1. In October 2005, the researchers crawled 20 million URLs.  Of that number, 19% contained executable programs.  5.5% of the executables and 4.4% of the domains contained piggy-backed spyware.  Piggy-backed spyware is code that is attached to a file a user downloads from a web site.
2. Although most of the spyware turned out to be adware, 14% of the spyware contained potentially malicious code.  This malware included trojans and dialers.
3. Sites specializing in pirated intellectual property have the highest percentage of drive-by attacks (malware downloaded without the user’s knowledge just by visiting the site).  Celebrity sites were a close second.
4. There was a 93% reduction in pages carrying drive-by attacks during the five months of the study.  But don’t uninstall your anti-spyware software yet.  The researchers concluded that there’s still enough malicious spyware to go around.

Author:  Tom Olzak

Sources:

A Crawler-based Study of Spyware on the Web, University of Washington

When I read this story, which was covered on almost every security web site, I was initially concerned.  Who wouldn’t be?  The BIOS is the most fundmental layer of functionality in any PC.  But the more I thought about it, the more I wondered about how much risk a BIOS rootkit actually presents to a business network.  After some research, I concluded that the risk is very low for businesses that take normal precautions.

In this article, we’ll look at rootkit technology, how engineers or programmers flash the BIOS, the typical safeguards protecting BIOS access, and what you can do to protect your business from BIOS rootkit issues.

Rootkits appeared about 10 years ago.  Their initial purpose was to provide “back doors” into applications and systems, bypassing the normal security safeguards.  Many rootkits were installed by developers who wanted quick access to system internals, especially if the standard access methods failed.  But the one defining characteristic of rootkits was stealth.  They were invisible to users, system administrators, and to most malware detection tools.

Over the years, rootkit development and use took two paths.  The first path led to ethical uses.  Again, providing back door system management functionality as well as the ability to collect information for forensic or administrative purposes.  The second path led to malicious activities designed to surreptitiously acquire information with criminal intent.  Today’s rootkits can perform many functions, including

1. keystroke logging
2. interception of system calls, resulting in system behavior modified to suit the needs of the rootkit owner
3. remote control of a system

Malicious rootkits are typically installed by exploiting a software vulnerability, either in the operating system or an application.  Although there was one well known successful application of rootkit technology to BIOS firmware in 1999 (CIH), rootkit infections of BIOS implementations have been largely ignored by the hacking community.  But with stronger system safeguards, attackers are looking for other avenues of entry into your computers.

So how can an attacker gain access to PC, server, and peripheral BIOS firmware? One way a to install a rootkit in BIOS firmware is through a user-initiated firmware upgrade.  Firmware upgrades are often necessary to correct problems with hardware operation or to add additional functionality.  In this scenario, the point of greatest vulnerability is retrieving the new firmware file.  It should be downloaded from the hardware vendor site or obtained from a reputable local hardware vendor.  This is the point at which it’s most probable that an infection will occur.  As with the CIH attack, the firmware may already contain a rootkit.  This is why it’s important to get it from a well-known and secure source.The other way infected firmware can be loaded into your hardware is through the actions of an attacker.  This normally requires physical access to the system to be compromised.  Why?  Because most hardware components are protected against changes to BIOS firmware with a jumper or a password.In the case of a jumper, the attacker would have to physically move the jumper to enable firmware flashing.  With most hardware, this requires not only physical access to the device, but also the opportunity for partial disassembly of the system in which the device is installed.  Standard physical controls should be sufficient to prevent this type of access.The effectiveness of firmware password safeguards depends on how you manage both administrative and physical processes.  If your engineers changed the password, the attacker may have to execute a series of steps to reset the BIOS security configuration to factory defaults.  This requires the same kind of access as that described for jumper manipulation.  However, once the factory defaults are restored, vendor passwords are easily obtained.  Again, standard physical access safeguards should be sufficient to prevent this type of access – especially if your engineers change the firmware password as part of all hardware installations.There are other ways to compromise the BIOS.  For example, overloading keyboard buffers is often one attack method that works on older systems.  And BIOS password cracking software exists and is available for download from the Internet.  But physical access is still necessary in many cases to enable firmware changes.  

Although firmware rootkit attacks should be considered when reviewing the effectiveness of your security program, I don’t believe you have to declare a state of emergency because of this week’s announcement.  A business that follows security best practices should be adequately protected from the kinds of access necessary to effect a firmware rootkit infection.  Probably the most important point to take away from reading this article is how critical it is for your engineers to be aware of the potential risks related to obtaining clean firmware.  Awareness is your first line of defense against BIOS rootkit attacks.

Author: Tom Olzak 

Resources:  RSS Feed for our Podcasts 

Sources:

Researchers: Rootkits headed for BIOS

The Basics of Rootkits: Leave no Trace

BIOS Flashing and Hotflashing

How to Bypass BIOS Passwords

According to Dunn, over 70 PCs were targeted on January 2, 2006 with messages intended to install keyloggers.  This was confirmed by MessageLabs Ltd – the government’s message filtering company.  Luckily, the messages were identified and stopped before they could reach their targets.  The most disturbing piece of information coming out of this incident is the source of the attack – Guangdong Province in China.

An isolated, one-time attack might be passed off as just another malicious individual flexing his muscles.  But this is at least the second incident in which Chinese attackers have targeted foreign governments.  

On November 1, 2004, attackers located in Guangdong Province launched an attack against the U.S. Army facility at Redstone Arsenal.  But this attack is thought to have been successful.  It is believed that U.S. military secrets, including aviation specifications and flight planning software, were stolen.  It is also believed that the intended recipient for this information was the Chinese government.  This successful breach of U.S. Government security is part of an on-going attempt by the Chinese to hack into government computers.  U.S. Officials have named the hackers Titan Rain.

So just how vulnerable is the U.S. infrastructure to cyber attacks by other nations or terrorist groups? 

1. During a 2004 FISMA required audit of security implemented by entities within the Federal government, seven departments failed to achieve a passing grade. Included in the list of failed departments was the Department of Homeland Security (DHS).
2. Congress and the Bush administration cut by 7% the 2005 DHS budget for cyber security programs.
3. In February 2005, The Presidential IT Advisory Committee (PITAC) completed a report entitled “Cyber Security: A Crisis of Prioritzation.”  The following findings and recommendations were presented to the Bush Administration:
1. Finding: ”The Federal R&D budget provides inadequate funding for fundamental research in civilian cyber security.”  Recommendation: The NSF, DHS, and DARPA budgets should be increased significantly.
2. Finding: “The Nation’s cyber security research community is too small to adequately support the cyber security research and education programs necessary to protect the United States.”  Recommendation: Double the size of the civilian cyber security fundamental research community by the end of the decade. 
3. Finding: “Current cyber security technology transfer efforts are not adequate to successfully transition Federal research investiments into civilian sector best practices and products.”  Recommendation: The relationship between the Federal government and the private sector must be strengthened.  Lines of communication and cooperation must be developed and maintained.
4. Finding: “The overall Federal cyber security R&D effort is currently unfocused and inefficient because of inadequate coordination and oversite.”  Recommendation: The Interagency Working Group on Critical Information Infrastructure Protection should become the focal point of R&D efforts, coordinating and priortizing all activities.
4. In December 2005, the members of the Cyber Security Alliance expressed to the Bush Administration its frustration with the lack of progress made in addressing online crime.  The Group - including organizations like Computer Associates, McAfee, Symantec, and RSA – believes that the lack of support and leadership shown by the Federal Goverment threatens the economy and national security.

We should not expect the Federal goverment to solve all our problems.  But we should expect leadership when national security and the overall public welfare are threatened.  Congress and the President must change their priorities when addressing cyber security within the context of overall defense and social spending.  If this does not happen, hackers will continue to outstrip our ability to protect our national infrastructure; terrorists and foreign governments will find us a soft target.

Author:  Tom Olzak 

Sources:

Security experts lift lid on Chinese hack attacks

Tech Group Blasts Federal Leadership on Cyber-Security

PITAC Report on Cyber Security, February 2005

As organizations shore up their Windows operating systems, non-Microsoft applications are becoming a more attractive target for hackers.  The SANS institute warns that the number of flaws in client-side applications continues to grow; this includes applications ostensibly intended to protect our end user devices and our networks.  This is providing easier access to sensitive information, which can result in HIPAA violations, identity theft, etc.  The bottom line?  Plan for a hacking, because it’s coming to a network near you.

But what is the best planning approach?  Some organizations plan for small events.  They base their planning decisions on the premise that the probability is quite low that a worst case scenario will become reality.  Other organizations plan for worst case scenarios, with the understanding that if their response team is trained in the worst that can happen, they can take care of lesser incidents.  I subscribe to the latter approach.

Incident response includes planning, team development, and testing.  If your team trains for small hacks, it may not be able to react to the big one when it occurs.  The proverbial handwriting is on the wall; the probability that your business will be the victim of a major compromise is growing every day.  Plan accordingly.

Author:  Tom Olzak 

Resources:

Anti-virus Software: The Next Big Worm Target? 

The Worst-Case Hack Scenario

NIST Guide to Malware Incident Prevention and Handling

According to an eWeek article by Ryan Naraine, a new batch of Trojans targeting Symbian OS based cell phones has been released into the wild (see link below).  Two of the three are spread by Bluetooth connections.  

As attacks against cell phones increase, anti-malware vendors are rushing to fill a growing demand for mobile device protection software.  But so far, the malware infecting cell phones might not be causing the level of financial impact that justifies the added expense.

Resources: 

eWeek Article – Triple Trojan Threat Calls on Symbian Cell Phones

Wireless Handheld Device Security 

New Trojan Horses Threaten Cell Phones