Black Hat

Mobile threats and other new directions from Black Hat

Mobile computing seems to be the new frontier in cybersecurity, edging out the cloud as a fruitful area for research and hacking at last week’s Black Hat Briefings. But stealthy persistent threats remain a serious concern and the emerging Internet of Things offers new challenges to privacy.

It’s getting harder to spot trends at Black Hat as the annual security conference grows and evolves, however. It remains a premier venue for original research, but with more than 7,500 attendees and presentations offered in 11 simultaneous tracks at the U.S. Briefings July 31 and Aug. 1 in Las Vegas, it no longer is a compact community where you can keep your ear to the ground. The crowds not only are larger, they also are more diverse, with a growing number of corporate and government types joining the hackers and researchers (although government employees are loath to identify themselves).

That change was illustrated by the reception given NSA Director Gen. Keith Alexander, who gave the opening keynote. Although Black Hat founder Jeff Moss said in introductory remarks that tensions between the hacker/security community and government were at an all-time high in the wake of revelations about domestic NSA snooping, the general found a largely friendly crowd. Yes, there was a shouted expletive and a few taunts from the audience, but people seemed to be mostly on Alexander’s side.

“There is such a thing as professionalism,” one audience member sniffed at the heckling.

But pushback has always been a hallmark of Black Hat and attendees are encouraged to challenge unsupported claims. This year’s audience seemed to be unusually willing to accept on faith assertions from Alexander that a more skeptical crowd would have questioned. Statements such as, “we have tremendous oversight and compliance” in surveillance programs, and the claim that there has never been any NSA overreach in gathering data. Alexander might be right, but we have no way of knowing as long as the programs remain classified. The general said “trust me,” and the audience did.

That said, there still is a lot of research being presented. As mobile computing comes of age there is a growing interest in possibilities offered by the Google Android and Apple iOS platforms. A malicious USB charging device can bypass digital signature requirements on many iPhone versions to install phony apps with malware without jailbreaking the phone.

Cryptographic keys for signing Android applications can be exposed to create bots that can set up unlimited numbers of spam accounts on social networking sites. Other vulnerabilities in Android authentication can allow legitimate apps to be altered, giving an attacker system control of the phone. Automated exploits for this one already are in the wild.

The BlackBerry OS 10 presents an attack surface that can allow remote entry and unauthorized escalation of privileges. And there are new mobile malware and mobile rootkits, and the LTE network itself is far from secure.

All of this takes on added significance as desktops become obsolete, laptops passé, and everyone uses tablets and smart phones to access data and applications that are being moved to the cloud.

At the same time, complex multistage threats and rootkits still are being advanced and distributed denial-of-service attacks capable of delivering multi-gigabit streams to targets are being offered as a service. In short, nothing is getting better and a lot of things are getting worse. All of this means plenty of job security for anyone who can defend a network, a server, a computer or an application.

As long as you can keep up with the bad guys, that is.

Posted by William Jackson on Aug 06, 2013 at 8:41 AM0 comments

People standing in line in Las Vegas using insecure WiFi

Secure-travel advice for Black Hat... and your local Starbucks

The annual Black Hat USA conference being held in Las Vegas July 27-Aug. 1 is not exactly a hostile environment, but if you go, you will be with a lot of people eager to demonstrate their hacking skills on the less witting among them. The opening ceremonies typically include a reminder that although Wi-Fi connections are provided, attendees are responsible for their own security when connecting.

So if you are representing your agency at the conference, don’t neglect the basics for secure use of your laptop, tablet or any other Internet-enabled device you take with you.

Black Hat is not as rough a neighborhood as its older sibling, DEF CON, where “Spot the Fed” has been a popular game for 20 years. This year feds have been advised to sit out DEF CON (Aug. 1-4) in the wake of the Edward Snowden revelations that have increased some anti-government feelings. But government is always a juicy target for people interested in establishing their hacker creds.

Not that attacks at Black Hat single out government. “What I’ve found is that it’s more of a passive scanning,” said Jeff Debrosse, director of advanced research projects for Websense Security Labs. “It’s not targeted, it’s targets of opportunity.”

The crowd attending Black Hat is varied, Debrosse said. “I don’t run into really dangerous people there; I run into serious people with varying degrees of expertise and skill,” from script kiddies to those who set up their own femtocells to capture cellular traffic. That means you can’t assume that any connection is secure. Even when plugging in in your hotel room, it’s probable that the hotel is using a wireless bridge at some point that could expose you.

“Leverage VPNs,” Debrosse advised those working at the conference. “I’m always about encryption, encryption, encryption.”

Debrosse offered some common-sense tips for protecting yourself at Black Hat. And even if you’re not going, they also apply to just about any out-of-office experience you might have. They include:

  • Make sure your devices are fully patched and antivirus software is updated.
  • Delete cookies and clear your browser history and cache to limit residual information about your habits.
  • Encrypt sensitive files or — better yet — go with full-disk encryption.
  • Do as little on the road as possible. Back up your devices before leaving and while on site, save work to the cloud or a removable drive, then revert to the back-up state when you return.
  • Turn off Bluetooth and Wi-Fi and any applications that use them whenever you can.
  • Don’t charge devices at public ports, which can give outsiders access to them.
  • Don’t take candy (or USB drives) from strangers.
  • Leave any Radio Frequency ID devices such as badges, passports or cards in your room.
  • Use wired connections when available and be careful when connecting wirelessly. Wi-Fi pineapples — rogue hotspots that indiscriminately identify themselves as any network your device is looking for — can deliver you into the enemy’s hands.
  • Avoid sending sensitive data while on site, use your VPN at all times and when roaming use a high-speed cellular connection if possible. It’s not perfect, but can be safer than Wi-Fi.

In general, be careful about anything you do online, and do as little of it as possible. If you stay safe at Black Hat, you probably will be in good shape almost anywhere you go.

Personally, I favor a ballpoint pen and a notebook (paper) when traveling. They are easy to get through airport security, difficult to hack, and my handwriting is a match for any encryption.

Posted by William Jackson on Jul 26, 2013 at 1:28 PM0 comments

Two men checking mobile phones with giant rat looking over their shoulders

AndroRAT signals commercialization of mobile malware

Mobile malware is not new. According to Juniper Networks’ Third Annual Mobile Threats Report,  there were more than 276,000 malicious apps for mobile devices discovered from March 2012 through March 2013. The Android platform, with an estimated two thirds of the mobile market share in 2012, is the target of 92 percent of that malware.

Now, researchers at Symantec have discovered a new wrinkle that combines a Remote Access Tool for Android devices with a kit that lets unskilled users easily repackage legitimate apps with AndroRAT to create Trojans. The new binder kit is being advertised in the hacker underground market as “first ever Android RAT app binder + builder.”

“To date, Symantec has counted 23 cases of popular legitimate apps being Trojanized in the wild with AndroRAT,” Symantec’s  Andrea Lelli wrote in a recent blog post.  Only several hundred infections of AndroRAT have been found worldwide, most of them in the United States and Turkey, but the number is growing.

AndroRAT enables control of the infected device, allowing the criminal to remotely monitor and make phone calls, send SMS messages, access GPS coordinates, use the camera and microphone and access stored files.

The appearance of AndroRAT packaged in an off-the-shelf kit for infecting applications is a significant step in the commercialization of mobile malware, said Vikram Thakur, Symantec’s principal security response manager.

“All this tool is doing is lowering the bar for people entering the malware space,” Thakur said. “But it’s only one piece of the puzzle.” The user “still has to figure out how to monetize it.”

Making money from malware for mobile devices has for years been a stumbling block for cyber criminals. The devices are increasingly popular and powerful, but do not offer as many opportunities for ripping users off as do desktop and laptop computers that are more often used in commerce. As much fun as it might be to take control of someone’s smartphone, there is not a lot of money in it.

But the ability to leverage malware in large mobile botnets can make it worthwhile. Common schemes are to deliver ads to the infected device, send premium text messages for which the smartphone owner is billed or to have the device browse a for-pay video site. These do not produce a big return on any one device, but Symantec discovered a large mobile botnet in 2012 that was pulling in more than $1 million a year for its owner, Thakur said.

“The bad guys are not trying to suck out as much money as they can on day one,” he said. They are staying under the radar, taking a few dollars a month from each victim for a small -- but long term -- return on investment.

The next phase in such schemes is to take products such as the AndroRAT binder one step further and bundle it with tools for hosting and delivering premium content to compromised devices: An all-in-one tool that can turn any wannabe into a successful mobile bot herder.

So far, it does not appear that this has been done, Thakur said. “If it is happening in the underworld, it is in a very siloed manner.” But he expects that we will see activity of this kind in the future.

The good news is that most mobile malware today is delivered in applications that have to be installed on a smartphone or other device, which means that the user is the first and best line of defense. You should have an antivirus tool installed on your phone, but be careful about what else you install on it.

“If somebody is offering you a free version of an app that you would have to pay for somewhere else, think twice,” Thakur said. “Nothing is free.”

Posted by William Jackson on Jul 19, 2013 at 9:54 AM2 comments

Broken window showing poster of generic top level domain names

New domain names bound for collisions: 'Things are going to break'

The Internet is on the brink of the largest expansion of generic Top Level Domains in its history, with as many as 1,000 new strings expected to be added over the next year, more than quadrupling the current gTLD space.

Some observers, including the operator of two of the Internet’s root zone servers, worry that this expansion of public domains could result in naming collisions with private internal network domains, disrupting those networks.

“We know things are going to break,” said Danny McPherson, chief security officer of Verisign, the company that runs the A and J root servers. Networks in the .gov domain could be affected, as well as those supporting emergency services such as public safety answering points for the nation’s 911 system. “It makes us uneasy,” McPherson said.

At risk is any enterprise with a network naming scheme using domain names for non-public resources that are the same as new domain name strings now being considered for approval on the Internet. There are 1,833 such names now being considered by the Internet Corporation for Assigned Names and Numbers, and the approved new gTLDs could begin being delegated in the root system later this year.

The resulting collisions could cause some networks to become about as useless as the Washington Beltway on Friday afternoon.

The solution is to change those internal domain names to avoid naming collisions. But this can be a complex job for a large enterprise, and McPherson worries that many administrators are not aware of the issue. He believes the 12 root zone operators have a responsibility to monitor the global systems to identify potential collision situations and warn network operators in advance. But there is no zone-wide system to provide that visibility.

Top Level Domains are the suffixes on URLs that appear to the right of the final dot in the address, such as .gov and .com. There now are 317 of these, including country names such as .us and .uk. Name servers in the Domain Name System use authoritative lists maintained in the 13 root servers to associate URLs with an IP address to direct queries. The potential problem with the domain expansion is that requests for a network’s internal domains are routinely checked against the global DNS database as well as the local enterprise name database. If the domain name is not in the global database, it looks for it in the local database, and the query is directed to the proper server within the network.

But if that internal name is added to the Internet’s collection of domains, the internal request will be sent out to the Internet and the user will not be able to access resources on his own network.

How likely is this to happen? Take .home for instance. This is a default internal domain name used on millions of pieces of home networking equipment. McPherson said .home is one of the top five queries received by Verisign’s root servers. It also is one of the most coveted new gTLDs being considered, with 11 applicants. Other commonly used internal domain names being considered for the Internet include .inc, .corp, .cloud and .mail.

McPherson also is concerned that less commonly used names such as .med that might be used by hospitals and clinics for connecting with health care equipment could suddenly become unavailable internally if .med goes onto the Internet.

Ideally, if you are managing a network you would be warned by the root zone operators when they notice local domain queries from your network that would be likely to result in collisions. With no system in place for monitoring for this, however, the responsibility falls on network administrators to know their naming schemes, pay attention to ICANN’s new gTLD program,  and make sure they are not using new Internet domains internally.

Posted by William Jackson on Jul 12, 2013 at 12:38 PM1 comments