BLOG

Cloudflare Public DNS Service

Domain Name Service (DNS) is an integral part of today’s public Internet infrastructure. The purpose of DNS is to resolve names to IP addresses and the technology itself was invented in 1983 when security was an afterthought. As a result, over the years many types of DNS attacks have been seen such as DNS spoofing, cache poisoning, and many others. These attacks often consist of sending incorrect DNS responses back to clients in the hope the clients will communicate with network nodes across the internet, which are controlled by attackers instead of the originally requested legitimate nodes.

In response to the security shortcomings of DNS, additional protocols have been created to mitigate security risks such as Domain Name System Security Extensions (DNSSEC). DNSSEC essentially forms a signed chain of trust within the hierarchical infrastructure of DNS nodes so when a client queries a node’s IP address there is verification that the resolved response is legitimate. Cloudflare, a cloud-based company that is known for its content delivery network, DDOS mitigation, and security services has recently made mainstream news with its new DNS public consumer services offering. What makes Cloudflare’s public DNS so attractive is that they can compete, if not surpass, Google’s DNS services in both performance and security. In their recent blog post published this past Sunday, they boast their “fast and highly distributed network, and claim they are the fastest authoritative DNS provider on the Internet with seven million Internet properties.” Additionally, their new public DNS service supports DNS over HTTPS and DNS over TLS for added encrypted communication across the Internet.

What seems to make Cloudflare more attractive than Google is their emphasis on privacy and speed. Their goal according to their blog is to keep expanding their infrastructure until everyone is within 10 milliseconds of at least one of their DNS locations. Additionally, Cloudflare uses protocols such as DNS Query Name Minimization to minimize captured public information as it crosses DNS nodes. Furthermore, Cloudflare states they will never store any information in their logs that identifies end users. All logs collected by public resolvers will be deleted within 24 hours. Their resolvers are built from the open source DNS resolver and the modular designed Knot Resolver, which was released about two years ago and currently has a large and active user base.

To check if you are currently using DNSSEC, you can visit http://www.dnssec-ornot.com/.  To try out Cloudflare’s DNS service visit https://1.1.1.1/.

Sources 
https://blog.cloudflare.com/dns-resolver-1-1-11
https://github.com/hashcat/hashcat  
 https://threatpost.com/cloudflare-launches-publicly-dns-over-httpsservice/130900/


Wed, 11 Apr 2018 21:28:00 +0000

---

IC3 Issues Alert on Tech Support Fraud

Thu, 29 Mar 2018 19:42:00 +0000

---

Windows Server 2019 – now available in preview

At Ignite in September 2017, we announced the Technical Preview of Project Honolulu– our reimagined experience for management of Windows and Windows Server. Project Honolulu is a flexible, lightweight browser-based locally-deployed platform and a solution for management scenarios. One of our goals with Project Honolulu is to make it simpler and easier to connect existing deployments of Windows Server to Azure services. With Windows Server 2019 and Project Honolulu, customers will be able to easily integrate Azure services such as Azure Backup, Azure File Sync, disaster recovery, and much more so they will be able to leverage these Azure services without disrupting their applications and infrastructure.

 

Security:

Security continues to be a top priority for our customers. The number of cyber-security incidents continue to grow, and the impact of these incidents is escalating quickly. A Microsoft study shows that attackers take, on average, just 24-48 hours to penetrate an environment after infecting the first machine. In addition, attackers can stay in the penetrated environment – without being noticed – for up to 99 days on average, according to a report by FireEye/Mandiant. We continue on our journey to help our customers improve their security posture by working on features that bring together learnings from running global-scale datacenters for Microsoft Azure, Office 365, and several other online services.

Our approach to security is three-fold – Protect, Detect and Respond. We bring security features in all three areas in Windows Server 2019.
On the Protect front, we introduced Shielded VMs in Windows Server 2016, which was enthusiastically received by our customers. Shielded VMs protect virtual machines (VM) from compromised or malicious administrators in the fabric so only VM admins can access it on known, healthy, and attested guarded fabric. In Windows Server 2019, Shielded VMs will now support Linux VMs. We are also extending VMConnect to improve troubleshooting of Shielded VMs for Windows Server and Linux. We are adding Encrypted Networks that will let admins encrypt network segments, with a flip of a switch to protect the network layer between servers.

On the Detect and Respond front, in Windows Server 2019, we are embedding Windows Defender Advanced Threat Protection (ATP) that provides preventative protection, detects attacks and zero-day exploits among other capabilities, into the operating system. This gives customers access to deep kernel and memory sensors, improving performance and anti-tampering, and enabling response actions on server machines.

 

 

Application Platform:

 

A key guiding principle for us on the Windows Server team is a relentless focus on the developer experience. Two key aspects to call out for the developer community are improvements to Windows Server containers and Windows Subsystem on Linux (WSL).

Since the introduction of containers in Windows Server 2016, we have seen great momentum in its adoption. Tens of millions of container images have been downloaded from the Docker Hub. The team learned from feedback that a smaller container image size will significantly improve experience of developers and IT Pros who are modernizing their existing applications using containers. In Windows Server 2019, our goal is to reduce the Server Core base container image to a third of its current size of 5 GB. This will reduce download time of the image by 72%, further optimizing the development time and performance.

We are also continuing to improve the choices available when it comes to orchestrating Windows Server container deployments. Kubernetes support is currently in beta, and in Windows Server 2019, we are introducing significant improvements to compute, storage, and networking components of a Kubernetes cluster.

A feedback we constantly hear from developers is the complexity in navigating environments with Linux and Windows deployments. To address that, we previously extended Windows Subsystem on Linux (WSL) into insider builds for Windows Server, so that customers can run Linux containers side-by-side with Windows containers on a Windows Server. In Windows Server 2019, we are continuing on this journey to improve WSL, helping Linux users bring their scripts to Windows while using industry standards like OpenSSH, Curl & Tar.

Finally, Window Server customers using System Center will be excited to know that System Center 2019 is coming and will support Windows Server 2019.

We have much more to share between now and the launch later this year. We will bring more details on the goodness of Windows Server 2019 in a blog series that will cover the areas above.

Sign up for the Insiders program to access Windows Server 2019

We know you probably cannot wait to get your hands on the next release, and the good news is that the preview build is available today to Windows Insiders. Join the program to ensure you have access to the bits. For more details on this preview build, check out the Release Notes.

We love hearing from you, so don’t forget to provide feedback using the Windows Feedback Hub app, or the Windows Server space in the Tech community.

 

 

Wed, 21 Mar 2018 18:42:00 +0000

---

Breaking Botnets and Wrestling Ransomware Webcast

Sat, 17 Mar 2018 14:51:00 +0000

---

4G LTE Under Attack

 
The discovery of this set of vulnerabilities may sound like just another security story; however, the potentialfor abuse here is enormous. In addition to tracking an individual’s location, their location can also be spoofed or altered. This presents unique challenges for criminal investigations as criminals can use this to provide false alibis or even frame another person. The research also proves it possible for an attacker to generate and distribute fake emergency alerts. As seen in the recent case of the false alarm for a threat against Hawaii, this could be abused to create massive disruption.

All of these potential attack scenarios are made possible by authentication relay attacks. A successful authentication relay attack will allow an attacker to bypass network authentication defenses without any legitimate credentials and disguise their identity. Once authenticated an attacker has access to the network core where they can essentially block a target device from receiving notifications altogether.

The major cellular carriers have been notified of these flaws and are in the process of releasing fixes. The research team has agreed to not release their proof of concept code until the fixes have been applied. Perhaps the most troubling part of this story is that these types of attacks can be conducted for as little as $1,300, which is negligible to a well-organized criminal effort

Sources:

https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/new- campaign-exploits-cve-2018-4878-anew-via-malicious-microsoft-word-documents

http://blog.talosintelligence.com/2018/02/group-123-goes-wild.html

 

Tue, 13 Mar 2018 19:46:00 +0000

---

Re-purposing Lucrative Exploits

Figure 1. Exploit workflow. Source - http://blog.talosintelligence.com/2018/02/group-123-goes- wild.html

Adobe released a patch for the troubling zero-day on 6 of February to address CVE-2018- 4878 aiming to protect victims from the RCE vulnerability, but attackers found a new way to exploit CVE-2018-4878 as noted by TREND MICRO in their February 27, 2018 report stating "The campaign involves the use of malicious spam - specifically with a spam email that with an embedded link that directs the recipient to a Microsoft Word lure document (Detected by Trend Micro as TROJ_CVE20184878.A and SWF_CVE20184878.A) stored on the malicious website safe-storage[.]biz. After the file is downloaded and executed, it will prompt the user to enable editing mode to view what's inside the document. This document is what triggers the exploitation of CVE-2018-4878 - in particular, a cmd.exe window is opened that is remotely injected with a malicious shellcode."

 This reviving of CVE-2018-4878 illustrates not only the classic "cat and mouse" dance between attacker and defender but also the ability and keenness of attackers to adapt methods to keep exploiting lucrative vulnerabilities such as those with high NVD scores.



Sources:
https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and- exploits/new-campaign-exploits-cve-2018-4878-anew-via-malicious-microsoft- word-documents

  http://blog.talosintelligence.com/2018/02/group-123-goes-wild.html


Thanks to Peraton CIP report for this information

Sat, 03 Mar 2018 19:24:00 +0000

---

Malware: The New DRM Solution

Software piracy has been an issue for about as long as there has been software to pirate. Companies are constantly developing new Digital Rights Management (DRM) solutions to protect their products, while software pirates, known as crackers, are constantly finding new ways to bypass these technologies. However, FlightSimLabs (FSLabs) recently thought of a new DRM strategy: place malware within their installer.


FlightSimLabs develops add-ons for Microsoft’s Flight Simulator game. These add-ons allow customers to buy additional planes to fly, expanding the game experience. Some Reddit users noticed a strange file, test.exe, which was extracted into a temporary folder when the A320X add-on was installed. Upon further investigation, the executable turned out to be malware purposefully placed by FSLabs to steal usernames and passwords stored in Google Chrome when a pirated copy is installed.

The malware is designed to run only when a flagged serial number is detected. The application is actually the command-line tool Chrome Password Dump

created by SecurityXploded which retrieves and displays usernames and passwords from Chrome in an easy-to-read format. The .bin file provided with the FSLabs application calls the test.exe file and sends the output to a Log.txt file. As if this wasn’t bad enough, the text file is then encoded with Base64.exe and sent back to an FSLabs site, installLog.flightsimlabs.com over an HTTP connection (not even

HTTPS). Security researchers at Fidus Information Security determined that the malware was not called when the application is run with a legitimate serial number.
 The founder and owner of FSLabs, Lefteris Kalamaras, states "First of all – there are no tools used to reveal any sensitive information of any customer who has legitimately purchased our products." The malware was intended to collect information on people using pirated copies only. However, stealing credentials may still violate multiple sections of the Computer Fraud and Abuse Act. Also, even though the malware is not activated by the add-on for legitimate users, it was still extracted and puts their systems at risk of someone else activating it. FSLabs has offered another version of the installer without the test.exe file.


Sources:


 https://threatpost.com/flight-sim-labs-heavy-handed-anti-piracy-tactics-raise-hackles/130005/ 
 https://www.fidusinfosec.com/fslabs-flight-simulation-labs-dropping-malware-to-combat-piracy/   https://www.extremetech.com/gaming/264411-flight-sim-labs-caught-deliberately-distributing-malware-gaming-mods   
Thanks to Peraton CIP report for this information
 
 
 

 
 

 






Sat, 03 Mar 2018 19:08:00 +0000

---

National Consumer Protection Week

Original release date: March 02, 2018

March 4–10 is National Consumer Protection Week (NCPW), an event to encourage people and businesses to learn more about avoiding scams and understanding consumer rights. During NCPW, the Federal Trade Commission (FTC) and its partners highlight free resources to help protect consumers.

NCCIC/US-CERT recommends consumers participate in the FTC/Facebook live chats and review the following NCCIC/US-CERT security tips:

• Protecting Your Privacy
• Avoiding Social Engineering and Phishing Attacks
• Preventing and Responding to Identity Theft

Sat, 03 Mar 2018 19:03:00 +0000

---

Winter Olympics Cyberattack

The Olympic Games have always been a symbol of global unity and cooperation, mixed in with friendly competition of course. However, this can also mark the games as a target for groups that don’t share that worldview. This year, the Winter Olympics opening ceremony was targeted by a cyberattack focused on disruption and destruction of systems. The attack resulted in the official website being offline for roughly 12 hours, preventing attendees from accessing tickets and information, as well as disrupting the Wi-Fi at the stadium and various news coverage feeds.

Security researchers at Cisco’s Talos group analyzed the malware and have dubbed it Olympic Destroyer. While it is still unclear how the systems became initially infected, Talos has disclosed some details of how the malware operates. The malware is contained within a binary file which is responsible for propagation across the network. It checks the Address Resolution Protocol (ARP) table on the system to discover additional targets, as well as using the Windows Management Instrumentation Query Language (WQL) to run the request "SELECT ds_cn FROM ds_computer" to find other systems. These are carried out using legitimate administrative tools included with Windows, PsExec and WMI. The other function of the binary file is to drop 2 modules, the credential stealers.
 
The stealer modules focus on different types of credentials: a web browser module and a system module. The web browser stealer parses the SQLite file in the registry to access stored credentials for Internet Explorer, Firefox, and Chrome. The system module gathers credentials from the Local Security Authority Subsystem Service (LSASS), a Windows process that enforces security policy for the system. Once credentials have been gathered, the binary file is updated to include the credentials hardcoded in, to be used on newly infected systems for further access.
After reconnaissance, the malware begins a destruction phase to disable the system. Using the Windows command line (cmd.exe), various tasks are carried out to prevent recovery of the system: deletion of all shadow copies on the system, deletion of the wbadmin catalog, using bcdedit to change the boot configuration and disable Windows recovery, and deleting the System and Security Windows Event logs. Finally, the malware stops and disables all Windows services and shuts down the system, preventing it from being restarted in a usable state.
Olympic Destroyer used well-known Sysinternal tools included with Windows, implying the attacker knew the targets were Windows-based. Talos also suggested the attacker knew a “lot of technical details of the Olympic Game infrastructure such as username, domain name, server name, and
obviously password.”

Sources:

·   https://threatpost.com/olympic- destroyer-malware-behind-winter- olympics-cyberattack-researchers- say/129918/

·   http://blog.talosintelligence.com/201 8/02/olympic-destroyer.html

https://thehackernews.com/2018/02/p yeongchang-2018-winter-olympics.html

and The CIP from Peraton

Thu, 22 Feb 2018 21:39:00 +0000

---

Final Public Draft of Special Publication (SP) 800-171A, Assessing Security Requirements for Controlled Unclassified Information

NIST Computer Security Division Releases the Final Public Draft of Special Publication (SP) 800-171A, Assessing Security Requirements for Controlled Unclassified Information


NIST Computer Security Division releases the Final Public Draft of Special Publication (SP) 800-171A, Assessing Security Requirements for Controlled Unclassified Information is now available for public comment.  See below for further details.

Learn about the updates to the Final Draft SP 800-171A on the NIST CSRC website at:
https://csrc.nist.gov/News/2018/NIST-Releases-Final-Draft-SP-800-171A

Below is the link to the Draft SP 800-171A publication record where links to the document, the comment template and other supplemental information is available:
https://csrc.nist.gov/publications/detail/sp/800-171a/draft

Deadline to submit comments to draft SP 800-171A: March 23, 2017

Email comments or questions about this draft document to:
sec-cert@nist.gov

Thu, 22 Feb 2018 21:33:00 +0000

---