Tag Archives: F5 Networks

WannaCry Portends a Surge in Attacks

The landmark WannaCry ransomware attack, I believe, may have been a proof of concept experiment that inadvertently spun out of control after it got released prematurely.

But now that it’s out there, WannaCry signifies two developments of profound consequence to company decision-makers monitoring the cybersecurity threat landscape:

  • It revives the self-propagating internet worm as a preferred way to rapidly spread new exploits, machine to machine, with no user action required.
  • It lights up the cyber underground like a Las Vegas strip billboard, heralding a very viable style of attack. WannaCry already has begun to spur hackers to revisit self-spreading worms, an old-school, highly invasive type of attack.

The unfolding “kill switch” subplot supports my analysis.

First, a recap: WannaCry is an exploit that spreads on its own, seeking out Windows laptops, desktops and servers that lack a certain security patch issued in March by Microsoft.

See also: How to Keep Malware in Check  

WannaCry first appeared on the internet on a Friday morning and swiftly swept across the globe, reminiscent of the I Love You and Code Red worms of yore. It infected 200,000 Windows machines in 150-plus countries. Hardest-hit were institutions of the U.K.’s National Health Service, as well as Spanish and Russian utility companies.

You may recall that self-spreading Windows worms were all in vogue a decade ago. The most infamous probably was Conficker. I wrote extensively about Conficker for USA Today. But for all the attention Conficker drew, it never delivered any overtly malicious payload. It simply spread.

WannaCry, by contrast, is spreading with a purpose. It carries with it instructions to encrypt each infected machine’s hard drive. Then it requests a $300 ransom, payable in bitcoin, to decrypt the drive.

So why do I think WannaCry was released prematurely? Because $300 is low for a ransom demand, especially for a ransomware attack aimed at the business sector and designed to scale globally. It makes more sense that $300 was a placeholder amount.

“This looked like a shotgun approach to compromise as many systems as quickly as possible before anti-virus definitions could catch up,” says Andrew Spangler, principal malware analyst at Nuix, an intelligence, analytics and cybersecurity solutions company. “It’s possible the attackers were not even aware of how effective this propagation method would be.”

Kill switch discovered

On Friday night, a researcher going by the handle “Malware Tech” reported that he had reverse-engineered WannaCry and discovered a “kill switch” sitting at a domain name that the author had not yet actually registered.

A kill switch also is somewhat unusual for ransomware. It could have been included as a tool to give the attacker the ability to release the ransomware in small doses, shutting it down to make tweaks. But WannaCry’s creator neglected to follow through and register his kill switch’s domain name.

That made it possible for Malware Tech to come along, discover the unregistered domain name, register it and thus take control of the kill switch. He then was able to shut down the original version of WannaCry—by hitting the kill switch.

Yet to no one’s surprise, within a matter of hours, slightly tweaked variants of the original version began circulating. “Updated WannaCry variations have since been released,” says Ray Pompon, principal threat researcher at F5 Networks, an application services and security company. “The danger is still real.”

Good guys, bad guys engage in cyber duel

To be specific, new variants with a slightly modified kill-switch domain are spreading. A very small change connects the malware’s kill switch to a slightly different domain and creates a viable variant, says Chris Doman, threat engineer at AlienVault. “This allows WannaCry to continue propagating again,” Doman says.

Fortunately, other good-guy researchers have taken it upon themselves to hustle to register the kill switch domains of any new variant that turns up and follow Malware Tech’s example to kill the variant when possible.

“The cat-and-mouse (chase) will likely continue until someone makes a larger change to the malware, removing the kill-switch functionality completely,” Doman says. “At that point, it will be harder to stop new variants.”

Security patching more vital than ever

The kill switch subplot aside, one might ask why did it took this long—nearly a decade after Conficker—for cyber criminals to incorporate a Windows worm into an attack designed for monetary gain?

Part of the reason is that Microsoft has put forth a tremendous effort to stay on top of newly discovered Windows vulnerabilities. Under its bug bounty program, it pays researchers handsomely to discover and report fresh Windows vulnerabilities. And it pours vast resources into issuing security patches in a timely manner.

See also: It’s Time for the Cyber 101 Discussion  

With respect to the specific Windows bug leveraged by WannaCry, Microsoft issued a patch in March. Still, the digital world we live in is both amazing—and amazingly complex. That means implementing security patches across an organization of any size can be an onerous process.

The result is that vulnerability management, and security patching, lags well behind in the vast majority of organizations. This is true for patches issued by Microsoft, Oracle, Java, Adobe and any other widely used business system you care to name.

“Numerous organizations have fallen victim to these attacks because they failed to apply the patches in a timely manner or were using legacy systems that could not be patched,” says Andreas Kuehlmann, senior vice president and general manager of the Software Integrity Group at Synopsys.

Unintended help from government

An X-factor also came into play. It turns out that the National Security Agency knew all about this particular Windows bug and, in fact, possessed a tool to take advantage of it. Nothing wrong with that. Our intelligence agencies need to have the capability to match or exceed the cyber capabilities of China, Russia or North Korea.

The X-factor that made a difference was this: Hackers stole that information from the NSA and published it online—delivering it on a silver platter to the creator of WannaCry.

“Now that weapons-grade cyber attack tools are in the wrong hands, it is clear that tools and techniques previously reserved for use by nation-states are being integrated into crime ware for profit,” says Josh Gomez, senior security researcher at Anomali. “This means we can expect to see more of these exploits and tools leveraged in future attacks, each one likely surpassing the previous in sophistication and stealth.”

Hang on to your hats, folks. Buckle your seat belts. Company networks’ defenses sorely need shoring up: This, we know all too well. And now attacks are all but certain to ratchet to an unprecedented level of intensity.

Observes Jonathan Sander, chief technology officer at STEALTHbits Technology: “This massive attack is a potent mix of phishing to attack the human, worm to spread via unpatched Microsoft systems and ransomware to get the bad guys their payday. … The reason for WannaCry’s success is our collective failure to do the basic security blocking and tackling of patches, user education and consistent backups. As long as we fail to remove vulnerabilities and watch our files, bad guys will exploit us by exploiting our systems.”

Will 2015 Top 2014 in Security Exposures?

It’s hard to imagine how 2014 could be surpassed as the worst year for massive identity theft and data loss exposures.

The news developments of 2014 were relentless and mind-numbing. Heartbleed and Shellshock rose to the fore as two of the nastiest Internet-wide vulnerabilities ever to come to light. Heartbleed exposes the OpenSSL protocols widely used by website shopping carts. And Shellshock enables a hacker to take control of the module used to type text-based commands on Linux, Unix and Mac servers.

“These are problems in the very fabric of what the Internet is built on,” says David Holmes, security evangelist at F5 Networks.

Click here to receive fresh analysis of breaking developments from top cybersecurity and privacy experts.

Meanwhile, Target, Nieman Marcus, Dairy Queen, Home Depot, JP Morgan and SonyPictures led a parade of organizations disclosing major data breaches. Indeed, the tally of data breaches made public in the U.S. hit a record 783 in 2014, nearly 30% higher than in 2013, according to the the Identity Theft Resource Center.

“The ubiquitous nature of data breaches has left some consumers and businesses in a state of fatigue and denial about the serious nature of this issue,” says Eva Velasquez, chief executive offer of the ITRC.

The scary part

Now here’s the scary part: The pace hasn’t slowed in the first few weeks of 2015.

Consider that the financial services sector has spent billions over the past decade on the best defensive technologies and systems money can buy. Yet a low-level Morgan Stanley financial adviser was able to exfiltrate account records, including passwords, for six million of the Wall Street giant’s clients.

Meanwhile, forensic analysts at Dell SecureWorks recently uncovered a novel strain of malware circulating deep inside a corporate network. It’s being referred to as a “skeleton key.” With a skeleton key an intruder can fool the authentication protocols on widely used Microsoft Active Directory systems by typing arbitrary passwords. This enables the attacker to do such things as gain unfettered access to webmail and virtual private networks (VPNs).

“It’s much easier to be an attacker than a defender,” observes Jeff Williams, director of security strategy for Dell SecureWorks’ Counter Threats Unit. “As a defender, you must protect all paths of access, whereas the attacker only needs to find one foothold from which to mount an intrusion.”

If nothing else, the headlines of 2014 should grab the attention of company owners, directors and senior executives. No one wants to make it to the ITRC’s list of U.S. breaches for 2015.

SMBs exposed

But small and medium-sized businesses (SMBs) should pay heed as well, says William Klusovsky, a security specialist at NTT Com Security. SMBs should grasp that they are part of a wider supply chain and that modern day cybercriminals are intensively hunting for all weak links, he says.

Small business owners should “understand your businesses processes, be aware of your risk profiles and be able to explain that to your partners,” Klusovsky advises. “And then within reason implement the protections you can afford.”

A good place to start, for companies of any size, is to step into an attacker’s shoes, Dell SecureWorks’ Williams says. “Identify paths of entry and put mitigations in place, whether that be two-factor authentication, removing unneeded services, implementing, monitoring or training staff,” Williams says.

Security consultants can be valuable guides, and third-party managed services can do the day-to-day heavy lifting. But the due diligence must come from the business owner.

The business owner should plan to “remain engaged and active in the conversations with that security service provider,” Williams says.

Over time, all business owners need to develop some level of skill about security policies and procedures and look to infuse that knowledge into the company’s infrastructure.

See more at Third Certainty