What we can learn from Google's China attack

The Internet has been abuzz over Google's admission that it was targeted in a coordinated and allegedly state sponsored cyber attack. Some are applauding Google's stance, while others question Google’s true motivation. This story is too big to just disappear so I have no doubt that we'll learn more as time goes on, but let's consider what we should have learned thus far.

1.) Corporations make corporate decisions

It makes for a lovely feel good story to believe that Sergey Brin charged into Eric Schmidt's office to demand that Google exit China as retaliation for the attack. It's nice to believe that "do no evil" can survive in the corporate jungle. The reality is that Google is a large (very large) corporation and mottos other than "do what's best for the shareholder's" are little more than advertising hype. Sure Sergey and Larry own a big piece of the pie, but like all large corporations, Google is controlled by large, faceless institutional investors doing what they've been tasked with - looking at the bottom line. Google didn't go public with this story to save the world. They did so because they believe that it's the right business decision and they've decided that the benefits of doing business in China simply aren't worth the costs. They remain a long way from winning in China the way that they've won in the rest of the world. They have decided that the cost of the negative public perception created when they agreed to censor search results simply hasn't been worth it, especially when they are also forced to deal with state sponsored infiltrations, possibly aided by insiders.

2.) Outdated Web Browsers Leave a Gaping Security Hole

Just because software hasn't reached end-of-life status isn't justification for using it. It has been a long standing gripe of mine that IE 6 continues to control significant market share in the enterprise. Any CISO that hasn't fought to change this should be fired. Yes, IE 7 & 8 are also allegedly vulnerable but public exploit code seen to date has not successfully exploited these versions of IE. Why? Because they have additional security measures that make this vulnerability harder to exploit. In this case, the protection making the difference is Data Execution Prevention (DEP) but additionally, they include a number of additional protections such as Address Space Layout Randomization (ASLR), malicious URL/phishing blacklists, XSS protection, etc. The answer is not to avoid IE altogether as Germany and France suggest, but at a minimum, enterprises must ensure that they are running the latest browsers, with the most current security protections.

3.) 0Day, Targeted Attacks are Very Hard to Defend Against

Perfect security lives on Pandora. We live on Earth. Don't waste time looking for it.

When an attacker possesses a weapon that you haven't seen before, you are at a significant disadvantage. 0day attacks present a fundamental challenge because we don't know what we're looking for. Combine that with a knowledgeable adversary that can effectively employ social engineering and no matter what security measures you have in place, at some point you will be compromised. Should we roll over and give up? Of course not. The goal is not perfect security but rather to mitigate threats to an acceptable level. We can achieve that by employing defense-in-depth and assuring that our detective controls are sufficient to understand the extent of damage, control it and quickly recover should a breach occur.

4.) The Best Defense is a Good Offense

One of the more surprising angles to this story has been the revelation that Google went on the offensive to get to the bottom of the attack. While such an approach can put an organization in a legal grey area, it is unlikely that Google would ever have had the evidence necessary to be confident of the origin of the attacks and the fact that some 33 other companies were affected had they not broken into a server in Taiwan. Did Google coordinate it's efforts with law enforcement? Is this a tipping point in the evolution of cyber warfare, when corporations frustrated with the red tape encountered by law enforcement crossing international borders begin to take matters into their own hands? Stay tuned...

- michael

Haiti Earthquake Also Rocks Internet (Update)

Following my previous post, I had lots of questions about what we are seeing in terms of malware and fraud taking advantage of the Haiti earthquake.

Not surprisingly we have seen an increase of web transactions to charity / donation sites - including some domains that were registered immediately following the earthquake, for example, haitifoundation.com.


Web transactions to donations sites range from:

• The mainstream, for example, RedCross
• The more obscure, for example, a personal blog (haitirescuecenter.wordpress.com) of an alleged worker in Haiti.
• The suspicious, for example, haitipal.com that links you to a PayPal donation to the user haitipal{at}hotmail[dot]com.

While, such sites may have good intentions, users should be wary of any site soliciting PayPal donations as there's no way to vet the source and ensure that donations are going to the victims. Individuals looking to donate should stick to reputable organizations only. CNN has a list of known, vetted donation organizations for Haiti.

On the malware front, we are seeing an increase in search engine optimization (SEO) taking advantage of Haiti Earthquake search terms to redirect visitors to FakeAV malware.

Here is a small list of the FakeAV domains that we have seen recently being redirected from Haiti Earthquake SEOed sites:

• fullsecurityscanc.com
• scan-now23.com
• full-pc-scanner1.com
• best-systemguard.net
• full-pc-scanner22.com
  

Zscaler will continue to monitor and protect their customers against this campaign.

Haiti Earthquake Also Rocks Internet

The magnitude 7.0 earthquake rocked Port-Au-Prince and its surrounding area on Tuesday, January 12, 2010 at 13:53:09 PST (21:53:09 UTC) according to USGS. Within the hour, the shock resonated on the Internet. The security community, including Zscaler, has been and continues to be vigilant (reference SANS ISC) for SEO attacks, fraudulent donation sites, and malicious web content taking advantage of the global popularity of folks following the story on the Internet. How quickly did this physical event transcend to cyber space and what was its impact on the Internet? Zscaler is in a unique position to provide an answer based on customer usage of the cloud.

I pulled the numbers for unique URLs visited with the word ‘haiti’ in the URL string for January 11 PST and then for January 12 PST, and calculated the percentage increase in URLs visited and bandwidth used over these two 24 hour periods.

There was a 1578% increase in URLs visited with a corresponding 5407% increase in bandwidth usage for ‘haiti’ URLs. Where bandwidth includes the request and response bytes over the 24 hour period.

Here is a graph of the ‘haiti’ URLs visited for each hour (PST) during January 12, showing an explosion in Internet activity covering this event.

Malware attacks on Winter Solstice - Shortest day of the year 2009

Yesterday, December 21^st 2009 was the Winter Solstice, meaning that it was the shortest day of the year. Malware authors did not miss this opportunity to push their malicious binaries using SEO (search-engine optimization) attacks. My colleague already posted a blog on SEO attacks where he mentioned that an SEO attack takes the advantage of Google's PageRank Technology to push search results to the top. We found several phrases/names like “Winter Solstice 2009 celebration” or “Shortest day of the year 2009” used in the search query resulted in a page redirecting to malicious sites containing malware. Here is the screenshot of search result,

Looking at the screenshot, you will find that the 3^rd and 5^th search results are malicious. Attackers use SEO as users are more likely to click on links which show up as top results. Clicking on the 3^rd link uses redirection to direct victim to a malicious site hosting malware. Here is what a user will see,

Redirection could take the victim to a variety of sites, all of which are hosting fake security applications. The malicious sites are using fake images, popups or even showing videos to social engineer the victim into downloading a malicious executable once they click on the page. Here are some few sites used for downloading the malware:

“hxxp://ftorm.com/scn/579876515334ef7a1587…[truncated]”

“hxxp://shjow.com/scn/3fe14f17847082bd940b…[truncated]”

“hxxp://prizepcscan.com/?p=p52dcWpsal%2FCj…[truncated]”

“hxxp://newscanonline.info/downloads.php/?aff_id=384…[truncated]”

Here are screenshots of the malicious sites:

The above images are taken after clicking on the same search results multiple times, resulting in redirection to different attack sites and methods used for infection. Sometimes the victim will be presented with a video playing or popup images or messages urging the victim to install fake anti-virus software. The sites displaying videos will download a file named “Flash_Plugin_Setup1261476530.exe” to the system and other sites download “setup.exe” as a malicious file. Here are the virus total results for those files,

For “Flash_Plugin_Setup1261476530.exe”

http://www.virustotal.com/analisis/78f7246e0e6b9ae58bba1581727f2f598d330cfaf34c987f1bed665ee53429cb-1261476806

For “setup.exe”

http://www.virustotal.com/analisis/2f86f7bc9139dc4267ad1325c92f08557f5a359e6d74ccb6620248b99cf9a68e-1261476933

The “setup.exe” has very poor detection (4 out of 41). This is not the first time malware authors have used the latest hot news, celebrity’s names, holidays, popular event etc. They use such key phrases to push their malicious site to the top of the search results using SEO techniques. They continually change their malicious binaries in order to evade Anti-viruses from detection. The success of this approach is demonstrated in the above Virustotal results illustrating poor AV detection. Be sure to never download anything from redirected site promising free security software.

Be Safe,

Umesh

Beware of SEO attacks

On Sunday, Tom Stuker, a United Global Services member that flew about 700,000 miles this year, was interviewed on Fox News. Not long after that, the top Google search results for Tom Stuker were all poisoned to have links that take the victim to Fake AV malware downloads.

SEO (search-engine optimization) attacks, take advantage of Google's PageRank Technology to have their page result bubble to the top. Google's PageRank Technology is based on a web of trust, they rank pages that are linked to as being of higher importance and thus scored higher. However, using clever hypertext content for their page and an army of bots to spread links on forums, blogs, hacked websites, etc. hackers are able to grab the top spots for their search terms of choice.

Given the speed at which these search terms are poisoned, it is likely that the hackers may have bots monitoring popular media feeds for names / key-phrases that folks are likely to Google. This type of leveraging of the media as a decision-based feed for automation reminds me of the fictional book Daemon. Other members in the security industry have taken recent notice to these rapid SEO attacks as well: Brittany Murphy SEO and Beware of bad Google search results.

Following the redirects to get to the malware for one of the Tom Stuker examples seen yesterday:

hxxp://davtech.org/sqr.php?in=tom%20stuker
302s to: hxxp://hirm9k.xorg.pl?in.php?t=cc&d=20-12-2009_some2&h=davtech.org&p=http%3A%2F%www.google.com [snip...]
302s to: hxxp://newvirusscan.com/hitin.php?land=20&affid=92400
302s to: hxxp://newvirusscan.com/index.php?affid=92400

few js's load then the payload:
hxxp://newvirusscan.com/downloader.php?affid=92400
200 response: Content-Disposition: attachment; filename="install.exe"

Interesting stuff in the 200 OK response from the server:
Pragma: hack

Uploaded sample to VirusTotal (first one seen for this sample) - poor detection (13/41): http://www.virustotal.com/analisis/af58ed98fdc57ed25eb59d7e21b28f9f270bae6a5a8ca789f97876641567800f-1261348933

Going Green? The Cloud can help...

In light of the U.N. Climate Conference in Copenhagen, Denmark this week, and the agreement "to set a mitigation target to limit warming to no more than 2 degrees Celsius" I thought it would be fitting to do a quick post on the energy-saving benefits of cloud computing ... whether you are doing it to save the polar bears or to save some cash, these benefits should be recognized and considered by many organizations.

Do a Google search for cloud computing energy saving and you get about 195,000 results. This does not come as a surprise, because as one of the results states, cloud computing is "an inherently energy-efficient technology." No shock here: the amount of computing power that most organizations have is well beyond what is actually being used by their employees ... and as Moore's Law indicates, this computing power will double every two years. Many of the servers in your organization's server racks are not doing anything terribly complex: handling DNS lookups, processing email, filtering traffic, and storing data. Most organizations have a separate server for each function and may have redundant / fail-over servers as well.

This website calculates the electricity cost of running a desktop computer to be $405/year (330 Watt power supply and $0.14/kWh). A Dell PowerEdge 2970 has a 750 Watt power supply with an option for a redundant power supply for fail-over. Running this server has an electricity cost of $907/year per power supply. HowStuffWorks details how much electricity coal generates (roughly 2,460 kWh/ton). Running the example server with one power supply for a year uses 6,480 kWh, requiring 2.6 tons of coal.

Cloud computing companies often lease space in data-centers, which charge a premium for power, cooling, and rack-space (see Datacenter energy costs outpacing hardware prices). In order for companies that offer services in the cloud to remain competitive, they must be efficient with their computing power: consolidation, virtualization, efficient software, "smart" power management, etc. So adopting cloud computing is a good thing: it saves electricity/money/coal/pollution/polar bears/planet and funds the innovation of efficient computing.

1 Week 'til XMAS... Avoid Shopping Woes

Many folks are familiar with fake goods sites (e.g., replica watches and fake pharm / pill sites). These sites either peddle shoddy goods, or just flat out steal your payment credentials.

In case you needed to be reminded this holiday season, there are more than the obvious scam sites out there. Many show up in search engine results / advertisements and forum / e-mail advertisements (spam). On top of which, many have been in business for more than this holiday season.

Some examples,
hxxp://www.cheap-abercrombie.com/
hxxp://www.variantkicks.com/
hxxp://www.tiffanyoutlet.com/

You can see by visiting the sites, that their virtual store-fronts look legit:

The Name Records for each of these examples dates back to 2001, 2007, and 2008:

There are many more examples of these questionable virtual storefronts. However, I was able to find a single forum post spam advertising the above examples (which I why I selected these three):

This site states that cheap-abercrombie.com advertises that their merchandise is authentic, but customers are reporting the merchandise to be poorly made replicas with no option for return / refund.

This site states that variantkicks.com sells counterfeit shoes and charges $36 USD for returns.

The tiffanyoutlet.com site does not currently resolve an A record (but is also not showing that it is suspended by the Registrar). Google has a cached page of the site here, and Google results show that the site has been advertised via spam and is peddling fake jewelry.

Whether you are buying your sweetie a tennis bracelet, a sweater, or some new kicks this holiday season, buy from reputable stores, do your research, and if you have any doubt about the legitimacy of a store, err on the side of caution and shop elsewhere. Onguardonline.gov has more advice for online shopping here.