SANS NewsBites is a semiweekly high-level executive summary of the most important news articles that have been published on computer security during the last week. Each news item is very briefly summarized and includes a reference on the web for detailed information, if possible.
Spend five minutes per week to keep up with the high-level perspective of all the latest security news. New issues are delivered free every Tuesday and Friday.
Volume XVI - Issue #69
August 29, 2014
TOP OF THE NEWS
FBI, Secret Service Investigating Attacks on JPMorgan Chase and Other Financial InstitutionsCommerce OIG Warns NOAA of Vulnerabilities in Satellite Ground Systems
THE REST OF THE WEEK'S NEWS
Payment Card Industry Council Urges Businesses to Take Precautions Against BackoffUK Information Commissioner Fines Ministry of Justice Over Unencrypted Prison Records
"Google Dorking" Exposes Sensitive Information
Malware Advertising Attack Hits Popular Websites
Netis Routers Have Backdoors with Hardcoded Passwords
Microsoft Reissues Dodgy Patch
Possible Dairy Queen Data Breach
STORM CENTER TECH CORNER
STORM CENTER TECH CORNER******************* Sponsored By Magnet Forensics **********************
Webcast: Speeding up the Investigation of Employee Policy Violations - Monday, September 15 at 1:00 PM EDT (17:00:00 UTC) with Jad Saliba (CTO), Jamie McQuaid (Forensics Consultant) and Rob Lee. Designed for forensics professionals who work in a corporate environment, this webinar will arm you with the tools and techniques needed to speed up employee policy violation investigations to get them off your desk.
http://www.sans.org/info/166657
***************************************************************************
TRAINING UPDATE
- --SANS Network Security 2014 | Las Vegas, NV | October 19-27, 2014 Register and pay by September 17 and save $200. 46 courses. Bonus evening presentations include The Bot Inside the Machine; Real-time Monitoring in Industrial Control Systems; and The Law of Offensive Countermeasures, Active Defense, or Whatever You Wanna Call It.
http://www.sans.org/event/network-security-2014
- --Security Awareness Summit | Dallas, TX | Sept 8-16, 2014 Come learn from your peers on how to build Next Generation Security Awareness Programs. Hear from security awareness officers as they share lessons learned on how they took their awareness programs to the next level and how they measured the impact. Plus 5 courses.
http://www.sans.org/event/security-awareness-summit-and-training-2014
- --SANS ICS Amsterdam 2014 | Amsterdam, Netherlands | September 21-27, 2014 3 courses. ICS/SCADA Summit and Training.
http://www.sans.org/event/sans-ics-amsterdam-2014
- --DFIR Prague 2014 | Prague, Czech Republic | September 29-October 11, 2014 11 courses. Bonus evening presentations include Sushi Grade Smartphone Forensics on a Ramen Noodle Budget; Everything They Told Me About Security was Wrong; and The Great Browser Schism: How to Analyze IE10 & IE11.
http://www.sans.org/event/dfir-prague-2014
- --Pen Test Hackfest Summit | Washington DC | November 13-20, 2014 100% dedicated Pen Test Training. The optimal place to take your next Pen Testing course allowing you to interact with our instructors who specialize in this area. Meet with other industry professionals who are focused on ethical hacking and vulnerability assessments. 5 courses | Expert Summit Talks | 3 nights of NetWars | Evening of CyberCity | Coin-a-palooza
http://www.sans.org/event/sans-pen-test-hackfest-2014/
- --SANS London 2014 | London, UK | November 15-24, 2014 16 courses.
http://www.sans.org/event/london-2014
- --Can't travel? SANS offers LIVE online instruction. Day (www.sans.org/simulcast) and Evening courses (www.sans.org/vlive) available!
- --Multi-week Live SANS training
http://www.sans.org/mentor/about
Contact mentor@sans.org
- --Looking for training in your own community?
http://www.sans.org/community/
- --Save on On-Demand training (30 full courses) - See samples at
http://www.sans.org/ondemand/specials
Plus Tallinn, Hong Kong, Sydney, and Tokyo all in the next 90 days.
For a list of all upcoming events, on-line and live: http://www.sans.org
*****************************************************************************
TOP OF THE NEWS
FBI, Secret Service Investigating Attacks on JPMorgan Chase and Other Financial Institutions (August 27 & 28, 2014)
The FBI and the US Secret Service are working together on an investigation into the scope of attacks that affected several financial institutions, including JPMorgan Chase. The New York Times reported that the thieves stole "gigabytes" of data from JPMorgan Chase and four other financial institutions. A spokesperson for JPMorgan Chase noted that it "experience[s ]
cyberattacks nearly every day," and did not confirm this recent report. Bloomberg's report suggests that Russia could be behind the attacks. Others are less eager to attribute the attacks to Russia, saying that data theft differs from the usual disruptive attacks launched in such cases. According to the most recent report, the attackers may have altered and deleted records at JPMorgan Chase.
-http://www.cnet.com/news/jpmorgan-hackers-altered-deleted-bank-records-says-repo
rt/
-http://www.darkreading.com/attacks-breaches/feds-investigating-breaches-at-jp-mo
rgan-other-banks/d/d-id/1306826?
-http://www.computerworld.com/article/2599266/security/fbi-secret-service-studyin
g-scope-of-bank-cyberattacks.html
-http://www.bbc.com/news/technology-28965878
-http://www.zdnet.com/fbi-investigates-hack-of-jpmorgan-other-us-banks-7000033080
/
-http://www.nytimes.com/2014/08/28/technology/hackers-target-banks-including-jpmo
rgan.html
-http://www.bloomberg.com/news/2014-08-27/fbi-said-to-be-probing-whether-russia-t
ied-to-jpmorgan-hacking.html
[Editor's Note (Murray): You will not be surprised to learn that this attack, like many such attacks these days, began with a carefully and artfully crafted bait message sent via e-mail. The bait appeared to be an important encrypted announcement message from bank management. (It has been on cable TV since about noon Thursday, so it may be possible to find it on Google/YouTube by now.) Among other things, taking the bait generated a "security error message" saying that the system was unable to decrypt the message and prompting for, yes, you guessed it, UID and password. The layered security architectures of money center banks are the targets of daily and resourceful attacks. Almost by definition, some of these attacks enjoy at least limited success. If there were no success at all, the attackers would tire, retire, or seek softer targets. That said, such success should not, as in this case, include "gigabytes of sensitive data." That it did so suggests insufficient layers and monitoring. Strong Authentication should be the first layer. ]
Commerce OIG Warns NOAA of Vulnerabilities in Satellite Ground Systems (August 27, 2014)
According to an audit from the Office of Inspector General (OIG) of the US Department of Commerce, there are vulnerabilities in the Joint Polar Satellite System (JPSS) ground system that could be exploited to disrupt its mission. The JPSS ground system collects data from weather satellites and shares them with users worldwide. It operates under the purview of the National Oceanic and Atmospheric Administration (NOAA)-http://www.scmagazine.com/ground-system-for-weather-satellites-contains-thousand
s-of-high-risk-bugs/article/368479/
[Editor's Note (Paller): The satellite ground and uplink systems were not designed to withstand cyber attack. Sadly, the situation is not improving as fast as the attack landscaping is advancing. ]
*************************** SPONSORED LINKS *****************************
1) Kill Shot: Stopping Unknown Malware with Trust Based Application Control. Thursday, September 04 at 2:00 PM EDT (18:00:00 UTC) with Harry Sverdlove and Dave Shackleford. http://www.sans.org/info/166662
2) Learn to Detect, Control and Manage the Insider Threat Risks in Law Enforcement Orgs in Sep. 5 Webcast. http://www.sans.org/info/166667
3) SANS survey looks at security and compliance in managing data center server assets. Take survey and enter to win iPad. Results Webcast on 10/29. http://www.sans.org/info/166672
*****************************************************************************
THE REST OF THE WEEK'S NEWS
Payment Card Industry Council Urges Businesses to Take Precautions Against "Backoff" (August 27, 2014)
Adding its voice to those of the US Department of Homeland Security (DHS) and the Secret Service, the Payment Card Industry Security Standards Council has issued a bulletin urging its retailers to examine their security controls to protect their systems from point-of-sale (POS) malware known as "Backoff" that has already infected more than 1,000 company networks. Backoff, which can scrape memory from the systems used in payment card transactions, was used in the attack on Target's systems. The advisory encourages retailers to update their antivirus products and to change default passwords, as well as to examine logs for anomalous or suspicious activity. It also recommends that retailers use encryption.-http://www.computerworld.com/article/2599724/data-security/retailers-warned-to-a
ct-now-to-protect-against-backoff-malware.html
[Editor's Note (Murray): The issue is not the brand of malware. There is general agreement that these attacks are exploiting remote access facilities that are not protected by strong authentication. It is a stretch to think that hundreds of thousands of merchants are going to fix this, particularly if we do not tell them what to do. Many of these remote access facilities are installed for the benefit of those who sold the point of sale system to the merchants. The merchants may not even know that they are there, much less that they are a vulnerability. ]
UK Information Commissioner Fines Ministry of Justice Over Unencrypted Prison Records (August 26 & 27, 2014)
The UK Information Commissioner's Office (ICO) has fined Ministry of Justice GBP 180,000 (US $298,500) for losing a device that contains unencrypted prison records. In May 2012, the Prison Service issued new hard drives with encryption capabilities to all 75 prisons in England and Wales. The ministry, for which this is a repeat offense, was reportedly unaware that disk encryption needed to be switched on. The missing device contained personal data about nearly 3,000 inmates. The data include health information, visitor information, and prisoners' links to organized crime.-http://www.nextgov.com/cybersecurity/threatwatch/2014/08/breach/1439/
-http://www.v3.co.uk/v3-uk/news/2361825/ico-fines-ministry-of-justice-gbp180-000-
for-unencrypted-data-gaffe-at-75-prisons
"Google Dorking" Exposes Sensitive Information (August 27, 2014)
In July, the US Department of Homeland Security (DGS) issued a warning to police, security, and public safety officers of an activity it calls "Google Dorking," which leverages advanced search techniques in Google to uncover sensitive business data and vulnerabilities in their IT systems. By searching for certain file types and keywords, potential attackers can uncover login credentials, bank account information, and website vulnerabilities. While the searches can be seen as malicious, the DHS warning was aimed largely at urging the recipients to examine their own websites.-http://arstechnica.com/security/2014/08/feds-warn-first-responders-of-dangerous-
hacking-tool-google-search/
[Editor's Comment (Northcutt): That is 15 years behind the times. Moreover, this is better thought of as power searching using Google. However, here is the main site and I certainly concur with DHS, all organizations should run the dorks against their own sites.
-http://www.exploit-db.com/google-dorks/]
Malware Advertising Attack Hits Popular Websites (August 27 & 28, 2014)
Several popular websites have been targeted by maliciously-crafted advertisements to infect site visitors' computers with malware. At least eight sites have been affected, including eBay.ie, Photobucket.com, and Deviantart.com. The attacks took place between August 19 and August 22. Dutch security company Fox-IT detected the attacks, and noted that the sites themselves were not compromised; instead, the malicious redirection activity came from advertisements.-http://www.scmagazine.com/malicious-ads-impact-javacom-tmz-and-photobucket-site-
visitors-firm-finds/article/368681/
-http://www.computerworld.com/article/2599641/security/new-malvertising-campaign-
hit-visitors-of-several-high-profile-sites.html
-http://blog.fox-it.com/2014/08/27/malvertising-not-all-java-from-java-com-is-leg
itimate/
Netis Routers Have Backdoors with Hardcoded Passwords (August 27, 2014)
Researchers at Trend Micro say that hardcoded passwords in Netis routers sold by Netcore, a Chinese company, could be exploited to change router settings and run arbitrary code in the devices. The issue lies in an open UDP port listening at port 53413. The hardcoded password in the router firmware is the same in every device; there is not a way for users to disable or modify the configuration. The issue could be used in man-in-the-middle attacks. Researchers used ZMap to locate the vulnerable routers; most are in China.-http://www.theregister.co.uk/2014/08/27/netis_routers_have_a_backdoor_say_resera
chers/
-http://blog.trendmicro.com/trendlabs-security-intelligence/netis-routers-leave-w
ide-open-backdoor/
Microsoft Reissues Dodgy Patch (August 27, 2014)
Microsoft has reissued a patch (MS14-045) that it pulled 10 days ago after reports that it was causing the blue screen of death in some cases. The patch addresses kernel vulnerabilities in 47 Microsoft systems; they could be exploited to expose information and allow privilege elevation. At the same time it pulled this bulletin, Microsoft also pulled three non-security updates, which have not yet been reissued.-http://www.zdnet.com/microsoft-reissues-flawed-windows-security-update-700003304
9/
-http://www.theregister.co.uk/2014/08/27/microsoft_reissues_security_patch/
-https://technet.microsoft.com/en-us/library/security/ms14-045.aspx
Possible Dairy Queen Data Breach (August 26, 2014)
There are reports that ice cream and fast food chain Dairy Queen may be a recent target of thieves targeting payment card data. Financial institutions have said that they are seeing patterns of fraud on cards recently used at Dairy Queen stores. While the company initially denied that its systems were compromised, it also acknowledges that most locations are franchises and there are no company policies requiring the franchises to report braches to headquarters. Dairy Queen has now confirmed that it was contacted by the US Secret Service regarding the breach and is investigating along with authorities.-http://krebsonsecurity.com/2014/08/dq-breach-hq-says-no-but-would-it-know/
[Editor's Note (Murray): One can say "possible" about almost any restaurant or fast food chain. DQ is simply this week's most visible victim. Neither these chains or the consumers that frequent them should have to bear the risk of this broken system. Where are the regulators and legislators? How long does this have to continue before we conclude that the credit card brands and issuers are waiting for their competitors to move first? How long before consumers lose faith? ]
STORM CENTER TECH CORNER
Obfuscated Javascript: Good or Evil-https://isc.sans.edu/forums/diary/False+Positive+or+Not+Difficult+to+Analyze+Jav
ascript/18593
Firefox 32 To Introduce SSL Cert Pinning
-http://monica-at-mozilla.blogspot.de/2014/08/firefox-32-supports-public-key-pinn
ing.html
Honeynet Project introduces "Beeswarm"
-http://www.honeynet.org/node/1189
More Memory Scraping in PoS Devices
-https://isc.sans.edu/forums/diary/One+More+Day+of+Trolling+in+POS+Memory/18589
Google Chrome 37 Released
-http://googlechromereleases.blogspot.com.au/2014/08/stable-channel-update_26.htm
l
Synology Software Update
-http://www.synology.com/de-de/releaseNote/model/DS414
Point of Sales Devices and PCI
-https://isc.sans.edu/forums/diary/Trolling+Memory+for+Credit+Cards+in+POS+PCI+En
vironments/18579
-https://isc.sans.edu/forums/diary/Point+of+Sale+Terminal+Protection+-+Fortress+P
CI+at+the+Mall/18581
Netflix Releases Security Tools
-http://techblog.netflix.com/2014/08/announcing-scumblr-and-sketchy-search.html
-http://techblog.netflix.com/2014/06/announcing-security-monkey-aws-security.html
New Free Windows Firewall / Network Monitoring Systems
-https://www.glasswire.com
***********************************************************************
The Editorial Board of SANS NewsBites
John Pescatore was Vice President at Gartner Inc. for fourteen years. He became a director of the SANS Institute in 2013. He has worked in computer and network security since 1978 including time at the NSA and the U.S. Secret Service.
Shawn Henry recently retired as FBI Executive Assistant Director responsible for all criminal and cyber programs and investigations worldwide, as well as international operations and the FBI's critical incident response. He is now president of CrowdStrike Services.
Stephen Northcutt teaches advanced courses in cyber security management; he founded the GIAC certification and was the founding President of STI, the premier skills-based cyber security graduate school, www.sans.edu.
Dr. Johannes Ullrich is Chief Technology Officer of the Internet Storm Center and Dean of the Faculty of the graduate school at the SANS Technology Institute.
Ed Skoudis is co-founder of CounterHack, the nation's top producer of cyber ranges, simulations, and competitive challenges, now used from high schools to the Air Force. He s also author and lead instructor of the SANS Hacker Exploits and Incident Handling course, and Penetration Testing course.
Michael Assante was Vice President and Chief Security Officer at NERC, led a key control systems group at Idaho National Labs, and was American Electric Power's CSO. He now leads the global cyber skills development program at SANS for power, oil & gas and other critical infrastructure industries.
Mark Weatherford is a Principal at The Chertoff Group and the former Deputy Under Secretary of Cybersecurity at the US Department of Homeland Security.
William Hugh Murray is an executive consultant and trainer in Information Assurance and Associate Professor at the Naval Postgraduate School.
Sean McBride is Director of Analysis and co-founder of Critical Intelligence, and, while at Idaho National Laboratory, he initiated the situational awareness effort that became the ICS-CERT.
Rob Lee is the SANS Institute's top forensics instructor and director of the digital forensics and incident response research and education program at SANS (computer-forensics.sans.org).
Tom Liston is a Senior Security Consultant and Malware Analyst for InGuardians, a handler for the SANS Institute's Internet Storm Center, and co-author of the book Counter Hack Reloaded.
Dr. Eric Cole is an instructor, author and fellow with The SANS Institute. He has written five books, including Insider Threat and he is a founder with Secure Anchor Consulting.
Mason Brown is one of a very small number of people in the information security field who have held a top management position in a Fortune 50 company (Alcoa). He leads SANS' efforts to raise the bar in cybersecurity education around the world.
David Hoelzer is the director of research & principal examiner for Enclave Forensics and a senior fellow with the SANS Technology Institute.
Gal Shpantzer is a trusted advisor to CSOs of large corporations, technology startups, Ivy League universities and non-profits specializing in critical infrastructure protection. Gal created the Security Outliers project in 2009, focusing on the role of culture in risk management outcomes and contributes to the Infosec Burnout project.
Alan Paller is director of research at the SANS Institute.
Brian Honan is an independent security consultant based in Dublin, Ireland.
David Turley is SANS operations manager and serves as production manager and final editor on SANS NewsBites.
Please feel free to share this with interested parties via email, but no posting is allowed on web sites. For a free subscription, (and for free posters) or to update a current subscription, visit http://portal.sans.org/
