ESET – Jupiter Broadcasting

“An Illinois hospital says someone attempted to blackmail it to stop the release of data about some of its patients.”
The hospital chain received an anonymous email asking for a substantial amount of money in order to prevent the release of patient data. A sample of the data was included in the email as proof
“The hospital says it immediately notified law enforcement agencies.”
“An investigation discovered the data relates to patients who visited Clay County Hospital clinics on or before February 2012. A hospital representative declined to disclose how many people are involved but said the data is limited to their names, addresses, Social Security numbers and dates of birth. No medical information was compromised in the breach”
“The hospital believes the data has not been released so far. It didn’t disclose how the data was obtained but said an audit by an outside expert concluded the hospital hadn’t been hacked.”
The age of the data suggests that the compromise may have involved backups and/or cold storage
It is not clear of the Hospital stores the older data themselves, or if they rely on a 3rd party provider that may have been compromised
“A recent report by the Identity Theft Report Center found that by early December there had been 304 breaches so far this year in the U.S. healthcare sector. That’s 42 percent of the 720 breaches reported across the country. But, in part because of the massive breaches at major retailers, the entire healthcare sector only accounted for 9.7 percent of all records compromised in reported breaches so far in 2014.”

Sony cancels the release of “The Interview” – plays the victim

Sony has apparently cancelled the release of the film that is apparently the cause of the hack of their systems
A number of cinemas had declined to screen the file after vague threats of physical violence were made
“We are deeply saddened at this brazen effort to suppress the distribution of a movie, and in the process do damage to our company, our employees, and the American public,” Sony’s statement continues. “We stand by our filmmakers and their right to free expression and are extremely disappointed by this outcome.”
If they stand for freedom of expression, they wouldn’t have cancelled the movie
A number of people believe that the hackers may have found something especially damaging to Sony, and Sony is hoping to avoid the disclosure
Bruce Schneier – “It’s really a phenomenally awesome hack—they completely owned this company,”
“this is like Snowden, only with Sony.” He said that releases from the hack could go on for months.
That seems to suggest that the hackers will soon leak something that will look very, very bad for the company, Schneier says.
Earlier this week, Sony sent a letter to news outlets reporting on the leaks, saying that they could face prosecution for downloading stolen information. That letter, Schneier said, was a signal that the worst is still to come.
Gawker posts a copy of the threatening letter
“The fact that they sent that letter tells me there is stuff still to be found that Sony is terrified of. There’s some really bad stuff in there—stuff they did, stuff they said, stuff that’s illegal. Someone [from Sony] is going to jail for this.”
Reaction to the Sony hack is beyond the realm of stupid – This is not terrorism
Cisco analysis of Wiper malware used at Sony
Newer version of Wiper malware signed with stolen Sony certificate
ThreatPost Digital Undergound Podcast – Details of the Sony Breach
The leak has also covered a number of different plans and plots by the MPAA
Inclusing the MPAA’s post-SOPA plan to make ISP DNS Servers block sites

Feedback:

Round Up:

The post Don’t Fire IT | TechSNAP 193 first appeared on Jupiter Broadcasting.

Packet Tells A Lot | TechSNAP 109

chris — Thu, 09 May 2013 17:34:22 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

The nasty Apache Malware we’ve been telling you about has spread to Nginx and others, we’ll update you on the latest.

Plus hackers get access to control systems at Google, a big batch of your questions, and much much more.

On this week’s TechSNAP.

Thanks to:

GoDaddy.com

Use our code tech249 to score .COM for $2.49!

32% off your ENTIRE first order just use our code go32off3 until the end of the month!

Direct Download:

RSS Feeds:

Support the Show:

Purchase anything at Amazon.com
Purchase anything at Think Geek using this link
Purchase anything at Newegg using this link
Contribute directly on our donation page or check out our advertising options and reach millions of amazing people!
Grab our Chrome Extension and auto-tag your shopping session for us!

Fill out my Wufoo form!

Show Notes:

Get TechSNAP on your Android:

Browser Affiliate Extension:

Jupiter Broadcasting Affiliate Extensions for Chrome and Firefox

BSDCan Live, May 17th and 18th

Cdorked Malware spreads to nginx and lighttpd as well

ESET has found more than 400 servers infected with Cdorked in the top 100,000 ranked sites on Alexa
Thanks to information shared with ESET by system administrators of some of the infected sites, ESET has the modified binaries of nginx and lighttpd as well as apache.
Originally I thought the story may have been incorrect, that it was just infected apache behind nginx, but there are actually modified nginx binaries as well
It is still unclear how the servers are being compromised to install the infected binaries, but the small footprint suggests that it is not a ‘class break’, and that the servers may be specifically targeted
ESET has managed to analyze the configuration of the backdoor and find even more ways that Cdorked attempts to evade detection
The configuration contains a very long blacklist of ips, who are not directed to the exploit kit, this list may be harvested from administrative logins of the compromised servers
The servers do not attempt to infect anyone with their language localization set to: Japanese, Finnish, Russian and Ukrainian, Kazakh or Belarusian
ESET says 100,000 of its users have browsed to a page with a Cdorked redirection which was then blocked by their software
Cdorked only seems to target Internet Explorer 7+ and Firefox on windows XP, Vista, 7 and 8, specifically ignoring Chrome, Opera and all devices running Linux or BSD
Cdorked seems to have a special redirection for iPhone and iPad devices, instead of delivering windows malware, the mobile devices are redirected to a page with links to pornographic pay sites
The malware currently being delivered by the infected sites is identified as Win32/Glupteba.G
SHA1 hashes of known-bad binaries:
a53a30f8cdf116de1b41224763c243dae16417e4 bad-apache
a51b1835abee79959e1f8e9293a9dcd8d8e18977 bad-nginx
dd7846b3ec2e88083cae353c02c559e79124a745 bad-lighthttpd
ee679661829405d4a57dbea7f39efeb526681a7f bad-apache-x64-with-symbols
5b87807b4a1796cfb1843df03b3dca7b17995d20 bad-apache-i386
03592b8147e2c84233da47f6e957acd192b3796a bad-apache

Cylance compromises Industrial control system as Google HQ in Australia

Cylance is running a world-wide project to identify vulnerable Industrial Control Systems
While reviewing the logs of their scans, they stumbled across a particularly interest result
The Tridium Niagara Building Management Systems (BMS) for Google Wharf 7, exposed on the internet
They were able to interrogate the device and find out it was running a slightly outdated version of Tridium Niagara, on an embedded QNX machine
They were also able to extract the config.bog file, which contains the username and ‘encoded’ (just encoded, not hashed) password for every user on the system
With the administrative password, Cylance could have rooted the device and had persistent access
The researchers reported the issue to Google, who quickly pulled the ICS system offline
“At the time of this blog post, this exact issue affects tens of thousands of devices on the Internet and thousands of different organizations”
Tridium claims on its website that “there are over 245,000 instances of the Niagara Framework deployed worldwide.”
Cylance scans showed 25,000 similarly vulnerable systems facing the Internet
“If Google can fall victim to an ICS attack, anyone can.”
Additional Coverage – ThreatPost

Dissecting RSA’s packet capture of the VOHO Watering hole attack

This story covers some of the interesting information to can get from even just a few packets off of someone elses network
By analyzing the packet capture RSA releases, a lot of information about RSAs network can be gleaned
First, the source MAC address in the captured frame starts with 00:50:56, a block assigned to VMWare, this is as you might expect, the researcher at VMWare was testing the exploit in a virtual machine
Now, the destination MAC address (the router on the local network) is assigned to 2Wire, suggesting a small home-grade router
The source IP address is 192.168.0.106, what you would expect for a device behind a home router
The destination IP address is the Command & Control server, 58.64.155.59, in Hong Kong
Looking at the IP TTL (128), this suggests the source machine (in the VMWare) is Windows, as FreeBSD and Linux use 64 as the default TTL
Looking at the source port and the fact that it is very low rather than high, suggests that the source OS is Windows XP, rather than a newer version of windows
Original RSA Story “Lions at the watering hole”

Feedback:

Round Up:

The post Packet Tells A Lot | TechSNAP 109 first appeared on Jupiter Broadcasting.