Technical view of the OpenSSL Heartbleed Vulnerability

I came across a very interesting document which explains the technical view of the OpenSSL Heartbleed Vulnerability.

https://www.ibm.com/developerworks/community/files/basic/anonymous/api/library/38218957-7195-4fe9-812a-10b7869e4a87/document/ab12b05b-9f07-4146-8514-18e22bd5408c/media

Source: IBM Corporation

Safari-Internet Explorer Blended Threat Vulnerability

Normally, most of the information security people use one or more web browser because this can make one feel surf the web more secure.

Usually, one uses one of the few available browsers to surf normally while other browsers to visit the suspected web site.

Ironically, use of multiple browsers will make your machine infect malware instead of be more secure. How, let’s explore Safari-internet explorer blended threat vulnerability.

However, this vulnerability is already patched but I feel the insight to this vulnerability is very essential.

Each of vulnerability is considered moderate/less severity, however, when these two vulnerabilities combines together the severity becomes very critical.

The vulnerabilities associated with safari and Internet Explorer is "Carpet Bomb" and "DLL Load Hijack" respectively.

Safari Carpet Bomb, discovered by Netish Dhanjani, is the vulnerability of Apple's web browser on OS X and Microsoft Windows. When users use Safari to browse the specially crafted website, Safari will download file into users machine without users interaction (default location is Desktop).

Aviv Raff had discovered that IE7 has the behavior that may be dangerous to the user. For some DLLs, IE7 will search the DLLs from PATH environment and loaded the first match into memory. In some situation, IE7 will search from Desktop.

The search path of IE is in the following order:

C:\Program Files\Internet Explorer\
C:\WINDOWS\system32\
C:\WINDOWS\system\
C:\WINDOWS\
C:\Documents and Settings\username\Desktop

If the attacker has the ability to put DLLs on the victim's Desktop, they will won the game.

This attack is called "Blended Threat" vulnerability since the overall vulnerability is the combination of two vulnerabilities.

Types of Malwares

Adware
The purpose of adware is to display ads.
Some Adware threats bombards the users with so many ads that the users can hardly use their computer.
Some Adware program can also lead to phishing attacks as in tricking users to click to visit malicious websites which could led them to downloading additional malwares.
This can pose a significant risk to other types of attacks.  

APT (Advanced Persistent Threat)
The term APT refers to an elaborate attack like Stuxnet that’s backed by a government or other powerful group.
The breakdown of APT is as follows:
Advanced: Attackers use highly advanced technology to perform the sophisticated attack.
Persistent: The goal of such attacks is to continue the attack until the success is not achieved.
Threat: Refers to the threat to the organization.

AET (Advanced Evasion Threat)
AET is type of network attack that combines several different known evasion methods to create a new technique that's delivered over several layers of the network simultaneously.
The breakdown of AET is as follows:
Advanced: Attackers use highly advanced technology to perform very sophisticated attack. The attack is delivered over several layers of the network making it hard to be detected since the individual evasion techniques may get skipped in the detection however the aggregation of these evasion techniques could cause a significant impact on the CIA of the organization.
Evasion: Blocks of attacks that individually could go undetected by current security products
Threat: Refers to the threat to the organization.
AET is very hard to detect since it require huge level of correlations among different event log sets.
Lots of pioneer security companies are currently focusing on identifying APT and AET attacks by using machine learning, user behavior analytics and other techniques.

Backdoor
A backdoor opens up computer to hacking attacks.
It allows full access to everything on the computer, bypassing the requirement to log in with a Windows password.
A hacker could take the control of the system whenever they wanted using the backdoor.

Bot
On its own, a bot isn’t harmful.
The creator, or “bot herder,” works hard to get as many silent bot infestations as possible installed, then rents out the bot network to others.
DDoS (Distributed Denial of Service) attacks are often managed by sending commands to a bot network that cause all the infected PCs to run an attack script.

Dropper
A dropper doesn’t harm your system itself.
However, it installs other threats, or opens a channel through which the bad guys can push malwares to the system.

Exploit
Relationship between Threat, Exploit, Vulnerability, Target and Countermeasures is as follows:
“THREAT EXPLOITS the VULNERABILITY in the TARGET system and COUNTERMEASURES must be implemented to block such attacks”
vulnerability is a weakness which allows an attacker to reduce a system's information assurance.

Vulnerability is the intersection of three elements:
A system susceptibility or flaw,
Attacker access to the flaw, and
Attacker capability to exploit the flaw

Exploit is the way to use the vulnerability effectively to gain access to the system for performing malicious activity.

Keylogger
keylogger is a form of spyware that captures everything the user types, including passwords and other sensitive information.
Some keyloggers also capture screenshots, log your web browsing history, record anything copied to the clipboard, and more.

Malware
Malware is a blanket term which applies to any software designed to be malicious, including (but not limited to) all of the other types described here.

Ransomware
A ransomware threat encrypts your important documents, disables Windows logon, or otherwise makes your computer unusable until you pay the ransom demanded by its perpetrators.
It’s a bit dodgy for the perpetrators, since they might be tracked through the ransom payment.
Its hard to recover from the Ransomwares since few ransomware would encrypt the entire system which would be hard to decrypt without knowing the key.

RAT (Remote Access Trojan)
Like all Trojans, a RAT masquerades as an innocent and useful program.
Behind the scenes, though, it opens up a backdoor that gives its owner complete access to the affected computer.

Rootkit
Antivirus software can only remove threats that it can detect. Rootkit technology hides a threat’s file and Registry traces so that most programs can’t “see” them.
Some rootkits operates at a system level which goes undetected by anti-malware softwares.

Only specialized anti-malware technology can bring the hidden traces into view.
Rootkit are very few in the market since it require very specialized design.

Scareware
A fake antivirus that pretends to find problems on your system and displays a big, frightening warning – that’s scareware.
Naturally you must pay the registration before it will “fix” the made-up problems.
In most cases there’s no actual malicious code, just a huge scam to con you into paying money for nothing.

Spyware
Spyware simply means malicious software that steals credit card numbers, passwords, and other sensitive personal information.

Trojan
Named after the Trojan Horse of legend, a Trojan is a seemingly benign program that does something nasty in secret.
Trojans are the most common type of malware on the Android platform.
While one is playing a Trojanised Android game, it may be sending your contacts to a server in Russia, or making £10 per minute phone calls.

Virus
A computer virus spreads by injecting its code into other programs or, less commonly, into the boot sector of a disk.
When the infected program is executed, the virus code runs too.
It may simply infect more files, or it may perform a “payload” action like wiping out your hard drive.

Worm
Like a virus, a worm replicates itself within the computer or across the network. 
Unlike a virus, it doesn’t wait for the infected program to get launched.
Network worms can spread around the world with alarming rapidity.

Constructor
A utility to construct a malware

Trackware
Allows a third party to identify the user or their device, usually with a unique identifier.
The most common trackware is tracking cookies.

Potentially unwanted softwares
A program or component that may be considered undesirable or intrusive by a user if used questionable, or may inadvertently introduce privacy or security risks.

If the user is aware of and accepts the potential risk associated with a program classed as PUA, they may elect to install and use the application.

Reconnaissance

Reconnaissance:

Reconnaissance is the first phase of the cyber exploitation life cycle.

In this phase, hackers focus on collect as much information about the target without getting detected.

1)      Collect Elementary Information:

a.      What is the website look like

b.      What web server are they using

c.      Where are they physically located

d.      Officers of the company

e.      When was the company founded

f.       Where do they start from?

g.      Who is providing the hosting service

h.      No. of offices the company has

2)      Discover OS, Web Servers & Platforms:

a.      What operating system is running in the system exposed

b.      What web server they are using? E.g. apache, ISS etc.

c.      What version they are using

3)      Perform Queries:

a.      Whois

b.      DNS information

c.      Underlying networking information

d.      Routers they are using

e.      Employees Information for social engineering

4)      Discover Vulnerabilities:

a.      Possible vulnerabilities

Why Reconnaissance?

1)      It helps us to understand the security posture of any company. Understand the network infrastructure of the target company as in exposed and possibly internal IP address, what is behind the firewall, which version of DMZ they use etc.

2)      Helps in reducing the attack area. I.e. focused domains, IP address, ports etc.

3)      Helps in building information database to keep track of attack vectors etc.

4)      Layout a network map.

5)      It makes the job easier in the long run

Types of recon:

1)      Passive scanning: Using public available sources to determine as much information about the target e.g. IP address, OS, web servers, services open, access control, IDS etc.

2)      Active Recon: Touching the target e.g. Going to job interview, social engineering, walking through the building

3)      Anonymous: Getting information from unknown/third party sources.

4)      Organization/private: Process of getting info from event calendar, email services etc.,

5)      Internet recon: Using internet sources like passive. Use google to reconnaissance their website etc.

6)      Pseudonymous: Collecting info. From sources that are published but not direct from the employee or company e.g. Government etc.

Goals of Reconnaissance:

1)      What am I looking for:

a.      Network information

                                                    i.     Domain names: child domains etc.

                                                   ii.     Internal domains etc. like .net, .com so .com is used outside but .net internally

                                                  iii.     IP addresses

                                                  iv.     Unmonitored/private websites

                                                   v.     TCP/UDP services

                                                  vi.     IDS/Access controls

                                                vii.     VPN info

                                               viii.     Phone numbers/VoIP

b.      Operating system info.

                                                    i.     User & group names: like how they do system naming

                                                   ii.     Banner grabbing

                                                  iii.     Routing tables how packets are getting router

                                                  iv.     SNMP

                                                   v.     System architecture

                                                  vi.     Remote Systems

                                                vii.     System names like if the name of one of the server is from stars we can try to identify others

                                               viii.     Passwords length etc.

c.      Organization Information

                                                    i.     Organization website

                                                   ii.     Company directory

                                                  iii.     Employee details

                                                  iv.     Location details

                                                   v.     Addresses/Phone Numbers

                                                  vi.     Comments in HTML source code

                                                vii.     Security Policies deployed

                                               viii.     Web server links i.e. Partnering company

                                                  ix.     Background of organization

                                                   x.     News/press releases

Once we get the information, hackers try to create a blueprint of the organization. This helps in identifying the different point of entries to the organization etc.

Tools Used for Reconnaissance:

1)      WinHTTrack (Website Copier)

2)      Webmaster toolkit (Link Extractor)

3)      Whois

4)      Ping

5)      Nslookup

6)      Netstat

7)      Tracert

8)      Netcraft

9)      Wayback machine

10)   PoliteMail

11)   Email Lookup
12)  Nmap
13) Vulnerability Scanners like Nessus, Nexpose etc.
14) Sniffers like Wireshark, Ettercap etc.
15) Packet Crafters like Netcat, Hping etc.

Useful Sysinternals Tools for Malware Hunting in Windows OS

Some of the tools in Sysinternals suite are very useful for securing as well as for identifying any malicious activities in Windows operating system.

I have listed the tools, that I frequently use for malware hunting.

Download windows Sysinternals suite and explore the listed tools for malware hunting and securing your windows system.

Tools	Description
AccessEnum	This tool shows access permission of user accounts to the directories, files and Registry keys on the system. Users can use it to find ACL permission holes
EFSDump	View information for encrypted files
MoveFile	Schedule file rename and delete commands for the next reboot. This can be useful for cleaning stubborn or in-use malware files
PendMoves	See what files are scheduled for delete or rename the next time the system boots
Process Monitor	Monitor file system, Registry, process, thread and DLL activity in real-time
Psfile	See what files are opened remotely
Sdelete	Securely overwrite your sensitive files and cleanse your free space of previously deleted files using this DoD-compliant secure delete program
ShareEnum	Scan file shares on your network and view their security settings to close security holes
Sigcheck	Dump file version information and verify that images on your system are digitally signed
Ping	Measures network performance
TCPview	Active socket command-line viewer
Whois	See who owns an Internet address
Autoruns	See what programs are configured to startup automatically when your system boots and you login. Autoruns also shows you the full list of Registry and file locations where applications can configure auto-start settings.
Handle	This handy command-line utility will show you what files are open by which processes, and much more
ListDLLs	List all the DLLs that are currently loaded, including where they are loaded and their version numbers. Version 2.0 prints the full path names of loaded
ProcDump	This new command-line utility is aimed at capturing process dumps of otherwise difficult to isolate and reproduce CPU spikes. It also serves as a general process dump creation utility and can also monitor and generate process dumps when a process has a hung window or unhandled exception
Process Explorer	Find out what files, registry keys, and other objects processes have open, which DLLs they have loaded, and more. This uniquely powerful utility will even show you who owns each process.
Psexec	Execute processes remotely
Pskill	Terminate local or remote processes
Pslist	Show information about processes and threads
Psservice	View and control services
Pssuspend	Suspend and resume processes
Shellrunas	Launch programs as a different user via a convenient shell context-menu entry
Autologon	Bypass password screen during logon
LogonSessions	List active logon sessions
PsLoggedOn	Show users logged on to a system
Psinfo	Obtain information about a system
Strings	Search for ANSI and UNICODE strings in binary images.