Threat Feed - June 28, 2016

Threat Feed

Phishing

The Executive Wire Scam

Phishing attacks have been with us for many the years. This sub-type of spam involves sending a mass of emails with a generic message that often seeks money. A more limited scope of attack that resurfaces from time to time is related to a phishing attack but is known as ‘Spear phishing’. Spear phishing works by emailing a select group of people with a message directed at them with a subject matter germane to the person. For instance, a person working in an accounting department would be targeted with a fake email that seems related to financing and they would feel compelled to read the email regarding finance.

The latest email scam involves the spear phishing attack with social engineering being added in for effect. With the amalgam currently in use, the attackers complete a reconnaissance of the business, acquiring the domain name, and select persons in the accounting and finance departments, using social engineering techniques to get the specific names of the staff members responsible for wiring and approving the wires. Much of the needed information can often be obtained by social engineers trolling social media sites where people thoughtlessly post their PII (Personal Identifiable Information.)

Armed with this knowledge, the attacker may send a directly worded email to the person responsible for wiring funds to a bank, generally located in Hong Kong or China, for an invoice or other logical use. The “CEO” may provide in the email that they are exceptionally busy and to ensure the wire is processed soon.

DDoS

            CCTV Breach

            The CCTV has become common in businesses, both retail and offices. These are also being seen more in consumer homes as the residents want to monitor the premises, inside and out, when they are not home. The attackers have found however a manner to attack these and use them for DDoS attacks. Recently this operation was analyzed as the attackers focused their efforts on a small jewelry shop. The jewelry shop website received, at the height of the attack, 50,000 HTTP requests/second, targeting the app layer (layer 7). This level of attack generally will cease any other traffic intended to the website, as the website for a small retail establishment is able to manage possibly a few hundred or thousand requests per second at the same time. All of this traffic was from CCTV devices. Due to the number of requests, there were a number of bot nets involved. This was possible as these pieces of hardware having poor security and a portion from various vendors having the same hard-coded root password.

Ransomware

Ransomware continues to be an issue. This year the medical industry has been a significant target. The latest example with this has been the hospital in Hollywood, who ended up paying the ransom for the key. There also have been police stations that have been the victim and paid for the key in order to gain access to their data. One of the latest high-visibility victims of this is the NASCAR team Circle Sport-Leavine Family Racing (CSLFR). Days before the team was planning on taking a car out for testing, the computer, which happened to have mission critical information on it, began to act strangely. There were random files present and other odd items. The crew chief clicked on a file, and the next time he attempted to access another file, every file was encrypted. The critical files held years of data. The crew ended up paying $500 in bitcoins to have the key to decrypt the files. Although this was stressful, it reminds us that files from unknown sources should not just be clicked on. 

New Threat Feed & Big Data/Data Analytics Newsletters

Good morning. Beginning next week, there will be a weekly information security threat feed available. This will summarize the news that is focussed on information security and the threats we face daily. If you would like to be placed on the email distribution, please provide your email.

In addition there will be also be provided articles on big data and business analytics.

Rest assured your email address will not be shared, sold, or otherwise distributed. Your email address will only be used to email the daily summaries.

Thank you.

Ransomware-So Alive

Ransomware continues to be an issue in the info sec environment for many fields. Ransomware has been rampant with the medical field and increasing in usage with other industries. The incidents have increased 17.7% form April 2015 to March 2016. From their viewpoint, all it takes is a user to click on the wrong link and the attackers would be able to apply their malware.

A ransomware malware infection has proven to be very problematic for the affected client. Once infected, the client has two primary options. These would be to pay or not to pay the ransom. In a recent study, 84% of businesses would not pay the ransomware. The issue initially was the infected clients were concerned that if the business were to pay, they may not actually receive the decryption key and/or the ransomware may leave other items to achieve access later, that may not be readily noted by the client. The businesses here have tended to have made routinely back-ups. Other simply have decided not to pay.

As the attackers have operationalized ransomware as part of their business, it has been shown to be very profitable for them. This issue will only continue and increase in usage in the environment. This issue can be mitigated to lower and mitigate the risk for this attack.

Remember, hope is not a strategy.

Dude, where’s my car? Vehicle hacking trends & analysis; #14

Defenses

                As the vehicle advanced in its application of technology, it has become more connected. This has increased the attack points and vulnerabilities. The market has produced a vast number of persons interested in looking for these to report. Although these continue to be found, there are a number of defenses that may be put into place to in the least provide layers of security.

The vehicle manufacturer has the opportunity to implement a secure communication channel intra- and inter-vehicle.  This includes using TLS 1.2 and SAML 2.0 and other cryptographic protocols. This should not be avoided for the convenience of management or the engineers. This may be an issue especially later when additional functionality would be added as technology and its application abilities are enhanced. It is much better to be late with a project than allow the next generation to address this.

The vehicle is in effect a computer on wheels. As with any system there are a number of ports that are not used and available. The ports that are not used should be closed. These may not be a point of attack at the present time, however with later functionality there may be problems. The engineering team cannot guaranty the functionality in the future. As has been noted, new attacks are regularly exploited. New attack points are found regularly with both old and new equipment and systems.

Nearly all consumer and commercial systems have AV and at least one firewall. The vehicle functionally is no different. The vehicles should have some form of this defense in depth in place. Although these tools are not perfect, this is better than nothing being in place. A bit of system protection is better than nothing. Along this same thought, the vehicles should have embedded some form of IDS/IPS.

The threats and vulnerabilities for the vehicles are not unknown until the issue becomes too significant to patch quickly. These are regularly published in various social media outlets. The info sec groups should learn from this in comparison to ignoring these, as being from an unknowing lay person. The threat feed should be gathering information from other threat feeds, blogs, vendor updates, twitter accounts, and other sources. These may provide updates in general or to specific vehicles. Also if an attack works on a certain vehicle, it may be viable on others.

In short, the vehicle cyber security is an issue that can be mitigated to a reasonable level. There is no panacea that will bring the risk to 0%, but to a very manageable level. This will take a paradigm shift however from the present mode of hurrying to get a project done merely to move to the next. The security team must not allow info sec to be treated as some function to be bolted on at the last milestone of a project.  The planning needs to be more long-term versus short-term. Without these being in place, there will continue to be a massive expense and embarrassment to the manufacturer.

Dude, where’s my car? Vehicle hacking trends & analysis; #13

Real World Attack-Tesla

                This issue arose after the attackers reviewed the architecture for two years. Due to the labor and equipment intensity, this was not an easy hack (Heisler, 2015). With the physical nature of the attack, this would be applicable only in limited circumstances.

                This is a physical attack on the vehicle. The attackers presented this at DefCON 2015 (Pagliery, 2015). The attack is basic enough. The attacker has to have a location not proximate to others. The attack surface was behind the dash of the vehicle. The attacker had to plug their laptop into a port behind the driver’s side dash. While the dash has been removed, revealing the port, the attacker could plant a Trojan. As an additional point of interest, the infotainment system was using as out of date browser (Zetter, 2015).

                When successful, the attacker is able to shut down the vehicle and force it to stop (Ward, 2015; Masunaga, 2015). They were able to open the doors, make the display present faulty information, or pop the trunk (Pagliery, 2015). On a positive note, Tesla quickly reacted and patched the issue. These were effectuated with an OTA patch (Hall, 2015; Heisler, 2015).

References

Hall, G. (2015, August 7). Tesla issues software patch to guard against vehicle hack. Retrieved from http://www.bizjournals.com/sanjose/news/2015/08/07/tesla-issues-software-patch-to-guard-against.html

Heisler, Y. (2015, August 14). Want to hack a car? Don’t try hacking a tesla. Retrieved from http://bgr.com/2015/08/14/tesla-hacking-model-s/   

Masunaga, S. (2015, August 6). Researchers hack a telsa model s, bring car to stop. Retrieved from http://www.latimes.com/business/la-fi-hy-telsa-hack-20150806-story.html

Pagliery, J. (2015, August 6). Tesla fixes bug after hackers hijack model s. Retrieved from http://money.cnn.com/2015/08/06/technology/tesla-hack/index.html  

Ward, M. (2015, August 6). Warning after security experts hack tesla car. Retrieved from http://www.bbc.com/news/technology-33802344

Zetter, K. (2015, August 6). Researchers hacked a model S, but tesla’s already released a patch. Retrieved from http://www.wired.com/2015/08/researchers-hacked-model-s-teslas-already/

Dude, where’s my car? Vehicle hacking trends & analysis; #12

Real World Attack-Nissan Electrical Vehicle (Leaf)

                A relatively newer technology gaining a much greater acceptance and implementation has been the electric vehicle. Recently the attacker’s focus has been on the Nissan Leaf. The attack on this model was relatively easily accomplished through the web browser (Ashford, 2016; Walford, 2016). The attacker only needed the VIN to access the system (Ashford, 2016). Anyone could get this data by looking in the window or by manipulating the VIN algorithm, namely the last four digits (Ashford, 2016; Zorz, 2016). With this vulnerability being accessed from any IP, the car can be hacked from across the planet (Abel, 2016; Torchinsky, 2016).

                The attack was announced previously in Canada and only discussed in online forums (Ashford, 2016). Nissan was contacted regarding the vulnerability but did not correct this in a timely manner. Finally this was reported widely and Nissan removed the app (Lacey, 2016) and thus removed the vulnerability.

                Although this was a legitimate attack, this was between two parties that knew each other. The target was a Nissan Leaf located in the UK owned by a friend while the attacker was in Australia (Abel, 2016; Torchinksy, 2016, Walford, 2016b). As the API was insecure and allowed anyone to log in (Mearian, 2016), the effort was nominal (Abel, 2016; Walford, 2016). This insecure API was with the Nissan Connect EV application fka CarWings (Mearian, 2016; Cluley, 2016; Weise, 2016; Hammerschmidt, 2016). This API was used to remotely control the vehicle’s function (Mearian, 2016) including the heating and air conditioning systems (Ashford, 2016) and could be used to drain the battery’s energy (Abel, 2016; Torchinsky, 2016). This could also control the vehicle and modify the historical driving data (Mearian, 2016). With this attack, only the functions interacting with the mobile phone app were affected.

                This predominantly may be described as a generic attack as this could be used against other platforms (Aron, 2016). This attack shows technology is moving forward too quickly. The marketing and consumer needs are trumping the security. The regard for security and safety appears to be lacking (Ashford, 2016). In this instance the API was engineered intentionally without security (Abel, 2016). There was no authentication and attacker only needed the VIN (Zorz, 2016; Cluley, 2016; Torchinsky, 2016; Hammerschmidt, 2016). At best security was an afterthought (Kieler, 2016; Weise, 2016).

References

Abel, R. (2016, April 4). ‘Father of car hacking’ awarded for researched. Retrieved from http://www.scmagazineuk.com/father-of-car-hacking-awarded-for-research/article/487247/  

Aron, A.J. (2016, February 26). Security researcher found a loophole in nissan’s app for leaf electric car. Retrieved from http://www.biztekmojo.com/002121/security-researcher-found-loophole-nissans-app-leaf-electric-car

Ashford, W. (2016, February 25). Nissan breaks basic security rules with leaf electric car app. Retrieved from http://www.computerweekly.com/news/4500274612/Nissan-breaks-basic-security-rules-with-leaf-electric-car-app  

Cluley, G. (2016, February 24). Lousy Nissan leaf security leaves cars open to online exploitation. Retrieved from https://www.grahamcluley.com/2016/02/lousy-nissan-leaf-security-leaves-cars-open-online-exploitation/  

Hammerschmidt, C. (2016, February 26). Security expert discloses security flaw in nissan vehicles. Retrieved from http://www.eetimes.com/document.asp?doc_id=1325091 

Kieler, A. (2016, February 25). Nissan disables electric car app over security flaw that allows other users to control vehicle temps. Retrieved from http://consumerist.com/2016/02/25/nissan-disables-electric-car-app-over-security-flaw-that-allows-other-users-to-control-vehicle-temps/  

Lacey, S. (2016, February 29). Security flaws made Nissan leaf owners vulnerable to a hack. Retrieved from http://www.greentechmedia.com/articles/read/security-flaws-made-nissan-leaf-owners-vulnerable-to-a-hack

Mearian, L. (2016, March 23). Should you worry that your car will be hacked? Retrieved from http://www.computerworld.com/article/3047193/security/should-you-be-worried-your-car-will-be-hacked.html   

Walford, L. (2016, February 24). Nissan leaf connected car features hacked on web-climate, seats, battery & trip logs. Retrieved from http://www.autoconnectedcar.com/2016/02/nissan-leaf-connected-car-features-hacked-on-web-climate-seats-battery-trip-logs/  

Walford, L. (2016b, February 24). Leaf carwings Nissan connect EV remote control app grounded. Retrieved from http://www.autoconnectedcar.com/2016/02/leaf-carwings-nissan-connect-ev-remote-controls-app-grounded/

Torchinsky, J. (2016, February). How the Nissan leaf can be hacked via web browser from anywhere in the world. Retrieved from http://jalopnik.com/how-the-nissan-leaf-can-be-hacked-via-web-browser-from-1761044716  

Weise, E. (2016, February 25). Nissan leaf app deactivated because it’s hackable. Retrieved from http://usatoday.com/story/tech/news/2016/02/24/nissan-disables-app-hacked-electric-leaf-smart-phone-troy-hunt/80882756  

Zorz, Z. (2016, February 25). Insecure APIs allow anyone to mess with Nissan leaf electric car. Retrieved from https://www.helpnetsecurity.com/2016/02/25/insecure-apis-allow-anyone-to-mess-with-nissan-leaf-electric-car/

Dude, where’s my car? Vehicle hacking trends & analysis; #11

Real World Attack-General Motors Corvette Brakes

                There are not specific models or manufacturers that are immune from vulnerabilities or attack. The attackers look solely for vulnerabilities regardless of the target. There is not a strata in the automobile industry that is perfectly designed or manufactured. This is the case with General Motors. There consistently have been issues with one piece of equipment when attacked to the vehicle– the dongle. These two factors were applied with an attack from 2015 on the GM Corvette and its brake system.

                The GM brake system was attacked via a dongle manufactured by Mobile Devices plugged into the OBD-II port (Young, 2015; Foster, Prudhomme, Koscher, & Savage, 2015; Zorz, 2015; Goodwin, 2015; Amir, 2015). This was the Metromile dongle (Mathews, 2015; Schupak, 2015). The dongle is commonly used by insurance agencies and fleets (Snyder, 2015) for tracking and reporting purposes.

                In this attack, the deviant only needed to know or acquire the IP address and phone number attached to the vehicle (Kovacs, 2015). Gathering this information is not difficult or labor intensive. With this in hand, the attackers then sent an SMS message to the dongle. This is connected to the CAN bus, which controls the vehicle’s components used to drive the vehicle and other functions.  This attack was directed explicitly to a 2013 Corvette (Young, 2015; O’Keefe, 2015). In exploring this attack vector, the attackers at first targeted the windshield wipers and brakes. Once this vector was known to be a viable avenue, other attempts would be made. The additional targets were the door locks, steering, and transmission.

                Once connected to the OBD-II port, the attack was completed without authentication (Kovacs, 2015). This in itself is a significant security issue in the architecture. This was later patched (Young, 2015) and the vulnerability mitigated.

References

Amir, W. (2015, August 12). Researchers show how to hack a corvette with a text message. Retrieved from https://www.hackread.com/hack-corvette-with-text-message/

Foster, I., Prudhomme, A., Koscher, K., & Savage, S. (2015, August 10-11). Fast and vulnerable: A story of telematics failures. WOOT, 2015. Retrieved from http://www.autosec.org

Goodwin, A. (2015, August 11). Researchers hack a corvette’s brakes via insurance black box. Retrieved from http://www.cnet.com/roadshow/news/resarchers-hack-a-corvettes-brakes-via-insurance-black-box/#!   

Kovacs, E. (2015, August 12). Researchers hack car via insurance dongle. Retrieved from http://www.securityweek.com/researchers-hack-car-insurance-dongle

Mathews, L. (2015, August 11). Corvette hijacked by hacking its insurance dongle. Retrieved from http://www.geek.com/news/researchers-hijack-a-corvette-by-hacking-its-insurance-dongle-1630857/  

O’Keefe, S. (2015, August 12). Researchers wirelessly hack a corvette’s brakes using an insurance dongle. Retrieved from http://www.itsecurityguru.org/2015/08/12/researchers-wirelessly-hack-a-corvettes-brakes-using-an-insurance-dongle/

Schupak, A. (2015, August 12). Hackers hijack a corvette via text message. Retrieved from http://www.cbsnews.com/news/hackers-hijack-corvette-via-text-message/  

Snyder, B. (2015, August 12). Corvette hack is one more reason to be wary of connected cars. Retrieved from http://www.cio.com/article/2969358/consumer-electronics/corvette-hack-is-one-more-reason-to-be-wary-of-connected-cars.html

Young, A. (2015, July 28). Car hacking: Security experts caution automakers on greater need for cybersecurity and anti-hacking measures. Retrieved from http://www.ibtimes.com/car-hacking-security-experts-caution-autmakers-greater-need-cybersecurity-anti-2026472 

Young, R. (2015, August 11). Hackers cut a corvette’s brakes via a common car gadget. Retrieved from http://www.wired.com/2015/08/hackers-cut-corvettes-brakes-via-common-car-gadget/

Zorz, Z. (2015, August 12). Researcher’s hack corvette via SMS to plugged-in tracking dongle. Retrieved from https://www.helpnetsecurity.com/2015/08/12/researchers-hack-corvette-via-SMS-to-plugged-in-tracking-dongle/