Monthly Archives: February 2014

Live from RSA USA 2014: Talking Security with Martin Brown, Chief Security Portfolio Architect at BT Security Enterprise

| By | Business of Security, Executive Perspectives, Security Perspective

The excitement and buzz at the RSA Conference has everyone talking security and we are no exception. In fact, during the conference, we are gathering up industry leaders and influencers and asking them to provide their perspectives on the biggest issues in cybersecurity in 2014 for our podcast series hosted by FireEye Chief Security Strategist, Richard Bejtlich.

On the first day of the conference, Richard sat down with Martin Brown, Chief Security Portfolio Architect at BT. Richard and Martin discussed the state of the security industry, new threats on the horizon, and what role next generation security products play within these advanced cyber threats.

Brown explains how anti-virus alone is not enough for organizations and that there needs to be a blend of conventional and non-conventional solutions with skills and process to deal with targeted attacks. He uses the analogy of the footprints in the sand. Detecting the footprints, analyzing the shoe size, determining the weight of the person all can be determined with traditional products. But if you look out to sea you notice the “ripples in the water.” These rings are developing from the center point. Traditional tools can’t determine what caused the ripple effects, but newer technologies, like FireEye, can rewind time and look back to see what originally caused the ripple effect.

Listen to the full podcast and make sure to check back soon for our next featured interview:
Richard Bejtlich Interviews Martin Brown, Chief Security Portfolio Architect at BT Security Enterprise

The 2013 FireEye Advanced Threat Report!

| By | Advanced Malware, Threat Research

FireEye has just released its 2013 Advanced Threat Report (ATR), which provides a high-level overview of the computer network attacks that FireEye discovered last year.

In this ATR, we focused almost exclusively on a small, but very important subset of our overall data analysis – the advanced persistent threat (APT).

APTs, due to their organizational structure, mission focus, and likely some level of nation-state support, often pose a more serious danger to enterprises than a lone hacker or hacker group ever could.

Over the long term, APTs are capable of cyber attacks that can rise to a strategic level, including widespread intellectual property theft, espionage, and attacks on national critical infrastructures.

The data contained in this report is gleaned from the FireEye Dynamic Threat Intelligence (DTI) cloud, and is based on attack metrics shared by FireEye customers around the world.

Its insight is derived from:

  • 39,504 cyber security incidents
  • 17,995 malware infections
  • 4,192 APT incidents
  • 22 million command and control (CnC) communications
  • 159 APT-associated malware families
  • CnC infrastructure in 206 countries and territories Continue reading »

Amazon’s Mobile Shopping Clients and CAPTCHA

| By , and | Mobile Threats, Threat Intelligence, Threat Research, Vulnerabilities
Amazon is a popular online retailer serving millions of users. Unfortunately, FireEye mobile security researchers have found security issues within Amazon’s mobile apps on both Android and iOS platforms through which attackers can crack the passwords of target Amazon accounts. Amazon confirmed our findings and hot fixed the issue. Recently, we found two security issues within Amazon’s mobile apps on both Android and iOS platforms:
  • No limitation or CAPTCHA for password attempts
  • Weak password policy
Attackers can exploit these two security issues remotely against target Amazon accounts. Continue reading »

Background Monitoring on Non-Jailbroken iOS 7 Devices — and a Mitigation

| By , and | Mobile Threats, Threat Intelligence, Threat Research, Vulnerabilities
Background monitoring mobile applications has become a hot topic on mobile devices. Existing reports show that such monitoring can be conducted on jailbroken iOS devices. FireEye mobile security researchers have discovered such vulnerability, and found approaches to bypass Apple's app review process effectively and exploit non-jailbroken iOS 7 successfully. We have been collaborating with Apple on this issue.
fig1
Fig.1 Background Monitoring
We have created a proof-of-concept "monitoring" app on non-jailbroken iOS 7.0.x devices. This “monitoring” app can record all the user touch/press events in the background, including, touches on the screen, home button press, volume button press, and TouchID press, and then this app can send all user events to any remote server, as shown in Fig.1. Potential attackers can use such information to reconstruct every character the victim inputs. Continue reading »

Write Once, Exploit Everywhere: FireEye Report Analyzes Four Widely Exploited Java Vulnerabilities

| By | Advanced Malware, Exploits, Threat Research, Vulnerabilities

Over the last couple of decades, Java has become the lingua franca of software development, a near-universal platform that works across different operating systems and devices. With its “write once, run anywhere” mantra, Java has drawn a horde of developers looking to serve a large user base as efficiently as possible.

Cyber attackers like Java for many of the same reasons. With a wide pool of potential targets, the platform has become the vehicle of choice for quickly dispersing lucrative crimeware packages.

In our continuing mission to equip security professionals against today’s advanced cyber threats, FireEye has published a free report, “Brewing Up Trouble: Analyzing Four Widely Exploited Java Vulnerabilities.” The report outlines four commonly exploited Java vulnerabilities and maps out the step-by-step infection flow of exploits kits that leverage them.

Download the paper to learn more about these vulnerabilities:

  • CVE-2013-2471, which allows attackers to override Java’s getNumDataElements() method, leading to memory corruption.
  • CVE-2013-2465, which involves insufficient bounds checks in the storeImageArray() function. This vulnerability is used by White Lotus and other exploit kits.
  • CVE-2012-4681, which allows attackers to bypass security checks using the findMethod () function.
  • CVE-2013-2423, which arises due to insufficient validation in the findStaticSetter () method, leading to Java type confusion. This vulnerability employed by RedKit and other exploits kits.

As explained in the paper, Java’s popularity among the developers and widespread use in Web browsers all but guarantees continuing interest from threat actors.

Motivated by the profits, cyber attackers are bound to adopt more intelligent exploit kits. And these attacks will continue to mushroom as more threat actors scramble for a piece of the crimeware pie.

Operation GreedyWonk: Multiple Economic and Foreign Policy Sites Compromised, Serving Up Flash Zero-Day Exploit

| By , , , and | Targeted Attack, Threat Intelligence, Threat Research, Vulnerabilities

Less than a week after uncovering Operation SnowMan, the FireEye Dynamic Threat Intelligence cloud has identified another targeted attack campaign — this one exploiting a zero-day vulnerability in Flash. We are collaborating with Adobe security on this issue. Adobe has assigned the CVE identifier CVE-2014-0502 to this vulnerability and released a security bulletin.

As of this blog post, visitors to at least three nonprofit institutions — two of which focus on matters of national security and public policy — were redirected to an exploit server hosting the zero-day exploit. We’re dubbing this attack “Operation GreedyWonk.”

We believe GreedyWonk may be related to a May 2012 campaign outlined by ShadowServer, based on consistencies in tradecraft (particularly with the websites chosen for this strategic Web compromise), attack infrastructure, and malware configuration properties.

The group behind this campaign appears to have sufficient resources (such as access to zero-day exploits) and a determination to infect visitors to foreign and public policy websites. The threat actors likely sought to infect users to these sites for follow-on data theft, including information related to defense and public policy matters.

Continue reading »

XtremeRAT: Nuisance or Threat?

| By and | Threat Intelligence, Threat Research

Rather than building custom malware, many threat actors behind targeted attacks use publicly or commercially available remote access Trojans (RATs). This pre-built malware has all the functionality needed to conduct cyber espionage and is controlled directly by humans, who have the ability to adapt to network defenses. As a result, the threat posed by these RATs should not be underestimated.

However, it is difficult to distinguish and correlate the activity of targeted threat actors based solely on their preference to use particular malware — especially, freely available malware. From an analyst’s perspective, it is unclear whether these actors choose to use this type of malware simply out of convenience or in a deliberate effort to blend in with traditional cybercrime groups, who also use these same tools.

There are numerous RATs available for free and for purchase in online forums, chat rooms and market places on the Internet. Most RATs are easy to use and thus attract novices. They are used for a variety of criminal activity, including “sextortion”. [1] The ubiquity of these RATs makes it difficult to determine if a particular security incident is related to a targeted threat, cybercrime or just a novice “script kiddie” causing a nuisance.

Although publicly available RATs are used by a variety of operators with different intents, the activity of particular threat actors can still be tracked by clustering command and control server information as well as the information that is set by the operators in the builder. These technical indicators, combined with context of an incident (such as the timing, specificity and human activity) allow analysts to assess the targeted or non-targeted nature of the threat.

In this post, we examine a publicly available RAT known as XtremeRAT. This malware has been used in targeted attacks as well as traditional cybercrime. During our investigation we found that the majority of XtremeRAT activity is associated with spam campaigns that typically distribute Zeus variants and other banking-focused malware. Why have these traditional cybercrime operators begun to distribute RATs? This seems odd, considering RATs require manual labor as opposed to automated banking Trojans.

Continue reading »

RSA 2014: New Thinking to Narrow the Security Gap

| By | Business of Security, Executive Perspectives, Security Perspective

Attacking the gap and preparing for the new frontiers in security is our focus for the 2014 RSA Conference. Around the show floor, in our booth, and in the conference tracks, you’ll hear from FireEye experts on how to address this new frontier. We’ll have updates on the latest threats from our research teams as well as live demonstrations of our new FireEye Security Platform. Find us at our booth and make sure to catch our research team presenting throughout the conference:

  • Kevin Mandia, SVP and COO for FireEye, Inc., will be presenting on the New Frontiers in Security on Tuesday, February 25 at 2:40 PM. Listen in as Kevin joins a group of industry experts to discuss how organizations must rethink their security approach in this Security Mash-Up panel session.
  • Also on Tuesday, February 25 at 1:20 PM, FireEye’s Zheng Bu Vice President, FireEye Research Labs will present Twilight of Legacy AV Models - A Different Long Tail Story. Malware has a very short lifetime. But how short is it? The findings may surprise you and while large portions of malware objects only appear once, the lifetime of malware forms a very fat-head long-tail chart. The anti-virus industry presents a reactive model, and it performs very badly on the fat-head. In this session Bu will present the study, the challenge and a possible mitigation plan.
  • On Wednesday, February 26 at 12 PM, Amanda Stewart, Malware Research Engineer at FireEye, will dig into techniques to sneak malware past Anti-Virus scanners. APT developers used this technique in a highly-targeted attack against a Fortune 50 company last year. Learn more during this must-see technical session, DLL Side-Loading: A Thorn in the Side of the Anti-Virus (AV) Industry.
  • One year after the well-known APT 1 Report, Kevin Mandia will discuss the fallout from exposing China’s espionage effort during the State of the Hack: One Year after the APT1 Report technical session. While there will be other sessions at RSA 2014 around the industry changing APT1 report, come hear directly from the source on the latest approaches attackers are using to compromise organizations and what organizations should be doing to narrow their security gap. Kevin will be speaking on Thursday, February 27 at 3:55 PM.

Don’t forget to stop by our booth located at North Expo #2813 to learn more about the newly expanded FireEye Security Platform, which integrates expertise from Mandiant and is designed to give customers one solution to go from threat alert to remediation. We’ll have live demonstrations of all the new FireEye products. In the mean time, be sure to follow @FireEye for the latest threat research and updates from the company.

Operation SnowMan: DeputyDog Actor Compromises US Veterans of Foreign Wars Website

| By , , , and | Advanced Malware, Exploits, Targeted Attack, Threat Research, Vulnerabilities

On February 11, FireEye identified a zero-day exploit (CVE-2014-0322)  being served up from the U.S. Veterans of Foreign Wars’ website (vfw[.]org). We believe the attack is a strategic Web compromise targeting American military personnel amid a paralyzing snowstorm at the U.S. Capitol in the days leading up to the Presidents Day holiday weekend. Based on infrastructure overlaps and tradecraft similarities, we believe the actors behind this campaign are associated with two previously identified campaigns (Operation DeputyDog and Operation Ephemeral Hydra).

This blog post examines the vulnerability and associated attacks, which we have dubbed “Operation SnowMan.”

Continue reading »

New IE Zero-Day Found in Watering Hole Attack

| By | Exploits, Vulnerabilities

FireEye Labs has identified a new Internet Explorer (IE) zero-day exploit hosted on a breached website based in the U.S. It’s a brand new zero-day that targets IE 10 users visiting the compromised website-a classic drive-by download attack. Upon successful exploitation, this zero-day attack will download a XOR encoded payload from a remote server, decode and execute it.

This post was intended to serve as a warning to the general public. We are collaborating with the Microsoft Security team on research activities. We will continue to update this blog as new information about this threat is found.

Update: We have posted a full analysis of the attack, which we have dubbed “Operation SnowMan.”