of endpoints and we will continue to protect our customers regardless on who you decide to attack. If we see it, we will block you, end of story!
This is highly unusual since we have been under sustained attacks since 2005. What this may indicate is that the organized attackers are starting to realize that by attacking our infrastructure they are denying themselves access to many other targets. You see by attacking us you allow us to send out updates to thousands of Internet users thereby protecting them from attack.
Only time will tell if this strange, eerily silence continues. Keep in mind though Mr. Attacker that we have visibility on thousands of endpoints and we will continue to protect our customers regardless on who you decide to attack. If we see it, we will block you, end of story!
Hackers Steal Up To $1 Billion From Banks
Now that's a headline that will just reach out and grab your attention. The obvious question here is why did they do it and secondly what will they be using that money for to finance. Pay attention friends things are getting very interesting these days.
Original Article
Original Article
Wednesday, February 11, 2015
Memex Toolset Released...
DARPA has publicly presented for the first time a new set of search
tools called Memex which will improve also researches into the “Deep
Web”.
In 2014, the U.S. Defense Advance Research Projects Agency (DARPA) launched a the MEMEX project to design advanced search tools that could be also used to scan the deep web, which isn’t indexed by Google and other commercial search engines.
The Memex search engine was started to allow search of not indexed content, an operation that in the majority of cases is still run manually by Intelligence Agency.
Read the Full Article Here
In 2014, the U.S. Defense Advance Research Projects Agency (DARPA) launched a the MEMEX project to design advanced search tools that could be also used to scan the deep web, which isn’t indexed by Google and other commercial search engines.
The Memex search engine was started to allow search of not indexed content, an operation that in the majority of cases is still run manually by Intelligence Agency.
Read the Full Article Here
Obama Launches Cyberthreat Intel-Sharing Center
Long-awaited central repository for cyber threat information and intelligence created by The White House.
The concept of a federal government-led center for coordinating cyberthreat intelligence has been discussed by the Obama administration for some time, and that concept became a reality yesterday when the White House announced the formation of the Cyber Threat Intelligence Integration Center (CTIIC).
That's all fine and dandy but how do we integrate with this initiative? The last Google search we did showed NOTHING!
The concept of a federal government-led center for coordinating cyberthreat intelligence has been discussed by the Obama administration for some time, and that concept became a reality yesterday when the White House announced the formation of the Cyber Threat Intelligence Integration Center (CTIIC).
That's all fine and dandy but how do we integrate with this initiative? The last Google search we did showed NOTHING!
IMPORTANT NOTICE CONCERNING FEEDS
FOR IMMEDIATE RELEASE
Starting on 1 March 2015 SLC Security Services LLC will be moving our public indicator feeds to a paid subscription model. What this means is that if you are currently using our Indicators of Compromise you will be required to obtain and maintain a subscription and eligibility. The subscription model will be allow organizations of any size to subscribe to the service at an affordable rate and allow our company to add analyst to improve the service. We have been providing these indicators free as a public service for 3 years this coming March so it's time to improve our service offerings.
Subscription Pricing:
There are 4 levels of pricing and each level will require your organization to maintain eligibility for whatever pricing tier you are obtaining service.
Tier 1 (Non Profit - Research Tier): Free IOC's for use by not for profit organizations, associates, Government and small business users. Will require registration and a one time verification as well as a service agreement.
Tier 2 (Small End User): A nominal charge in which you will receive our SLC Security Client application license for use on up to 5 individual workstations or servers.
Tier 3 (Business Restricted Users): Business users with more than 5 individuals will be charged per user for access to our advanced indicators, SLC Security Client application (for workstations and servers), email alert service and access to formatted feeds for Fireeye, Symantec, Crowdstrike, Palo Alto Firewalls, IP Tables, Snort as well as several other platforms.
Tier 4 (Enterprise Site License): This model is designed for large corporations and entities that want to deploy and protect an unlimited number of workstations. In addition to the Tier 3 service you will also be provided with plugins and the SLC Connect middleware to allow your internal machines to mirror our IOC data, threat bulletins, blog and RSS post. You will also be granted access to our OSINT-X research platform for full text documentation. We will also provide additional services based on your contract terms to include 1 annual audit with full reporting and 16 hours of on site training to cover topics of interest with your security staff.
We will be phasing in this paid service over the next few weeks so please pay attention to our media outlet(s) and look for the subscription information.
Starting on 1 March 2015 SLC Security Services LLC will be moving our public indicator feeds to a paid subscription model. What this means is that if you are currently using our Indicators of Compromise you will be required to obtain and maintain a subscription and eligibility. The subscription model will be allow organizations of any size to subscribe to the service at an affordable rate and allow our company to add analyst to improve the service. We have been providing these indicators free as a public service for 3 years this coming March so it's time to improve our service offerings.
Subscription Pricing:
There are 4 levels of pricing and each level will require your organization to maintain eligibility for whatever pricing tier you are obtaining service.
Tier 1 (Non Profit - Research Tier): Free IOC's for use by not for profit organizations, associates, Government and small business users. Will require registration and a one time verification as well as a service agreement.
Tier 2 (Small End User): A nominal charge in which you will receive our SLC Security Client application license for use on up to 5 individual workstations or servers.
Tier 3 (Business Restricted Users): Business users with more than 5 individuals will be charged per user for access to our advanced indicators, SLC Security Client application (for workstations and servers), email alert service and access to formatted feeds for Fireeye, Symantec, Crowdstrike, Palo Alto Firewalls, IP Tables, Snort as well as several other platforms.
Tier 4 (Enterprise Site License): This model is designed for large corporations and entities that want to deploy and protect an unlimited number of workstations. In addition to the Tier 3 service you will also be provided with plugins and the SLC Connect middleware to allow your internal machines to mirror our IOC data, threat bulletins, blog and RSS post. You will also be granted access to our OSINT-X research platform for full text documentation. We will also provide additional services based on your contract terms to include 1 annual audit with full reporting and 16 hours of on site training to cover topics of interest with your security staff.
We will be phasing in this paid service over the next few weeks so please pay attention to our media outlet(s) and look for the subscription information.
Tuesday, February 10, 2015
Wall of Shame
Here's some of the latest traffic we are seeing today:
US Traffic
1. New York University -Malicious Activity
2. Princeton University - Malicious Activity
3. University of Pennsylvania - Malicious Hacking Activity
4.Carnegie Mellon University - Botnets and Compromised Systems
Foreign Traffic
1. Imagen Y Sistemas - Malicious Activity
2. Blacksun Incorporated - Malicious Activity (Canada)
3. Almighty Power Ministries (Nigeria)
Analyst Notes:
We are seeing an increase in US colleges and Universities that may be related to recent hacking activities previously noted. While we have attempted to contact as many organizations as we can we have noted that many have not acknowledged the activity even though some data has been seen on Darknet and some forums.
In addition some recent Twitter activity shows that some of these hackers are posting specific information that was able to be verified. Many Universities have chosen not to report such issues.
The main attack vector at these organizations was mostly SQL injections according to the Twitter post. Specific intelligence is available by subscribing to our intelligence services.
US Traffic
1. New York University -Malicious Activity
2. Princeton University - Malicious Activity
3. University of Pennsylvania - Malicious Hacking Activity
4.Carnegie Mellon University - Botnets and Compromised Systems
Foreign Traffic
1. Imagen Y Sistemas - Malicious Activity
2. Blacksun Incorporated - Malicious Activity (Canada)
3. Almighty Power Ministries (Nigeria)
Analyst Notes:
We are seeing an increase in US colleges and Universities that may be related to recent hacking activities previously noted. While we have attempted to contact as many organizations as we can we have noted that many have not acknowledged the activity even though some data has been seen on Darknet and some forums.
In addition some recent Twitter activity shows that some of these hackers are posting specific information that was able to be verified. Many Universities have chosen not to report such issues.
The main attack vector at these organizations was mostly SQL injections according to the Twitter post. Specific intelligence is available by subscribing to our intelligence services.
NEWS ROUNDUP 2/10/2015
Twitter Request from the NSA top 1.9 Million Account Request
UPI posted a story today on the 190 million users on twitter stating that the NSA has requested the information on less than 1% of Twitter users. So that means they have received information on 1.9 million Twitter accounts. That's a little different than stating 1% huh?
Read the original article here.
US to unveil new Cyber Security Agency
The U.S. government is creating a cybersecurity agency that will monitor and share information about threats against the government and private businesses in the wake of high-profile cyberattacks at Sony Pictures, Anthem Inc. and several major retailers.
NCTC director who is now executive vice president at Leidos, a national security contractor.
In the wake of news-making attacks on Sony Pictures, Home Depot and
many others, the federal government is establishing a new information
integration center to focus on cyber threats. The center will analyze
intelligence contributed by several agencies, along with the private
sector, a model that will face some serious hurdles.
The proposed Cyber Threat Intelligence Integration Center will fall under the Office of the Director of National Intelligence and it will not be responsible for actually gathering any threat intelligence. Rather, it will serve as an aggregation point for information collected by intelligence agencies and, the Obama administration hopes, private companies.
Note
Please tell me on one hand you are looking to share information and the other hand you are increasing the penalties without excluding research and development? Doesn't make sense to our team.
UPI posted a story today on the 190 million users on twitter stating that the NSA has requested the information on less than 1% of Twitter users. So that means they have received information on 1.9 million Twitter accounts. That's a little different than stating 1% huh?
Read the original article here.
American hostage Mueller's death confirmed by Obama, family
US to unveil new Cyber Security Agency
The U.S. government is creating a cybersecurity agency that will monitor and share information about threats against the government and private businesses in the wake of high-profile cyberattacks at Sony Pictures, Anthem Inc. and several major retailers.
NCTC director who is now executive vice president at Leidos, a national security contractor.
CyberCaliphate at it again
The Twitter feeds of Newsweek and veterans' group Military Spouses of Strength were hacked Tuesday morning by a group identifying itself as CyberCaliphate, the same organization that was confirmed to have hacked the twitter account for U.S. Central Command earlier this year.
The Twitter feeds of Newsweek and veterans' group Military Spouses of Strength were hacked Tuesday morning by a group identifying itself as CyberCaliphate, the same organization that was confirmed to have hacked the twitter account for U.S. Central Command earlier this year.
Anthem Breach Prompts New York To Conduct Cybersecurity Reviews
Meanwhile, Anthem victims are now being harassed by scammers trying to collect even more personal information.
CFAA may stall cyber security research unless Government exempts security researchers
All of this at a time when we need to share information more than ever.
The proposed Cyber Threat Intelligence Integration Center will fall under the Office of the Director of National Intelligence and it will not be responsible for actually gathering any threat intelligence. Rather, it will serve as an aggregation point for information collected by intelligence agencies and, the Obama administration hopes, private companies.
Note
Please tell me on one hand you are looking to share information and the other hand you are increasing the penalties without excluding research and development? Doesn't make sense to our team.
Delay in actionable intelligence creating additional risk, additional malware seen
With the recent Anthem incident it goes without saying that organizations need to share information to protect other entities from similar attacks. In the case of Anthem the information has been shared with only 2 organizations and the information being put out by commercial vendors is incomplete and in some cases completely inaccurate. What we are seeing is that many people are making guesses as to what the actual threat is.
It seems like this recent issue and with the Sony issue that in both cases the information coming out of the analysis of these events is being withheld from commercial security vendors. This does nothing to protect others that may face similar attacks. It should be noted however that the attackers in this case have moved on to other attacks.
This is a concerted effort to infiltrate many businesses and Government. As of yet we have not seen any real and meaningful cooperation between Anthem, Sony or the Government. If they really wanted to protect the masses clear and concise information would be put out for everyone.
This leads me to believe that nobody really knows the exact methods. I can tell you that there are zero day attacks being used as well as a known browser flaw that is not being fixed by vendors. If hackers know about it and vendors choose to ignore it there is really nothing the average person can do to protect themselves from the threats that loom.
I have predicted that the educational space will be the next to have issue based on what we have seen. Because of this we will offer educational institutions access to our blocklist in the hope that some will be proactive and save themselves some embarrassment. There have been several attackers on Twitter posting educational information and much of the stolen information is available on Darknet and being shared between hackers.
This open sharing initiative that everybody speaks of is non existent and probably will not come to pass. It's a shame really as there are power in numbers. We need a distributed protection system that can incorporate actual information between vendors in near real time. Until this happens we will continue to see disinformation. In addition the naming conventions between commercial products is horrible and confusing and interoperability between companies is horrible as well.
The additional malware being seen that is NOT being tracked by any of the major vendors was previously posted.
Indicator Information
IP Addresses Involved:
196.203.89.134
194.105.9.85
82.81.128.61
50.56.56.125
Also it goes without saying that certain file extensions should be dropped by your email gateways.
It seems like this recent issue and with the Sony issue that in both cases the information coming out of the analysis of these events is being withheld from commercial security vendors. This does nothing to protect others that may face similar attacks. It should be noted however that the attackers in this case have moved on to other attacks.
This is a concerted effort to infiltrate many businesses and Government. As of yet we have not seen any real and meaningful cooperation between Anthem, Sony or the Government. If they really wanted to protect the masses clear and concise information would be put out for everyone.
This leads me to believe that nobody really knows the exact methods. I can tell you that there are zero day attacks being used as well as a known browser flaw that is not being fixed by vendors. If hackers know about it and vendors choose to ignore it there is really nothing the average person can do to protect themselves from the threats that loom.
I have predicted that the educational space will be the next to have issue based on what we have seen. Because of this we will offer educational institutions access to our blocklist in the hope that some will be proactive and save themselves some embarrassment. There have been several attackers on Twitter posting educational information and much of the stolen information is available on Darknet and being shared between hackers.
This open sharing initiative that everybody speaks of is non existent and probably will not come to pass. It's a shame really as there are power in numbers. We need a distributed protection system that can incorporate actual information between vendors in near real time. Until this happens we will continue to see disinformation. In addition the naming conventions between commercial products is horrible and confusing and interoperability between companies is horrible as well.
The additional malware being seen that is NOT being tracked by any of the major vendors was previously posted.
Indicator Information
IP Addresses Involved:
196.203.89.134
194.105.9.85
82.81.128.61
50.56.56.125
Also it goes without saying that certain file extensions should be dropped by your email gateways.
Monday, February 9, 2015
NEWS ROUNDUP 2/9/2015
Hard to Tackle Malware being used in University Breaches:
Many security professionals including our company have been warning Universities to activity that indicate a large scale problem on their networks. Many of the Universities have chosen to ignore the issue. Earlier today at one of our client sites we saw for the first time a malware that was running completely in memory and that is not detected by any of the major anti-virus products. The malware is currently being studied but it appears to be related to earlier reports of activity that we have been picking up on our sensors. We believe that the malware probably will be used to perform farther damage in the future. We have submitted the memory dump to several anti-virus vendors and are awaiting additional details.
Company's Doing one of Two Things:
Either companies that we are notifying are acknowledging issues or they are quietly cleaning their issues. We noted several of the Universities originally on our University post that have since dropped off our sensors so that's good in that they are no longer infected. The bad part is that they may not know what information has been stolen or damaged on their respective networks. So companies or entities are either acknowledging they are in over their heads or covering it up completely.
Many security professionals including our company have been warning Universities to activity that indicate a large scale problem on their networks. Many of the Universities have chosen to ignore the issue. Earlier today at one of our client sites we saw for the first time a malware that was running completely in memory and that is not detected by any of the major anti-virus products. The malware is currently being studied but it appears to be related to earlier reports of activity that we have been picking up on our sensors. We believe that the malware probably will be used to perform farther damage in the future. We have submitted the memory dump to several anti-virus vendors and are awaiting additional details.
Company's Doing one of Two Things:
Either companies that we are notifying are acknowledging issues or they are quietly cleaning their issues. We noted several of the Universities originally on our University post that have since dropped off our sensors so that's good in that they are no longer infected. The bad part is that they may not know what information has been stolen or damaged on their respective networks. So companies or entities are either acknowledging they are in over their heads or covering it up completely.
FBI Online Agent Screenlocker
We have been seeing a ton of screen lockers lately. Just today one of our customer calls and states that they believe the FBI has locked out a machine. Upon inspection of course it's just a run of the mill screen locker claiming to be the FBI. I can tell you that the FBI would not tell you to go and get a moneypak to pay for unlocking your machine. In fact the FBI would just come and get the machine to perform forensics and be done with it.
When you see this message it is NOT the FBI. :-) Read r0cket's malware blog to learn how to remove the infection.
When you see this message it is NOT the FBI. :-) Read r0cket's malware blog to learn how to remove the infection.
Interesting Routing Anamalies on the Internet
We are currently researching some really interesting routing anomalies on the Internet. It seems that not only is the Great Firewall of China doing some really interesting things to Chinese users but some really strange routing is taking place on the US east cost the past few days.
Could be coincidence but we don't think so. Funny how some of these sites are doing redirects to phishing sites as well. Tell me again why we allow China to have root servers again?!
And that's only half of it.
Could be coincidence but we don't think so. Funny how some of these sites are doing redirects to phishing sites as well. Tell me again why we allow China to have root servers again?!
And that's only half of it.
Friday, February 6, 2015
Connecting the Dots... One breach at a time...
Take our big data analytics training and learn how to make sense of data in your enterprise. Learn how to connect the dots, build out your own OSINT intelligence mapping system, link analysis and lots more. Classes are being scheduled for the summer and customized training is available...
Analytics in action...
Private training available at your location or ours... Learn how to make sense of the data in your enterprise and beyond!
Private training available at your location or ours... Learn how to make sense of the data in your enterprise and beyond!
Collaboration in the Works
We wanted to let the readers know that we are working on a collaboration with several security providers to provide our intelligence products to help improve situational awareness against threats to infrastructure. We are currently working on integrating our data sources into several open source and commercial products to help make the security landscape of individual computer users (home users), business users (corporate users) and Government entities.
Stay tuned in the coming weeks as new service offerings are provided to existing commercial products and open source software and hardware products. Here are some of the things we are working on in the lab.
- Threat Feeds to Commercial Products - We will provide a list of products soon
- Threat Feeds to Open Source - Integration with Snort and Linux based systems as well as the release of our SLC Security Platform for Windows machines (coming spring 2015)
- Bulletin Service where we send out flash alerts directly to customers via the security platforms that we manage to include our OSINT-X platform and OSINT-X security appliance
- Open integration of our products (build a solution with our data)
- Security alert mailing list (Active now - You can subscribe from our website and blogs)
NEWS ROUNDUP 2/6/2015
Frederick
High School and West Frederick Middle School in Maryland were closed February 5
following a February 4 shooting outside the high school gymnasium during a
basketball game that left 2 students injured.
Former Inland Empire insurance agent pleads guilty to federal bank fraud and tax charges in scheme that netted nearly $6 million.
Flash Player 16.0.0.305 patches zero-day vulnerability.
Kovter trojan distributed via malvertising on Huffington Post.
Phone service restored in Forest Grove area after outage affects more than 1,200 customers. Phone service was restored to areas of Washington County after an outage that was reported by Frontier Communications February 4 kept customers in the areas of Gales Creek, Glenwood, and Tanner Creek from using a landline to call 9-1-1
Former Inland Empire insurance agent pleads guilty to federal bank fraud and tax charges in scheme that netted nearly $6 million.
Flash Player 16.0.0.305 patches zero-day vulnerability.
Kovter trojan distributed via malvertising on Huffington Post.
Phone service restored in Forest Grove area after outage affects more than 1,200 customers. Phone service was restored to areas of Washington County after an outage that was reported by Frontier Communications February 4 kept customers in the areas of Gales Creek, Glenwood, and Tanner Creek from using a landline to call 9-1-1
May just wanna disable flash until this situation becomes stable... Wait it's flash... Ugggghh
For the third time in two weeks, Adobe has issued an emergency security update for its Flash Player software to fix a dangerous zero-day vulnerability that hackers already are exploiting to launch drive-by download attacks.
Seriously consider disabling this until Adobe get's their issues resolved... You may be waiting awhile with this one.
Seriously consider disabling this until Adobe get's their issues resolved... You may be waiting awhile with this one.
Thursday, February 5, 2015
How we monitor for problems and detect issues before the attack...
Utilizing our cloud based computing platform we are able to see attack information as it happens in real time. We are able to monitor Dark Net, Usenet and OSINT sources for relevant information concerning the activity of hackers and cyber criminals. We have been warning companies and advising them on what to look for but they don't seem to take our warnings seriously. And months later we read about issues in the news once they finally figure out that we were right in the first place.
It has happened numerous times in the past and will happen in the future unless these entities take our alerts seriously. Companies are too busy looking at their perimeter's to really get an understanding of what is really taking place. All too often the information is available to indicate a problem because once a site is breached typically other attacks are launched from that same infrastructure to other organizations. Using link analysis between companies and attacks that are being reported is a smart way to connect the dots folks. These technologies exist for a reason and as systems evolve they get better and better at predictive analysis based on past activity.
We sincerely hope you start putting the pieces together because the time of breach until there are actual notifications are usually around 12 months out. Anthem just caught the problem in 4 months but that means that they are better than average at detecting the problem but not stopping it.
If any of these companies took their security seriously they would consider utilizing big data to highlight problems before they are nightmares for the companies involved.
Quite honestly our team of volunteers are extremely good at detecting issues but we simply do not have the resources to do our analysis on a large scale. If we had the funding and additional resources we could certainly assist with these investigations but as of now we will continue to do large data analysis and warn the companies that we note as having problems in the hope that at some point a company will notice that we are way ahead of the "average" and help us get to a place where we can really be effective and assist law enforcement in containing these issues and actually finding the entities responsible for these data breaches. Until that happens we will continue to research, blog and watch from the sidelines.
If the Government were to really fund the cyber security initiatives and get private industry to bring technologies that work to market we could be a much bigger help in these cases but until that happens we will sit back and watch.
It's a shame really.
So here's what we suggest to help prevent these large breaches in the future. Stop withholding data when it comes to cyber security. Provide a clearinghouse where we can report issues and use the indicators of compromise that we have developed. I'm sorry but 95% of the technologies in use are reactive. You need analytics that can find trends and identify suspicious activity over the entire Internet connected infrastructure.
Until we have a view of the entire Internet we are confined to our own little LAN connected world and chances are somebody has already infiltrated your infrastructure. If you want to wait 12 months while they steal your data be my guest or hire us to come in a get rid of the badness and save yourselves some major embarrassment.
Later this week we will for the first time every compile a list of all of the organizations that we are more than 80% confident that have issues that need to be addressed. Our system is reporting on real world attacks and since we report on these attacks we are a major target. One good thing about being a target is that it forces attackers to show their infrastructure that they are using to attack us (and many others). Using this data we can quite quickly build out a clear picture of bad activity being directed at us and others.
Have a great week and we look forward to working with the ones that value their security posture.
It has happened numerous times in the past and will happen in the future unless these entities take our alerts seriously. Companies are too busy looking at their perimeter's to really get an understanding of what is really taking place. All too often the information is available to indicate a problem because once a site is breached typically other attacks are launched from that same infrastructure to other organizations. Using link analysis between companies and attacks that are being reported is a smart way to connect the dots folks. These technologies exist for a reason and as systems evolve they get better and better at predictive analysis based on past activity.
We sincerely hope you start putting the pieces together because the time of breach until there are actual notifications are usually around 12 months out. Anthem just caught the problem in 4 months but that means that they are better than average at detecting the problem but not stopping it.
If any of these companies took their security seriously they would consider utilizing big data to highlight problems before they are nightmares for the companies involved.
Quite honestly our team of volunteers are extremely good at detecting issues but we simply do not have the resources to do our analysis on a large scale. If we had the funding and additional resources we could certainly assist with these investigations but as of now we will continue to do large data analysis and warn the companies that we note as having problems in the hope that at some point a company will notice that we are way ahead of the "average" and help us get to a place where we can really be effective and assist law enforcement in containing these issues and actually finding the entities responsible for these data breaches. Until that happens we will continue to research, blog and watch from the sidelines.
If the Government were to really fund the cyber security initiatives and get private industry to bring technologies that work to market we could be a much bigger help in these cases but until that happens we will sit back and watch.
It's a shame really.
So here's what we suggest to help prevent these large breaches in the future. Stop withholding data when it comes to cyber security. Provide a clearinghouse where we can report issues and use the indicators of compromise that we have developed. I'm sorry but 95% of the technologies in use are reactive. You need analytics that can find trends and identify suspicious activity over the entire Internet connected infrastructure.
Until we have a view of the entire Internet we are confined to our own little LAN connected world and chances are somebody has already infiltrated your infrastructure. If you want to wait 12 months while they steal your data be my guest or hire us to come in a get rid of the badness and save yourselves some major embarrassment.
Later this week we will for the first time every compile a list of all of the organizations that we are more than 80% confident that have issues that need to be addressed. Our system is reporting on real world attacks and since we report on these attacks we are a major target. One good thing about being a target is that it forces attackers to show their infrastructure that they are using to attack us (and many others). Using this data we can quite quickly build out a clear picture of bad activity being directed at us and others.
Have a great week and we look forward to working with the ones that value their security posture.
Wednesday, February 4, 2015
BREACH: Anthem breach is the mother of all Healthcare Data Breaches!
We knew ahead of time but waited until the CEO of Anthem made a public statement. The Anthem breach will prove to be one of the biggest breaches in Healthcare history. The breach is being investigated by the FBI and several large new organizations leaked information on the breach prior to an official announcement earlier today.
We will make this a sticky post and follow the developments.
2/4/2015: Official Notification Came Out Today but was proceeded by news media leaks of details.
2/4/2015: WSJ appears to have been the first news media organization to break the story.
2/5/2015: DataBreaches also posted information they have compiled here.
2/5/2015: Major News continues to report on the issue.
2/5/2015: LA Times reporting really specific information on the case.
From the LA Times:
Suspicious activity was first noticed and reported Jan. 27. Two days later, an internal investigation verified that the company was a victim of a cyber attack, the company said. The unauthorized access to the vast database goes back to Dec. 10.
Cybersecurity analysts warned that the thieves may attack Anthem again using the employee data they took. Anthem said it’s working to strengthen security and identify any potential gaps.
“It is highly possible that they are preparing for another attack, such as a social engineering or phishing attack, that may give them access to systems that they were unable to reach,” said Tom DeSot, chief information officer of cybersecurity firm Digital Defense Inc. in San Antonio.
Previously Reported:
Anthem Blue Cross Data Breach (Nov 2014) - Our Previous Report
From Krebs:
Bloomberg reports that U.S. federal investigators probing the theft of 80 million Social Security records and other sensitive data from insurance giant Anthem Inc. are pointing the finger at state-sponsored hackers from China. Although unconfirmed, that suspicion would explain a confidential alert the FBI circulated last week warning that Chinese hackers were targeting personally identifiable information from U.S. commercial and government networks.
We will make this a sticky post and follow the developments.
2/4/2015: Official Notification Came Out Today but was proceeded by news media leaks of details.
2/4/2015: WSJ appears to have been the first news media organization to break the story.
2/5/2015: DataBreaches also posted information they have compiled here.
2/5/2015: Major News continues to report on the issue.
2/5/2015: LA Times reporting really specific information on the case.
From the LA Times:
Suspicious activity was first noticed and reported Jan. 27. Two days later, an internal investigation verified that the company was a victim of a cyber attack, the company said. The unauthorized access to the vast database goes back to Dec. 10.
Cybersecurity analysts warned that the thieves may attack Anthem again using the employee data they took. Anthem said it’s working to strengthen security and identify any potential gaps.
“It is highly possible that they are preparing for another attack, such as a social engineering or phishing attack, that may give them access to systems that they were unable to reach,” said Tom DeSot, chief information officer of cybersecurity firm Digital Defense Inc. in San Antonio.
Previously Reported:
Anthem Blue Cross Data Breach (Nov 2014) - Our Previous Report
From Krebs:
Bloomberg reports that U.S. federal investigators probing the theft of 80 million Social Security records and other sensitive data from insurance giant Anthem Inc. are pointing the finger at state-sponsored hackers from China. Although unconfirmed, that suspicion would explain a confidential alert the FBI circulated last week warning that Chinese hackers were targeting personally identifiable information from U.S. commercial and government networks.
BREACH: capdm.ca Breached - Updated
See http://pastebin.com/9Lu68fMi to see if your account is compromised.
2/3/2015: Reached out to the organization to get additional detail.
2/3/2015: Received the following response.
2/3/2015: Reached out to the organization to get additional detail.
2/3/2015: Received the following response.
We are actively investigating and will follow-up shortly. Please feel free to contact me directly should you have further requests for information.
2/3/2015: Additional intelligence being collected on this incident from third parties. Our network security operations center is collecting relevant claims and information from Darknet and third party data providers. Noted additional detail. If calling in to obtain information reference INC2015-005.
Type: Healthcare Area: Disclosure First Noted: 12 Dec 2014 Location: Canada Total Records: 1500+ and data on Darknet Status: Not Monitoring for Follow Up (Not a client of SLC Security Services LLC)
Krebs Post about Physical Attack
Yeah hackers are changing their tactics. Like I said last week while everybody is concentrating on the network hackers are actively using hardware and physical attacks. Read my original post here.
If you want a firm that can actually find problems and not just give you a false sense of security contact our SOC by email to schedule a no obligation audit. If we don't find problems you don't pay...
Kreb's story can be read here.
We have seen everything you can imagine over the last 25 years. Cell phones are still one of the biggest threats as they are cheap, can be untraceable and have long battery lives but attacking corporations is even easier since they rely on old technologies that are not even checked during most audits. Our audits are complete and concise and when you companies realize that we can actually give you piece of mind instead of just talking about it give us a call and let us prove to you that security is our main business.
If you want a firm that can actually find problems and not just give you a false sense of security contact our SOC by email to schedule a no obligation audit. If we don't find problems you don't pay...
Kreb's story can be read here.
We have seen everything you can imagine over the last 25 years. Cell phones are still one of the biggest threats as they are cheap, can be untraceable and have long battery lives but attacking corporations is even easier since they rely on old technologies that are not even checked during most audits. Our audits are complete and concise and when you companies realize that we can actually give you piece of mind instead of just talking about it give us a call and let us prove to you that security is our main business.
ATTACKER: The Preston Law Firm of Houston Texas
Hey guys you may want to check out your systems because we have been seeing attacks from you all day. As some of you know that fact that we report on breaches in advance of some people really causes them to get angry. Either this law firm is owned by hackers or they have hired hackers to try and infiltrate our infrastructure.
It started out as simple SMTP probes but we are starting to see web server probes. We hope you like playing with our honeypot systems because that's what your hitting folks.
Next time please try and do your homework before blatantly just attacking what you think is our infrastructure. Thanks and have a great day.
Maybe you didn't like us reporting on the Texas A&M activity or some other such nonsense but this is a free country, we have data to back up our claims so if you want to play this game please by all means let's do this...
I would love to be able to put out all of the information we have and then charge you for your resource usage today since it was so extensive and you achieved absolutely NOTHING!
It started out as simple SMTP probes but we are starting to see web server probes. We hope you like playing with our honeypot systems because that's what your hitting folks.
Next time please try and do your homework before blatantly just attacking what you think is our infrastructure. Thanks and have a great day.
Maybe you didn't like us reporting on the Texas A&M activity or some other such nonsense but this is a free country, we have data to back up our claims so if you want to play this game please by all means let's do this...
I would love to be able to put out all of the information we have and then charge you for your resource usage today since it was so extensive and you achieved absolutely NOTHING!
ATTACKS: Harvard, MIT and Others
We have noted an uptick in the number of brute force and email probes from MIT and Harvard. In addition we have noted that Boston University, Hampshire College and Harvard are all on our blocklist due to malicious activity. MIT is involved with cyber security and has partnerships with the Government for research so this may explain why we are seeing an uptick on our sensors and reported attempts to compromise email accounts.
DISCLOSURE: UMass Memorial Medical Group
The UMass Memorial Medical Group is working with law-enforcement personnel after it learned a former employee allegedly accessed private patient billing information that contained credit-card and debit-card numbers, Social Security numbers, and birth dates, according to hospital personnel.
Anthony Berry, the director of media and public relations for UMass, said the group is continuing to work with law enforcement, but there is "nothing concrete" to report yet.
Tuesday, February 3, 2015
D-Link Router Vulnerability - CONFIRMED
D-Link’s popular DSL2740R wireless router is vulnerable to domain
name system (DNS) hijacking exploits that requiring no authentication to
access its administrative interface.
According to Todor Donev of the Belgian security firm Ethical Hacker, a number of other D-Link routers are affected by this bug as well, particularly the DLS-320B. PCWorld is reporting that the vulnerability exists in a widely deployed piece of router firmware called ZynOS, which is developed by ZuXEL Communications Corporation.
The troubling part of this issue is that it appears as though this and a few other bugs are allowing law enforcement to monitor the activities of individuals utilizing this hardware. We previously reported on similar vulnerabilities with Linksys hardware that allows similar interception without the end user being aware and allows Cisco to monitor customer usage of devices. For this reason we do not allow Cisco or Linksys hardware in our secured networking environment.
According to Todor Donev of the Belgian security firm Ethical Hacker, a number of other D-Link routers are affected by this bug as well, particularly the DLS-320B. PCWorld is reporting that the vulnerability exists in a widely deployed piece of router firmware called ZynOS, which is developed by ZuXEL Communications Corporation.
The troubling part of this issue is that it appears as though this and a few other bugs are allowing law enforcement to monitor the activities of individuals utilizing this hardware. We previously reported on similar vulnerabilities with Linksys hardware that allows similar interception without the end user being aware and allows Cisco to monitor customer usage of devices. For this reason we do not allow Cisco or Linksys hardware in our secured networking environment.
BREACHED: Texas A&M University
Seeing indicators that this entity has been breached for over a month and does not realize it. It appears as though their infrastructure is being used to launch farther attacks on other educational institutions.
They also appear on Emerging Threats for malicious activity since at lease the 11th of December, 2014. You would think these large organizations would do something to get themselves off the blacklist but as of today we are still detecting malicious activity.
Update: Our sensors are still seeing traffic originating from Texax A&M and they still have not closed off the vulnerable systems. Seeing additional reports from additional locations that they are being attacked by this entity. Over 200+ external IP's are reporting attempted breaches and brute forces from the Texas A&M network.
They also appear on Emerging Threats for malicious activity since at lease the 11th of December, 2014. You would think these large organizations would do something to get themselves off the blacklist but as of today we are still detecting malicious activity.
Update: Our sensors are still seeing traffic originating from Texax A&M and they still have not closed off the vulnerable systems. Seeing additional reports from additional locations that they are being attacked by this entity. Over 200+ external IP's are reporting attempted breaches and brute forces from the Texas A&M network.
Monday, February 2, 2015
Hardware Hacking and Physical Attacks Largely Being Ignored
One of the recurring issues that we are seeing on audits are the lack of knowledge on physical attacks to infrastructure. Most of the companies we are working with do not check physical path of network connections as well as security systems. We have seen many companies that are either ignoring physical attacks or they feel as though they are not important. It should be noted that while your watching your network, attackers are building hardware, buying hardware and exploiting things such as your camera's, network security appliances, security systems, networks and communications systems such as telephone and hard wired infrastructure.
Find out today if hackers and bypass your defenses. Email SLC Security Services LLC SOC and ask for a free no obligation security audit. The findings are confidential. Let us show you why our audits are the best in the industry.
Find out today if hackers and bypass your defenses. Email SLC Security Services LLC SOC and ask for a free no obligation security audit. The findings are confidential. Let us show you why our audits are the best in the industry.
University of Chicago Still Leaking Information and Vulnerable
During a recent review of some incidents being covered by databreaches.net I was able to do some additional research and confirm that even as recent as an hour ago that information is still being offered in the underground community. In addition server IP addresses owned by the organization are attacking other colleges and universities in the US and elsewhere.
In Addition:
The following organizations are also compromised.
Illinois Institute of Technology
Northwestern University
In Addition:
The following organizations are also compromised.
Illinois Institute of Technology
Northwestern University
Sunday, February 1, 2015
TECHNOLOGY WATCH: British Government to Receive US Company Technologies
The British government has selected Northrop Grumman to provide it with
engineering, development and other cyber-security solutions services.
Solutions under the seven-year framework contract, which was competitively awarded, will specifically support data security and information assurance.
"As a long-standing partner with the U.K. government, we are proud to have been selected to support the security of their digital domain and the protection of its citizens," said Kathy Warden, corporate vice president and president, Northrop Grumman Information Systems. "With more than 30 years of cyber-security expertise that has been developed and deployed around the world, we look forward to continuing our work with some of the brightest industry and academic minds to deliver world class operational performance, scaled to the mission, and to increase our U.K.-based workforce that will support cyber innovators of the future."
It should also be noted that other companies were also involved in the bidding and have been awarded contracts but Northrop Grumman is the only company to publicly acknowledge the contract award.
Solutions under the seven-year framework contract, which was competitively awarded, will specifically support data security and information assurance.
"As a long-standing partner with the U.K. government, we are proud to have been selected to support the security of their digital domain and the protection of its citizens," said Kathy Warden, corporate vice president and president, Northrop Grumman Information Systems. "With more than 30 years of cyber-security expertise that has been developed and deployed around the world, we look forward to continuing our work with some of the brightest industry and academic minds to deliver world class operational performance, scaled to the mission, and to increase our U.K.-based workforce that will support cyber innovators of the future."
It should also be noted that other companies were also involved in the bidding and have been awarded contracts but Northrop Grumman is the only company to publicly acknowledge the contract award.
Malware: tinba is gonna be the end of Suntrust, Regions Bank and a few others... wait for it! (Dyre Banking Trojan) - Updated
If your monitoring infections and malware traffic it goes without saying that banking targets are high on the priority watch list. I'm making this prediction based on intelligence that we are seeing in the SOC. Let's see how this plays out.
My prediction is that the following banks are gonna get nailed by tinba:
1.Suntrust
2. Regions Bank
3. Credit One Bank
4. Netteller
5. TD Bank
6. JP Morgan Chase
7. PNC Bank
8. RBC Bank
Since this campaign is targeting customers there is little that the banks can do to stop it. Most of the issue is being caused by anonymous proxies and some very interesting MITM traffic.
My prediction is that the following banks are gonna get nailed by tinba:
1.Suntrust
2. Regions Bank
3. Credit One Bank
4. Netteller
5. TD Bank
6. JP Morgan Chase
7. PNC Bank
8. RBC Bank
Since this campaign is targeting customers there is little that the banks can do to stop it. Most of the issue is being caused by anonymous proxies and some very interesting MITM traffic.
Wednesday, January 28, 2015
Private Security Companies more of a threat than Government Snooping
You may think that the Governments warrantless wiretapping and surveillance programs are troubling but private companies and operators are more of a threat than even the Government. Think about it this way. When Government wants to do long term surveillance they are supposed to follow CALEA and FISA rules to conduct the surveillance and they are supposed to terminate that surveillance if the collected data exonerates the targets of that investigation. At least some of the time judges and secret courts place restrictions on the surveillance authorizing the surveillance for a certain period of time.
It should also be noted that nearly all of the request that go to the FISA court are approved. Sometimes even without a very good justification. But private operators are even more dangerous than the Government because they don't have to follow any legal rules.
Just look at rules on electronic interception that fall under 18 USC as one example. There were no prosecutions under these rules last year or the year before that. Even when there are prosecutions they usually are for associated crimes and not the interception itself.
So the next time you think that the Government is your biggest threat you should really think again. The private operators collect, store and share information about targets more easily and with virtually no oversight.
It should also be noted that nearly all of the request that go to the FISA court are approved. Sometimes even without a very good justification. But private operators are even more dangerous than the Government because they don't have to follow any legal rules.
Just look at rules on electronic interception that fall under 18 USC as one example. There were no prosecutions under these rules last year or the year before that. Even when there are prosecutions they usually are for associated crimes and not the interception itself.
So the next time you think that the Government is your biggest threat you should really think again. The private operators collect, store and share information about targets more easily and with virtually no oversight.
Tuesday, January 27, 2015
NOTICE: Patch your Linux Servers
As you may have read in the media recently, a new zero-day security
vulnerability for a common component in the Linux operating system has
been released into the wild. This vulnerability allows attackers to
remotely access some vulnerable Linux-based systems without the use of
compromised passwords or other user credentials. Once in the system,
attackers could leverage other vulnerabilities to escalate privileges
until they gain root access. A good article that describes the
vulnerability can be found here:
http://www.zdnet.com/article/
We recommend that you immediately patch your operating system with the appropriate latest version. At the time of sending this e-mail (approximately at 7pm Central time on Tuesday, Jan. 27), the following Linux distributions have issued patches:
· Red Hat
· Debian
· Ubuntu
Other popular distributions, such as CentOS, have indicated publicly that patches are in the works.
Since the vulnerable library is very common and is used by a wide range of server-side software, applying the patch is not without risk of collateral damage or side effects. In other words, there is some risk that patching your system might impact the performance of other applications on your server that also use the same library.
Nonetheless, taking into account the severity of the security hole, we are advising our clients to apply the patch immediately upon it becoming available to them. The risk of not patching outweighs the potential risk from side effects.
We strongly recommend that you patch your servers immediately with the appropriate patch.
If you are running Red Hat Enterprise Linux or CentOS, you may execute the following command on your server to patch:
CentOS/Red Hat Linux: yum -y update glibc
Ubuntu/Debian Linux: apt-get upgrade glibc
Please note that patching your system WILL require a restart after you execute the above commands.
http://www.zdnet.com/article/
We recommend that you immediately patch your operating system with the appropriate latest version. At the time of sending this e-mail (approximately at 7pm Central time on Tuesday, Jan. 27), the following Linux distributions have issued patches:
· Red Hat
· Debian
· Ubuntu
Other popular distributions, such as CentOS, have indicated publicly that patches are in the works.
Since the vulnerable library is very common and is used by a wide range of server-side software, applying the patch is not without risk of collateral damage or side effects. In other words, there is some risk that patching your system might impact the performance of other applications on your server that also use the same library.
Nonetheless, taking into account the severity of the security hole, we are advising our clients to apply the patch immediately upon it becoming available to them. The risk of not patching outweighs the potential risk from side effects.
We strongly recommend that you patch your servers immediately with the appropriate patch.
If you are running Red Hat Enterprise Linux or CentOS, you may execute the following command on your server to patch:
CentOS/Red Hat Linux: yum -y update glibc
Ubuntu/Debian Linux: apt-get upgrade glibc
Please note that patching your system WILL require a restart after you execute the above commands.
Friday, January 23, 2015
ALERT: Whale Phishing Alert
The FBI and Internet Crime Complaint Center warns of a very profitable spam campaign that has already claimed more than 2,000 victims globally.
The FBI and the Internet Crime Complaint Center (IC3) are warning of a spam email campaign known as the Business E-mail Compromise (BEC) that has resulted in the global victim dollar loss of $215 million so far.
The IC3 alert, which was issued on Jan. 22, provides statistics on the impact of the BEC campaign for the period of Oct. 1, 2013, to Dec. 1, 2014. During that period, the IC3 received complaints about BEC from 45 countries, with a combined victim count of 2,126. In the United States alone, the IC3 said there were 1,198 victims.
Read More from the Original Report:
http://www.eweek.com/security/spam-campaign-business-e-mail-compromise-pilfers-215-million.html
Activity: Confirmed
Number of Confirmed Cases Reported: 3
The FBI and the Internet Crime Complaint Center (IC3) are warning of a spam email campaign known as the Business E-mail Compromise (BEC) that has resulted in the global victim dollar loss of $215 million so far.
The IC3 alert, which was issued on Jan. 22, provides statistics on the impact of the BEC campaign for the period of Oct. 1, 2013, to Dec. 1, 2014. During that period, the IC3 received complaints about BEC from 45 countries, with a combined victim count of 2,126. In the United States alone, the IC3 said there were 1,198 victims.
Read More from the Original Report:
http://www.eweek.com/security/spam-campaign-business-e-mail-compromise-pilfers-215-million.html
Activity: Confirmed
Number of Confirmed Cases Reported: 3
The FBI and Internet Crime Complaint Center warns of a very profitable spam campaign that has already claimed more than 2,000 victims globally.
The FBI and the Internet Crime Complaint Center (IC3) are warning of a spam email campaign known as the Business E-mail Compromise (BEC) that has resulted in the global victim dollar loss of $215 million so far. The IC3 alert, which was issued on Jan. 22, provides statistics on the impact of the BEC campaign for the period of Oct. 1, 2013, to Dec. 1, 2014. During that period, the IC3 received complaints about BEC from 45 countries, with a combined victim count of 2,126. In the United States alone, the IC3 said there were 1,198 victims. - See more at: http://www.eweek.com/security/spam-campaign-business-e-mail-compromise-pilfers-215-million.html#sthash.DRlL878Z.dpufThursday, January 22, 2015
Drones Being Used to Smuggle Drugs Over the Border
It goes without saying that Drones provide a unique way to take photographs, explore hard to reach areas and in this case to smuggle drugs across the US/Mexico border. Border Patrol has indicated that they are seeing increased instances of the use of drones to carry packages of drugs from Mexico into the US. There have been 3 separate news articles in the past week on the topic as well as some discussion in Government circles on how to combat the problem.
Drones have been used to smuggle phones, tobacco, drugs and weapons into prison courtyards in the past and are frequently used to carry out wireless attacks by moving devices into target areas for interception purposes.
The FAA has begun issuing licenses to licensed pilots to be allowed to operate drones for hire (highly restricted). It is thought that the rules on drone use will be relaxed at some point in 2015.
We are following this topic with interest.
Drones have been used to smuggle phones, tobacco, drugs and weapons into prison courtyards in the past and are frequently used to carry out wireless attacks by moving devices into target areas for interception purposes.
The FAA has begun issuing licenses to licensed pilots to be allowed to operate drones for hire (highly restricted). It is thought that the rules on drone use will be relaxed at some point in 2015.
We are following this topic with interest.
Wednesday, January 21, 2015
ALERT: RSA Public Key has a backdoor
We are seeing indications that the RSA public key is compromised and has a backdoor. Several security researchers have confirmed through actual data that the key's are compromised but they have not indicated the responsible party.
Dell SecureWorks put out an alerts as did several bloggers over the past 2 weeks.
Dell SecureWorks put out an alerts as did several bloggers over the past 2 weeks.
Tuesday, January 20, 2015
ALERT: Barclay Card Service Phishing and Possible Customer Accounts Compromised
We are researching this information currently and are in the process of putting out a bulletin from our SOC. It is thought that the uptick in "targetted" Phishing attacks over the last 12 hours may be related to a compromise of account information at Barclay Card Services.
We will be putting out a bulletin later this evening. Please ensure that if you receive messages from Barclays that you actually verify the information in the email and that it goes back to an actual Barclays domain and not a third party.
Related Compromised Host:
NTT America Inc
GWTC - Golden West Telecommunications (more than likely a compromised customer)
Time Warner Cable South (more than likely a compromised customer)
KRM Information Services
Dwyer Products (a customer of Comcast Business Communications)
List of Compromised Host:
69.70.172.150
70.61.114.98
195.101.177.120
209.57.92.144
64.251.170.197
12.27.45.130
74.94.124.215
We will be putting out a bulletin later this evening. Please ensure that if you receive messages from Barclays that you actually verify the information in the email and that it goes back to an actual Barclays domain and not a third party.
Related Compromised Host:
NTT America Inc
GWTC - Golden West Telecommunications (more than likely a compromised customer)
Time Warner Cable South (more than likely a compromised customer)
KRM Information Services
Dwyer Products (a customer of Comcast Business Communications)
List of Compromised Host:
69.70.172.150
70.61.114.98
195.101.177.120
209.57.92.144
64.251.170.197
12.27.45.130
74.94.124.215
Sunday, January 18, 2015
So tired of seeing this Starbucks
Hey Starbucks are you just asking for a breach?
Not that I want to give criminals any ideas but Starbucks and Waffle House need to get their acts together and fix this ASAP.
Hackers for Hire Getting Publicity
I was quite surprised the NY Times published a recent article on "Hackers for Hire".
The website in case you were curious is at http://neighborhoodhacker.com/
There are many other sites as well but this is the one getting publicity right now.
The website in case you were curious is at http://neighborhoodhacker.com/
There are many other sites as well but this is the one getting publicity right now.
Friday, January 16, 2015
NEWS: NY Post Twitter Hacked
The New York Post on Friday said that one of its Twitter feeds
focused on business news had been hacked, following a series of
inaccurate Tweets on the Federal Reserve, Bank of America and military
engagement with China.
"Our Twitter feed has been hacked," the newspaper said on its "@NYPostBiz" account.
"Our Twitter feed has been hacked," the newspaper said on its "@NYPostBiz" account.
Upcoming Maintenance 1/17/2015 00:00-02:00
We will be performing maintenance on our feeds during the timeframe indicated. While we do not expect any outages we will not be able to post updates to our blacklist or hosted content during this timeframe.
After this maintenance our feeds will no longer be available to the public. Only subscribers or appliance users will be able to pull updates. We have already distributed our certificates to the appliances and have been testing the certs for 7 days.
Any site that does not get the update at 3AM EST on 1/17/2015 will be updated via a non public feed.
If you have any questions please contact your account representative.
This potential for outage will NOT affect the blog or our web presence only paid subscription users and public users of our data.
After this maintenance our feeds will no longer be available to the public. Only subscribers or appliance users will be able to pull updates. We have already distributed our certificates to the appliances and have been testing the certs for 7 days.
Any site that does not get the update at 3AM EST on 1/17/2015 will be updated via a non public feed.
If you have any questions please contact your account representative.
This potential for outage will NOT affect the blog or our web presence only paid subscription users and public users of our data.
Thursday, January 15, 2015
BREACH: Safeway Improper Disposal Cost Them $10 Million
Source: http://www.healthcareinfosecurity.com/hefty-fine-in-improper-disposal-case-a-7797
ThreatStream Picking Up our Feeds - Feeds Will Be Changing to Customer Only Certs Soon!
If your a ThreatStream customer and would like our indicators make sure you opt in the control panel. Check out our accuracy and you will see that we are good at what we do.
In addition we have many new products and services for 2015. Our company is leading the way in the intelligence space. Some much larger security firms are snagging our data and reselling it. For this reason we are about to change to a certificate based authentication mechanism so we can get compensated for the long hours we put into keeping you safe.
In addition we have many new products and services for 2015. Our company is leading the way in the intelligence space. Some much larger security firms are snagging our data and reselling it. For this reason we are about to change to a certificate based authentication mechanism so we can get compensated for the long hours we put into keeping you safe.
Wednesday, January 14, 2015
Hey Security Personnel - There's more to wireless than 802.11
I am amazed at how many of these breaches and attacks are taking place over WIFI and even more surprised at how many are taking place over other wireless services such as bluetooth, personal devices such as tablets and cell phones and other attacks to include paging, microwave P2P links, etc.
During root cause analysis of several attacks this week we have noted that the attack vector ended up not being the network or workstation. The attack vector recently has been through a variety of wireless hacks yet of the 122 entities we polled this week only 5 have a program in place to actively check for attacks via wireless, only 1 had a TSCM plan in place for the corporation. This is ALARMING!
I can't for the life of me believe that you can rest assured at night knowing that hackers can hack your cameras, security systems, cell phones, etc, etc.
I issue this challenge to ANY company. Call us for an audit. If we don't break in you don't pay. If we compromise your network you pay our normal consulting rate. We are trying to help you but if you don't want the help you can rest assured that hackers will penetrate your defenses. Just not the way you were expecting them to get in.
During root cause analysis of several attacks this week we have noted that the attack vector ended up not being the network or workstation. The attack vector recently has been through a variety of wireless hacks yet of the 122 entities we polled this week only 5 have a program in place to actively check for attacks via wireless, only 1 had a TSCM plan in place for the corporation. This is ALARMING!
I can't for the life of me believe that you can rest assured at night knowing that hackers can hack your cameras, security systems, cell phones, etc, etc.
I issue this challenge to ANY company. Call us for an audit. If we don't break in you don't pay. If we compromise your network you pay our normal consulting rate. We are trying to help you but if you don't want the help you can rest assured that hackers will penetrate your defenses. Just not the way you were expecting them to get in.
Tuesday, January 13, 2015
News Indicator Feeds, Service Plans and Security Appliance Package
SLC Security Services LLC has expanded our SOC offerings. We are offering 2 levels of service with our Intel feeds. The first is our bring your own hardware (firewall, IDS, etc). If your device can pull in a CSV feed. XML feed or STIX format feed you can subscribe to hourly updates for your own devices. We are offering a security feed site license and access to our Intelligence product all for a flat fee. Pricing starts at $99.00 per site per year and depends on the amount of traffic your site will be generating.
Our second offering is our Security Gateway Appliance. The Gateway appliance is suitable for small to medium enterprises and provides a firewall, IDS/IPS as well as our Intelligence gateway in which you can keep track of things such as reputation, external threats, news and other information without exposing your network to bad content hosted on third party web servers. Pricing starts at $1995 if you use your own hardware or $2995 for a 1U security device. If your an ISP find out how you can get the system without charge.
For more information visit http://www.slcsecurity.com/ or call us at (919)441-7353.
Our second offering is our Security Gateway Appliance. The Gateway appliance is suitable for small to medium enterprises and provides a firewall, IDS/IPS as well as our Intelligence gateway in which you can keep track of things such as reputation, external threats, news and other information without exposing your network to bad content hosted on third party web servers. Pricing starts at $1995 if you use your own hardware or $2995 for a 1U security device. If your an ISP find out how you can get the system without charge.
For more information visit http://www.slcsecurity.com/ or call us at (919)441-7353.
Monday, January 12, 2015
OUR OPINION: National Breach Notification Standard
We have been reading articles and watching interviews concerning a national breach notification standard and several people in our office and clients have stated some things that really have us thinking about this proposal.
Part of the proposal states that Americans have a right to know what information is being collected about them and how it is being used. This is interesting with the recent things that have come to light out of the Snowden debacle. In fact if that's the case I would think that the Government should play by the same rules that they are dishing out on the Corporate world.
Of course we all know they will exempt themselves from having to meet the same guidelines.
One other interesting aspect is that it will give businesses 30 days to disclose if information has been lost or stolen. Well that's fine but what about the businesses that never acknowledge having had a breach and the security researchers that have the information and are afraid to release it for fear of reprisal?
We get submissions every single day and while we cannot validate each and every one some businesses do the right thing and deal with the notifications and take care of their customers, but many don't. Many of the organizations including colleges and universities simply ignore it because they know we can't release their information. It's a catch 22 that the Government and laws are not keeping up with. They should have a program (within the Government) where these submissions can be presented without threat of legal action from the affected party. This would eliminate the general liabilities of security researchers that are privy to more information than even the Government.
Thought our comments are greatly appreciated on this topic!
Part of the proposal states that Americans have a right to know what information is being collected about them and how it is being used. This is interesting with the recent things that have come to light out of the Snowden debacle. In fact if that's the case I would think that the Government should play by the same rules that they are dishing out on the Corporate world.
Of course we all know they will exempt themselves from having to meet the same guidelines.
One other interesting aspect is that it will give businesses 30 days to disclose if information has been lost or stolen. Well that's fine but what about the businesses that never acknowledge having had a breach and the security researchers that have the information and are afraid to release it for fear of reprisal?
We get submissions every single day and while we cannot validate each and every one some businesses do the right thing and deal with the notifications and take care of their customers, but many don't. Many of the organizations including colleges and universities simply ignore it because they know we can't release their information. It's a catch 22 that the Government and laws are not keeping up with. They should have a program (within the Government) where these submissions can be presented without threat of legal action from the affected party. This would eliminate the general liabilities of security researchers that are privy to more information than even the Government.
Thought our comments are greatly appreciated on this topic!
Sunday, January 11, 2015
WARNING:GoGo Inflight Internet Interception
We have been seeing reports of invalid SSL certificates, Malware infections and other problems with GoGo Inflight Internet service. In fact we have had multiple independent reports come in as recent as this evening of strange activities on the network (we have screenshots and data) that indicate information is being recorded by the system utilized to provide Internet to passengers.
Just be warned and don't assume that because your using a VPN over the service that your communications are secure especially if you are utilizing an SSL VPN product. In fact some SSL vpn's won't even connect at all.
Just be warned and don't assume that because your using a VPN over the service that your communications are secure especially if you are utilizing an SSL VPN product. In fact some SSL vpn's won't even connect at all.
INTEL: Paris suspect in terror plot update (TERROR SUSPECT Hayat Boumeddiene) via OSINT-X (UPDATED)
The remaining subject wanted in connection with the terror attacks is back in Syria. Information shows that the subject was able to move through Turkey and is now confirmed to be in Syria.
It is believed the subject entered Turkey on 2 January, 2015.
Subject is believed to have been in the city of Sanliurfa in Turkey and has since returned to Syria.
Our sources are saying Turkey is not providing information because they cannot confirm it. The last confirmed report is that on 2 January 2015 the subject was known to be in Sanliurfa.
INTEL//OS//TIP
UPDATE: 1/12/2015:
The information noted is being heavily reported on mainstream media today. It appears as though the previous intelligence gathered through OSINT-X is being confirmed by all of the news accounts.
It is believed the subject entered Turkey on 2 January, 2015.
Subject is believed to have been in the city of Sanliurfa in Turkey and has since returned to Syria.
Our sources are saying Turkey is not providing information because they cannot confirm it. The last confirmed report is that on 2 January 2015 the subject was known to be in Sanliurfa.
INTEL//OS//TIP
UPDATE: 1/12/2015:
The information noted is being heavily reported on mainstream media today. It appears as though the previous intelligence gathered through OSINT-X is being confirmed by all of the news accounts.
Friday, January 9, 2015
UPDATED: SA - Terrorist Security Alert France
FOR IMMEDIATE RELEASE
A gun assault on the Paris offices of satirical magazine Charlie Hebdo Wednesday was the deadliest terrorist attack in France's recent history. Some other terror attacks in Western Europe:
SECTOR REPORTS:
National Security: Heightened Alert Status but No Changes to Security Posture at Embassies
Homeland Security: Actively Assisting
Corporate Security: No Impact
POSSIBLE RELATED INTEL:
ISIS Video Released over the past few days possible trigger for attack
Noted Alerts to France prior to attack after first incident earlier in the week
A previous attack in Tours, France Bertrand Nzohabonayo, had used an ISIS propaganda image as his Facebook profile picture.
The very next day, a driver, also shouting “Allahu Akbar,” slammed into a crowd of 13 pedestrians in Dijon, injuring 11. Police say the former psychiatric patient, who was most likely drunk, will probably face terrorism charges.
This Monday, a second driver, with a similar history of mental illness, drove his car into 10 people in holiday market in Nantes, killing one. Both police and eyewitnesses say the suspect appeared “unbalanced” after the attack while repeatedly stabbed himself and muttered things about protecting children in Chechnya and working to free the people of Palestine.
Finally, that same evening, a bullet smashed through a window at Paris synagogue. No one was injured.
What no one has reported, however, is that only hours before the first attack in this timeline, ISIS released a new video calling for all Muslims in France unable to immigrate and join its campaigns in Syria and Iraq to pick up arms and attack local citizens, “where they stand and in their homes.”
12 Confirmed Dead with 8 Injured (critical injuries).
Previous news indicating France has disrupted a terrorist plot have been removed but are still available for review in OSINT-X.
Total Records Associated in OSINT-X: 366 Confirmed, 19 Pending, 3 Alerts
1/8/2014:
Lots of police activity in French Villages
Shots fired at Mosque
Percussion Grenades deployed at Mosque
Police Woman killed in France
French tells U.S. suspect trained with Al Qaeda
Suspects confirmed on US Watch List
Magazine states they will publish 1 million copies of next issue
U.S. and French cooperating with intelligence details
Private Company data being tapped to assist in the investigation
1/9/2014:
Search Helicopter spots the 2 suspects in the terror attack.
Terrorist still wearing black clothing when spotted from the air.
Weather turns bad for search. The search continues on the ground and the air.
Hostages taken at printing company and supermarket in France, 4 suspects, unknown hostages
Blast, Gunshots at both France hostage sites
Woman and Man associated with Policewoman shooting earlier in the week, hostages at supermarket
2 Brothers, killed at site of hostage taking - Confirmed by Mayor
3 Terrorist Killed, Female Terrorist being pursued at this time
FBI issues alert in US on possible terrorist attacks
Analyst have downgraded this alert.
A gun assault on the Paris offices of satirical magazine Charlie Hebdo Wednesday was the deadliest terrorist attack in France's recent history. Some other terror attacks in Western Europe:
SECTOR REPORTS:
National Security: Heightened Alert Status but No Changes to Security Posture at Embassies
Homeland Security: Actively Assisting
Corporate Security: No Impact
POSSIBLE RELATED INTEL:
ISIS Video Released over the past few days possible trigger for attack
Noted Alerts to France prior to attack after first incident earlier in the week
A previous attack in Tours, France Bertrand Nzohabonayo, had used an ISIS propaganda image as his Facebook profile picture.
The very next day, a driver, also shouting “Allahu Akbar,” slammed into a crowd of 13 pedestrians in Dijon, injuring 11. Police say the former psychiatric patient, who was most likely drunk, will probably face terrorism charges.
This Monday, a second driver, with a similar history of mental illness, drove his car into 10 people in holiday market in Nantes, killing one. Both police and eyewitnesses say the suspect appeared “unbalanced” after the attack while repeatedly stabbed himself and muttered things about protecting children in Chechnya and working to free the people of Palestine.
Finally, that same evening, a bullet smashed through a window at Paris synagogue. No one was injured.
What no one has reported, however, is that only hours before the first attack in this timeline, ISIS released a new video calling for all Muslims in France unable to immigrate and join its campaigns in Syria and Iraq to pick up arms and attack local citizens, “where they stand and in their homes.”
12 Confirmed Dead with 8 Injured (critical injuries).
Previous news indicating France has disrupted a terrorist plot have been removed but are still available for review in OSINT-X.
Total Records Associated in OSINT-X: 366 Confirmed, 19 Pending, 3 Alerts
1/8/2014:
Lots of police activity in French Villages
Shots fired at Mosque
Percussion Grenades deployed at Mosque
Police Woman killed in France
French tells U.S. suspect trained with Al Qaeda
Suspects confirmed on US Watch List
Magazine states they will publish 1 million copies of next issue
U.S. and French cooperating with intelligence details
Private Company data being tapped to assist in the investigation
1/9/2014:
Search Helicopter spots the 2 suspects in the terror attack.
Terrorist still wearing black clothing when spotted from the air.
Weather turns bad for search. The search continues on the ground and the air.
Hostages taken at printing company and supermarket in France, 4 suspects, unknown hostages
Blast, Gunshots at both France hostage sites
Woman and Man associated with Policewoman shooting earlier in the week, hostages at supermarket
2 Brothers, killed at site of hostage taking - Confirmed by Mayor
3 Terrorist Killed, Female Terrorist being pursued at this time
FBI issues alert in US on possible terrorist attacks
Analyst have downgraded this alert.
Thursday, January 8, 2015
ACO Congress is currently undergoing Maintenance. Check back soon.
A notice was posted to the ACO Congress that the site is currently down and undergoing maintenance. SLC Security Services LLC is NOT involved with the investigation of this entity.
A historical look shows that this system may have had issue far earlier than originally thought as some information points to May as the original time frame of the attack - Unconfirmed
A historical look shows that this system may have had issue far earlier than originally thought as some information points to May as the original time frame of the attack - Unconfirmed
UPDATED WITH REFERENCES: Black Boxes being heavily utilized in ATM fraud attacks
We have several confirmed reports of recent arrest and the increase in the use of black box ATM machine hacks. There have been confirmed reports out of Russia and in the recent case of Thomas Gilbert (according to MSNBC). Many police departments are operating on memorandum that shows pictures of what the devices look like and some reports are coming in to Investigators that these devices are increasingly showing up as a result of criminal search warrants often times for unrelated issues.
It is believed that the same group responsible for the Home Depot breaches may in fact be related to the increase in the number of these devices being discovered.
Carders have jackpotted an ATM by inserting a circuit board into the USB ports of an ATM, tricking it into spitting out cash.
The technique was thought to have emulated the cash dispenser of the ATM so the brains of the machine thought everything was normal, buying additional time for the brazen crooks to make off with the cash.
Additional reference material (Pic Above)
Additional Details and Reports:
NCR puts out notice to customers alerting them to be vigilant with this issue 1/6/2015 - This appears to be what alerted Krebs to the issue that he initially reported on
NCR reports black boxing being heavily utilized by criminals in Mexico 1/8/2015
SLC Security obtains independent report of organized criminal activity related in UK, Mexico and Canada via our clients and financial service partners of issues related to black boxing 1/8/2015
SLC Security noted Twitter activity of bragging of successful attacks 1/8/2015 - It is believed that plans and code are being sold to build boxing devices.
It is believed that the same group responsible for the Home Depot breaches may in fact be related to the increase in the number of these devices being discovered.
In the photo above you can clearly see the serial interface utilized to conduct this attack.
Additional information will be released to members of our OSINT-X service.
NOTHING FOLLOWS
Related and Updated Information:
Cash machines pay out after USB module gets a call from a Galaxy S4 (Originally Reported by Krebs)
Location: UKCarders have jackpotted an ATM by inserting a circuit board into the USB ports of an ATM, tricking it into spitting out cash.
The technique was thought to have emulated the cash dispenser of the ATM so the brains of the machine thought everything was normal, buying additional time for the brazen crooks to make off with the cash.
Additional Details and Reports:
NCR puts out notice to customers alerting them to be vigilant with this issue 1/6/2015 - This appears to be what alerted Krebs to the issue that he initially reported on
NCR reports black boxing being heavily utilized by criminals in Mexico 1/8/2015
SLC Security obtains independent report of organized criminal activity related in UK, Mexico and Canada via our clients and financial service partners of issues related to black boxing 1/8/2015
SLC Security noted Twitter activity of bragging of successful attacks 1/8/2015 - It is believed that plans and code are being sold to build boxing devices.
Wednesday, January 7, 2015
BREACH: www.acocongressportal.com
We have indications that this server was hacked earlier today. In addition to post showing up on popular sites for dumps we are also seeing indications of additional stolen information on other sites.
No attackers have claimed responsibility for this attack yet.
No attackers have claimed responsibility for this attack yet.
Pastebin Being Used to Launch Attacks
We are seeing code as well as commands being stored on pastebin with specific keywords and content strings used to launch denial of service and exploits. Sucuri has been researching this and we started seeing this type of activity this morning at a few sites.
SLC Security Services LLC utilizes customer premise equipment to collect information and attack history data from clients and from Internet Service Providers that participate in our network intelligence program.
SLC Security Services LLC utilizes customer premise equipment to collect information and attack history data from clients and from Internet Service Providers that participate in our network intelligence program.
OSINT-X Service Impact
Due to the ongoing feed activity as a result of the terror attacks in Paris our OSINT-X system is under heavy load today. What this means for customers is that feeds may be delayed up to 2 hours for updates as we add additional capacity today.
Our system is being accessed at record levels today and searches are taking up to 3 minutes to complete.
XML and RSS services that feed external sources will continue to operate in real time but our web based interfaces are slower to respond. We will update this post once the load returns to a normal level.
UPDATE: We have resolved the slow query times. We have re-indexed the data and now results are coming in line with what responses we normally expect. Updates are now set to real-time from news feeds and 10 minute updates on all other content.
Our system is being accessed at record levels today and searches are taking up to 3 minutes to complete.
XML and RSS services that feed external sources will continue to operate in real time but our web based interfaces are slower to respond. We will update this post once the load returns to a normal level.
UPDATE: We have resolved the slow query times. We have re-indexed the data and now results are coming in line with what responses we normally expect. Updates are now set to real-time from news feeds and 10 minute updates on all other content.
Friday, January 2, 2015
Best Statement We Have Seen All Year
"Many companies are so focused on the perimeter that they have little idea what's going on inside the network."
BREACH UPDATE: Chick-Fil-A Inc
Popular fast-food chain Chick-Fil-A Inc. is investigating a payment
card data breach affecting an unknown number of its U.S. locations, but
early indications suggest many thousands of customer accounts may have
been compromised.
First reported Tuesday evening by Krebs on Security, the Chick-Fil-A data breach may date back to December 2013.
First reported Tuesday evening by Krebs on Security, the Chick-Fil-A data breach may date back to December 2013.
Sunday, December 28, 2014
DISCLOSURE: Independence Blue Cross
Independence Blue Cross has indicated that a maintenance worker discarded 12,500 paper records in the normal trash in October.
Thursday, December 25, 2014
H.J. Russell & Company - Owned
This companies IP address block has shown up in OSINT-X as a compromised host. This organization has machines attacking many other companies so they are presumed hacked at this point.
This activity started early 25 Dec 2014 and is ongoing.
Type: General
Area: Engineering
First Noted: 25 Dec 2014
Location: Various Locations
Total Records: 2500+ attacks noted
Status: Not Monitoring for Follow Up (Not a client of SLC Security Services LLC)
This activity started early 25 Dec 2014 and is ongoing.
Type: General
Area: Engineering
First Noted: 25 Dec 2014
Location: Various Locations
Total Records: 2500+ attacks noted
Status: Not Monitoring for Follow Up (Not a client of SLC Security Services LLC)
Merry Christmas from the SLC Security Team...
We wish you all a safe and happy holiday season... We will see you all on the 2nd...
Tuesday, December 23, 2014
Hey where did the domain monitoring go?
We wanted to let you all know that we are no longer offering notification services on domains. In order to get this information you will be required to subscribe to OSINT-X or purchase a system to host the solution at your location. Our business model has changed significantly over the past year and it is not longer in our best interest to provide a notification service that you can setup for yourself in the OSINT-X product line.
"This change may affect some people but at the end of the day the information being ingested into OSINT-X is more up to date than the system that scours our feeds for your companies information. This move is a win for our customers." said Kevin Wetzel of SLC Security.
"This change may affect some people but at the end of the day the information being ingested into OSINT-X is more up to date than the system that scours our feeds for your companies information. This move is a win for our customers." said Kevin Wetzel of SLC Security.
First Citizens Bank and Covert Electronic Surveillance
We are seeing indications that this bank is under covert electronic surveillance. This could be auditors hired by the bank, bad actors looking for attack vectors or some other party. We are not sure of the reason but our investigators have noted on several different dates that sophisticated attacks may be taking place at branch locations that are in non heavily populated areas or that these areas are under surveillance.
If you have any additional information on what may be occurring here please contact Kevin Wetzel at (919) 441-7353 or call our TSCM line at (717) 831-TSCM. Reports may remain anonymous if requested.
If you have any additional information on what may be occurring here please contact Kevin Wetzel at (919) 441-7353 or call our TSCM line at (717) 831-TSCM. Reports may remain anonymous if requested.
2014 Historical Data to be released to Tableau Desktop or Public Users
As part of our technology share program SLC Security Services LLC will be releasing intelligence information formatted for users of Tableau Desktop or Public software so you can perform your own network analysis. The information being provided will be for a 30 day period and will include several of our feeds so you can run comparisons against your own network traffic.
Some of our clients have begun running the data against firewall and server logs to identify compromised machines and host so this may be valuable to you to determine if you should hire a third party to perform a network or security analysis of your data.
The tableau data will be released to the public area of the Tableau Server and will be available to the public. The time periods of the data will be from 15 Nov - 15 Dec 2014. The purpose of the release is so you can evaluate some of the same data that we utilize in our security appliances to determine if the devices are a good fit for your organization. If you come up with other use cases please let us know. We would love to work with some new faces in 2015 and we will do profit sharing on any use case that is adopted into our commercial gateway appliance.
The SLC Secure Gateway is an appliance that acts as a firewall and gateway on networks and also collects information from workstations to include MD5 list of files, network traffic data and action logs to match indicators of compromise with known virus, malware and network security threats.
Some of our clients have begun running the data against firewall and server logs to identify compromised machines and host so this may be valuable to you to determine if you should hire a third party to perform a network or security analysis of your data.
The tableau data will be released to the public area of the Tableau Server and will be available to the public. The time periods of the data will be from 15 Nov - 15 Dec 2014. The purpose of the release is so you can evaluate some of the same data that we utilize in our security appliances to determine if the devices are a good fit for your organization. If you come up with other use cases please let us know. We would love to work with some new faces in 2015 and we will do profit sharing on any use case that is adopted into our commercial gateway appliance.
The SLC Secure Gateway is an appliance that acts as a firewall and gateway on networks and also collects information from workstations to include MD5 list of files, network traffic data and action logs to match indicators of compromise with known virus, malware and network security threats.
Covert Listening Threats even worse than recent hacking attempts
Over the past few weeks we have been researching data from various audits on the east coast. We are noting a large increase in the identification, location and disabling of covert listening devices. In the month of November alone we have discovered 14 separate listening devices at 7 different companies. One thing we also have noticed are some similarities between the various devices that have been located.
1. In several of the cases there were multiple listening devices in the same area. We believe this is being done so that if the primary is found the backup may continue to provide useful information to the attackers.
2. Fax machines are being heavily targeted at many businesses. We have been able to locate stolen documents in 4 of the cases out of the 14 being researched.
3. Ultrasonic devices are being used to avoid detection.
4. Networks are also being attacked with malware reporting back to 194.165.134.66. These IP's are also attempting to attack SMTP servers to verify accounts at these same organizations. This was determined through log file analysis.
5. 1 of the 14 companies is a major US Military Contractor.
These are the finding for November. We are still seeing covert listening devices in December and the numbers this month even with the holiday breaks are much higher than November so we are alerting companies to look for traffic to this host and call us if you have identified any. We would like to look for accompanying planted devices to see if this pattern remains. Only 1 of the 14 entities was not bugged or we did not locate any devices during the sweep.
SLC Security customers please read bulletin 2014-141 for additional information on the network IOC's and signal identification notations for these 14 locations.
1. In several of the cases there were multiple listening devices in the same area. We believe this is being done so that if the primary is found the backup may continue to provide useful information to the attackers.
2. Fax machines are being heavily targeted at many businesses. We have been able to locate stolen documents in 4 of the cases out of the 14 being researched.
3. Ultrasonic devices are being used to avoid detection.
4. Networks are also being attacked with malware reporting back to 194.165.134.66. These IP's are also attempting to attack SMTP servers to verify accounts at these same organizations. This was determined through log file analysis.
5. 1 of the 14 companies is a major US Military Contractor.
These are the finding for November. We are still seeing covert listening devices in December and the numbers this month even with the holiday breaks are much higher than November so we are alerting companies to look for traffic to this host and call us if you have identified any. We would like to look for accompanying planted devices to see if this pattern remains. Only 1 of the 14 entities was not bugged or we did not locate any devices during the sweep.
SLC Security customers please read bulletin 2014-141 for additional information on the network IOC's and signal identification notations for these 14 locations.
Copycat Hacks Becoming Commonplace
While Government experts have pointed the finger at North Korea in the recent attack of SONY. We are still not convinced. The reason we are not convinced lies in the OSINT-X data we have archived and analyzed, the malware used in the attack and the similarities of an earlier attack on South Korean banks. One thing is for sure that the Government is not an OSINT-X customer at this time although we have had contact and interest in the product for other uses within the DOD. The FBI probably could use the system to help them in this type of case but as of yet they have not requested access or a stand alone system at any of their locations even though we have offered in the past.
One thing stinks in this whole North Korea blame game. There are misspellings in some of the code used in the first attack and the second attack does not show the same signs. We find it hard to believe that the same people are responsible based on word structure and simple elimination due to the fact that the IP addresses that were cited in an earlier report have changed hands in the botnet wars on more than four separate occasions over the past year and one of the IP's is in direct control of a known China group that would be more suited to carry out this type of attack. This same IP also is hosting malware and has been listed as a compromised system 2 times in the past 2 months.
Truth be told nobody knows exactly who has committed this act and secondly it is nearly impossible without having access to the Internet Service Providers (ISP) core networks to analyze traffic. I say show me proof and I"ll believe that it was North Korea. There are too many ways for these guys to cover their tracks than to make a connection through one of the 1024 official IP addresses that are in use in North Korea. This information is also wrong as there are over 5000 IP addresses in our systems that lead to North Korean associate entities masked as news and public information sites (most of which are hosting propaganda on servers outside of North Korea). It stands to reason based on our intelligence that the North Korean Government is responsible for these systems directly as they do not allow outside entities to utilize communications systems and have played mock games with various releases of "malware" and viruses on these same systems infecting thousands of other entities. If they were in fact responsible they would do like every other hacker and use jump servers to mask their identity.
If you really want to see something interesting look at the 194.165.134.0/24 block and look at connections going to and from the Internet via that IP block. Then you may be able to tell us something.
One thing stinks in this whole North Korea blame game. There are misspellings in some of the code used in the first attack and the second attack does not show the same signs. We find it hard to believe that the same people are responsible based on word structure and simple elimination due to the fact that the IP addresses that were cited in an earlier report have changed hands in the botnet wars on more than four separate occasions over the past year and one of the IP's is in direct control of a known China group that would be more suited to carry out this type of attack. This same IP also is hosting malware and has been listed as a compromised system 2 times in the past 2 months.
Truth be told nobody knows exactly who has committed this act and secondly it is nearly impossible without having access to the Internet Service Providers (ISP) core networks to analyze traffic. I say show me proof and I"ll believe that it was North Korea. There are too many ways for these guys to cover their tracks than to make a connection through one of the 1024 official IP addresses that are in use in North Korea. This information is also wrong as there are over 5000 IP addresses in our systems that lead to North Korean associate entities masked as news and public information sites (most of which are hosting propaganda on servers outside of North Korea). It stands to reason based on our intelligence that the North Korean Government is responsible for these systems directly as they do not allow outside entities to utilize communications systems and have played mock games with various releases of "malware" and viruses on these same systems infecting thousands of other entities. If they were in fact responsible they would do like every other hacker and use jump servers to mask their identity.
If you really want to see something interesting look at the 194.165.134.0/24 block and look at connections going to and from the Internet via that IP block. Then you may be able to tell us something.
Friday, December 19, 2014
BREACH UPDATE: Staples admits to customers data being lost
Staples Inc. has come out with the following statement today.
The number of cards affected 1.16 million.
Staples Inc. (SPLS), the largest U.S. office-supply retailer, said 1.16 million payment cards may have been affected in a series of data breaches that occurred from July into September.
The theft occurred after criminals deployed malware on point-of-sale systems at 115 of Staples’ 1,400 U.S. stores, the Framingham, Massachusetts-based company said today in a statement. The company disclosed in October that it was investigating a potential breach.
The number of cards affected 1.16 million.
Staples Inc. (SPLS), the largest U.S. office-supply retailer, said 1.16 million payment cards may have been affected in a series of data breaches that occurred from July into September.
The theft occurred after criminals deployed malware on point-of-sale systems at 115 of Staples’ 1,400 U.S. stores, the Framingham, Massachusetts-based company said today in a statement. The company disclosed in October that it was investigating a potential breach.
Thursday, December 18, 2014
The Grinch?? Alert Logic's Claim's Not Adding Up
So as penetration testers we immediately took the information provided by Alert Logic in a recent notification concerning a vulnerability in Linux systems known as "the grinch". Our technical staff have all tried to confirm the information provided with the information provided in their post. Guess what?! We can't get any of the systems we have been testing to actually prove this exploit exist.
We have tested on RHEL, Fedora, Ubuntu and a few other distros and as of 5PM EST have not seen a single system that will allow us to exploit this vulnerability.
If anybody has more specific details on how this is accomplished we would love to hear about it.
We have tested on RHEL, Fedora, Ubuntu and a few other distros and as of 5PM EST have not seen a single system that will allow us to exploit this vulnerability.
If anybody has more specific details on how this is accomplished we would love to hear about it.
Wednesday, December 17, 2014
WE AGREE: SONY did not get hacked by North Korea
Those of us in the security research arena are not buying the statement in mainstream news that SONY was hacked by North Korea. In fact there are many indicators to indicate otherwise. We are not gonna speculate on this and are surprised at the number of news organizations that are putting out information on a whim.
Additional Reading:
Data Breaches also agree's
North Korea Tech
And This...
And This...
Yeah, Yeah we know there are not many that agree but North Korea is pretty much cut off from the outside world. They may have asked another rogue state to help them but again we are not gonna go the way of the mainstream news.
In non US news circles many outlets are reporting that the attackers are unknown but in the US it seems the media would like to make it appear as though North Korea is responsible. We all know North Korea couldn't hack it's way out of a wet paper bag.
Additional Reading:
Data Breaches also agree's
North Korea Tech
And This...
And This...
Yeah, Yeah we know there are not many that agree but North Korea is pretty much cut off from the outside world. They may have asked another rogue state to help them but again we are not gonna go the way of the mainstream news.
In non US news circles many outlets are reporting that the attackers are unknown but in the US it seems the media would like to make it appear as though North Korea is responsible. We all know North Korea couldn't hack it's way out of a wet paper bag.
Monday, December 15, 2014
Guess What?! Your owned... UPDATED 12/16/2014 1:37PM EST
On 15 December, 2014 SLC Security Services LLC kicked off an analytic job to determine what host are owned or have been compromised. The following organizations came out of our analysis as being compromised and either used to perform additional attacks or part of a larger issue such as botnets, malware distribution or brute force activity. The following entities have been seen by sensors owned or operated by SLC Security Services LLC volunteers.
If you show up on this list you may want to find a reputable security firm to help you secure your infrastructure. If you have any questions you can email soc@slcsecurity.com.
Pinellas County Schools, FL
Etech Group Pty Ltd, FL*
Turner Broadcasting Systems Inc, GA
New Life Homes LLC, GA*
CocaCola Company, GA
Grant County, Moses Lake WA
Indiana Department of Education, IN
Massachusetts Institute of Technology, MA
New England Telehealth Consortium*
Arvixe LLC, Santa Rosa CA*
National Center for Atmospheric Research
Boston University, MA
Automated Data Systems
Georgia Public Web Inc, GA
Mainstream Consulting Group, MN
Minnesota State Colleges and Universities, MN
George Mason University, DC
Disclaimer: The information included in this report was provided by third parties such as WHOIS, Domain Registrations, Private Databases and proprietary information. We do not warrant this information to be free from error. In fact we are seeing fraudulent WHOIS data on an increasing basis but we believe the information to be accurate. Item's marked with a star were only verified with WHOIS so these names may not be accurate.
62 man hours of research and analytic processes were utilized to identify these organizations.
If you show up on this list you may want to find a reputable security firm to help you secure your infrastructure. If you have any questions you can email soc@slcsecurity.com.
Pinellas County Schools, FL
Etech Group Pty Ltd, FL*
Turner Broadcasting Systems Inc, GA
New Life Homes LLC, GA*
CocaCola Company, GA
Grant County, Moses Lake WA
Indiana Department of Education, IN
Massachusetts Institute of Technology, MA
New England Telehealth Consortium*
Arvixe LLC, Santa Rosa CA*
National Center for Atmospheric Research
Boston University, MA
Automated Data Systems
Georgia Public Web Inc, GA
Mainstream Consulting Group, MN
Minnesota State Colleges and Universities, MN
George Mason University, DC
Disclaimer: The information included in this report was provided by third parties such as WHOIS, Domain Registrations, Private Databases and proprietary information. We do not warrant this information to be free from error. In fact we are seeing fraudulent WHOIS data on an increasing basis but we believe the information to be accurate. Item's marked with a star were only verified with WHOIS so these names may not be accurate.
62 man hours of research and analytic processes were utilized to identify these organizations.
Another Round - Compromised Host
We will be publishing another round of compromised host later this evening at approx. 10PM EST.
We are running a batch analytic job in Analytic Desktop as we speak. We will release the results when the job is finished.
We are running a batch analytic job in Analytic Desktop as we speak. We will release the results when the job is finished.
BREACH: NCUA Flash Drive Lost - Data being sold on Darknet
NCUA confirmed that an examiner lost an external flash drive containing names, addresses and social security number as well as the account numbers belonging to the members of the Palm Springs Federal Credit Union.
They were quick to note that the data did not require passwords or PINS of the associated accounts.
We have noted information pertaining to be from this loss being sold on Darknet.
NOTHING FOLLOWS
They were quick to note that the data did not require passwords or PINS of the associated accounts.
We have noted information pertaining to be from this loss being sold on Darknet.
NOTHING FOLLOWS
SONY Hack - What they are not telling you
It goes without saying that SONY is in deep trouble. We started seeing problems back in February of 2014 as several Sony related host had shown up on our blacklist of compromised systems. We were not doing the blogging thing back then but we can assure you that they are not being 100% honest about what has happened since they first discovered the breach.
You see Sony did exactly what some of the other entities we are blogging about. NOTHING. They knew they had security problems but they took the road that many of the companies we notify do. They sit back and try to cover up the issue before anybody notices. What's different this time in Sony's case is that the hackers had ample time to farther attack the Sony network. This bought the attackers much needed time to dig in really deep and to start shuffling data off the Sony network.
Here's what we know today:
1. Sony was attack far earlier than reported. We started seeing indicators back in February on our Compromised Host and Brute Force Attackers list.
2. The attack went unreported until the attackers started releasing troves of information.
3. The attackers notified Sony and tried to extort money from executives numerous time, Sony did not cave in to the attackers demands.
4. Information is being sold and the FBI is actively investigating the incident. Security researchers have confirmed that the FBI visited them after they downloaded Sony's proprietary documents.
5. Information is currently being sold on Underground Web Sites.
6. While the media is pointing to North Korea they are basing this information on the fact that some of the malware was written in Korean. This is really an assumption and we have seen this tactic being used to misdirect blame in the past.
7. Iran is releasing torrents with Sony information in them so they should also be given a second look but as of today it is not known who exactly is behind this attack.
You see Sony did exactly what some of the other entities we are blogging about. NOTHING. They knew they had security problems but they took the road that many of the companies we notify do. They sit back and try to cover up the issue before anybody notices. What's different this time in Sony's case is that the hackers had ample time to farther attack the Sony network. This bought the attackers much needed time to dig in really deep and to start shuffling data off the Sony network.
Here's what we know today:
1. Sony was attack far earlier than reported. We started seeing indicators back in February on our Compromised Host and Brute Force Attackers list.
2. The attack went unreported until the attackers started releasing troves of information.
3. The attackers notified Sony and tried to extort money from executives numerous time, Sony did not cave in to the attackers demands.
4. Information is being sold and the FBI is actively investigating the incident. Security researchers have confirmed that the FBI visited them after they downloaded Sony's proprietary documents.
5. Information is currently being sold on Underground Web Sites.
6. While the media is pointing to North Korea they are basing this information on the fact that some of the malware was written in Korean. This is really an assumption and we have seen this tactic being used to misdirect blame in the past.
7. Iran is releasing torrents with Sony information in them so they should also be given a second look but as of today it is not known who exactly is behind this attack.
Sunday, December 14, 2014
UPDATE: UC Berkeley Acknowledge Breach
Previously we reported on a list of college systems that were showing up in our OSINT system as being compromised. Earlier today we were notified that an alert was sent to UC Berkeley students and staff advising them of the breach.
Read our previous post here.
This is exactly why we started this blog and we are glad to see that they reported this in such a timely manner.
From the information being provided it appears as though the Real Estate Division is the affected Berkeley entity. They are stating that they first detected the activity in September. Although UC Berkeley is not a customer of ours we are glad that they took action.
Read our previous post here.
This is exactly why we started this blog and we are glad to see that they reported this in such a timely manner.
From the information being provided it appears as though the Real Estate Division is the affected Berkeley entity. They are stating that they first detected the activity in September. Although UC Berkeley is not a customer of ours we are glad that they took action.
Wireless the Number 1 Vector
If your organization is running wireless we are advising you that this is the number one attack vector. It is recommended that you move to certificate based authentication. In 57 of 60 assessments we are reviewing wireless is by far the easiest vector to gain access to corporate networks. Even if corporate wireless networks are segregated the information sent through these networks may lead to actual compromises of legitimate network resources due to the fact that many devices will still try and authenticate to resources over the network.
When conducting penetration testing we are successful over 95% of the time in gaining credentials over guest networks so just because you think your guest network is not connected to your corporate network you should still be vigilant in monitoring.
When conducting penetration testing we are successful over 95% of the time in gaining credentials over guest networks so just because you think your guest network is not connected to your corporate network you should still be vigilant in monitoring.
EXCLUSIVE: The Top 10 Items Missed During an Audit (Article 3 of 10 in a series)
This is an exclusive provided by SLC Security Services LLC the leader in Medical, Compliance and DOD Auditing Solutions.
Number 10 on the list is attacks on your Disaster Recovery Plan or Third Parties that handle your data. We are seeing more and more third party vendors of large companies open them up to compromise due to standards not being in place and no auditing of third parties that you share data.
If you remember Target this was a perfect example whereas their air conditioning contractor failed to secure their network and malware was introduced via this path. Many times businesses open up firewalls to vendors without any auditing and verification of what data is moving through those trusted connections. Here are some recommendations to prevent your vendors from allowing a hacker to jump through a third party and gain access to unauthorized resources.
1. Even though a vendor may be "trusted" they should only be trusted to particular systems. The systems should not reside in your network. Host that data in a separate network segment that you can introduce DLP or monitoring protections such as IPS and IDS and make sure you are alerted if any attempts are made to access resources other than the destinations you have authorized.
2. Grant the least access required. Open only single IP and services in your firewall. Don't completely allow them to access any resource on your internal networks.
3. ENCRYPT YOUR DATA as it leaves your network. Ensure that information that is taken is encrypted. This prevents somebody other than your vendor from accessing data in which they are not authorized to view. Use time based encryption so that the keys are generated and discarded daily using security devices made for this purpose.
4. Require 2 factor authentication to view or access systems. Sure it may be inconvenient but so is losing your customer base to hackers.
If possible use hardware based network cards (INTEL makes a great solution) that only allows one device on your customer network to access only the single device on your internal network that they require to carry out authorized functions and processes.
Another great idea is to use an endpoint firewall solution.
If you would like to audit your third party vendors contact SLC Security at (919) 441-7353 to schedule an audit.
Number 10 on the list is attacks on your Disaster Recovery Plan or Third Parties that handle your data. We are seeing more and more third party vendors of large companies open them up to compromise due to standards not being in place and no auditing of third parties that you share data.
If you remember Target this was a perfect example whereas their air conditioning contractor failed to secure their network and malware was introduced via this path. Many times businesses open up firewalls to vendors without any auditing and verification of what data is moving through those trusted connections. Here are some recommendations to prevent your vendors from allowing a hacker to jump through a third party and gain access to unauthorized resources.
1. Even though a vendor may be "trusted" they should only be trusted to particular systems. The systems should not reside in your network. Host that data in a separate network segment that you can introduce DLP or monitoring protections such as IPS and IDS and make sure you are alerted if any attempts are made to access resources other than the destinations you have authorized.
2. Grant the least access required. Open only single IP and services in your firewall. Don't completely allow them to access any resource on your internal networks.
3. ENCRYPT YOUR DATA as it leaves your network. Ensure that information that is taken is encrypted. This prevents somebody other than your vendor from accessing data in which they are not authorized to view. Use time based encryption so that the keys are generated and discarded daily using security devices made for this purpose.
4. Require 2 factor authentication to view or access systems. Sure it may be inconvenient but so is losing your customer base to hackers.
If possible use hardware based network cards (INTEL makes a great solution) that only allows one device on your customer network to access only the single device on your internal network that they require to carry out authorized functions and processes.
Another great idea is to use an endpoint firewall solution.
If you would like to audit your third party vendors contact SLC Security at (919) 441-7353 to schedule an audit.
Friday, December 12, 2014
BREACH: Las Vegas Sands Corp
Breached by Iranian hackers in response to a comment made by the CEO of the company. Attack bears similarities with SONY as information was stolen and then the hard drives of the companies machines were wiped.
BREACH: St. Louis Parking Company
St Louis Parking Company has released a press release indicating that customers information may have been breached from 6 Oct 2014 - 31 Oct 2014.
The affected server was identified and isolated to avoid any further data from being compromised. Datapark, the manufacturer of the revenue controls system, is investigating the incident and following the Payment Card Industry Data Security Standard.
Third-party forensic experts were also hired to help investigate the matter. The breach has been contained.
Type: Card Processing
Area: Parking
First Noted: 9 Oct 2014
Location: MO
Total Records: Unknown
Status: Not Monitoring for Follow Up (Not a client of SLC Security Services LLC)
The affected server was identified and isolated to avoid any further data from being compromised. Datapark, the manufacturer of the revenue controls system, is investigating the incident and following the Payment Card Industry Data Security Standard.
Third-party forensic experts were also hired to help investigate the matter. The breach has been contained.
Type: Card Processing
Area: Parking
First Noted: 9 Oct 2014
Location: MO
Total Records: Unknown
Status: Not Monitoring for Follow Up (Not a client of SLC Security Services LLC)
BREACH: Kickback Jack's
We have confirmation that Kickback Jack's has been attacked. As of today the attack appears to be limited to just a few locations however that could rise as the investigation unfolds.
They are not a customer so we will not be following the activity but thought that it best for us to advise you that credit cards are being used that were swiped from Kickback locations.
Type: POS
Area: Hospitality
First Noted: 12 Dec 2014
Location: Various
Total Records: 4500+
Status: Not Monitoring for Follow Up (Not a client of SLC Security Services LLC)
They are not a customer so we will not be following the activity but thought that it best for us to advise you that credit cards are being used that were swiped from Kickback locations.
Type: POS
Area: Hospitality
First Noted: 12 Dec 2014
Location: Various
Total Records: 4500+
Status: Not Monitoring for Follow Up (Not a client of SLC Security Services LLC)
List of Owned Colleges and Universities
Over a weeks worth of research and sensor data has indicated a very large amount of college and universities that are infected with malware and/or viruses. In order to be listed a college would have to have been infected for a period of more than 7 days without detecting the botnet, virus, malware or compromised host. This report is only a snapshot in time but is current as of 12/12/2014. If you are in data security at these universities you can research public blacklist as we have already listed out the IP address ranges in our feed at http://www.slcsecurity.com/blocks/alert-ips.txt. Check the feed and if your in that list you might want to check your computing resources as soon as you can.
If you have trouble locating the infected boxes please reply to this post and we attempt to help you locate the infected or offending devices that we are observing.
University of Arkansas
University of Waterloo
University of California - This entity has acknowledged and is actively re-mediating the breach
University of Missouri Columbia
University of Maryland
University of Pennsylvania (PENNSTATE)
These are the universities that are currently show up in our OSINT systems. We are still working on a master list.
If you have trouble locating the infected boxes please reply to this post and we attempt to help you locate the infected or offending devices that we are observing.
University of Arkansas
University of Waterloo
University of California - This entity has acknowledged and is actively re-mediating the breach
University of Missouri Columbia
University of Maryland
University of Pennsylvania (PENNSTATE)
These are the universities that are currently show up in our OSINT systems. We are still working on a master list.
Thursday, December 11, 2014
Colleges Largely Already Owned by Hackers or Spreading Malware
During research on our analytic system this week he are noticing a bad trend concerning educational institutions. We started looking at colleges and conducted some analytic research that indicates that 52% of college and university networks currently have at least one host that is actively participating in bot or malware campaigns. What is troubling us lately is that many of the organizations we are seeing in our OSINT products have remained compromised or infected for very long periods of time.
We have scheduled an analytics job to run tonight that will look through our systems and match educational institutions to known indicators of compromise and we will be releasing the list of infected schools in the next several days once we have had a chance to analyze the results.
"These schools have students studying cyber security and forensics so it's concerning that they have not had their students take an inner look at their networks and secured these vulnerabilities".
We have scheduled an analytics job to run tonight that will look through our systems and match educational institutions to known indicators of compromise and we will be releasing the list of infected schools in the next several days once we have had a chance to analyze the results.
"These schools have students studying cyber security and forensics so it's concerning that they have not had their students take an inner look at their networks and secured these vulnerabilities".
Wednesday, December 10, 2014
NEWS: Hackers contacted top Sony executives before attack via OSINT-X Newswires
Top executives at Sony Pictures received an email extorting money three days before the company’s computer network was taken offline in a major hack.
The email message was among thousands released on Monday when the email boxes of two top Sony executives were leaked online. It was the latest release of potentially embarrassing corporate information following a major hack on the company’s computer networks two weeks ago.
“We’ve got great damage by Sony Pictures,” the message began. “The compensation for it, monetary compensation we want.”
“Pay the damage, or Sony Pictures will be bombarded as a whole. You know us very well. We never wait long. You’d better behave wisely,” it reads.
Tuesday, December 9, 2014
Data Security Excellence Note: Smithfield Johnston Memorial Hospital
During a recent walk through of Smithfield Johnston Memorial Hospital our staff noted that this hospital takes data security seriously. There were no wireless networks spewing data such as what has been observed at other hospitals and all patient consultations look to be held in private offices and not in shared spaces.
It was also noted that none of the workstations remained logged in when users walked away. In addition we can report that this hospital although not a client really took the data privacy of their clients seriously.
This hospital would be easy to audit as they have their act together. Good job Johnston Memorial!
It was also noted that none of the workstations remained logged in when users walked away. In addition we can report that this hospital although not a client really took the data privacy of their clients seriously.
This hospital would be easy to audit as they have their act together. Good job Johnston Memorial!
Sunday, December 7, 2014
BREACH: WellCare informs Medicare subscribers of data breach via OSINT-X Newswires
Some personal information of a few dozen Monroe County residents who
are Medicare subscribers with WellCare Health Plans recently was
mishandled by a subcontractor for the insurer.
In late November, WellCare sent letters to 47 people affected in Monroe County, telling them the breach did not include Social Security numbers or any financial information. The insurer notified more than 500 people throughout New York state who were affected.
The insurer said it was not aware of misuse of anyone's information. Nevertheless, it urged the 47 individuals to review their credit card bills and other financial statements. The insurer is providing one-year credit protection.
[...]
In late November, WellCare sent letters to 47 people affected in Monroe County, telling them the breach did not include Social Security numbers or any financial information. The insurer notified more than 500 people throughout New York state who were affected.
The insurer said it was not aware of misuse of anyone's information. Nevertheless, it urged the 47 individuals to review their credit card bills and other financial statements. The insurer is providing one-year credit protection.
[...]
COMPROMISED HOST: General Mills
We previously reported on General Mills. As of today we are still seeing indications of an infection coming from their network. We believe the host to be compromised.
Affected Host:
146.217.15.253
146.217.15.254
We have sent a notification for them to check their systems. We will update this post if we receive any follow up from them.
Affected Host:
146.217.15.253
146.217.15.254
We have sent a notification for them to check their systems. We will update this post if we receive any follow up from them.
COMPROMISED HOST - University of Minnesota 128.101.165.206
We are starting to see reports of a compromised host out of the University of Minnesota. The IP address 128.101.165.206 looks to have been breached sometime around 11-26-2014 and as of 12-02-2014 was still showing infected although it has since dropped from our nightly analytic runs.
Friday, December 5, 2014
EXCLUSIVE: The Top 10 Items Missed During an Audit (Article 2 of 10 in a series)
This is an exclusive provided by SLC Security Services LLC the leader in Medical, Compliance and DOD Auditing Solutions.
Issue 9 - Inadequate security of network path and access control systems
Yes we are jumping around a bit that's just because we have been really tied up with some clients this week. So here goes...
The number 9 issue on the top 10 list of items missed during audits is something most auditing companies never even check. When doing audits one of the items we check as part of our TSCM sweeps are the network, phone and cable paths. What we are referring to here are network cables that actually are accessible outside of your building, telephone connections in shared closets or alert system components in public areas that can be manipulated without gaining physical access to your secure space.
How many times have you been in a building and seen a closet labeled "Telecom Closet" or some similar title? These areas are troublesome for many of our clients that lease space in buildings. One of the things we have had to do at some client locations is request separate telephone lines and communications lines be brought directly into our customer space. We also insist on full metal conduits into the building as to prevent wire tapping and similar physical attacks on the lines. Full metal conduits also prevent some really neat tricks in which you don't even have to cut the phone lines to be able to monitor them.
At one bank recently we noted that in the walk in area beside the ATM was a network jack on the wall. When we tested the network jack it was connected directly to the customers network switch and the port was active. The port gave us an IP address and through passive network monitoring we are able to run wireshark and get at a ton of very sensitive information to include the domain information for network that the tellers in the branch were logging into. With some arp poisoning we were able to capture login credentials, needless to say the client disabled the port after the audit.
One important thing to note: 95% of the companies that we initially audit are not even aware of the TSCM threats that exist. Many times our audits are eye opening as we can tell who is in a building, login information to networks, etc, etc. just because they are not aware of some of these attack vectors. I can't tell you the number of wireless networks we find. It's very surprising and somewhat easy to obtain access to these networks when we do stumble upon these links.
So there you have it. Check your cable paths and make sure your devices are not going into shared space. If you really want to ensure the security of your communications here are a few other tips.
1. Do not use fax machines to send medical, PII or sensitive information over the telephone network. While most people think telephone networks are secure there are many stops along the way whereas your competition can get at your information and reconstruct your faxes, emails, etc.
2. Do not allow employees to bring personal electronic devices into areas that house PII or PHI. It has been proven that this is an attack vector that can be exploited.
3. Ensure cable paths are properly secured.
4. Do not use wireless handsets even if they are DECT "secure". DECT can be reconstructed it just takes the know how and tools to do it.
5. Do not send PII over wireless networks.
6. Do not allow third party vendors into any network that houses PII, PHI or PCI.
Have a great day folks and be sure to look for the next article in this series.
Issue 9 - Inadequate security of network path and access control systems
Yes we are jumping around a bit that's just because we have been really tied up with some clients this week. So here goes...
The number 9 issue on the top 10 list of items missed during audits is something most auditing companies never even check. When doing audits one of the items we check as part of our TSCM sweeps are the network, phone and cable paths. What we are referring to here are network cables that actually are accessible outside of your building, telephone connections in shared closets or alert system components in public areas that can be manipulated without gaining physical access to your secure space.
How many times have you been in a building and seen a closet labeled "Telecom Closet" or some similar title? These areas are troublesome for many of our clients that lease space in buildings. One of the things we have had to do at some client locations is request separate telephone lines and communications lines be brought directly into our customer space. We also insist on full metal conduits into the building as to prevent wire tapping and similar physical attacks on the lines. Full metal conduits also prevent some really neat tricks in which you don't even have to cut the phone lines to be able to monitor them.
At one bank recently we noted that in the walk in area beside the ATM was a network jack on the wall. When we tested the network jack it was connected directly to the customers network switch and the port was active. The port gave us an IP address and through passive network monitoring we are able to run wireshark and get at a ton of very sensitive information to include the domain information for network that the tellers in the branch were logging into. With some arp poisoning we were able to capture login credentials, needless to say the client disabled the port after the audit.
One important thing to note: 95% of the companies that we initially audit are not even aware of the TSCM threats that exist. Many times our audits are eye opening as we can tell who is in a building, login information to networks, etc, etc. just because they are not aware of some of these attack vectors. I can't tell you the number of wireless networks we find. It's very surprising and somewhat easy to obtain access to these networks when we do stumble upon these links.
So there you have it. Check your cable paths and make sure your devices are not going into shared space. If you really want to ensure the security of your communications here are a few other tips.
1. Do not use fax machines to send medical, PII or sensitive information over the telephone network. While most people think telephone networks are secure there are many stops along the way whereas your competition can get at your information and reconstruct your faxes, emails, etc.
2. Do not allow employees to bring personal electronic devices into areas that house PII or PHI. It has been proven that this is an attack vector that can be exploited.
3. Ensure cable paths are properly secured.
4. Do not use wireless handsets even if they are DECT "secure". DECT can be reconstructed it just takes the know how and tools to do it.
5. Do not send PII over wireless networks.
6. Do not allow third party vendors into any network that houses PII, PHI or PCI.
Have a great day folks and be sure to look for the next article in this series.
Subscribe to:
Posts (Atom)