SMB in the limelight – WannaCry and more!

Days before WannaCry came into the spotlight, there were already some other ransomware and malware taking advantage of the SMB exploit (published under the codename ETERNALBLUE/DOUBLEPULSAR) following shadow brokers dump (NSA exploit targeting windows file sharing protocol). So far, WannaCry ransomware has infected more than 150 countries causing widespread panic. Although WannaCry distribution may have been stopped, the widespread of ransomware and similar malware distribution has not stopped yet.

Other Variants

UIWIX is an entirely new variant and has also been spotted in the wild. Like WannaCry, this ransomware program is also built under ETERNABLUE. It has ability to infect machines without writing files to permanent storage and hence, making it extremely harder to detect through conventional forensics. This ransomware renames files with ‘.uiwix’ extension and drops a text file called ’_DECODE_FILES.txt’ which contains requirements for decryption and payment address and mode of payment. Uiwix however poses an even bigger threat than WannaCry ransomware since it does not include any kill switch domains.
 

Another program using the same SMB vulnerability to exploit the system using EternalBlue and DoublePulsar is Adylkuzz. Adylkuzz exploits the SMB vulnerability to mine an obscure cryptocurrency called Monero.

Basically, Monero is a cryptocurrency similar to the Bitcoin but with enhanced anonymity capabilities. A major of underground website known to sell drugs, stolen credit cards and counterfeit items make use of monero. However, unlike WannaCry, Adylkuzz does not have the ability to self-propagate.

It has been found that Adylkuzz started exploiting the same vulnerability somewhere between 24th April and 2nd May i.e. weeks before WannaCry came into the scene. It infects the system taking an advantage of SMB vulnerability and shuts down SMB networking for further infection of the system with other malwares including WannaCry ransomware worm, detects the public IP address of the system, downloads the mining instructions, cryptominer and other cleaner tools. Therefore, we can easily predict that there are huge number of systems being infected with this very malware than that of WannaCry ransomware worm. Adylkuzz did not caused the same chaos as that of WannaCry since it was not shutting down computers or was not sending some ransom notes, all it did was perform Monero mining operation in the background. Although it is not catastrophic enough to raise an alarm and remained undected and hidden until the WannaCry came into the limelight gaining much more public attention.

Who is behind the current attack?
It has been found that WannaCry’s code shares some portion of the code to the Lazarus APT group who was responsible heavily for the Sony Wiper attack (Sony Pictures Entertainment being hacked using wiper malware), the Bangladesh bank heist ($81 million heist from SWIFT network using Dridex malware) and the DarkSeoul operations (Backdoor Trojan, dubbed as Duuzer, Brambul and Joanap malware targeting south Korean organizations, institutions and industries). Lazarus APT group was found to have conducted multiple attacks worldwide and was found to have a direct link between Bluenoroff and North Korea. So, there could be a possible clue that North Korea could probably be behind the current WannaCry attack. However, it is still too early to determine who exactly is behind this attack since, the repetition of the code could also be a false flag.

Final Words
It is therefore, highly recommended that you update your systems for MS17-010 and if you do not use SMB then it is also recommended that you disable the SMB version one.

To disable SMB follow the following steps:

1. Open Control Panel.
2. Click Programs.
3. Click Turn Windows features on or off (under the Programs).
4. Make sure that your ‘SMB 1.0/CIFS File Sharing Support’ is not ticked.

If you are a PowerShell user make sure that you disable SMB version one by typing the following command with administrator privilege:

Set-ItemProperty -Path “HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters” SMB1 -Value 0 -Force

That's it, you are protected for now.

Oops! Your important files are encrypted. - Ransomware (WannaCry in Nepal?)

There was nothing new with these words. We have had heard a lot about ransomware like Cryptowall, Jigsaw, Cerber, Cryptolocker, Teslacrypt, Locky and more. Displaying a nasty message on a desktop, asking for ransom and encrypting almost all files on the system. But this very sentence (Oops! Your important files are encrypted.) and this variant of ransomware was a complete different than others. It was more of a ransomware worm. Cyber criminals had started a new sophisticated cyber-attacking campaign starting Friday (12th May 2017). I am sure, this Monday (15th May) was definitely, the most hectic day for most of the IT guys, fixing the infected systems and issuing the patch and maybe paying ransom ($300 or $600) was the last option too.

We have heard stories of Google docs phishing attack campaign spread like a worm about two weeks back. And now, the most deadly ransomware worm known as WannaCrypt, WannaCry, WannaCrypt0r, WCryptor or WCRY which started attack on the internet, infecting thousands of devices and affecting more than hundred countries. Russia, Ukraine, India were among the top victims of this recent attack as reported by Kaspersky.

Figure shows countries affected with WannyCry ransomware

The ransomware came out on Friday causing an extremely chaotic situation to the whole world where targets including extremely high profile organizations including government forces, railway stations, hospitals, universities and many public and private organizations including organizations like Russian Interior Ministry in Russia, German’s Deutsche Bahn in Germany, FedEx in US, National Health Service (NHS) in UK, Renault in France, Portugal Telecom in Portugal, Telefonica in Spain, Andhra Pradesh Police in India and others who were the serious victims of recent cyber-attack. This kind of large scale cyber-attacks could be the beginning of new trend for organized cyber criminals. As workdays started on Monday, the number of affected companies, communities and people could still rise. As seen today, reported by China’s news agency around thirty thousand companies have been hit on China and more than two thousand computers have been infected in Japan and the number is still on rise. 

NHS was protected with Sophos (Seems like technologies cannot be trusted? Since, Security is not a product, it's a continuous process)

While working around, I also came to know that, some high profile ISP’s and private organizations of Nepal could be the victims of this ransomware attack campaign. Organizations like Nepal Telecom, Subisu, Worldlink, OTEL, Kantipur Media Group and other more organizations were found to be highly vulnerable to WannaCry Ransomware attack or say, EternalBlue and DoublePulsar exploit attack.

All Windows versions before Windows 10 are vulnerable to ‘WannaCry’ if not patched for MS-17-010. The ransomware worm makes use of EternalBlue MS17-010 to propagate.

EternalBlue, sometimes stylized as ETERNALBLUE, is an exploit developed by the U.S. National Security Agency (NSA). It was released by the Shadow Brokers hacker group on April 14, 2017.

EternalBlue exploits a vulnerability in Microsoft's implementation of the Server Message Block (SMB) protocol. The attackers were able to take advantage of this very vulnerability, exploit and propagate around the globe in a form of ransomware worm.

After the chaotic spread of this ransomware worm, Microsoft also came with an update for Windows XP although End of Life (EOL) for Windows XP was on 8th of April 2014.

But, as of now, the ransomware worm is down, meaning that a researcher and also a blogger by the name MalwareTech has slowed down the cyber-attack by simply registering a domain iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea[.]com, under a name of ‘Botnet Sinkhole’ which acted as a kill switch for the ransomware since the working mechanism of the ransomware was to search for the mentioned domain and if the domain was up, the attack would stop or else continue propagating. However, another researcher (Matthieu Suiche) has also confirmed that he found a new WannaCry variant with a different kill switch and registered new domain ifferfsodp9ifjaposdfjhgosurijfaewrwergwea[.]com However multiple security researches have claimed that there are more samples of the ransomware with different kill-swith and even without any kill-switch function.

As of 14th May, the total of $33,319.59 has been paid. Three bitcoin address were hardcoded into the ransomware itself

(13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94,12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw, 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn)

So far, these are the C&C centers found from various sources:

gx7ekbenv2riucmf.onion
57g7spgrzlojinas.onion
xxlvbrloxvriy2c5.onion
76jdd2ir2embyv47.onion
cwwnhwhlz52maqm7.onion

C&C IP address found from various sources:

188[.]166[.]23[.]127:443
193[.]23[.]244[.]244:443
2[.]3[.]69[.]209:9001
146[.]0[.]32[.]144:9001
50[.]7[.]161[.]218:9001
217[.]79[.]179[.]77
128[.]31[.]0[.]39
213[.]61[.]66[.]116
212[.]47[.]232[.]237
81[.]30[.]158[.]223
79[.]172[.]193[.]32
89[.]45[.]235[.]21
38[.]229[.]72[.]16
188[.]138[.]33[.]220

The filetypes that it looks to encrypt are:

.doc, .docx, .xls, .xlsx, .ppt, .pptx, .pst, .ost, .msg, .eml, .vsd, .vsdx, .txt, .csv, .rtf, .123, .wks, .wk1, .pdf, .dwg, .onetoc2, .snt, .jpeg, .jpg, .docb, .docm, .dot, .dotm, .dotx, .xlsm, .xlsb, .xlw, .xlt, .xlm, .xlc, .xltx, .xltm, .pptm, .pot, .pps, .ppsm, .ppsx, .ppam, .potx, .potm, .edb, .hwp, .602, .sxi, .sti, .sldx, .sldm, .sldm, .vdi, .vmdk, .vmx, .gpg, .aes, .ARC, .PAQ, .bz2, .tbk, .bak, .tar, .tgz, .gz, .7z, .rar, .zip, .backup, .iso, .vcd, .bmp, .png, .gif, .raw, .cgm, .tif, .tiff, .nef, .psd, .ai, .svg, .djvu, .m4u, .m3u, .mid, .wma, .flv, .3g2, .mkv, .3gp, .mp4, .mov, .avi, .asf, .mpeg, .vob, .mpg, .wmv, .fla, .swf, .wav, .mp3, .sh, .class, .jar, .java, .rb, .asp, .php, .jsp, .brd, .sch, .dch, .dip, .pl, .vb, .vbs, .ps1, .bat, .cmd, .js, .asm, .h, .pas, .cpp, .c, .cs, .suo, .sln, .ldf, .mdf, .ibd, .myi, .myd, .frm, .odb, .dbf, .db, .mdb, .accdb, .sql, .sqlitedb, .sqlite3, .asc, .lay6, .lay, .mml, .sxm, .otg, .odg, .uop, .std, .sxd, .otp, .odp, .wb2, .slk, .dif, .stc, .sxc, .ots, .ods, .3dm, .max, .3ds, .uot, .stw, .sxw, .ott, .odt, .pem, .p12, .csr, .crt, .key, .pfx, .der


How to be safe?

• For now, ensure that all Windows-based systems are fully patched. At a very minimum, ensure Microsoft bulletin MS17-010 has been applied.
• If your organization has SMB publicly accessible via the internet (ports 139, 445) should immediately be blocked for inbound traffics.
• If your organization is using snort then apply snort 42329-42332, 42340, 41978 rules immediately

These kinds of attacks are also more likely to happen in future, it all starts with just one click of yours so stay safe, stay secure.

At least follow the bellow mentioned points:

• First and foremost, be sure to back up your most important files on a regular basis.
• Personalize your anti-spam settings the right way.
• Refrain from opening attachments that look suspicious.
• Think twice before clicking.
• Patch and keep your operating system, antivirus, browsers, Adobe Flash Player, Java, and other software up-to-date.
• In the event a suspicious process is spotted on your computer, instantly turn off the Internet connection.
• Keep the Windows Firewall turned on and properly configured at all times.
• Enhance your protection more by setting up additional Firewall protection.
• Adjust your security software to scan compressed or archived files, if this feature is available.
• Consider disabling Windows PowerShell, which is a task automation framework if you do not use it.
• Disable Macros and ActiveX in Microsoft Office components.
• Install a browser add-on to block popups as they can also pose an entry point for ransom Trojan attacks.
• Deactivate AutoPlay.
• Make sure you disable file sharing.
• Disable Remote Service if not in use
• Block known-malicious Tor IP addresses

Cyber Threat Intelligence

Threat Intelligence is also sometime known as Cyber Threat Intelligence which is an organized, analyzed and refined information of the potential attack or a way to build a defense in depth strategy for the current attacks that threaten an organization as a whole. Threat intelligence is the most critical component of modern cyber security. By integrating cyber threat intelligence into a security infrastructure, an organization can quickly assess risk, prioritize alters and threats that matters the most, minimize the exposure to attack and save time and money by increasing efficiency of the security operations. These days many companies provide threat intelligence service integrated in the form of Security Information and Event Management (SIEM) to provide real-time analysis of security alerts generated by network hardware and applications.

The use of threat intelligence and SIEM platforms helps organizations understand the risks of the most common and severe threats including internal and especially external threats such as zero day exploits and advanced persistent threats (APT) attacks. In a military, business or security context, intelligence is any information that provides an organization with decision support and possibly a strategic advantage. Threat intelligence is a component of security intelligence and, like security intelligence, includes both the information relevant to protecting an organization from external and internal threats as well as the process, policies and tools designed to gather and analyze the information.

Threat intelligence is however divided into four parts as per the ‘Center for the Protection of National Infrastructure’ which include strategic threat intelligence, tactical threat intelligence, operational threat intelligence and technical threat intelligence.

Strategic Threat Intelligence consists of high-level information which is consumed by senior decision-makers. For example a report indicating that a particular government is believed to have hacked into foreign companies who have direct competitors within their own nation, hence a board might consider this fact when weighing up the benefits and risks of entering that competitive marketplace, and to help them allocate effort and budget to mitigate the expected attacks. Strategic threat intelligence is almost exclusively in the form of reports, briefings or conversations.

Tactical Threat Intelligence often consists of tactics, techniques, and procedures and is the information about how threat actors are conducting attacks. Tactical threat intelligence is gathered by defenders and incident response teams to ensure that their defense, alerting and investigation are prepared for current tactics. For example, the fact that attackers are using tools to obtain clear text credentials and then replaying those credentials is tactical intelligence which could prompt defenders to change policy and prevent interactive logins by admins, and to ensure that logging's do not get captured. Tactical threat intelligence is usually gained by reading white papers or technical press, communicating with peers in other organizations to learn what they are seeing attackers do, or purchasing service from a provider of such intelligence.

Operational Threat Intelligence is the information about specific impending attacks against the organization and is initially consumed by higher level security staff, such as security managers or heads of incident response. Any organization would love to know which groups are going to attack them, when and how, but such intelligence is very rare. In the majority of cases, only a government will have this sort of access to attack groups and their infrastructure necessary to collect this type of intelligence. For national and state threats, it is simply not possible for a private entity to legally gain access to relevant communication channels and hence good operational threat intelligence will not be an option for many organizations.

However, there are cases, where operational intelligence might be available, such as when an organization is targeted by more public actors which include hacktivist. It is advisable for organization to focus on these cases, where details of attacks can be found from open source intelligence or providers with access to closed chat forums. Another form of operational threat intelligence that might be available is that derived from activity based attacks where specific activities or events in the real world result in attacks in the cyber domain. In such instances, future attacks can sometimes be predicted following certain events and event patterns. This linking of attacks to real world events is common practice in physical security but less commonly seen in cyber security.

Technical Threat Intelligence is the information which often consists of data which is normally gathered through technical means. An example would be a feed of internet protocol (IP) addresses suspected of being malicious or implicated as command and control servers. Technical threat intelligence often has a short lifespan since attackers can easily change their IP addresse or modify sum hashes, hence the need to gather such intelligence automatically rises. Technical threat intelligence typically feeds the investigative or monitoring functions of a business, for example blocking attempted connections to suspect servers.

However, cyber threat intelligence is still a new topic and still requires some time to find more information and data regarding the topic. Targeted attacks, zero-day vulnerabilities and malware exploit such as ransom ware attacks are the area of concern for organizations these days, however, the organizations do not have required resources and expertise which is necessary to perform independent research and evaluate these threats. In most of these case threat intelligence services are often used as a form of outsourced capabilities to provide organizations with access to expertise and resources regarding advanced security topics as such, which they might not otherwise be able to afford.

Final Words

Cyber threat intelligence is a complex term and yet unclearly defined, having multifaceted approach to framing, thinking about, and reacting to cyber adversarial activity. Many discussions emphasize the complexity of the cyber operational domain, the speed in which activity and operations take place, in operational level hacktivist group may plan to deface the physical infrastructure as well as cyber infrastructure to support their objective as well as the supposed inherent advantage of the attacker. Threat intelligence should be implemented in every aspect, type and level including strategic level, operational level, tactical level and technical level. Moreover, every emerging threats should be published and should be shared with the global security community so as the threat intelligence can be make globally available and information should be reachable so as to share the knowledge of adversaries on possible cyber-attack.

The main motive behind any cyber-attack depends on type of attack and type of attacker who is attacking. By looking at the basic first steps of an attacker, the type of attack and the targeted point where an attacker is trying to infiltrate can be clearly known and now those information can be immediately put into a place to find out if the attacker will succeed or fail. Usually, honeypots (a decoy server to find out the attack pattern of a hacker) are deployed at such case and help in studying the patterns of an attacker and also help stop attacks. Other than honeypots, to cope against such cyber-attack, threat intelligence can be used as an option for gathering intelligence of an attack in this modern sophisticated cyber domain. Threat intelligence gathers intelligence from various online source, signatures, gathers knowledge of different attack patterns and then verify the original internal and external network traffic and discards the malicious traffic or at cases of zero day attacks gives an alarm to the administrators. Correlating different rule sets in case of SIEM and making a certain rule to gather intelligence about the attack pattern also helps in reducing the threat to some extent.