Author Archives: Hacker Medic

Smart security for today’s smart Segurança inteligente para casas inteligentes: Não de: Don’t let attackers spoil your Christmas

Hacker Medic December 3, 2014 No Comments

Resumo: A Symantec avalia a segurança de dispositivos inteligentes em casas automatizadas: interruptores, tomadas, timers, termostatos, detectores de fumaça, travas e alarmes.

Twitter Card Style:

summary

Contribuição de: Mario Ballano

(imagem: Natal em uma casa inteligente – Não deixe que os ajudantes domésticos inteligentes do Papai Noel estraguem seu Natal)

Com a aproximação das festas de final de ano, a hora das decorações luminosas chegou novamente. Como um geek, eu sou naturalmente atraído por luzes piscantes que podem ser controladas por meio de dispositivos eletrônicos e logo fiquei empolgado ao ver todas as diferentes ferramentas inteligentes e recursos de automação residencial disponíveis no mundo da Internet das Coisas (IoT).

No entanto, considerando a quantidade de possíveis problemas de segurança que os aparelhos IoT podem gerar, será que eu abriria a Caixa de Pandora ao instalá-los em casa? Antes de utilizar esses aparelhos IoT, queria saber mais sobre o real nível de segurança destes aparelhos para lares inteligentes.

Há uma variedade enorme de dispositivos domésticos inteligentes que podem ser utilizados na temporada de festas, como por exemplo:

Interruptores inteligentes para controlar luzes de Natal;
Câmera CFTV de vigilância inteligente para filmar o Papai Noel;
Detector de fumaça inteligente, caso minha árvore de Natal pegue fogo;
Sistema inteligente de entretenimento para que as músicas festivas me acompanhem de um cômodo a outro;
Termostato inteligente para deixar minha casa quente e aconchegante;
Travas inteligentes para portas que impedem a entrada de visitantes indesejados;
Sistema de alarme de segurança na janela, que deixe minha casa segura quando sair de férias, entre outros.

Muitos destes dispositivos têm conexão sem fio com um hub central, que me permite gerenciar os aparelhos a partir de um smartphone ou navegador de internet. Além de se conectarem ao Wi-Fi, eles também utilizam uma ampla variedade de protocolos de comunicação, como Powerline, Z-Wave, Zigbee e protocolos customizados de rádio.

Assim, começamos nossa análise com duas combinações de interruptores inteligentes e o hub.

Hubs inteligentes e segurança
O primeiro hub utiliza Wi-Fi e seu próprio protocolo de rádio para a comunicação. Para garantir que ele esteja rodando a versão mais recente do firmware, ele verifica periodicamente a internet em busca de atualizações. Essa é uma boa prática, já que é improvável que os usuários atualizem seus dispositivos IoT manualmente, o que poderia criar o risco de vulnerabilidades exploráveis sem patches.

Entretanto, infelizmente neste caso, as atualizações de firmware não continham assinatura digital e eram baixadas de um servidor aberto de Protocolo de Transferência de Arquivos Triviais (TFTP). Tal fato pode permitir que um cibercriminoso na mesma rede redirecionasse o aparelho para um servidor TFTP malicioso, por exemplo, através de modificações no Protocolo de Resolução de Endereços (ARP) ou alterando os ajustes de sistema de nome de domínio (DNS). O servidor TFTP poderia, então, enviar uma atualização maliciosa de firmware para o dispositivo doméstico inteligente. E, se isso acontecer, toda a instalação seria comprometida e outros aparelhos poderiam ser atacados, já que o criminoso teria controle total sobre o hub.

O mesmo smart hub utiliza um protocolo customizado de transmissão por rádio para enviar comandos aos aparelhos conectados sem nenhuma autenticação adicional ou implementação de segurança. Infelizmente, isso permite o sucesso de ataques simples de replay. Se um atacante estiver próximo à rede, por exemplo, do lado de fora da casa, ele pode interceptar parte do tráfego e repetir os pacotes para apagar as luzes ou abrir o portão da garagem. E, mesmo que ele não entenda o protocolo, ele pode conduzir um replay de uma sessão gravada para repetir um comando.

Além disso, o usuário pode armazenar os detalhes de configuração do hub em um serviço de nuvem, possibilitando que o aparelho de smart hub seja gerenciado pela internet, a partir de qualquer navegador. A conta do usuário é protegida por um código PIN simples, de quatro dígitos, que definitivamente é curto demais para o mundo atual. Mas, além do problema de um atacante adivinhar o código (principalmente se considerarmos que “1234” é uma escolha comum e insegura para muitos usuários), há outras questões com este serviço de nuvem em particular. Constatamos que o servidor de backend é suscetível a um ataque de injeção cega de SQL. E isso tem o potencial de revelar outros detalhes de configuração do usuário ou até permitir que o atacante assuma o controle de outras contas. Ou seja, o atacante pode até mesmo desligar as luzes da árvore de Natal sem ao menos estar perto da casa.

Infelizmente, o segundo hub que analisamos não foi muito melhor. Este não utiliza nenhum método de autenticação para comandos enviados na rede interna. Se um atacante estiver na mesma rede Wi-Fi do hub, ele pode adquirir o controle sobre todos os outros aparelhos. Ele pode até ir um passo além, já que o hub tinha uma vulnerabilidade de execução de código remoto, executando comandos arbitrários com privilégios raiz sobre o hub.

Riscos para sua casa inteligente
Estes hubs são apenas dois exemplos do que conseguimos comprometer em um período curto. Há muitos outros aparelhos para casas inteligentes que podem ter falhas de segurança.

Já foi constatado que alguns dispositivos domésticos têm o mesmo tipo de problema, como casos onde pessoas alteraram o termostato do ex-cônjuge ou desativaram travas de segurança. Relatórios recentes alertam sobre como milhares de webcams de IP e babás eletrônicas são acessíveis a qualquer pessoa na internet. Também houve relatos de pessoas ganhando o controle sobre sistemas de automação residencial de terceiros.

De modo geral, vemos que sensores de dispositivos domésticos inteligentes podem ser diretamente afetados, por exemplo, modificando o firmware através de acesso físico à interface JTAG do aparelho. Os criminosos podem, assim, vender o aparelho modificado a outra pessoa, comprometendo outros aparelhos ou redes de sua casa.

E, dependendo dos ajustes de segurança da rede de Wi-Fi, os atacantes podem interceptar as comunicações do dispositivo IoT para o hub central, smartphone ou nuvem, e injetar seus próprios comandos.

Além disso, se o servidor de backend da nuvem for utilizado para administração remota, essa parte deve estar protegida, já que atacantes podem tentar forçar senhas para obter acesso a este servidor.

Você pode dizer que acender ou apagar as luzes de outra pessoa não traz um grande problema. Pode ser, mas os efeitos de um ataque à casa inteligente são mais relevantes para a segurança quando você está de férias. Algumas pessoas podem usar luzes controladas remotamente para fingir que ainda há alguém em casa e afastar ladrões. Ladrões inteligentes poderiam usar webcams de IP abertas para verificar se os donos estão em casa e onde estão seus itens mais valiosos.

Outra possível via de acesso que pode ser explorada por atacantes seria aplicar o modelo de ransomware (rapto de softwares) à residência inteligente. O dono da casa seria, então, coagido a pagar um resgate para poder aumentar a calefação ou até mesmo assistir TV.

Este é um assustador paraíso para perseguidores, ladrões e outros personagens obscuros. Se eles encontrarem falhas nos sensores de segurança ou travas de portas, conseguem tudo de que precisam para arruinar seu fim de ano.

Proteção inteligente
É por isso que você deve estar atento ao instalar dispositivos domésticos inteligentes e garantir que entende bem os ajustes de configuração dos aparelhos. Nós da Symantec ficaremos de olho no mercado de aparelhos domésticos inteligentes e continuaremos a informar os fornecedores sobre pontos fracos descobertos.

A segurança varia muito em diferentes aparelhos domésticos inteligentes, portanto é difícil dar conselhos genéricos aos usuários. Seguem alguns pontos a serem considerados ao instalar aparelhos domésticos inteligentes:

Habilite a administração remota pela internet apenas se for realmente necessário
Defina uma senha forte para os aparelhos quando possível
Utilize senhas fortes e criptografia WP2 para proteger sua rede de Wi-Fi
Utilize marcas confiáveis para casas inteligentes, que invistam em segurança.

Smart security for today’s smart homes: Don’t let attackers spoil your Christmas

Hacker Medic December 3, 2014 No Comments

Many smart home solutions contain flaws that could allow attackers to access your network and potentially compromise your home’s security

Twitter Card Style:

summary

Contributor: Mario Ballano

With the holiday season around the corner, thoughts turn to a warm home brightened up by the twinkle of seasonal decorations. If you’re a geek like me, it’s always tempting to opt for the high-tech solution and control your festive lights with one of the growing number of home automation devices available. However, Symantec has found that some of these devices contain security flaws that could allow attackers to gain access to your home network.

Two home automation hubs tested by Symantec had multiple security flaws that could potentially allow attackers to gain access to the hubs themselves and, by extension, to other devices connected to them. The issues aren’t specific to these particular hubs; any connected device is potentially at risk. Many more smart home devices potentially have similar security flaws.

While the explosion of internet-enabled devices, known as the Internet of Things (IoT), holds exciting possibilities for home automation, it also presents some serious security challenges and home users need to be aware that it isn’t just their PCs or smartphones that could be compromised by attackers.

A Pandora’s Box
There is a huge range of smart home devices that could find their way into your house this holiday season:

Smart power plugs to control Christmas lights
CCTV cameras to catch Santa’s visit
Smart smoke detectors in case the Christmas tree catches fire
Smart entertainment systems, allowing the festive music to follow you from room to room
Smart thermostats to keep your home nice and warm
Smart door locks to keep unwanted guests out
Security alarm systems to keep your home safe while on vacation

Many of these smart home devices connect wirelessly to a central hub which lets you manage them all from a smartphone or web browser. Apart from Wi-Fi, smart home devices use a wide range of communication protocols, such as Powerline, Z-Wave, Zigbee, in addition to custom radio protocols. We started our analysis with two smart power plug and hub combinations.

Smart hubs and security
The first hub we looked at uses Wi-Fi and its own radio protocol for communication. To ensure that the hub is running the latest version of its firmware, it periodically checks the internet for firmware updates. This is a good practice, as users are unlikely to manually update their IoT devices themselves and could potentially fall foul of unpatched, exploitable vulnerabilities.

However, in this case, the firmware updates were not digitally signed and were downloaded from an open Trivial File Transfer Protocol (TFTP) server. This could allow an attacker on the same network to redirect the device to a malicious TFTP server. There are several means of doing this such as through Address Resolution Protocol (ARP) poisoning or by changing the domain name system (DNS) settings. The TFTP server could then send a malicious firmware update to the device. If this happens, then the complete setup would be compromised and other connected devices could be attacked, as the attacker would have full control over the hub.

This same smart hub uses a custom radio transmission protocol for sending commands to connected devices without any additional authentication or security implementation. Unfortunately, this allows for successful replay attacks. These are very simple attacks which allow an attacker within range of the network to intercept some of the traffic and then replay it back over the network. For example, a signal to open a garage door captured while you are leaving the house could be used again later in the day to gain access. The same can be done for turning on or off lights. The attacker doesn’t even need to understand the protocol, they simply have to capture the signal used to issue a command a replay it.

The user can store this hub’s configuration details in a cloud service, allowing them to manage the device from the internet through any web browser. Unfortunately, the user’s account is protected by a simple, four-digit PIN code. This can be easily cracked with the tools available to today’s attackers.

Apart from the problem of an attacker guessing the PIN code (especially considering how “1234” is a common, unsecure PIN choice for many users), there are other issues with this particular cloud service. We discovered that the backend server is susceptible to a blind SQL injection attack. This could potentially reveal other users’ configuration details or may even let the attacker take control of other accounts. This could let the attacker switch off Christmas tree lights, or worse, without even being close to the house.

Unfortunately, the second smart home hub that we tested was not much better. This one did not use any authentication method for commands that were sent in the internal network. If an attacker is on the same Wi-Fi network as the hub, then they could gain control of any device connected to the hub. They could even go a step further, as the hub had a remote code execution vulnerability, allowing the attacker to execute arbitrary commands with root privileges on the hub.

Risks to your smart home
These hubs are just two examples of what we managed to compromise in a short space of time and are the latest in a long line of security flaws found in smart home devices. For example, there have been cases where people modified the thermostat of their ex-spouse or disabled security locks. Recent reports warned of how thousands of webcams and baby monitors are accessible to anyone from the internet. There have also been reports of people taking control of home automation systems belonging to others.

In general, we have found that smart home device sensors can be attacked directly, for example by modifying the firmware through physical access to the device’s JTAG interface. The attackers could then sell the modified device to someone else, potentially compromising other devices or networks in their home.

Depending on the Wi-Fi network’s security settings, attackers could intercept communications from an IoT device to the central hub, smartphone, or the cloud and inject their own commands.

Additionally, if a backend cloud server is used for remote administration, this part also needs to be protected. Attackers could attempt to brute-force passwords to gain access to this server.

You may say that switching someone’s lights on and off is not such a big deal. This may be true, but the effects of a smart home attack are more relevant to security when you are on vacation. Some people may use remote-controlled lights to pretend that someone is still at home to keep burglars away. Smart thieves could also use open IP webcams to check if the owners are at home and where their valuable items are.

Another possible avenue for attackers to explore would be to apply the proven-to-work model of ransomware to the smart home. The homeowner could be coerced to pay a ransom in order to turn up the heating or even just to watch TV. This is a creepy potential paradise for stalkers, burglars, and other shady characters.

Smart protection
You should be vigilant when installing smart home devices and make sure that you understand the devices’ configuration settings. We at Symantec will keep our eyes open on the smart home device market and continue to inform vendors about discovered weaknesses in the devices we study.

Security varies a lot with different smart home devices, so it is difficult to give generic advice to users. Here are a few points to consider when installing smart home devices:

Only enable remote administration from the internet if you really need it
Set a strong password for the devices where possible
Use strong passwords and WP2 encryption to protect your Wi-Fi network
Use trusted smart home brands from companies that invest in security

Trend Micro’s Q3 Security Roundup Details Unprecedented Vulnerabilities and New, Sophisticated Techniques

Hacker Medic December 2, 2014 No Comments

Shellshock revelation, new attacks against mobile and web platforms dissected in quarterly report

2014 ????????????????? 4 ???

Hacker Medic November 30, 2014 No Comments

重大な脆弱性からサイバースパイ活動まで、今年の事件を振り返り、将来への影響を考察します。

Twitter Card Style:

summary

2014 年は、大規模なデータ侵害から Web の根幹に関わる脆弱性まで、さまざまなセキュリティ事案が発生しましたが、その中で重要度を判断するのは難しいことです。単に興味を引くだけの出来事もあれば、オンラインセキュリティにおける大きなトレンドを示す出来事もあります。過去の名残に過ぎない脅威もあれば、将来を指し示す脅威もあるのです。

この 1 年にオンラインセキュリティの世界で発生した 4 つの重要な事件を振り返り、そこから得られた（または得るべき）教訓と、来年予想される出来事を考察します。

Heartbleed 脆弱性および ShellShock（Bash Bug）脆弱性の発見
今年の春、Heartbleed 脆弱性が見つかりました。Heartbleed は OpenSSL の深刻な脆弱性です。OpenSSL は、SSL プロトコルと TLS プロトコルの最も普及している実装として、多くの有名な Web サイトで使用されています。攻撃者は、Heartbleed 脆弱性を悪用して、ログイン情報や個人データ、さらには復号鍵といった機密情報を盗み出し、セキュア通信を解読できる可能性があります。

続いて秋口には、Linux および Unix、さらには Unix ベースである Mac OS X の多くのバージョンに搭載されている Bash（シェルと呼ばれる共通コンポーネントの 1 つ）の脆弱性が見つかりました。

ShellShock または Bash Bug と呼ばれるこの脆弱性によって、攻撃者は、侵入先のコンピュータからデータを盗み取ることができるだけでなく、そのコンピュータを制御してネットワーク上の他のコンピュータにアクセスする可能性もあります。

Heartbleed 脆弱性と ShellShock 脆弱性によって、オープンソースソフトウェアのセキュリティに注意が向けられ、電子商取引で使われているきわめて多くのシステムの根幹に関わっていることが明らかになりました。ベンダー独自のプロプライエタリソフトウェアで脆弱性が見つかった場合は、そのベンダー 1 社が提供するパッチが必要になるだけです。しかし、オープンソースソフトウェアの場合には、膨大な数のアプリケーションやシステムに統合されている可能性があるため、管理者はさまざまなベンダーが提供するパッチを必要とします。ShellShock 脆弱性と Heartbleed 脆弱性では、パッチの提供状況や有効性について多くの混乱が発生しました。これを契機に、オープンソースの脆弱性に関して、MAPP プログラムのように足並みを揃えた対応の必要性が認識されることを願っています。

オープンソースプログラムでは、今後もこのような新しい脅威が見つかるでしょう。それらが攻撃者にとって新しい攻撃対象になる可能性がある一方で、最大のリスク要因はやはり、適切なパッチが適用されていない既知の脆弱性です。今年のインターネットセキュリティ脅威レポートによると、正規の Web サイトの 77 % で悪用可能な脆弱性が放置されています。したがって 2015 年は、攻撃者は Heartbleed 脆弱性や ShellShock 脆弱性を悪用すると共に、パッチが適用されていない多数の脆弱性をまんまと悪用し続けることでしょう。

組織化されたサイバースパイ活動とサイバー妨害工作の可能性: Dragonfly および Turla
Dragonfly グループは、2011 年にはすでに活動が確認されており、当初は米国とカナダの航空防衛企業を標的としていましたが、2013 年の初めに主にエネルギー企業に狙いを変えています。このグループは複数の経路で攻撃を仕掛ける能力を備えており、大掛かりな攻撃活動を実行して、産業用制御システム（ICS）機器メーカー数社のソフトウェアにリモートアクセス型のトロイの木馬を感染させました。これにより、攻撃者は、ソフトウェアがインストールされているシステムにアクセスすることができ、標的組織に侵入してサイバースパイ活動を実行する足掛かりができたのです。さらに、それらのシステムの多くでは、石油パイプラインやエネルギー網など、重要なインフラの制御に使用されるICSプログラムが稼働していました。これらの攻撃においてサイバー妨害工作は確認されませんでしたが、攻撃者が妨害工作を実行できる能力を持ち合わせており、いつでも攻撃を仕掛けることができたのは間違いありません。おそらく、攻撃の開始を待ち構えていたところで、実行前に中断したのでしょう。

また、Dragonfly は、標的の組織に侵入するために標的型のスパムメール攻撃や水飲み場型攻撃を実行していました。Turla マルウェアの背後にいるグループも、同様に多段階の攻撃戦略を用いており、スピア型フィッシングメールや水飲み場型攻撃を使って標的を感染させます。水飲み場型攻撃では標的を極度に絞り込んだ侵害機能が用いられ、特定範囲の正規の Web サイトを侵害して、事前に指定した IP アドレス範囲からアクセスした標的のみにマルウェアを配布していました。さらに、攻撃者たちは、重要度の高い標的のために最も高度な監視ツールも用意しています。ただし、Turla の動機は Dragonfly とは異なります。Turla の攻撃者は大使館や政府機関を標的として長期的な監視活動を実行しており、これはきわめて典型的なスパイ活動です。

Dragonfly の攻撃と Turla の攻撃のどちらにも、国家が支援している活動に見られる特徴があり、高度な技術力と豊富なリソースが認められます。これらのグループは、複数の経路で攻撃を仕掛けたり、多数のサードパーティの Web サイトを侵害したりできる能力を備え、サイバースパイ活動を目的としているようです。Dragonfly はさらに、妨害工作を実行する能力も備えています。

こうした攻撃は、ほぼ毎日観測される多数のサイバースパイ攻撃のほんの一例です。問題は世界中で発生していて静まる気配はありません。Sandworm などによる攻撃でも、多数のゼロデイ脆弱性が悪用されています。高度な技術リソースや潤沢な資金力を踏まえると、これらの攻撃は国家が支援している可能性が高いでしょう。

狙われたクレジットカード
盗んだクレジットカードやデビットカードのデータを闇市場で販売して儲けるために、こうしたカード類は犯罪者の格好の標的となっています。今年は、店頭レジ端末（POS）システムを狙って消費者の決済カード情報を盗み取る大規模な攻撃が何件も発生しました。米国が主な標的となった原因として、磁気ストライプのカードよりも高度なセキュリティを提供する、EMV（Europay, MasterCard, and VISA）と呼ばれる「チップアンドピン」方式のシステムが採用されていないことが挙げられます。攻撃に使用されたマルウェアは、決済カードの磁気ストライプから読み取られた情報を、暗号化される前に盗み取ることが可能です。この情報を使ってカードを複製することができます。EMV カードの取引情報は一回限りの暗号化が毎回行われるため、犯罪者が決済データの有用な部分だけを選んで別の購入に再利用するのは困難です。ただし、EMV カードも不正なオンライン購入に利用される危険性があります。

また、今年は、近距離無線通信（NFC）技術を利用して iPhone を「仮想財布」として利用する Apple Pay も開始されました。NFC とは、ハードウェアデバイスから近くにある別の物理オブジェクト（Apple Pay の場合は店のレジ）に、データを無線で送信する通信手段です。

NFC 決済システムは目新しいものではありませんが、多くのスマートフォンで NFC 規格がサポートされるようになれば、来年はこの技術を利用する消費者も増えると予想されます。NFC システムは磁気ストライプよりも安全性が高いとはいえ、依然として犯罪者に悪用される可能性があることには注意が必要です。ただし、犯罪者は個々のカードを標的とする必要があるので、今年米国で発生したような大規模な侵害や盗難は起きないでしょう。しかし、決済カードデータを安全に保管していない小売業者を NFC 決済システムが保護してくれるわけではありません。保管されたデータは、引き続き厳重に保護する必要があります。

法執行機関との協力体制の強化
最後は、よいニュースをお伝えします。今年は、国際的な法執行機関が、サイバー犯罪者の摘発に向けてオンラインセキュリティ業界との協力を深め、従来よりも活発かつ積極的に活動した事例が多く見られました。

Blackshades は、初心者レベルのハッカーから高度なサイバー犯罪グループにいたるまで、さまざまな攻撃者によって使用されている有名かつ強力なリモートアクセス型のトロイの木馬（RAT）です。2014 年 5 月、FBI、欧州警察組織、その他複数の法執行機関は、Blackshades（別名 W32.Shadesrat）に関連するサイバー犯罪活動の疑いで数十名を逮捕しました。今回の一斉摘発において、シマンテックは FBI と緊密に連携し、関与した容疑者たちを追跡するための情報を提供しています。

そのちょうど 1 カ月後、FBI、英国の国家犯罪対策庁、その他複数の国際的な法執行機関は、シマンテックを含め複数の民間パートナーと協力して、非常に危険な 2 つの金融詐欺活動、Gameover Zeus ボットネットと Cryptolocker ランサムウェアネットワークに対する大規模な摘発作戦を実行しました。この結果 FBI は、双方の脅威によって使われていた大規模なインフラを押収しています。

これらの摘発作戦を含めて継続的な取り組みは行われているものの、サイバー犯罪が一夜にしてなくなることはありません。長期的な成功のためには、民間のパートナーと法執行機関が協力を継続することが必要です。サイバー犯罪活動がますます急速に高度化していくなか、サイバー犯罪者を摘発して活動を停止させるべく、今後もこの協力活動が続くことを期待します。

以上が、2014 年のオンラインセキュリティにおける 4 大事件です。まだ 2015 年まで数週間あるので、もちろん新しい事件が発生する可能性もあります。しかし、将来何が起きようとも、シマンテックはお客様を保護することをお約束いたします。

* 日本語版セキュリティレスポンスブログの RSS フィードを購読するには、http://www.symantec.com/connect/ja/item-feeds/blog/2261/feed/all/ja にアクセスしてください。

Regin: ????????????????????????

Hacker Medic November 26, 2014 No Comments

類を見ない技術力を有する高度なスパイツール Regin は、政府機関、インフラ運営組織、企業、研究者、個人を狙ったスパイ活動に利用されています。

Twitter Card Style:

summary

Regin と呼ばれるこの高度なマルウェアは、少なくとも 2008 年以降、世界のさまざまな標的に対する組織的なスパイ活動に利用されています。Regin はバックドア型のトロイの木馬であり、その構造から類を見ない技術力が伺える複雑なマルウェアです。標的に応じてさまざまな機能をカスタマイズできるため、攻撃者にとって大規模な監視活動を行うための強力なフレームワークであり、政府機関、インフラ運営組織、企業、研究者、個人を狙ったスパイ活動に利用されています。

開発には年単位、または少なくとも月単位の期間を要したと考えられ、その痕跡を隠すために開発者は努力を惜しまなかったようです。その機能や豊富なリソースから、Regin は国家によって使用されている主要なサイバースパイツールの 1 つだと思われます。

Backdoor.Regin はホワイトペーパー（英語）で説明されているように、多段階型の脅威であり、第 1 段階を除いて、各段階は隠蔽されて暗号化されています。第 1 段階が実行されると、全部で 5 段階からなる後続の段階が順に復号されてロードされる仕組みです。個々の段階からは、パッケージの全体に関する情報はほとんど得られません。5 つの段階のすべてを入手して初めて、この脅威の分析と理解が可能になるのです。

図 1. Regin の 5 つの段階

また、Regin はモジュール型の手法を採用しているため、標的に応じて用意されたカスタム機能をロードすることができます。この手法は、Flamer や Weevil（The Mask）といった高度なマルウェアファミリーでも見られるものです。また、多段階にロードされる構造は、Duqu や Stuxnet で採用されているものに類似しています。

活動の時系列と標的のプロファイル
Regin の感染は 2008 年から 2011 年にかけて、さまざまな組織で確認されていましたが、その後、突然活動を休止しています。2013 年になって、マルウェアの新しいバージョンによる活動が再開されました。標的には、民間企業、政府機関、研究機関が含まれます。感染のほぼ半数は、個人や小規模企業を標的とするものです。通信会社に対する攻撃は、各社のインフラを経由する通話にアクセスすることを狙ったものだと思われます。

図 2. Regin の感染件数の業種別内訳

感染は地理的にも分散していて、主に 10 カ国で確認されています。

図 3. Regin の感染件数の国別内訳

感染経路とペイロード
感染経路は標的によって異なり、このブログの執筆時点で、再現可能な経路は確認されていません。一部の標的は、有名な Web サイトに偽装したサイトにアクセスするように仕向けられた後に、Web ブラウザを介して、またはアプリケーションを悪用されて、この脅威がインストールされたと考えられます。あるコンピュータのログファイルには、未確認の悪用コードによって Yahoo! Instant Messenger から Regin が侵入した痕跡が記録されていました。

Regin はモジュール型の手法を採用しているため、攻撃者は、必要に応じて個々の標的に合わせたカスタム機能をロードすることが可能です。一部のカスタムペイロードは非常に高度な機能を備え、特定分野における高い技術力を示していることから、開発者が高水準のリソースを抱えていることを重ねて証明しています。

Regin には、数十種類ものペイロードが存在し、リモートアクセス型のトロイの木馬（RAT）のさまざまな機能を標準で装備しています。たとえば、スクリーンショットの撮影、マウスのポイントアンドクリック操作の制御、パスワードの窃取、ネットワークトラフィックの監視、削除済みファイルの復元などの機能です。

Microsoft IIS Web サーバーのトラフィックを監視したり、携帯電話の基地局コントローラの管理トラフィックを盗聴したりするなど、さらに特化された高度なペイロードモジュールも確認されています。

ステルス性
Regin の開発者は、この脅威が人目に付かずに活動できるように相当な労力を費やしています。目立たないということは、何年間にもわたる持続的なスパイ活動に利用できるということです。存在が検出されたとしても、どのような活動を実行しているかを確認するのは非常に難しく、今回も、ペイロードがサンプルファイルを復号してようやく、ペイロードを分析することができました。

「ステルス」機能として備えられているのは、フォレンジック対策機能、カスタム開発された暗号化仮想ファイルシステム（EVFS）、RC5 の亜種という通常使われているものとは別の暗号化方式などです。また、攻撃者と秘密裏に通信するために、ICMP の ping、HTTP cookies に埋め込まれたコマンド、カスタムの TCP プロトコルと UDP プロトコルなど、複数の高度な手法を使用しています。

まとめ
Regin は非常に複雑な脅威であり、組織的なデータ収集活動や情報収集活動に利用されています。開発と運用には膨大な時間とリソースを投資する必要があることから、背後に国家が存在すると考えられるでしょう。標的に対して、長期間にわたり執拗に監視活動を実行するうえで非常に適した設計になっています。

Regin が発見されたことで、情報収集活動に利用するツールを開発するために、膨大な投資が継続的に実行されていることが明らかになりました。Regin には、まだ見つかっていないコンポーネントが多数あり、その他の機能や別のバージョンが存在する可能性があります。シマンテックは今後も分析活動を継続し、新しい発見があり次第、情報を提供する予定です。

追加情報
侵害の兆候や、さらに詳しい技術情報については、ホワイトペーパー『Regin: Top-tier espionage tool enables stealthy surveillance（Regin: 人目に付かずに監視活動が可能な最悪のスパイツール）』（英語）を参照してください。

保護対策
シマンテック製品およびノートン製品は、この脅威を Backdoor.Regin として検出します。

Who’s Watching You Sleep?

Hacker Medic November 25, 2014 No Comments

The Gaping Hole in the Internet of Things

Thanks to George Orwell’s classic book 1984, I graduated High School thinking I would eventually live in a world monitored and suppressed by world governments. In the wake of the PRISM scandal in 2013 I started to get the feeling that Orwell’s dystopian novel was looking like an ill-timed prophesy. In light of comedian Pete Holms’ rant on how Privacy is Uncool, it is little brother (us) leaking our secrets; no one has to steal them from us. If you thought unmanaged Social Media privacy settings were bad, how much would you cringe if you knew you were letting people watch you sleep? Welcome to the perils of the Internet of Things (IoT).

Up until very recently a number of security camera manufactures were shipping internet connected cameras (AKA IP cameras) with default passwords. Many of these passwords were never changed by the purchaser after setting them up. It was only a matter of time that someone would set up a website displaying many of these feeds (Up to 73K at its peak).

Let me introduce Insecam, the website dedicating to not only showing you the unrestricted feeds of home and commercial security cameras but also to where they are located with all of the admin and password information. In addition to this they have social plugins that let you share your favorite feeds with your community. Ultimately taken from the pages of the improving-through-shaming security book, this site claims to seek the end of default passwords yet places advertisements conveniently next to navigation icons.

Sleep edit.jpg

On my review of the site, I saw mundane shots of doors and walkways and more mild scenes of people working the front counters of gas stations and dry-cleaners. With a chill down my spine I saw a bartender drinking the profits and an overhead shot of a girl scrolling through a fashion site. What startled me was the shear amount of cameras in bedrooms, a no-no in my world. Granted that a majority of these were aimed at cribs but the alarming part was the number of unsecured cameras pointed at hospital patients, adult beds, living rooms, and private hot tubs. Sadly, various online forum contributors claim to have found dead bodies and adults in very private or intimate situations. Situations like this define the need for better security in the internet of things landscape.

No matter what colored bucket of hacker you place the Insecam’s creator into, they have exposed a gaping hole in the IoT landscape. In 2011 there were over 9 Billion devices connected to the internet and by the year 2020 it is expected that number will be close to 24 billion. This is a cause for concern for manufactures and companies like Symantec and a potential bonanza for hackers. As more and more things come online, we are discovering new vulnerabilities and how some security practices are becoming out of date. There are obstacles with current security practices but there are ways to overcome them.

Better Password Management

I’m not a fan of passwords. Since we have to live with them we have to learn how to use them. I wrote a fun mocku-blog on password best practices for you to loathe and share. Passwords are a very weak form of security and Insecam proved that. Two Factor authentication can be used to install and access IP camera feeds via a computer or mobile device. If you have the time, take a peek at this white paper from Symantec on digital certificates used for authentication.

When it is all said in done, Insecam victims used default ports and passwords and were most likely discovered by an IP address surfing tool. A simple change of the password would eliminate them from the site but it could still be guessed by a serious stalker. Keep in mind that passwords are the number one thing sought after by hackers since we often use the same ones on multiple sites. Here is how they do it.

Encryption; an IoT solution

As a best PKI practice, all data SHOULD be encrypted in transit and at rest between a Host and Client. If the device manufactures enabled encryption of the data, only the end user could review the video stream with client authentication. This would slow the feed a bit but it would secure the connection. If marketers want to instill trust in their internet connected devices they need to consider implementing a security promise with their messaging. So how can they encrypt a live feed?

My engineering buddy and counterpart Frank Agurto-Machado recommends the use of embedding a private SSL ROOT CA within each device. The connection between the manufacture’s infrastructure and the camera would be secured and encrypted via client authentication to this private SSL root. Ultimately, this may increase the cost of a device but it would help better ensure security. While this DOES NOT remedy the Password hijacking, it secures the model from point-to-point between the “client” and the host. Symantec offers Private CAs to enterprises that need customized encryption for server to server communication or for applications such as this.

The Security Trade-Off

Balance Act_0.jpg

Throughout the course of world history humans have always had to juggle between access and fortification when it comes to security. Our ancestors had to find a way to secure a food hoard that would not take hours to hide or cover. Castles had to ensure soldiers and citizens could pass freely yet survive a siege. Anti-virus software on your PC has to allow you to quickly surf the internet but check and possibly restrict all incoming traffic. Manufactures within the IoT space have to learn how to balance these two and improve customer messaging to assist them in setting up a trustworthy and secure devices.

Edit: Since the writing of this blog insecam has been shut down. From appearances it appears to be taken down by a third-party hacker.

DroidJack RAT: A tale of how budding entrepreneurism can turn to cybercrime

Hacker Medic November 25, 2014 No Comments

See how Android.Sandorat, a multi-featured mobile crimeware tool, began life as a legitimate Android app.

Twitter Card Style:

summary

Small-scale mobile app software entrepreneurship has been described as the cottage industry of the 21st century. It allows talented software developers to apply their skills to create new and innovative mobile apps, with the hope of becoming the next big thing and, perhaps, even attaining the trappings of wealth associated with success. However, with over 1 million apps available for download on the Google Play Store, for every success story there are countless apps that fail to deliver.

While I was researching a new Android remote administration tool (RAT) known as DroidJack (detected by Symantec as Android.Sandorat), it soon became apparent that its authors had actually started off as Android app developers. In their own words, they were “budding entrepreneurs trying to develop and apply skills that we have gained.” With limited success of their legitimate app on the Google Play Store, they soon turned their skills to creating and selling an Android crimeware tool, known as SandroRAT, on a hacker forum. In August 2014, this same tool was reported in the media to have been used in cybercriminal activity targeting Polish banking users through a phishing email. This tool has since evolved into DroidJack RAT and is now being openly sold on its own website at a cost of US$210 for a lifetime package.

Figure 1. DroidJack website logo

Evolution
On April 26, 2013, the Sandroid RAT was released on the Google Play Store. The authors described the app as being a free tool that lets users control their PC without advertisements.

Figure 2. DroidJack website logo

On December 29, 2013, there was an announcement on a hacker forum of a new project called SandroRAT. The forum poster linked the project back to the Sandroid app available on the Google Play Store, referring to SandroRAT as being a kind of “vice-versa” to the Sandroid app, while also commenting on how it remains hidden on the phone.

Figure 3. SandroRAT control panel

On June 27, 2014, there was an announcement from the same poster on the same hacker forum of a next-generation Android RAT, known as DroidJack.

Figure 4. DroidJack control panel

Capabilities
DroidJack has similar features to other Android RATs, such as AndroRAT and Dendroid. Some of the more than 50 features on offer include the following:

No root access required
Bind the DroidJack server APK with any other game or app
Install any APK and update server
Copy files from device to computer
View all messages on the device
Listen to call conversations made on the device
List all the contacts on the device
Listen live or record audio from the device’s microphone
Gain control of the camera on the device
Get IMEI number, Wi-Fi MAC address, and cellphone carrier details
Get the device’s last GPS location check in and show it in Google Maps

Figure 5. Screenshot from DroidJack marketing video, which shows GPS pinpointer location feature using Google Maps

Legality
Law enforcement is getting more aggressive in its stance against the creation and use of RATs. In May 2014, the FBI, Europol, and several other law enforcement agencies arrested dozens of individuals suspected of cybercriminal activity centered on Blackshades (detected as W32.Shadesrat), a RAT for personal computers that was sold on a dedicated website. Moreover, the recent arrest and indictment of a man in Los Angeles for allegedly conspiring to advertise and sell StealthGenie (Android.Stealthgenie), a mobile application similar to DroidJack, shows that law enforcement is continuing its campaign against any technology designed to invade an individual’s privacy.

In an attempt to distance themselves from any responsibility for illegal activity, the authors of DroidJack have included a disclaimer in their marketing material. Similar disclaimers have been used in the past by other malware authors, such as the Mariposa botnet author, who unsuccessfully claimed on his website that the software was only for educational purposes. Whether the authors of DroidJack truly believe that this disclaimer absolves them of any responsibility is irrelevant, as naivete is not a defense in law.

Figure 6. Disclaimer used in DroidJack marketing

Attribution
If the author or authors of DroidJack meant to cover up their tracks, they have not done a good job. Some simple investigations lead back to the names and telephone numbers of several individuals initially involved in the creation of Sandroid, supposedly based out of Chennai in India. However, whether all of the initial developers are still involved in the creation of DroidJack is not clear. Their marketing video for DroidJack also clearly shows the GPS pinpointer locator function homing in on a location in India. If the authors of DroidJack are truly based out of India, cyber law in India indicates that the creation of such software would be seen as an offense.

Protection summary
Symantec offers the following protection against DroidJack.

Antivirus

Android.Sandorat
Android.Malapp (prior to the release of Sandorat)

DroidJack RAT: A tale of how budding entrepreneurism can turn to cybercrime

Hacker Medic November 25, 2014 No Comments

See how Android.Sandorat, a multi-featured mobile crimeware tool, began life as a legitimate Android app.

Twitter Card Style:

summary

Figure 1. DroidJack website logo

Evolution
On April 26, 2013, the Sandroid RAT was released on the Google Play Store. The authors described the app as being a free tool that lets users control their PC without advertisements.

Figure 2. DroidJack website logo

Figure 3. SandroRAT control panel

On June 27, 2014, there was an announcement from the same poster on the same hacker forum of a next-generation Android RAT, known as DroidJack.

Figure 4. DroidJack control panel

Capabilities
DroidJack has similar features to other Android RATs, such as AndroRAT and Dendroid. Some of the more than 50 features on offer include the following:

No root access required
Bind the DroidJack server APK with any other game or app
Install any APK and update server
Copy files from device to computer
View all messages on the device
Listen to call conversations made on the device
List all the contacts on the device
Listen live or record audio from the device’s microphone
Gain control of the camera on the device
Get IMEI number, Wi-Fi MAC address, and cellphone carrier details
Get the device’s last GPS location check in and show it in Google Maps

Figure 5. Screenshot from DroidJack marketing video, which shows GPS pinpointer location feature using Google Maps

Figure 6. Disclaimer used in DroidJack marketing

Protection summary
Symantec offers the following protection against DroidJack.

Antivirus

Android.Sandorat
Android.Malapp (prior to the release of Sandorat)

2755801 – Update for Vulnerabilities in Adobe Flash Player in Internet Explorer – Version: 32.0

Hacker Medic November 25, 2014 No Comments

Revision Note: V32.0 (November 25, 2014): Added the 3018943 update to the Current Update section.Summary: Microsoft is announcing the availability of an update for Adobe Flash Player in Internet Explorer on all supported editions of Windows 8, Windows …

Regin??????????????????

Hacker Medic November 23, 2014 No Comments

Regin 是一款先進的窺伺工具，本身具有極為罕見的技術專業能力，並且已經運用於窺伺政府機關、基礎設施營運商、各級企業、研究機構乃至於平民個人。

Twitter Card Style:

summary

這款先進的惡意軟體，名稱為 Regin；至少自 2008 年起就已經開始用運用在有系統的窺伺活動中，針對許多跨國目標進行窺伺。Regin 屬於後門類型的木馬程式，是一款複雜的惡意軟體，其結構呈現出罕見的技術專業能力。這款惡意軟體藉由依目標而定的眾多功能實現自訂目標，能夠使其操控者得以運用功能強大的架構進行大規模監視，並且已經運用在以政府機關、基礎設施營運商、各級企業、研究機構乃至於平民個人為對象的窺伺行動當中。

這款惡意軟體的開發時間，就算不是耗時數年，也是耗費數個月才完成的；而且作者也花費許多心思隱匿其蹤跡。Regin 的功能及其背後所投注的資源層級，在在顯示，這是一款國家級的重大網路刺探工具。

正如賽門鐵克在新發行的技術白皮書中所言，Backdoor.Regin 是一項分段式威脅，而且除第一階段外，各個階段都經過隱藏並以加密處理。執行第一階段會啟動一連串的解密作業，並載入所有後續階段，一共五個階段。而各別階段皆提供少量有關完整套件的資訊。只有集合全部五個階段，才能分析並瞭解這項威脅。

圖 1.Regin 的五個階段

Regin 也採用模組化方式，載入專為特定目標而設計的自訂功能。這種模組化方式也已經在其他系列的精密惡意軟體系列中發現，例如 Flamer 與 Weevil (即「面具」)，而分段式載入架構，也類似於 Duqu/Stuxnet 系列威脅所呈現的情況。

時間進程與目標相關資料
在 2008 年至 2011 年之間，我們觀察到 Regin 感染各種組織機構，而在此之後，它卻突然隱匿。而此惡意軟體的新版本，則是自 2013 年起重新出現。攻擊目標包含民營公司、政府機關以及研究機構。將近半數的感染，都是以平民個人與小型企業做為目標。針對電信公司的攻擊，顯然意在取得透過其基礎設施傳送的通話內容。

圖 2.經各部門所確認的 Regin 感染事件

感染事件發生在各個不同的地區，已經獲悉的感染，主要發生於十個不同的國家地區。

圖 2.經各部門所確認的 Regin 感染事件

感染事件發生在各個不同的地區，已經獲悉的感染，主要發生於十個不同的國家地區。