It seems that PC makers are not happy with the Intel’s Management Engine (IME) and the flaws that keep being found in it. The original flaw allowed attackers a clean way to compromise a system including uploading malware and exfiltrating data. This could be done in a way that bypassed most security systems and even allowed for tampering with the UEFI BIOS if the attacker was sophisticated enough. To their credit, Intel did warn people and manufacturers about this and patched it fairly quickly. The problem is, now that the cat is out of the bag about one flaw; there are sure to be more.
Def Con 25, Las Vegas, NV –
Your phone rings and you check the number as a precaution against marketing calls and it looks like it is from your office. The voice on the other end says that there is an issue on the network and they need your assistance to troubleshoot. The person is calm, friendly and helpful so you agree to assist. By the time it is all done you have in advertently given away vital information about your network to a potential attacker.
Black Hat 2017, Las Vegas, NV -
When an attacker gains a foothold in a network the first thing they need to do is learn the lay of the land. They have done some research on the target to gather information about possible systems they might encounter. In reality, they do not truly know what is going on. They are likely to have hit an exposed system with little true access into the good parts of the network. They are going to need to check shares, network connections and also scrape memory for and stored credentials. With these in had they begin the process of moving around the network and building their map of the target environment.
Black Hat USA 2017 - Las Vegas, NV.
Another company that we have the chance to sit down with was Attivo Networks. Attivo, if you are not familiar with them specialize in network deception through the use of projected systems. These are systems that do not really exist in the network but that occupy space and would appear real to someone looking at the network from behind the scenes. They use different methods to make these systems appear to be real including mapped drives (that are invisible to an actual user). This way when a system on the network is compromised an attacker might be fooled into interacting with a deception system and give themselves away.
Black Hat USA 2017 - Las Vegas, NV
When you think of Dell you might get many different images that come to mind. For some they might think about the 90s and the “you’re getting a Dell Dude” guy. Others might think about servers, or corporate desktops. In recent years, you might think about Dell’s push back into the performance market. However, for a large number of people you would not think about Security when the Dell name gets tossed out. This would be a mistake though as Dell does have a large team of people that work on security. This is not just for Dell products, but also for other products that are outside of the Dell realm. While at Black Hat 2017 I had the chance to site down with Brett Hansen, VIce President of Dell Data Security and we talked about some of the security offerings that Dell has.
A few days ago we published an article that covered a leaked batch of emails that showed Kaspersky has worked with the Russian Government. We also covered that the pieces of the emails that were published were completely out of context, and also are nothing out of the ordinary for a company that has a contract with a Government body. Kaspersky's denial of cooperation is also nothing new, so why the big deal in the media? Well we might have found a few pieces to that puzzle which would certainly explain the big push to discredit Kaspersky.
Questionable security practices aside, it seems that just about every "big" scandal lately has had leaked emails as some sort of component. In the latest such scandal we find that leaked Kaspersky emails are at the core of the US National Security policy maker's concerns over the company and the use of the product inside the US. According to "internal company emails obtained by Bloomberg Businessweek" Kaspersky has had a rather close relationship with Russian intelligence agencies.
WikiLeaks is at it again with their "Vault 7" releases. This time part of the dump features a nice little took kit for continued exploitation of some Linux systems. The tool kit is called OutlawCountry and is, to be perfectly honest, not much more than a remote management, monitoring and exfiltration tool. It is intended to run in the background on a system after a vulnerability has been exploited to allow the payload to be pushed. It looks very similar to a tool that the NSA used for years and has now become the commercial product Kaseya.
For the last couple of days the world has been buzzing with news about the Petya malware. When the news of the outbreak broke on Tuesday morning, it was all about a new ransomware that was spreading around the globe. References to WannaCry were made and fingers pointed to the use of the same NSA exploit as the attack vector. However, Petya was not really like WannaCry in that there was no “kill-switch”. Wednesday morning the big players in the anti-malware and security markets had sent out their “what you should know emails” and a low-grade form of panic hit many enterprises.
Remote management and access tools are great things for IT staff to use, but if they are not set up correctly or they have bugs hidden in the code they can quickly become a nightmare. Intel’s AMT (Active Management Technology) suite of tools recently was found to have a rather nasty little surprise hidden in them. It seems that a flaw in the way their SOL (Serial on LAN) tool runs combined with the way Windows deals with AMT allowed attackers to use AMT to deploy malware and to exfiltrate data from a compromised system.