ESET Threat Blog

Greetings, friends and fiends.

I've been uncharacteristically quiet for the past couple of weeks, due to the AMTSO workshop last week in Santa Clara. There was, as usual, some lively discussion: though no papers were approved at the meeting, some are close enough to finished to be voted on shortly. (See also the AMTSO blog for more updates, in particular on yesterday's AMTSO panel session.)

At the moment I'm at RSA, as Randy mentioned in a previous blog. I'm not working the ESET stand, but Randy and Jeff are around there much of the time, if you'd like to say hello, and if anyone wants to talk to me specifically, someone at the stand can put you in touch with me.

David Harley CISSP FBCS CITP
Director of Malware Intelligence

ESET Threatblog (TinyURL with preview enabled): http://preview.tinyurl.com/esetblog
ESET Threatblog notifications on Twitter:
http://twitter.com/esetresearch; http://twitter.com/ESETblog
ESET White Papers Page: http://www.eset.com/download/whitepapers.php

Securing Our eCity community initiative: http://www.securingourecity.org/

Also blogging at:
http://smallbluegreenblog.wordpress.com/
http://avien.net/blog
http://blogs.securiteam.com
http://blog.isc2.org/
http://macvirus.com/

Jeff Debrosse, ESET's Senior Director of Research, has published some further resources on his personal blog at http://jeffdebrosse.wordpress.com/2010/01/15/haiti-info-and-update/ (help resources and security resources). As he explains there, Jeff is personally and emotionally closer to this tragedy than most of us, and I hope that his family all turn up safe and sound.

I've also received pointers to one or two additional resources as comments to this blog and others. Unfortunately, I don't feel able to add any resource that doesn't come from a trusted source unless I'm able to verify it personally. I apologise if this means that I'm missing genuine, well-meant resources, but this is, after all, a security blog. E.M. Forster said (in Howards End)something like "the confidence trick is the work of man, but the want-of-confidence trick is the work of the devil": I may admire the moral principle behind that statement, but I feel I owe it to our readers to be reasonably sure that I'm not publishing resources that expose them to risk of fraud.

David Harley BA CISSP FBCS CITP
Director of Malware Intelligence

ESET Threatblog (TinyURL with preview enabled): http://preview.tinyurl.com/esetblog
ESET Threatblog notifications on Twitter: http://twitter.com/esetresearch (or @ESETblog)
ESET White Papers Page: http://www.eset.com/download/whitepapers.php

Securing Our eCity community initiative: http://www.securingourecity.org/

Also blogging at:
http://smallbluegreenblog.wordpress.com/
http://avien.net/blog
http://blogs.securiteam.com
http://blog.isc2.org/
http://macviruscom.wordpress.com/

 I notice that our own Jeff Debrosse, having joined the ranks of ESET presenters at Virus Bulletin conferences this year with our paper on "Behaviour Analysis for the Next Decade"  (http://www.eset.com/threat-center/blog/2009/12/02/malice-through-the-looking-glass-conference-paper), has also swelled the ranks of ESET contributors to the magazine this month, with an opinion piece on “Cybersecurity awareness for the next generation.”.

Nice one, JD.

I'd mention our umpteenth 59th VB100 award, too, but that would be immodest.

David Harley BA CISSP FBCS CITP
Director of Malware Intelligence

ESET Threatblog (TinyURL with preview enabled): http://preview.tinyurl.com/esetblog
ESET Threatblog notifications on Twitter: http://twitter.com/esetresearch (or @ESETblog)
ESET White Papers Page: http://www.eset.com/download/whitepapers.php

Securing Our eCity community initiative: http://www.securingourecity.org/

Also blogging at:
http://blog.isc2.org/
http://avien.net/blog
http://blogs.securiteam.com
http://dharley.wordpress.com/

Have you checked our white papers page at http://www.eset.com/download/whitepapers.php lately?

We've recently put up a paper by Jeff Debrosse and David Harley that was presented at the 19th Virus Bulletin Conference in Geneva in 2009, and called "Malice Through the Looking Glass: Behaviour Analysis for the Next Decade".  

The paper was first published in Virus Bulletin 2009 Conference Proceedings..

Copyright is held by Virus Bulletin Ltd, but is made available on our site for personal use free of charge, by permission of Virus Bulletin.

Here's the abstract:

Most VB attendees have a major interest in malicious code. Often they focus on the highly technical issues around the intricacies of malware technology and counter-technology, the
programmatic detail of attack and counter-attack. Sometimes they focus instead on the higher level application of defensive technology to corporate or infrastructural environments, even the entire Internet. More rarely, they look at the human side of malware management, mostly from the point of view of involving the potential victim (individual or organization under attack) in the defensive process (education and training, policy enforcement and so on).

However, malware is only part of a complex process of malicious exploitation. Behaviour analysis is a crucial topic in 21st century anti-malware, but rather than focusing purely on programmatic behaviour, should we not be looking at the psychosocial behaviours that underpin the exploitation mechanism? (By this we mean not only the behaviour of the criminal, but that of the victim.) This paper considers steps towards a holistic approach to behaviour analysis that would enable us to treat the disease rather than the symptom, drawing on both social and computer science.

David Harley BA CISSP FBCS CITP
Director of Malware Intelligence

Also blogging at:
http://blog.isc2.org/
http://avien.net/blog
http://blogs.securiteam.com
http://dharley.wordpress.com/

ESET Threatblog (TinyURL with preview enabled): http://preview.tinyurl.com/esetblog
ESET Threatblog notifications on Twitter: http://twitter.com/esetresearch
ESET White Papers Page: http://www.eset.com/download/whitepapers.php

Securing Our eCity community initiative: http://www.securingourecity.org/

I recently learned a new acronym: SODDI (Some Other Dude Did It). What this refers to is the defense that criminals routinely use (plausible deniability) – and even more so when it comes to illicit activities on the Internet.

On Sunday, November 8th 2009 the Associated Press published an article regarding an individual that was accused of possessing child pornography. After 11 months, and at a personal expense of $250,000, computer forensics proved that the computer had become infected with malware that was designed to download illegal content. Malicious software was the culprit at work behind the scenes.

This activity is a topic that had been discussed for quite a few years as a potential liability for any computer that has been infected. Software that is designed to conduct remote operations can surreptitiously download any kind of digital material to a person’s machine or establish connections (or probe/attack) any target. This would cause the owner of the infected computer to appear to have broken one, or more, of many laws including illegally accessing a network, theft of intellectual property (IP) and child pornography – to name a few. Basically, any action that an attacker or criminal can directly perform on the Internet, can also be duplicated and executed from a victim’s computer. The end result is truly horrific for the victims who have to defend themselves when the trail leads to them – and seemingly stops at their computers.

There are numerous examples of this occurring. For instance, substitute school teacher Julie Amero’s life was undeniably, and tragically, altered after the school computer she was using in a 7th grade classroom started displaying pornographic images to her students. After significant expense, loss of a teaching career and other losses she was finally convicted of a lesser charge (in 2008) and a reduced fine.

Cases like these are where several (of many) cybercrime issues converge:

• Laws: many legal systems still struggle to catch up with cybercrimes
• Plausible deniability: the challenge of proving that a person is the one that used their computer to commit an act (usually a criminal act)
• Attribution: lack of attribution across the Internet impairs the ability to accurately, and with a high degree of confidence, trace internet connections/packets back to their source(s)

When two or more of these elements are combined, the end result is typically a confusing, and potentially indefensible, gathering of forensic data that can both let a criminal “walk” or cause an innocent person to be charged, tried and sentenced.

In any war there is a term known as “collateral damage”. In the war against cybercriminals, the collateral damage is clear and unmistakable. As a society, when we  gain more overall forensic analysis experience and systems are capable of providing more accurate attributable information, we should see a diminishing number of cases of innocent victims and more/stiffer convictions for the bad guys.
   
Jeff Debrosse
Senior Research Director

"Now may I suggest some of the things we must do if we are to make the American dream a reality. First, I think all of us must develop a world perspective if we are to survive. The American dream will not become a reality devoid of the larger dream of brotherhood and peace and goodwill. The world in which we live is a world of geographical oneness…" - Dr. Martin Luther King, from a speech delivered at Lincoln University, Pennsylvania, June 6, 1961

If Dr. King had still been alive today to see the wonders of the global connectivity of the Internet, he would probably consider the quoted portion of his speech as a "statement before its time."

Today the current global Internet penetration rate stands at approximately 24%. With a global population of 6.7 billion, that equates to roughly 1.6 billion users on the Internet across the globe. At the current penetration rate, cybercrime has become pervasive, pandemic and increasingly connected with other parts of the criminal ecosystem. It ranges from the theft of an individual’s identity to the complete disruption of a country’s Internet connectivity due to a massive distributed attack against its networking and computing resources.

With the remaining 5 billion users to connect to the Internet, there are significant challenges – one of which is cybercrime (via its many methods). There are technological preventative measures that help mitigate cybercrime attacks, but technology alone is not the answer.

The next one billion users on the Internet will not come from developed countries, but rather mostly from developing countries. Awareness, even simple levels of awareness, of various types of risks and cybercrime attacks can yield positive results. This is primarily due to the fact that the weakest link in the “security chain” is, correctly, always quoted as being the end user. The additional one billion users on the Internet will be considered “fresh targets” by the cybercriminals.

The target of cybercrime centers on information – the data that is electronically stored for retrieval and subsequent use. For instance, even with varying levels of per-capita income, the amount of money that stands to be lost to a cybercrime called “phishing” (one of the most common online attacks where a person is socially engineered to provide personally identifiable information by someone posing to be a trusted source) has the potential to be quite significant due to the sheer number of users at risk (unaware).

A real-world example of the scope of the threat: cybercrimes, like phishing and data breaches, are a scalable threat to the United States. These threats are so severe they are detailed as national security threats in the 2009 Annual Threat Assessment Intelligence Briefing to the Senate Intelligence Committee. This representes the scope of one cybercrime problem in a single country, whose users have had several years of exposure to the Internet. New Internet users will face the same difficulties – but from cybercriminals that have had also years of experience and that have optimized their attack and evasion techniques. 

Infrastructure build-out, deployment and subsequent end-user connectivity should be coupled with effective cybersecurity awareness training – in addition to application usage training. It is the ignorance of on-line risks that poses the greatest threat to the new generation of global Internet citizens. Coordinated global efforts in effective awareness training will transform these new Internet citizens from potential victims to increasingly aware, and less vulnerable, people as a whole.

Jeff Debrosse
Senior Research Director

Securing Our eCity community initiative: http://www.securingourecity.org/

Virus Bulletin 2009 is now in full swing, though meetings and other issues have kept me from seeing as much as I’d like. Still, excellent opening and keynote speeches, and a very interesting talk on cyber-insurance from Pascal Lointier. (A bit of a first for me: though I’ve been attending VB most years since 1996 and have presented papers most years, I’ve never chaired a session before. It’s a lot less nerve-racking than presenting.)

Our own Juraj Malcho presented his paper on "Is there a lawyer in the lab?" on some legal issues that arise nowadays with certain kinds of malware. Though I’d already seen the paper, the presentation was still pretty riveting.

Jeff Debrosse presented our joint paper on "Malice through the looking glass": cunningly, I’d concentrated on the reserve paper that no-one has asked for yet, so I was able to enjoy his presentation and just popped onto the stage for the questions at the end, So my nerves have had a good old holiday so far. As long as no-one else drops out so I have to present after all…

Unfortunately I had to miss the vendor presentations, as I had to deal with some email issues that I’m still working on, but I’m sure Randy has done his usual excellent job on ESET’s vendor presentation.

Having a wonderful time

Wish you were here

David Harley BA CISSP FBCS CITP
Director of Malware Intelligence

ESET Threatblog (TinyURL with preview enabled): http://preview.tinyurl.com/esetblog
ESET Threatblog notifications on Twitter: http://twitter.com/esetresearch
ESET White Papers Page: http://www.eset.com/download/whitepapers.php

Securing Our eCity community initiative: http://www.securingourecity.org/

• Data Breaches continue to be a huge problem: Eight-five percent of organizations surveyed had had at least 1 data breach in the last 12 months, demonstrating that there is no let up in breaches as this is consistent with 84 percent sited [sic] in the 2008 report. Companies suffering more than 5 data breaches rose to 22 percent in 2009 up from 13 percent in 2008.
• More than 70% have fully executed or just launched data encryption strategy in their organization. Once again data encryption strategies are being implemented across a majority of the respondent participants. The majority of organizations, 78 percent, have some type of encryption strategy, up from 74 percent in 2008 and from 66 percent in 2007.
• Encryption of data on mobile data-bearing devices used by employees is very important or important. More than 59 percent of respondents say it is very important or important to encrypt employees’ mobile devices – a sign that organizations recognize that valuable data is more mobile than ever.
• On average a company will pay $202 per record compromised, and, in total an average of $6.6M should they experience a data breach.

• Domestic population (census.gov): 307M
• Personally-identifiable records involved in data breaches (privacy rights clearing house): 262.5M
• Domestic Internet penetration rate (internetworldstats.com): 74.4% (251M users)

Just last Saturday, June 6th; there was a new posting on the Full Disclosure mailing list from a source that calls themselves pwnmobile (at least that’s part of their email address). In the post, pwnmobile claims they have harvested information from T-Mobile USA’s servers. The data they claim to have acquired is:

• various databases
• confidential documents
• scripts
• applications

Interestingly enough, the poster of the message stated that they supposedly approached T-Mobile’s competitors, but there was no interest and now the data will be sold to the highest bidder. T-mobile USA, the subsidiary of Deutsche Telekom AG, is currently investigating this claim, and if found to be true, will contact their customers according to breach notification laws. T-Mobile USA’s 32.8 million contract customers make up 81% of their total customer base – you can also add to that the addition of 36,000 employees. If there truly was a breach of this magnitude, and based on the findings regarding the source of the breach, it could be costly for the carrier.

So far, the only evidence pwnmobile has shown as evidence of breaching T-Mobile USA’s systems are system logs that could have been copied by one or more employees or contractors working for the carrier. This would not indicate a data breach by any means and could simply be a ploy to “take the money and run.” 

The pwnmobile safe-mail email address is a good place to start in discovering the identity of the person or group that made the post. According to safe-mail, “We can access data and/or delete an account *only* according to the Terms and Conditions in the Agreement.” Those terms clearly state:

“You may use Safe-mail in ANY legal way for your personal, business or other needs.”

The terms also state:

“You may not use Safe-mail in a way that is threatening, harmful, or invasive of the rights of other; for spamming, chain letters, pyramid schemes, junk mail, unsolicited advertising or bulk e-mail; or otherwise in a way that is damaging, offensive, or that creates a nuisance. Disguising the origin of transmitted content is prohibited. You agree to abide by all laws and regulations applicable to this agreement and use of the e-mail system. This agreement is made under and shall be construed according to the laws of the State of Israel and Israel’s courts will have exclusive jurisdiction over any dispute related to the system or this agreement.”

With increased international collaboration regarding cybercrimes, regardless if they are committed across borders or within their own borders, the pressure is on for the criminals. The old adage, “You can run, but you can’t hide” is slowly, but surely, starting to make more headway. 

Jeff Debrosse
Research Director

Well, not so much about punishment, but I’m sitting in the lounge with Andrew Davies’s version of Dr. Zhivago in the background, so I’m in a Russian mood…

My colleague Jeff Debrosse, Director of Research in our San Diego office, drew my attention to the latest FBI challenge at http://www.fbi.gov/page2/dec08/code_122908.html. Like many people in this business, I’m fascinated by encryption and decryption, but I don’t have a particular talent for it, so I probably won’t attempt the challenge. I was interested enough to follow this link, though, which is a short primer on "Analysis of Criminal Codes and Ciphers" by Daniel Olson, a cryptanalyst forensic examiner with the bureau. As an introduction to some basic cryptographic techniques with some real-life (criminal) applications, it looks very readable. If you’re interested in something a bit more comprehensive but not particularly technical/mathematical, Simon Singh’s "The Code Book" is also very readable. Bruce Schneier has written a couple of books that are still practical rather than theoretical, if you fancy something with a bit more meat to it…

Speaking of Jeff Debrosse, he was recently featured on Fox 5 News, talking about cybercrime. We posted a link here. Nice one, Jeff. And since we’re blowing our own trumpets here, thank you Paul Lilly for a very positive review of ESET Smart Security in MaximumPC.

David Harley BA CISSP FBCS CITP
Director of Malware Intelligence