Slashdot Mirror
Tools, Techniques, Procedures of the RSA Hackers Revealed
An anonymous reader writes "Details of the tools, techniques and procedures used by the hackers behind the RSA security breach have been revealed in a research paper (PDF) published by Australian IT security company Command Five. The paper also, for the first time, explains links between the RSA hack and other major targeted attacks. This paper is a vendor-neutral must-read for any network defenders concerned by the hype surrounding 'Advanced Persistent Threats.'"
I think everyone is afraid to click on that link.
It was most interesting to see one antivirus lab take months longer than another to detect one of these rootkits -- and that the rootkit may have been out there for months longer than that.
We might be past the useful span of antivirus software at this point. The attacker has always had the upper hand, being able to train malware against existing antivirus software.
One piece of advice in there was to limit internal networks to using internal DNS. But it's smarter to go one step further. By determining which sites employees should visit and distributing a hosts file to all internal computers, a company can avoid the myriad risks of operating a DNS server. Then any outgoing DNS traffic can be detected by a savvy internalnet admin at the firewall, and the offending computers cleaned.
E-mail attachments also continue to be a problem. The secret of the pros is to set up a script in your favorite language to detect e-mails with attachments, and move the attachments from the e-mail to the IT account. Then, once a trained professional examines each attachment, safe files can be copied into the folders of the relevant employees, and an e-mail sent to them to let them know they're in the clear.
While good computer safety is complex, much of it can be automated or outsourced. But thankfully not all of it, am I right guys?
The report details malware that connected to a particular control host, named alyac.org. The host was used in an attack on SK Communications. One particular piece of malware (the Murcy malware the paper describes) is indicated to have been used in the RSA attack.
The RSA connection is detailed in the paragraph of the report titled "Link To RSA Breach":
The majority of the known callback domains for Murcy malware were used in the March 2011 RSA breach. This suggests that the attackers responsible for the RSA breach also use the Murcy malware. Given that the malware is reportedly not in widespread use, the Chinese server communicating with ‘path.alyac.org’ may have been compromised by the same attackers responsible for the RSA breach
There's little else that's really information specifically about the RSA breach. Still a nice bit of information about malware, but it'd be nice if the summary mentioned SK Communications, since that's the paper's real focus.
You do not have a moral or legal right to do absolutely anything you want.
All internal systems should use the internal DNS server.
The firewalls should block any outgoing DNS queries from any systems (except the internal DNS servers).
The firewall logs should be checked each day for violations.
The internal DNS server logs should be checked each day for unusual activity.
Even if you cannot prevent your systems from being compromised you should be looking for the signs that they are compromised.
But what is a "Financial IP address" wrt the chart on page 12? Most of the other data is an ip or domain?
Domestic spying is now "Benign Information Gathering"
"the compromised computer communicating with âpath.alyac.orgâ(TM) is running Windows 2003 Server Web Edition, Service Pack 2 .. only computers running Windows XP were observed communicating with âpath.alyac.orgâ(TM)". Command and Control in the Fifth Domain, Feb 2012
AccountKiller
You can just copy and paste text from the blacked out areas if you want to see it.
IMHO the most important thing in the article is that the malware was digitally signed. This exposes the weakness in digital signatures. Not only for applications and modules(drivers) but UEFI and all of the other "secure boot" ideas.
Having to work for a living is the root of all evil.
>I for one support this statement. It must be checked by a Unionized member of the Cisco Guild. We will have job security forever.
If you were not a first-rate idiot, you would know that regular inspection of firewall logs is indeed a key requirement of any vigilant security strategy. It does not matter whether that firewall is from Cisco, Checkpoint, Linux iptables or any other of probably 100 major systems of that kind.
But you as a super-jerk will surely believe that installing a virus scanner is sufficient and that windows users can safely run as root. Your kind of idiots blend in excellently into large multinational corpos like Lockmart or RSA security. Those which are fscked on a regular basis by anon and the chinese.
If this was a real reveal, there'd be no blacked out information.
Twitter supports and protects racists - by smearing their critics with the "Hate Speech" label.
If you look at the whois record (http://whois.arin.net/rest/net/NET-75-100-117-112-1/pft), you'll see that it is indeed listed as owned by a financial institution -- at least, in theory. As they pointed out in the article, the attackers registered DNS names using look-alike credentials, so why not do the same with IP blocks? If you look closer at the above whois, you'll notice that ARIN has been unable to contact the Point of Contact who registered the IPs since 2 weeks after they were registered and the email address is not owned by said financial institution.
Thus, I would conclude that there is a high likelihood the IP registration was spoofed like they did with DNS entries.
Sig? No thanks, I don't smoke...
This is so bad it's almost funny.
IMHO the most important thing in the article is that the malware was digitally signed. This exposes the weakness in digital signatures. Not only for applications and modules(drivers) but UEFI and all of the other "secure boot" ideas.
I'd go a bit further in saying that it exposes the weakness ouf using digital signatures period in all applications of it - legal and otherwise.
Truth is like the sun. You can shut it out for a time, but it ain't goin' away. - Elvis Presley (source: imdb.com)