SMB in the limelight – WannaCry and more!

Days before WannaCry came into the spotlight, there were already some other ransomware and malware taking advantage of the SMB exploit (published under the codename ETERNALBLUE/DOUBLEPULSAR) following shadow brokers dump (NSA exploit targeting windows file sharing protocol). So far, WannaCry ransomware has infected more than 150 countries causing widespread panic. Although WannaCry distribution may have been stopped, the widespread of ransomware and similar malware distribution has not stopped yet.

Other Variants

UIWIX is an entirely new variant and has also been spotted in the wild. Like WannaCry, this ransomware program is also built under ETERNABLUE. It has ability to infect machines without writing files to permanent storage and hence, making it extremely harder to detect through conventional forensics. This ransomware renames files with ‘.uiwix’ extension and drops a text file called ’_DECODE_FILES.txt’ which contains requirements for decryption and payment address and mode of payment. Uiwix however poses an even bigger threat than WannaCry ransomware since it does not include any kill switch domains.
 

Another program using the same SMB vulnerability to exploit the system using EternalBlue and DoublePulsar is Adylkuzz. Adylkuzz exploits the SMB vulnerability to mine an obscure cryptocurrency called Monero.

Basically, Monero is a cryptocurrency similar to the Bitcoin but with enhanced anonymity capabilities. A major of underground website known to sell drugs, stolen credit cards and counterfeit items make use of monero. However, unlike WannaCry, Adylkuzz does not have the ability to self-propagate.

It has been found that Adylkuzz started exploiting the same vulnerability somewhere between 24th April and 2nd May i.e. weeks before WannaCry came into the scene. It infects the system taking an advantage of SMB vulnerability and shuts down SMB networking for further infection of the system with other malwares including WannaCry ransomware worm, detects the public IP address of the system, downloads the mining instructions, cryptominer and other cleaner tools. Therefore, we can easily predict that there are huge number of systems being infected with this very malware than that of WannaCry ransomware worm. Adylkuzz did not caused the same chaos as that of WannaCry since it was not shutting down computers or was not sending some ransom notes, all it did was perform Monero mining operation in the background. Although it is not catastrophic enough to raise an alarm and remained undected and hidden until the WannaCry came into the limelight gaining much more public attention.

Who is behind the current attack?
It has been found that WannaCry’s code shares some portion of the code to the Lazarus APT group who was responsible heavily for the Sony Wiper attack (Sony Pictures Entertainment being hacked using wiper malware), the Bangladesh bank heist ($81 million heist from SWIFT network using Dridex malware) and the DarkSeoul operations (Backdoor Trojan, dubbed as Duuzer, Brambul and Joanap malware targeting south Korean organizations, institutions and industries). Lazarus APT group was found to have conducted multiple attacks worldwide and was found to have a direct link between Bluenoroff and North Korea. So, there could be a possible clue that North Korea could probably be behind the current WannaCry attack. However, it is still too early to determine who exactly is behind this attack since, the repetition of the code could also be a false flag.

Final Words
It is therefore, highly recommended that you update your systems for MS17-010 and if you do not use SMB then it is also recommended that you disable the SMB version one.

To disable SMB follow the following steps:

1. Open Control Panel.
2. Click Programs.
3. Click Turn Windows features on or off (under the Programs).
4. Make sure that your ‘SMB 1.0/CIFS File Sharing Support’ is not ticked.

If you are a PowerShell user make sure that you disable SMB version one by typing the following command with administrator privilege:

Set-ItemProperty -Path “HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters” SMB1 -Value 0 -Force

That's it, you are protected for now.

Oops! Your important files are encrypted. - Ransomware (WannaCry in Nepal?)

There was nothing new with these words. We have had heard a lot about ransomware like Cryptowall, Jigsaw, Cerber, Cryptolocker, Teslacrypt, Locky and more. Displaying a nasty message on a desktop, asking for ransom and encrypting almost all files on the system. But this very sentence (Oops! Your important files are encrypted.) and this variant of ransomware was a complete different than others. It was more of a ransomware worm. Cyber criminals had started a new sophisticated cyber-attacking campaign starting Friday (12th May 2017). I am sure, this Monday (15th May) was definitely, the most hectic day for most of the IT guys, fixing the infected systems and issuing the patch and maybe paying ransom ($300 or $600) was the last option too.

We have heard stories of Google docs phishing attack campaign spread like a worm about two weeks back. And now, the most deadly ransomware worm known as WannaCrypt, WannaCry, WannaCrypt0r, WCryptor or WCRY which started attack on the internet, infecting thousands of devices and affecting more than hundred countries. Russia, Ukraine, India were among the top victims of this recent attack as reported by Kaspersky.

Figure shows countries affected with WannyCry ransomware

The ransomware came out on Friday causing an extremely chaotic situation to the whole world where targets including extremely high profile organizations including government forces, railway stations, hospitals, universities and many public and private organizations including organizations like Russian Interior Ministry in Russia, German’s Deutsche Bahn in Germany, FedEx in US, National Health Service (NHS) in UK, Renault in France, Portugal Telecom in Portugal, Telefonica in Spain, Andhra Pradesh Police in India and others who were the serious victims of recent cyber-attack. This kind of large scale cyber-attacks could be the beginning of new trend for organized cyber criminals. As workdays started on Monday, the number of affected companies, communities and people could still rise. As seen today, reported by China’s news agency around thirty thousand companies have been hit on China and more than two thousand computers have been infected in Japan and the number is still on rise. 

NHS was protected with Sophos (Seems like technologies cannot be trusted? Since, Security is not a product, it's a continuous process)

While working around, I also came to know that, some high profile ISP’s and private organizations of Nepal could be the victims of this ransomware attack campaign. Organizations like Nepal Telecom, Subisu, Worldlink, OTEL, Kantipur Media Group and other more organizations were found to be highly vulnerable to WannaCry Ransomware attack or say, EternalBlue and DoublePulsar exploit attack.

All Windows versions before Windows 10 are vulnerable to ‘WannaCry’ if not patched for MS-17-010. The ransomware worm makes use of EternalBlue MS17-010 to propagate.

EternalBlue, sometimes stylized as ETERNALBLUE, is an exploit developed by the U.S. National Security Agency (NSA). It was released by the Shadow Brokers hacker group on April 14, 2017.

EternalBlue exploits a vulnerability in Microsoft's implementation of the Server Message Block (SMB) protocol. The attackers were able to take advantage of this very vulnerability, exploit and propagate around the globe in a form of ransomware worm.

After the chaotic spread of this ransomware worm, Microsoft also came with an update for Windows XP although End of Life (EOL) for Windows XP was on 8th of April 2014.

But, as of now, the ransomware worm is down, meaning that a researcher and also a blogger by the name MalwareTech has slowed down the cyber-attack by simply registering a domain iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea[.]com, under a name of ‘Botnet Sinkhole’ which acted as a kill switch for the ransomware since the working mechanism of the ransomware was to search for the mentioned domain and if the domain was up, the attack would stop or else continue propagating. However, another researcher (Matthieu Suiche) has also confirmed that he found a new WannaCry variant with a different kill switch and registered new domain ifferfsodp9ifjaposdfjhgosurijfaewrwergwea[.]com However multiple security researches have claimed that there are more samples of the ransomware with different kill-swith and even without any kill-switch function.

As of 14th May, the total of $33,319.59 has been paid. Three bitcoin address were hardcoded into the ransomware itself

(13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94,12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw, 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn)

So far, these are the C&C centers found from various sources:

gx7ekbenv2riucmf.onion
57g7spgrzlojinas.onion
xxlvbrloxvriy2c5.onion
76jdd2ir2embyv47.onion
cwwnhwhlz52maqm7.onion

C&C IP address found from various sources:

188[.]166[.]23[.]127:443
193[.]23[.]244[.]244:443
2[.]3[.]69[.]209:9001
146[.]0[.]32[.]144:9001
50[.]7[.]161[.]218:9001
217[.]79[.]179[.]77
128[.]31[.]0[.]39
213[.]61[.]66[.]116
212[.]47[.]232[.]237
81[.]30[.]158[.]223
79[.]172[.]193[.]32
89[.]45[.]235[.]21
38[.]229[.]72[.]16
188[.]138[.]33[.]220

The filetypes that it looks to encrypt are:

.doc, .docx, .xls, .xlsx, .ppt, .pptx, .pst, .ost, .msg, .eml, .vsd, .vsdx, .txt, .csv, .rtf, .123, .wks, .wk1, .pdf, .dwg, .onetoc2, .snt, .jpeg, .jpg, .docb, .docm, .dot, .dotm, .dotx, .xlsm, .xlsb, .xlw, .xlt, .xlm, .xlc, .xltx, .xltm, .pptm, .pot, .pps, .ppsm, .ppsx, .ppam, .potx, .potm, .edb, .hwp, .602, .sxi, .sti, .sldx, .sldm, .sldm, .vdi, .vmdk, .vmx, .gpg, .aes, .ARC, .PAQ, .bz2, .tbk, .bak, .tar, .tgz, .gz, .7z, .rar, .zip, .backup, .iso, .vcd, .bmp, .png, .gif, .raw, .cgm, .tif, .tiff, .nef, .psd, .ai, .svg, .djvu, .m4u, .m3u, .mid, .wma, .flv, .3g2, .mkv, .3gp, .mp4, .mov, .avi, .asf, .mpeg, .vob, .mpg, .wmv, .fla, .swf, .wav, .mp3, .sh, .class, .jar, .java, .rb, .asp, .php, .jsp, .brd, .sch, .dch, .dip, .pl, .vb, .vbs, .ps1, .bat, .cmd, .js, .asm, .h, .pas, .cpp, .c, .cs, .suo, .sln, .ldf, .mdf, .ibd, .myi, .myd, .frm, .odb, .dbf, .db, .mdb, .accdb, .sql, .sqlitedb, .sqlite3, .asc, .lay6, .lay, .mml, .sxm, .otg, .odg, .uop, .std, .sxd, .otp, .odp, .wb2, .slk, .dif, .stc, .sxc, .ots, .ods, .3dm, .max, .3ds, .uot, .stw, .sxw, .ott, .odt, .pem, .p12, .csr, .crt, .key, .pfx, .der


How to be safe?

• For now, ensure that all Windows-based systems are fully patched. At a very minimum, ensure Microsoft bulletin MS17-010 has been applied.
• If your organization has SMB publicly accessible via the internet (ports 139, 445) should immediately be blocked for inbound traffics.
• If your organization is using snort then apply snort 42329-42332, 42340, 41978 rules immediately

These kinds of attacks are also more likely to happen in future, it all starts with just one click of yours so stay safe, stay secure.

At least follow the bellow mentioned points:

• First and foremost, be sure to back up your most important files on a regular basis.
• Personalize your anti-spam settings the right way.
• Refrain from opening attachments that look suspicious.
• Think twice before clicking.
• Patch and keep your operating system, antivirus, browsers, Adobe Flash Player, Java, and other software up-to-date.
• In the event a suspicious process is spotted on your computer, instantly turn off the Internet connection.
• Keep the Windows Firewall turned on and properly configured at all times.
• Enhance your protection more by setting up additional Firewall protection.
• Adjust your security software to scan compressed or archived files, if this feature is available.
• Consider disabling Windows PowerShell, which is a task automation framework if you do not use it.
• Disable Macros and ActiveX in Microsoft Office components.
• Install a browser add-on to block popups as they can also pose an entry point for ransom Trojan attacks.
• Deactivate AutoPlay.
• Make sure you disable file sharing.
• Disable Remote Service if not in use
• Block known-malicious Tor IP addresses

Cyber Threat Intelligence

Threat Intelligence is also sometime known as Cyber Threat Intelligence which is an organized, analyzed and refined information of the potential attack or a way to build a defense in depth strategy for the current attacks that threaten an organization as a whole. Threat intelligence is the most critical component of modern cyber security. By integrating cyber threat intelligence into a security infrastructure, an organization can quickly assess risk, prioritize alters and threats that matters the most, minimize the exposure to attack and save time and money by increasing efficiency of the security operations. These days many companies provide threat intelligence service integrated in the form of Security Information and Event Management (SIEM) to provide real-time analysis of security alerts generated by network hardware and applications.

The use of threat intelligence and SIEM platforms helps organizations understand the risks of the most common and severe threats including internal and especially external threats such as zero day exploits and advanced persistent threats (APT) attacks. In a military, business or security context, intelligence is any information that provides an organization with decision support and possibly a strategic advantage. Threat intelligence is a component of security intelligence and, like security intelligence, includes both the information relevant to protecting an organization from external and internal threats as well as the process, policies and tools designed to gather and analyze the information.

Threat intelligence is however divided into four parts as per the ‘Center for the Protection of National Infrastructure’ which include strategic threat intelligence, tactical threat intelligence, operational threat intelligence and technical threat intelligence.

Strategic Threat Intelligence consists of high-level information which is consumed by senior decision-makers. For example a report indicating that a particular government is believed to have hacked into foreign companies who have direct competitors within their own nation, hence a board might consider this fact when weighing up the benefits and risks of entering that competitive marketplace, and to help them allocate effort and budget to mitigate the expected attacks. Strategic threat intelligence is almost exclusively in the form of reports, briefings or conversations.

Tactical Threat Intelligence often consists of tactics, techniques, and procedures and is the information about how threat actors are conducting attacks. Tactical threat intelligence is gathered by defenders and incident response teams to ensure that their defense, alerting and investigation are prepared for current tactics. For example, the fact that attackers are using tools to obtain clear text credentials and then replaying those credentials is tactical intelligence which could prompt defenders to change policy and prevent interactive logins by admins, and to ensure that logging's do not get captured. Tactical threat intelligence is usually gained by reading white papers or technical press, communicating with peers in other organizations to learn what they are seeing attackers do, or purchasing service from a provider of such intelligence.

Operational Threat Intelligence is the information about specific impending attacks against the organization and is initially consumed by higher level security staff, such as security managers or heads of incident response. Any organization would love to know which groups are going to attack them, when and how, but such intelligence is very rare. In the majority of cases, only a government will have this sort of access to attack groups and their infrastructure necessary to collect this type of intelligence. For national and state threats, it is simply not possible for a private entity to legally gain access to relevant communication channels and hence good operational threat intelligence will not be an option for many organizations.

However, there are cases, where operational intelligence might be available, such as when an organization is targeted by more public actors which include hacktivist. It is advisable for organization to focus on these cases, where details of attacks can be found from open source intelligence or providers with access to closed chat forums. Another form of operational threat intelligence that might be available is that derived from activity based attacks where specific activities or events in the real world result in attacks in the cyber domain. In such instances, future attacks can sometimes be predicted following certain events and event patterns. This linking of attacks to real world events is common practice in physical security but less commonly seen in cyber security.

Technical Threat Intelligence is the information which often consists of data which is normally gathered through technical means. An example would be a feed of internet protocol (IP) addresses suspected of being malicious or implicated as command and control servers. Technical threat intelligence often has a short lifespan since attackers can easily change their IP addresse or modify sum hashes, hence the need to gather such intelligence automatically rises. Technical threat intelligence typically feeds the investigative or monitoring functions of a business, for example blocking attempted connections to suspect servers.

However, cyber threat intelligence is still a new topic and still requires some time to find more information and data regarding the topic. Targeted attacks, zero-day vulnerabilities and malware exploit such as ransom ware attacks are the area of concern for organizations these days, however, the organizations do not have required resources and expertise which is necessary to perform independent research and evaluate these threats. In most of these case threat intelligence services are often used as a form of outsourced capabilities to provide organizations with access to expertise and resources regarding advanced security topics as such, which they might not otherwise be able to afford.

Final Words

Cyber threat intelligence is a complex term and yet unclearly defined, having multifaceted approach to framing, thinking about, and reacting to cyber adversarial activity. Many discussions emphasize the complexity of the cyber operational domain, the speed in which activity and operations take place, in operational level hacktivist group may plan to deface the physical infrastructure as well as cyber infrastructure to support their objective as well as the supposed inherent advantage of the attacker. Threat intelligence should be implemented in every aspect, type and level including strategic level, operational level, tactical level and technical level. Moreover, every emerging threats should be published and should be shared with the global security community so as the threat intelligence can be make globally available and information should be reachable so as to share the knowledge of adversaries on possible cyber-attack.

The main motive behind any cyber-attack depends on type of attack and type of attacker who is attacking. By looking at the basic first steps of an attacker, the type of attack and the targeted point where an attacker is trying to infiltrate can be clearly known and now those information can be immediately put into a place to find out if the attacker will succeed or fail. Usually, honeypots (a decoy server to find out the attack pattern of a hacker) are deployed at such case and help in studying the patterns of an attacker and also help stop attacks. Other than honeypots, to cope against such cyber-attack, threat intelligence can be used as an option for gathering intelligence of an attack in this modern sophisticated cyber domain. Threat intelligence gathers intelligence from various online source, signatures, gathers knowledge of different attack patterns and then verify the original internal and external network traffic and discards the malicious traffic or at cases of zero day attacks gives an alarm to the administrators. Correlating different rule sets in case of SIEM and making a certain rule to gather intelligence about the attack pattern also helps in reducing the threat to some extent.

Bypassing eCos Embedded Devices Authentication (CVE-2017-1000020)

Disclaimer: Breaking into unauthorized systems and devices are completely illegal. The information provided here is solely for the purpose of sharing knowledge and all I present is my research materials so that the public can remain safe and benefit from my research.

We have heard a lot of stories about routers being vulnerable to hack attacks, routers being a part of botnet, distributing malwares or lately the story about mirai bot. Let's get into my story here...

Lately, I was working with some router setups on TOTOLINK SOHO router. I performed a router setup and updated my password for my administrator login. After some days I thought of changing some settings and was trying to log into the router but unfortunately I forgot my last password. Instead of pressing the reset button and erasing everything and starting with a fresh setup I thought of taking this issue to some extent and looking into it a bit more. I had heard some stories about public exploits being available for totolink routers. I thought of checking all of them for my benefit and for learning purpose but none of them were of my use. At some times, while I tried to access the router login page there was this one thing that would grab my attention. While trying to access the router login page, 'wizard.htm' (the router setup page) would show up for about 1/2 second or so and then would get redirected to 'login.htm' and if I try to access the 'wizard.htm' page the router would not show it and instead show up the login (login.htm) page again. Untill I clear my browser cache and start the same process again, the process would then show up the same results as before. I thought of looking into this issue and ways for possible login bypass in the authentication mechanism. Looking into the page source code in 'login.htm', showed a line with javascript file named 'language_en.js'. I looked inside it and found the internal page names like 'menu.htm', 'password.htm', 'upload.htm', 'route.htm', and all other pages with heavy information that an attacker would need. Okay, that could come handy later because accessing those pages now would return nothing but the login page again.
 

Main Login page for Totolink Router

If you have been into a bit of networking and stuffs, you probably would know about what a three way handshake is. Generally, Transmission Control Protocol (TCP) uses three way handshake to set up a TCP/IP connection over an Internet Protocol(IP) based network prior to its communication or say exchanging data. I won't be telling you an in-depth story of three way handshake and how that works for now. Let's get back into the story again...

"What if I could stop the process right at the 'wizard.htm' page or may be slow down the process and see what I could do around there?" was the question in my mind.

Okay that sounds fun! but how?

How about performing a slow Denial Of Service (DOS) attack with some play and pause with the device reply?

Wow that sounds much better!

Lets get started...

Hping3 came handy this time. If you don't know what it is then, hping3 is a network tool able to send custom TCP/IP packets and to display target replies just like ping program does with ICMP replies.

I then fired the device with SYN flood attack to execute my slow dos with the use of hping3. By the way SYN flood or FIN flood worked just fine and I never thought of trying other flooding options.

hping3 in FIN flood mode

FIN flood attack in action

So, a SYN flood is a form of denial-of-service attack in which an attacker sends a succession of SYN requests to a target's system in an attempt to consume enough server resources to make the system unresponsive to legitimate traffic.

Now, while the flooding is still taking place go back to your browser, clear your cache (required most of the times), enter the router ip followed by the page you want. Example: ip/reboot.htm or ip/menu.htm and so on. It could take some hit and trial as per the router's capability of resisting the attack but as time passes it would finally give us the page we want to be.

Conclusion: eCos Embedded Web Servers used by Multiple Routers, while sending SYN flood or FIN flood packets fails to validate and handle the packets and does not ask for any sign of authentication resulting in Authentication Bypass.

Shodan Search Result

What could go wrong?
An attacker can take complete advantage of this bug and take over the device remotely or locally.
At the time of writing, there were 11,887 'eCos Embedded Web Servers' as reported by SHODAN but the numbers of internet users using totolink, greatek and other routers not shown by the shodan are likely higher in numbers than as shown in the result. Totolink and Greatek routers were tested and were found vulnerable.

Possibly changing the dns or changing the ip route or changing passwords or updating rogue firmwares or maybe more zombie devices teaming up with the mirai bot army could be the outcome of such vulnerability.

As always, updating the device to the latest firmware version is highly recommended in case of availability. If you find more information related to this bug then feel free to share or exchange ideas.

Cyber Warfare - How prepared is Nepal?

So, Let me break down every single stuffs and make it easy for you to understand what the topic is about and what's the threat to our country in depth.

What is Cyber Warfare?

The proliferation of internet usage in the recent years has changed the way we interact daily. Right from the usage of e-Commerce, online banking, social networking sites up to connecting every single devices like Internet of things - IOT i.e. toasters, refrigerators, televisions, temperature controls, home automation systems, nuclear power station to internet and controlling them from any end point of globe has been developed. After land, sea, air and space, warfare has entered the fifth domain: cyberspace. Back in the old days, war was fought either from land, sea, air, and space with guns, ammunition, fighter jets, missiles, but now an individual or even a group of individuals can wage a war with just a use of computer and working internet connection, right from their bed while taking a sip of tea and in pajamas.

So, Cyber Warfare is the art and science of fighting without fighting; defeating an opponent without spilling their blood. In other words, cyber war refers to the action by a nation-state, to penetrate other nation’s computers and networks for the purpose of causing damage or disruption.

These days almost all the nation and states are fully dependent on internet for storage and transference of information and information in this era has become a critical part of daily operations. What we say, what we do, what we share, what we plan are very critical information we hold as an individual or as a nation overall and these information could be used against us to malice us.

The Internet was not originally designed with security in mind, but as an open system to allow scientists and researchers to send data to one another quickly. Without strong investments in cyber security and cyber defenses, data systems remain open and susceptible to rudimentary and dangerous forms of exploitation and attack. Since, the internet is widely open and easily accessible by anyone, information can be easily extracted or manipulated and could be used against for espionage, sabotage or vandalism of the national level infrastructures by directly striking to the networks from thousands of miles away and eventually destroying and disrupting the normal flow of information and communication and therefore cyberspace could be the next war-fighting domain in modern warfare.

Let's look at some major attacks around the globe in the past.

Back in the old days (late 80’s and early 90’s), hackers used to break into systems for fun and with motive of learning new things. Robert Tappan Morris, a Cornell University graduate student who released the most notable internet worm also known as ‘Morris worm’ on November of 1988, was where the people started noticing the ability and potential of the internet. Directly or indirectly nation and state sponsored cyber-attack has been going on for more than a decade. The sophistication of cyber-attacks have been evolving in the recent years.

Involvement of China

In 2006, when the China Aerospace Science and Industry Corporation (CASIC) intranet network was surveyed, spywares were found in the computers and later on October 2007, Chines Ministry of State Security stated that foreign hackers had been stealing information from Chinese key areas. The most popular search engine of china, ‘Baidu’ was hacked by Iranian Cyber Army on January of 2010. ‘Operation Aurora’ a series of cyber-attack conducted by china is also among the most notable attack by china against US.

Involvement of Russia

Russia has a tagline of spy, espionage and proxy war since the phase of cold war. On August 2008, computer networks in Georgia were hacked by unknown foreign intruders but around that time US was in conflict with Russia, although there was little or no disruption of services but the hacks did put political pressure on the Georgian government and it appeared to be coordinated with Russian military actions. The most notable attacks carried out by Russian hackers include Red October in 2012, Turla in 2014, Yahoo data breach in 2014, Democratic National Committee (DNC) hack in 2016 and release of Hillary Clinton’s private email has also been blamed upon the Russian hackers although the real source is still unknown or unspoken.

Involvement of others

Among many of the notable attacks, Stuxnet which was discovered in 2010, had targeted industrial control SCADA (Supervisory Control and Data Acquisition) systems in Iran and was blamed on US and Israel, ‘Flame’ in 2012 which appeared to be targeting Iran and middle-eastern countries. ‘Shamoon’ in 2012 was used to conduct an incredibility destructive attack on Saudi oil industry which was blamed on Iran, Sony Pictures hack in 2014 which was blamed on North Korea.

Other than these countries, Belgium, Australia, Maldives, India, Pakistan, Nepal etc. are also the victims of cyber-attacks and are at high risk of massive cyber-attack.

Since, technology is ever changing, and so are cyber threats. Hackers have evolved as per the time. Previously attacks used techniques that were random but now the attack pattern are completely different, sophisticated and more dangerous. Attack are more advanced, persistent and the threats are higher.

What's going on in Nepal?

As per Microsoft’s Malware Infection Index Asia Pacific 2016, Nepal is ranked number four in the list, which means Nepal is extremely vulnerable to cyber-attack and is encountering highest number of malware attack on a daily basis. The Asia Pacific region is especially vulnerable with emerging markets most at risk of malware threats. Out of top five locations across the globe most at risk of infection, a total of four are from the Asia Pacific – Pakistan, Indonesia, Bangladesh and Nepal, topping the ranking at first, second, fourth and fifth place in terms of computer encountering malware.

This is not the first time that Nepal has become a target or being exploited by cyber criminals and state sponsored hackers. Previously, Naikon also known as APT-30 (Advanced Persistent Threat) group has targeted military, government and civil organization and exploited. Carbanak, an APT style attacks also resulted in financial loss of the Nepal including almost thirty other country. These type of attacks are growing rapidly although Nepal has not developed much in terms of technology. Although Nepal has Information Technology Security Emergency Response Team (ITSERT-NP) but does not actively participate in research and development nor do they participate in active Intelligence gathering and learning about new threats and spreading awareness or maybe I could be unaware of that.

Technical manpower who are capable of defending the national level infrastructure are extremely limited and are always outnumbered by start-up hackers. Lack of training, resource, materials and especially security awareness seems to the problem in context of Nepal. The first phase should be divided into learning defensive tactics and then gradually developing offensive techniques and eventually build up elite cyber task force for national defense of information and security of Nepal. On 2014 – 2015 Nepal was highly vulnerable to cyber-attack since the national infrastructure almost collapsed because of the massive earthquake, and as a result, thousands of websites and servers including servers from government, military and private servers were victim of huge cyber-attack and cyber vandalism. The main reason Nepal became a target of cyber attackers was because of the chaos and dilemma caused by earthquake. Most of the websites are built by people who have little or no knowledge about security and on top of that the websites are built for just small amount ranging from minimum of five thousand to fifty thousand rupees. Until and unless the gap between developers and security people are not bridged, cyber-attacks will continue to generate and will be the biggest curse either for Nepalese economy and national infrastructure.

Overall

There is no such thing as hack proof security but still adding extra layer of security and using concept of defense in depth will make attacker to put more effort, time and resource. Since, policy is the first line of defense, a well-structured, and well-formatted and policy should be to the point rather than defining the vague scope of the work. Creating policy for enterprise user as well and end user will help create a wall between enterprise level defenses. Every software and hardware devices should be taken seriously while manufacturing and should be tested before deploying or distributing to the end customers. Public awareness programs helps the public and security related people to discuss on topics that are usually not talked much which will close the gap between security builder and public.

The main motive behind any cyber-attack depends on type of attack and type of attacker who is attacking. By looking at the basic first steps of an attacker, the type of attack and the targeted point where an attacker is trying to attack is clear and now those information can be immediately put in place to find out if the attacker will succeed or fail. Usually, honeypots (a decoy server to find out the attack pattern of a hacker) are deployed at such case and help in studying the patterns of an attacker and also help stop attacks. To cope against cyber-attack, threat intelligence can be used as an option for defense in depth strategy. Threat intelligence gathers intelligence from various online source and then verify the original network traffic and discard the malicious traffic. Correlating different rule sets and making a certain rule to gather intelligence about the attack pattern also helps in reducing the threat to some extent.

To implement security concepts in modern cyber world, training materials and time for the training is limited and the cost is higher for training and on top of that the certifications are for limited period of time. Normally, the certifications of training are for either three years or for four years of limited time period and requires deep understanding of how networks and computers works. For enterprise level security it is somehow easy since there are lots of training resources that are freely available but to spread awareness among the public is a tough task since the public is completely unaware of how the systems work and how they can be used against them. Most people are not focused on the security part of the cyber world but are more interested in buying the latest gadgets and using them for sole benefit or for entertainment purpose.

Final words

No matter how deep is the defense is or how hard you are trained to defend, an attacker will always find a way inside and eventually break into the systems, but that does not mean to do nothing. We can never predict a cyber-war until we start one.

Alan Lakein states a quotation saying, “Failing to plan is planning to fail.”

This statement is indeed true, the very first step in doing any task is planning, and this is true for cyber warfare too. If there is no plan or well written and explained documentation then at the time of incidents, the administrator could not handle the attack and eventually get defeated and would lose data and information worth millions.

A famous quotation by Sun Tzu states, “Victorious warriors win first and then go to war while defeated warriors go to war first and then seek to win.”

This statement is also true in terms of cyber warfare. Before going towards war or before starting a war, a warrior must first know how to defend own self and know the enemy. A drill or an exercise should be carried out to learn the offensive way of penetrating and defensive way of blocking an attack. Offensive and defensive tactics should not be practiced once, nor twice, but a plenty of times before heading towards the real war. Cyber war is not much different than the war in land, sea or air but is the same, where as in cyber warfare there are no bloods and guns but just the computers, network and the giant internet. Recently, ransom wares are evolving day by day and if we do not make the general public aware about the rising malware attacks then the civilians could become direct victim of cyber-attacks.

Past is a lesson, and future is where we implement things we have learned in the past, we can either run away from it or learn a lesson from it. Previous attacks could be of great help to predict future attacks and patterns of attacks. We can expect satellites, naval forces, aircraft, missiles and rockets being hacked and exploited to cause severe damage to the global economy and infrastructures. If we do not prepare now for cyber warfare, develop threat intelligence and prepare defensively then it could raise a massive threats to our lives as a whole.
 

Note:You can find a part of this article published on a Print Media of Nepal at: https://thehimalayantimes.com/opinion/cyber-warfare-how-prepared-is-nepal/ which was published on January 05, 2017 5:06 am On: Opinion

Aftermath of ‘NSA Hack’ by ‘The Shadow Brokers’

Just after a cyber attack on U.S. Democratic National Committee by a lone hacker named ‘Guccifer 2.0’, National Security Agency (NSA) became the victim of cyber attack where the group named ‘The Shadow Broker's’ dumped more than 300 MB of Equation Group ‘Cyber Weapon’ which was operated by Tailored Access Operations (TAO) team. The Shadow Broker is currently running a Bitcoin auction for the hacking tools they have acquired. As of 13th August 2016, they tweeted about the hack with a POC and then released the dump with pgp encrypted files on different file sharing sites. As per their words, they are inviting “Wealthy elites” to bid huge amount of cryptocurrency for the deadliest cyber weapons.

The archive contained scripts under cryptonyms like BANANAUSURPER, BARGLEE, BLASTING, BUZZDIRECTION, exploits under cryptonyms like EGBL, ELBA, ELBO, ELCA, ELCO, EPBA, ESPL, EXBA and many different tools. Some of the cryptonyms were the same to that of Snowden’s leak. The exploit appears to be targeting firewalls, particularly Cisco Adaptive Security Appliance (ASA), Cisco Private Internet eXchange (PIX), Fortigate, Juniper Netscreen, TopSec etc. The exploits took advantage of undisclosed vulnerabilities aka 0’day exploits.

Mustafa Al-Bassam (Founder of LulzSec aka Tflow) has a good write up about the comprehensive list of all the tools and exploits that are contained or referenced in the dump. The targeted products and the company have already started to issue patch and publicly respond to the leaked exploits. “This is the first time possible examples of those tools have been available for inspection. As part of our analysis of these files, we identified an attack against NetScreen devices running ScreenOS.” says Derrick Scholl from the Juniper Product Security Information Response Team. Cisco has also released software updates that address Cisco ASA’s SNMP Remote code execution (RCE) vulnerability (CVE-2016-6366). Omar Santos, a Principal Engineer in the Cisco Product Security Incident Response Team (PSIRT) within Cisco's Security Research and Operations along his team has stated that “Cisco Firewall Service Modules and Cisco PIX Firewalls have passed the last day of software support milestone as stated in the published End of Life (EoL) documents. Further investigations into these devices will not be performed, and fixed software will not be made available.”  Meanwhile, Fortinet’s Threat Research and Response team has warned in an advisory of a ‘high-risk’ vulnerability in its older version of FortiGate firewalls, the statement states that, “FortiGate firmware (FortiOS) released before Aug 2012 has a cookie parser buffer overflow vulnerability, this vulnerability, when exploited by a crafted HTTP request, can result in execution control being taken over.” FortiOS 4.x firmware release and lower versions seem to be affected but FortiOS 5.x firmware is not affected and in the meantime FortiSwitch firmware versions 3.4.2 and below are affected.

Say what’s interesting in the bitcoin auction? Some of the geeks and leets seems to be making fun of the auction call or maybe they are enjoying the call. As of Wednesday, tiny payments (0.001337 BTC) of bitcoin seemed like this:

1never9kNNkr27UseZSHnaEHg1z8v3Mbb

1gonnaV3MFNjymS4RGvUbHACstiS8aSYz

1giveGEk184Gwep2KT4UBPTcE9oqWzCVR

1youKBMLEohsexdZtkvnTzHnc4iU7Ffty

1upAbpBEWQ467QNT7i4vBMVPzSfQ3sqoQ

1never9kNNkr27UseZSHnaEHg1z8v3Mbb

1gonnaV3MFNjymS4RGvUbHACstiS8aSYz

11etAyypstpXLQpTgoYmYzT8M2foBSBe1

1youKBMLEohsexdZtkvnTzHnc4iU7Ffty

1downAsBbRQcBfUj8rgQomqhRsNFf1jMo

This reads as 'never gonna give you up, never gonna let you down', which is one of a famous song among the leet community by Rick Astley - Never Gonna Give You Up.

Anyway this leak has awaken the top leading industries of networking and cyber security as well as many security community around the globe. If the victim organizations and industries do not patch their vulnerability soon, we can easily predict more script kiddies or even pro black hat communities exploiting the back doors for fun and for profits.

A search engine for Hackers – SHODAN

Wouldn’t that be cool if we could get access and control to security cameras, printers, toasters, traffic lights, gas station, nuclear power plant, monitoring stations etc.? Well, that’s exactly, what Shodan does for us. Basically, Shodan is a search engine that help users find specific devices (routers, servers, switches, computers etc.) that are connected to the internet.

This search engine was created by John Matherly and launched back in 2009. What makes Shodan different from other search engine is because of its algorithm, and definitely the way it unites the devices linked with the internet. Some define it as a reconnaissance tool, since it gives information about the open ports, service versions, server information and much more about the specified devices. A penetration tester would use this engine to find the targeted IP information which is publicly exposed. Security researchers would use it to find certain devices or information and generate report and distribute among the security community, whereas the same information could also be used by the black hat community to exploit the targeted network and cause damage to those vulnerable devices.

Most of the connected devices tend to be vulnerable in one way or the other way. A script kiddie with no prior knowledge of how things work, could use this engine and find widely open devices which uses default password or no passwords in some cases and then claim that they have hacked certain devices and act cool among friend circle. Well, isn’t that cool? (And by saying that I don’t motivate you to act illegal) Exactly, that’s what happen and what are happening. Sometimes back, security researchers have found huge number of vulnerable monitoring devices which used default username and default password or no password at all.

Back in the time, people used google dork to find out “How to hack IP camera” or so, but with Shodan you can now act as a Hollywood hacker and act cool (And again by saying this I don’t motivate you to act illegal either). Huge number of devices are widely exploited and used by cyber folks and kids. IP cameras are just a simple example. Not only IP cameras, but the devices I mentioned on the very first sentence are online, can be seen at Shodan, which are widely vulnerable and could easily be exploited with malicious intended folks from the dark.

It is always a best practice to change your default usernames and passwords, close the unused ports, and update your devices to the latest firmware and to the latest kernel release, patch the vulnerability which are made public, do not open any port unless you really need it and at least follow security related news to know what’s going on in the security community.

At last, remember this adage, “Bridge when you can and route when you must.” You might need it someday folks.