Week 05: System and User Enumeration

https://www.wired.com/insights/2014/01/ethical-hackers-alchemists-time-masters-binary-evolution/

Plenty of people envision hackers as evil people who intend to harm the innocent. Ethical Hackers are now kind of becoming the alchemists of the 21st century, they speak the language of code, the language that drives so much of our lives. Hackers speak many languages, but in principle what makes them alchemists —  is they all speak the mysterious language of code. The coders, the developers, the designers, the user experience experts are driving our world. Ethical hackers speak the language of code that is the lingo that essentially is binding us all into one universal binary language. There are many sponsored hackathons and hacker events as there is a growing appreciation of their skill and expertise. Hackers are becoming the new elite, the solvers of some of societies largest issues and are cutting apps that are fundamentally changing the way we evolve and live today.

One of the three major consumer credit reporting agencies was attacked by hackers who were able to access to more than 134 Million people sensitive information. According to the New York Times, this is the third cybersecurity attack since 2015 and and one of the largest risks to the personal sensitive information.

According to Pamela Dixon, the executive director of the World Privacy Forum which is a nonprofit research group, the chance of having your information leaked is about 50 percents if you have a credit report. That means the hackers were able to have the sensitive information of more that 65 million people who live in the US.

Hackers gained access to some files in the company’s system last May and were able to define some weak points in the website software according to the company’s consultants. So many unauthorized activities were found since then.

The following information were stolen such as names, birth days, addresses, and documents with personal information used in disputes for 182 thousand people.

https://www.nytimes.com/2017/09/07/business/equifax-cyberattack.html

http://www.reuters.com/article/us-usa-cyber-russia-hpe-specialreport/special-report-hp-enterprise-let-russia-scrutinize-cyberdefense-system-used-by-pentagon-idUSKCN1C716M?utm_source=twitter&utm_medium=Social

Russia have been given the source code to ArcSight, a cyberdefense system used by the Pentagon and US intelligence. Experts and former employees say the source code review is a huge security blunder:

“Six former U.S. intelligence officials, as well as former ArcSight employees and independent security experts, said the source code review could help Moscow discover weaknesses in the software, potentially helping attackers to blind the U.S. military to a cyber attack.

“It’s a huge security vulnerability,“ said Greg Martin, a former security architect for ArcSight. ”You are definitely giving inner access and potential exploits to an adversary.”

Arcsight, which has been around since 2000, is a big data analytics firm that was acquired by Hewlett Packard. The software scans activity from users, firewalls and other sources and then aggregates it and looks for suspicious activity – such as multiple failed login attempts.

The security firm that ran the code review state that they find vulnerabilities in 50% of US/International Software – and are required to report these to the government. The Russian government justifies this code review as a check on foreign software that may be compromised – by other States, malicious actors etc. That is a hard policy to argue against, however it raises the question as to whether US firms should be selling this software at all. I was told by another professor that cryptographic software is considered a weapon and as such subject to the same kinds of restrictions that selling ammunition or firearms would have. Shouldnt this apply more broadly to include cyber defense software?

Cyber security resarchers at CyberArk created an attack which they call Illusion Attack. In developing their own custom SMB server, they were able to trick Windows Defender into scanning a benign file and executing a malicious malware instead. The Illusion Attack begins with an attacker tricking the victim into executing an exploit that is hosted on the malicious SMB share. The attacker would serve different files into the Windows PE Loader and Windows Defender. Whenever Windows Defender would scan the file, it is given a benign file which would be read as clean, while the PE loader would load the malicious file.

Microsoft responded in saying that it isn’t believed to be a security issue, but may be a feature request in the future.

 

Article: https://threatpost.com/windows-defender-bypass-tricks-os-into-running-malicious-code/128179/

Even though this is a rather short article I thought it was kind of interesting. It talks about how the US used a DDoS attacks against North Korea from March to September against is counter intelligence agency. It focused on the teams that conducted North Korea’s hacking. Even though it did not totally stop them it flooded them with so much traffic it caused most of them not to be able to do their job which the US then used as a bargaining chip to talk North Korea into doing things that they may not have done. I think it is a good example of how cyber ware is becoming bigger and bigger and soon wars may be fought in the cyber realm and not as much with boots on the ground.

 

 

Source: https://www.engadget.com/2017/10/01/us-launched-dos-attack-against-north-korea-hackers/

https://www.technewsworld.com/story/84801.html

Interesting article where Apache strikes back against the Equifax breach being caused by a vulnerability in their framework.

They note no one at the @equifax domain has been in contact with them, insinuating they haven’t managed their environment, and that Equifax didn’t use database encryption.

The article also goes into a good explanation of a zero day vulnerability.

My In the News story this week came from the latest episode of Vice on HBO.  The episode discusses Russian Hacking, and also exposes how black-hat hackers attack targets.  It shows how two white-hat hackers were able to gather information on the host and make a purchase on her credit card.  Here is how they did it…

They new what hotel she was checking in at from her blog.  They waited in the lobby all day until she came into the hotel.  Once she entered the hotel lobby and checked in, they created a fake wifi hot-spot with a common hotel name, like “Hilton Hotel Wifi” using software on their laptop.  They waited a few minutes and… bingo!  Guest started to join their network.  The fake log-in page asked for their name, phone number, and room number.  This is the only information they needed.

After they got this simple information, they asked a female friend to call the hotel, claiming to be the host, and add them to the room.  The fake Female friend only authenticated with the name, phone number, and room number.

Once they two white-hat hackers were added to the room, they obtained a room key, with her credit card information.  They proceeded to use another software application to de-encypt the room key and get her credit card information.

With her credit card information, they purchased a gift from the gift shot for her.

This was all described in the show.

I was not able to find any new cyber attack article that was not already posted in the prior weeks and for this week. So I did not want to be repetitive and post the same thing again. However, I found this article that I thought students who are recently new to the cyber world or profession would find this article interesting. The article still has the focus on cyber attacks and discusses some of the top cyber security companies.

The cyber security market is on the rise and is expected to reach $187.77 billion in 2021. This is due to the increase in cyber attacks involving the internet and cloud computing. Now, there is high demand for cyber security solutions and products. Currently, North America is the world’s largest market for cyber security; however, emerging markets like in the Asia Pacific will have opportunities. There is a major need to protect confidential data for the government, military, financial institutions, hospitals and many other organizations. The cyber security market is divided into four areas: network security, cloud security, wireless security and others. As of now, network security is dominating the market.

http://markets.businessinsider.com/news/stocks/Recent-Cyber-Attacks-Drive-Growth-in-Cyber-Security-Markets-1002226467

 

Cloudflare’s CEO is quoted below.

“I woke up this morning in a bad mood and decided to kick them off the Internet,” he announced.

Though there’s nothing especially troubling about kicking professed white supremacists off the internet, this is going to open up Cloudflare up to a lot of, “But what about, that?” lawsuits.

https://thehackernews.com/2017/09/amazon-whole-foods.html

Amazon’s Whole Foods Market Suffers Credit Card Breach In Some Stores

This article talks about the following: Whole Foods Market was acquired by Amazon for 13.7 billion in late August, Whole Foods Market was become a victim of credit card security breach, hacker were able to gain unauthorized access to credit card information for its customers who made purchases at certain venues like taproom and full table series restaurant located within some stores, company has not disclosed details about the total number of stores that were targeted and total number of customers affected by the breach, company did mention that the hacker targeted their point of sale terminals in attempt to steal customer data including credit details, Whole Foods market has hired cybersecurity firm to help with the investigation of the credit card breach and contacted law enforcement authorities of this incident, finally Whole Foods Market is the latest victim of the high-profile cyber-attacks earlier this month Global Tax and Deloitte suffered a cyber-attack.

It will be interesting to see how things unfold in the future. It seems like there is a cyber-attack almost every day but we do not see much action from the government or big organization. Is there a way to minimize or fully eliminate the risk of data breach?