Wednesday 12 April 2017

Detecting & Preventing APT10 Operation Cloud Hopper

There has been much concern over a state-sponsor threat known as APT10 Operation Cloud Hopper, also known as Stone Panda, after the UK National Cyber Security Centre (NCSC) recently spooked UK businesses and their suppliers about a Chinese threat actor posing a serious threat to IT Managed Service Providers (MPS) and their UK clients.   

Overview of the Threat
APT10, a Chinese-based hacking group also known as Stone Panda, MenuPass, CVNX, and Potassium is operating a hacking campaign known as Operation Cloud Hopper, which is believed to have been underway since 2014. There are intelligence reports which indicate the APT10 threat actor has significantly upscaled their capabilities and attack sophistication in early 2016. The APT10 Cloud Hopper campaign focuses on sending malware infected emails to staff working at IT Managed Service Providers (MPS), once executed the malware creates a backdoor which allows the attacker remote access to the MSP's backend systems. From there the attackers are able to navigate the MSP network and identify external connections with the MSP clients, which are their actual targets. These network channels are then used to steal data from those clients, data which is packaged and exhilarated through the MSP remote connection. These backdoors are known to remain undetected for months, due to the use of tailored malware which is undetectable by anti-virus and security monitoring systems.

So how do you know if your business has been infiltrated or is being attacked by APT10, aside from the NCSC informing you are a victim?
PwC and BAE Systems have been assisting NCSC with APT10, have produced a list of known source IP addresses of the attackers, which can be imported into security monitoring solutions such as firewalls, IDS/IPS, proxy servers, content filtering and SIEM \ log management solutions. Any hits against these IP addresses would be highly concerning, in such scenarios I would recommend unplugging the network cable (and not powering off) all suspect systems, and then seeking help from external qualified and experienced digital forensic investigator if you don’t have one to hand in your business. There are other known APT10 IP addresses to be found within the NCSC CiSP forum, but you will have to sign up to get those here. https://www.ncsc.gov.uk/cisp

PwC and BAE Systems have also provided an extract list of known APT10 malicious MD5 file hashes (unique identifier for the known malicious APT10 related files).These MD5 hash lists can be used to scan for the presence of known malicious APT10 files on servers and workstations. I recommend importing those file MD5 hash lists into a scanner, such as the Nessus Vulnerability Scanner, and scanning the entire IT estate on a regular basis if your business is an IT MSP.

APT10 is Active and Here to Stay
Keep an eye on the NCSC, PwC and BAE Systems for updates about the APT10 threat, as they are likely to provide updated lists of known associated IP addresses and further MD5 file hashes as more incidents are investigated and intelligence comes to their attention. Given this threat actor is said to be still active and is known to be operational for several years, don't expect APT10 to be going away anytime soon, after all APT actually stands for Advanced 'Persistent' Threat. So if you are an IT MSP, it will be prudent to routinely check and update your lists of APT10 suspected IP addresses and MD5 file hashes to be monitored and regularly scanned.

Most anti-virus and web filtering vendors worth their salt should now be aware of this threat and should be keeping up-to-date with the latest APT10 related malware and associated IP addresses and file hashes as well, but it is well worth asking them about their position. It goes without saying that it is paramount to keep all security prevention and monitoring systems bang up-to-date, as is performing regular external and internal network vulnerability scans, and monitoring and acting upon any signs of compromise.

Tuesday 11 April 2017

WinZip Encryption Password Security (2017)

9 years ago I wrote a post on WinZip Encryption Security, that post has received tens of thousands of visits over the years and continues to be pretty popular, but it is high time for that advice to be refreshed. The advice below also applies to 7-Zip, which also supports the same type of encryption as WinZip.

Do not use WinZip ‘Standard Zip 2.0 Encryption’
WinZip pre-version 9 only offered WinZip's own proprietary encryption algorithm called Zip 2.0 encryption, which is broken, so never use WinZip pre-version 9 or the “WinZip's Zip 2.0 Encryption” as an option, as passwords of any strength can very easily be recovered with third party cracking tools. WinZip versions 9 to 21 defaults to use the National Institute of Standards and Technology (NIST) scrutinised and US government agency approved encryption algorithm called the Advanced Encryption Standard (AES) - http://csrc.nist.gov/groups/STM/cavp/documents/aes/aesval.html . This is great, however, WinZip still includes the option to change the encryption to use the flawed Zip 2.0 encryption.

Use AES-256, but there’s nothing wrong with AES-128
The latest version of WinZip (Version 21) defaults to use the AES-256 encryption and also supports AES-128. There is hardly any noticeable speed advantage in encrypting and decrypting with AES-256 over AES-128 given the brilliant efficiency in the way AES cryptographic algorithm works, so given the lack of overhead, it makes sense to stick with the default and much stronger flavour of AES-256. 
However, both AES-128 and AES 256 are considered strong enough for commercial industry best practice and both are NIST approved to use until at least the year 2031. To put the strength of AES-128 into perspective, the '128' bit number equates to 3,400,000,000,000,000,000,000,000,000,000,000,000,000 possible keys, so guessing or cracking a key of that length is far from feasible at the moment. We also know the AES algorithm doesn’t have any sufficiently serious flaws to get around the encryption process, the Achilles Heel is the password you choose to generate that encryption key.

Use a Complex Password (Super Important)
I recommend the following password rules if you are serious about protecting your data with WinZip AES encryption, or any other AES encryption which uses a password for that matter, use a password that is:
  • at least 12 characters in length
  • is random i.e. does not contain any dictionary, common words or names
  • is not commonly known or guessable password i.e. P@$$w0rD1
  • has at least one Upper Case Character e.g. A to Z
  • has at least one Lower Case Character e.g. a to z
  • has at least one number e.g. 0 to 9
  • has at least one Special Character e.g. !,",£,$,%,@,#
Recommended Vs WinZip Default Password Policy

Why you need a Complex Password
WinZip’s AES encryption uses “Symmetric” encryption, as such the password is used to generate an AES private encryption key, if you know or can guess the password, you beat the encryption. So the complexity and strength of the password is by far the weakness point. An attacker in possession of a WinZip encrypted file has unlimited attempts at guessing that password to decrypt the WinZip archive, the defence is time, by using a password complex and long enough the thwart the unlimited amount of attempts at being successful. Hackers mainly use two attack types to crack WinZip encrypted file passwords, Dictionary Attacks and Brute Force Attacks. We'll save Rainbow table encryption cracking for another post.

A Dictionary Attack is as it sounds, the attacker tries commonly known to be used passwords and words found in a dictionary. Hackers build their own password dictionary databases by harvesting password uncovered in past data breaches which are freely available online and on the dark web, such as the recent account passwords dump following the Yahoo Data Breach. The attacker then uses a tool to script attempts, allowing thousands of password attempts from their dictionary databases to be tried in minutes.

Dictionary Attack Tool

Top Ten Account Password in Breached Yahoo Accounts
  1. 123456
  2. password
  3. welcome
  4. ninja
  5. abc123
  6. 123456789
  7. 12345678
  8. sunshine
  9. princess
  10. qwerty
The other common password cracking technique is a Brute Force Attack, in which every single combination of characters possible e.g. aaaa to zzzz is attempted, which is why I recommend using different character cases and specialist characters within lengthy passwords, as it serious extends the timeline for this type of attack to be successful.

Brute Force Attack 

Document names can be read within Encrypted Archives
There is one final issue to be aware of with WinZip encryption, an issue you don't have with other file encryption applications. Without knowing the password it is still possible for anybody to browse and read the filenames within encrypted archive, which obviously can give an attacker vital clues about the content and whether the encrypted zip file password is worth the effort to crack. One way around this is to double zip the archive, giving initial zip archive a random name, or use an alternative encryption tool following the creation of the zip file.

Anyone can read the Encrypted Zip Archived file names without the password

File Encryption Applications to Consider
There are plenty of other encryption tools you can use for file encryption as an alternative to using WinZip. 
  • TrueCrypt is free, multi-platform and has been my personal recommendation for many years. However after its development was discontinued in May 2014 following an audit, it caused controversy in the cyber security industry. Despite that, I think the latest version of TrueCrypt is still safe to use.
  • Verhttps://veracrypt.codeplex.com/aCrypt spawned out of TrueCrypt, an excellent and supported encryption tool which also works with Windows, Mac and Linux
  • AxCrypt is another free Windows-based encryption tool I recommend.
  • GNU Privacy Guard is an open-source version of the legendary Pretty Good Privacy (PGP)

Monday 3 April 2017

Cyber Security Roundup for March 2017

Security researchers found there were able to find numerous sensitive documents by searching Microsoft’s Office 365 documents made publically accessible through the Docs.com website. Documents found included business confidential information, passwords and personal data. The issue was not caused by any security vulnerability in O365, but by its users misconfiguring or not understand the access permissions on their Microsoft O365 file storage, inadvertently permitting public access to their confidential data.  Businesses and users need to meet cloud services halfway when it comes to security, that starts obtaining a clear understanding of what security the cloud service does and does not do, so ensure your security homework is done before adopting the cloud.

A patch for a critical vulnerability in Apache (Server) Struts was released this month, the vulnerability, which is being actively exploited by cyber criminals in ransomware attacks, allows the remote execution of commands on the server. Non-Microsoft patches are more likely to be missed, given the patch process of Apache servers is often a manual one. It is essential to check any Apache server software facing the internet is constantly kept up to date, in this case, make sure the Struts framework element as used with Java EE web apps, is running a non-vulnerable version, either Struts 2.3.32 or Struts 2.5.10.1

It is the official 'goodbye Vista' next month as of 11 April 2017, Microsoft will no longer support Windows Vista, which means no further security updates to fix new vulnerabilities, either free or via paid assisted support options. So if you have Windows Vista, either upgrade or apply additional security measures such as application whitelisting to be safe. It is less overhead and cheaper long-term to upgrade to a supported Operating System in my view.

Finally, the UK Government Digital and Culture Minister, Matt Hanock, is pushing for further adoption of the Cyber Essentials scheme, insisting all governance contractors hold a Cyber Essentials certificate. A number of businesses have also agreed to require their suppliers to achieve Cyber Essentials, including Barclays, BT, Vodafone, Astra Zeneca, Airbus Defence & Space and Intel Security.  Hancock said   “We know the scale of the threat is significant: one in three small firms and 65% of large businesses are known to have experienced a cyber-breach or attack in the past year. Of those large firms breached, a quarter was known to have been attacked at least once per month.” Cyber-security is one of the seven pillars of the government's digital strategy, he said. “It's absolutely crucial UK industry is protected against this threat – because our economy is a digital economy.” 

News
Awareness, Education and Threat Intelligence
Reports