InfoSec Daily Podcast Episode 350 [ 46:14 | 21.19 MB ] Play Now | Play in Popup | Download (285)

Stories

Source: http://www.irongeek.com/i.php?page=security/mutillidae-deliberately-vulnerable-php-owasp-top-10

Mutillidae: A Deliberately Vulnerable Set Of PHP Scripts That Implement The OWASP Top 10.  Version 2.0 beta has just been released.

http://www.irongeek.com/downloads/mutillidae2.0.1beta.zip

Source:  http://blogs.computerworlduk.com/jericho-forum/2011/03/after-the-breach—how-secure-is-rsas-securid/

Source:  http://www.computerworlduk.com/news/security/3265825/rsa-warns-securid-customers-about-hack/

Source:  http://www.csoonline.com/article/678070/rsa-breach-puts-apt-back-in-the-spotlight

Source:  http://news.cnet.com/8301-27080_3-20044775-245.html

Source:  http://news.cnet.com/8301-27080_3-20044455-245.html

Source:  http://www.readwriteweb.com/enterprise/2011/03/rsa-breach-an-attack-that-used.php

Source:  http://www.net-security.org/secworld.php?id=10765

I was asked by Kevin, a guy that used to work with me a long time ago to comment on the whole RSA breach.  To be honest, we talked about it last Friday so I was a little reluctant at first, that was until yesterday.  Reactions to the RSA breach have been as varied as the security community itself.  They've ranged from the "it's not a big deal" to "OMG!".  We wanted to take a few moments and discuss the breach, what we know about it, what it means and what does (wait for it) APT really mean to us.  

So what do we know?  Well, on March 17th RSA, the security division of EMC, suffered a breach and data loss following an "extremely sophisticated cyber attack."  Their investigation revealed that the information extracted from the company systems was related to its SecurID two-factor authentication products. 

What does it mean?  RSA SecurID is a hardware token that are identical internally except for the unique printed serial number on the outside of each one.  Each token is initialized with a secret ‘seed’ value, and a cryptographically protected copy of that seed value is sent to the token purchaser to install into their authentication server.  The algorithm, which is based on AES, uses that seed value combined with the internal clock to generate the numbers displayed.  Normally customers buy a large batch of tokens at one time, and receive a file containing that batch of seed values. 

If RSA's attackers were somehow able to obtain the seed records then things are much worse then it would seem at first blush.  Again, the reason is because these seed records are used to generate the unique, one-time passwords that SecureID generates every 30 seconds or so in order to authenticate the user.  If the attackers have access to the seed they could potentially can calculate the number that is shown on the token during authentication.
 

• Is APT something that everyone should be worrying about and planning for (is APT pervasive or just hype)?
• Explain how APT works (reconnaissance, phishing, infection, exfiltration)?
• What industries are targeted the most with APT?
• What data is most often taken (this goes to adding more protections around the most valuable data)?
• What are the most common Trojans used with APT?
• How can you tell you've been infected by APT?
• What can be used for detection (system logs, AV logs, IDS logs, Netflows, DNS, VPN logs, Full packet capture, File system analysis)?
• What can be done (logs, correlation of data across the enterprise, combine response efforts into a central location, keep data longer)?
• How long should you maintain this network data (3 months, 6 months, 9 months, a year)?
• What can be used for Mitigation (DNS/IP Sink Hole, system remediation and reimage)?
• What can your security vendor company do to mitigate the risks of APT (asked to the panelists)?
• Do you notify law enforcement when you find APT (or the company that you saw was infected by this malware)?
• Do you recommend security awareness to all employees and if so, do you have any examples/suggestions?
• Are you seeing APT being used by certain countries or is it equally used across the globe?
• What is missing from a technology, training, resources, policy perspective that needs to be addressed?
• Do we have all the tools to combat APT?
• Should vendors cryptographically sign all the code, including JavaScript, that they produce so that users can verify that they are really running the code they think they’re running?

I personally think there is a good bit of hype with APT as with anything. STUXNet was so overhyped that you have probably gotten to the point where people cringe when they hear that name.  However, the reality is that APT is real and it is pervasive, but it is nothing new.  That being said, it does highlight the need for every company to gain insight into why someone would target them and what are the "crown jewels" to a business, thus what they need to protect.   The Penetration Execution Standard (http://www.pentest-standard.org) does a great job of highlighting OSINT (OpenSource Intelligence) that should be gather as part of a penetration test.  But unfortunately, we as pentesters aren't doing it and companies aren't either.  Therefore, it stands to reason that most companies wouldn't know who is/would be targeting then and what they would be after.