Hacked over Russian hackers?

OPINION

Are you upset that Russian hackers – possibly operating under the influence of, or even directed by, their government – got into the Democratic Party’s email system?

I’m not.

I’m upset that anyone was able to get into the system as easily as they did.

Any high interest operation such as a major election is going to attract the attention of hackers trying to break in for any of a multitude of reasons. Just as Willie Sutton is going to rob banks, political adversaries or those seeking financial gain will take any advantage they can against their opponents.

It is the responsibility of the people with valuable information to protect it themselves. Once an organization reaches a size, a level of notoriety or importance, or economic or political significance; they must take advantage of professional security experience. An individual who gets hacked may have some losses but won’t necessarily suffer serious economic or reputational disaster. A large business may be able to expend the resources to clean up after they’ve learned their lessons. But the entities in the middle, from a 10-person office to a national volunteer organization could be damaged beyond recovery.

What should a high profile organization like a political party do?

If I were consulting them, the first thing I’d do is sequester the devices and accounts from everyone with a recognizable name. Then I would issue them devices that are known free of any malware and without the most attacked apps. These would route all online activity through the office via VPN where it is protected from interception and filtered. Similarly, their email and messaging will go through a single system with advanced safeguards and appropriate passwords. Finally, social networking will all be posted by public relations personnel. Although there can be accounts in the principals’ names and they may submit posts; they will be vetted and edited, if necessary.

Finally, everyone will attend a class in protecting themselves against attacks from phishing to ransomware and all the online lures. This is because a slip of the finger by anyone from the top dog to the intern – and even the IT staff – can open the entire organization to an attack.

The internet will die tomorrow!

Panic!
The internet will die tomorrow! (Monday July 9, 2012)

Maybe. But not likely for you. For 0.02%(1) (that’s 1 in 5,000) users in the world. Only 27%(2) of the total are in the US and since the US has a high percentage of users; your chances are even lower.

What happened?

A few years ago some bad guys infected some users and changed their DNS settings. The DNS system tells your internet connections where to go when you type an address such as “google.com” in your browser. Rather than using the master DNS servers, an infected computer gets its directions from the bad guys’ servers. When you typed “google.com” (or any normal address), they would actually send you to Google. However, when Google sent your browser back to pick up an ad, they would insert the destination to their own ads so they made money.

Pretty soon the global police forces found the bad guys and took over their system. But they realized if they shut it down cold no one who was infected would get to Google when they typed “google.com.” So … our FBI has, for several years, paid a private company to run the bad guys’ servers and to serve up correct information.

Why will the internet die?

Now the FBI has stopped paying this bill and 250,000 computers won’t be able to find Google, or any other named domain, until they fix their settings.

Am I infected?

Probably not. See the first paragraph above.

A site that will give you a quick “yes” or “no” is at www.dns-ok.us, but with some caveats. The FBI also has a 6-page .pdf(3) explaining how to check your own DNS settings. It’s tedious, but detailed enough that anyone reading this can follow. It also points out that your computer can have an apparent safe setting while your router is infected.

References

(1) – Article on Time Techland.
The best non-tech explanation I saw.
http://techland.time.com/2012/07/06/dnschanger-no-the-internet-isnt-shutting-down-on-monday/

(2) – Infection count by country, as of 6/11/12

http://www.dcwg.org/top-dns-changer-infections-by-country/  
Spreadsheet of percent by country
http://bit.ly/PC3-DNSchanger

(3) – The FBI post
http://www.fbi.gov/news/stories/2011/november/malware_110911/DNS-changer-malware.pdf

 . This work by Bill Barnes is licensed under a Creative Commons BY-NC-SA 3.0 US License. Permissions beyond the scope of this license may be available at http://zaitech.com/satellite/contacts.htm.
(c) 2011 Bill Barnes - Disclaimer - Home Page - Blogs Home

Should I open this email?

Should I open this email?

A client asks:
I received an email from someone I don’t recognize. The email had an attachment (document) he wanted me to evaluate. Do I dare open the attachment?  Is there any way I can do so and guarantee it is not a virus? 

Basically, no. You can’t guarantee it’s benign.

In this sort of circumstance, either as sender or recipient, I try to validate the legitimacy of the contact. In the text of the email I identify myself and the attachment by filename and size. Sometimes I will make non-email contact to alert the recipient or verify the sender. Unless you or the data on your system are particularly high value, it’s unlikely a random attack would take the effort to pass these tests.

If you can’t make this “out of band” contact and still want to open the message or its attachment, there are some unilateral assessments you should make first. Start with the anti-spam / anti-phishing / anti-virus triggers you apply to every subject line, message, and attachment.
In the preview, before you open the email:
•    Are you expecting this?
•    Do the From and To addresses look reasonable. For example, do names look random or made up, are there multiple similar addressees at the same domain, or is your exact address missing from the list? If it makes reference to an account, especially a financial account, and is not directly and exclusively addressed to you; it’s probably a phishing attack.
•    Is the subject line meaningful and relevant?
•    If it refers to an “issue with your account;” does it identify the account or describe the problem?
•    Does the content apply to you? (Immediately trash a notice from BigBank if you don’t do business with them.)
•    Do the grammar, writing style, and content ring true to the request? If it comes from someone you know, do the style and content match what they usually send?
•    Are there excessive links and do they connect to what you expect? Hover your mouse over the link and look at the entire URL. Work back from the first “/” after “http://.” A link of “http://BigBank.com.BadGuys.ru/...” will actually take you to BadGuys’ site. While you’re looking at the links, pay attention to the top level domain (TLD). That is the letters left of the “/” until you hit a period – classically “.com” or “.org.” The “.ru” in the example above refers to Russia; along with China, a common starting point for malware. This is a minor indicator as bad guys can buy a .com and good things can come from unexpected countries such as bit.ly (a useful URL-shrinking service), where the “.ly” stands for Libya. (http://en.wikipedia.org/wiki/List_of_Internet_top-level_domains#Country_code_top-level_domains)
•    Are the attachment’s name and file type what they appear to be? It’s an old trick to name the attachment “CuteKitty.jpg” and then pad the name out with many spaces before giving the actual functional name of “…virus.exe” which falls off the edge of the page.
•    Is it delivered primarily as pictures? Your previewer should be set not to download pictures automatically, but only on your request. Downloading the pictures can deliver malware and return significant tracking information about you. If you can’t comprehend the gist of the message from the text it doesn’t deserve further analysis.
•    Look at the source of the message. In Microsoft Office (retail) Outlook, right-click on the message and choose View Source. This is very geeky and includes a lot of garbage; but, with experience, you may be able to spot something suspicious. Backtracking the internet headers is even more obscure, but can reveal that the sender is not who he appears to be.
•    Did it pass your up-to-date virus and spam checker? Antivirus programs often remove the malware attachments and deliver a message that contains very little text. There’s usually a good reason for it to be labeled spam.
•    Right-click the attachment and save it to a temporary folder on your computer or sacrificial thumb drive. Run an on-demand virus check on it.
•    Be sure all your viewing software is up-to-date. There is often a “check for updates” option under the Help or Tools menu or you can go to the publisher’s website. Especially visit adobe.com, java.com, and microsoft.com at least monthly to check for updates for Adobe Reader, Flash Player (hopefully, you’ve never installed Shockwave Player), Java, and Windows.
•    Open the attachment in less common programs. For example, use foxit (www.foxitsoftware.com) for .PDFs rather than Adobe Reader or send office documents to Google Documents (docs.google.com).
•    Open the attachment on a Linux or Apple computer as malware is often (but not necessarily) Windows-specific. You can get a CD to boot your PC directly into Linux. Everything runs in memory and when you reboot there’s no record (and hopefully, no residual evil) from what you just did.
•    If this were a legitimate email and you trashed it without opening would it really cause any problems?

Surf - and email - safe!

Read more:
An example of a "good" email from your bank. 


 . This work by Bill Barnes is licensed under a Creative Commons BY-NC-SA 3.0 US License. Permissions beyond the scope of this license may be available at http://zaitech.com/satellite/contacts.htm.
(c) 2011 Bill Barnes - Disclaimer - Home Page - Blogs Home

Malware scanner

Worms and trojans and viruses – Oh my! But beware the insidious rootkit, my child, because it is . If you get a rootkit, it burrows deep into your system and disappears. Only a program specially designed to look for it will find it.

Microsoft has recently introduced the Microsoft Standalone System Sweeper (MSSS) that will, among other things, find and kill those pesky rootkits. Get the program at http://windows.microsoft.com/en-US/windows/what-is-windows-defender-offline.

MSSS is used a little differently than other one-time scans you’re familiar with such as MalwareBytes. It creates it’s own bootable CD or USB drive and you run it outside of Windows. It does this so it can find rootkits which, by definition, are hidden when Windows is running. If you actually bought your antivirus program on CD, it probably can do this; except MSSS is a little different (at least since I last had an AV CD). It doesn’t offer, but requires, that you update your definitions before running a scan.

Go to the download page and choose whether you want 32-bit or 64-bit. This button runs a downloader that gives you the option to create a bootable CD, bootable USB thumb drive, or download an ISO (Fig. 1). I’ll tell you what to do with an ISO next month; but until then, save yourself a lot of trouble and choose one of the other options.

Fig. 1. The MSSS downloader menu (this image may have changed).

I decided to try MSSS out on my file server. When it runs a full scan – the default your first time – it alerts you the scan could take hours. Sure enough, after 4:52:42, it reported the number of “resources scanned” was 3,520,572!

Admittedly, my single C: drive runs about 350 GB (there’s a lot of client files I really should throw away). The program looked inside compressed files, naturally. It also looked inside downloaded .ISO CD images. To my surprise, it looked inside some Outlook .PST files to find a virus in the attachment of a piece of spam.


This work by Bill Barnes is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 United States License.
Permissions beyond the scope of this license may be available at http://zaitech.com/satellite/contacts.htm.

Book Review

Review - Zero Day

Sex. Murder. Corrupt, bumbling bureaucrats. The Russian Mafia. The fate of the Western world. Hunky nerds and beautiful geeks.

Zero Day by Mark Russinovich has them all. It also has worms and viruses and rootkits – but you don’t have to know any more about them than that if your computer has them, it’s going to be a pain. This book is a can’t-put-it-down thriller until you start thinking about it. Then it will give you nightmares.

Zero Day starts with a company that is having computer problems. They call in a specialist who discovers that their servers have been infected with a particularly pernicious piece of malware. While he’s trying to get the company back in business a call from a colleague at the Department of Homeland Security lets them realize they both are vexed by someone known as “Super Phreak.” Could this be the harbinger of cyberwar? And one with an auspicious starting date.

Mark Russinovich is a Microsoft Technical Fellow. That is a position for a person who is so accomplished that he has no assignment beyond thinking up new ideas. Computer professionals will recognize him as the creator of the Sysinternals utilities. With names like LDMDump and PsGetSid, these programs allow you to learn things about your computer that you didn’t know existed; including that you have an infection down where your antivirus can’t get it.

Here, in Russinovich’s first novel, he uses his knowledge of what is and what could be to weave a story of what we hope never happens. Without referencing any specific real-life situations (see “Stuxnet”[1]), this is a story one could imagine was pieced together from page 4 of the daily newspaper. An airliner has a rough ride over the Atlantic. A ship runs aground in Japan. A hospital has a medication mixup. A worker dies in an industrial accident. Are these unconnected stories? Only our heroes have the insight to know that they are linked by Super Phreak’s zero day rootkit (you only need to know that’s a computer nasty no one has ever seen before). Since a political appointee is too inept, corrupt, or both to sound the alarm; our heroes have to chase, against the clock, across two continents on their own to save the world.

The first edition I had was marred by some editing errors. (The first chapter opens “Saturday, August 11” and on the next page in bold it refers to “Friday, August 11.” [This was corrected in the online excerpt.] In a faux pas as bad as calling your spouse with your lover’s name; another place refers to the heroine with a villain’s name.)

That said, the story maintains its credulity: travel takes real time, coincidences are fortuitous but not magical, heroes are strong and clever but not supermen. Worst of all, the technology is very real and is installed in any business or is available to any teenage hacker anywhere in the world where the internet is available. The story implies a single set of malware could damage a multitude of systems which, in fact, would have to be programmed individually. However, any of the attacks mentioned could happen any time in the near future – or be happening now.

If you like international political thrillers or if you like technology; you’ll like Zero Day. A pair of PhDs become unexpected agents sufficiently focused on what needs to be done to brush off an assassin’s bullets and to convince an uninvolved Russian to assist them in the course of a taxi ride. Russinovich has set himself up to have created the next Jack Ryan. Let’s hope we can look forward to more cybercrises to befall us. [Zero Day the book has no familial or topical relation to the 2003 or 2007 movies with a similar title.]
------- 

REFERENCES:

The book's homepage
http://www.zerodaythebook.com/
Mark Russinovich
http://en.wikipedia.org/wiki/Mark_Russinovich
Stuxnet
http://www.nytimes.com/2011/01/16/world/middleeast/16stuxnet.html
http://en.wikipedia.org/wiki/Stuxnet
Thanks to my source: Steve Gibson
http://twitter.com/sggrc
http://www.grc.com/securitynow.htm
. This work by Bill Barnes is licensed under a Creative Commons BY-NC-SA 3.0 US License. Permissions beyond the scope of this license may be available at http://zaitech.com/satellite/contacts.htm.
(c) 2011 Bill Barnes - Disclaimer - Home Page - Blogs Home