Downclimb

2017.02.05

Weekly infosec news summary for 2017.01.29 – 2017.02.05

Quotes

“Mimikatz: The AK47 of cyber. No matter the adversary (nation-state or e-crime), it is almost always present in intrusions on Windows targets” Dmitri Alperovitch

“If you are trying to improve security, and you do so by adding code instead of removing code, odds are that you are doing it wrong. […] I am (in)famous for my opposition to soft mitigations - many do not stop attackers, but add unnecessary (and risky) complexity. […] In short: If your mitigation doesn’t stop the bug dead (/GS in some cases) but merely shakes the table of the artist, it will be hard to convince me of the value of the mitigation.” halvarflake

Top stories

Insider threat recruitment

RedOwl and Intsights released a report titled Monetizing the Insider, wherein they describe recruitment efforts on forums to monetize insider access. This includes access to insider trading information, assistance with cashing out stolen credit cards at retailers, and help installing malware on bank computers. Combating these problems is difficult and can involve background checks on employees, monitoring of them (screen capture recording and video cameras), and processes that involve two people. You should also leverage strategies that mitigate other more general security issues, such as applying least privilege to all accounts, auditing and alerting on concerning actions, and segregation of duties, which can mitigate the effects of compromised accounts and other issues in addition to insider threats.

Delegated Recovery

Facebook, in collaboration with Github, posted Improving account security with delegated recovery and released a protocol spec for being able to use one service (Facebook) to recover an account on a different service (Github). Github has also posted how they are doing this (link). The concept is that “secret questions” and password recovery emails have various limitations and that if you lose your phone that is used for two-factor authentication, this can be further complicated. Access to the Facebook account doesn’t directly grant someone the ability to access your Github account, but instead Github can use this as a piece of the decision making process in granting access to someone trying to recover their account.

G Suite Enterprise

Google has announced their Enterprise edition of their email (reportedly $25/user/mo) as a new class beyond their Business class ($10/user/month). They moved some of their features (such as DLP functionality to monitor for credit cards in emails) up to their Enterprise class, but the most interesting feature is their addition of hosted S/MIME. With this, you are required to provide Google with your private S/MIME keys. This defeats one of the main reasons people use S/MIME which is for when you don’t want to have to completely trust your email provider. That said, S/MIME certificate management in most enterprises is usually not ideal, and this provides better encryption in communication and better validation of communications.

Email snooping due to transactional email services

There have been a number of bounties related to mail issues over the past year when using SendGrid, Mailgun, and likely others, that are allowing attackers to receive email destined for various companies that use those services. Examples:

Gitlab using Mailgun (link).
Slack using an unnamed service (an MX lookup shows they use Mailgun) (link).
Uber using SendGrid (link).
Facebook and Yelp using G Suite (link).
- Correction 2017.02.06: Originally this article stated they were using SendGrid, but it was pointed out by the author of that article, @Uranium238, that this was a G Suite issue.

The problem appears to be that these businesses are using these services to send emails, but don’t care about using them to receive responses. These email services then fail to perform any domain verification, allowing any user of the service to register other business’s domains to receive the email responses. This is very troubling that these email services are not taking any measures to avoid this. Even if fixed, be aware of the ability of these services to receive emails on your behalf which opens up concerns about attackers targeting them or social engineering them to redirect things like your password resets. See an example of this attack attempted against a company named ChunkHost that uses SendGrid here.

Similarly, there is a post on ‘Deep Thoughts’ on Subdomain Takeover Vulnerabilities that is a somewhat similar problem of shared hosting providers that don’t explicitly validate the subdomain claiming process. The author makes the claim of referring to “subdomain takeover as the new XSS”. He advises that you need to “maintain a list of all the web services you host with shared hosting providers” and “add/remove vendors from the list as services are created/transitioned/deprecated. When doing so, you must be very sure to rigorously manage the DNS entries that point to these services because a dangling DNS entry pointed as a service provider where you’re not claiming the domain is a recipe for getting tripped up on a subdomain takeover.”

Business

When the Market Can’t Deliver, Change the Market: Hudson Thrift at Uber discusses the decision making process in working with a start-up to deliver the solution they wanted as opposed to building it themselves (expensive) or buying it from the market (would only provide an 80% solution). We should expect to see these types of relationships happen more often.
Zimperium Announces Its Exploit Acquisition Program for N-Days: The mobile defense company has announced it will buy old exploits that no longer work due to being patched or are otherwise less valuable so that they can test their product. They’ll additionally hand over the exploits to the affected vendors. This is a great way to ensure the effectiveness of their solution and to test it with actual exploits and better spot trends and techniques, much like pwn2own competitions that allow the vendors to identify various tactics needed in exploit chains as opposed to simply vulnerabilities.

Tools

airbnb/streamalert: AirBnB’s StreamAlert was introduced at the Enigma conference and with the post StreamAlert: Real-time Data Analysis and Alerting. This is heavily integrated with Amazon AWS, making use of AWS Lambda to read AWS Kinesis Streams, and making use of Hashicorp’s Terraform. This allows for real-time alerting of events in a scalable way, as opposed to the way many alerting systems work by first ingesting the data into something like ElasticSearch and then periodically scanning the events for things to alert from.
Cloud Canary: Thinkst’s Canary deception product (not free) now runs on AWS.
Chrome on iOS: Google open-sourced Chrome for iOS.

Conference materials and publications

Haroon Meer #t2 keynote: The conference #t2 in Helsinki, Finland released their keynote from October.
ShmooCon videos: Conference in Washington, DC in mid-January.