Blog

Engaged for Security

Posted on by mgy0knxycvop3nptyu87 in Uncategorized

So I was recently engaged as an IT Security consultant and I figured I would write up what occurred, not name names, show the thought process, and maybe get a conversation started…

 

In this instance, an email was sent to a VIP from one of the company’s consultants. This email was empty, no subject line and no text in the body of the email. But attached to this empty email was a ‘blank’ Word that was promptly saved and opened.

 

The installed AV didn’t complain before and after the Word doc was opened. The only thing that tipped off the VIP that something was amiss was that the accounting software would no longer open. This prompted getting the IT dept for the company involved, which in this case, is an outsourced MSP that according to the VIP, do not have the company’s best interests at heart. The MSP’s more interested in maximizing the amount of billing they do and minimizing the amount of exertion required on their end (kinda the name of the game for an MSP, but I digress). So there isn’t a lot of trust for the MSP from the company’s side, but the Word file was submitted to the MSP.

 

From what I understand, the MSP scanned the Word doc with some unspecified anti-malware/anti-virus product and got no detections. Their recommendation was to contact the vendor of the accounting software to get support and get it running again on the VIP’s computer. This prompted the VIP to request an outside view on what was occurring and thus my involvement.

 

So after the NDA for naming the company, employees, the MSP, etc, etc, etc, I started with the email from the consultant to the VIP. It looks legitimate, if not a little weird for just being blank and with attachment. I have no access to any logs for review, so I can’t verify directly that the backend infrastructure was used for transporting the email (under MSP control), but I can check the email headers. So taking that and running it through MXToolBox (https://mxtoolbox.com/EmailHeaders.aspx) and G Suite Toolbox (https://toolbox.googleapps.com/apps/messageheader/) (I prefer to have things double checked, if possible), gives that it definitely appears to have passed through the company’s backend. I checked an internal to internal email from another consultant to the VIP to verify what a ‘good’ header looks like in this environment.

 

Where we stand currently:

  • Change all the consultant’s passwords?
  • Restage the consultant’s workstation?
  • ???

 

Now onto the Word doc, since it contained no sensitive info, it was immediately uploaded to VirusTotal (1), Hybrid-Analysis (2), and Any.Run (3). The VirusTotal results returned 11 of 59 engine detections and of course, the AV used by the MSP and was rolled out to the company was not one of the 11 that detected a problem with the Word doc. Of course, the AV the MSP used and had deployed this company was Sophos and this vendor was not one of the 11 engines that detected anything wrong with this file.

 

So I surmise the MSP just took the Word doc and scanned it with the Sophos AV they more than likely had installed on their own workstations, seen no detections, and sent back their response. As an aside, due to definition updates, the Word file was blocked by Sophos approximately 24-36 hours after the first run in the company’s environment.

 

Using the VirusTotal, Hybrid-Analysis, and Any.Run, I begin to build a list of Indicators of Compromise (IOCs) for this event. I’m feeling that the following has been established:

 

  • Consultant received the same empty email with a document
    • Outside source
    • Malware compromised the workstation
    • Consultant or attacker then used the consultants email to send the document higher up the chain in the company
  • The sent Word document (maldoc) is definitely malicious
    • Malicious Macros on document open
    • Runs powershell to pull malware from ‘oopasdnqwe[.]com’
    • MALWARE
  • Currently deployed AV is blind to this maldoc and it’s payload
  • Consultant and VIP need to have work done…

 

Next step is to create an mitigation plan with the above and include the IOCs so that the company can get the MSP working on checking the environment for any other infections from this supposedly ‘clean’ Word document.

 

To update where we stand currently:

 

Mitigation Plan

  • Change all the consultant’s passwords
  • Restage the consultant’s workstation
  • Change all the VIP’s passwords
  • Restage the VIP’s workstation
  • Try to follow the email with the maldoc back to its source
    • Was it sent from internal source to the consultant?
      • If so, then add that source to the password change/restage
    • Was it sent externally to the consultant?
  • Compile IOCs to be submitted to the MSP
    • Check company environment for:
      • Other infections
      • Possible other compromises of company assets

 

To build the list of IOCs, we’ll refer back to the various uploads that have been made regarding the maldoc and it’s payload. Please be aware, I did not take screenshots to demo this at the time, but am instead going back to the submission and getting the current data. So the details will show more detections for the maldoc as it is closer to current time then when this all occurred, mid-June 2018.

https://www.virustotal.com/#/file/9bac1109bed7400dbb6aa062b22c1d31e86c7f1f11bd355e631aa9ee82f8fc73/detection

VT-Maldoc

IOCs

    • Maldoc
      • Inquiry.doc
      • 9bac1109bed7400dbb6aa062b22c1d31e86c7f1f11bd355e631aa9ee82f8fc73
    • Payload
      • C:\Users\USERID\AppData\Local\Temp\#####.exe
      • D64426736e4f588634b112829a2e347123b64ea0aa3aac0a54d2e04212f80c67 (4)(5)
        • Appears to be Ursnif (6)
        • malware family is primarily known for being a data-stealing  malware, but it’s also known for acquiring a wide variety of behavior
          • Backdoors
          • Spyware
          • file infectors
    • Domains
    • IPs
      • 23.227.199.70
        • Points to Oopasdnqwe.com

 

  1. https://www.virustotal.com/#/file/9bac1109bed7400dbb6aa062b22c1d31e86c7f1f11bd355e631aa9ee82f8fc73/detection
  2. https://www.hybrid-analysis.com/sample/9bac1109bed7400dbb6aa062b22c1d31e86c7f1f11bd355e631aa9ee82f8fc73
  3. https://app.any.run/tasks/55e0b763-860f-4aa8-b711-8b9725c197d5
  4. https://www.virustotal.com/#/file/d64426736e4f588634b112829a2e347123b64ea0aa3aac0a54d2e04212f80c67/detection
  5. https://www.hybrid-analysis.com/sample/d64426736e4f588634b112829a2e347123b64ea0aa3aac0a54d2e04212f80c67?environmentId=100
  6. https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=win32/ursnif

Security – Backing up what is IMPORTANT, from the Inside

Posted on by mgy0knxycvop3nptyu87 in Security, Security - From the Inside Out!

The sad truth is, it’s more likely then not, you will face a time that something bad happens. Perhaps its a security control you put in place will fail. Maybe it’s a update you didn’t apply because it required a restart (or three). Or perhaps you’ve angered a nation state, regardless of which, backups will be what saves you (assuming your not abducted and interrogated by the previously mentioned nation state). All these what ifs, is why it is the first item that will be given a more in-depth dive…

So what, exactly, is a backup? It is simply a ‘verified’ good copy of your data and/or anything you deem important that resides on a device of electronic storage. So items like Word docs, spending spreadsheets, family photos, recorded videos of your kids playing in the backyard, legal documents, and/or your music collection.

It is important to specify the following, that a copy is a copy, not the original. You cannot simply move your important data on a RAID 5 array and consider it backed up. It is also not moving the data onto an external storage medium. You must have more then a single copy of your important data. This means your original copy plus one, at a minimum. So you could keep your original on your laptop or desktop, with a copy on a file server. Maybe this file server has a RAID array… Maybe this server is linked to a DropBox account so an additional copy of the data will reside in the ‘cloud’… Maybe this server is also backed up onto a USB drive, be it a flash drive or an hard drive. This is the first step…

The second step, is the ‘verified’ backup or copy of your important data. So why do I quantify the ‘verified’ part in verified good backup, this is due to the fact, you do NOT have a backup if it hasn’t been tested. Tested to the point, that you have taken the time and effort to restore what you’ve backed up, to some other piece of storage medium you have access to and verified everything is there and you can access it. It is recommended to fully test your back up and restore functionality a least once a year. The more important data you could check at least every 6 months, more often as your comfortable.

To review, you only have a backup if… One, the data is not the original (as in it is a copy) and, Two, the data that is backed up or copied, is tested or verified to be available and in good condition in the event the time comes to restore it.

 

  •  Backups
    • If it’s important, have a backup
    • A backup is not moving the file(s) in question to an external drive and calling it ‘good to go’
    • 3-2-1
      • This means having at least 3 total copies of your data, 2 of which are local but on different mediums/devices/services, and at least 1 copy offsite.
      • 2 local
        • Your main computer
        • A secondary computer
        • An external hard drive you backup to
        • A NAS on your local network
      • 1 offsite
        • Data backup services
          • Backblaze
          • Cloudberry
          • Carbonite
          • Mozy
        • Online Storage Services
          • Google Drive
          • Dropbox
          • iCloud
        • External Media
          • HDD/Optical media
          • Media given to family or firends to store
          • Media placed in a Bank box
          • Media given to a lawyer

Security – Starting from the Inside

Posted on by mgy0knxycvop3nptyu87 in Security, Security - From the Inside Out!

So for the actual first post on this first series on the BWTS blog, we’re going on the ‘Inside’.

So with this, we will start looking at the networks endpoints, so your computers, servers, tablets, phones or in other words, the devices you tend to use. The general advice for all of these are:

  • Have the latest, currently supported Operating System installed
    • Apply all Operating System patches/updates/etc
      • More difficult with Android phone due to OS fragmentation
      • More difficult with OLDER Apple devices
  • Have anti-virus and anti-malware software installed
    • It is to be the most current and supported version
    • Ensure it’s definitions are current and updating properly
    • Yes, even Macs, iPhones, Android, and Linux…
    • Yes, I’m serious about this…
    • Malware is not just limited to Windows and being able to detect and stop the spread of malware (even if it doesn’t effect your platform of choice, is still a good choice)
    • Just think about it in terms of being a good neighbor on the Internet, OK?
  • Use a firewall if possible on your endpoints
    • Continue to tune and refine it, do not just set it and leave it
  • Use the most current and supported web browser
    • Recommended are Chrome and FireFox
      • Secondary recommendation for Brave
      • Tor Browser bundle with an honorable mention
    • Use adblocking/script stopping extensions/addons
      • Gorhill’s uBlock Origin
      • Noscript
      • Adblock Plus
    • Run inside of a sandbox
      • Sandboxie
      • If resources are available, create a VM to do general web browsing
        • VMware Workstation
        • VirtualBox
      • If sandboxing is not possible:
        • Boot off of a Linux boot CD/DVD
        • Install a version of Linux or BSD Operating System onto a spare computer
          • Ubuntu
          • Debian
          • Mint
          • FreeBSD
          • PCBSD
  • Use strong passwords
    • This advise seems to change with time, but what has stayed constant:
      • Make it as long as possible
      • Use it like a passphrase and not a password
        • Lyrics to a favorite song
        • Sentences
      • Complex
        • Use of upper and lower case characters, numbers, and special characters
    • Use a password manager and let it manage everything for you
      • Use a strong master password
      • KeePass
      • LastPass
  • Backups
    • If it’s important, have a backup
    • A backup is not moving the file(s) in question to an external drive and calling it ‘good to go’
    • 3-2-1
      • This means having at least 3 total copies of your data, 2 of which are local but on different mediums/devices/services, and at least 1 copy offsite.
      • 2 local
        • Your main computer
        • A secondary computer
        • An external hard drive you backup to
        • A NAS on your local network
      • 1 offsite
        • Data backup services
          • Backblaze
          • Carbonite
          • Mozy
        • Online Storage Services
          • Google Drive
          • Dropbox
          • iCloud
        • External Media
          • HDD/Optical media
          • Media given to family or firends to store
          • Media placed in a Bank box
          • Media given to a lawyer

It is important to note, there is no such thing as perfect security. So everything here will be best effort, because the closest you can get to ‘perfect’ security is a brand new computer, sealed in a concrete block and dropped into the ocean.

So stay tuned for more as get into the inside and work our way outside!

Security – From the Inside Out!

Posted on by mgy0knxycvop3nptyu87 in Security, Security - From the Inside Out!

So for the actual first post on the BWTS blog, we’re going to start a series. This will be an overview with deep dives on various topics, with today being the general overview.

So security for most, tends to be ‘I’ve installed a firewall and antivirus, so I’m all set’. In a much more perfect world, this could actually be the case. In ‘this’ world that we live in, it ends up being a lot more complicated. You must have security starting from the inside out, which is what we’ll endeavor to cover. This starts at your endpoints, so your computers, servers, tablets, phones or in other words, the devices you tend to use. This then moves outward, encompassing your switches, routers, firewalls, Internet connection and progresses to the ‘outside’, so all of your external services. These externals are things like your e-mail accounts (since most use a web mail service like Gmail and Yahoo, and do not host their own), social media, online financial accounts, etc.

It is important to note, there is no such thing as perfect security. So everything here will be best effort, because the closest you can get to ‘perfect’ security is a brand new computer, sealed in a concrete block and dropped into the ocean.

So stay tuned for more as get into the inside and work our way outside!