It seems that many users are receiving Phishing phone calls through Skype from a profile called 'ONLINE HELP'. This call, if answered, plays a recorded message telling the user that their computer is not protected and that they must go to visit www.hosog.com. If you do visit this site, it is riddled with malware. This is a phishing scam!
The user account that I have observed is drationlinehelpgb and shows as being registered in the US, but seems to have been taken down now. However, others have reported a user account of drajizonlinehelp, which appears to be registered in Afghanistan. This one is still live at the time of writing and is using the same 'ONLINE HELP' profile name. It would appear that new accounts are being created as the old ones are blocked by people and reported for abuse to Skype.
It is slightly worrying the number of people who are reporting having answered this call. If you receive any unsolicited calls through Skype from users outside your contacts, don't answer them. Indeed you should actually change your privacy settings in Skype if you haven't already. Choose the Privacy... menu item in the Skype menu to open up the Privacy settings tab in the Options dialog. Make sure that all the options are set to people in my Contact list only. I suggest that you also don't share your online status on the Web. You shouldn't now receive calls out of the blue from scammers.
The problem is that people are becoming trained into accepting connections in social media sites and it spills out into their other online activities. People still think that SPAM and phishing scams only happen over email. Actually, people are usually fairly vigilant with their email, so it is more likely to be successful if they try other avenues. Sophos did an experiment at the end of 2009 where they created two fictitious Facebook users, one with a profile picture of a rubber duck. They had thousands of people sign up to 'friend' them. How carefully do users check links from their 'friends'? It opens up a very good channel for SPAM and phishing attacks. As a general rule of thumb don't connect or share details with anyone you don't personally know through social media, voip, email, etc. Also, if you use these media channels a lot, you should think about investing in a security product to help protect you.
Showing posts with label malware. Show all posts
Showing posts with label malware. Show all posts
Thursday, 9 June 2011
Friday, 3 June 2011
Google email Accounts Compromise
I was asked to comment yesterday on the story that emerged about the Google mail accounts that were compromised over the last few days, so I thought I'd put some of my answers down here. First off, Google wasn't compromised; a set of phishing emails were sent out and a fake Gmail login set up to harvest login details. These were used to set up forwarding rules to copy mail to another account.
Unfortunately, although a large number of people are aware of phishing and are (to a certain extent) vigilant, it only takes one person within the organisation to fall for the attack to compromise security. The scammers are becoming better at targeting people and making the initial phishing contact more believable to some people. Phishing is not just about email, although that is the most common avenue for the initial contact. Social media is also commonly used and we have seen the use of SEO to force phishing sites to the top of search engine rankings as well. User education is the only real way out of this.
Could this be cyber espionage? I would think that is most likely given the profile of those targeted. Information is worth a lot of money and political weight. In recent years we have seen a decrease in attacks designed to deface/destroy/delay/deny services and information. Instead, we are now seeing information and identity theft as major goals. Viruses won't necessarily stop your computer from working, but they will use Trojans to steal your login credentials. Malware now will silently sign your machine up to botnets rather than perform an obviously malicious action.
What can companies like Google do to stop this? Well, they can improve their SPAM filtering for a start. It is possible to eliminate the vast majority of phishing emails, which would drastically reduce the problems. However, many of the major vendors aren't strong enough on this. Secondly, user education would help a lot, but can't always help you against the best social engineers. To be honest, though, the governments and organisations that these people work for shouldn't allow the use of gmail, or other accounts (which have fewer controls than a corporate email setup), for official business and should educate their users to use different passwords, be vigilant, etc.
Spear phishing is a more difficult one to combat as it targets a specific user or group of users that the attacker has knowledge of. If I know your habits and who your friends are then I can use that information to trick you much more easily. If you receive an email or Facebook message from your partner, do you hesitate before opening it? The reason this doesn't happen more is that it takes background research and, by definition, targets very few people. This technique is only relevant if you want what that specific user has access to. Hence it is more likely to be information that they were after.
Another way to combat these types of attack is to use one-time passwords as well, so that intercepting a single logon only gives you access during that session, and isn't valid in the future. However, tokens are prohibitively expensive for Google to hand out to everyone. There are other solutions such as SMS tokens, but these aren't all that cheap, when multiplied up by the number of gmail users, and aren't without their problems. Software token solutions such as Swivel, GrIDsure, FireID, etc., are possibly cost-effective enough to be implemented and could drastically reduce the success of these attacks. However, none of these stop the man-in-the-middle (MITM) attack, so you could still hijack the session and set up a forwarding rule to obtain a copy of all their mail. Google do allow you to set up alerts and have to validate changes through a 2-step process, but you have to enable this. This should be the default for all of these services. Perhaps they could also add a footer to all versions of the email to specify where it has been forwarded to.
How worrying is this sort of attack? Well, that depends. Most people can be socially engineered - look at Derren Brown! For the individual, spear phishing is unlikely to be a problem, but with a lack of education they may well fall for a bulk phishing scam anyway (thousands do or nobody would bother). However, for those with access to secrets or other valuable information, it is a serious issue. It all comes down to how good the attacker is. I believe that HM Treasury is the most attacked entity in this country and that is mostly for information rather than evading tax or performing Denial-of-Service, etc. They should be worried about this type of attack.
Unfortunately, although a large number of people are aware of phishing and are (to a certain extent) vigilant, it only takes one person within the organisation to fall for the attack to compromise security. The scammers are becoming better at targeting people and making the initial phishing contact more believable to some people. Phishing is not just about email, although that is the most common avenue for the initial contact. Social media is also commonly used and we have seen the use of SEO to force phishing sites to the top of search engine rankings as well. User education is the only real way out of this.
Could this be cyber espionage? I would think that is most likely given the profile of those targeted. Information is worth a lot of money and political weight. In recent years we have seen a decrease in attacks designed to deface/destroy/delay/deny services and information. Instead, we are now seeing information and identity theft as major goals. Viruses won't necessarily stop your computer from working, but they will use Trojans to steal your login credentials. Malware now will silently sign your machine up to botnets rather than perform an obviously malicious action.
What can companies like Google do to stop this? Well, they can improve their SPAM filtering for a start. It is possible to eliminate the vast majority of phishing emails, which would drastically reduce the problems. However, many of the major vendors aren't strong enough on this. Secondly, user education would help a lot, but can't always help you against the best social engineers. To be honest, though, the governments and organisations that these people work for shouldn't allow the use of gmail, or other accounts (which have fewer controls than a corporate email setup), for official business and should educate their users to use different passwords, be vigilant, etc.
Spear phishing is a more difficult one to combat as it targets a specific user or group of users that the attacker has knowledge of. If I know your habits and who your friends are then I can use that information to trick you much more easily. If you receive an email or Facebook message from your partner, do you hesitate before opening it? The reason this doesn't happen more is that it takes background research and, by definition, targets very few people. This technique is only relevant if you want what that specific user has access to. Hence it is more likely to be information that they were after.
Another way to combat these types of attack is to use one-time passwords as well, so that intercepting a single logon only gives you access during that session, and isn't valid in the future. However, tokens are prohibitively expensive for Google to hand out to everyone. There are other solutions such as SMS tokens, but these aren't all that cheap, when multiplied up by the number of gmail users, and aren't without their problems. Software token solutions such as Swivel, GrIDsure, FireID, etc., are possibly cost-effective enough to be implemented and could drastically reduce the success of these attacks. However, none of these stop the man-in-the-middle (MITM) attack, so you could still hijack the session and set up a forwarding rule to obtain a copy of all their mail. Google do allow you to set up alerts and have to validate changes through a 2-step process, but you have to enable this. This should be the default for all of these services. Perhaps they could also add a footer to all versions of the email to specify where it has been forwarded to.
How worrying is this sort of attack? Well, that depends. Most people can be socially engineered - look at Derren Brown! For the individual, spear phishing is unlikely to be a problem, but with a lack of education they may well fall for a bulk phishing scam anyway (thousands do or nobody would bother). However, for those with access to secrets or other valuable information, it is a serious issue. It all comes down to how good the attacker is. I believe that HM Treasury is the most attacked entity in this country and that is mostly for information rather than evading tax or performing Denial-of-Service, etc. They should be worried about this type of attack.
Saturday, 18 December 2010
HDD Tools & Other Malware Removal
Recently I had someone come to me with their laptop saying that they had a new anti-virus program that they didn't remember installing and that 'other things' on their laptop didn't seem to work any more. The same thing happened to a corporate desktop machine I was asked about a couple of weeks later, that was originally running McAfee. Finally, two days ago I saw another corporate machine running McAfee that was saying that it had a hard drive failure. A tool, called HDD Tools, then automatically ran to diagnose the problem and stated that if they purchased the full HDD Tools product then it could fix the problem.
Each of these was a piece of malware that had infected the machine and was trying to get the user to enter their credit card details into a website so that money can be taken from their account and maybe their card cloned. These malware programs go along with the fake anti-virus software that the APWG have reported a huge rise in recently. These are a collection of programs that purport to be useful software and will fix a problem that you are experiencing. The truth of the matter is that it is that software that is causing you the problems in the first place and paying them the money will just cause more trouble.
The later breed of scams using these supposedly useful tools do one of two things in general - either they cost you money and they may try to clone your card, or they will enlist your machine in a botnet. For a discussion of this type of malware and its proliferation, see this blog post.
Here I wanted to tell you a couple if simple steps to remove this type of software if you do get infected. Obviously, it should go without saying that you should do everything possible to try to avoid getting infected in the first place rather than try to recover from it - the damage may already be done. However, there are many similarities between them and you will need to remove them. A simple procedure can often work to get rid if them as follows (N.B. this will not always work and if you make a mistake you can make things much worse).
Each of these was a piece of malware that had infected the machine and was trying to get the user to enter their credit card details into a website so that money can be taken from their account and maybe their card cloned. These malware programs go along with the fake anti-virus software that the APWG have reported a huge rise in recently. These are a collection of programs that purport to be useful software and will fix a problem that you are experiencing. The truth of the matter is that it is that software that is causing you the problems in the first place and paying them the money will just cause more trouble.
The later breed of scams using these supposedly useful tools do one of two things in general - either they cost you money and they may try to clone your card, or they will enlist your machine in a botnet. For a discussion of this type of malware and its proliferation, see this blog post.
Here I wanted to tell you a couple if simple steps to remove this type of software if you do get infected. Obviously, it should go without saying that you should do everything possible to try to avoid getting infected in the first place rather than try to recover from it - the damage may already be done. However, there are many similarities between them and you will need to remove them. A simple procedure can often work to get rid if them as follows (N.B. this will not always work and if you make a mistake you can make things much worse).
- Detect that you have rogue software (malware) on your system. This isn't always hard as, in the case of HDD Tools, it will keep popping its window up and not allow you access to the C:\ drive of your computer. Other things to look for are if your AV product doesn't work or if you get strange services appearing in the Task Manager. Often the malware will stop Task Manager from running by disabling the Run command and the right-click functionality on the Taskbar. However, sometimes you can still get access to it by pressing Ctrl+Shift+Esc. Look for processes with random names; HDD Tools uses a number like 20418112.exe, that will change with each infected machine.
- Reboot your machine in Safe Mode by pressing F8 during boot (that's the function key F8, NOT press the F key then the 8 key). If your machine boots up normally then you didn't press F8 early enough - you need to reboot again. You need to go into Safe Mode as the malware will prevent you from deleting it normally by having a background service running. This will not be started in Safe Mode, so you can remove it.
- Once in Safe Mode, you can begin to remove the malware. First, you need to find out what the malware is and where it's stored. Mostly the malware won't appear in the list of installed programs so can't simply be uninstalled, but that's worth a check. However, sometimes this can be used to reinfect the machine, so be wary. If you have rogue software on your system then it will probably have created some kind of shortcut on the desktop or in the Start menu to make it seem legitimate. Have a look at where this points to and what the name of the file is. Other places to look are in the Startup folder and in the list of services installed on the machine. In the case of HDD Tools, it installs a desktop icon and Start menu folder.
- Navigate to the path in Windows Explorer to find all the files you are looking to remove, but don't remove them yet. HDD Tools stores its files in your temporary folder, e.g. C:\Documents and Settings\username\AppData\Local Settings\temp, or C:\users\username\AppData\Local\temp. You may need to show hidden files and folders to be able to see this folder in Windows Explorer by changing the settings in Folder Options.
- Run a file search on your machine to see if there are any other instances of those files anywhere else for you to remove.
- Run Regedit from the Run... command to open up the registry editor (Warning: messing around with the registry can ruin your machine). Now run a search for the filename in the registry.
- You will need to go through the registry to remove all references to the malware and any keys that it has created. In general, if the only entries in the key relate to the malware you can remove the key, otherwise just remove the values. These often appear in HKEY_LOCAL_MACHINE or HKEY_CURRENT _USER in the Software\Microsoft\Windows\CurrentVersion key.
- Once you have deleted these, you can go back and delete the original files.
- Reboot normally and check your machine.
It is still possible to get infected even if you have a properly managed device with Anti-virus software installed. The problem is that they are not 100% effective. See 'How secure is your AV Product?'
Saturday, 26 June 2010
System Recovery with Comodo's Time Machine
Comodo's Time Machine is a software application that runs on your Windows machine and periodically (either manually or automatically) takes snapshots of your system. You are then able to roll back to any of these snapshots in the future. Indeed you can jump backwards and forwards in the tree and new branches appear as you make changes to the system.
The idea behind it is that if you suffer any problems with corrupted software, malware, etc., then you can roll back to a known good state and start again. You can lock snapshots so that they don't get deleted and then clear out the ones that you don't want to keep any more. This is quite important, especially if you take automatic snapshots. You have to remember that every change made to the computer (i.e. every time you run it or change a file) the changes are stored. When a new snapshot is created, if you change a file you will have a new version on your system as well as the old one. Due to this, it requires a fair amount of space on your system. However, the upsides are fairly obvious.
I have been using it quite a lot recently on test boxes while performing testing of security software against various malware and other attacks. It enabled me to perform a test, roll back to the pre-test state and perform it again or try another attack from a fresh system. It greatly reduced the testing time for certain attacks as I wasn't having to deal with an imaging server, etc. For the normal user, however, this does mean that if you get infected with malware or something else goes wrong with your system, you can very quickly and easily roll back to a previous state and carry on working.
There are a few issues to keep in mind though. Firstly, as I've already mentioned, the space required can be quite large if you keep taking snapshots and don't clear previous ones off the system. Secondly, if you roll back your system, you won't have access to any new files or software that you have put on the system - you will need to roll forward again to get at these. Finally, I did have one or two occasions where the restore failed. When I say the restore failed, I mean one snapshot failed so that I couldn't boot into it. At the boot stage I had to select another snapshot to boot from. I could always find a snapshot the did work, but it is slightly worrying that there were occasions when the one I wanted wouldn't boot. This could be due to the fact that I was installing various service packs, updates and malware onto the system and switching between them many times, but it is still worth noting that you will require a full system backup and you must backup all your data regularly.
Of course there are other products out there that do the same thing and some reviewers say that they are better (e.g. Acronis). However, I found Comodo's Time Machine very easy to use and it is free. I'm not necessarily endorsing Comodo's product; I'm saying that this type of software is worth a look for keeping your systems running.
The idea behind it is that if you suffer any problems with corrupted software, malware, etc., then you can roll back to a known good state and start again. You can lock snapshots so that they don't get deleted and then clear out the ones that you don't want to keep any more. This is quite important, especially if you take automatic snapshots. You have to remember that every change made to the computer (i.e. every time you run it or change a file) the changes are stored. When a new snapshot is created, if you change a file you will have a new version on your system as well as the old one. Due to this, it requires a fair amount of space on your system. However, the upsides are fairly obvious.
I have been using it quite a lot recently on test boxes while performing testing of security software against various malware and other attacks. It enabled me to perform a test, roll back to the pre-test state and perform it again or try another attack from a fresh system. It greatly reduced the testing time for certain attacks as I wasn't having to deal with an imaging server, etc. For the normal user, however, this does mean that if you get infected with malware or something else goes wrong with your system, you can very quickly and easily roll back to a previous state and carry on working.
There are a few issues to keep in mind though. Firstly, as I've already mentioned, the space required can be quite large if you keep taking snapshots and don't clear previous ones off the system. Secondly, if you roll back your system, you won't have access to any new files or software that you have put on the system - you will need to roll forward again to get at these. Finally, I did have one or two occasions where the restore failed. When I say the restore failed, I mean one snapshot failed so that I couldn't boot into it. At the boot stage I had to select another snapshot to boot from. I could always find a snapshot the did work, but it is slightly worrying that there were occasions when the one I wanted wouldn't boot. This could be due to the fact that I was installing various service packs, updates and malware onto the system and switching between them many times, but it is still worth noting that you will require a full system backup and you must backup all your data regularly.
Of course there are other products out there that do the same thing and some reviewers say that they are better (e.g. Acronis). However, I found Comodo's Time Machine very easy to use and it is free. I'm not necessarily endorsing Comodo's product; I'm saying that this type of software is worth a look for keeping your systems running.
Monday, 10 May 2010
Series of Demo Videos of Trusteer's Rapport
I am currently producing a series of videos demonstrating the anti-spyware capabilities of Trusteer's Rapport. So far I have looked at keylogging software and screen capture. Specifically, I have demonstrated it with Zemana ScreenLogger, Zemana KeyLogger and SpyShelter. I will be adding more videos over the next few days. The first two videos are embedded below. (Edit: 17/05/10 - I have now added three more videos covering Zemana SSL Logger, AKLT and Snadboy's Revelation V2.)
Links to the YouTube videos are below:
Links to the YouTube videos are below:
- Trusteer's Rapport Demo 1 - Zemana ScreenLogger
- Trusteer's Rapport Demo 2 - Zemana KeyLogger
- Trusteer's Rapport Demo 3 - SpyShelter
- Trusteer's Rapport Demo 4 - AKLT
- Trusteer's Rapport Demo 5 - Zemana SSL Logger
- Trusteer's Rapport Demo 6 - Snadboy's Revelation V2
- Trusteer's Rapport Demo 7 - Pharming Attack
- Trusteer's Rapport Demo 8 - Amecisco Invisible Keylogger Stealth
- Trusteer's Rapport Demo 9 - Anti-Phishing Protection
Wednesday, 17 February 2010
Keylogging Trusteer's Rapport
Let's get some perspective on this first: no security product is 100% secure and just because there may be an obscure way round a product doesn't mean you shouldn't use it and that it won't protect you against a lot of attacks. How secure is your Anti-Virus (AV) product? Certainly not 100%, so we need layers of security. Rapport is another layer of security and could help protect your machine.
I have said in my previous post about this issue how well Trusteer dealt with me. So, now to the method of keylogging Trusteer. It's quite simple really, but requires a special setup. Rapport hooks onto the keyboard driver to prevent keylogging. However, if you invoke the remote desktop feature in Windows then a different keyboard driver is invoked, which Rapport cannot hook onto. So, if you're using a remote desktop connection into your machine then Rapport will not be giving you the full protection (it still has other layers of protection that work in this scenario).
Is this such a special case that you don't need to worry about it? Well not necessarily. There are a plethora of remote access software solutions available to users who are increasingly using them to access their machines at home or at work. There is also another technology that can be leveraged to cause this effect whilst the user is at the actual machine. Microsoft have introduced RemoteApps to the Windows desktop environment to allow for legacy applications to appear to run seamlessly on Windows 7. This is done via Virtual PC running another OS and the RAIL QFE update to allow applications to be exposed from a desktop machine as RemoteApps. However, we can use this technique to look back at the machine and expose the web browser as a RemoteApp, which the user should not notice.
As I say, it's a special case and not one a user would normally encounter, but it is possible. There are other issues with Trusteer as well, being able to capture the screen of protected websites and information leakage as highlighted on ReviewMyLife.co.uk here. It doesn't mean you shouldn't use Rapport though, just know and trust the machine that you're using. Basically, don't ever connect to any secure site or service from an untrusted machine, no matter what's installed on it.
I have said in my previous post about this issue how well Trusteer dealt with me. So, now to the method of keylogging Trusteer. It's quite simple really, but requires a special setup. Rapport hooks onto the keyboard driver to prevent keylogging. However, if you invoke the remote desktop feature in Windows then a different keyboard driver is invoked, which Rapport cannot hook onto. So, if you're using a remote desktop connection into your machine then Rapport will not be giving you the full protection (it still has other layers of protection that work in this scenario).
Is this such a special case that you don't need to worry about it? Well not necessarily. There are a plethora of remote access software solutions available to users who are increasingly using them to access their machines at home or at work. There is also another technology that can be leveraged to cause this effect whilst the user is at the actual machine. Microsoft have introduced RemoteApps to the Windows desktop environment to allow for legacy applications to appear to run seamlessly on Windows 7. This is done via Virtual PC running another OS and the RAIL QFE update to allow applications to be exposed from a desktop machine as RemoteApps. However, we can use this technique to look back at the machine and expose the web browser as a RemoteApp, which the user should not notice.
As I say, it's a special case and not one a user would normally encounter, but it is possible. There are other issues with Trusteer as well, being able to capture the screen of protected websites and information leakage as highlighted on ReviewMyLife.co.uk here. It doesn't mean you shouldn't use Rapport though, just know and trust the machine that you're using. Basically, don't ever connect to any secure site or service from an untrusted machine, no matter what's installed on it.
Friday, 12 February 2010
Trusteer's Response to Issues with Rapport
I have been getting a lot of hits on this blog relating to Trusteer's Rapport, so I thought I would take a better look at the product. During my investigations, I was able to log keystrokes on a Windows 7 machine whilst accessing NatWest. However, the cause is as yet unknown as Rapport should be secure against this keylogger, so I'm not going to share the details here yet (there will be a video once Trusteer are happy there is no further threat).
I have had quite a dialogue with Trusteer over this potential problem and can report that their guys are pretty switched on, they picked up on this very quickly and are taking it extremely seriously. They are also realistic about all security products and have many layers of security in place within their own product. No security product is 100% secure - it can't be. The best measure of a product, in my opinion, is the company's response to potential problems. I have to admit that Trusteer have been exemplary here.
Why do I keep saying it's a potential problem when I have logged keystrokes? Well, under normal operating conditions this isn't possible with the keylogger used. Most home users won't have a machine set up like the test machine in this case.
Trusteer have also pointed out that keyloggers are not the main threat facing the banks at the moment and are of less use now than in the past. Rapport has several layers of security protecting the machine beyond keyloggers and blocking screen capture. One of he major plus points about Rapport is their anti-phishing and anti-pharming technologies. Although, again, these aren't perfect, it's better than nothing.
I don't agree totally with Trusteer here though. The problem with being able to log typed characters comes back to weak passwords and single-factor authentication. In this case, NatWest seem to require a customer ID, consisting of the user's date of birth and a 4 digit ID in the format ddmmyyxxxx, a 4 digit PIN and only a short password. Now, they will let any Customer ID through in this format whether it's valid or not (good from a security point of view as you don't know if you've got a valid Customer ID or not). However, clearly they allow 6 character passwords and then ask for three of them. So with one capture I can have 3 out of 4 PIN digits and half the password. We know people choose weak passwords that can be guessed. This becomes a crossword puzzle to make a 6 character password given three known characters. I would agree with Trusteer that keyloggers and screen capture shouldn't be a problem now, but it still is, as the banks cling onto simple username and password authentication, often with poor password policies.
If the banks move to 2-factor authentication and one-time passwords then most of this would be redundant, and Trusteer could concentrate on pushing us off to the correct site to avoid phishing and pharming attacks. Of course, these will become even more prevelant and sophisticated. Technology can't stop this alone, it has to be coupled with user education. Screen capture can still cause problems with strong authentication solutions, such as those using images or on-screen grids to generate one-time passwords.
So, what's the bottom line? Since my earlier posts, Rapport has come a long way with compatibility, etc. The tone of the marketing has also changed for the better and is more realistic (although some of the 44 partner banks could be doing more). So Rapport could be an additional layer of security to protect you, but you will still have to be vigilant. You must have an up-to-date, legitimate anti-virus/anti-malware product, firewall protection, tight controls on your browser and a cautious and skeptical approach to all communiations and links. Without these, Rapport isn't going to help you anyway.
Edit: video in later post - Keylogging Trusteer's Rapport
I have had quite a dialogue with Trusteer over this potential problem and can report that their guys are pretty switched on, they picked up on this very quickly and are taking it extremely seriously. They are also realistic about all security products and have many layers of security in place within their own product. No security product is 100% secure - it can't be. The best measure of a product, in my opinion, is the company's response to potential problems. I have to admit that Trusteer have been exemplary here.
Why do I keep saying it's a potential problem when I have logged keystrokes? Well, under normal operating conditions this isn't possible with the keylogger used. Most home users won't have a machine set up like the test machine in this case.
Trusteer have also pointed out that keyloggers are not the main threat facing the banks at the moment and are of less use now than in the past. Rapport has several layers of security protecting the machine beyond keyloggers and blocking screen capture. One of he major plus points about Rapport is their anti-phishing and anti-pharming technologies. Although, again, these aren't perfect, it's better than nothing.
I don't agree totally with Trusteer here though. The problem with being able to log typed characters comes back to weak passwords and single-factor authentication. In this case, NatWest seem to require a customer ID, consisting of the user's date of birth and a 4 digit ID in the format ddmmyyxxxx, a 4 digit PIN and only a short password. Now, they will let any Customer ID through in this format whether it's valid or not (good from a security point of view as you don't know if you've got a valid Customer ID or not). However, clearly they allow 6 character passwords and then ask for three of them. So with one capture I can have 3 out of 4 PIN digits and half the password. We know people choose weak passwords that can be guessed. This becomes a crossword puzzle to make a 6 character password given three known characters. I would agree with Trusteer that keyloggers and screen capture shouldn't be a problem now, but it still is, as the banks cling onto simple username and password authentication, often with poor password policies.
If the banks move to 2-factor authentication and one-time passwords then most of this would be redundant, and Trusteer could concentrate on pushing us off to the correct site to avoid phishing and pharming attacks. Of course, these will become even more prevelant and sophisticated. Technology can't stop this alone, it has to be coupled with user education. Screen capture can still cause problems with strong authentication solutions, such as those using images or on-screen grids to generate one-time passwords.
So, what's the bottom line? Since my earlier posts, Rapport has come a long way with compatibility, etc. The tone of the marketing has also changed for the better and is more realistic (although some of the 44 partner banks could be doing more). So Rapport could be an additional layer of security to protect you, but you will still have to be vigilant. You must have an up-to-date, legitimate anti-virus/anti-malware product, firewall protection, tight controls on your browser and a cautious and skeptical approach to all communiations and links. Without these, Rapport isn't going to help you anyway.
Edit: video in later post - Keylogging Trusteer's Rapport
Friday, 15 January 2010
How secure is your AV Product?
We all use (or at least we should all use) an Anti-Virus (AV) product on our computer to protect it from malware (yes, that includes you Mac and Linux users as well). Rogue Anti-Malware is on the increase and users should be wary of what they install, but if we do choose a big vendor and pay money for it, does it protect our machine from all threats?
Well the answer is no. No security product can be 100% secure, but how secure are they actually? There have been a number of recent surveys and their results show that things are probably improving, but there's still a significant gap. AV-Comparatives.org showed that in their tests, G Data was the best with a 99.8% detection rate of known malware, with Norman being the worst of the 16 at 84.8%. Known malware was taken to be malware from a period of one year that ended 8 months prior to the test. This is important to stress; these weren't new malware instances, these were old known malware that all vendors will have seen and had time to develop their product to combat.
There's another potential issue as well. What settings do you use on your AV product? Do you use the default settings? Several products do come with the highest protection set as default, but not all. Kaspersky, Symantec and Sophos, for example, don't have the highest security settings by default (although Sophos, to their credit, asked AV-Comparatives to test them with default settings, unlike the other two who asked to be tested with settings changed to high security). McAfee use a cloud-based technology called Artemis, which is on by default, but requires an internet connection. Their test scores come down from 98.7% detection rate when online to 92.6% when offline. So be wary about the settings that you use and the mode of use as well, as it can make a big difference.
AV-Test.org also performed similar tests with more current malware, with similar results. In their tests, Symantec came out top with a score of 98% malware detected and Trend Micro with 83.3%. I'll pick out a few big names so that I can give you average figures from both testing labs.
This isn't the full story though. The above tests are detected existing malware. There are two other metrics that we need to look at. The first of these is the removal or blocking rate. This is the percentage of malware instances that were blocked or removed by the AV product. The others will have infected the machine. AV-Test.org correctly point out that this is a much more important metric than detected malware, as if an AV product detects it but still allows it to install, then you are only marginally better off than if you didn't know about it at all - your machine is still infected. Their tests show that the blocking rates are a chunk down from the detection rates, with the best now being PC Tools at 94.8% and the worst being CA Internet Security at 73.5%. Blocking rate figures for the set of AV products are also given in the table above.
The final thing to consider is the detection rate of new malware that hasn't been seen before, i.e. from live attacks. Cyveillance performed a set of tests sending live attack malware through a set of the top AV products on a daily basis to see how they performed. In their tests, cloud-based McAfee came out top at 44% and VirusBuster bottom on 16%. AV-Comparatives performed a similar test and came out with slightly better results, ranging from AVIRA on 74% down to Norman on 32%. Again, I have averaged their figures to include in the table above.
Conclusion: you could use more than one AV product as long as they don't conflict. However, it is essential that you keep the product up-to-date at all times and configure it for maximum protection.
Well the answer is no. No security product can be 100% secure, but how secure are they actually? There have been a number of recent surveys and their results show that things are probably improving, but there's still a significant gap. AV-Comparatives.org showed that in their tests, G Data was the best with a 99.8% detection rate of known malware, with Norman being the worst of the 16 at 84.8%. Known malware was taken to be malware from a period of one year that ended 8 months prior to the test. This is important to stress; these weren't new malware instances, these were old known malware that all vendors will have seen and had time to develop their product to combat.
There's another potential issue as well. What settings do you use on your AV product? Do you use the default settings? Several products do come with the highest protection set as default, but not all. Kaspersky, Symantec and Sophos, for example, don't have the highest security settings by default (although Sophos, to their credit, asked AV-Comparatives to test them with default settings, unlike the other two who asked to be tested with settings changed to high security). McAfee use a cloud-based technology called Artemis, which is on by default, but requires an internet connection. Their test scores come down from 98.7% detection rate when online to 92.6% when offline. So be wary about the settings that you use and the mode of use as well, as it can make a big difference.
AV-Test.org also performed similar tests with more current malware, with similar results. In their tests, Symantec came out top with a score of 98% malware detected and Trend Micro with 83.3%. I'll pick out a few big names so that I can give you average figures from both testing labs.
| Product | Existing Detection | Blocking | Live Detection |
|---|---|---|---|
| Symantec | 98.2% | 92.8% | 35.5% |
| Kaspersky | 96.1% | 89.9% | 41.0% |
| McAfee | 93.0% | 86.7% | 45.5% |
| AVG | 93.1% | 84.2% | 40.0% |
| F-Secure | 91.9% | 80.2% | 42.0% |
This isn't the full story though. The above tests are detected existing malware. There are two other metrics that we need to look at. The first of these is the removal or blocking rate. This is the percentage of malware instances that were blocked or removed by the AV product. The others will have infected the machine. AV-Test.org correctly point out that this is a much more important metric than detected malware, as if an AV product detects it but still allows it to install, then you are only marginally better off than if you didn't know about it at all - your machine is still infected. Their tests show that the blocking rates are a chunk down from the detection rates, with the best now being PC Tools at 94.8% and the worst being CA Internet Security at 73.5%. Blocking rate figures for the set of AV products are also given in the table above.
The final thing to consider is the detection rate of new malware that hasn't been seen before, i.e. from live attacks. Cyveillance performed a set of tests sending live attack malware through a set of the top AV products on a daily basis to see how they performed. In their tests, cloud-based McAfee came out top at 44% and VirusBuster bottom on 16%. AV-Comparatives performed a similar test and came out with slightly better results, ranging from AVIRA on 74% down to Norman on 32%. Again, I have averaged their figures to include in the table above.
Conclusion: you could use more than one AV product as long as they don't conflict. However, it is essential that you keep the product up-to-date at all times and configure it for maximum protection.
Friday, 4 December 2009
Proposed Pseudo-Code for Hacking Process
It is quite common in Information Systems to use pseudo code to describe a process. I have often thought that the same principle can be applied to the process of hacking an organisation, which may help people understand the process and how to protect themselves. Below is my proposal for this pseduo-code for the hacking process. This is very much a work in progress. I would welcome feedback on it and I will update it as suggestions are made or as I feel it needs revising.
organisation = proposed target
organisation.footprint(value, effort, risk)
profit = value - (effort * risk)
if profit > 0 then
organisation.enumerate()
select attack_type
case DoS
engage_botnet(myBotnet)
myBotnet.launchDDoS(organisation)
case Access
organisation.gainAccess(myAccount)
myAccount.Elevate()
organisation.installBackdoor(myAccount)
organisation.cleanUP()
end select
else
exit
end if
This highlights the fact that we only need enough security to make it not worthwhile attacking, i.e. it will cost the attacker more to compromise our system than they will gain. Who would spend £1m to get £10 worth of information? We don't need (indeed cannot have) absolute security, just enough to protect our system. It also highlights another interesting point. Perhaps we should make our countermeasures public - not the actual implementational details or versions, but the fact that they are in place, e.g. that we have an IDS. Consider blatant versus hidden CCTV cameras. Cameras in plain sight deter most criminals, whereas hidden cameras spy on criminals while they perpetrate their crime.
We want to make the risk of being caught/prosecuted value high, so that hackers require a higher value:effort ratio, which we won't give them. Given two identically protected organisations with the same value, would you attack the one that doesn't monitor activity or the one that does?
Obviously, the above is very vague and doesn't provide methods to complete these tasks, but that is not the point of this post. Backdoors and Trojans are usually relatively easy to install if you have the right level of access to the system, so much of your security is going to hang on stopping a hacker from gaining access. Gaining access to an organisation is usually performed in one of four main ways:
organisation = proposed target
organisation.footprint(value, effort, risk)
profit = value - (effort * risk)
if profit > 0 then
organisation.enumerate()
select attack_type
case DoS
engage_botnet(myBotnet)
myBotnet.launchDDoS(organisation)
case Access
organisation.gainAccess(myAccount)
myAccount.Elevate()
organisation.installBackdoor(myAccount)
organisation.cleanUP()
end select
else
exit
end if
This highlights the fact that we only need enough security to make it not worthwhile attacking, i.e. it will cost the attacker more to compromise our system than they will gain. Who would spend £1m to get £10 worth of information? We don't need (indeed cannot have) absolute security, just enough to protect our system. It also highlights another interesting point. Perhaps we should make our countermeasures public - not the actual implementational details or versions, but the fact that they are in place, e.g. that we have an IDS. Consider blatant versus hidden CCTV cameras. Cameras in plain sight deter most criminals, whereas hidden cameras spy on criminals while they perpetrate their crime.
We want to make the risk of being caught/prosecuted value high, so that hackers require a higher value:effort ratio, which we won't give them. Given two identically protected organisations with the same value, would you attack the one that doesn't monitor activity or the one that does?
Obviously, the above is very vague and doesn't provide methods to complete these tasks, but that is not the point of this post. Backdoors and Trojans are usually relatively easy to install if you have the right level of access to the system, so much of your security is going to hang on stopping a hacker from gaining access. Gaining access to an organisation is usually performed in one of four main ways:
- Malware
- Sniffing
- Direct Attack
- Social Engineering
- Installing Antivirus/Antispyware
- Latest OS and Application Patches
- Enterprise-level firewall, with IDS/IPS, AV, etc.
- Personal firewalls on all mobile devices
- Secure, hardened configurations
- Browser lock-down
- Encrypted communication (e.g. SSL/TLS, VPN, etc.)
- User Education!
The last point is often overlooked as a critical security practice. Please feel free to comment.
Thursday, 1 October 2009
APWG Report 1st Half 2009
On 27th September the APWG released their First Half 2009 Phishing Trends Report. This provides some interesting/worrying reading. Most notably is the rise and rise of rogue anti-malware programs.
Rogue anti-malware programs are programs that run on a user's machine and falsely identify malware infections. They then inform users that the malware can be removed by purchasing their anti-malware program. The installed software, in many cases, does absolutely nothing. The malware author has made their money off the user and doesn't care about them or the fact that their machine is left vulnerable to other malware. However, there is another breed of rogue anti-malware that will install other malware onto the user's machine, often adding them to botnets or adding trojans and spyware. According to Panda Labs' Luis Corrons, rogue anti-malware programs are proliferating with "exponential growth. In the first quarter of 2009 alone, more new strains were created than in all of 2008. The second quarter painted an even bleaker picture, with the emergence of four times as many samples as in all of 2008."
Most of these rogue anti-malware programs have a common root - they even look the same. So how come they aren't detected as malware? Well, often they employ server-side obfuscation so that each version is slightly different, thus defeating some signature-based scans. Also, you have to remember that many of these don't perform any malicious actions and, therefore, don't trigger other alarms.
What can we do about rogue anti-malware? Well, simply don't trust anything on the Web saying that you are infected or that they will scan you for free. Do not install any anti-malware from a company that you do not know and always check for validity of links and downloads. There are many companies out there providing free basic anti-malware or sophisticated products for a relatively low price that are legitimate, such as: Panda Security, AVG, Comodo, Symantec, etc. If you do get infected by one of these programs then you need to remove it. Instructions for removing the most common ones can be found at http://www.anti-malware-blog.com/ - N.B. be warned that I have not assessed or validated their instructions and there is no guarantee that they won't cause other problems.
What about the rest of the report? Well, phishing is still on the increase, with reported phishing highs for the first half of the year exceeding those of last year significantly (about 7%). 21,856,361 computers were scanned to determine host infection rates. 11,937,944 were found to be infected (54%), which is an increase of over 66% from the last quarter of 2008. Banking trojan/password stealing crimeware infections rose by more than 186%. Finally, payment services have taken the top spot in the most targeted industry sector from the financial sector, although this is still a close second. To see how this compares, a previous blog post of mine on this shows how things have changed.
For more information about the Anti-Phishing Working Group, to report phishing attacks or to see their reports yourself, visit http://apwg.org/
Monday, 31 August 2009
ATM & Bank Card Security
I recently read an article in New Scientist entitled "Want to clone bank cards? Just press 'print'". They state that it has been discovered that
"... a devious piece of criminal coding that has been quietly at work in a clutch of cash machines at banks in Russia and Ukraine. It allows a gang member to walk up to an ATM, insert a "trigger" card, and use the machine's printer to produce a list of all the debit card numbers used that day, including their start and expiry dates - and their PINs. Everything needed, in fact, to clone those cards and start emptying bank accounts."
This is possible because ATM Terminal vendors have succumbed to financial pressures, and the demand for greater functionality, and moved to using standard modular PC architectures and off-the-shelf operating systems, such as Microsoft Windows and Linux. These ATM devices then become vulnerable to similar malware as their desktop counterparts.
SpiderLabs, part of Trustwave, identified that in this case a new version of the 50KB lsass.exe Windows XP file is loaded onto the system via a compromised Borland Delphi installer utility, isadmin.exe (note, that's LSASS.EXE, not 1SASS.EXE as some have reported). You can view the full report from Trustwave as a PDF here. The legitimate lsass.exe executable is used to cache session data in Windows, so that users don't have to re-enter passwords when receiving new emails or returning to a website, which is essentially what the malware developers want to do with the card data. Actually, this has no place on an ATM, but may not be picked up, due to the fact that it is, by default, on most Windows XP installs.
If a trigger card is not detected, the malware stores the transaction data to a file called tr12 and key or PIN data to a file called k1 in the C:/WINDOWS directory. If a trigger card is detected, then a menu of 10 options is displayed for 10 seconds, with functions including: uninstalling, deleting logs, printing logs via the built-in printer encrypted with DES and possibly the ability to export the data onto the trigger card. This particular malware only works on transactions in US dollars, Russian Rouble or Ukrainian Hryvnia. It is also said that chip-and-PIN cards across Europe are not vulnerable to this malware as the PIN is encrypted in the secure PIN pad.
It has been speculated that deploying the malware was either an inside job or the result of bribes and threats; the reasoning being that an attacker would have to have physical access to the ATM to deploy the malware. However, the ATMs and banking network, although separate from the Internet, have not necessarily been hardened enough. Back on 25th November 2003 the first known case of a worm (Welchia) infecting Windows XP based ATM machines was reported, which used the closed financial network to propagate. This was possible because the ATMs weren't patched by the financial institutions in question. This brings on the whole problem of patch management on ATMs as well as placing greater restrictions on the financial networks. How long will it be before keyloggers are available for chip-and-PIN cards as well?
Tuesday, 16 June 2009
Trojan Keylogger Screensaver Compromising Novell Client for Windows
I've been talking about 2-factor authentication and improving authentication mechanisms for a while now and trying to get companies to implement such solutions. One such organisation uses the Novell client for Windows on Windows XP. When a user attempts to log in they are not required to press Ctrl+Alt+Del. Many forums and reviews state that this is an advantage, as users don't like it! The point of pressing Ctrl+Alt+Del (CAD) on Windows is to stop all applications from running and kill Trojans, etc. Novell have replaced the MSGina.dll with NWGina.dll so that they can capture the CAD key combination. This is the standard way to override the built-in login screen and replace it with a custom one. However, Novell have decided to allow administrators to eliminate the need for the CAD key combination. This, obviously reduces the overall security of the system.
I know that there are many ways to write a keylogger, some more sophisticated than others, but a lot of these low-level system keyloggers can be picked up by AV (Anti-Virus) software. I wanted to show that you don't need to be able to create this type of keylogger to obtain the username/password combination from a system that doesn't require the CAD key combination. Another reason for not going down this route is that I wanted to show that this could be put on a live system, not just in the lab. Therefore, it mustn't trigger the AV when installed or when running. The solution I decided to try was to write a screensaver to mimic the Novell login screen, capture the username/password, write these to a web service and then hand back to the real Novell client.
I have just listed a few things there without explanation. Why don't I just take the details and log the user in myself, then pass the username/password to my web service? Well, this would require either modifications to the NWGina or System calls that would trigger the AV and other protection mechanisms. I wanted this to remain undetected. Basically, a screensaver is just an application that is run automatically, rather than explicitly by the user. Indeed, when you write a screensaver you produce an .exe file and just rename it as .scr. Obviously there are a few things you have to do to make it function as a screensaver, like be full-screen and always on top. You also have to handle mouse and keyboard events to end the screensaver and return control of the desktop to the user. However, instead of immediately exiting our application and returning control, why not pop up another form to mimic the login dialog and fool users into giving us their password? It's easy really.
So what do we do once the user has entered their details? Well, the screensaver writes the data to a simple web handler that I wrote for this purpose. All it does is take an HTTP GET request with URL parameters and return a simple text confirmation to the screensaver. I don't care that it's in plaintext and somebody might read it. Obviously, I would have to anonymize the server so that it couldn't be traced, but I'm not actually trying to deploy this. Once the screensaver has confirmation that the username/password have been logged, then it displays the 'incorrect password' dialog and immediately exits to reveal the real login dialog. In this way, the user will most likely think that they have mistyped their password. As a little trick, I decided to make the ruse more plausible by turning the CAPS Lock on as soon as the user clicks the login button.
The final thing to evade detection was to set a limit as to how many times the Trojan would appear. Nobody mistypes their password the first time they log in every time, so I decided that a 1 in 5 rule would probably be acceptable. Here I assumed that users might accept that they have mistyped their password 1 in 5 times, particularly with the CAPS Lock trick as well. You could go for a lot less than this, but then you'd have to make sure it was on the machine for a while to capture the passwords. Again, this is simple to do, generate a pseudo-random number to determine whether to show the Trojan dialog or exit the program.
Having written the screensaver I had to test it. Well, I have access to a corporate laptop and desktop with the Novell client on and McAfee AV software. It works a treat. Very realistic and not picked up by the AV. I have asked people to look at it and try it (without using their real username/password combination) and they have said that they wouldn't have realised. I'm not sure it's particularly ethical to try this on a real network, so I'll probably leave it there, however there is still the issue of mass distribution of such a Trojan. I don't believe that this will be terribly difficult though, especially if using a bit of social engineering as well.
So, how do you defeat this method? Don't disable CAD, or if it is disabled then press it anyway!
I know that there are many ways to write a keylogger, some more sophisticated than others, but a lot of these low-level system keyloggers can be picked up by AV (Anti-Virus) software. I wanted to show that you don't need to be able to create this type of keylogger to obtain the username/password combination from a system that doesn't require the CAD key combination. Another reason for not going down this route is that I wanted to show that this could be put on a live system, not just in the lab. Therefore, it mustn't trigger the AV when installed or when running. The solution I decided to try was to write a screensaver to mimic the Novell login screen, capture the username/password, write these to a web service and then hand back to the real Novell client.
I have just listed a few things there without explanation. Why don't I just take the details and log the user in myself, then pass the username/password to my web service? Well, this would require either modifications to the NWGina or System calls that would trigger the AV and other protection mechanisms. I wanted this to remain undetected. Basically, a screensaver is just an application that is run automatically, rather than explicitly by the user. Indeed, when you write a screensaver you produce an .exe file and just rename it as .scr. Obviously there are a few things you have to do to make it function as a screensaver, like be full-screen and always on top. You also have to handle mouse and keyboard events to end the screensaver and return control of the desktop to the user. However, instead of immediately exiting our application and returning control, why not pop up another form to mimic the login dialog and fool users into giving us their password? It's easy really.
So what do we do once the user has entered their details? Well, the screensaver writes the data to a simple web handler that I wrote for this purpose. All it does is take an HTTP GET request with URL parameters and return a simple text confirmation to the screensaver. I don't care that it's in plaintext and somebody might read it. Obviously, I would have to anonymize the server so that it couldn't be traced, but I'm not actually trying to deploy this. Once the screensaver has confirmation that the username/password have been logged, then it displays the 'incorrect password' dialog and immediately exits to reveal the real login dialog. In this way, the user will most likely think that they have mistyped their password. As a little trick, I decided to make the ruse more plausible by turning the CAPS Lock on as soon as the user clicks the login button.
The final thing to evade detection was to set a limit as to how many times the Trojan would appear. Nobody mistypes their password the first time they log in every time, so I decided that a 1 in 5 rule would probably be acceptable. Here I assumed that users might accept that they have mistyped their password 1 in 5 times, particularly with the CAPS Lock trick as well. You could go for a lot less than this, but then you'd have to make sure it was on the machine for a while to capture the passwords. Again, this is simple to do, generate a pseudo-random number to determine whether to show the Trojan dialog or exit the program.
Having written the screensaver I had to test it. Well, I have access to a corporate laptop and desktop with the Novell client on and McAfee AV software. It works a treat. Very realistic and not picked up by the AV. I have asked people to look at it and try it (without using their real username/password combination) and they have said that they wouldn't have realised. I'm not sure it's particularly ethical to try this on a real network, so I'll probably leave it there, however there is still the issue of mass distribution of such a Trojan. I don't believe that this will be terribly difficult though, especially if using a bit of social engineering as well.
So, how do you defeat this method? Don't disable CAD, or if it is disabled then press it anyway!
Wednesday, 10 June 2009
How to tell if your Firewall is a full DMZ
Most firewalls have a 'DMZ' setting, but are they actually a full DMZ firewall? DMZ is a term often used in network security, but it can mean two different things to manufacturers and practitioners. Technically, there is no such thing as a DMZ in a firewall architecture, only a screened-subnet firewall, screened-host firewall or an exposed host, but the term is the industry standard when talking about allowing access to information servers (e.g. web, mail, etc.) from the Internet.
So what is a DMZ? DMZ stands for Demilitarized Zone and is, obviously, a military term for the no-go area between two armies where no military activity is allowed. However, in network security terms it is a secure subnet that separates the Internet from the internal machines on your network. This becomes a logical place to implement any Information Servers, as these can be partially opened to the Internet, whilst not allowing direct access to the internal network. So are all DMZ firewalls the same? Well, no they aren't. They range from small SoHo (Small Office/Home Office) routers up to full enterprise-level firewalls. Of course the majority of SoHo routers are not DMZ firewalls at all; their DMZ features are actually exposed hosts, which have less protection than a normal machine and little or no separation from the internal network. This is bad, as any successful attack on the exposed host now has free range over the internal network.
Moving towards proper enterprise firewalls, we still have two different types of firewall often referred to as a DMZ firewall; they are either logical or physical DMZ firewalls. Obviously, the physical DMZ firewall offers the best level of security, but what's the difference? The difference is that they are a screened-host and a screened-subnet firewall respectively. Although your firewall arrives as a single rack-mounted unit, internally it is made up of a set of components - most notably packet filtering routers and a bastion host. The packet filtering routers simply permit or deny access based on IP address, TCP port number or protocol type. More sophisticated functionality is implemented by using proxies on the secure bastion host. The diagram below shows the logical setup of a full DMZ firewall, with a separate screened-subnet (purple) between the insecure Internet (red) and the secure Intranet (green).
So what is a DMZ? DMZ stands for Demilitarized Zone and is, obviously, a military term for the no-go area between two armies where no military activity is allowed. However, in network security terms it is a secure subnet that separates the Internet from the internal machines on your network. This becomes a logical place to implement any Information Servers, as these can be partially opened to the Internet, whilst not allowing direct access to the internal network. So are all DMZ firewalls the same? Well, no they aren't. They range from small SoHo (Small Office/Home Office) routers up to full enterprise-level firewalls. Of course the majority of SoHo routers are not DMZ firewalls at all; their DMZ features are actually exposed hosts, which have less protection than a normal machine and little or no separation from the internal network. This is bad, as any successful attack on the exposed host now has free range over the internal network.
Moving towards proper enterprise firewalls, we still have two different types of firewall often referred to as a DMZ firewall; they are either logical or physical DMZ firewalls. Obviously, the physical DMZ firewall offers the best level of security, but what's the difference? The difference is that they are a screened-host and a screened-subnet firewall respectively. Although your firewall arrives as a single rack-mounted unit, internally it is made up of a set of components - most notably packet filtering routers and a bastion host. The packet filtering routers simply permit or deny access based on IP address, TCP port number or protocol type. More sophisticated functionality is implemented by using proxies on the secure bastion host. The diagram below shows the logical setup of a full DMZ firewall, with a separate screened-subnet (purple) between the insecure Internet (red) and the secure Intranet (green).
The point here is that no communication is allowed directly from the Internet to the Intranet. All traffic can be forced through the Bastion Host to perform URL, content, virus and SPAM filtering, among others. In the screened-host solution, there is no internal packet filtering router or separate screened-subnet. The information servers are logically separated from the information servers, but not physically. They may be on different VLANs (Virtual Local Area Networks) and physical firewall ports, but they are only separated by the logic of these mechanisms. One way to tell if your firewall is a screened-host is to see if you can set an Access Control List (ACL) between your information servers and your internal machines and see if the virus checking will work between them as well. If you can't set up an internal ACL or perform real-time virus checking on internal traffic, then you probably have a screened-host firewall.
The most secure way to implement a firewall is to have the full screened-subnet firewall, depicted above. This solution can have multiple internal connections that are all separate networks connected via the firewall. The advantage of this is that there is physical separation between your information servers and your internal machines. Indeed, it is possible to separate your organisation internally into departments or by access medium, i.e. wired and wireless networks are physically separated and wireless networks are treated as less secure. Another 'best practice' is to have your servers separated from the rest of your network and restrict access to them. If you have an intranet server, for example, why allow more than HTTP (port 80) and HTTPS (port 443) access to it from your network? If we lock the network down in this way we can better halt the spread of malware on our internal network even if we do get infected. This is moving towards bringing the firewall in from the edge of the network to the core, to protect our network as a whole. Remember, firewalls can't protect against traffic that doesn't go through them.
Wednesday, 3 June 2009
User-Friendly Multi-Factor Authentication with GrIDsure
I have been tasked with rolling out a trial multi-factor authentication system that must be user-friendly, secure, low-cost and have zero impact on the existing network and users who won't be on the trial. That should be simple!
A trawl round the InfoSecurity Europe show always helps, as you can get the latest state of play from all the major vendors. This year there were the obvious keyring tokens, SmartCards, USB tokens, SMS solutions and some innovative software solutions, including GrIDsure. Before making any decisions about the solution to go for, several things need to be decided, among which are: how much security is required? What is considered user-friendly to a normal, non-technical user? What metrics should we use for authentication?
To answer these we need to look at what authentication is first: Authentication is the binding of an identity to a subject. The subjects we're talking about in this case are users and we're trying to bind their digital identity, i.e. user ID, to them as an individual. There are four metrics we can use to query identity, namely:
A trawl round the InfoSecurity Europe show always helps, as you can get the latest state of play from all the major vendors. This year there were the obvious keyring tokens, SmartCards, USB tokens, SMS solutions and some innovative software solutions, including GrIDsure. Before making any decisions about the solution to go for, several things need to be decided, among which are: how much security is required? What is considered user-friendly to a normal, non-technical user? What metrics should we use for authentication?
To answer these we need to look at what authentication is first: Authentication is the binding of an identity to a subject. The subjects we're talking about in this case are users and we're trying to bind their digital identity, i.e. user ID, to them as an individual. There are four metrics we can use to query identity, namely:
- What they know - e.g. password, PIN, secret/personal information, etc.
- What they have - e.g. token, SmartCard, phone, etc.
- What they are - i.e. biometrics
- Where they are (in space and time) - e.g. particular terminal, logon hours, etc.
The most common form of authentication is username/password, but this is outdated, insecure and, usually, fairly easily cracked (but that's another post). The problem is that each of these on their own is not very secure (yes, even biometrics are not that secure used on their own in a large environment). If we use a combination then we can obtain secure, strong authentication (by strong authentication we mean that we are sure about the identity of this subject as it would be very hard to have all the required metrics otherwise). RSA-type tokens and SmartCards combined with a PIN or password are easy and obvious choices to deploy, but they have issues. They are expensive to deploy, as you have hardware costs as well as the authentication servers. From a user perspective, they have to carry round something else with them. That's not usually too much of a problem, as these are small devices or credit-cards, but you have to have a reader for a SmartCard. Lost or damaged hardware (or tokens that have run out of battery) have to be replaced at a cost.
OK, so we could use SMS, whereby a text message is received by the user containing a one-time password. This is often done by sending one on-demand to the user when they start the login process. What if the network is down? What if there are delays on the network? Well, we can deliver the password up front, i.e. when they log off we can send them the password to use next time they want to login, but then it's hanging around on their phone, which they might lose. So what's the solution? Well, I saw two products that are noteworthy: Swivel Authentication Solutions and GrIDsure.
Swivel's solution relies on either secure SMS or a Turing image (one that is human-readable but not computer-readable). The Turing image will show two rows of numbers, the first is 0 to 9 and the second is the numbers in a random order. The idea is that you have a PIN number that you remember and you read off a one-time PIN from the image. So, if your PIN was 2468 then your one-time PIN for this login attempt would be 7193 from the image below. If someone uses a keylogger, then it will be defeated by this, as that PIN won't be valid next time and it hasn't revealed the base PIN number that you remember. However, if someone uses keylogger and screen capture malware, then it could be read off and deduced - possibly a big ask. However, you could shoulder-surf the pattern as well. That being said, this is very easy to deploy and relatively cheap. Users find it fairly simple to use as well, and it has to be better than a static PIN.
However, there is another solution - GrIDsure. With GrIDsure, you choose a pattern on a grid to remember. The grid size and pattern length is configurable, but the standard is to have a four square pattern on a 5x5 grid. You remember this pattern and then, when you attempt to login, you will be presented with a 'random' grid of numbers. You then read off the numbers in your pattern. For example, if your pattern is the tick that GrIDsure use as their demo and you are presented with the grid shown below, then your one-time PIN number would be 0649. This would change every time you log in. This now defeats keyloggers and shoulder surfing, as each digit will appear more than once. So, even if you see or log the grid and someone typing 0649, there are 81 patterns that would result in this PIN on the grid shown below. It is important to remember that you do not type or click the grid. The grid is just an image; you type the PIN in on a standard keypad.
This can be made more secure by deploying the grid on your mobile phone as a Java applet rather than in the web page, thus defeating screen capture. The grids, in this instance, are seeded from the phone's unique ID, so someone else has to have your actual phone, not just the applet running on their phone. This is true multi-factor authentication, as it requires the physical phone and a pattern that the user knows, without both you cannot authenticate. Also, this is a cheap to deploy solution as most users will already have a mobile phone, and those that don't can drop back onto the single-factor one-time passcode by displaying the grid in a browser. Users also find this very simple to use, as many people already remember their PIN numbers as a pattern anyway. This also 'plays nicely' with other authentication, i.e. you can still use username and password for some users and GrIDsure for others as the desktop client accepts both. Similarly, the web portal is able to interface with virtually any web-based application as a single-sign-on solution. Of course existing users can still hit the services direct and use traditional authentication until this has been deployed to all.
Thursday, 21 May 2009
Trusteer or no trust 'ere...
...that is the question. Well, I've had more of a look into Trusteer's Rapport, and it seems that my fears were justified. There are many security professionals out there who are claiming that this is 'snake oil' - marketing hype for something that isn't possible. Trusteer's Rapport gives security 'guaranteed' even if your machine is infected with malware according to their marketing department. Now any security professional worth his salt will tell you that this is rubbish and you should run a mile from claims like this. Anyway, I will try to address a few questions I raised in my last post about this.
Firstly, I was correct in my assumption that Rapport requires a list of the servers that you wish to communicate with; it contacts a secure DNS server, which has a list already in it. This is how it switches from a phishing site to the legitimate site silently in the background. I have yet to fully investigate the security of this DNS, however, as most other companies would say their DNS is secure. They do also have an automatic update process, which needs to be tested in my opinion, as this could be the target of attack.
Another alarming thing I have discovered is the following:
With these problems in mind, I decided to install Rapport on a virtual Vista machine with no AV and start logging a few things. The install writes to the file system (obviously) and the registry. However, in use, it is writing to the file system, specifically a set of encrypted log files. Further investigation shows that they are using encrypted JavaScript files to access and write to these log files. Rapport also runs a service on your machine called RapportService and was using about 10MB RAM on my VM. This service protects the Rapport files from deletion or modification as far as I can see. On install, the boot sector is updated to run this service at startup. However, if you stop this, then you can play around with the files. (To do this you will need to boot into Safe Mode by running msconfig.exe and selecting this option in the Boot tab. If you do this, then Windows Defender may block Rapport from restarting.)
The files of interest seem to be stored on a per-user basis. There are lots of log files that are accessed each time you hit a Rapport site. The main ones seem to be rooksbas.log, koan.log, backend.log and backend-cfg.log. Of interest though are the .cfg files and the JavaScript files. You have to enter a code during install, which may be just for registration, but may also be some kind of seed for the key, because the program itself must have the encryption key for these files. In which case, it should be a matter of reverse engineering the code to find that key and then everything becomes open (but this is just a guess on my part and may not be true). They don't tell you what algorithms they use for this encryption though, which isn't always a good sign.
Running packet sniffing software on the machine whilst connecting to http://www.rbs.co.uk/ I found a few things. Firstly, RBS is using ATDMT to track users' habits and install tracking cookies - a form of malware! Rapport didn't pick up on this tracking cookie or block it. Also, it doesn't appear to contact Trusteer directly, however, it does tell the server that it is running, as "Trusteer-Rapport/3.5.0903" was added to the userAgent string and the following data was also sent to http://www.rbsdigital.com/: "X-Trusteer-Rapport: ver=3.5.0903.22; ak=C056E35A634C288C2BA683A7B21DBC6274417C4CBF7FCE0CBB561651EE30EB60; av=a0; rs=0.01372". This makes me wonder how their secure DNS server comes into play. This wasn't the first time I had gone to the RBS site though, so maybe it is cached, but again, where? Presumably in those encrypted log files.
The problem for Trusteer is that the more successful Rapport is, the more it will become a target for attack, and the less use it will be. They are trying to do something good and it is another level of protection, but the false claims make it dangerous. I believe that this product will make users complacent and take less care of their machine and credentials. Why bother having any form of AV product if Rapport protects my details anyway? People are being educated into thinking that if they see the green box at the top of the browser then they are safe and I think they will then throw caution to the wind. Even worse is that if they use a browser other than IE, then they have no protection at all. I don't think this is drummed into the users enough on the third party sites that use this.
It goes to show the old addage that a little learning is a dangerous thing. You are teaching users only part of the story and they will get lost in marketing hype and false claims. Trusteer should be open and honest about the capabilities of Rapport and push for more user education, then I would recommend their product. As it is (forgetting the compatibility issues) I cannot recommend that system administrators install this on their machines and let users believe that they are safe no matter what.
Edit: I have a new post here and a series of demo videos of Rapport blocking spyware.
Edit (10/4/10): I am still getting a lot of hits on this blog post so I thought that I ought to point out that Rapport as a product has matured a lot in the last year and many of the problems with compatibility, etc., have been sorted out. Also, the marketing has changed a lot to be much more realistic. If this is used as a layer in your overall security arsenal and is combined with user education, then it will help to protect your machine, data and identity. Download a keylogger for yourself and try using it before and after installing Rapport and you might see why your Banks are pushing it. I still think that the Banks have a duty to educate their users and to standardise the process of conducting online transactions and authentication to help users and stop many of the attack vectors currently being exploited.
Firstly, I was correct in my assumption that Rapport requires a list of the servers that you wish to communicate with; it contacts a secure DNS server, which has a list already in it. This is how it switches from a phishing site to the legitimate site silently in the background. I have yet to fully investigate the security of this DNS, however, as most other companies would say their DNS is secure. They do also have an automatic update process, which needs to be tested in my opinion, as this could be the target of attack.
Another alarming thing I have discovered is the following:
"To protect you against phishing attacks Rapport learns the password (andWhat? Where and how does it store these? What hash function or encryption is it using? This is potentially a massive security flaw. I did try this feature out and it does ask if you want to remember the details, but in my opinion it should never do this. Now the hacker doesn't need a keylogger anyway, as they can attack the storage of the password! Talking of keyloggers, I was sure that Rapport couldn't protect against rootkits, malicious drivers and all malware keyloggers, and the proof can be found here (a video of someone logging the keystrokes when Rapport is used to protect the ING Direct login showing that Trusteer's Rapport can be bypassed or cracked). I know that some will say that this requires particular malware and this may be detected with your existing AV product. However, don't forget that Trusteer 'guarantee' security even on an infected system. They are also encouraging lax attitudes towards using AV products with their rhetoric.
sometimes even the username) you use with protected websites"(ref).
With these problems in mind, I decided to install Rapport on a virtual Vista machine with no AV and start logging a few things. The install writes to the file system (obviously) and the registry. However, in use, it is writing to the file system, specifically a set of encrypted log files. Further investigation shows that they are using encrypted JavaScript files to access and write to these log files. Rapport also runs a service on your machine called RapportService and was using about 10MB RAM on my VM. This service protects the Rapport files from deletion or modification as far as I can see. On install, the boot sector is updated to run this service at startup. However, if you stop this, then you can play around with the files. (To do this you will need to boot into Safe Mode by running msconfig.exe and selecting this option in the Boot tab. If you do this, then Windows Defender may block Rapport from restarting.)
The files of interest seem to be stored on a per-user basis. There are lots of log files that are accessed each time you hit a Rapport site. The main ones seem to be rooksbas.log, koan.log, backend.log and backend-cfg.log. Of interest though are the .cfg files and the JavaScript files. You have to enter a code during install, which may be just for registration, but may also be some kind of seed for the key, because the program itself must have the encryption key for these files. In which case, it should be a matter of reverse engineering the code to find that key and then everything becomes open (but this is just a guess on my part and may not be true). They don't tell you what algorithms they use for this encryption though, which isn't always a good sign.
Running packet sniffing software on the machine whilst connecting to http://www.rbs.co.uk/ I found a few things. Firstly, RBS is using ATDMT to track users' habits and install tracking cookies - a form of malware! Rapport didn't pick up on this tracking cookie or block it. Also, it doesn't appear to contact Trusteer directly, however, it does tell the server that it is running, as "Trusteer-Rapport/3.5.0903" was added to the userAgent string and the following data was also sent to http://www.rbsdigital.com/: "X-Trusteer-Rapport: ver=3.5.0903.22; ak=C056E35A634C288C2BA683A7B21DBC6274417C4CBF7FCE0CBB561651EE30EB60; av=a0; rs=0.01372". This makes me wonder how their secure DNS server comes into play. This wasn't the first time I had gone to the RBS site though, so maybe it is cached, but again, where? Presumably in those encrypted log files.
The problem for Trusteer is that the more successful Rapport is, the more it will become a target for attack, and the less use it will be. They are trying to do something good and it is another level of protection, but the false claims make it dangerous. I believe that this product will make users complacent and take less care of their machine and credentials. Why bother having any form of AV product if Rapport protects my details anyway? People are being educated into thinking that if they see the green box at the top of the browser then they are safe and I think they will then throw caution to the wind. Even worse is that if they use a browser other than IE, then they have no protection at all. I don't think this is drummed into the users enough on the third party sites that use this.
It goes to show the old addage that a little learning is a dangerous thing. You are teaching users only part of the story and they will get lost in marketing hype and false claims. Trusteer should be open and honest about the capabilities of Rapport and push for more user education, then I would recommend their product. As it is (forgetting the compatibility issues) I cannot recommend that system administrators install this on their machines and let users believe that they are safe no matter what.
Edit: I have a new post here and a series of demo videos of Rapport blocking spyware.
Edit (10/4/10): I am still getting a lot of hits on this blog post so I thought that I ought to point out that Rapport as a product has matured a lot in the last year and many of the problems with compatibility, etc., have been sorted out. Also, the marketing has changed a lot to be much more realistic. If this is used as a layer in your overall security arsenal and is combined with user education, then it will help to protect your machine, data and identity. Download a keylogger for yourself and try using it before and after installing Rapport and you might see why your Banks are pushing it. I still think that the Banks have a duty to educate their users and to standardise the process of conducting online transactions and authentication to help users and stop many of the attack vectors currently being exploited.
Tuesday, 19 May 2009
Trusteer's Rapport
NatWest have just sent through an important information letter to their customers highlighting a new security solution to help secure their online banking. They are using Trusteer's Rapport product (more info). Anything people do to combat malware, phishing, pharming, etc., is a good thing, and for this they should be commended. However, Trusteer make some bold claims and I'm wondering how true they really are. This needs a lot more investigation than reading through their sales rhetoric, but I'm going to get some of my initial thoughts down here, then see what I can find out.
The problem statement is well defined by Trusteer and centres around lack of user education. In a previous blog entry I wrote about 2 successful phishing attacks against an organisation that only needed one person to send an email containing their password to bring the whole network down (here). Users need to be educated into not handing out secret or personal information to anyone who asks, e.g. a bank will never ask for your PIN number - why would they? Again, see my previous blog entry as to what is happening with phishing, pharming and brand hijacking. One thing I find alarming is their statement:
On to the Rapport solution. They claim that they can protect against: Man-in-the-Browser, Man-in-the-Middle, Keyloggers, Session Hijacking, Screen Capturing, Pharming, Phishing and Phishing Malware. Without going through all of these I will look at a few points. Firstly, let's look at keyloggers. This can't combat hardware keyloggers. It claims that it can combat software keyloggers by encrypting "all keystrokes from keyboard to browser." As I don't have an encrypting keyboard or driver, how does this work? Rapport is a browser plug-in, not a new driver. How does this stop me from rewriting the drivers on the machine and logging all the keystrokes? One wonders about the case for stopping this as well, because most banks only get you to enter three random characters of your passphrase anyway, and most have drop-down lists of numbers to select from for online PIN numbers (not card PIN numbers, which are never asked for). Also, what's the value of logging my one-time password? It's not valid by the time the attacker gets it. Having said that, combating keyloggers is a worthy goal and something we should implement if available.
Man-in-the-Middle attacks and Pharming attacks are both defeated, because Rapport "diverts traffic to the real website." How? If I have poisoned an external DNS server to point to my IP address, how do you know it's wrong, unless you have a store of my IP address already? Where do you store that? Can I update it? If not, what happens when the bank does change its servers? If this is done via strong authentication, how does that work? Is this like SSL, which has to have a valid certificate? A Pharming website won't have a valid certificate, so does this mean I'm safe? Only if I take heed of the warnings and assuming they can't update the local machine's store of the certification authorities (which you can do). Rapport supports automatic updates; are these secure or can I break into the update process?
Again, how without a list of the servers? Also, what about technologies like Microsoft's CardSpace? I know, it's Microsoft, so can we trust it, etc. However, by utilising something like CardSpace, the user doesn't enter information via the keyboard or in normal usage; it is done in a protected mode. Users can't enter their PIN number into a card that doesn't accept that information - indeed users wouldn't be the originator of the card in this scenario, so wouldn't be able to add information to it anyway. This looks to see if you are submitting the 'card' to the same site as before, by looking at things like IP address, etc. Doesn't this help against Phishing, Pharming, keyloggers and man-in-the-middle attacks? Incidentally, Rapport is only supported on XP and Vista - the same as CardSpace.
I will try to have a better look at this product and see if I can find out what the exact technologies are behind it. It may well be that their technology is secure and does help guard against these attacks, but it seems on the surface to be a collection of current technologies rather than anything new. In the mean time, NatWest should follow many other banks and institutions and get an EV SSL certificate so that the browser bar goes green and the site is authenticated by the browser with the certification authority directly. This seems as though it should be done even if other mechanisms are in place. However, I do admit that this only truly works alongside user education, but so does any security solution, including Rapport.
The problem statement is well defined by Trusteer and centres around lack of user education. In a previous blog entry I wrote about 2 successful phishing attacks against an organisation that only needed one person to send an email containing their password to bring the whole network down (here). Users need to be educated into not handing out secret or personal information to anyone who asks, e.g. a bank will never ask for your PIN number - why would they? Again, see my previous blog entry as to what is happening with phishing, pharming and brand hijacking. One thing I find alarming is their statement:
"Recent malware in the wild have proved to be capable of bypassing the most advanced multi-factor authentication and security controls put in place... At Trusteer labs we have identified malware that bypass device identification, hardware and software tokens, client-side certificates, SMS authentication and transaction verification, and even card-readers..."Well, I can see how some of these can be done relatively easily, but not all. I realise that a man-in-the-middle attack will defeat most, but if we can secure ourselves from the man-in-the-middle attack then we're fine in most cases. This is a big IF, of course, but SSL goes some way towards this (although it is also flawed in many implementations, but not in the way most phishers mount their attacks). The problem also comes from particular implementations being predictable, e.g. the RSA token that can be cracked if you know the Serial Number and the codes.
On to the Rapport solution. They claim that they can protect against: Man-in-the-Browser, Man-in-the-Middle, Keyloggers, Session Hijacking, Screen Capturing, Pharming, Phishing and Phishing Malware. Without going through all of these I will look at a few points. Firstly, let's look at keyloggers. This can't combat hardware keyloggers. It claims that it can combat software keyloggers by encrypting "all keystrokes from keyboard to browser." As I don't have an encrypting keyboard or driver, how does this work? Rapport is a browser plug-in, not a new driver. How does this stop me from rewriting the drivers on the machine and logging all the keystrokes? One wonders about the case for stopping this as well, because most banks only get you to enter three random characters of your passphrase anyway, and most have drop-down lists of numbers to select from for online PIN numbers (not card PIN numbers, which are never asked for). Also, what's the value of logging my one-time password? It's not valid by the time the attacker gets it. Having said that, combating keyloggers is a worthy goal and something we should implement if available.
Man-in-the-Middle attacks and Pharming attacks are both defeated, because Rapport "diverts traffic to the real website." How? If I have poisoned an external DNS server to point to my IP address, how do you know it's wrong, unless you have a store of my IP address already? Where do you store that? Can I update it? If not, what happens when the bank does change its servers? If this is done via strong authentication, how does that work? Is this like SSL, which has to have a valid certificate? A Pharming website won't have a valid certificate, so does this mean I'm safe? Only if I take heed of the warnings and assuming they can't update the local machine's store of the certification authorities (which you can do). Rapport supports automatic updates; are these secure or can I break into the update process?
"Rapport transparently terminates the connection to the proxy server and
diverts traffic directly to the real website."
Again, how without a list of the servers? Also, what about technologies like Microsoft's CardSpace? I know, it's Microsoft, so can we trust it, etc. However, by utilising something like CardSpace, the user doesn't enter information via the keyboard or in normal usage; it is done in a protected mode. Users can't enter their PIN number into a card that doesn't accept that information - indeed users wouldn't be the originator of the card in this scenario, so wouldn't be able to add information to it anyway. This looks to see if you are submitting the 'card' to the same site as before, by looking at things like IP address, etc. Doesn't this help against Phishing, Pharming, keyloggers and man-in-the-middle attacks? Incidentally, Rapport is only supported on XP and Vista - the same as CardSpace.
I will try to have a better look at this product and see if I can find out what the exact technologies are behind it. It may well be that their technology is secure and does help guard against these attacks, but it seems on the surface to be a collection of current technologies rather than anything new. In the mean time, NatWest should follow many other banks and institutions and get an EV SSL certificate so that the browser bar goes green and the site is authenticated by the browser with the certification authority directly. This seems as though it should be done even if other mechanisms are in place. However, I do admit that this only truly works alongside user education, but so does any security solution, including Rapport.
Friday, 15 May 2009
APWG Report 2nd Half 2008
The Anti-Phishing Working Group produce two reports a year now on Phishing Activity Trends. I was reminded to look at the report from the second half of last year recently by problems encountered by an organisation I'm involved with(!), which has suffered two successful phishing attacks in the last 9 months. The two incidents both followed the same pattern: a phishing email was sent round purporting to be from the technical staff talking of lack of storage space on the user's account. They asked for the user's password in order to be able to reconfigure the quota. Now, the vast majority of people deleted this email, but on each occasion one person (a different one in each incident) replied with their username and password. This resulted in vast amounts of spam being sent through the users' email accounts, sufficient for the domain to be blacklisted by Message Labs in the first incident. The problem is that people still fall for this type of scam, and it only needs one person in an organisation to do it.
Anyway, back to the report. The APWG highlight a few interesting things in their report. Phishing reports and unique phishing sites detected both peaked in October, at 34,758 and 27,739 respectively, then fell sharply to December, when the figures were 23,187 and 15,709 respectively. These are way off the high of 55,643 detected in April 2007 and the lowest since August 2006, when they fell to 10,091. This is in sharp contrast to the password stealing malicious code URLs, which soared to 31,173 in December from 11,834 in November and a low of 3,113 in May last year. Although, interestingly, the number of unique keyloggers and malicious applications has dropped from 1,519 in July to 559 in December.
This trend has been followed by a new category of 'Rogue Anti-Malware Programs.' This is where fake applications are sold, purporting to be anti-malware (e.g. AV products) but either do little or nothing but make money off people buying it, or they become harvesters of information. The rise is from a low of 2,084 in September to 9,287 in December.
The final thing to note concerns Brand Hijacking. Brand hijacking is still high, with 269 brands hijacked in November, but the balance in the sectors is changing. Back in 2007 Financial Services accounted for 93.8% of the hijacked brands, which peaked at a high of 178 in November 2007. The remainder were: Retail 2.8%, ISP 2.2% and Government 1.2%. In Q3 2008 Financial had dropped to 61% and dropped further in Q4 2008 to only 46%. This shows a drop in real terms as well as percentage as around 124 financial brands were hijacked in Q4 2008 against around 167 in 2007. Retail has shown a drop from around 5 brands to around 3 and makes up for only 1% in Q4 2008. The 'big winner', if it can be described thus, is Payment Services, which is up to 38%, with Auction sites making up 11% and 4% for other brands. This 'other' category is up from 3% in Q3 2008, which is attributed to more attacks against MySpace, Facebook, etc., by the authors.
For more information about the Anti-Phishing Working Group, to report phishing attacks or to see their reports yourself, visit http://apwg.org/
Anyway, back to the report. The APWG highlight a few interesting things in their report. Phishing reports and unique phishing sites detected both peaked in October, at 34,758 and 27,739 respectively, then fell sharply to December, when the figures were 23,187 and 15,709 respectively. These are way off the high of 55,643 detected in April 2007 and the lowest since August 2006, when they fell to 10,091. This is in sharp contrast to the password stealing malicious code URLs, which soared to 31,173 in December from 11,834 in November and a low of 3,113 in May last year. Although, interestingly, the number of unique keyloggers and malicious applications has dropped from 1,519 in July to 559 in December.
This trend has been followed by a new category of 'Rogue Anti-Malware Programs.' This is where fake applications are sold, purporting to be anti-malware (e.g. AV products) but either do little or nothing but make money off people buying it, or they become harvesters of information. The rise is from a low of 2,084 in September to 9,287 in December.
The final thing to note concerns Brand Hijacking. Brand hijacking is still high, with 269 brands hijacked in November, but the balance in the sectors is changing. Back in 2007 Financial Services accounted for 93.8% of the hijacked brands, which peaked at a high of 178 in November 2007. The remainder were: Retail 2.8%, ISP 2.2% and Government 1.2%. In Q3 2008 Financial had dropped to 61% and dropped further in Q4 2008 to only 46%. This shows a drop in real terms as well as percentage as around 124 financial brands were hijacked in Q4 2008 against around 167 in 2007. Retail has shown a drop from around 5 brands to around 3 and makes up for only 1% in Q4 2008. The 'big winner', if it can be described thus, is Payment Services, which is up to 38%, with Auction sites making up 11% and 4% for other brands. This 'other' category is up from 3% in Q3 2008, which is attributed to more attacks against MySpace, Facebook, etc., by the authors.
For more information about the Anti-Phishing Working Group, to report phishing attacks or to see their reports yourself, visit http://apwg.org/
Subscribe to:
Posts (Atom)