Wanna Laugh. . .?

So, this last week was hustling and bustling with stories of a malware outbreak, only this time it was a ransomware(WannaCry). There seemed to be red screens everywhere especially in UK, Germany, some in India, Russia too. Like any other ransomware this code used a (now) known exploit in Windows to takeover and finally encrypt user files. This was typically followed by a demand for bitcoins for decrypting the files back. Let's ignore the 'Killswitch' story here.

Looking at the bigger picture. Were these countries targeted? May be not. Despite so much loss and chaos, I am compelled to ask if this a Good thing...? May be not but you know May Be it is. I will come to that shortly.

One of the most important observations here is that the it was possible since the attackers used a recent critical vulnerability in Microsoft OS - Windows which affects many versions of the OS. There are multitude of issues reported for Windows and patched weekly by Microsoft but this was a special one. This was disclosed by a hacker group from the 'data they stole from the NSA’. What does this mean. It is a fact now that governments are researching to find such vulnerabilities for the purpose of warfare, espionage, snooping, etc and using the exploits as powerful tools for similar purposes. This is where the problem arises.

While I am against adhoc disclosure of vulnerabilities, this has happened often that security researchers and hackers do a 'Responsible Disclosure' for issues after a follow up that involves several months of notifying the vendors involved. And in return are neither acknowledged nor paid and even have to take the blame for it sometimes. Yes, they do it for free! However, when respectable governments do the same thing ('irresponsible non-disclosure'), they somehow are above all ethics. Yes, we all know they can change their laws that govern the system.

The good part about a ransomware is you can quantify the loss (forget the chaos and mental agony, that’s priceless :)). This ransomware is known to have costed the world around $4 Billion by now.  It's time we honored the researchers who save us billions of dollars and immense trouble, by sharing issues in advance every year.

Coming to my first question and hence answer, it may be a good thing after all. The incidence has made us think about security. That it’s not just server admins or corporates but as people we need to be aware and be inclined towards a bit of critical thinking specially before sharing data or clicking on links and malware. As identities grow faster in the virtual world of internet, we need to protect ourselves as responsible citizens. Remember, there are no boundaries in the internet. And unlike typical wars fought on the ground, attacks in this space can be from anywhere. It may not always be what it seems like.

Of course, there is no reason for paranoia. If governments become irresponsible, people will need to be more responsible. In general, do some housekeeping. Keep Calm and Patch your OS and software. You can automate this, if it’s too much of a task. Be careful with what you are clicking (avoid if not necessary). And, simply put be a 'minimalist' when it comes to your data. Play Safe and have fun responsibly.

Note: For those interested in technical analysis of the ransomware, more details can be found in Endgame's blog here.

Bangladesh Bank Fraud: Came, Conquered, Got Human

On a recent news, a group of attackers gained access to the Bangladesh's Central Bank’s (BB) SWIFT payment system. Few weeks of investigations have revealed that this might in fact be the work of a custom malware (outlined well by BAE systems here) that infected the SWIFT agent for the bank.

However, this is not a lone incident. There are numerous incidents these days that follow a similar pattern of attack and amount anywhere from lot of money to loss of reputation. It should be noted that in most of the cases these do not exploit a major flaw in the software itself. This is a classic case of weakness in the Human link of security. The only plausible explanation of how the 'custom malware' was deployed into the bank's local environment, is the human side. Ironically, this is also the side that brought an end to the fraud when a spelling mistake was discovered in the transaction request email and the support team called the bank for verification.

Although its no coincidence that this malware was has been found at this time, it is yet to be confirmed if this was indeed the one used for the attack. The malware linked to the incident is indeed sophisticated for the fact that it works by replacing the conditional Jump instruction || 0x75 0x04 ||liboradb.dll(dll from the Swift suite responsible for database transactions and authorization) with  NOP instructions 0x90 0x90 to always succeed any authorization checks. Additionally, the logic for detecting forge transactions created and deleting the same from the database uses a pattern of swift codes which one familiar with such a system can devise. All along it also keeps signalling the command and control center a sort of audit log.

Any malware is a piece of code that is designed to program as per a pre-defined logic. A custom works as per the environment it is in. This is what adds flexibility and intelligence to the code. The more reliance we continue having on machine and code, the more necessary human intervention would be to protect it.And this is what is lacking in today's automated self run systems such as these. I will explain how.

Security by its very nature has to be in Layers. Assuming, the above scenario really occurred via a malware designed for Swift, two major events happened that compromised all controls in the case above:

1. The malware was deployed in the environment
2. Authorization logic was changed

For both the above to work, they need to function isolated environments i.e. the SWIFT based systems and the crucial .dlls , to avoid them from being tampered.
It seems evident that the malware was deployed through human error either by using Social Engineering techniques or by a malicious insider, but a human element is a must. Whereas in the second case(of the authorization logic), there seems to be a need for an additional element to security. For transactions bigger than a threshold, a second factor of authorization, mostly human, should be involved and mandatory.
It is interesting and what followed reiterates the fact the attack was well planned. Post the transaction the money was laundered into various accounts, which has still not been recovered or traced. I believe operational controls play an important role especially in bank frauds and this is no different. For amounts beyond a threshold is debited or credited from an account these should be controlled and allowed only after verification. This not only adds security and control but also makes for more business sense since such customers are generally premier for any bank (and as they say their safety should be a priority). And this might sound a little far fetched but our anti money laundering systems are yet to get smarter to be able to prevent and trace such incidents.

Although, there may be combination other controls that are required depending on the system being protected, the right human intervention will be necessary when impact is huge. All malware are designed to subvert technology, while some to subvert humans. Only unlike technology all humans are different.

References:

http://www.databreachtoday.com/swift-confirms-repeat-hack-attacks-a-9067

http://baesystemsai.blogspot.in/2016/04/two-bytes-to-951m.html