Cedar APT IOC's Added

Cedar APT IOC's Added to the commercial feed.

A total of 6 IOC's related to Cedar have been updated.

BREACH: Advantage Dental

Advantage Dental ("Advantage"), an Oregon-based dental services provider notified 151,626 patients of a breach of personal patient protected health information (PHI/HIPAA) after its intrusion detection system discovered an internal database at Advantage was illegally accessed.  The unauthorized access occurred between February 23, 2015 and February 26, 2015. The intruder was able to gain access to this database through a computer that had been infected with malware.  Advantage terminated the illegal access immediately upon discovery on February 26, 2015. The intrusion resulted in the unauthorized access to the name, date of birth, phone number, social security number, and home address. No treatment, payment, or any other financial data was accessed.

First reported 16 March 2015. 

Read More: https://secure.advantagedental.com/index.asp?din=598

BREACH: Startup Slack Reports Data Breach

Looks like they have implemented 2 factor authentication. 

http://www.usatoday.com/story/tech/2015/03/27/slack-data-breach/70545436/

Under Attack - This Pattern Looks Familiar

Just like in previous disclosures that we have provided information within a few hours we end up coming under attack and just like the last time we say please by all means hit us so we can map out your networks and infected host...

This is a lesson in how to map out a botnet in real time. Thanks guys!

UPDATED WITH INDICATORS AND NOTES: Large BOTNET exposed

SLC Security Services LLC has discovered a previously unknown BOTNET network. We will be adding the indicators to our paid feeds. We had previously been seeing the nodes responding to various internet host but we couldn't get the host to respond to any of the request we sent. Apparently the bot command and control requires a certain sequence of ports to be queried prior to the C+C actually responding to the infected bot request in a normal fashion.

More information is being sent out via our alert feed to our paid subscribers.

UPDATE: Updated indicators have been rolled out to our client systems. If you see any indicators triggering with "BOTLICK" as the alert type page our on call contact specified in your contract. We would love to catch an active client so we can determine the initial infection vectors.

ADDITIONAL INDICATORS:
If you see encrypted traffic going to any of the following IP addresses please check your source for processes that should not be running. This is affecting Windows 7 and Windows 8 PC's.

179.111.212.221
81.149.12.77
89.156.44.210
38.108.61.227
37.110.214.124
86.126.135.242
112.211.182.241
125.62.97.218
95.31.88.21
112.198.90.89 - Additional C+C Detected
36.79.181.47 - Additional C+C Detected
190.107.244.151 - C+C
80.82.64.201 - C+C

ADDITIONAL DETAILS:
Our security analyst have been able to determine that there are at least 300+ host connected to the last indicator 36.79.171.47. We were able to pull in some additional data from our partners honeypots and network sensors to get a rough count of the activity level going to this system.

UPDATE: We are also seeing large numbers of connections to 80.82.64.201 as well. 

The system appears to be in Indonesia and is connected via cable modem. We are actively working with the ISP to see if they can provide any additional details.

UPDATES MOVED TO MAILING LIST

UPDATED 3-25-2014: Third US Health Entity Suspected of being Compromised

While we can't name any particular names at this time we have started seeing indicators of another related attack originating out of China aimed at US Healthcare entities. This time another well known affiliate of a previously breached healthcare entity appears to be attacking other Healthcare entities in California and Arizona.

Additional research is being done at this time but it appears as though a new malware variant is being sent via Phishing emails and they are coming from other healthcare entities so it appears as legitimate traffic which may be problematic as they may be assumed to be trusted entities.

The malware is being sent via email and is in zip, exe and also embedded HTML to infected flash websites. UPDATE: And now we are seeing PDF and word document with the same payload.

Updates will be posted here as we can obtain additional information. It appears as though one individual was also socially engineered to get malware inside an organization in Arizona. Additional reports are coming in from Utah and North Dakota as well.

Additional Details:
After researching we have noted that the botnet post from yesterday seems to be directly related to the compromised host.  - Additional IP's (Indicators) can be seen in this post.

After our report yesterday we also noted similar activity to what was seen prior to the Anthem, Community Health Systems and several University breaches we have been tracking.

If you run snort we have sent out the snort signatures (a total of 5 of them via our alert mailing list).

MOVED TO MAILING LIST - In addition another Intel provider may have already leaked the information this past week.... Have a good weekend everybody!

Apple Credential Phishing Attempts - As reported by MalwareBytes

We have been seeing many reports of Apple phishing schemes to include over 100 pages hosted at ovh.net. The scheme starts by emailing users purchase confirmations that look nearly identical to Apples legitimate purchase notifications but the links to cancel or verify the purchase lead to ovh.net and we have also noted xcelwings.com to be hosting similar content.

Ensure that you are verifying that you are connected to Apple to use secure pay or any of the other methods of purchase from the Apple store and be leary of any verification emails received. At a minimum verify that the domain is an actual Apple domain before proceeding.

Original Source: MalwareBytes
Additional Domain Indicator: SLC Security Services LLC

Researched by Analyst

Following the News - Intelligence Agency's Lacking Actionable Data

It goes without saying that the number of terrorist events over the past 2 weeks is quite alarming and as of the last 2 months the activity worldwide has increased. The number of attacks outside of traditional unstable areas has risen as well as the Iran and Israel debacle has some intelligence analyst shaking their heads.

With the revelation that the pilot of the Germanwings crash was locked out of the cockpit, US terror attack of TSA agents and many other incidents not being covered in the mainstream media we have to take note. In addition a constant barrage of hacking from China's "PANDA" crew, Iran hashing deals with long reaching effects in the middle east and many areas of instability. Things are about to get interesting.

The recent revelation that the US is supporting Iranian fighters in the region with air strikes things lately have seemed to be turned on their heads. What's next? We can tell you that we have picked up additional activity with some well financed groups in the middle east, messages hidden in images (stenography) with cryptic messages from the middle east and plenty more items that just cause us to wonder what is really going on out there.

Keep your eyes and ears open folks. Things are changing quicker than intelligence agency's can keep up and private entities are also struggling to keep up with changing conditions to keep our travelers and employees safe.

There are many types of terror related activities to be aware of in addition to the theft of your corporate secrets and we will be expanding the scope of intelligence that we post in the coming weeks. No longer will we simply focus on data leaks (although we will continue to provide the information we have been providing). There comes a time when information needs to be put out there so that business leaders and enterprises can maintain situational awareness and security of personnel and assets. While there are many organizations out there that claim to provide these types of service and Government bulletins and advisories come out often time this information is released to the public well after the fact so our goal is to get you actionable intelligence before it's too late.

We thank you all for your continued support. We recommend that if you read out blog frequently and find the information useful that you subscribe to our alerts mailing list. We will only mail you once a day or when critical information needs to be put out in a timely fashion and we include much more granular details in our mailing list that may assist you in making smarter and safer business decisions in an effective manner.

NC REN - North Carolina Research and Eduation Network - Public Proxy

Why on earth would NC REN be running a publicly accessible proxy server on their networks? This would definitely indicate either a misconfiguration or an attempt to research what Internet users would do with such a system.

Interesting to say the least...

SOURCE:
Information was researched by Maxmind as part of this statement.

BREACH: Berkeley Get's Whacked

Our OSINT monitoring is showing that a server at Berkeley has been compromised. Currently the site is reporting to be on IP 181.224.147.237 but indications show that problems started on the 19th of March. It's not a good time to be in the educational sector as sites are getting hit nearly daily.

William Farrell CPA - Cary NC

CPA leaks payroll information. Interesting thing happened today while we were reviewing faxes received by our company. We started receiving faxes from a local CPA firm containing payroll information. It could be that the CPA firm did not verify whom it was sending the information to before sending the fax and did not verify that the fax was received.

We are reaching out to the CPA firm for comment and will update this information once we receive a response.

Total Number of Records: 7 Pages
Received via: Fax Machine
Type: Inadvertent Disclosure

Update: We attempted to contact the organization via their website and guess what...

A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:

  info@williamfarrellcpapc.com
    The mail server could not deliver mail to info@williamfarrellcpapc.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.

Highmark - Related to Anthem Attack

More than 51,000 current Highmark health insurance customers in Pennsylvania will receive letters this week notifying them that their personal information may have been stolen as part of the larger Anthem Inc. data heist.

Those customers are in Highmark’s Western and Central Pennsylvania markets, 49 counties in all. “Letters are going out now,” spokesman Aaron Billger said.

What is interesting is that Highmark has been noted in Open Source feeds as having compromised systems in the past as well. This may have been part of the vectors used to gain access to Anthem and deserves a second look.

NOTICE: Phone System Outage

SLC Security will be performing upgrades to our internal telephone system on 13 March between 12:00AM and 4:00AM (CDT). During this event all calls to our 24X7 monitoring staff may experience unexpected disconnects and/or periods where technical staff may not be available.

During this time you may page us by reviewing your contract. All contracts include a paging support number where you can get an immediate call back. This service will be available without interruption during this time period.

Wow you don't say...

Previously we have reported as has DataBreaches.net on University of Chicago. I saw today where they have indicated that they have been breached by Carbonic. It goes without saying that unless these organizations take our warnings seriously they will all fall one by one.

SLC Security Services LLC is the leader in Cloud predictive analytics. We have been naming potential breach victims with a 98% success rate since last June when we started our cloud computing system.

See our previous report on University of Chicago

Health Care Audits are a Joke

It goes without saying that the Government even with their many billions of dollars on security have failed to stop the ex-filtration of highly classified material. Just look at Wikileaks and the Bradley Manning (or Chelsea to be correct now) case. While the Government performs background checks on individuals, facilities, etc. these leaks do happen. Think about how companies are being affected today. They have less money invested and the auditors that give them the all clear are not checking the very hacking vectors that are being used to steal peoples information, trade secrets and more.

It really irritates us when we see companies being breached that have hired these large security firms that only concentrate on the infrastructure, malware and viruses. You folks do realize that over85% of the time a successful attack is the result of successful social engineering or bypassing weak security features in products that are not usually checked in an audit.

While we won't give away all of our auditing steps we can tell you that the normal audit only covers about 30% of the areas that should be checked. And while you should be checking other areas before giving a certification we understand that you are there to do only one job. Keep hiring the Mandiants, the Dell SecureWorks and others (oh and by the way Dell's feed data is all out of date and inaccurate in most cases) and wonder why your companies still get breached. Your getting breached folks because your not checking the actual vectors that are being used and your not changing with the times.

Sure your employees may pickup on somebody calling them claiming to be from the help desk, or maybe they won't. And maybe your employees are using secure (truly insecure) corporate messaging products away from the office and leaving a clear way into your network (you are paying attention here right?). Have you checked to make sure what the company claims is in fact the case? Can their encryption be hijacked? I bet it can with the right knowledge and time. Stop taking these large companies at their word just because they are large companies that have been around for awhile.

Good luck folks. If you want a real audit conducted contact us. It will be extensive, concise and complete.

Despite our Warnings - Wake Health

Despite our previous warnings we are now seeing indications that Wake Health is being specifically targeted by external actors. While we have talked to them on at least one occasion by phone and several post have been made to the blog they have continued to ignore the information we have sent to them.

Today we started seeing information indicating that they are specifically being targeted. These are the same types of indicators that we noted from Anthem months before they acknowledged that they were breached. It is our belief that Wake Health will be the next entity to see similar issues.

What starts out as probes end up with infiltration and we can tell you from previous visits that Wake Health is not protecting PHI concerning patients. They have taken the same route as some other entities in ignoring our warnings and are not a client so we are helpless to help them.

Specifically we are seeing that compromised servers in Switzerland and in Russia are being used to target their employees. It will only take one slip up and they will suffer the same fate as Anthem and some of the educational institutions we have been alerting on.

Again Wake you should seriously hire us to secure your network. I am pretty sure it's probably already too late but you can't say we didn't warn you numerous times to this type of activity.

Here is what is known to date:
1. Wake Health has been leaking PHI for well over a year. The information was more than likely being used to collect information such as usernames (which we have observed as well).
2. Domains and existing malicious actors are utilizing previously compromised host to send email to Wake's employees to infect their infrastructure with targeted malware (cannot confirm but this is the same pattern we have previously observed).
3. Patient information and PHI is currently being shopped in underground markets so this is an indicator that they may have already been compromised yet they have not acknowledged (and they ignored our previous warnings).

We will update if we see any information but will only talk to Wake Health directly concerning this matter and only if under contract.

Theory: Utilizing Porn Sites to Infect and Gain Access - Gov Connection or Bad Guys?

Over the course of the last few days we have been seeing a ton of traffic being exfiltrated to 101 Ave of the America's, 10th Floor (registrations in Whois and through some other utilities in our stack). When checking these host it appears as though they are mostly porn hosting and cloud computing computers. As we researched more we started finding certificates with strange references to legitimate Government organizations.

Would these people be so stupid to use real certificates on fake sites to collect data from suspects and users. In addition these same nodes are Tor exit nodes meaning that traffic on Tor could be sniffed as it exits the network.

A little more research is needed but it appears as though some of these host are being disquised albeit poorly to look like porn sites and other web servers when in fact their true purpose is not known. One IP that is sticking out in the ordeal is 37.139.6.7. This IP is showing up in all sorts of indicators and is also being picked up by multiple sensors on the Internet as Tor, Malicious, SSH Attacking, etc, etc.

Due to the nature of businesses being attacked from this IP and a few others that we are not currently disclosing it appears as though this is a concerted effort to get into the infrastructure of some heavy industry to include Healthcare, Communications Companies as well as Intelligence providers.

We will be keeping an eye on this and will let you know if anything changes as we are monitoring for any traffic to these host and alerting our SOC to review immediately.

Defacement: We noted that cctec.cornell.edu was defaced

Our OSINT-X noted that cctec.cornell.edu was defaced by AnonSec. I'm sure this is only the begining. We have been reporting on many of these vulnerable universities for awhile now.

The message on the page stated that if Cornell would like to contact them through Twitter that they can be reached at www.twitter.com/Mrlele1337

Wall of Shame

Here's some of the latest traffic we are seeing today:

US Traffic
1. Boston University - Compromised System (Infiltrated Blacklist)
2. University of Washington - Compromised System (Infiltrated Blacklist, SLC Security Blacklist)
3. Utah State University - Compromised System (Infiltrated Blacklist, SLC Security Blacklist)
4. Yale University - Compromised System/SSH Attacks (Infiltrated Blacklist, Private Feed)

Foreign Traffic
No reports today

Analyst Notes:
We are seeing an increase in US colleges and Universities that may be related to recent hacking activities previously noted. While we have attempted to contact as many organizations as we can we have noted that many have not acknowledged the activity even though some data has been seen on Darknet and some forums.

In addition some recent Twitter activity shows that some of these hackers are posting specific information that was able to be verified. Many Universities have chosen not to report such issues.

The main attack vector at these organizations was mostly SQL injections according to the Twitter post. Specific intelligence is available by subscribing to our intelligence services. In addition we have started noting strange traffic on DNS ports specifically UDP 53 from some of these organizations.

Dyre and Upatre Evolving - Emerging Threats gets it right

We were just reading a report from Emerging Threats concerning the development and frequent changes and variations to these malware products. What this indicates is that the malware is under active development making it extremely difficult to catch all the variants.

Read the original document here.

The article was well written and very concise and on point.

Spina & Lavelle Attorneys Trying to Penetrate our Infrastructure

Either these attorneys are owned or they are probing for information. Just letting you know we see you. Have a great day!

Traffic drops on our sensors

Last night our security engineers noted some very interesting things happening with our sensors. After midnight some coordinated attacks that we have been seeing for weeks suddenly dropped off. We have not see a single attack since midnight yesterday.

This is highly unusual since we have been under sustained attacks since 2005. What this may indicate is that the organized attackers are starting to realize that by attacking our infrastructure they are denying themselves access to many other targets. You see by attacking us you allow us to send out updates to thousands of Internet users thereby protecting them from attack.

Only time will tell if this strange, eerily silence continues. Keep in mind though Mr. Attacker that we have visibility on thousands of endpoints and we will continue to protect our customers regardless on who you decide to attack. If we see it, we will block you, end of story!

Hackers Steal Up To $1 Billion From Banks

Now that's a headline that will just reach out and grab your attention. The obvious question here is why did they do it and secondly what will they be using that money for to finance. Pay attention friends things are getting very interesting these days.

Original Article

Memex Toolset Released...

DARPA has publicly presented for the first time a new set of search tools called Memex which will improve also researches into the “Deep Web”.

In 2014, the U.S. Defense Advance Research Projects Agency (DARPA) launched a the MEMEX project to design advanced search tools that could be also used to scan the deep web, which isn’t indexed by Google and other commercial search engines.

The Memex  search engine was started to allow search of not indexed content, an operation that in the majority of cases is still run manually by Intelligence Agency.

Read the Full Article Here

Obama Launches Cyberthreat Intel-Sharing Center

Long-awaited central repository for cyber threat information and intelligence created by The White House.

The concept of a federal government-led center for coordinating cyberthreat intelligence has been discussed by the Obama administration for some time, and that concept became a reality yesterday when the White House announced the formation of the Cyber Threat Intelligence Integration Center (CTIIC).

That's all fine and dandy but how do we integrate with this initiative? The last Google search we did showed NOTHING!

IMPORTANT NOTICE CONCERNING FEEDS

FOR IMMEDIATE RELEASE

Starting on 1 March 2015 SLC Security Services LLC will be moving our public indicator feeds to a paid subscription model. What this means is that if you are currently using our Indicators of Compromise you will be required to obtain and maintain a subscription and eligibility. The subscription model will be allow organizations of any size to subscribe to the service at an affordable rate and allow our company to add analyst to improve the service. We have been providing these indicators free as a public service for 3 years this coming March so it's time to improve our service offerings.

Subscription Pricing:
There are 4 levels of pricing and each level will require your organization to maintain eligibility for whatever pricing tier you are obtaining service.

Tier 1 (Non Profit - Research Tier): Free IOC's for use by not for profit organizations, associates, Government and small business users. Will require registration and a one time verification as well as a service agreement.

Tier 2 (Small End User): A nominal charge in which you will receive our SLC Security Client application license for use on up to 5 individual workstations or servers.

Tier 3 (Business Restricted Users): Business users with more than 5 individuals will be charged per user for access to our advanced indicators, SLC Security Client application (for workstations and servers), email alert service and access to formatted feeds for Fireeye, Symantec, Crowdstrike, Palo Alto Firewalls, IP Tables, Snort as well as several other platforms.

Tier 4 (Enterprise Site License): This model is designed for large corporations and entities that want to deploy and protect an unlimited number of workstations. In addition to the Tier 3 service you will also be provided with plugins and the SLC Connect middleware to allow your internal machines to mirror our IOC data, threat bulletins, blog and RSS post. You will also be granted access to our OSINT-X research platform for full text documentation. We will also provide additional services based on your contract terms to include 1 annual audit with full reporting and 16 hours of on site training to cover topics of interest with your security staff.

We will be phasing in this paid service over the next few weeks so please pay attention to our media outlet(s) and look for the subscription information.

Wall of Shame

Here's some of the latest traffic we are seeing today:

US Traffic
1. New York University -Malicious Activity
2. Princeton University - Malicious Activity
3. University of Pennsylvania - Malicious Hacking Activity
4.Carnegie Mellon University - Botnets and Compromised Systems

Foreign Traffic
1. Imagen Y Sistemas - Malicious Activity
2. Blacksun Incorporated - Malicious Activity (Canada)
3. Almighty Power Ministries (Nigeria)

Analyst Notes:
We are seeing an increase in US colleges and Universities that may be related to recent hacking activities previously noted. While we have attempted to contact as many organizations as we can we have noted that many have not acknowledged the activity even though some data has been seen on Darknet and some forums.

In addition some recent Twitter activity shows that some of these hackers are posting specific information that was able to be verified. Many Universities have chosen not to report such issues.

The main attack vector at these organizations was mostly SQL injections according to the Twitter post. Specific intelligence is available by subscribing to our intelligence services.

NEWS ROUNDUP 2/10/2015

Twitter Request from the NSA top 1.9 Million Account Request
UPI posted a story today on the 190 million users on twitter stating that the NSA has requested the information on less than 1% of Twitter users. So that means they have received information on 1.9 million Twitter accounts. That's a little different than stating 1% huh?

Read the original article here. 

American hostage Mueller's death confirmed by Obama, family

 

US to unveil new Cyber Security Agency
The U.S. government is creating a cybersecurity agency that will monitor and share information about threats against the government and private businesses in the wake of high-profile cyberattacks at Sony Pictures, Anthem Inc. and several major retailers.

NCTC director who is now executive vice president at Leidos, a national security contractor.

CyberCaliphate at it again
The Twitter feeds of Newsweek and veterans' group Military Spouses of Strength were hacked Tuesday morning by a group identifying itself as CyberCaliphate, the same organization that was confirmed to have hacked the twitter account for U.S. Central Command earlier this year.

Anthem Breach Prompts New York To Conduct Cybersecurity Reviews

Meanwhile, Anthem victims are now being harassed by scammers trying to collect even more personal information.  

CFAA may stall cyber security research unless Government exempts security researchers

All of this at a time when we need to share information more than ever.

In the wake of news-making attacks on Sony Pictures, Home Depot and many others, the federal government is establishing a new information integration center to focus on cyber threats. The center will analyze intelligence contributed by several agencies, along with the private sector, a model that will face some serious hurdles.
The proposed Cyber Threat Intelligence Integration Center will fall under the Office of the Director of National Intelligence and it will not be responsible for actually gathering any threat intelligence. Rather, it will serve as an aggregation point for information collected by intelligence agencies and, the Obama administration hopes, private companies.

Note
Please tell me on one hand you are looking to share information and the other hand you are increasing the penalties without excluding research and development? Doesn't make sense to our team.

Delay in actionable intelligence creating additional risk, additional malware seen

With the recent Anthem incident it goes without saying that organizations need to share information to protect other entities from similar attacks. In the case of Anthem the information has been shared with only 2 organizations and the information being put out by commercial vendors is incomplete and in some cases completely inaccurate. What we are seeing is that many people are making guesses as to what the actual threat is.

It seems like this recent issue and with the Sony issue that in both cases the information coming out of the analysis of these events is being withheld from commercial security vendors. This does nothing to protect others that may face similar attacks. It should be noted however that the attackers in this case have moved on to other attacks.

This is a concerted effort to infiltrate many businesses and Government. As of yet we have not seen any real and meaningful cooperation between Anthem, Sony or the Government. If they really wanted to protect the masses clear and concise information would be put out for everyone.

This leads me to believe that nobody really knows the exact methods. I can tell you that there are zero day attacks being used as well as a known browser flaw that is not being fixed by vendors. If hackers know about it and vendors choose to ignore it there is really nothing the average person can do to protect themselves from the threats that loom.

I have predicted that the educational space will be the next to have issue based on what we have seen. Because of this we will offer educational institutions access to our blocklist in the hope that some will be proactive and save themselves some embarrassment. There have been several attackers on Twitter posting educational information and much of the stolen information is available on Darknet and being shared between hackers.

This open sharing initiative that everybody speaks of is non existent and probably will not come to pass. It's a shame really as there are power in numbers. We need a distributed protection system that can incorporate actual information between vendors in near real time. Until this happens we will continue to see disinformation. In addition the naming conventions between commercial products is horrible and confusing and interoperability between companies is horrible as well.

The additional malware being seen that is NOT being tracked by any of the major vendors was previously posted.

Indicator Information

IP Addresses Involved:
196.203.89.134
194.105.9.85
82.81.128.61
50.56.56.125

Also it goes without saying that certain file extensions should be dropped by your email gateways.

NEWS ROUNDUP 2/9/2015

Hard to Tackle Malware being used in University Breaches:
Many security professionals including our company have been warning Universities to activity that indicate a large scale problem on their networks. Many of the Universities have chosen to ignore the issue. Earlier today at one of our client sites we saw for the first time a malware that was running completely in memory and that is not detected by any of the major anti-virus products. The malware is currently being studied but it appears to be related to earlier reports of activity that we have been picking up on our sensors. We believe that the malware probably will be used to perform farther damage in the future. We have submitted the memory dump to several anti-virus vendors and are awaiting additional details.

Company's Doing one of Two Things:
Either companies that we are notifying are acknowledging issues or they are quietly cleaning their issues. We noted several of the Universities originally on our University post that have since dropped off our sensors so that's good in that they are no longer infected. The bad part is that they may not know what information has been stolen or damaged on their respective networks. So companies or entities are either acknowledging they are in over their heads or covering it up completely.

FBI Online Agent Screenlocker

We have been seeing a ton of screen lockers lately. Just today one of our customer calls and states that they believe the FBI has locked out a machine. Upon inspection of course it's just a run of the mill screen locker claiming to be the FBI. I can tell you that the FBI would not tell you to go and get a moneypak to pay for unlocking your machine. In fact the FBI would just come and get the machine to perform forensics and be done with it.

When you see this message it is NOT the FBI. :-) Read r0cket's malware blog to learn how to remove the infection.

Interesting Routing Anamalies on the Internet

We are currently researching some really interesting routing anomalies on the Internet. It seems that not only is the Great Firewall of China doing some really interesting things to Chinese users but some really strange routing is taking place on the US east cost the past few days.

Could be coincidence but we don't think so. Funny how some of these sites are doing redirects to phishing sites as well. Tell me again why we allow China to have root servers again?!

And that's only half of it.

Connecting the Dots... One breach at a time...

Take our big data analytics training and learn how to make sense of data in your enterprise. Learn how to connect the dots, build out your own OSINT intelligence mapping system, link analysis and lots more. Classes are being scheduled for the summer and customized training is available...

Analytics in action...

Private training available at your location or ours... Learn how to make sense of the data in your enterprise and beyond!

Collaboration in the Works

We wanted to let the readers know that we are working on a collaboration with several security providers to provide our intelligence products to help improve situational awareness against threats to infrastructure. We are currently working on integrating our data sources into several open source and commercial products to help make the security landscape of individual computer users (home users), business users (corporate users) and Government entities. 

Stay tuned in the coming weeks as new service offerings are provided to existing commercial products and open source software and hardware products. Here are some of the things we are working on in the lab. 

• Threat Feeds to Commercial Products - We will provide a list of products soon
• Threat Feeds to Open Source - Integration with Snort and Linux based systems as well as the release of our SLC Security Platform for Windows machines (coming spring 2015)
• Bulletin Service where we send out flash alerts directly to customers via the security platforms that we manage to include our OSINT-X platform and OSINT-X security appliance
• Open integration of our products (build a solution with our data)
• Security alert mailing list (Active now - You can subscribe from our website and blogs)

There will be much more coming so stay tuned.... And have a great weekend. 

NEWS ROUNDUP 2/6/2015

Frederick High School and West Frederick Middle School in Maryland were closed February 5 following a February 4 shooting outside the high school gymnasium during a basketball game that left 2 students injured. 


Former Inland Empire insurance agent pleads guilty to federal bank fraud and tax charges in scheme that netted nearly $6 million.


Flash Player 16.0.0.305 patches zero-day vulnerability.


Kovter trojan distributed via malvertising on Huffington Post.


Phone service restored in Forest Grove area after outage affects more than 1,200 customers. Phone service was restored to areas of Washington County after an outage that was reported by Frontier Communications February 4 kept customers in the areas of Gales Creek, Glenwood, and Tanner Creek from using a landline to call 9-1-1   

May just wanna disable flash until this situation becomes stable... Wait it's flash... Ugggghh

For the third time in two weeks, Adobe has issued an emergency security update for its Flash Player software to fix a dangerous zero-day vulnerability that hackers already are exploiting to launch drive-by download attacks.

Seriously consider disabling this until Adobe get's their issues resolved... You may be waiting awhile with this one.

IOC's for Digestion

Traffic to or from:
196.203.89.134
194.105.9.85


 

Our Information on Anthem - Q&A

See our official post here.

How we monitor for problems and detect issues before the attack...

Utilizing our cloud based computing platform we are able to see attack information as it happens in real time. We are able to monitor Dark Net, Usenet and OSINT sources for relevant information concerning the activity of hackers and cyber criminals. We have been warning companies and advising them on what to look for but they don't seem to take our warnings seriously. And months later we read about issues in the news once they finally figure out that we were right in the first place.

It has happened numerous times in the past and will happen in the future unless these entities take our alerts seriously. Companies are too busy looking at their perimeter's to really get an understanding of what is really taking place. All too often the information is available to indicate a problem because once a site is breached typically other attacks are launched from that same infrastructure to other organizations. Using link analysis between companies and attacks that are being reported is a smart way to connect the dots folks. These technologies exist for a reason and as systems evolve they get better and better at predictive analysis based on past activity.

We sincerely hope you start putting the pieces together because the time of breach until there are actual notifications are usually around 12 months out. Anthem just caught the problem in 4 months but that means that they are better than average at detecting the problem but not stopping it.

If any of these companies took their security seriously they would consider utilizing big data to highlight problems before they are nightmares for the companies involved.

Quite honestly our team of volunteers are extremely good at detecting issues but we simply do not have the resources to do our analysis on a large scale. If we had the funding and additional resources we could certainly assist with these investigations but as of now we will continue to do large data analysis and warn the companies that we note as having problems in the hope that at some point a company will notice that we are way ahead of the "average" and help us get to a place where we can really be effective and assist law enforcement in containing these issues and actually finding the entities responsible for these data breaches. Until that happens we will continue to research, blog and watch from the sidelines.

If the Government were to really fund the cyber security initiatives and get private industry to bring technologies that work to market we could be a much bigger help in these cases but until that happens we will sit back and watch.

It's a shame really.

So here's what we suggest to help prevent these large breaches in the future. Stop withholding data when it comes to cyber security. Provide a clearinghouse where we can report issues and use the indicators of compromise that we have developed. I'm sorry but 95% of the technologies in use are reactive. You need analytics that can find trends and identify suspicious activity over the entire Internet connected infrastructure.

Until we have a view of the entire Internet we are confined to our own little LAN connected world and chances are somebody has already infiltrated your infrastructure. If you want to wait 12 months while they steal your data be my guest or hire us to come in a get rid of the badness and save yourselves some major embarrassment.

Later this week we will for the first time every compile a list of all of the organizations that we are more than 80% confident that have issues that need to be addressed. Our system is reporting on real world attacks and since we report on these attacks we are a major target. One good thing about being a target is that it forces attackers to show their infrastructure that they are using to attack us (and many others). Using this data we can quite quickly build out a clear picture of bad activity being directed at us and others.

Have a great week and we look forward to working with the ones that value their security posture.

BREACH: Anthem breach is the mother of all Healthcare Data Breaches!

We knew ahead of time but waited until the CEO of Anthem made a public statement. The Anthem breach will prove to be one of the biggest breaches in Healthcare history. The breach is being investigated by the FBI and several large new organizations leaked information on the breach prior to an official announcement earlier today.

We will make this a sticky post and follow the developments.

2/4/2015: Official Notification Came Out Today but was proceeded by news media leaks of details.
2/4/2015: WSJ appears to have been the first news media organization to break the story.
2/5/2015: DataBreaches also posted information they have compiled here.
2/5/2015: Major News continues to report on the issue.
2/5/2015: LA Times reporting really specific information on the case.

From the LA Times:
Suspicious activity was first noticed and reported Jan. 27. Two days later, an internal investigation verified that the company was a victim of a cyber attack, the company said. The unauthorized access to the vast database goes back to Dec. 10.

Cybersecurity analysts warned that the thieves may attack Anthem again using the employee data they took. Anthem said it’s working to strengthen security and identify any potential gaps.

“It is highly possible that they are preparing for another attack, such as a social engineering or phishing attack, that may give them access to systems that they were unable to reach,” said Tom DeSot, chief information officer of cybersecurity firm Digital Defense Inc. in San Antonio.


Previously Reported:
Anthem Blue Cross Data Breach (Nov 2014) - Our Previous Report

From Krebs:
Bloomberg reports that U.S. federal investigators probing the theft of 80 million Social Security records and other sensitive data from insurance giant Anthem Inc. are pointing the finger at state-sponsored hackers from China. Although unconfirmed, that suspicion would explain a confidential alert the FBI circulated last week warning that Chinese hackers were targeting personally identifiable information from U.S. commercial and government networks.

BREACH: capdm.ca Breached - Updated

See http://pastebin.com/9Lu68fMi to see if your account is compromised.

2/3/2015: Reached out to the organization to get additional detail.

2/3/2015: Received the following response.

We are actively investigating and will follow-up shortly.  Please feel free to contact me directly should you have further requests for information.

2/3/2015: Additional intelligence being collected on this incident from third parties. Our network security operations center is collecting relevant claims and information from Darknet and third party data providers. Noted additional detail. If calling in to obtain information reference INC2015-005. 

Type: Healthcare

Area: Disclosure 

First Noted: 12 Dec 2014

Location: Canada

Total Records: 1500+ and data on Darknet

Status: Not Monitoring for Follow Up (Not a client of SLC Security Services LLC) 

Krebs Post about Physical Attack

Yeah hackers are changing their tactics. Like I said last week while everybody is concentrating on the network hackers are actively using hardware and physical attacks. Read my original post here.

If you want a firm that can actually find problems and not just give you a false sense of security contact our SOC by email to schedule a no obligation audit. If we don't find problems you don't pay...

Kreb's story can be read here. 

We have seen everything you can imagine over the last 25 years. Cell phones are still one of the biggest threats as they are cheap, can be untraceable and have long battery lives but attacking corporations is even easier since they rely on old technologies that are not even checked during most audits. Our audits are complete and concise and when you companies realize that we can actually give you piece of mind instead of just talking about it give us a call and let us prove to you that security is our main business.

ATTACKER: The Preston Law Firm of Houston Texas

Hey guys you may want to check out your systems because we have been seeing attacks from you all day. As some of you know that fact that we report on breaches in advance of some people really causes them to get angry. Either this law firm is owned by hackers or they have hired hackers to try and infiltrate our infrastructure.

It started out as simple SMTP probes but we are starting to see web server probes. We hope you like playing with our honeypot systems because that's what your hitting folks.

Next time please try and do your homework before blatantly just attacking what you think is our infrastructure. Thanks and have a great day.

Maybe you didn't like us reporting on the Texas A&M activity or some other such nonsense but this is a free country, we have data to back up our claims so if you want to play this game please by all means let's do this...

I would love to be able to put out all of the information we have and then charge you for your resource usage today since it was so extensive and you achieved absolutely NOTHING!

Pay Attention on Friday

I bet something big hits at the end of the day on Friday!

ATTACKS: Harvard, MIT and Others

We have noted an uptick in the number of brute force and email probes from MIT and Harvard. In addition we have noted that Boston University, Hampshire College and Harvard are all on our blocklist due to malicious activity. MIT is involved with cyber security and has partnerships with the Government for research so this may explain why we are seeing an uptick on our sensors and reported attempts to compromise email accounts.

DISCLOSURE: UMass Memorial Medical Group

The UMass Memorial Medical Group is working with law-enforcement personnel after it learned a former employee allegedly accessed private patient billing information that contained credit-card and debit-card numbers, Social Security numbers, and birth dates, according to hospital personnel.
Anthony Berry, the director of media and public relations for UMass, said the group is continuing to work with law enforcement, but there is "nothing concrete" to report yet.

Read more: http://www.lowellsun.com/todaysheadlines/ci_27447491/scope-data-breach-unknown#ixzz3Qkube1ms

Analyst Research: We have checked our OSINT-X system and have not seen any traffic from UMass on our sensor network. This may indicate that the issue was localized. If we note any activity we will update the blog with additional information. 

D-Link Router Vulnerability - CONFIRMED

D-Link’s popular DSL2740R wireless router is vulnerable to domain name system (DNS) hijacking exploits that requiring no authentication to access its administrative interface.

According to Todor Donev of the Belgian security firm Ethical Hacker, a number of other D-Link routers are affected by this bug as well, particularly the DLS-320B. PCWorld is reporting that the vulnerability exists in a widely deployed piece of router firmware called ZynOS, which is developed by ZuXEL Communications Corporation.

The troubling part of this issue is that it appears as though this and a few other bugs are allowing law enforcement to monitor the activities of individuals utilizing this hardware. We previously reported on similar vulnerabilities with Linksys hardware that allows similar interception without the end user being aware and allows Cisco to monitor customer usage of devices. For this reason we do not allow Cisco or Linksys hardware in our secured networking environment.

BREACHED: Texas A&M University

Seeing indicators that this entity has been breached for over a month and does not realize it. It appears as though their infrastructure is being used to launch farther attacks on other educational institutions.

They also appear on Emerging Threats for malicious activity since at lease the 11th of December, 2014. You would think these large organizations would do something to get themselves off the blacklist but as of today we are still detecting malicious activity.

Update: Our sensors are still seeing traffic originating from Texax A&M and they still have not closed off the vulnerable systems. Seeing additional reports from additional locations that they are being attacked by this entity. Over 200+ external IP's are reporting attempted breaches and brute forces from the Texas A&M network. 

Hardware Hacking and Physical Attacks Largely Being Ignored

One of the recurring issues that we are seeing on audits are the lack of knowledge on physical attacks to infrastructure. Most of the companies we are working with do not check physical path of network connections as well as security systems. We have seen many companies that are either ignoring physical attacks or they feel as though they are not important. It should be noted that while your watching your network, attackers are building hardware, buying hardware and exploiting things such as your camera's, network security appliances, security systems, networks and communications systems such as telephone and hard wired infrastructure.

Find out today if hackers and bypass your defenses.  Email SLC Security Services LLC SOC and ask for a free no obligation security audit. The findings are confidential. Let us show you why our audits are the best in the industry.

University of Chicago Still Leaking Information and Vulnerable

During a recent review of some incidents being covered by databreaches.net I was able to do some additional research and confirm that even as recent as an hour ago that information is still being offered in the underground community. In addition server IP addresses owned by the organization are attacking other colleges and universities in the US and elsewhere.

In Addition:
The following organizations are also compromised.

Illinois Institute of Technology
Northwestern University

TECHNOLOGY WATCH: British Government to Receive US Company Technologies

The British government has selected Northrop Grumman to provide it with engineering, development and other cyber-security solutions services. 

Solutions under the seven-year framework contract, which was competitively awarded, will specifically support data security and information assurance. 

"As a long-standing partner with the U.K. government, we are proud to have been selected to support the security of their digital domain and the protection of its citizens," said Kathy Warden, corporate vice president and president, Northrop Grumman Information Systems. "With more than 30 years of cyber-security expertise that has been developed and deployed around the world, we look forward to continuing our work with some of the brightest industry and academic minds to deliver world class operational performance, scaled to the mission, and to increase our U.K.-based workforce that will support cyber innovators of the future." 

It should also be noted that other companies were also involved in the bidding and have been awarded contracts but Northrop Grumman is the only company to publicly acknowledge the contract award.

Malware: tinba is gonna be the end of Suntrust, Regions Bank and a few others... wait for it! (Dyre Banking Trojan) - Updated

If your monitoring infections and malware traffic it goes without saying that banking targets are high on the priority watch list. I'm making this prediction based on intelligence that we are seeing in the SOC. Let's see how this plays out.

My prediction is that the following banks are gonna get nailed by tinba:

1.Suntrust

2. Regions Bank

3. Credit One Bank

4. Netteller

5. TD Bank

6. JP Morgan Chase

7. PNC Bank

8. RBC Bank

Since this campaign is targeting customers there is little that the banks can do to stop it. Most of the issue is being caused by anonymous proxies and some very interesting MITM traffic.

Private Security Companies more of a threat than Government Snooping

You may think that the Governments warrantless wiretapping and surveillance programs are troubling but private companies and operators are more of a threat than even the Government. Think about it this way. When Government wants to do long term surveillance they are supposed to follow CALEA and FISA rules to conduct the surveillance and they are supposed to terminate that surveillance if the collected data exonerates the targets of that investigation. At least some of the time judges and secret courts place restrictions on the surveillance authorizing the surveillance for a certain period of time.

It should also be noted that nearly all of the request that go to the FISA court are approved. Sometimes even without a very good justification. But private operators are even more dangerous than the Government because they don't have to follow any legal rules.

Just look at rules on electronic interception that fall under 18 USC as one example. There were no prosecutions under these rules last year or the year before that. Even when there are prosecutions they usually are for associated crimes and not the interception itself.

So the next time you think that the Government is your biggest threat you should really think again. The private operators collect, store and share information about targets more easily and with virtually no oversight.

NOTICE: Patch your Linux Servers

As you may have read in the media recently, a new zero-day security vulnerability for a common component in the Linux operating system has been released into the wild. This vulnerability allows attackers to remotely access some vulnerable Linux-based systems without the use of compromised passwords or other user credentials. Once in the system, attackers could leverage other vulnerabilities to escalate privileges until they gain root access. A good article that describes the vulnerability can be found here:

http://www.zdnet.com/article/critical-linux-security-hole-found/

We recommend that you immediately patch your operating system with the appropriate latest version. At the time of sending this e-mail (approximately at 7pm Central time on Tuesday, Jan. 27), the following Linux distributions have issued patches:

·      Red Hat
·      Debian
·      Ubuntu

Other popular distributions, such as CentOS, have indicated publicly that patches are in the works.

Since the vulnerable library is very common and is used by a wide range of server-side software, applying the patch is not without risk of collateral damage or side effects. In other words, there is some risk that patching your system might impact the performance of other applications on your server that also use the same library.

Nonetheless, taking into account the severity of the security hole, we are advising our clients to apply the patch immediately upon it becoming available to them. The risk of not patching outweighs the potential risk from side effects.

We strongly recommend that you patch your servers immediately with the appropriate patch.

If you are running Red Hat Enterprise Linux or CentOS, you may execute the following command on your server to patch:

CentOS/Red Hat Linux: yum -y update glibc
Ubuntu/Debian Linux: apt-get upgrade glibc

Please note that patching your system WILL require a restart after you execute the above commands.

ALERT: Whale Phishing Alert

The FBI and Internet Crime Complaint Center warns of a very profitable spam campaign that has already claimed more than 2,000 victims globally.
The FBI and the Internet Crime Complaint Center (IC3) are warning of a spam email campaign known as the Business E-mail Compromise (BEC) that has resulted in the global victim dollar loss of $215 million so far.

The IC3 alert, which was issued on Jan. 22, provides statistics on the impact of the BEC campaign for the period of Oct. 1, 2013, to Dec. 1, 2014. During that period, the IC3 received complaints about BEC from 45 countries, with a combined victim count of 2,126. In the United States alone, the IC3 said there were 1,198 victims.

Read More from the Original Report:
http://www.eweek.com/security/spam-campaign-business-e-mail-compromise-pilfers-215-million.html

Activity: Confirmed
Number of Confirmed Cases Reported: 3

The FBI and Internet Crime Complaint Center warns of a very profitable spam campaign that has already claimed more than 2,000 victims globally.

The FBI and the Internet Crime Complaint Center (IC3) are warning of a spam email campaign known as the Business E-mail Compromise (BEC) that has resulted in the global victim dollar loss of $215 million so far. The IC3 alert, which was issued on Jan. 22, provides statistics on the impact of the BEC campaign for the period of Oct. 1, 2013, to Dec. 1, 2014. During that period, the IC3 received complaints about BEC from 45 countries, with a combined victim count of 2,126. In the United States alone, the IC3 said there were 1,198 victims. - See more at: http://www.eweek.com/security/spam-campaign-business-e-mail-compromise-pilfers-215-million.html#sthash.DRlL878Z.dpuf

Drones Being Used to Smuggle Drugs Over the Border

It goes without saying that Drones provide a unique way to take photographs, explore hard to reach areas and in this case to smuggle drugs across the US/Mexico border. Border Patrol has indicated that they are seeing increased instances of the use of drones to carry packages of drugs from Mexico into the US. There have been 3 separate news articles in the past week on the topic as well as some discussion in Government circles on how to combat the problem.

Drones have been used to smuggle phones, tobacco, drugs and weapons into prison courtyards in the past and are frequently used to carry out wireless attacks by moving devices into target areas for interception purposes.

The FAA has begun issuing licenses to licensed pilots to be allowed to operate drones for hire (highly restricted). It is thought that the rules on drone use will be relaxed at some point in 2015.

We are following this topic with interest.

ALERT: RSA Public Key has a backdoor

We are seeing indications that the RSA public key is compromised and has a backdoor. Several security researchers have confirmed through actual data that the key's are compromised but they have not indicated the responsible party.

Dell SecureWorks put out an alerts as did several bloggers over the past 2 weeks.

ALERT: Barclay Card Service Phishing and Possible Customer Accounts Compromised

We are researching this information currently and are in the process of putting out a bulletin from our SOC. It is thought that the uptick in "targetted" Phishing attacks over the last 12 hours may be related to a compromise of account information at Barclay Card Services.

We will be putting out a bulletin later this evening. Please ensure that if you receive messages from Barclays that you actually verify the information in the email and that it goes back to an actual Barclays domain and not a third party.

Related Compromised Host:
NTT America Inc
GWTC - Golden West Telecommunications (more than likely a compromised customer)
Time Warner Cable South (more than likely a compromised customer)
KRM Information Services
Dwyer Products (a customer of Comcast Business Communications)

List of Compromised Host:
69.70.172.150
70.61.114.98
195.101.177.120
209.57.92.144
64.251.170.197
12.27.45.130
74.94.124.215

So tired of seeing this Starbucks

Hey Starbucks are you just asking for a breach? 

Not that I want to give criminals any ideas but Starbucks and Waffle House need to get their acts together and fix this ASAP.

Hackers for Hire Getting Publicity

I was quite surprised the NY Times published a recent article on "Hackers for Hire".

The website in case you were curious is at http://neighborhoodhacker.com/

There are many other sites as well but this is the one getting publicity right now.

NEWS: NY Post Twitter Hacked

The New York Post on Friday said that one of its Twitter feeds focused on business news had been hacked, following a series of inaccurate Tweets on the Federal Reserve, Bank of America and military engagement with China.

"Our Twitter feed has been hacked," the newspaper said on its "@NYPostBiz" account.

Upcoming Maintenance 1/17/2015 00:00-02:00

We will be performing maintenance on our feeds during the timeframe indicated. While we do not expect any outages we will not be able to post updates to our blacklist or hosted content during this timeframe.

After this maintenance our feeds will no longer be available to the public. Only subscribers or appliance users will be able to pull updates. We have already distributed our certificates to the appliances and have been testing the certs for 7 days.

Any site that does not get the update at 3AM EST on 1/17/2015 will be updated via a non public feed.

If you have any questions please contact your account representative.

This potential for outage will NOT affect the blog or our web presence only paid subscription users and public users of our data.

BREACH: Safeway Improper Disposal Cost Them $10 Million

Source: http://www.healthcareinfosecurity.com/hefty-fine-in-improper-disposal-case-a-7797

ThreatStream Picking Up our Feeds - Feeds Will Be Changing to Customer Only Certs Soon!

If your a ThreatStream customer and would like our indicators make sure you opt in the control panel. Check out our accuracy and you will see that we are good at what we do.

In addition we have many new products and services for 2015. Our company is leading the way in the intelligence space. Some much larger security firms are snagging our data and reselling it. For this reason we are about to change to a certificate based authentication mechanism so we can get compensated for the long hours we put into keeping you safe.

Hey Security Personnel - There's more to wireless than 802.11

I am amazed at how many of these breaches and attacks are taking place over WIFI and even more surprised at how many are taking place over other wireless services such as bluetooth, personal devices such as tablets and cell phones and other attacks to include paging, microwave P2P links, etc.

During root cause analysis of several attacks this week we have noted that the attack vector ended up not being the network or workstation. The attack vector recently has been through a variety of wireless hacks yet of the 122 entities we polled this week only 5 have a program in place to actively check for attacks via wireless, only 1 had a TSCM plan in place for the corporation. This is ALARMING!

I can't for the life of me believe that you can rest assured at night knowing that hackers can hack your cameras, security systems, cell phones, etc, etc.

I issue this challenge to ANY company. Call us for an audit. If we don't break in you don't pay. If we compromise your network you pay our normal consulting rate. We are trying to help you but if you don't want the help you can rest assured that hackers will penetrate your defenses. Just not the way you were expecting them to get in.

News Indicator Feeds, Service Plans and Security Appliance Package

SLC Security Services LLC has expanded our SOC offerings. We are offering 2 levels of service with our Intel feeds. The first is our bring your own hardware (firewall, IDS, etc). If your device can pull in a CSV feed. XML feed or STIX format feed you can subscribe to hourly updates for your own devices. We are offering a security feed site license and access to our Intelligence product all for a flat fee. Pricing starts at $99.00 per site per year and depends on the amount of traffic your site will be generating.

Our second offering is our Security Gateway Appliance. The Gateway appliance is suitable for small to medium enterprises and provides a firewall, IDS/IPS as well as our Intelligence gateway in which you can keep track of things such as reputation, external threats, news and other information without exposing your network to bad content hosted on third party web servers. Pricing starts at $1995 if you use your own hardware or $2995 for a 1U security device. If your an ISP find out how you can get the system without charge.

For more information visit http://www.slcsecurity.com/ or call us at (919)441-7353.

OUR OPINION: National Breach Notification Standard

We have been reading articles and watching interviews concerning a national breach notification standard and several people in our office and clients have stated some things that really have us thinking about this proposal.

Part of the proposal states that Americans have a right to know what information is being collected about them and how it is being used. This is interesting with the recent things that have come to light out of the Snowden debacle. In fact if that's the case I would think that the Government should play by the same rules that they are dishing out on the Corporate world.

Of course we all know they will exempt themselves from having to meet the same guidelines.

One other interesting aspect is that it will give businesses 30 days to disclose if information has been lost or stolen. Well that's fine but what about the businesses that never acknowledge having had a breach and the security researchers that have the information and are afraid to release it for fear of reprisal?

We get submissions every single day and while we cannot validate each and every one some businesses do the right thing and deal with the notifications and take care of their customers, but many don't. Many of the organizations including colleges and universities simply ignore it because they know we can't release their information. It's a catch 22 that the Government and laws are not keeping up with. They should have a program (within the Government) where these submissions can be presented without threat of legal action from the affected party. This would eliminate the general liabilities of security researchers that are privy to more information than even the Government.

Thought our comments are greatly appreciated on this topic!

WARNING:GoGo Inflight Internet Interception

We have been seeing reports of invalid SSL certificates, Malware infections and other problems with GoGo Inflight Internet service. In fact we have had multiple independent reports come in as recent as this evening of strange activities on the network (we have screenshots and data) that indicate information is being recorded by the system utilized to provide Internet to passengers.

Just be warned and don't assume that because your using a VPN over the service that your communications are secure especially if you are utilizing an SSL VPN product. In fact some SSL vpn's won't even connect at all.

INTEL: Paris suspect in terror plot update (TERROR SUSPECT Hayat Boumeddiene) via OSINT-X (UPDATED)

The remaining subject wanted in connection with the terror attacks is back in Syria. Information shows that the subject was able to move through Turkey and is now confirmed to be in Syria.

It is believed the subject entered Turkey on 2 January, 2015.

Subject is believed to have been in the city of Sanliurfa in Turkey and has since returned to Syria.

Our sources are saying Turkey is not providing information because they cannot confirm it. The last confirmed report is that on 2 January 2015 the subject was known to be in Sanliurfa.

INTEL//OS//TIP


UPDATE: 1/12/2015:
The information noted is being heavily reported on mainstream media today. It appears as though the previous intelligence gathered through OSINT-X is being confirmed by all of the news accounts.

UPDATED: SA - Terrorist Security Alert France

FOR IMMEDIATE RELEASE

A gun assault on the Paris offices of satirical magazine Charlie Hebdo Wednesday was the deadliest terrorist attack in France's recent history. Some other terror attacks in Western Europe:

SECTOR REPORTS:
National Security: Heightened Alert Status but No Changes to Security Posture at Embassies
Homeland Security: Actively Assisting
Corporate Security: No Impact

POSSIBLE RELATED INTEL:
ISIS Video Released over the past few days possible trigger for attack

Noted Alerts to France prior to attack after first incident earlier in the week

A previous attack in Tours, France Bertrand Nzohabonayo, had used an ISIS propaganda image as his Facebook profile picture.

The very next day, a driver, also shouting “Allahu Akbar,” slammed into a crowd of 13 pedestrians in Dijon, injuring 11. Police say the former psychiatric patient, who was most likely drunk, will probably face terrorism charges.

This Monday, a second driver, with a similar history of mental illness, drove his car into 10 people in holiday market in Nantes, killing one. Both police and eyewitnesses say the suspect appeared “unbalanced” after the attack while repeatedly stabbed himself and muttered things about protecting children in Chechnya and working to free the people of Palestine.

Finally, that same evening, a bullet smashed through a window at Paris synagogue. No one was injured.

What no one has reported, however, is that only hours before the first attack in this timeline, ISIS released a new video calling for all Muslims in France unable to immigrate and join its campaigns in Syria and Iraq to pick up arms and attack local citizens, “where they stand and in their homes.”

12 Confirmed Dead with 8 Injured (critical injuries).

Previous news indicating France has disrupted a terrorist plot have been removed but are still available for review in OSINT-X.

Total Records Associated in OSINT-X: 366 Confirmed, 19 Pending, 3 Alerts

1/8/2014:
Lots of police activity in French Villages
Shots fired at Mosque
Percussion Grenades deployed at Mosque
Police Woman killed in France
French tells U.S. suspect trained with Al Qaeda
Suspects confirmed on US Watch List
Magazine states they will publish 1 million copies of next issue
U.S. and French cooperating with intelligence details
Private Company data being tapped to assist in the investigation

1/9/2014:
Search Helicopter spots the 2 suspects in the terror attack.
Terrorist still wearing black clothing when spotted from the air. 
Weather turns bad for search. The search continues on the ground and the air.
Hostages taken at printing company and supermarket in France, 4 suspects, unknown hostages
Blast, Gunshots at both France hostage sites
Woman and Man associated with Policewoman shooting earlier in the week, hostages at supermarket
2 Brothers, killed at site of hostage taking - Confirmed by Mayor
3 Terrorist Killed, Female Terrorist being pursued at this time
FBI issues alert in US on possible terrorist attacks

Analyst have downgraded this alert. 

ACO Congress is currently undergoing Maintenance. Check back soon.

A notice was posted to the ACO Congress that the site is currently down and undergoing maintenance. SLC Security Services LLC is NOT involved with the investigation of this entity.

A historical look shows that this system may have had issue far earlier than originally thought as some information points to May as the original time frame of the attack - Unconfirmed

UPDATED WITH REFERENCES: Black Boxes being heavily utilized in ATM fraud attacks

We have several confirmed reports of recent arrest and the increase in the use of black box ATM machine hacks. There have been confirmed reports out of Russia and in the recent case of Thomas Gilbert (according to MSNBC). Many police departments are operating on memorandum that shows pictures of what the devices look like and some reports are coming in to Investigators that these devices are increasingly showing up as a result of criminal search warrants often times for unrelated issues.

It is believed that the same group responsible for the Home Depot breaches may in fact be related to the increase in the number of these devices being discovered.

 

In the photo above you can clearly see the serial interface utilized to conduct this attack.

Additional information will be released to members of our OSINT-X service. 

NOTHING FOLLOWS 

Related and Updated Information:

Cash machines pay out after USB module gets a call from a Galaxy S4 (Originally Reported by Krebs)

Location: UK
Carders have jackpotted an ATM by inserting a circuit board into the USB ports of an ATM, tricking it into spitting out cash.

The technique was thought to have emulated the cash dispenser of the ATM so the brains of the machine thought everything was normal, buying additional time for the brazen crooks to make off with the cash.

Additional reference material (Pic Above)

Additional Details and Reports:

NCR puts out notice to customers alerting them to be vigilant with this issue 1/6/2015 - This appears to be what alerted Krebs to the issue that he initially reported on

NCR reports black boxing being heavily utilized by criminals in Mexico 1/8/2015

SLC Security obtains independent report of organized criminal activity related in UK, Mexico and Canada via our clients and financial service partners of issues related to black boxing 1/8/2015

SLC Security noted Twitter activity of bragging of successful attacks 1/8/2015 - It is believed that plans and code are being sold to build boxing devices.

BREACH: www.acocongressportal.com

We have indications that this server was hacked earlier today. In addition to post showing up on popular sites for dumps we are also seeing indications of additional stolen information on other sites.

No attackers have claimed responsibility for this attack yet.

Pastebin Being Used to Launch Attacks

We are seeing code as well as commands being stored on pastebin with specific keywords and content strings used to launch denial of service and exploits. Sucuri has been researching this and we started seeing this type of activity this morning at a few sites. 

SLC Security Services LLC utilizes customer premise equipment to collect information and attack history data from clients and from Internet Service Providers that participate in our network intelligence program.

OSINT-X Service Impact

Due to the ongoing feed activity as a result of the terror attacks in Paris our OSINT-X system is under heavy load today. What this means for customers is that feeds may be delayed up to 2 hours for updates as we add additional capacity today.

Our system is being accessed at record levels today and searches are taking up to 3 minutes to complete.

XML and RSS services that feed external sources will continue to operate in real time but our web based interfaces are slower to respond. We will update this post once the load returns to a normal level.

UPDATE: We have resolved the slow query times. We have re-indexed the data and now results are coming in line with what responses we normally expect.  Updates are now set to real-time from news feeds and 10 minute updates on all other content.

Best Statement We Have Seen All Year

"Many companies are so focused on the perimeter that they have little idea what's going on inside the network."

BREACH UPDATE: Chick-Fil-A Inc

Popular fast-food chain Chick-Fil-A Inc. is investigating a payment card data breach affecting an unknown number of its U.S. locations, but early indications suggest many thousands of customer accounts may have been compromised.

First reported Tuesday evening by Krebs on Security, the Chick-Fil-A data breach may date back to December 2013.

DISCLOSURE: Independence Blue Cross

Independence Blue Cross has indicated that a maintenance worker discarded 12,500 paper records in the normal trash in October.

H.J. Russell & Company - Owned

This companies IP address block has shown up in OSINT-X as a compromised host. This organization has machines attacking many other companies so they are presumed hacked at this point.

This activity started early 25 Dec 2014 and is ongoing.

Type: General
Area: Engineering
First Noted: 25 Dec 2014
Location: Various Locations
Total Records: 2500+ attacks noted
Status: Not Monitoring for Follow Up (Not a client of SLC Security Services LLC) 

Merry Christmas from the SLC Security Team...

We wish you all a safe and happy holiday season... We will see you all on the 2nd...

Hey where did the domain monitoring go?

We wanted to let you all know that we are no longer offering notification services on domains. In order to get this information you will be required to subscribe to OSINT-X or purchase a system to host the solution at your location. Our business model has changed significantly over the past year and it is not longer in our best interest to provide a notification service that you can setup for yourself in the OSINT-X product line.

"This change may affect some people but at the end of the day the information being ingested into OSINT-X is more up to date than the system that scours our feeds for your companies information. This move is a win for our customers." said Kevin Wetzel of SLC Security.

First Citizens Bank and Covert Electronic Surveillance

We are seeing indications that this bank is under covert electronic surveillance. This could be auditors hired by the bank, bad actors looking for attack vectors or some other party. We are not sure of the reason but our investigators have noted on several different dates that sophisticated attacks may be taking place at branch locations that are in non heavily populated areas or that these areas are under surveillance.

If you have any additional information on what may be occurring here please contact Kevin Wetzel at (919) 441-7353 or call our TSCM line at (717) 831-TSCM. Reports may remain anonymous if requested. 

2014 Historical Data to be released to Tableau Desktop or Public Users

As part of our technology share program SLC Security Services LLC will be releasing intelligence information formatted for users of Tableau Desktop or Public software so you can perform your own network analysis. The information being provided will be for a 30 day period and will include several of our feeds so you can run comparisons against your own network traffic.

Some of our clients have begun running the data against firewall and server logs to identify compromised machines and host so this may be valuable to you to determine if you should hire a third party to perform a network or security analysis of your data.

The tableau data will be released to the public area of the Tableau Server and will be available to the public. The time periods of the data will be from 15 Nov - 15 Dec 2014. The purpose of the release is so you can evaluate some of the same data that we utilize in our security appliances to determine if the devices are a good fit for your organization. If you come up with other use cases please let us know. We would love to work with some new faces in 2015 and we will do profit sharing on any use case that is adopted into our commercial gateway appliance.

The SLC Secure Gateway is an appliance that acts as a firewall and gateway on networks and also collects information from workstations to include MD5 list of files, network traffic data and action logs to match indicators of compromise with known virus, malware and network security threats.

Covert Listening Threats even worse than recent hacking attempts

Over the past few weeks we have been researching data from various audits on the east coast. We are noting a large increase in the identification, location and disabling of covert listening devices. In the month of November alone we have discovered 14 separate listening devices at 7 different companies. One thing we also have noticed are some similarities between the various devices that have been located.

1. In several of the cases there were multiple listening devices in the same area. We believe this is being done so that if the primary is found the backup may continue to provide useful information to the attackers.

2. Fax machines are being heavily targeted at many businesses. We have been able to locate stolen documents in 4 of the cases out of the 14 being researched.

3. Ultrasonic devices are being used to avoid detection.

4. Networks are also being attacked with malware reporting back to 194.165.134.66. These IP's are also attempting to attack SMTP servers to verify accounts at these same organizations. This was determined through log file analysis.

5. 1 of the 14 companies is a major US Military Contractor.

These are the finding for November. We are still seeing covert listening devices in December and the numbers this month even with the holiday breaks are much higher than November so we are alerting companies to look for traffic to this host and call us if you have identified any. We would like to look for accompanying planted devices to see if this pattern remains. Only 1 of the 14 entities was not bugged or we did not locate any devices during the sweep.

SLC Security customers please read bulletin 2014-141 for additional information on the network IOC's and signal identification notations for these 14 locations.

Copycat Hacks Becoming Commonplace

While Government experts have pointed the finger at North Korea in the recent attack of SONY. We are still not convinced. The reason we are not convinced lies in the OSINT-X data we have archived and analyzed, the malware used in the attack and the similarities of an earlier attack on South Korean banks. One thing is for sure that the Government is not an OSINT-X customer at this time although we have had contact and interest in the product for other uses within the DOD. The FBI probably could use the system to help them in this type of case but as of yet they have not requested access or a stand alone system at any of their locations even though we have offered in the past.

One thing stinks in this whole North Korea blame game. There are misspellings in some of the code used in the first attack and the second attack does not show the same signs. We find it hard to believe that the same people are responsible based on word structure and simple elimination due to the fact that the IP addresses that were cited in an earlier report have changed hands in the botnet wars on more than four separate occasions over the past year and one of the IP's is in direct control of a known China group that would be more suited to carry out this type of attack. This same IP also is hosting malware and has been listed as a compromised system 2 times in the past 2 months.

Truth be told nobody knows exactly who has committed this act and secondly it is nearly impossible without having access to the Internet Service Providers (ISP) core networks to analyze traffic. I say show me proof and I"ll believe that it was North Korea. There are too many ways for these guys to cover their tracks than to make a connection through one of the 1024 official IP addresses that are in use in North Korea. This information is also wrong as there are over 5000 IP addresses in our systems that lead to North Korean associate entities masked as news and public information sites (most of which are hosting propaganda on servers outside of North Korea). It stands to reason based on our intelligence that the North Korean Government is responsible for these systems directly as they do not allow outside entities to utilize communications systems and have played mock games with various releases of "malware" and viruses on these same systems infecting thousands of other entities. If they were in fact responsible they would do like every other hacker and use jump servers to mask their identity.

If you really want to see something interesting look at the 194.165.134.0/24 block  and look at connections going to and from the Internet via that IP block. Then you may be able to tell us something.

BREACH UPDATE: Staples admits to customers data being lost

Staples Inc. has come out with the following statement today.

The number of cards affected 1.16 million.

Staples Inc. (SPLS), the largest U.S. office-supply retailer, said 1.16 million payment cards may have been affected in a series of data breaches that occurred from July into September.
The theft occurred after criminals deployed malware on point-of-sale systems at 115 of Staples’ 1,400 U.S. stores, the Framingham, Massachusetts-based company said today in a statement. The company disclosed in October that it was investigating a potential breach.

The Grinch?? Alert Logic's Claim's Not Adding Up

So as penetration testers we immediately took the information provided by Alert Logic in a recent notification concerning a vulnerability in Linux systems known as "the grinch". Our technical staff have all tried to confirm the information provided with the information provided in their post. Guess what?! We can't get any of the systems we have been testing to actually prove this exploit exist.

We have tested on RHEL, Fedora, Ubuntu and a few other distros and as of 5PM EST have not seen a single system that will allow us to exploit this vulnerability.

If anybody has more specific details on how this is accomplished we would love to hear about it.

WE AGREE: SONY did not get hacked by North Korea

Those of us in the security research arena are not buying the statement in mainstream news that SONY was hacked by North Korea. In fact there are many indicators to indicate otherwise. We are not gonna speculate on this and are surprised at the number of news organizations that are putting out information on a whim.


Additional Reading:
Data Breaches also agree's
North Korea Tech
And This...
And This...

Yeah, Yeah we know there are not many that agree but North Korea is pretty much cut off from the outside world. They may have asked another rogue state to help them but again we are not gonna go the way of the mainstream news.

In non US news circles many outlets are reporting that the attackers are unknown but in the US it seems the media would like to make it appear as though North Korea is responsible. We all know North Korea couldn't hack it's way out of a wet paper bag.

Guess What?! Your owned... UPDATED 12/16/2014 1:37PM EST

On 15 December, 2014 SLC Security Services LLC kicked off an analytic job to determine what host are owned or have been compromised. The following organizations came out of our analysis as being compromised and either used to perform additional attacks or part of a larger issue such as botnets, malware distribution or brute force activity. The following entities have been seen by sensors owned or operated by SLC Security Services LLC volunteers.

If you show up on this list you may want to find a reputable security firm to help you secure your infrastructure. If you have any questions you can email soc@slcsecurity.com.

Pinellas County Schools, FL
Etech Group Pty Ltd, FL*
Turner Broadcasting Systems Inc, GA
New Life Homes LLC, GA*
CocaCola Company, GA
Grant County, Moses Lake WA
Indiana Department of Education, IN
Massachusetts Institute of Technology, MA
New England Telehealth Consortium*
Arvixe LLC, Santa Rosa CA*
National Center for Atmospheric Research
Boston University, MA
Automated Data Systems
Georgia Public Web Inc, GA
Mainstream Consulting Group, MN
Minnesota State Colleges and Universities, MN
George Mason University, DC

Disclaimer: The information included in this report was provided by third parties such as WHOIS, Domain Registrations, Private Databases and proprietary information. We do not warrant this information to be free from error. In fact we are seeing fraudulent WHOIS data on an increasing basis but we believe the information to be accurate. Item's marked with a star were only verified with WHOIS so these names may not be accurate.

62 man hours of research and analytic processes were utilized to identify these organizations.