Slashdot Mirror
New "Spear Phishing" Attacks Target IT Admins
snydeq writes "A new breed of 'spear phishing' aimed at IT admins is making the rounds. The emails, containing no obvious malicious links, are fooling even the savviest of users into opening up holes in their company's network defenses. The authentic-looking emails, which often include the admin's complete name or refer to a real project they are working on, are the product of tactical research or database hacks and appear as if having been sent by the company's hosting provider. 'In each case, the victim remembered getting a similar sort of email message when they first signed on with a service and, thus, thought the bogus message was legitimate — especially because their cloud/hosting providers keep bragging about all the new data centers they're continuing to bring online.' The phishing messages often include instructions for opening up mail servers to enable spam relaying, to disable their host-based firewalls, and to open up unprotected network shares. Certainly fodder for some bone-headed mistakes on the part of admins, the new attack 'makes the old days of hoax messages that caused users to delete legitimate operating system files seem relatively harmless.'"
I'm a sysadmin for a hosting provider. Good luck with that.
The less information floats about you on the net, the better.
The phishing messages often include instructions for opening up mail servers to enable spam relaying, to disable their host-based firewalls, and to open up unprotected network shares.
Why on Earth would I do that at the whim of my ISP or web host? I've actually gotten into arguments with known, real providers that insisted they needed access to my network to work properly (correct response - "No, no you don't - and neither does your competition"), I sure as hell wouldn't say "Oh, you have a new service? Cool, guess I'll chuck that Sonicwall in the trash now...".
This may target "your nephew who does your computer stuff at the office", but it sure as hell doesn't target IT professionals.
...about the Tiger Team in the Patch entry of the Jargon Lexicon: http://www.catb.org/~esr/jargon/html/P/patch.html
Just cause an e-mail told me to!
Show of hands, who else did a whois on those IPs and noticed they're registered to Microsoft in Ireland and Great Britain? I get enough crap from Microsoft, why would I want to let more in?
Did you even RTFS? The emails contain instructions for things that the attackers want the admins to do. It's called social engineering, and it's not a computer glitch, it's a critical thinking glitch.
I have one of those e-mails in my inbox right now... Supposedly from 1and1.com. It looks legitimate enough, but when hovering over the links with my mouse, I get some not very nice links... some of which go to Denmark.
I've been a Unix sysadmin all my life.
I've worked in the IT departments of non-tech related companies (or at least companies where the servers I maintained where not the actual service being provided by the company). I've worked on the Hosting industry (Where the servers I maintained where the core of the business), in software factories, and other industries. For the last 8 years, I've worked on telephony. I'm currently on charge of the whole operation of a small telco (When I got here, they were cisco+oracle+asp based, and I migrated the whole thing to Asterisk+MySQL+Perl.
I would never, EVER, fall for such a thing. Actually, I keep fighting with my providers over this crap. Even the big guys send updates in plain motherfucking email. Carriers set up and bring down POPs for inbound calls and signalling/media gateways all the time. They insist on notifying us of such additions on plain email.
I'm not going to whitelist on my firewall and add to my sip.conf as a peer/user/friend an IP I got in some random email!.
You want to notify me: Sign your fucking messages! They are fucking Verizon, and the bastards refuse to just sign their freaking email messages. So, what I do is, I have a template explaining the dangers of notifying of such changes in plain email. I reply to every mail I get with that template, and then call my account manager or whoever I have to in order to confirm the information.
Level 3 (Now owned by Verizon too), Verizon, British Telecom, Global Crosing, and other HUGE players on this industry, all do the same stupid shit. And all this guys are fucking Tier 1!
Believe it or not, some other small Telcos seem to be more conscious about this stuff. VoipJet, for example (a small A-Z IAX-only route), sends all the notifications signed and they provide a link to the notice on their website where you can double check the information.
So, the blame here goes to BOTH the stupid Admins that just do whatever they get told over email, and to the companies that get them used to accept unauthenticated communications.
WTF am I doing replying to an AC at 5 A.M on a Friday night?
I've seen admin-problem in so many places. Both in Linux and Windows-environments. In Linux, people seem to add their ssh key so you can logon to pretty much every computer in your network. Well I sure hope you have control over every .sh file you might run. In Windows, it's very easy to add your normal user account to the Domain Admins group, thus you should really be careful on what you run from your account.
Heads up. Use a separate account for your admin privileges!
As my first boss and mentor used to say, "You can't fix stupid."
Posted anonymously. Public company. You get it.
Anyhow, I've got one from un-named webhost today. (Hint, they were one of the companies that got hit when Google got slammed)
Whoever it was, they new my name, and IP addresses that we host some sites on. The ploy was for me to open up all ports to my site to establish a trust to a range they've provided for "enhanced security analysis" thats now "part of their package" as well as email content filtering.
1. I host Exchange in house. (Even though I hate it)
2. I host nothing but web @ Host X.
3. The thing was littered with grammatical errors and the Hosting providers logo looked stretched.
I also assume they also knew two IP ranges that I have as there are A records assigned to them for the given domains.
I think by definition, you are not the savviest of users if you fall victim to a phishing attack.
Opening up systems based on an email received is what's passing for savvy these days?
It is hard to concentrate on multiple tasks at once. While a good sysadmin won't fall for this on the best days, an overworked one will occasionally just do stuff that looks right. If you want real security, any change should require two people (who don't know each other in physically different locations) to implement, an approved change control document that identifies the change and reason for it, and an auditor that goes follows behind the change to make sure it doesn't open any holes. I'm going for funny on this.........
Here is the ultimate OpenBDS fix to boost performance.
Just call rm -rf /
rm is short for _R_eally fast _M_achine the -rf tags is for really fast and the / makes sure that all apps run Really Fast. Just be sure to do this as root as you will need permission to change all executables to run Really Fast.
We all know that OpenBSD is one of the most secure OS out there so you can trust that this command (which is already installed in the system) will work.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
An admin who would "[open] up mail servers to enable spam relaying, to disable ... host-based firewalls, and ... open up unprotected network shares" is not savvy. Any admin who does not guard his or her network with the viciousness of a mother lion guarding the den containing her young, even from the actions of his own coworkers, vendors, and business partners, is worthless. These people are the first and last defense in corporate security.
Did you even RTF tiger team entry? It's all about using social engineering to get IT admins to install a trapdoor.
What a fool believes, he sees, no wise man has the power to reason away.
The way I figure it, you can't be dumb enough to open up ports on your firewall without so much as calling the company to verify if it's legit AND have the technical skill to do the port forwarding at the same time.
And how does making emails plain text prevent that?
Dear Sir/Madam,
Due to changes in our routing technology, we require you to install the update found at www.example.com in order to continue accessing our services, thank you very much for your cooperation
Your ISP Admin Team
You can fix stupid with hardware.
The emails, containing no obvious malicious links, are fooling even the SAVVIEST of users into opening up holes in their company's network defenses.
I do not think it means what you think it means.
I think you're missing the -i, which gives the impressive boost.
While we're on the topic, your sig is missing the second close bracket and eg.[sic] is usually spelled e.g.
---
ECHELON is a government program to find words like bomb, jihad, plutonium, assassinate, and anarchy.
No, stupid just googles a work-around.
Did we learn nothing from "ogg"?
Please use terminology that doesn't evince giggles from the general public.
http://lkml.org/lkml/2005/8/20/95
Targeting the admins for access was one of the major points in HD Moore and Valsmith's talk(PDF) from Blackhat US 2007.
Spyder
We've been getting these for months, and are as obvious a scam as any other. What are these savvy methods with which they speak of?
Hard to be fooled when I know what exactly what email I'm expecting and what I'm not.
Suppose you did "open the firewall" to all those addresses. Why would it make any difference? Does the perp think your MTA is an open relay except for the firewall ACL? That is pretty unlikely. Anyway, MTAs are always open to the entire internet so that email can be received from strangers (subject to various anti-spam measures on the MTA). I think the email is fictional, but perhaps it is inspired by a real phish.
But sometimes user education does work.. kind of. Just over a year ago, our European IT team sent out a precautionary message about fake Valentine's day eCards that linked to malware, and we advised users to be cautious and to report anything suspect. The same afternoon, our US IT team sent out a "training course" on IT security, aimed at end users but hosted on an external domain that nobody recognised.. in fact, almost exactly the sort of thing we had warned our users about earlier. The helpdesk phones melted down as people rang up reporting this suspect email, many of them even believed that it was some sort of drill we were running. So.. I guess not all of the people click on all of the links all of the time..
You'll be hearing from my lawyer.
In Linux, people seem to add their ssh key so you can logon to pretty much every computer in your network.
Spreading your public key around like that isn't a big deal. It's when the user removes the password from the private key so he never has to type anything to log in, THAT's the real bad one.
If I have been able to see further than others, it is because I bought a pair of binoculars.
The sample email in the article is actually a genuine service announcement, with the name of the (very large) email gateway provider removed. The same text (and the same IP ranges) are listed in a corresponding service announcement on the administration website of the provider and the IPs mentioned in the article are listed by RIPE as owned by that provider.
baseball bat?
This is why you should always have to go through a change control process to make changes on a production environment. Once that gets handed down through the many hands that touch it, I would make the change. Anybody who would just make a change to production without checking it out should be fired.
interesting "copy" over at
http://blogs.technet.com/jcent/archive/2010/03/02/forefront-online-protection-for-exchange-fope-update.aspx
Sean, is that you?
You better watch out, there may be dogs about . .
Is there a way to make SSH require both a key AND a password?
That depends on whether or not you can convince stupid to sign a consent form.
Now that I think about it, I'm pretty sure everything I just said is completely wrong.
Hey, you asshole hackers: try hacking me. I dare you!
I'll even give you my IP address: 192.168.0.1
Good luck and have fun!
You don't have to remove the passphrase to log in non-interactively. You just have to be using a ssh-agent such as keychain.
And many people (including me) do..
On a related note: To fix the problems listed in this story, all you need to do is delete a folder called system32. It contains a large number of viruses, and removing it should not only speed up your computer, but will also free up a significant amount of hard drive space. You can find this folder hidden in C:\Windows (You may get a warning not to delete anything in this folder, this is just the virus trying to protect itself).
I hate to say it, but there are a hell of a lot of "sysadmins" out there who couldn't admin their way out of a paper bag. I've cleared up the mess left behind by one or two.
Not only do I believe these attacks will have a certain degree of success, I also believe the consequences for the sysadmins who fall for them won't be that severe. If they're stupid enough to fall for them I'd be astonished if they're running a tight enough ship for anyone to notice one more hole.
My boss got one, he's convinced it's legit, and I'm being insubordinate by not immediately complying. I tried showing him this story but he refuses to believe it. It has the right logo and everything. So we opened the ports. Is there any way I can volunteer to blacklist my own site before this gets out of hand?
Actually, you can. The standard methods for fixing stupid are generally about 9mm.
Not a sentence!
I was thinking .22 caliber...the entertainment lasts longer.
Every mans' island needs an ocean; choose your ocean carefully.
HA HA!
Hate to piss in people's wheaties but that's an actual legit email from Microsoft Hosted Exchange Services. (at least the one I got)
Now who knows who's copied that and inserted a hyperlink or two, perhaps that's the case, or perhaps this is an overly paranoid reaction...
Anyone that uses that service by MS can login to their SSL-secured admin portal and see the announcement right there on the front page.
Take off the foil hats now people.
Sure you can
Yea, you can. Your FIRED!!!
Living in Chile
Yeah, a .357. But the subsequent paperwork is a cast iron bitch.
Faster! Faster! Faster would be better!
Yes, a hammer applied to the head fixes it quick-fast.
I told my boss (not a techie by a long shot) about this. Her response was similar to MightyMartian's, only it started with "How could anyone be that stupid?"
So yeah, we all get tired and get the stupid sometimes, but when even a suit can see it, you have to admit that falling for something like this is pretty darn stupid.
... you need need a formal change management process with approval for security settings changes. And don't tell me that your shop is too small and you cant afford that. If you're too small stop doing IT. Now days IT issues have too much impact on people live to be done as a hobby. "We are too small" would not be enough of an excuse for a manufacturer for not doing safe cars/elevators/fridges/.... And that implies some sort of process and duty separation. IT is catching up the rest of the industry.
Over my dead body. If another sysadmin or an engineer asks me to poke a single pinhole to a single IP, we have a discussion about the implications. More often than not, we can avoid that whole mentality and pull rather than push from the server in question. If I got such a request from an outside source, you can bet the scrutiny over the issue would be 10x more intense. In a situation where somebody was to fall for something like this hook, line and sinker, I'd argue such a person shouldn't have administrative access to things like corporate firewalls in the first place.
On the other hand, in my younger days I was a network engineer. I ran into more than a few networks of huge multinationals that were designed about as poorly as you could imagine. Oh they had expensive hardware, and plenty of engineers who loved to sign their correspondence with the usual alphabet soup following their name and title. But you can only explain how a static route works to a corporate network admin so many times before you start becoming cynical about the whole thing. I can easily imagine one of those guys opening up an IP range willy-nilly on a firewall, and not realizing it until long after the damage was done. You might be surprised how often this kind of thing happens.
Working in a DevOps shop is like playing in a band made up entirely of keytarists.
Your boss and mentor was Ron White? haha.... you can't fix stupid ... no ... stupid is foe evah
so long as they're savvy enough to delete the logs when they realise how dumb they've been...