Cyberweekly #97 - How to work from home

Published on Sunday, April 12, 2020

Capitalizing on Coronavirus Panic, Threat Actors Target Victims Worldwide

https://www.recordedfuture.com/coronavirus-panic-exploit/

Coronavirus has also been weaponized as a way to spread spyware by the Iranian government. Iran’s Health Ministry sent a message to victims advising them to download a specific application to monitor for potential symptoms of COVID-19. This application was, in reality, spyware. The malicious Android application, called ac19.apk, is capable of gathering victim location services and monitoring a user’s physical activity (such as walking or sitting) — ostensibly to determine where the user is going and when. The application is distributed on a website created by the Iranian government, https://ac19[.]ir/.

We know that phishers, organised crime and some other APT’s are using COVID-19 in their lures and attacks. Although mostly this appears to be a shifting of attack capability, so while this is a new attack vector to defend against, it’s not a rise in the actual risk, because it comes with a reduction in the other attacks by those groups.

But this is chilling, a government is using COVID-19 warnings in order to increase spying on its own citizens by allegedly delivering malware from the government itself.

Advisory: COVID-19 exploited by malicious cyber actors - NCSC.GOV.UK

https://www.ncsc.gov.uk/news/covid-19-exploited-by-cyber-actors-advisory

In the UK, the NCSC has detected more UK government branded scams relating to COVID-19 than any other subject. Although, from the data seen to date, the overall levels of cyber crime have not increased, both the NCSC and CISA are seeing a growing use of COVID-19 related themes by malicious cyber actors. At the same time, the surge in home working has increased the use of potentially vulnerable services, such as Virtual Private Networks (VPNs), amplifying the threat to individuals and organisations.

A reminder that although terribly worded, the COVID-19 threat is coming primarily from phishing and social engineering, the lure part of an attack, and is primarily about existing attackers changing their operating tactics.

You'd easily be mistaken in believing that there was a new threat on the landscape that you must protect against, but the reality is that, generally speaking, these aren't new actors adding to the threat, but changing tactics. However there might be a greater risk, as during this period, people are more nervous and far more likely to click well constructed phishing lures than they might be normally.

How I protected my home network - Caleb Sima - Medium

https://medium.com/@csima/how-i-protected-my-home-network-66797536a3cc

After running for two weeks with no noticeable security activity, my mother in-law dropped by and used the Wifi network. Almost immediately I received an alert of an Android device portscanning my network and accessing the data canary. The origin device causing all the trouble was, in fact, my mother in-law’s phone. Through the simple Fingbox UIs I immediately kicked the phone off the network and asked to take a peek at it. Sure enough, a malware scanner app confirmed the phone had an infection. Now that’s what I call success!

This is a lovely story of security made simple, easy to use and just working. Caleb sets out at the beginning that they are not going to be doing security analysis, shipping their traffic anywhere or setting up complex trust zones, as that's all too much to ask. I agree, I think security that is trivially easy to setup and only bothers you when something goes wrong is the right level for most people.

Shipping something like this to high value employees houses so that as an organisation you have some confidence that they have secure home working networks is an idea that you might want to consider

Attack matrix for Kubernetes

https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/

When we in Azure Security Center started to map the security landscape of Kubernetes, we noticed that although the attack techniques are different than those that target Linux or Windows, the tactics are actually similar. For example, a translation of the first four tactics from OS to container clusters would look like 1. “initial access to the computer” becomes “initial access to the cluster”, 2. “malicious code on the computer” becomes “malicious activity on the containers”, 3. “maintain access to the computer” becomes “maintain access to the cluster”, and 4. “gain higher privileges on the computer” becomes “gain higher privileges in the cluster”.

Therefore, we have created the first Kubernetes attack matrix: an ATT&CK-like matrix comprising the major techniques that are relevant to container orchestration security, with focus on Kubernetes.

If you are running Kubernetes, then this framework will work well for you to help understand what attacks attackers might carry out, and how they will get there. You can then work out where your detection capability is and where it's missing.

Decade of the RATs: Novel APT Attacks Targeting Linux, Windows and Android

https://blogs.blackberry.com/en/2020/04/decade-of-the-rats

BlackBerry researchers have released a new report that examines how five related APT groups operating in the interest of the Chinese government have systematically targeted Linux servers, Windows systems and Android mobile devices while remaining undetected for nearly a decade.

The BlackBerry report, titled Decade of the RATs: Cross-Platform APT Espionage Attacks Targeting Linux, Windows and Android, examines how APTs have leveraged the “always on, always available” nature of Linux servers to establish a “beachhead” for operations. Given the profile of the five APT groups involved and the duration of the attacks, it is likely the number of impacted organizations is significant.

This really should come as no surprise. While there have been very few reports about linux based malware, it's not because there's fundamentally better security, it's because there's far less attention paid to detection capabilities in that area.

Linux runs on huge numbers of servers, in particular a lot of cloud servers use it for the low license costs. That makes it a huge target for APT's and therefore we should expect that they have developed highly capable tools for this area.

Responsible Coronavirus Surveillance Is Possible, Privacy Experts Say

https://theintercept.com/2020/04/02/coronavirus-covid-19-surveillance-privacy/

The coronavirus tracking ramp-up is already well underway around the world. In South Korea, Taiwan, and Israel, authorities use smartphone location data to enforce individual quarantines. Moscow police say they’ve already busted 200 quarantine violators caught via facial recognition-enabled cameras. NSA contractor and perennial privacy offender Palantir is helping Britain’s National Health Service track infections. Apps that leverage a smartphone’s bounty of built-in, highly accurate sensors to enforce social distancing or map the movements of the infected have been deployed in Singapore, Poland, and Kenya; MIT researchers are now pitching a similar, but more “privacy friendly,” app. In Mexico, Uber sent government authorities rider data to trace the route of an infected tourist, also banning 240 users who’d taken rides with the same driver.

This sums up some pretty sensible recommendations about appropriate use of data to perform contact tracing during a health epidemic. It's clear that the threat to life is great enough that some erosion of personal liberty might be necessary, but the key things that come out of these recommendations is that data used this way should be walled off and only used for this purpose.

This is a good reminder that the best controls here are not technological ones that perform funky special things on bluetooth identifiers, but in reality the best controls will come from a strong contract between government and public, transparency about adhering to that contract and public trust.

Best Security Key for Multi-Factor Authentication 2020 | Reviews by Wirecutter

https://thewirecutter.com/reviews/best-security-keys/

The Yubico YubiKey 5 Series supports a wide array of security protocols, which makes it compatible with more online accounts than most other keys. Yubico also provides the best documentation, and its excellent introductory experience eases the process for newcomers. Compared with other security keys, the 5 Series offers more connection options, including USB-A, USB-C, and a dual-headed USB-C and Lightning-port model for iOS users. All of the full-size keys have a hole so you can attach them to any keychain, making them portable, and in our tests they proved durable after weeks of regular use. The YubiKey 5 Series can be a little more expensive than other keys with similar features, but its robust compatibility with more devices and accounts makes it worth the price.

This is a good review of various security keys. I've been a fan of Yubikeys for a while, and I have the USB-C variant of the YubiKey set for my company accounts.

Some things that this article didn't cover, that I'd recommend:

1. It's possible, and indeed, I'd recommend buying more than one key or key type. I have a backup key that is held in case I lose my main one. You can add a second key to almost every service that supports yubikeys (With the annoying exception of AWS), and even a third. This means you can buy both a USB-C connecting one and an NFC one if you want.

2. iOS support is more than a little flaky. I don't use mine with my phone at all. Most services have some work arounds, Google requires me to be at a computer where I can use the key to generate a code to type into my device, and many services support using a standard TOTP service like Authy or Google Authenticator instead.

The use of hardware keys is something you really only want to enable for high value accounts. It can be fiddly to go find them when needed. I use mine to: * Unlock last pass * Login to Github once every 30 days/new browsers * Login to GSuite/Gmail whenever Google is worried about security * Using the AWS Console for my root account

For pretty much everything else, I rely on Last Pass to generate strong passwords and TOTP codes from Authy instead. Those services are probably the most valuable/interesting ones that I use, and so the ones that I'll tolerate the most restrictions on.

RDP Drawing Unwanted Attention | Decipher

https://duo.com/decipher/rdp-drawing-unwanted-attention

Since the beginning of March, when some organizations began instituting either voluntary or mandatory remote work policies, researchers have seen increases in both the number of RDP servers exposed to the Internet and the number of unique IP addresses scanning for those servers. According to data gathered by Shodan, the device search engine, the number of RDP servers exposed on the default port (3389) has increased steadily, and eight percent of those servers are still vulnerable to BlueKeep. In the United States alone, more than 38,000 servers are still vulnerable to BlueKeep.

Of course, if you want your staff to work remotely from home, and normally they use RDP a lot, then you need to expose that RDP server to them.

More likely is a number of organisations using rapidly deployed RDP servers to enable staff to work from home without having a work laptop. But again, this needs to be exposed to all of your staff.

This is an area where you want better controls in place. RDP has built in authentication mechanisms, but has a history of critical vulnerabilities including a preauthentication attack such as BlueKeep. That means that all the MFA and password policies in the world won't protect you. IP Whitelisting or other access controls are necessary here, and rolling out a VPN solution to your staffs personal devices is probably the best (and most expensive) way to solve this.

I'll note that you can throw together a client VPN using AWS pretty easily, it supports a good IPSec VPN stack, can authenticate using your existing AD services, and support split tunnelling (by IP address) so you only intercept traffic for your corporate servers.

SANS Security Awareness Work-from-Home Deployment Kit | SANS Security Awareness

https://www.sans.org/security-awareness-training/sans-security-awareness-work-home-deployment-kit

SANS Security Awareness Work-from-Home Deployment Kit From a comprehensive step-by-step guide on how to implement a remote security initiative across the organization to quick tips, videos and newsletters for individuals and families, the SANS Security Awareness Work-from-Home Deployment Kit covers everything you need to know to protect your business and your family. 

I was really torn on whether to include this or not. I like that this resource exists, I think the setting out the 3 different audiences, organisation leaders, individuals working from home, and parents is a great way to segment the guidance.

However, the guidance itself is ... well, rather poor. The deployment guide doesn't actually say anything, it's a lot of links to various other resources that SANS have provided. And while that's helpful to a degree, for an organisation leader who is trying to setup remote working from home, it might have been nice to pull those resources together into one pack for them.

Distributed Work’s Five Levels of Autonomy – Matt Mullenweg

https://ma.tt/2020/04/five-levels-of-autonomy/

The first level is where most colocated businesses are: there’s no deliberate effort to make things remote-friendly, though in the case of many knowledge workers, people can keep things moving for a day or two when there’s an emergency. More often than not, they’ll likely put things off until they’re back in the office. Work happens on company equipment, in company space, on company time. You don’t have any special equipment and may have to use a clunky VPN to access basic work resources like email or your calendar. Larger level one companies often have people in the same building or campus dialing into a meeting. Level one companies were largely unprepared for this crisis.

This is what I see in so many companies at the moment. The move has been to treat this extended quarantine as an extended "working from home day". But the way we think about work, about how we conduct meetings and how we continue to operate has to change fundementally to actually turn this into something that works long term.