RAID – Jupiter Broadcasting

HACKERS LEAK DATA FROM MANDIANT SECURITY RESEARCHER IN OPERATION #LEAKTHEANALYST
The leaked data included more screenshots than documents. Images showed that the hackers might have gained access to the researcher’s Microsoft (Hotmail, OneDrive) and LinkedIn accounts. Earlier in the day, when Bleeping Computer was alerted of the leak, the researcher’s LinkedIn account had been defaced.
No clear proof that anything more than a personal computer / personal accounts were breeched.
Other news “sources” used headlines such as Hackers kick off #leaktheanalyst campaign by dumping data of $1bn security firm
.

70,000 Memcached Servers Can Be Hacked Using Eight-Month-Old Flaws

Original Talos blog post
Background: January 2017, a series of Mongodb incidents wherein multiple competing groups were attacking the same servers which leads to the conclusion that there is no hope of actually recovering data, if there ever was in the first place.
This prompted Talos to investigate memcached

Dan talks about upgrading ZFS arrays

raidz arrays cannot be expanded. You have n devices; it stays N devices
you can replace devices
you can replace devices with bigger devices
once they area all replaced, BANG, you have more space
what options exist for replacing devices?
Pull a drive, insert a new one, issue the zfs replace command.
Insert a new drive, if you have space, issue the zfs replace command.
But then Dan had a great idea the other night….

Feedback

Round Up:

From the Netflix Technology Blog ChAP: Chaos Automation Platform
Hacking Voting Machines at DEF CON 25
real people’ don’t need end-to-end encryption
FreeNAS 11.0 is Now Here

The post Netflix Lab Rats | TechSNAP 330 first appeared on Jupiter Broadcasting.

Belmont IRL | Ask Noah 14

chris — Mon, 26 Jun 2017 19:19:03 +0000

RSS Feeds:

MP3 Feed | HD Video Feed | iTunes Feed

Become a supporter on Patreon:

— Show Notes: —

— The Cliff Notes —

Have a Backup Plan
Retro Thinkpad – it’s Alive!
KeepassX 2.2 Release with Yubikey Support
Linux Surprises Linus
Veronica on Twitter
IRL Podcast

— Noobs Corner —

Check out the Ask Noah Dashboard

— Stay In Touch —

Find all the resources for this show on the Ask Noah Dashboard

Ask Noah Dashboard

Need more help than a radio show can offer? Altispeed provides commercial IT services and they’re excited to offer you a great deal for listening to the Ask Noah Show. Call today and ask about the discount for listeners of the Ask Noah Show!

Altispeed Technologies

Contact Noah

asknoah [at] jupiterbroadcasting.com

— Twitter —

The post Belmont IRL | Ask Noah 14 first appeared on Jupiter Broadcasting.

Linux Active Directory | Ask Noah 10

chris — Mon, 05 Jun 2017 19:55:23 +0000

RSS Feeds:

MP3 Feed | HD Video Feed | iTunes Feed

Become a supporter on Patreon:

— Show Notes: —

— The Cliff Notes —

Linux Active Directory Systems

RAZDC

FreeIPA

Etcher.io

Invoice Ninja

DD Command

sudo dd bs=4M if=/path/to/iso of=/dev/sdc && sync

— Guest —

Michael Tunnell

Michael Tunnell is a Designer / Developer / Marketer, Writer, Podcaster, Linux Enthusiast, and Open Source Advocate that has been involved with many web, Linux, and/or open source related projects.

— Noobs Corner —

Check out the Ask Noah Dashboard

— Stay In Touch —

Find all the resources for this show on the Ask Noah Dashboard

Ask Noah Dashboard

Altispeed Technologies

Contact Noah

asknoah [at] jupiterbroadcasting.com

— Twitter —
+ Noah – Kernellinux
+ Ask Noah Show
+ Altispeed Technologies
+ Jupiter Broadcasting

The post Linux Active Directory | Ask Noah 10 first appeared on Jupiter Broadcasting.

Bad Boy Backups | TechSNAP 309

chris — Tue, 07 Mar 2017 21:42:43 +0000

RSS Feeds:

Become a supporter on Patreon:

Show Notes:

Data from connected CloudPets teddy bears leaked and ransomed, exposing kids’ voice messages

Extortionists Wipe Thousands of Databases, Victims Who Pay Up Get Stiffed
Spiral Toys xCEO denies voice recordings stolen
CloudPets left their database exposed publicly to the web without so much as a password to protect it.
There are references to almost 2.2 million voice recordings of parents and their children exposed by databases that should never have contained production data.
CloudPets has absolutely no password strength rules
The CloudPets Twitter account has also been dormant since July last year so combined with the complete lack of response to all communications, it looks like operations have well and truly been shuttered.

Spammers expose their entire operation through bad backups

Today we release details on the inner workings of a massive, illegal spam operation. The situation presents a tangible threat to online privacy and security as it involves a database of 1.4 billion email accounts combined with real names, user IP addresses, and often physical address. Chances are that you, or at least someone you know, is affected. Spammergate: The Fall of an Empire
The data from this well-known, but slippery spamming operation, was discovered by Chris Vickery, a security researcher for MacKeeper and shared with Salted Hash, Spamhaus, as well as relevant law enforcement agencies.
Vickery also discovered thousands of warm-up email accounts used by RCM to skirt anti-spam measures
RCM’s data breach also exposed 2,199 IP addresses used for public-faced activities; as well as the group’s internal assets. This is in addition to the 60 IP blocks RCM has identified for activities in the past, as well as current and future operations; and the 140 active DNS servers that are rotated frequently.
Based on campaign logging documents, the data breach also exposed more than 300 active MX records. In just two spreadsheets alone, RCM recorded nearly 100,000 domains used for their campaigns.
If an offer doesn’t inbox (meaning it is rejected, or otherwise dumped into a spam or junk folder), or a given domain is blacklisted, RCM goes back to a list of thousands of domains and selects another to restart the process.

Feedback

Round Up:

The post Bad Boy Backups | TechSNAP 309 first appeared on Jupiter Broadcasting.

Fancy Bear Misfire.apk | TechSNAP 299

chris — Thu, 29 Dec 2016 18:41:47 +0000

RSS Feeds:

Become a supporter on Patreon:

Show Notes:

Patch Your Sh** T-Shirt

TechSNAP is about to reach episode 300 so before Chris and Allan hand over the show to Wes & Dan we have a round of PATCH YOUR SH** swag to get out! Be sure to check out the tote bag and the sticker too!

Exploit in PHPMailer puts almost every PHP CMS at risk

“PHPMailer continues to be the world’s most popular transport class, with an estimated 9 million users worldwide. Downloads continue at a significant pace daily.”
“Probably the world’s most popular code for sending email from PHP! Used by many open-source projects: WordPress, Drupal, 1CRM, SugarCRM, [..], Joomla! and many more”
“An independent researcher uncovered a critical vulnerability in PHPMailer that could potentially be used by (unauthenticated) remote attackers to achieve remote arbitrary code execution in the context of the web server user and remotely compromise the target web application.”
“To exploit the vulnerability an attacker could target common website components such as contact/feedback forms, registration forms, password email resets and others that send out emails with the help of a vulnerable version of the PHPMailer class.”
“A successful exploitation could let remote attackers to gain access to the target server in the context of the web server account which could lead to a full compromise of the web application.”
When the mailer software calls the system’s sendmail binary to send the email, it can optionally pass additional parameters to sendmail, like -f to override the from address.
Proper input validation was not performed on this input. Instead of the content being restricted based on what is safe to evaluate in the shell, the input is validated as an email address via RFC 3696, which allows for quoted usernames with spaces.
So if the attacker fills out the form such that their email address is:
“attacker\” -oQ/tmp/ -X/var/www/cache/phpcode.php some”@email.com
this will actually execute:
Arg no. 0 == [/usr/sbin/sendmail]
- Arg no. 1 == [-t]
- Arg no. 2 == [-i]
- Arg no. 3 == [-fattacker]
- Arg no. 4 == [-oQ/tmp/]
- Arg no. 5 == [-X/var/www/cache/phpcode.php]
- Arg no. 6 == [some”@email.com]
If the attacker can also provide some PHP code as the body of the message, it will be written to the indicated file, phpcode.php, where it can then be run by the attacker via the web server.
“The vulnerability was responsibly disclosed to PHPMailer vendor. The vendor released a critical security release of PHPMailer 5.2.18 to fix the issue as notified”
“UPDATE: The author of this advisory published a bypass of the current solution/fix which makes the PHPMailer vulnerable again in versions <5.2.20”
There was also a similar vulnerability found in SwiftMailer, another similar application

Use of Fancy Bear Android Malware in Tracking of Ukrainian Field Artillery Units

“From late 2014 and through 2016, FANCY BEAR X-Agent implant was covertly distributed on Ukrainian military forums within a legitimate Android application developed by Ukrainian artillery officer Yaroslav Sherstuk”
“The original application enabled artillery forces to more rapidly process targeting data for the Soviet-era D-30 Howitzer employed by Ukrainian artillery forces reducing targeting time from minutes to under 15 seconds. According to Sherstuk’s interviews with the press, over 9000 artillery personnel have been using the application in Ukrainian military”
“Successful deployment of the FANCY BEAR malware within this application may have facilitated reconnaissance against Ukrainian troops. The ability of this malware to retrieve communications and gross locational data from an infected device makes it an attractive way to identify the general location of Ukrainian artillery forces and engage them”
“Open source reporting indicates that Ukrainian artillery forces have lost over 50% of their weapons in the 2 years of conflict and over 80% of D-30 howitzers, the highest percentage of loss of any other artillery pieces in Ukraine’s arsenal”
“This previously unseen variant of X-Agent represents FANCY BEAR’s expansion in mobile malware development from iOS-capable implants to Android devices, and reveals one more component of the broad spectrum approach to cyber operations taken by Russia-based actors in the war in Ukraine”
“The collection of such tactical artillery force positioning intelligence by FANCY BEAR further supports CrowdStrike’s previous assessments that FANCY BEAR is likely affiliated with the Russian military intelligence (GRU), and works closely with Russian military forces operating in Eastern Ukraine and its border regions in Russia”
“The original application central to this discussion, Попр-Д30.apk, was initially developed domestically within Ukraine by a member of the 55th Artillery Brigade. Based on the file creation timestamps as well as the app signing process, which occurred on 28 March 2013, CrowdStrike has determined that the app was developed sometime between 20 February and 13 April 2013.”
Distributed on a forum, and popularized via social media under a name that translates to “Correction-D30”, described as “Modern combat software”
“As an additional control measure, the program was only activated for
use after the developer was contacted and issued a code to the individual
downloading the application”
“At the time of this writing, it is unclear to what degree and for how long this specific application was utilized by the entirety of the Ukrainian Artillery Forces. Based on open source reporting, social media posts, and video evidence, CrowdStrike assesses that Попр-Д30.apk was potentially used through 2016 by at least one artillery unit operating in eastern Ukraine”
“The use of the X-Agent implant in the original Попр-Д30.apk application appears to be the first observed case of FANCY BEAR malware developed for the Android mobile platform. On 21 December 2014 the malicious variant of the Android application was first observed in limited public distribution on a Russian language, Ukrainian military forum.”
“The creation of an application that targets some of the front line forces pivotal in Ukrainian defense on the eastern front would likely be a high priority for Russian adversary malware developers seeking to turn the tide of the conflict in their favor”
“Although traditional overhead intelligence surveillance and reconnaissance (ISR) assets were likely still needed to finalize tactical movements, the ability of this application to retrieve communications and gross locational data from infected devices, could provide insight for further planning, coordination, and tasking of ISR, artillery assets, and fighting forces.”
“The X-Agent Android variant does not exhibit a destructive function and does not interfere with the function of the original Попр-Д30.apk application. Therefore, CrowdStrike Intelligence has assessed that the likely role of this malware is strategic in nature. The capability of the malware includes gaining access to contacts, Short Message Service (SMS) text messages, call logs, and internet data, and FANCY BEAR would likely leverage this information for its intelligence and planning value.”
“CrowdStrike Intelligence assesses a tool such as this has the potential ability to map out a unit’s composition and hierarchy, determine their plans, and even triangulate their approximate location. This type of strategic analysis can enable the identification of zones in which troops are operating and help prioritize assets within those zones for future targeting”
The Evidence to Prove the Russian Hack

Bigger than Miria? New leet botnet launches ddos attacks

“Earlier in the year, a huge DDoS attack was launched on Krebs on Security. Analysis showed that the attack pelted servers with 620 Gbps, and there were fears that the release of the Mirai source code used to launch the assault would lead to a rise in large-scale DDoS attacks. Welcome Leet Botnet.”
“In the run-up to Christmas, security firm Imperva managed to fend off a 650 Gbps DDoS attack. But this was nothing to do with Mirai; it is a completely new form of malware, but is described as “just as powerful as the most dangerous one to date”. The concern for 2017 is that “it’s about to get a lot worse”.”
“Clearly proud of the work put into the malware, the creator or creators saw fit to sign it. Analysis of the attack showed that the TCP Options header of the SYN packets used spelled out l33t, hence the Leet Botnet name.”
“The attack itself took place on 21 December, but details of what happened are only just starting to come out. It targeted a number of IP addresses, and Imperva speculates that a single customer was not targeted because of an inability to resolve specific IP addresses due to the company’s proxies. One wave of the attack generated 650 Gbps of traffic — or more than 150 million packets per second.”
“Despite attempting to analyze the attack, Imperva has been unable to determine where it originated from, but the company notes that it used a combination of both small and large payloads to “clog network pipes and bring down network switches”. While the Mirai attacks worked by firing randomly generated strings of characters to generate traffic, in the case of Leet Botnet the malware was accessing local files and using scrambled versions of the compromised content as its payload. Imperva describes the attack as “a mishmash of pulverized system files from thousands upon thousands of compromised devices”. What’s the reason for using this particular method?”
“Besides painting a cool mental image, this attack method serves a practical purpose. Specifically, it makes for an effective obfuscation technique that can be used to produce an unlimited number of extremely randomized payloads. Using these payloads, an offender can circumvent signature-based security systems that mitigate attacks by identifying similarities in the content of network packets.”
“While in this instance Imperva was able to mitigate the attack, the company says that Leet Botnet is “a sign of things to come”. Brace yourself for a messy 2017…”
Technical Details
“The attack began around 10:55 AM on December 21, targeting several anycasted IPs on the Imperva Incapsula network.”
“It’s hard to say why this attack didn’t focus on a specific customer. Most likely, it was the result of the offender not being able to resolve the IP address of his actual victim, which was masked by Incapsula proxies. And so, lacking any better option, the offender turned his attention to the service that stood between him and his target.”
“The first DDoS burst lasted roughly 20 minutes, peaking at 400 Gbps. Failing to make a dent, the offender regrouped and came back for a second round. This time enough botnet “muscle” to generate a 650 Gbps DDoS flood of more than 150 million packets per second (Mpps)”
“Both attack bursts originated from spoofed IPs, making it impossible to trace the botnet’s actual geo-location or learn anything about the nature of the attacking devices.”
So, unlike Mirai, it seems leet depends on reflection and amplification, rather than raw power
The attack traffic was generated by two different SYN payloads:
Regular-sized SYN packets, ranging from 44 to 60 bytes in size
Abnormally large SYN packets, ranging from 799 to 936 bytes in size
“The former was used to achieve high Mpps packet rates, while the latter was employed to scale up the attack’s capacity to 650 Gbps.”
Additional Coverage

Feedback:

ZFS pool additions
I thought it would never happen to me.
Torikun asks: So ISP’s have slow upload speeds and high download speeds. Is my download speed affected when I max out the upload?

Round Up:

The post Fancy Bear Misfire.apk | TechSNAP 299 first appeared on Jupiter Broadcasting.

This Old Linux RV | LAS 444

chris — Sun, 20 Nov 2016 18:44:53 +0000

RSS Feeds:

Become a supporter on Patreon:

— Show Notes: —

Brought to you by: Linux Academy

Hacking the UPS

This week we install the NAS that was reviewed last episode, and take you through some of the hardware modifications we made to get this Linux rig installed.

— PICKS —

Runs Linux

The Synthetic Human RUNS LINUX

Sent in by: Craig T
Hi Guys,

I was watching a documentary over here that is forked from a new TV series Humanshttps://www.channel4.com/programmes/humans which follows a world where synthetic Human’s are part of life.

Anyway the show made a documentary to see how far off creating Synthetic human’s we are : How to build a Human https://www.channel4.com/programmes/how-to-build-a-human

They appear to be using Ubuntu to program the robot for speech interaction https://imgur.com/a/bBQos its at about 13:48through the video.

Craig

Desktop App Pick

Ranger

Sent in by Tux t

Ranger is a console file manager with VI key bindings. It provides a minimalistic and nice curses interface with a view on the directory hierarchy. It ships with “rifle”, a file launcher that is good at automatically finding out which program to use for what file type.

UTF-8 Support
Multi-column display
Preview of the selected file/directory
Common file operations (create/chmod/copy/delete/…)
VIM-like console and hotkeys
Renaming multiple files at once
Automatically determine file types and run them with correct programs
Change the directory of your shell after exiting ranger
Tabs, Bookmarks, Mouse support
True Color Image previews [How to enable]
Video thumbnails [How to enable]

Spotlight

SSH Tunnel

Sent in By Oliver A

Transparent proxy server that works as a poor man’s VPN. Forwards over ssh. Doesn’t require admin. Works with Linux and MacOS. Supports DNS tunneling.

Stickers – Super Key Sticker with Any LAS Sticker While They Last!

Chris’ Personal YouTube Channel – MeetBSD and Behind the Scenes Noah Vist Videos Soon

— NEWS —

Microsoft SQL On linux is The Real Deal

Now available in a public preview, SQL Server for Linux aims to be full-featured like the Windows edition and a robust, long-term choice for enterprises

Those who wondered what it would be like to run Microsoft SQL Server on Linux now have an answer. Microsoft has released the first public preview of the long-promised product.

Microsoft also wants to make clear this isn’t a “SQL Server Lite” for those satisfied with a reduced feature set. Microsoft has a four-point plan to make this happen.

Microsoft Joins the Linux Foundation

It isn’t about Linux alone

And neither is the Linux Foundation. A lot of the projects Microsoft has been helping under the Linux Foundation umbrella are infrastructure and developer-oriented projects that Microsoft’s user base is interested in using.

Microsoft still has a lot of proprietary software, and it’s going to stay that way

Make no mistake: This move does not constitute a signal that Microsoft is preparing to open-source its key products. The Microsoft Windows kernel, Microsoft SQL Server, crucial parts of the Azure stack, and so on—they are all still strong moneymakers for Microsoft in their current incarnations. You can expect them to remain proprietary for a good long while.

This helps Microsoft help itself

A common theme in discussions about Microsoft’s involvements with Linux and open source is that it’s been a self-serving effort. Over time, Microsoft has found more places where its best interests coincide nicely with those of others—but again, in a pragmatic and transactional manner.

There’s still a lot of room for change on Microsoft’s part

Don’t get this wrong, Microsoft joining the Linux Foundation would have been unthinkable even a short time ago. But it is only one of many possible steps that Microsoft could take.

The Five Dollar Tool That Breaks Passwords

The perils of leaving computers unattended just got worse, thanks to a newly released exploit tool that takes only 30 seconds to install a privacy-invading backdoor, even when the machine is locked with a strong password.

PoisonTap, as the tool has been dubbed, runs freely available software on a $5/£4 Raspberry Pi Zero device. Once the payment card-sized computer is plugged into a computer’s USB slot, it intercepts all unencrypted Web traffic, including any authentication cookies used to log in to private accounts. PoisonTap then sends that data to a server under the attacker’s control. The hack also installs a backdoor that makes the owner’s Web browser and local network remotely controllable by the attacker.

It Turns Out The Btrfs RAID 5/6 Issue Isn’t Completely Fixed

_with headlines like “btrfs RAID5/RAID6 support is finally fixed” when that’s very much not the case. Only one bug has been removed for the key use case that makes RAID5 interesting, and it’s just the first of many that still remain in the path of a user trying to recover from a normal disk failure.

Feedback:

https://www.dropbox.com/s/26yiubqm4wv00if/video_2016-11-20_11-23-42.mov?dl=0

Mail Bag

Name: Broken Canoe
Subject: Data Privacy Following The Presidential Election

Hey Chris, – this is something I’ve had a lot of people ask me following Trump’s victory, – “should I keep my data in the cloud on services based in the US now that Trump is President?”

I think it’s a valid question, and one worth discussing on LAS or User Error. The general feeling is that infringements on privacy and civil liberties will only get worse in the coming years. Interested to hear your thoughts, more so that you use Dropbox.

Message: + Name: Daniel T

Subject: Touchpad Issue

in Gnome 3.20 (I think) Gnome switched to use libinput over synaptic for the touchpad lib. you need to remove xf86-input-synaptic and install xf86-input-libinput. but you also need to remove the synaptic config file. Forgive me I don’t remember what/where it is. Antergos may still be setting it up with synaptic

Call in: 1-877-347-0011

New Show: User Error

User Error | Jupiter Broadcasting

Catch the show LIVE SUNDAY:

— CHRIS’ STASH —

Chris’s Twitter account has changed, you’ll need to follow!

Chris Fisher (@ChrisLAS) | Twitter

Hang in our chat room:

irc.geekshed.net #jupiterbroadcasting

— NOAH’S STASH —

Noah’s Day Job

Altispeed Technologies

Contact Noah

noah [at] jupiterbroadcasting.com

Find us on Google+

Find us on Twitter

Follow us on Facebook

The post This Old Linux RV | LAS 444 first appeared on Jupiter Broadcasting.

Bringing Linux to the Surface | LAS 430

chris — Sun, 14 Aug 2016 21:03:00 +0000

RSS Feeds:

Become a supporter on Patreon:

— Show Notes: —

Brought to you by: Linux Academy

Microsoft’s Best Linux Laptop?

Surface 3’s touchscreen will soon work with Linux | TechRadar

There’s some good news for those of you who have been mulling the possibility of installing Linux on your Surface 3, as support for the touchscreen is included with the new release candidate of version 4.8 of the Linux Kernel.

Surface Pro 1 Specs

Software – Windows 8 Pro. Upgradeable to Windows 8.1 Pro
Exterior – Dimensions: 10.81 in (27.5 cm) x 6.81 in (17.3 cm) x 0.53 in (13.46 mm)

Weight: Less than 2lbs
Casing: VaporMg
Color: Dark Titanium
Integrated kickstand
Physical buttons: Volume, Power, and Windows button

Storage* and Memory – 64GB, 128GB
Display – Screen: 10.6 inch ClearType Full HD Display

Resolution: 1920 x 1080
Aspect Ratio: 16:9 (widescreen)
Touch: 10-point multi-touch

CPU and Wireless

3rd Gen Intel Core i5 Processor
4GB RAM
Wi-Fi (802.11a/b/g/n)
Bluetooth®4.0 technology

Battery Life – 42 W-h

Camera, Video, and Audio

Two 720p HD cameras, front and rear-facing
Microphone
Stereo speakers

Ports

Full-size USB 3.0
microSDXC card slot
Headset jack
Mini DisplayPort
Cover port
Sensors
Ambient light sensor
Accelerometer
Gyroscope
Magnetometer
Power Supply
48W power supply (including 5W USB for accessory charging)
Surface Pro Pen Included

Linux Resources for the Surface

— PICKS —

Runs Linux

The Darpa Cyber Grand Challenge at DefCon 24, Runs Linux

Desktop App Pick

httping

Httping is like ‘ping‘ but for http-requests.
Give it an url, and it’ll show you how long it takes to connect, send a request and retrieve the reply (only the headers). Be aware that the transmission across the network also takes time! So it measures the latency of the webserver + network.
It supports, of course, IPv6.

Spotlight

AllTube Download

youtube-dl

youtube-dl is a command-line program to download videos from YouTube.com and a few more sites.

— NEWS —

Linux bug leaves USA Today, other top sites vulnerable to serious hijacking attacks

The vulnerability resides in the design and implementation of RFC 5961, a relatively new Internet standard that’s intended to prevent certain classes of hacking attacks. In fact, the protocol is designed in a way that it can easily open Internet users to so-called blind off-path attacks, in which hackers anywhere on the Internet can detect when any two parties are communicating over an active transmission control protocol connection.

Linux vulnerability leaves top sites wide open to attackers

GUADEC 2016

The 2016 edition of GUADEC will happen in Karlsruhe, Germany from August 12 — 14 for the core conference days. Come early or stay after for workshops on August 11 **andBoFs and hackfests from August 15 — 17**. All conference events and workshops will be held at the Karlsruhe Institute of Technology located in the heart of the city. We would like to thank our sponsors for making the event happen.

RedHat is hiring to make Linux run better on laptops

This will be quite varied work and we expect you to be part of a team which will be looking at anything from driver bugs, battery life issues, implementing new stacks, biometric login and enabling existing features in the kernel or in low level libraries in the user interface.

Be aware of Btrfs raid5/6 serious data-loss bugs https://t.co/5ztwIX6QBI Consider using ZFS on Linux before the bugs are fixed.

— Btrfs (@btrfs) August 8, 2016

Mail Bag

https://slexy.org/view/s21ybMDJNj
https://slexy.org/view/s21YyjMjdI
https://slexy.org/view/s21T4WHdOE

Loading poll…

Call Box

Chris’ call out for the community to help him with his background

Catch the show LIVE SUNDAY:

— CHRIS’ STASH —

Chris’s Twitter account has changed, you’ll need to follow!

Chris Fisher (@ChrisLAS) | Twitter

Hang in our chat room:

irc.geekshed.net #jupiterbroadcasting

— NOAH’S STASH —

Noah’s Day Job

Altispeed Technologies
+ Altispeed on Twitter

Contact Noah

noah [at] jupiterbroadcasting.com

Find us on Google+

Find us on Twitter

Follow us on Facebook

The post Bringing Linux to the Surface | LAS 430 first appeared on Jupiter Broadcasting.

Fear and Linux in Las Vegas | LAS 429

chris — Sun, 07 Aug 2016 20:05:18 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

Noah’s back from Defcon! He shares his experience at this infamous conference, his Linux in the wild sightings & his surprising takeaway.

Plus Btrfs’ RAID 5/6 code has been found “unsafe”, the FossHub compromise, an Internet of Things failure that struck close to home & more!

Thanks to:

Get Paid to Write for DigitalOcean

Direct Download:

RSS Feeds:

Become a supporter on Patreon:

— Show Notes: —

Brought to you by: Linux Academy

Noah Visits Defcon

Hackers Fool Tesla S’s Autopilot to Hide and Spoof Obstacles

In a series of tests they plan to detail in a talk later this week at the Defcon hacker conference, they found that they could use off-the-shelf radio-, sound- and light-emitting tools to deceive Tesla’s autopilot sensors, in some cases causing the car’s computers to perceive an object where none existed, and in others to miss a real object in the Tesla’s path.

Hacking Hotel Keys and Point of Sale Systems at DEFCON

Hecker is scheduled to talk about his research at the DEFCON security conference in a talk where he will also reveal flaws in the magnetic stripe approach used in point-of-sale (POS) systems. In an interview ahead of the talk, Hecker detailed some of his key findings and the widespread risks.

— PICKS —

Runs Linux

This Sewer Camera that my plumber used, Runs Linux

Desktop App Pick

Lifeograph

Private offline journal, encrypted note taking.

Features

Search and play audio/video from YouTube
Search tracks of albums by album title
Search and import YouTube playlists
Create and save local playlists
Download audio/video
Convert to mp3 & other formats (requires ffmpeg or avconv)
View video comments
Works with Python 3.x
Works with Windows, Linux and Mac OS X
Requires mplayer or mpv
This project is based on mps, a terminal based program to search, stream and download music. This implementation uses YouTube as a source of content and can play and download video as well as audio. The pafy library handles interfacing with YouTube.

Spotlight

Stellarium 0.15.0 has been released

New big features

We introduce a major internal change with the StelProperty system.
This allows simpler access to internal variables and therefore more ways of operation.
Most notably this version introduces an alternative control option via RemoteControl, a new webserver interface plugin.
We also introduce another milestone towards providing better astronomical accuracy for historical applications:
experimental support of getting planetary positions from JPL DE430 and DE431 ephemerides. This feature is however not fully tested yet.

The major changes:

Added StelProperty system
Added new plugin for exhibitions and planetariums – Remote Control
Added new skycultures: Macedonian, Ojibwe, Dakota/Lakota/Nakota,
Kamilaroi/Euahlayi
Updated code of plugins
Added Bookmarks tool and updated AstroCalc tool
Added new functions for Scripting Engine and new scripts
Added Miller Cylindrical Projection
Added updates and improvements in DSO and star catalogues (include initial
support of The Washington Double Star Catalog)
azimuth lines (also targeting geographic locations) in ArchaeoLines plugin
Many fixes and improvements…

— NEWS —

PSA – Do not download Classic SHELL! read comments (MBR overwrite!!) mbr.rootkit

Classic Shell itself wasn’t compromised. FossHub was and some download links were replaced by another program, not signed, that do only one thing: overwrite the MBR. It’s not an infected version of Classic Shell, Audacity or whatever, it’s only a small program that targets your MBR. If at the end of the installation process nothing happens beside a short cmd window then you have downloaded the malware.

Hacker Compromises Fosshub to Distribute MBR-Hijacking Malware

“In short, a network service with no authentication was exposed to the internet,” the hacker told Softpedia in an email. “We were able to grab data from this network service to obtain source code and passwords that led us further into the infrastructure of FOSSHub and eventually gain control of their production machines, backup and mirror locations, and FTP credentials for the caching service they use, as well as the Google Apps-hosted email.”

FossHub serves up MBR-compromising versions of Audacity and Classic Shell

Corrupt .exe’s downloads of both Audacity and Classic Shell have been removed from FossHub.com after being found laden with a Master Boot Record-overwriting Trojan.

Never Trust a Found USB Drive, Black Hat Demo Shows Why

“Despite the dangers of hackers, viruses and other bad things, almost half of those who found one of our flash drives plugged it into a computer,” Bursztein said.

What are malicious USB keys and how to create a realistic one?

Btrfs RAID 5/6 Code Found To Be Very Unsafe & Will Likely Require A Rewrite

“more or less fatally flawed, and a full scrap and rewrite to an entirely different raid56 mode on-disk format may be necessary to fix it. And what’s even clearer is that people /really/ shouldn’t be using raid56 mode for anything but testing with throw-away data, at this point. Anything else is simply irresponsible.”

@ahl I assume you actually tested it before shipping it though

— Allan Jude (@allanjude) August 6, 2016

Re: [BUG] Btrfs scrub sometime recalculate wrong parity in raid5

Couldn't turn on my bedroom lights last night because there is no way to dismiss this dialog. Thank you @tweethue! pic.twitter.com/2EJUgujzLF

— Thomas Roth (@StackSmashing) July 30, 2016

MeetBSD California 2016

Any tips where I can park Lady Jupiter near the Clark Kerr Campus
Meet up?

Mail Bag

https://slexy.org/view/s2NuBRmc2H
https://slexy.org/view/s2usaSqiSk
https://slexy.org/view/s2vRzbEICz
Audio Only for Live Show?

Loading poll…

Call Box

Chris’ call out for the community to help him with his background

Catch the show LIVE SUNDAY:

— CHRIS’ STASH —

Chris’s Twitter account has changed, you’ll need to follow!

Chris Fisher (@ChrisLAS) | Twitter

Hang in our chat room:

irc.geekshed.net #jupiterbroadcasting

— NOAH’S STASH —

Noah’s Day Job

Altispeed Technologies

Contact Noah

noah [at] jupiterbroadcasting.com

Find us on Google+

Find us on Twitter

Follow us on Facebook

The post Fear and Linux in Las Vegas | LAS 429 first appeared on Jupiter Broadcasting.

Insecurity Appliance | TechSNAP 245

chris — Thu, 17 Dec 2015 19:45:41 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

Meet BOOTTRASH the Malware that executes before your OS does, the hard questions you need to ask when buying a security appliance, Project Zero finds flaws in Fireeye hardware.

Plus some great audience questions, a big round up & much, much more!

Thanks to:

Get Paid to Write for DigitalOcean

Direct Download:

RSS Feeds:

Become a supporter on Patreon:

— Show Notes: —

BOOTRASH malware executes before your OS does

“Researchers at FireEye spotted the financial threat group FIN1 targeting payment card data using sophisticated malware dubbed “BOOTRASH” that executes before the operating system boots.”
The malware only works against MBR formatted disks, if it detects GPT it just exists
It backs up the original VBR (Volume Boot Record, the boot code at the start of the partition, which is calls from the boot code installed in the MBR) to a different location on the disk
It finds some free space between partitions or at the end of the disk, and uses that to create its own tiny virtual file system, to store the actual malware files
Additional files and resources are encoded into a registry hive, so they do not leave any files on the regular file system. Only the invisible virtual file system (not listed in the partition table, hiding in unused space), and some random strings on encoded binary in the registry
“As previously discussed, during a normal boot process the MBR loads the VBR, which loads the operating system code. However, during the hijacked boot process, the compromised system’s MBR will attempt to load the boot partition’s VBR, which has been overwritten with the malicious BOOTRASH bootstrap code. This code loads the Nemesis bootkit components from the custom virtual file system. The bootkit then passes control to the original boot sector, which was saved to a different location on disk during the installation process. From this point the boot process continues with the loading and executing of the operating system software.”
“The bootkit intercepts several system interrupts to assist with the injection of the primary Nemesis components during the boot process. The bootkit hijacks the BIOS interrupt responsible for miscellaneous system services and patches the associated Interrupt Vector Table entry so it can intercept memory queries once the operating system loader gains control. The bootkit then passes control to the original VBR to allow the boot process to continue. While the operating system is being loaded, the bootkit also intercepts the interrupt and scans the operating system loader memory for a specific instruction that transfers the CPU from real mode to protected mode. This allows the bootkit to patch the Interrupt Descriptor Table each time the CPU changes from real mode to protected mode. This patch involves a modified interrupt handler that redirects control to the bootkit every time a specific address is executed. This is what allows the bootkit to detect and intercept specific points of the operating system loader execution and inject Nemesis components as part of the normal kernel loading.”
So it dynamically replaces bits of kernel code with its own code, making it a very hard to detect rootkit, since it is actually injected before the kernel is loaded (hence the name, bootkit)
Researcher Blog

“A decisionmaker’s guide to buying security appliances and gateways”

“With the prevalence of targeted “APT-style” attacks and the business risks of data breaches reaching the board level, the market for “security appliances” is as hot as it has ever been. Many organisations feel the need to beef up their security – and vendors of security appliances offer a plethora of content-inspection / email-security / anti-APT appliances, along with glossy marketing brochures full of impressive-sounding claims.”
This article provides a bit of a guide to help you shop for an appliance that might actually be worth the number of zeros on the price tag
“Most security appliances are Linux-based, and use a rather large number of open-source libraries to parse the untrusted data stream which they are inspecting. These libraries, along with the proprietary code by the vendor, form the “attack surface” of the appliance, e.g. the code that is exposed to an outside attacker looking to attack the appliance. All security appliances require a privileged position on the network – a position where all or most incoming and outgoing traffic can be seen. This means that vulnerabilities within security appliances give an attacker a particularly privileged position – and implies that the security of the appliance itself is rather important.”
Five questions to ask the vendor of a security appliance
- What third-party libraries interact directly with the incoming data, and what are the processes to react to security issues published in these libraries?
- Are all these third-party libraries sandboxed in a sandbox that is recognized as industry-standard? The sandbox Google uses in Chrome and Adobe uses in Acrobat Reader is open-source and has undergone a lot of scrutiny, so have the isolation features of KVM and qemu. Are any third-party libraries running outside of a sandbox or an internal virtualization environment? If so, why, and what is the timeline to address this?
- How much of the proprietary code which directly interacts with the incoming data runs outside of a sandbox? To what extent has this code been security-reviewed?
- Is the vendor willing to provide a hard disk image for a basic assessment by a third-party security consultancy? Misconfigured permissions that allow privilege escalation happen all-too often, so basic permissions lockdown should have happened on the appliance.
- In the case of a breach in your company, what is the process through which your forensics team can acquire memory images and hard disk images from the appliance?
Not to mention, in the case of a breach at the vendor, what information could the attacker get about your appliance, your network, or your security? How are the trusted keys protected on the vendor’s network?
- Bonus Question: Does the vendor publish hashes of the packages they install on the appliance so in case of a forensic investigation it is easy to verify that the attacker has not replaced some?
“A vendor that takes their product quality (and hence your data security) seriously will be able to answer these questions, and will be able to confidently state that all third-party parsers and a large fraction of their proprietary code runs sandboxed or virtualized, and that the configuration of the machine has been reasonably locked down – and will be willing to provide evidence for this (for example a disk image or virtual appliance along with permission to inspect).”
All of these are very good questions, and I happen to know one vendor who answered these questions in their recent BSDNow interview.

Project Zero finds flaws in FireEye security appliance

“FireEye sell security appliances to enterprise and government customers. FireEye’s flagship products are monitoring devices designed to be installed at egress points of large networks”
The device is connected to a SPAN, MONITOR, or MIRROR port. A feature of high end switches that allows all traffic from a port or set of ports to be copied to another port
“The FireEye device then watches all network traffic passively, monitoring common protocols like HTTP, FTP, SMTP, etc, for any transferred files. If a file transfer is detected (for example, an email attachment or a HTTP download) the FireEye extracts the file and scans it for malware.”
If the device detects malware, it alerts the security team
The device can also be configured in a IPS (Intrusion Prevention System) mode, where it would block such traffic
“For networks with deployed FireEye devices, a vulnerability that can be exploited via the passive monitoring interface would be a nightmare scenario. This would mean an attacker would only have to send an email to a user to gain access to a persistent network tap – the recipient wouldn’t even have to read the email, just receiving it would be enough”
If you compromise one of these devices, you are basically sitting on a wiretap of the entire network. These devices are sometimes even installed behind devices that decrypt encrypted traffic, giving you even more access
“A network tap is one of the most privileged machines on the network, with access to employee’s email, passwords, downloads, browsing history, confidential attachments, everything. In some deployment configurations an attacker could tamper with traffic, inserting backdoors or worse. Because FireEye devices typically have a secondary internet-connected interface for updates and management, the issue could even be wormable across the internet.”
“FireEye have issued a patch for this vulnerability, and customers who have not updated should do so immediately to protect their infrastructure.” Devices with security content release 427.334 and higher have this issue resolved
Q. How long did FireEye take to resolve this issue after it was reported?
A. FireEye responded very quickly, pushed out temporary mitigations to customers within hours of our report and resolved the issue completely within 2 days.
- Q. Have FireEye supported your security research?
A. Yes, FireEye have been very cooperative. They worked with us closely, provided test equipment, support, and have responded very quickly to any issues we reported.
“Project Zero have been evaluating a FireEye NX 7500 appliance, and created a lab to generate sample traffic. The test environment consisted of a workstation with four network interfaces. Two interfaces were connected to a hub, which were used for simulating network traffic. The FireEye passive monitoring interface (called pether3) was connected to a third port on the hub (acting like a mirror port) so that it could observe traffic being exchanged between the two interfaces on the test machine. This simulates an intranet user receiving email or downloading files from the internet.”
“The main analyses performed by the FireEye appliance are monitoring for known malicious traffic (blacklisted netblocks, malware domains, snort rules, etc), static analysis of transferred files (antivirus, yara rules, and analysis scripts), and finally tracing the execution of transferred files in instrumented virtual machines. Once an execution trace has been generated, pattern matching against known-bad behaviour is performed.”
“The MIP (Malware Input Processor) subsystem is responsible for the static analysis of files, invoking helper programs and plugins to decode various file types. For example, the swf helper invokes flasm to disassemble flash files, the dmg helper invokes p7zip to extract the contents of Mac OS Disk Images and the png helper invokes pngcheck to check for malformed images. The jar helper is used to analyze captured Java Archives, which checks for signatures using jarsigner, then attempts to decompile the contents using an open source Java decompiler called JODE.”
The problem is that the JODE decompiler, actually executes small bits of the java code, to try to deobfuscate it
“With some trial and error, we were eventually able to construct a class that JODE would execute, and used it to invoke java.lang.Runtime.getRuntime().exec(), which allows us to execute arbitrary shell commands. This worked during our testing, and we were able to execute commands just by transferring JAR files across the passive monitoring interfaces.”
So, just by emailing someone behind this device a .jar file, it would end up getting executed on the security device, running arbitrary shell commands
“As FireEye is shipped with ncat installed by default, creating a connect-back shell is as simple as specifying the command we want and the address of our control server.”
“We now have code execution as user mip, the Malware Input Processor. The mip user is already quite privileged, capable of accessing sensitive network data. However, , there is a very simple privilege escalation to root”
“FireEye have requested additional time to prepare a fix for the privilege escalation component of this attack”
“This allows exfiltration of confidential data, tampering with traffic, lateral movement around networks and even self-propagating internet worms.”
“If you would like to read more from our series on attacks against security products, we have also published research into ESET, Kaspersky, Sophos, Avast and more, with further research scheduled for release soon.”

Feedback:

Round Up:

The post Insecurity Appliance | TechSNAP 245 first appeared on Jupiter Broadcasting.

Finding Nakamoto | TechSNAP 244

chris — Thu, 10 Dec 2015 19:56:35 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

Bitcoin’s creator has been found again, we’ll cover what the media thinks they’ve figured out & what we really know.

Then, ‘In Patches We Trust: Why Security Updates have to get better’, a great batch of questions, a huge round up & much more!

Thanks to:

Get Paid to Write for DigitalOcean

Direct Download:

RSS Feeds:

Become a supporter on Patreon:

— Show Notes: —

WIRED thinks they found Bitcoin’s Creator Satoshi Nakamoto

Since that pseudonymous figure first released bitcoin’s code on January 9th, 2009, Nakamoto’s ingenious digital currency has grown from a nerd novelty to a kind of economic miracle. As it’s been adopted for everything from international money transfers to online narcotrafficking, the total value of all bitcoins has grown to nearly $5 billion.
Nakamoto himself, whoever he is, appears to control a stash of bitcoins easily worth a nine-figure fortune (it rose to more than a billion at the cryptocurrency’s peak exchange rate in 2014).
In the last weeks, WIRED has obtained the strongest evidence yet of Satoshi Nakamoto’s true identity. The signs point to Craig Steven Wright.
Gizmodo thinks it was actually two people
A monthlong Gizmodo investigation has uncovered compelling and perplexing new evidence in the search for Satoshi Nakamoto, the pseudonymous creator of Bitcoin.
According to a cache of documents provided to Gizmodo which were corroborated in interviews, Craig Steven Wright, an Australian businessman based in Sydney, and Dave Kleiman, an American computer forensics expert who died in 2013, were involved in the development of the digital currency.
Wired’s “Evidence”
An August 2008 post on Wright’s blog, months before the November 2008 introduction of the bitcoin whitepaper on a cryptography mailing list. It mentions his intention to release a “cryptocurrency paper,” and references “triple entry accounting,” the title of a 2005 paper by financial cryptographer Ian Grigg that outlines several bitcoin-like ideas.
A post on the same blog from November, 2008 includes a request that readers who want to get in touch encrypt their messages to him using a PGP public key apparently linked to Satoshi Nakamoto. This key, when checked against the database of the MIT server where it was stored, is associated with the email address satoshin@vistomail.com, an email address very similar to the satoshi@vistomail.com address Nakamoto used to send the whitepaper introducing bitcoin to a cryptography mailing list.
An archived copy of a now-deleted blog post from Wright dated January 10, 2009, which reads: “The Beta of Bitcoin is live tomorrow. This is decentralized… We try until it works.” (The post was dated January 10, 2009, a day after Bitcoin’s official launch on January 9th of that year. But if Wright, living in Eastern Australia, posted it after midnight his time on the night of the 9th, that would have still been before bitcoin’s launch at 3pm EST on the 9th.) That post was later replaced with the rather cryptic text “Bitcoin — AKA bloody nosey you be…It does always surprise me how at times the best place to hide [is] right in the open.” Sometime after October of this year, it was deleted entirely.
In addition to those three blog posts, they received a cache of leaked emails, transcripts, and accounting forms that corroborate the link.
Another clue as to Wright’s bitcoin fortune wasn’t leaked to WIRED but instead remains hosted on the website of the corporate advisory firm McGrathNicol: a liquidation report on one of several companies Wright founded known as Hotwire, an attempt to create a bitcoin-based bank. It shows that the startup was backed in June 2013 by $23 million in bitcoins owned by Wright. That sum would be worth more than $60 million today.
Reported bitcoin ‘founder’ Craig Wright’s home raided by Australian police
On Wednesday afternoon, police gained entry to a home belonging to Craig Wright, who had hours earlier been identified in investigations by Gizmodo and Wired,
People who say they knew Wright have expressed strong doubts about his alleged role, with some saying privately they believe the publications have been the victims of an elaborate hoax.
More than 10 police personnel arrived at the house in the Sydney suburb of Gordon at about 1.30pm. Two police staff wearing white gloves could be seen from the street searching the cupboards and surfaces of the garage. At least three more were seen from the front door.
The Australian Federal police said in a statement that the raids were not related to the bitcoin claims. “The AFP can confirm it has conducted search warrants to assist the Australian Taxation Office at a residence in Gordon and a business premises in Ryde, Sydney. This matter is unrelated to recent media reporting regarding the digital currency bitcoin.”
The documents published by Gizmodo appear to show records of an interview with the Australian Tax Office surrounding his tax affairs in which his bitcoin holdings are discussed at length.
During the interview, the person the transcript names as Wright says: “I did my best to try and hide the fact that I’ve been running bitcoin since 2009 but I think it’s getting – most – most – by the end of this half the world is going to bloody know.”
Guardian Australia has been unable to independently verify the authenticity of the transcripts published by Gizmodo, or whether the transcript is an accurate reflection of the audio if the interview took place. It is also not clear whether the phrase “running” refers merely to the process of mining bitcoin using a computer.
The purported admission in the transcript does not state that Wright is a founder of the currency, but other emails that Gizmodo claim are from Wright suggest further involvement he may have had in the development of bitcoin.
The emails published by Gizmodo cannot been verified. Comment has been sought from Sinodinos on whether he was contacted by Wright – or his lawyer – in relation to bitcoin and its regulatory and taxation status in Australia.
A third email published by Gizmodo from 2008 attributes to Wright a comment where he said: “I have been working on a new form of electronic money. Bit cash, bit coin …”
WikiLeaks on Twitter: “We assess that Craig S Wright is unlikely to be the principal coder behind Bitcoin.” https://t.co/nRnftKPjm9”
Additional Coverage: Freedom Hacker

In Patches We Trust: Why Security Updates have to get better

“How long do you put off restarting your computer, phone, or tablet for the sake of a security update or software patch? All too often, it’s far too long”
Why do we delay?
I am in the middle of something
The update might break something
I can’t waste a bunch of time dealing with fixing it if it doesn’t work
I hate it when they move buttons around on me
Installing the update makes the device unusable for 20+ minutes
“Patches are good for you. According to Homeland Security’s cyber-emergency unit, US-CERT, as many as 85 percent of all targeted attacks can be prevented by applying a security patch”
“The problem is that far too many have experienced a case when a patch has gone disastrously wrong. That’s not just a problem for the device owner short term, but it’s a lasting trust issue with software giants and device makers.”
We have all seen examples of bad patches
“Apple’s iOS 8.0.1 update was meant to fix initial problems with Apple’s new eight generation mobile operating system, but killed cell service on affected phones — leaving millions stranded until a fix was issued a day later. Google had to patch the so-called Stagefright flaw, which affected every Android device, for a second time after the first fix failed to do the job. Meanwhile, Microsoft has seen more patch recalls in the past two years than in the past decade.”
“Microsoft, for example, issued 135 security bulletins this year alone with thousands of separate vulnerabilities patched. All it takes is one or two patches to fail or break something — which has happened — to account for a 1 percent failure rate.”
Users get “update fatigue”, If every time they go to use the computer, there is a new update for one or more of: Java, Flash, Chrome, Skype, Windows, etc.
Worse, many drivers and other programs now add their own utilities, “update managers” and so on. Lenovo and Dell have both recently had to patch their “update managers” because they actually make your system more vulnerable
Having a slew of different programs constantly nagging the user about updating just causes the user to stop updating everything, or to put the updates off for longer and longer
“At the heart of any software update is a trust relationship between the user and the company. When things go wrong, it can affect thousands or millions of users. Just ignoring the issue and pulling patches can undermine a user’s trust, which can damage the future patching process.”
“Customers don’t always expect vendors to be 100 percent perfect 100 percent of the time, or at least they shouldn’t,” said Childs. “However, if vendors are upfront and honest about the situation and provide actionable guidance, it goes a long way to reestablishing the trust that has been lost over the years.”

New APT group identified, known as Sofacy, or Fancy Bear

“Sofacy (also known as “Fancy Bear”, “Sednit”, “STRONTIUM” and “APT28”) is an advanced threat group that has been active since around 2008, targeting mostly military and government entities worldwide, with a focus on NATO countries. More recently, we have also seen an increase in activity targeting Ukraine.”
“Back in 2011-2012, the group used a relatively tiny implant (known as “Sofacy” or SOURFACE) as its first stage malware. The implant shared certain similarities with the old Miniduke implants. This led us to believe the two groups were connected, at least to begin with, although it appears they parted ways in 2014, with the original Miniduke group switching to the CosmicDuke implant.”
“In the months leading up to August, the Sofacy group launched several waves of attacks relying on zero-day exploits in Microsoft Office, Oracle Sun Java, Adobe Flash Player and Windows itself. For instance, its JHUHUGIT implant was delivered through a Flash zero-day and used a Windows EoP exploit to break out of the sandbox. The JHUHUGIT implant became a relatively popular first stage for the Sofacy attacks and was used again with a Java zero-day (CVE-2015-2590) in July 2015.
While the JHUHUGIT (and more recently, “JKEYSKW”) implant used in most of the Sofacy attacks, high profile victims are being targeted with another first level implant, representing the latest evolution of their AZZYTrojan.”
This shows how APT attackers constantly evolve, and reserve their best exploits for use against high profile targets, using lesser quality exploits on lesser targets, to avoid the better exploits being discovered and mitigated
“The first versions of the new AZZY implant appeared in August of this year. During a high profile incident we investigated, our products successfully detected and blocked a “standard” Sofacy “AZZY” sample that was used to target a range of defense contractors.”
“Interestingly, the fact that the attack was blocked didn’t appear to stop the Sofacy team. Just an hour and a half later they had compiled and delivered another AZZY x64 backdoor. This was no longer detectable with static signatures by our product. However, it was detected dynamically by the host intrusion prevention subsystem when it appeared in the system and was executed.”
“This recurring, blindingly-fast Sofacy attack attracted our attention as neither sample was delivered through a zero-day vulnerability — instead, they appeared to be downloaded and installed by another malware. This separate malware was installed by an unknown attack as “AppData\Local\Microsoft\Windows\msdeltemp.dll””
The attackers have multiple levels of malware, and can cycle through them until something works, then use that to drop a payload that matches the quality of the target they are attacking
“In addition to the new AZZY backdoors with side-DLL for C&C, we observed a new set of data-theft modules deployed against victims by the Sofacy group. Among the most popular modern defense mechanisms against APTs are air-gaps — isolated network segments without Internet access, where sensitive data is stored. In the past, we’ve seen groups such as Equation and Flame use malware to steal data from air-gapped networks. The Sofacy group uses such tools as well. The first versions of these new USB stealer modules appeared around February 2015 and the latest appear to have been compiled in May 2015.”
“This data theft module appears to have been compiled in May 2015 and is designed to watch removable drives and collect files from them, depending on a set of rules defined by the attackers. The stolen data is copied into a hidden directory as “%MYPICTURES%\%volume serial number%“, from where it can be exfiltrated by the attackers using one of the AZZY implants. More details on the new USB stealers are available in the section on technical analysis.”
“Over the last year, the Sofacy group has increased its activity almost tenfold when compared to previous years, becoming one of the most prolific, agile and dynamic threat actors in the arena. This activity spiked in July 2015, when the group dropped two completely new exploits, an Office and Java zero-day. At the beginning of August, Sofacy began a new wave of attacks, focusing on defense-related targets. As of November 2015, this wave of attacks is ongoing. The attackers deploy a rare modification of the AZZY backdoor, which is used for the initial reconnaissance. Once a foothold is established, they try to upload more backdoors, USB stealers as well as other hacking tools such as “Mimikatz” for lateral movement.”
Lateral movement is a more generic term for Island Hopping, moving around inside the network once you get through the outer defenses
“Two recurring characteristics of the Sofacy group that we keep seeing in its attacks are speed and the use of multi-backdoor packages for extreme resilience. In the past, the group used droppers that installed both the SPLM and AZZY backdoors on the same machine. If one of them was detected, the other one provided the attacker with continued access.”
“As usual, the best defense against targeted attacks is a multi-layered approach. Combine traditional anti-malware technologies with patch management, host intrusion detection and, ideally, whitelisting and default-deny strategies.”

Feedback:

Round Up:

The post Finding Nakamoto | TechSNAP 244 first appeared on Jupiter Broadcasting.