Flame Malware Spreads through the Middle East

Written by Martin W. Lewis on May 28, 2012

In 2010, the Stuxnet worm made global headlines as it attacked the Iranian nuclear program. Described by the Wikipedia as “the first discovered malware that spies on and subverts industrial systems,” Stuxnet was identified by the Belarussian antivirus software vendor, VirusBlokAda. Currently, a vastly larger and more powerful malware program called Flame (or sKyWIper) is infecting computers in Iran and neighboring countries. Flame, recently identified by the Russian anti-virus firm Kaspersky Lab, is so sophisticated that it might have been present, undetected, for years. According to a recent article in Wired, Flame’s “complexity, the geographic scope of its infections and its behavior indicate strongly that a nation-state is behind Flame, rather than common cyber-criminals — marking it as yet another tool in the growing arsenal of cyberweaponry.” The Wired article goes on to state that Flame is “designed primarily to spy on the users of infected computers and steal data from them, including documents, recorded conversations and keystrokes. It also opens a backdoor to infected systems to allow the attackers to tweak the toolkit and add new functionality.” According to another recent article, Flame has hit at least 600 computer systems thus far.

Speculations about the origin of Flame focus mostly on Israel and the United States. The fact that it is so large— 20 megabytes—has led to some interesting observations. One commentator on the Wired site (Lan8) joked about “Bloatware for malware, I LOVE it! Probably written in Redmond [home of Microsoft]. I wonder if you get a trial version of Warcraft with it?” Yet the same observer goes on more seriously to speculate that:

 [I]t’s the American version of the Israeli Stuxnet/DuQu … It seems to me that all the various components that do all the nifty little spy tricks seems like an American approach to spying (“give me everything you’ve got on….”) rather than the lean mean spying machine that was Stuxnet/DuQu, a more targeted and specific Russian/Israeli approach to similar ends.

Sumber :
http://geocurrents.info/news-map/flame-malware-spreads-through-the-middle-east

Computer Security Devices

To protect your network computer, you can use devices such as IPS HP Tipping Point S110, BlueCoat Proxy SG/ProxyAV, Citrix NetScaler, Tufin T-500, Riverbed SteelHead. The function and position on LAN of every device, is different.

The AppDV security solution is just one part of our HP TippingPoint comprehensive application security portfolio comprised of our Intrusion Prevention System (IPS), Security Management System (SMS), and hundreds of Digital Vaccines developed by DVLabs - all designed to help you manage and protect your vulnerable applications and your network from exploits and attacks.

The Blue Coat ProxySG appliance represents the latest in perimeter defense for securing and controlling Web-based content and applications. The Blue Coat ProxySG was designed to integrate protection and control functions for Internet and intranet traffic without sacrificing performance and employee productivity.

Citrix© NetScaler© is an all-in-one Web application delivery solution that makes applications run five times better by ensuring application availability through advanced L4-7 traffic management, by increasing security with an integrated application firewall and by substantially lowering costs by offloading servers. This reduces TCO, optimizes the user experience and makes sure that applications are always available. See more.

Tufin's SecureTrack provides configuration change monitoring, reporting, and alerting features specifically for corporate firewalls. Check Point (NG FP3+), Cisco (PIX, ASA, FWSM, IOS Routers), Juniper (ScreenOS), and soon Fortinet (FortiGate) firewalls are all supported. (How about MikroTik RouterBoard?)

The product is deployed on a central Red Hat (Enterprise Linux, CentOS) server. For Check Point firewalls, the product tracks all changes made by admins (watching for policy saves or installs) logged onto a Check Point SmartDashboard or Provider-1 GUI. When such changes are noted, the central server uses OPSEC to retrieve the policy, storing it in its own internal DB for subsequent analysis. For other supported firewalls, the product periodically logs into the firewall via SSH, retrieving the firewall's policies and ACLs and translating them into the product's internal XML rule base format. See more.

Riverbed Technology positions itself as being in the business of providing performance improvements to networked environments. Riverbed's WAN optimization products, both appliance-based and virtual, are branded under the product name Steelhead. The company differentiates itself in the market in part based on the relationships that it has with key technology partners, including Microsoft, EMC, HP, IBM and VMware. See more.

Price List

1. HP Tipping Point S110, US$9,289.99
2. Blue Coat ProxySG 300 Series SG300-25 - security appliance, USD $8,780.99
3. Citrix Netscaler NS 7000 Security Access Gateway, US $3,999.99
4. Tufin T-500 Appliance (Up to 100 firewalls, Quad-Core Intel® Xeon®, 8GB RAM, 1U, Dual PSU, RAID, 1-Year Support and Advanced Replacement Program Warranty), US$5,300
5. Riverbed Steelhead 1050-L (SHA-01050-L) with 4 onboard GbE bypass ports (800 conn/6Mbps), US$12,972. Can use single Steelhead? Or need a pair?

Cain & Abel v4.9.35, Testing Results

To test the security systems on multiple servers, I used Cain & Abel version 4.9.35 for Windows XP. Before I do the testing, I have to configure the program to select a specific adapter. For instance, I choose a NIC rather than a Wireless Adapter. Use the Configure menu -> click the Sniffer tab -> click \Device\NPF_bla bla bla -> OK. Choose the Sniffer tab, and than Start Sniffer icon. Check out HTTP group.

The results :
Secure : Yahoo Mail, ssh to nhc, Pustaka Iptek, Blogger, Winbox
Unsecure : Webmail, ftp to nhc, SITP, SIPL,
No checked : wcm, raker, help desk sjk, hotspot

Wireless LAN Security Summary

Wireless LAN Security Summary based on ISO 27001/ISO17799 are :

1. Develop an agency security policy that addresses the use of wireless technology, including 802.11.
A security policy is the foundation on which other countermeasures—the operational and technical ones—are rationalized and implemented. A documented security policy allows an organization to define acceptable architecture, implementation, and uses for 802.11 wireless technologies.

2. Ensure that users on the network are fully trained in computer security awareness and the risks associated with wireless technology (e.g., 802.11).
A security awareness program helps users to establish good security practices to prevent inadvertent or malicious intrusions into an organization’s information systems.

3. Perform a risk assessment to understand the value of the assets in the agency that need protection.
Understanding the value of organizational assets and the level of protection required is likely to enable more cost-effective wireless solutions that provide an appropriate level of security.

4. Ensure that the client NIC and AP support firmware upgrades so that security patches may be deployed as they become available (prior to purchase).
Wireless products should support upgrade and patching of firmware to be able to take advantage of wireless security enhancements and fixes.

5. Perform comprehensive security assessments at regular and random intervals (including validating that rogue APs do not exist in the 802.11 WLAN) to fully understand the wireless network security posture.
Security assessments, or audits, are an essential tool for checking the security posture of a WLAN and for determining corrective action to make sure it stays secure. Random checks ensure that the security posture is maintained beyond periods of assessment.

6. Ensure that external boundary protection is in place around the perimeter of the building or buildings of the agency.
The external boundaries should be secured to prevent malicious physical access to an organization’s information system infrastructure such as a fence or locked doors.

7. Deploy physical access controls to the building and other secure areas (e.g., using photo IDs or card badge readers).
Identification badges or physical access cards help to ensure that only authorized personnel have access to gain entry to a facility.

8. Complete a site survey to measure and establish the AP coverage for the agency.
Proper placement of Access Points will help ensure that there is adequate wireless coverage of the environment while minimizing exposure to external attack. The site survey should result in a report that proposes AP locations, determines coverage areas, and assigns radio channels to each AP and that ensures that the coverage range does not expose APs to potential malicious activities.

9. Take a complete inventory of all APs and 802.11 wireless devices.
A complete inventory list of APs and 802.11 wireless devices can be referenced when conducting an audit for unauthorized use of wireless technologies.

10. Ensure that wireless networks are not used until they comply with the agency’s security policy.
Security policy enforcement is vital for ensuring that only authorized APs and 802.11 wireless devices are operating in compliance with the organization’s wireless security policy.

Source : http://www.controlscada.com/download-free-iso-27001iso17799-wireless-lan-security-summary

Comparison between COBIT, ITIL and ISO 27001

Many friend of mine keep asking me about what is should be implemented first to improve their information system management: whether taking Cobit, ITIL, or ISO27001. And the next question usually which one is the easiest to be implemented in their company.

To be able to answer this question, let me tell you the definition of this three major standard in information system, who has a little bit difference in basic concept.

COBIT

Cobit is stand for Control Objective over Information and Related Technology. Cobit issued by ISACA (Information System Control Standard) a non profit organization for IT Governance. The Cobit main function is to help the company, mapping their IT process to ISACA best practices standard. Cobit usually choosen by the company who performing information system audit, whether related to financial audit or general IT audit.

ITIL

ITIL is stand for Information Technology Library. ITIL issued by OGC, is a set of framework for managing IT Service Level. Although ITIL is quite similar with COBIT in many ways, but the basic difference is Cobit set the standard by seeing the process based and risk, and in the other hand ITIL set the standard from basic IT service.

ISO27001

ISO27001 is much more different between COBIT and ITIL, because ISO27001 is a security standard, so it has smaller but deeper domain compare to COBIT and ITIL.

Here is the detail table of comparison between this three standard

AREA	COBIT	ITIL	ISO27001
Function	Mapping IT Process	Mapping IT Service Level Management	Information Security Framework
Area	4 Process and 34 Domain	9 Process	10 Domain
Issuer	ISACA	OGC	ISO Board
Implementation	Information System Audit	Manage Service Level	Compliance to security standard
Consultant	Accounting Firm, IT Consulting Firm	IT Consulting firm	IT Consulting firm, Security Firm, Network Consultant

What should be implemented first?

There's no exact answer about this question, but i think its really depend on your company and your requirement. Most of company start to implemented Cobit first because its cover general information system. And after that they usually choose between ITIL or ISO27001.

Another consideration is about budget and authoritive. Cobit implementation usually run from internal audit budget and ITIL or ISO27001 usually performed using IT departement budget. This consideration usually makes what kind of standard to implemented first become depend on management policy.

What is the easiest standard?

From the implementatation view, ITIL is the easiest standard to be implemented. Because, ITIL could be implemented partially and still not have impact on performance. Example, if IT departement lack of budget and he could choose to implement IT Service Delivery layer only, and the next year he will try to implement IT Release Management or IT Problem Management.<

However COBIT and ISO27001 is quite difficult to be implemented partially, since it should see a process in bigger view first before they could implemented partially.

How to choose the right vendor?

Many vendor said that he could help your company to implement these standard effectively, in fact there is no one solution for all. Usually the COBIT vendor come from Publci Accounting Firm who has an IT Audit arm, eg PWC, DTT, KPMG, EY. This type of vendor is best choice for COBIT since they also work for COBIT implementation derivative such as COBIT for Sarbanes Oxley.

The other standard ITIL and ISO27001 usually come from General IT Consulting Company, eg. IBM, Accenture. And for ISO27001 most of IT networking company also could offer this standard consultation.

Do you have any other opinion with this comparison?

Others referrence:
ISACA: Aligning COBIT, ITIL and ISO 17799 for Business Benefit

Download Hundreds of Complimentary Industry Resources

Get hundreds of popular Industry magazines, white papers, webinars, podcasts, and more; all available at no cost to you. With more than 600 complimentary offers, you'll find plenty of titles to suit your professional interests and needs. Click Here and Sign up today!

Source : http://www.securityprocedure.com/

WikiLeaks Cable about Chinese Hacking of U.S. Networks

We know it's prevalent, but there's some new information:

Secret U.S. State Department cables, obtained by WikiLeaks and made available to Reuters by a third party, trace systems breaches -- colorfully code-named "Byzantine Hades" by U.S. investigators -- to the Chinese military. An April 2009 cable even pinpoints the attacks to a specific unit of China's People's Liberation Army.

Privately, U.S. officials have long suspected that the Chinese government and in particular the military was behind the cyber-attacks. What was never disclosed publicly, until now, was evidence.


U.S. efforts to halt Byzantine Hades hacks are ongoing, according to four sources familiar with investigations. In the April 2009 cable, officials in the State Department's Cyber Threat Analysis Division noted that several Chinese-registered Web sites were "involved in Byzantine Hades intrusion activity in 2006."

The sites were registered in the city of Chengdu, the capital of Sichuan Province in central China, according to the cable. A person named Chen Xingpeng set up the sites using the "precise" postal code in Chengdu used by the People's Liberation Army Chengdu Province First Technical Reconnaissance Bureau (TRB), an electronic espionage unit of the Chinese military. "Much of the intrusion activity traced to Chengdu is similar in tactics, techniques and procedures to (Byzantine Hades) activity attributed to other" electronic spying units of the People's Liberation Army, the cable says.

[...]


What is known is the extent to which Chinese hackers use "spear-phishing" as their preferred tactic to get inside otherwise forbidden networks. Compromised email accounts are the easiest way to launch spear-phish because the hackers can send the messages to entire contact lists.

The tactic is so prevalent, and so successful, that "we have given up on the idea we can keep our networks pristine," says Stewart Baker, a former senior cyber-security official at the U.S. Department of Homeland Security and National Security Agency. It's safer, government and private experts say, to assume the worst -- that any network is vulnerable.

Two former national security officials involved in cyber-investigations told Reuters that Chinese intelligence and military units, and affiliated private hacker groups, actively engage in "target development" for spear-phish attacks by combing the Internet for details about U.S. government and commercial employees' job descriptions, networks of associates, and even the way they sign their emails -- such as U.S. military personnel's use of "V/R," which stands for "Very Respectfully" or "Virtual Regards."

The spear-phish are "the dominant attack vector. They work. They're getting better. It's just hard to stop," says Gregory J. Rattray, a partner at cyber-security consulting firm Delta Risk and a former director for cyber-security on the National Security Council.

Spear-phish are used in most Byzantine Hades intrusions, according to a review of State Department cables by Reuters. But Byzantine Hades is itself categorized into at least three specific parts known as "Byzantine Anchor," "Byzantine Candor," and "Byzantine Foothold." A source close to the matter says the sub-codenames refer to intrusions which use common tactics and malicious code to extract data.

A State Department cable made public by WikiLeaks last December highlights the severity of the spear-phish problem. "Since 2002, (U.S. government) organizations have been targeted with social-engineering online attacks" which succeeded in "gaining access to hundreds of (U.S. government) and cleared defense contractor systems," the cable said. The emails were aimed at the U.S. Army, the Departments of Defense, State and Energy, other government entities and commercial companies.

By the way, reading this blog entry might be illegal under the U.S. Espionage Act:

Dear Americans: If you are not "authorized" personnel, but you have read, written about, commented upon, tweeted, spread links by "liking" on Facebook, shared by email, or otherwise discussed "classified" information disclosed from WikiLeaks, you could be implicated for crimes under the U.S. Espionage Act -- or so warns a legal expert who said the U.S. Espionage Act could make "felons of us all."

As the U.S. Justice Department works on a legal case against WikiLeak's Julian Assange for his role in helping publish 250,000 classified U.S. diplomatic cables, authorities are leaning toward charging Assange with spying under the Espionage Act of 1917. Legal experts warn that if there is an indictment under the Espionage Act, then any citizen who has discussed or accessed "classified" information can be arrested on "national security" grounds.

Maybe I should have warned you at the top of this post.

Source : http://www.schneier.com/

Computer Security at Nuclear Facilities

The aspects that must be considered when applying computer security are wired network, wireless network, computer servers (include use secure OS), application software (mail, web, database), network devices (gateway, router, firewall, switch), computer room, network (wired and wireless) monitoring tools, testing/detecting/monitoring software tools, anti virus, IDS/IPS, cryptography, early warning system. The most important is the awareness of users. Without this, every effort be useless.

Computer Security is talking about how to prevent and detect from unauthorized access from unwanted users from certain computer system. Prevent to protect.

Rule 10/90, that is 10% technique, 90% habit.
Example :

1. Yes, you need a password
2. How to save it
3. How to written down
4. Don't using easy password
5. Don't using the same password
6. Don't give somebody else
7. Change password periodically
   
8. Remember to logout
9. Make sure already logout
10. Always login on secure system, no key logger, no cam, no spyware
    

Bugs and Security holes

• Bugs : error in computer system.
  
• Vulnerabilities (security hole) : bugs that enable user to violate security policy. For instance: wired network, wireless network and Operating Systems.
  
• Security hole : errors in design, errors in implementation, errors in maintenance. For instance: hand made applications, hand made programs, CMS.
  

Solution : hardened

Catagories computer misuse :

• External
• Hardware misuse
• Masquerading
• Pest Program
• By passes
• Active misuse
• Passive misuse
• Inactive misuse
• Indirect misuse

Severity

• Administration access : allows administrative activies on the computer, above and beyond that of a normal user
• Read restricted access : allows access to files that can normally not be accessed, or can view information not supposed to be viewed that may lead to a security compromise
• Reguler user access : access as a regular user has a strong degree of severity because these are typically many more ways interact with the system than without access at all
• Spoofing : allows the intruder to assume the identity of a user, computer, or network entity. This can result in other systems trusting the intruder and allow a system compromise
• Non-detectability : arises when a logging system has been disabled or otherwise malfunction. This can allow an intruder to perform actions that cannot be recorded.
• Deniel of Service : lowest degree of severity

Tools for information collection :

• Nikto, looking for detail and possibility of vulnerbility.
• w3bfuktor, directories
• sqler.sh, sql injection
• hping, testing for detail packet handling, blocking by firewall or not
• nmap, open port

Cheak out :
Top 100 Network Security Tools, include Nessus, WireShark, Hping, Cain and Abel, Nikto, GFI LANguard
Top 10 Web Vulnerability Scanners, include Nikto
Top 10 Vulnerability Scanners, include Nessus, GFI LANguard
Top 11 Packet Sniffers, include WireShark, Cain and Abel, NetStumbler,
Top 5 Wireless Tools, include NetStumbler
Top 4 Packet Crafting Tools, include hping
Top 6 Traffic Monitoring Tools, include Ntop, EtherApe
Top 5 Security-Oriented Operating Systems, include BackTrack, Knoppix
Top 4 Port Scanners, include Superscan, Angry IP Scanner

John the Ripper for Windows Download
Cracking password dengan John The Ripper

Jika tidak ada file /etc/shadow, bisa juga pakai file /etc/master.passwd

Bruce Schneier: The Story Behind The Stuxnet Virus

A government-produced worm that may be aimed at an Iranian nuclear plant? Of course it's made headlines.

Computer security experts are often surprised at which stories get picked up by the mainstream media. Sometimes it makes no sense. Why this particular data breach, vulnerability, or worm and not others? Sometimes it's obvious. In the case of Stuxnet, there's a great story.

As the story goes, the Stuxnet worm was designed and released by a government--the U.S. and Israel are the most common suspects--specifically to attack the Bushehr nuclear power plant in Iran. How could anyone not report that? It combines computer attacks, nuclear power, spy agencies and a country that's a pariah to much of the world. The only problem with the story is that it's almost entirely speculation.
Article Controls

Here's what we do know: Stuxnet is an Internet worm that infects Windows computers. It primarily spreads via USB sticks, which allows it to get into computers and networks not normally connected to the Internet. Once inside a network, it uses a variety of mechanisms to propagate to other machines within that network and gain privilege once it has infected those machines. These mechanisms include both known and patched vulnerabilities, and four "zero-day exploits": vulnerabilities that were unknown and unpatched when the worm was released. (All the infection vulnerabilities have since been patched.)

Stuxnet doesn't actually do anything on those infected Windows computers, because they're not the real target. What Stuxnet looks for is a particular model of Programmable Logic Controller (PLC) made by Siemens (the press often refers to these as SCADA systems, which is technically incorrect). These are small embedded industrial control systems that run all sorts of automated processes: on factory floors, in chemical plants, in oil refineries, at pipelines--and, yes, in nuclear power plants. These PLCs are often controlled by computers, and Stuxnet looks for Siemens SIMATIC WinCC/Step 7 controller software.

If it doesn't find one, it does nothing. If it does, it infects it using yet another unknown and unpatched vulnerability, this one in the controller software. Then it reads and changes particular bits of data in the controlled PLCs. It's impossible to predict the effects of this without knowing what the PLC is doing and how it is programmed, and that programming can be unique based on the application. But the changes are very specific, leading many to believe that Stuxnet is targeting a specific PLC, or a specific group of PLCs, performing a specific function in a specific location--and that Stuxnet's authors knew exactly what they were targeting.

It's already infected more than 50,000 Windows computers, and Siemens has reported 14 infected control systems, many in Germany. (These numbers were certainly out of date as soon as I typed them.) We don't know of any physical damage Stuxnet has caused, although there are rumors that it was responsible for the failure of India's INSAT-4B satellite in July. We believe that it did infect the Bushehr plant.

All the anti-virus programs detect and remove Stuxnet from Windows systems.

Dean Takahashi: Stuxnet computer worm takes its toll on Iran, where nuclear plant may be target

Iranian officials have confirmed that the Stuxnet computer worm has infected at least 30,000 computers in the country.

The worm attacks industrial control systems. Because of that, officials have wondered whether Iran was targeted because hackers wanted to take down its controversial nuclear reactor, which is feared to be making high-grade plutonium for nuclear weapons. The Stuxnet worm, first discovered in June by Belarus-based security firm VirusBlokAda, might have been an attempt to disable the Bushehr reactor from afar.

Experts from Iran’s Atomic Energy Organization reportedly met this week to discuss how to remove the malware. The worm targets control systems that use Siemens’ SCADA software (supervisory control and data acquisition), which operates all sorts of factories from power plants to military installations. Symantec reported that Iran was hit hardest by Stuxnet, which was spread through universal serial bus (USB) flash memory drives that were left in areas where unsuspecting employees could pick them up and plug them into their computers.

Roughly 60 percent of all incidents related to Stuxnet have been reported in Iran. The question arises as to who created the Stuxnet worm and whether it was a state that doesn’t want Iran to have nuclear weapons.

Stuxnet exploited multiple unpatched vulnerabilities in Windows, relied on stolen digital certificates to disguise the malware, and hid its code by using software known as a rootkit. Microsoft hasn’t fully fixed the vulnerabilities. U.S. cybersecurity officials told the Associated Press they didn’t know who created the worm or what its purpose is. Certainly, it can disable more SCADA-based machines than just those in Iran.

Scan Viruses with miniPE, bootable CD-ROM

If your computer was infected by viruses, you don't have way out without scan from CD-ROM or other computer. For windows user, you can use Live CD based on miniPE. These the steps :

1. Download miniPE at http://minipe.org/. Or you can download from my server ftp://dl1.batan.go.id/.


2. Extract the file "MiniPE.v2k5.09.03-XT_2oo8.o8.20.rar" with password "thecavern", and you will find a file with name "MiniPE.v2k5.09.03-XT_UPDATED.ISO".


3. Burn this an ISO image file to a blank CD-ROM.


4. Now you can use this bootable CD-ROM to scan your windows computer. Don't forget to make your computer can boot form CD-ROM.