Security Intelligence

The US govt can also do a lot better. The very agency they formed to counter cyber threats and alert against(CISA) itself got hacked because they failed to patch or remediate, and led to a serious leak of sensitive chemical industry information among others. Because they failed to follow their own security advisory. And they won't even put out a report detailing the hack like MS did.

> According to an early report on the breach, an anonymous source said that the compromised systems were the Infrastructure Protection (IP) Gateway, which houses critical information about the interdependency of U.S. infrastructure, and the Chemical Security Assessment Tool (CSAT), which houses private sector chemical security plans.

> CSAT is an online portal that contains highly sensitive information that determines which facilities are considered high-risk under the Chemical Facility Anti-Terrorism Standards (CFATS).

> CISA declined to confirm or deny which of their systems were taken offline.

https://securityintelligence.com/news/cisa-hackers-key-systems-offline/

> In late February, CISA had already issued a warning that cyber threat actors are exploiting previously identified vulnerabilities in Ivanti Connect Secure and Ivanti Policy Secure gateways. Ivanti Connect Secure is a widely deployed SSL VPN, while Ivanti Policy Secure (IPS) is a network access control (NAC) solution.

> Now, CISA itself has fallen victim to a cyberattack involving Ivanti products.

For what it's worth, the GitHub README.md calls it a Zero day so they apparently didn't give Apple any heads up to prepare for the release of the exploit. While a same day/same week fix is ideal, 23 days isn't that bad given a QA cycle. Patches for Meltdown/Spectre are just still their way out/not yet released for Microsoft's Server OSes for a point of comparison [1].

I wish I could have found something newer, but according to Symantec the average resolution time found in their 2015 study was 69 days[2]. The last time Apple rushed a fix out.. it didn't go so well[3].

Now, while I'm waxing poetic, I may as well frighten you with a recent RAND corp study about how long Zero Days can be known privately before publicly disclosed [4]. It also doesn't take too long to weaponize them [5].

This stuff sucks and is really nerve racking for anyone involved in security even tangentially. It's really easy to criticize but I guarantee that anyone on Hacker News who has written any meaningful software has released a security flaw. If you think you haven't you're absolutely kidding yourself and should reevaluate your stance.

[1] https://social.technet.microsoft.com/Forums/windowsserver/en-US/4f10320d-19f4-49a1-9ef3-673787e541cd/meltdown-patch-for-windows-server-2012-without-r2-and-2008-r2-still-not-released-regedit-key?forum=winserver8gen

[2] https://www.symantec.com/connect/blogs/guide-zero-day-exploits

[3]…

To get an idea of what happened when, this happened months before the Snowden leaks were published:

"“As reported by Facebook and Apple, Microsoft can confirm that we also recently experienced a similar security intrusion,” the company said on Feb. 22, 2013."

Kaspersky identified the attacker group for the first time in 2011, two years before:

https://securityintelligence.com/news/butterfly-effect-chaos-reigns-from-morpho-to-wild-neutron/

"According to eWEEK, the Wild Neutron group was first identified and named by Kaspersky Lab in 2011, and it went after high-profile corporate IP in 2013."

The group is very careful in using the obtained information:

"Vikram Thakur, senior manager at Symantec, believed that the Butterfly attacks are financially and not politically motivated, noting to CSO Online that the attackers are extremely careful with the information they obtain. So far, there’s no evidence of any high-profile IP for sale on the Dark Web, and while the data could be used for insider trading, there has been no odd stock market movement after the thefts occur. Vice president of security firm Fasoo, Ron Arden, said it’s possible that the group also employs insiders who are willing to deliberately compromise their accounts and give malicious actors access to five-year plans or financial statements."

As an aside, for those looking to understand YARA rules, [1] provides a brief introduction and [2] introduces how to write them. I needed to look it up myself, but seems relatively straightforward if you have a programming background.

tl;dr: YARA rules are a method of categorizing malware based on their characteristics. So the PDF here released a YARA rule to determine a specific piece of malware used in the hack (it's not clear to me what it identifies, other than a PHP script).

For convenience, here's the YARA rule presented in the PDF formatted to be more readable:

rule PAS_TOOL_PHP_WEB_KIT
{

meta:
description = "PAS TOOL PHP WEB KIT FOUND"

strings:
$php = "<?php"
$base64decode = /\='base'\.\(\d+\*\d+\)\.'_de'\.'code'/
$strreplace = "(str_replace("
$md5 = ".substr(md5(strrev("
$gzinflate = "gzinflate"
$cookie = "_COOKIE"
$isset = "isset"

condition:
(filesize > 20KB and filesize < 22KB) and
#cookie == 2 and
#isset == 3 and
all of them
}

[1] https://securityintelligence.com/signature-based-detection-with-yara/

[2] http://yara.readthedocs.io/en/v3.5.0/writingrules.html

EDIT: formatting

> Specifically, it related to Microsoft Secure Channel, known as Schannel, Microsoft's software for implementing secure transfer of data.

I'm confused... The article says this research relates to the SChannel vulnerability being patched this month and cites IBM Researchers[1] finding it, but the link to the blog post showing the work is towards OLE and not SChannel. Also, Microsoft has mentioned that they found[2] the SChannel vulnerability through an internal audit. To me, it seems the research is talking about CVE-2014-6332[3], which shows the patch as MS14-064. MS14-066 is the patch for the SChannel vulnerability.

Either BBC is confused on which patch they're trying to report on, or I am.

Anyone similarly confused as I am?

[1] http://securityintelligence.com/ibm-x-force-researcher-finds-significant-vulnerability-in-microsoft-windows/#.VGNiR2MhDwB

[2] http://blogs.technet.com/b/srd/archive/2014/11/11/assessing-risk-for-the-november-2014-security-updates.aspx

[3] http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6332

North Korean state-sponsored criminal fraud activities:

https://www.zdnet.com/article/north-korea-s-apt38-hacking-group-behind-bank-heists-of-over-100-million/

https://www.cnn.com/2019/03/01/politics/north-korea-cyberattacks-cash-bank-heists/index.html

Connections between specific Russian financial crime organizations and the Russian government are much harder to pin down as people who try to investigate ties between the Russian mob and the Russian government often wind up dead. However, the Russian government is well known to be tightly linked connected to Russian organized crime[0]. Given the sheer scale of Russian financial fraud operations--Carbanak stole upwards of a billion USD[1]--the balance of probabilities suggest these operations exist with the tacit approval of the Russian government.

[0] https://bpr.berkeley.edu/2019/12/16/gangs-and-gulags-how-vladimir-putin-utilizes-organized-crime-to-power-his-mafia-state/

[1] https://securityintelligence.com/carbanak-how-would-you-have-stopped-a-1-billion-apt-attack/