Using Geo IP Data to Tighten Rulesets

The ability to geo-block countries is a great way to limit malicious requests from entering your network or at the very least reduce the footprint of attack from the internet – it’s a great tool to keep in your security tool box. Take a look at my article for Algosec on using GeoIP data in your firewall to tighten rulesets and increase security. 

http://blog.algosec.com/2016/04/using-geo-ip-data-tighten-firewall-rulesets.html

TeslaCrypt Still on the Rise

We’ve seen the explosion of ransomware over the past year and it’s showing no signs of stopping anytime soon. Cyber extortionists are not only flocking to this method, they’re evolving it to fit their malicious needs. This is the reason we’ve seen multiple iterations of TeslaCrypt being produced, with each copy being independently developed by another group, to fit the needs of the particular developers or their clients.  You can find everything you need regarding TeslaCrypt in this well written blog post: http://soft2secure.com/knowledgebase/teslacrypt-3-0

With TeslaCrypt being used as a standard in many ways, it’s interesting to see how malicious developers have countered each version of TeslaCrypt to advance their malware with new “features”. These new features allow for the malware to: evade anti-virus, ransom files with better encryption, include additional file types, etc. As the opportunity exists for attackers to make money from this threat we’ll continue to see ransomware infect our networks. I personally don’t think this will be the end of their features and I’m concerned that we’ll start seeing other “data” or “access” ransomed in the near future.  Once the bad guys see a successful way to make money they evolve it, just like they do their tools, to fit their needs. We’re only seeing the tip of the iceberg with TeslaCrypt and other just like it. 

With this being said, the best way not to fall victim to this attack is backing up your files on a regular basis. If you have a recent backup of your data there’s no need to pay someone to get it back. Please, consider backing up your files. A service like SpiderOak is great for this type of “unmapped” backup, where new data is copied up to the cloud for backup right away. If you read the above article you’ll know that mapped drives are part of what TeslaCrypt and other ransomware variants crawl into right away. 

Ransomware is showing no signs of slowing, but if we back up our data, patch our systems and use some common sense with clicking links, we can limit it to an extent. As soon as it’s no longer viable for criminals to make money off this scheme, they’ll move on. It’s up to us to dissuade them.

Why Patching Will Never Get Old

I was asked to participate in Heimdal Security's "Round Up" of experts as to why "Software Patching is Key for Your Online Security". It's something overlooked by many as a first line of defense to protect systems from vulnerabilities.

You can read the responses from all contributors here: https://heimdalsecurity.com/blog/expert-roundup-software-patching/

WhatsApp Encrypts 1 Billion Users and Promptly Drops Mic

In attempts to find an analogy of the sheer amount of encrypted users using end-to-end encryption of phone, video, chat and images using WhatsApp, I came across this statistic:

To count to one thousand, counting one number every second continuously, it would take 17 minutes.  Counting to one million at the same rate, it would take 12 days (counting nonstop, day and night).  But counting to one billion would take 32 years! 

That's right, it would take 32 years to count the amount of users (today) that now have  end-to-end encryption using WhatsApp. That's freaking huge. 

I think we'll all remember the Apple vs FBI case as the spark that lite the fire, but in reality the work being done behind the scenes at WhatsApp took place long before the FBI bungled the San Bernardino iPhone. There has been a steady increase in encryption being pushed down to the consumer level, mainly due to privacy concerns with the mistrust of governments and organizations handling data, that has fueled this effort to become commonplace. 

What many will see is the FBI cracking one iPhone and WhatsApp turning on encryption two weeks later for 1 billion users. I don't think this was due to this case alone (the sheer design change would be massive), but needless to say, it didn't help. Once hearing this I can honestly say that I downloaded the app for the first time and will use it along side Whisper Systems, Signal App, for increased privacy and security. 

When thinking about the government requesting data from WhatsApp after encryption being enabled end-to-end, especially after they were starting to focus their attention on them previously, all I could think of was this GIF:

 

via GIPHY

How to Defend Your Network Against Ransomware

We've all seen the recent headlines of the sheer destruction that ransomware can bring upon your network, but we haven't seen many tips on defending against it. With many companies paying the ransom to criminals after being infected, it's only promoting them to use it more. If they weren't making money off this scheme they won't be using it, but unfortunately they are.

What I'd like to do with this article is spread some common sense in defending against ransomware and ways to assist with mitigating it once it's in your network. Here's the article I wrote for Tripwire explaining a few methods, since everything we do in security is based on layers, there's not a single defense that's going to stop ransomware by itself.

http://www.tripwire.com/state-of-security/incident-detection/creating-a-malwarerasomware-defendable-network/

Improve Forensic Visibility Within Your Network

Here's an article I wrote for RSA regarding how to improve forensic visibility within your network:

http://blogs.rsa.com/improving-forensic-visibility-throughout-a-complex-network/

Quick Primer on Ciphers, Protocols and Certificates

Transport Layer Security (TLS) and Secure Socket Layer (SSL) are cryptographic protocols meant to secure the communications from client to server over either internal or external networks. This is meant to ensure that the privacy and security of data being transferred over a network is secure from tampering or theft. We see these protocols used heavily in web browsers to connect to web servers offering the ability to perform transaction securely on their webpages.

The TLS protocol is the predecessor to the now aged SSL protocol and has variants that are widely used to encrypt and transfer secure data across the internet. The SSL protocol v3.0 is still used on certain systems, due to old hardware/operating systems, etc., but it’s been extensively disabled due to inherent security risks within the protocol. The newer TLS protocol has three versions, v1.0, v1.1 and v1.2 with versions 1.1 and 1.2 being deemed most secure. As of earlier this year the PCI council deemed that both SSL 3.0 and TLS 1.0 have been classified as insecure protocols and should be disabled on all services offering the ability to select this protocol. It’s not enough to have it dropped in priority, since it’s still possible that it could be chosen by older browsers, or by attackers using threats like BEAST/POODLE/DROWN that could attempt downgrade attacks to misuse the vulnerable SSL 2.0 & 3.0 protocol. At this point, the recommendation is to enable only TLS v1.1 and v1.2 due to security concerns with the lower versions.

After a network protocol is agreed upon by both client and server a cipher is determined next. This all happens with the negotiation between client and server and based off which network protocol will be in use will also assist with determining the cipher lists available for selection between client and server. Most of the secure ciphers that offer the best security are within TLS 1.1 and TLS 1.2 and in regards to TLS 1.2, it’s the only protocol that has the ability to run the secure GCM ciphers. These ciphers are more secure than their CBC predecessors. As with all things in encryption, the larger the key the better encryption, so looking at the ciphers this way helps too. These ciphers will be used going forward to encrypt data from client to server. 

Using these technologies with certificates allows for authentication of another party to validate that the server the client is attaching to is who they say they are. The certificate itself doesn’t have anything to do with the selection of the network protocol (SSL 3.0, or TLS 1.2, etc.), or the cipher suite that will be used afterwards. These are selected by the client and server, normally the client browser and the server’s operating system agreeing on how to secure the data in transit. When certificates are involved it’s verifying, normally via a third party certificate authority (like Verisign or GoDaddy) that the website you’re accessing is the actual server you’re intending on viewing. Certificates are used as a way of your browser trusting that you’re going to a legitimate website. The encryption happens based off the machine negotiation, not with the presence of a certificate. Data can still be sent securely, but you’re never sure from a client perspective if you’re sending data to the “real” server unless it’s been verified by a third party certificate. 

All these aspects, network protocols, ciphers and certificates, when used in tandem, give us the ability to have secure communications over the internet and protect the security and privacy of our data.