Saturday, October 14, 2017

VirusTotal, Equifax, and Antimalware Products

There is a subtle precision in the statement “VirusTotal only showed three antimalware scanners detecting malware.” If you think that means only three scanners on VirusTotal detected the malware, then read it again more carefully; that is not what it says and that is not what it means.

Before I continue to talk about VirusTotal mythology, there are a few things I would like to clarify concerning my find of a malicious link on the Equifax website.

  • The site was not hacked, but as stated in the title of my blog, it was compromised. There is a difference; there were no exploits, no backdoors, etc.
  • There was no malware and there were no malicious pages on the site.
  • There is no indication or probability that data was stolen as a result of the compromise.
  • Equifax’s security team is blameless for this one. They were sucker-punched so badly by a third party who was in turn compromised.  The whole food chain was poisoned.
  • Infection required two clicks, a download and an install. It was not a drive-by.
  • There was a serious threat to people who clicked on the link and fell for the attack. This was really nasty malware.

I do not understand why the Experian page was down for two days. I have a theory, but I will wait for the producers of Ancient Aliens to tell me what some people believe before I publish.

Speaking of antimalware, I hope that Kim Komando will agree to write some guest blogs under the pen name “Auntie Malware.” How cool would that be? But I digress. At the 2017 Virus Bulletin Conference in Madrid Spain I presented VirusTotal tips, tricks, and myths. I believe the full presentation will be available soon. The content of the presentation was submitted to my friends at VirusTotal to validate accuracy. I am going to do a series of blogs about VirusTotal mythology.

There are multiple reasons why one cannot assume that only the scanners that display detection on VirusTotal are the only ones that have detection of the threat. Just as importantly you cannot assume that if the scanner you did not display detection of the threat you were not protected.

VirusTotal uses command-line versions the scanners. Command-line antimalware scanner cannot be expected to perform the same way that the GUI versions do. There are undocumented switches that can boost heuristic detections to a levels not available in commercial offerings. Antimalware vendors can hide detection on VirusTotal. Sometimes you do not want the malware authors to know what you know. The commercial versions may very well have detection.

There is more to say on the subject, but for now know that “Displayed on VirusTotal” does not mean that only those scanners that display detection provide detection. Don’t forget protection; it is not the same as detection, but it matters. I know for a fact that at least one product that did not demonstrate detection offered protection. I have a very high degree of confidence that other scanners did too.
In the next series of blogs, which may not be sequential, I am going to dispel the following myths:

  • VirusTotal can be used to perform comparative testing
  • Detection of malware on VirusTotal means the scanner can detect it
  • Lack of detection means the file is safe
  • False Positive means false positive
  • Detection by more scanners means better coverage
  • Malicious website means malicious website

I am going end this blog by summing up VirusTotal in one neat little quote by Alan Greenspan.

“I know you think you understand what you thought I said
but I'm not sure you realize that what you heard is not what I meant”


Randy Abrams
Independent Security Analyst
https://www.linkedin.com/in/randy-abrams-ba24391/

Wednesday, October 11, 2017

New Equifax Website Compromise

Update: Third party analysis tends to indicates something that is conceptually the same as malvertising. Watch the video and replace Equifax with your favorite website. It happens every day throughout the world. Now it's a security training video.

I like Equifax more than Experian. TrustedID gave me the heads up that Experian had falsified personal information in my file. After verifying that Experian did in fact falsify the data (it was due to incompetence and apathy) I decided to see if the misinformation had propagated to Equifax. As I tried to find my credit report on the Equifax website I clicked on an Equifax link and was redirected to a malicious URL. The URL brought up one of the ubiquitous fake Flash Player Update screens.



For all of you voyeurs...
video

Seriously folks. Equifax has enough on their plate trying to update Apache. They are not going to help you update Flash.
 
I know that nobody is surprised at my find, but watching Equifax is getting to be like watching a video of United Airlines “deplaning” a passenger... It hurts.
 
And once again Equifax, all I want from you are my credit scores. Please?

Independent Security Analyst



Tuesday, October 10, 2017

Equifax Caught Experian Falsifying My Personal Information

One of the silver linings of the Equifax breach is their free identity theft protection. Perhaps that is the only silver lining. I was skeptical when I received an email from TrustedID that said “We've noticed a change on your credit report.”  I know that identity theft is rampant and credit reports change frequently, but consider the source. Equifax owns TrustedID; need I say more? I figured the email would be something like a LinkedIn style “three people have looked at your credit report. Upgrade to premium to find out who they are.” Or “views of your credit report are up 80% over last week’s views.” Still, I was curious. I logged into my TrustedID account and was informed that Experian had changed my address on file.

My investigation revealed that Experian now showed my current address is in a city I have never lived in. Perhaps accusing Experian of falsifying my personal information is a bit dramatic, but it is technically true. I won’t say it was deliberate because I know Hanlon’s razor. Hanlon’s razor essentially says “"Never attribute to malice that which is adequately explained by stupidity." In this case apathy is probably closer to accurate than stupidity. To paraphrase Lily Tomlin’s classic “we’re the phone company” sketch… “We don’t care. We don’t have to. We’re the credit bureau.” Experian is not stupid, they excel in math. They know exactly how much each congress person that can be bought costs. Based upon the laws of supply and demand I expect it isn’t very much.

Here is how I believe Experian got it wrong. For several years my Brother and sister-in-law had been living in a house I owned in Seattle. When they moved they filed a change of address form with the post office. My brother’s name is Steve. Steve is a name with five letters. The name Randy has five letters in it too. The rest is history. Data validation is not on Experian’s strong suit. Fortunately when I request my free credit report my brother will pass it along to me after Experian sends it to him.

Let’s compare Experian’s attitude toward consumers with T-Mobile’s attitude. In 2015 it was revealed that Experian had suffered a 2 yearlong data breach that affected T-Mobile’s customers. T-Mobile CEO John Legere response included the following comments.

“Obviously I am incredibly angry about this data breach and we will institute a thorough review of our relationship with Experian, but right now my top concern and first focus is assisting any and all consumers affected.”

Did you notice it was not Experian but rather T-Mobile whose first focus was on assisting customers?
Legere went on to say “Experian has assured us that they have taken aggressive steps to improve the protection of their system and of our data.”

 Improving the protection of T-Mobile’s data is important to Experian’s bottom line, but maintaining the integrity of consumer data is irrelevant to Experian. It doesn’t help or hurt their bottom line. Let’s hope the Equifax breach results in industry wide changes that, among other things, makes negligent changes of consumer data expensive.

In conclusion, thank you Equifax for bringing to my attention the falsification of my personal data by Experian. On a more cheerful note, when Experian is breached again the attackers won’t get my real address.

Independent Security Analyst
I am my brother’s keeper, but I am not my brother

Tuesday, September 12, 2017

Equifax: Here Is What I Want From You



My credit scores. I want my credit scores. I know you’ll give me a year of free credit monitoring, but I’m pretty sure that is only to try to sell me more stuff. Actually Equifax, you are stingy. When Anthem was breached their victims got two years of free credit monitoring AND a $1 million identity theft insurance policy. When Premera Blue Cross was breached they gave away two years of free credit monitoring. Not one year, but two full years AND I got free access for life to the results of my colonoscopy. Equifax, I just want my credit scores. The hackers get them free, why don’t I?

I decided to find out if I am one of the people impacted by the breach. What I learned was that if I can pick out apartments buildings from a lineup, know my last name, and the last six digits of my social security number then I am probably impacted. The last six of my social security number was tricky. I was able to find correspondence containing the last four digits, so that narrowed it down to a maximum of 100 guesses to get the first two. Lucky for me I got it on the third try or else I may have been locked out and had to ask a hacker for assistance.

So here’s how to find out if you are a victim.

Step 1: Go to https://krebsonsecurity.com/2017/09/equifax-breach-response-turns-dumpster-fire/ and pick out the website he indicates needs to be used. Do note that you may need to use a computer and a mobile device to verify the results. A tablet probably isn’t a bad idea either. Perhaps try it with iOS, Android, Win 10, and Symbian.

Step 2. Enter my last name and last six of my social security number (I don’t know if yours will work, but mine does, so I can confidently recommend it). Proceed to pick out ugly apartment buildings from a lineup. 




I hate these captchas. I wonder if the hackers had to complete them to get in too.

You can tell if you successfully completed step 1 by the following conspicuous message.




Have a last name?  √
Know or can guess the last six of your social security number?  √
Can pick ugly apartment buildings out of a lineup?  √

Winner!! You are the proud new owner of one glorious year of free credit monitoring!

I have to admit I got a bit queasy when the next screen appeared.



Why am I being asked for this information? Equifax knows all of this information just from my last name, the last six of my social security number, and some pictures of ugly apartment buildings now linked to my IP address. I forgot to check my VPN - it was off. I fear I am being set up. “See Mr. Investigator, he has some of the stolen data and knows which pictures are the ugly apartment buildings. He’s your culprit.” No, I think I will play it safe and appeal to the hacker’s consciences to do the right thing; Use the stolen data for good and sign me up so it doesn’t look like I committed the crime.

You may think that this sounds absurd, but do remember:

1) Equifax is desperate. Their stock tanked, they’re being grilled by congress, some of their executives sold stock at questionable times, and they face multiple lawsuits. Equifax needs a scapegoat like McCarthy needed commies.

2) The name of this blog is, after all, Security Through Absurdity. Sometimes I have to get a bit tongue-in-cheek or even absurd.

Equifax, I don’t care if you are too cheap to give two years of credit monitoring. I don’t care if you don’t give me a million bucks of identity theft protection. I don’t care about lawsuits. All I want is my credit scores. That is the only information that the hackers have that I do not have, and they got it for free.

Collector of free credit monitoring services and free identity theft insurance policies, and connoisseur of ugly apartment building fine art.

Wednesday, August 16, 2017

Will Passphrases Kill the Password Managers?


I won’t keep you hanging… … … much... the answer is no! If the answer was all you needed, then thank you for visiting my blog. If you would like to know why I say “no,” then keep reading.

Just in case you do not know what a passphrase is, it is a password that uses words instead of gibberish. The words may or may not have spaces in them. “thisisapassphrase” and “this is a passphrase” are both passphrases. Do not use those two examples for your passphrases though.


The argument for passphrases is that they are easy to remember, and if they are about 20 characters long or more, they can be far stronger than something like “^T28dy2a$o,v” is. That is completely correct. I am a strong proponent of passphrases.
 
On the NPR show All Tech Considered, Paul Grassi, the Senior Standards and Technology Adviser at NIST, is quoted as saying the following concerning password managers
 
“… these apps are useful because they completely randomize the password, but he says they aren't necessary to maintain security.”
 
The new NIST guidelines concerning passwords and passphrases are widely regarded as excellent by security experts. I wholeheartedly agree with all that Paul said, except for the part about password managers, and here are the reasons why.
 

1) Some sites are not going to allow long password/passphrases. If you are limited to 15 characters or less, complexity does become far more important and password managers help with that. This also means that you have to try to remember the gibberish.

2a) Depending upon how many sites you have passphrases for, many people are not going to be able to remember all of the phrases and which sites they correspond with. This leads to 2b (for the record, “2b or not 2b” is not a good passphrase.

2b) When people get to the point that they can’t remember all of the passphrases and corresponding sites, they are likely to take shortcuts that are essentially the same as incrementing passwords or using the same passphrase at multiple sites.

Cracking passwords is not as common as obtaining passwords from a data breach or a phishing attack. This is why password reuse is so dangerous. This is also why incrementing passwords makes a complex 16 character password weak. Easily recognized patters in passwords, such as “Todayis01/10/17” make the next series of password extremely easy to guess.

If a person has 20 sites with a unique username and passphrase to remember for each site, I believe that they are likely to do something far more serious than incrementing. They may use a site identifier.

Write down 20 websites that require you to log into. The next to each one write down your user name and a unique passphrase for each of them. Just to make my point., choose the first four words of a different sentence in this blog for each of the 20 website’s passphrases. As soon as you are done, stop looking at them. Even if your username is the same for all of the sites, do you remember the passphrases and corresponding sites? Most people will not. You need a way to remember all of these. The trick that I envision some people using is site identifiers.

“Tractors swim in aquariums” is a great passphrase (at least it was before I published this blog).

Now to make it easy to remember which site I use each password for…

“Tractors swim in aquariums – Gmail”

Care to guess this user’s password for Facebook, LinkedIn, and the company they work for? Websites can prevent users from including the name of the site in a password, but users are clever that way. They’ll figure out something as predictable. Of course if you write it down you are a bit worse off than using a random complex password. The gibberish passwords are hard to remember. If I see your passphrase written on a piece of paper, about a second or two is all I need to see it and remember it.

Passphrases and passwords share an identical problem. You can’t remember them all. Password managers address that problem. That is why password managers are as relevant in tomorrow’s world of ubiquitous passphrases as they are in today’s world of ubiquitous passwords.

Here is my recommendation. Use an excellent passphrase for your corporate login and remember it. Use an excellent passphrase for your personal computer login. Use an insanely good passphrase for your password manager. A sentence you create that is at least 35 characters long, such as “the purple cow danced on the cheese” is insane enough. Make sure your passphrases are at least 20 characters long and not common sentences, and you’ll be good to go for almost anywhere you currently use a password.

In future blogs I will give more detailed guidance on how to make killer passphrases.

In a different blog I will discuss the passphrase token attack and linguistic passphrase attacks. These attacks intrigue me, but I don’t think they are anything to worry about too much at this point.


Independent Security Analyst (is not my passphrase)

Thursday, August 10, 2017

Evasion and Regeneration; Decoys and Deception


I recently had an interesting conversation with Alex Gounares, the CEO at Polyverse. Alex calls Polyverse’s security approach “Moving Target Defense.” Polyverse’s technology basically causes your operating system to continuously morph into something functionally the same and dynamically different, at a very high rate of speed, while replacing the container with each morph. The idea is to give attackers virtually no time to exploit a vulnerability before the vulnerability has been moved somewhere else. If malware does enter the system, the OS is replaced with a brand new, clean morphed OS almost as quickly as the malware had arrived. Full disclosure: I had been referred by a friend to Polyverse for contract work. There was not a synergy in current needs but the ensuing conversation was engaging and thought provoking. This is the “evasion and regeneration” I am talking about in the title of this blog.

One of my all-time favorite quotes goes something like this. “If you only see one solution you probably don’t understand the problem.” This sage advice that I found in the sidebar of a DIY robotics book applies to life. Sometimes when I do not like a solution. I discover I’m not actually trying to solve the real problem. Sometimes the first solution I see is the best solution. Other times I find multiple appealing solutions.  Regardless, I am always more educated by remembering to apply this principle to my life.

I really am intrigued by Alex’s classifications of defenses as “stationary” and “moving target.” The moving target defense looks to me like a novel solution. Damn. The “S” word… “solution.” “If you only see one solution…” Sigh .Now my challenge became one to see if I could find better or equally appealing solutions that use a stationary target defense. In other words “Can a stationary endpoint be defended as well as an endpoint that is moving faster than the attackers can catch and inflict damage upon?”

There are many types of stationary target defenses but for this blog I am limiting discussion to one class of stationary target defense – deception and decoy. The reason is simple. It was the first to come to mind because my friend Gadi Evron is everywhere I go. Facebook, email, countries all over the world… Gadi is everywhere. In thinking about a stationary target defense solution that might be able to provide the effectiveness of a moving target defense, I remembered Gadi telling me about how his company, Cymmetria, uses decoys and deception to keep an attacker away from a stationary target. TrapX, Attivo Networks, and CounterCraft are three other companies that use a deception and decoy strategy. Aside from any technical merits of these solutions, I absolutely love the idea of deceiving the bad guys. Digital karma. Ask me about the time I kept a PC support scammer on the line for 45 minutes. He even waited for me to “cook my breakfast.”

I have an all-time favorite example of a successful stationary target defense. The defense was called “Rope-a-dope” and it made the “Rumble in the Jungle” one of the most exciting boxing matches in history. Muhammed Ali was essentially a stationary target for almost 8 rounds. In the 8th round Ali stopped being a stationary target and destroyed George Forman in an offensive flurry lasting less than 10 seconds. Rope-a-dope worked for Ali. Although it was an offensive maneuver that ended the fight, the defense was essentially stationary. I can’t imagine that getting pummeled by George Foreman felt like an Ashiatsu massage, but I wasn’t there.
Unlike Ali’s approach, companies employing decoys and deception do not let their targets stand and take punches – no matter how hardened the target is. Different companies use different techniques, but the high level concept is to use real or virtual computers that keep attention drawn away from the target by making the decoys look like they have the Holy Grail. One of the potential weaknesses of the decoy approach is that there is still a stationary target. I’m sure that all of the companies that use this approach are aware of this and have some pretty cool counter-measures, but still, there is a stationary target. If the decoys work all of the time then the actual target does not need to move.

My favorite moving target defense analogy is the SR-71 Blackbird. This spy plane was the fastest aircraft ever to fly.  The Blackbird had vulnerabilities. The Blackbird was designed for stealth, but you don’t really fly at Mach 3+ without leaving a detectable heat signature. To add to that, the skin around parts of the fuselage could be easily damaged. How did the Blackbird defend itself?  It flew faster than the missiles could reach it, faster than any other aircraft could fly, and it moved around a lot. Stealth was still a factor too. By the time the missile got there, the Blackbird was not. It didn’t matter that the Blackbird was in plain (no pun intended) sight.

Surveillance is a critical part of moving target defenses, deception and decoy defenses, and many other security approaches. Repelling attacks is good, but not everything. You want to have a discreet, digitally intimate relationship with your attacker. You just don’t want the attacker to know they are in the relationship. This should be your relationship status

 

This is what the adversary’s relationship status should be


You want to stalk your enemy… watch them... What is my enemy after? How are they going after it? How are their tactics adapting? Who is attacking me? What am I going to do about it? And so on… Ah ha! The OODA Loop is back!

Update: Attivo Networks expressed concern that I may be making decoy and deception defense look like a passive technology. I am actually surprised that none of the other vendors raised this concern because they all fight the misconception that they are glorified honeypots.

Modern decoy and deception approaches employ algorithms that can create a series of dynamically changing decoys and potentially even dynamically changing network topologies in response to the tactics of attackers. This is active engagement with the enemy, not passive intelligence collection.

Again, I am not recommending or endorsing any specific technology or security market segment. We’re talking philosophic approaches and challenging assumptions. I can’t imagine any single tactic working through the entire kill chain.

Given multiple approaches to achieve the same goals, which strategy is best? I can’t tell you, I don’t know your problem.

If you are Schick you are defending trade secrets. Encryption, DRM and data recovery probably address the real problem. Yes indeed, defend your endpoints, but don’t lose focus on the problem. Get that IP protected, then worry about the network and endpoints.

If you are a hospital you are defending human lives first. Protecting the equipment required to maintain the physical well-being of a patient probably requires different protection technologies and/or approaches than protecting the systems remotely monitoring a pacemaker. Banking Trojans may be the biggest threat to the accounting department, where data theft is the major threat to systems holding health records.

Make sure you are clear on the problem, assess the suitability of the approach to the problem, and them compare technologies and approaches. The right technological approach for you may not have been mentioned in this blog.

I really wanted to share with you the concept of diverse philosophical approaches to security, and demonstrate what happens when I remember some of the wisest words I know - “If you only see one solution you probably don’t understand the problem”

This is the official end of the blog, but feel free to read on if you enjoy the diversions that research on the Internet results in.  As you all know, the problem with research on the internet is not attribution and not validation, it’s that you get diverted to rather irrelevant information that is too compelling to ignore. In thinking about analogies to use in this blog, holograms came to mind. I could think of analogies using holograms for either type of defense, but they fell apart the very first time an adversary tried to “touch them.”  This analogy requires a hologram that can be “touched” to really fly. With that in mind I remembered that George Washington once said “if you can dream it you can find it on the Internet.”

Research into my dream led me to a company called Ultrahaptics. Ultrahaptics is developing a holographic technology which can make it seem like you are touching a hologram. How cool is that?


Randy Abrams

Independent Security Analyst (ISA)
Fan of Historical Quotes (FHQ)
Chaser of Internet Squirrels (CIS)

Tuesday, August 1, 2017

Can Comcast/Xfinity Publish Your Trade Secrets and Letters to Grandma?

The answer looks like yes, but ask a lawyer for a legal opinion.
I have confirmation from a lawyer that I am correct.

Comcast’s most recent Terms of Service (ToS) state

“Authorization. Comcast does not claim any ownership of any material that you publish, transmit or distribute using XFINITY Internet. By using XFINITY Internet to publish, transmit, or distribute material or content, you (1) warrant that the material or content complies with the provisions of this Agreement, (2) consent to and authorize Comcast, its agents, suppliers, and affiliates to reproduce, publish, distribute, and display the content worldwide and (3) warrant that you have the right to provide this authorization. You acknowledge that material posted or transmitted using XFINITY Internet may be copied, republished or distributed by third parties, and you agree to indemnify, defend, and hold harmless Comcast, its agents, suppliers, and affiliates for any harm resulting from these actions.”

 Sending data in email clearly is transmitting material. For example, if an employee or an independent contractor who uses their Comcast account to communicate something confidential with authorized people, it appears that Comcast retains the right to publish such information  on a worldwide basis.

If a child writes an email to grandma, fair game for worldwide publication? A suicide note? Spouses exchanging love letters and/or pictures? Letters to congress people. Your attorney? The FBI?

The answer is yes.

If I am reading this wrong please let me know so I can update this blog and inform others of what it means.

Randy Abrams
Independent Security Analyst