Security researchers have released a paper documenting a large and complex operation, code named “Operation Windigo”. Since the campaign began in 2011, more than 25,000 Linux and Unix servers were compromised to steal Secure Shell (SSH) credentials, to redirect Web visitors to malicious content, and to send spam. Well-known organizations such as cPanel and Linux Foundation were confirmed victims. Targeted operating systems include OS X, OpenBSD, FreeBSD, Microsoft Windows, and various Linux distributions. The paper claims Windigo is responsible for sending an average of 35 million spam messages on a daily basis. This spam activity is in addition to more than 700 Web servers currently redirecting approximately 500,000 visitors per day to malicious content.

The paper lists three main malicious components (ESET detection names):

• Linux/Ebury – an OpenSSH backdoor used to control servers and steal credentials
• Linux/Cdorked – an HTTP backdoor used to redirect Web traffic
• Perl/Calfbot – a Perl script used to send spam

Lengthy campaigns by malicious attackers have become commonplace. With the appropriate resources, motivation, and desire, attackers can obtain significant rewards for their efforts. While some campaigns focus on targeting specific organizations to identify and exfiltrate sensitive information, the goal here was financial gain, by way of Web redirects, spam, and drive-by-downloads.
 

Symantec protection

Symantec customers are protected against malware used in Operation Windigo with the following signatures:

AV

• Backdoor.Trojan
• Linux.Cdorked
• Linux.SSHKit
• Linux.SSHKit!gen1
• Trojan.Dropper
• Trojan.Tracur!gen5
• Trojan.Tracur!gen8

IPS

• System Infected: Festi Rootkit Activity

More details on ESET’s discovery of Operation Windigo is available on their blog.

sslauditor, gui, sslchecker

「Operation Windigo」というコードネームの大規模かつ複雑な攻撃活動について報告したホワイトペーパーが、セキュリティ研究者によって公開されました。この攻撃が始まった 2011 年以来、25,000 台を超える Linux/UNIX サーバーが侵入を受けて、SSH（Secure Shell）資格情報を盗み出された結果、Web にアクセスしたユーザーが悪質なコンテンツにリダイレクトされ、スパム送信を送り付けられるようになりました。cPanel や Linux Foundation といった著名な組織も被害を受けていたことが確認されています。標的となるオペレーティングシステムは、OS X、OpenBSD、FreeBSD、Microsoft Windows、そして Linux の各種ディストリビューションです。発表されたホワイトペーパーによると、Windigo は毎日平均 3,500 万通のスパムメッセージを送信しています。このスパム活動のほかに、700 台以上の Web サーバーが現在、1 日当たりおよそ 50 万の訪問者を悪質なコンテンツにリダイレクトしています。

このホワイトペーパーでは、悪質なコンポーネントとして主に次の 3 つが挙げられています（名前は ESET 社の検出名）。

• Linux/Ebury - サーバーを制御し資格情報を盗み出すために使われる OpenSSH バックドア
• Linux/Cdorked - Web トラフィックのリダイレクトに使われる HTTP バックドア
• Perl/Calfbot - スパムの送信に使われる Perl スクリプト

悪質な攻撃者による長期的な攻撃活動も、最近では一般的になってきました。適切なリソースを持ち、何らかの動機や欲求があれば、攻撃者は労力に見合った十分な見返りを得ることができます。特定の組織を狙って、重要な情報を選定して盗み出すことを目的とする攻撃もありますが、Operation Windigo の目的は、Web リダイレクト、スパム、ドライブバイダウンロードによる金銭的な利益です。
 

シマンテックの保護対策

シマンテック製品をお使いのお客様は、以下のシグネチャによって、Operation Windigo で使われているマルウェアから保護されています。

ウイルス対策

• Backdoor.Trojan
• Linux.Cdorked
• Linux.SSHKit
• Linux.SSHKit!gen1
• Trojan.Dropper
• Trojan.Tracur!gen5
• Trojan.Tracur!gen8

侵入防止システム

• System Infected: Festi Rootkit Activity

ESET 社によって確認された Operation Windigo の詳しい内容は、ESET 社のブログで公開されています。

* 日本語版セキュリティレスポンスブログの RSS フィードを購読するには、http://www.symantec.com/connect/ja/item-feeds/blog/2261/feed/all/jaにアクセスしてください。

Last November, we found an Internet of Things (IoT) worm named Linux.Darlloz. The worm targets computers running Intel x86 architectures. Not only that, but the worm also focuses on devices running the ARM, MIPS and PowerPC architectures, which are usually found on routers and set-top boxes. Since the initial discovery of Linux.Darlloz, we have found a new variant of the worm in mid-January. According to our analysis, the author of the worm continuously updates the code and adds new features, particularly focusing on making money with the worm.

By scanning the entire Internet IP address space in February, we found that there were more than 31,000 devices infected with Linux.Darlloz.

Coin mining
In addition, we have discovered the current purpose of the worm is to mine cryptocurrencies. Once a computer running Intel architecture is infected with the new variant, the worm installs cpuminer, an open source coin mining software. The worm then starts mining Mincoins or Dogecoins on infected computers.  By the end of February 2014, the attacker mined 42,438 Dogecoins (approximately US$46 at the time of writing) and 282 Mincoins (approximately US$150 at the time of writing). These amounts are relatively low for the average cybercrime activity so, we expect the attacker to continue to evolve their threat for increased monetization.

The worm’s new coin mining feature only affects computers running the Intel x86 architecture and we haven't seen it impact IoT devices. These devices typically require more memory and a powerful CPU for coin mining. 

Why Mincoin and Dogecoin?
The worm appears to aim at mining Mincoins and Dogecoins, rather than focusing on the well-known and more valuable cryptocurrency Bitcoin. The reason for this is Mincoin and Dogecoin use the scrypt algorithm, which can still mine successfully on home PCs whereas Bitcoin requires custom ASIC chips to be profitable.

New targets
The initial version of Darlloz has nine combinations of user names and passwords for routers and set-top boxes. The latest version now has 13 of these login credential combinations, which also work for IP cameras, typically used for remote monitoring of premises.

Why IoT devices?
The Internet of Things is all about connected devices of all types. While many users may ensure that their computers are secure from attack, users may not realize that their IoT devices need to be protected too. Unlike regular computers, a lot of IoT devices ship with a default user name and password and many users may not have changed these. As a result, the use of default user names and passwords is one of the top attack vectors against IoT devices. Many of these devices also contain unpatched vulnerabilities users are unaware of.

While this particular threat focuses on computers, routers, set-top boxes and IP cameras, the worm could be updated to target other IoT devices in the future, such as home automation devices and wearable technology.

Blocking other attackers
As described in a previous blog, the worm prevents other attackers or worms, such as Linux.Aidra, from targeting devices already compromised with Linux.Darlloz. The malware author implemented this feature into the worm when it was released last November.

In early January, there were reports about a back door on a number of routers. By using the back door, remote attackers could gain access to the routers, allowing them to compromise the user’s network. For Darlloz’ author, this represented a threat, so they implemented a feature to block the access to the back door port by creating a new firewall rule on infected devices to ensure that no other attackers can get in through the same back door.

Infections in the wild
Once a device is infected, Darlloz starts a HTTP Web server on port 58455 in order to spread. The server hosts worm files and lets anyone download files through this port by using a HTTP GET request. We searched for IP addresses that open this port and host Darlloz files on static paths. Assuming that the Darlloz worm can be downloaded, we tried to collect OS finger prints of the host server. The following statistics give an overview of the infection.

• There were 31,716 identified IP addresses that were infected with Darlloz.
• Darlloz infections affected 139 regions.
• There were 449 identified OS finger prints from infected IP addresses.
• 43 percent of Darlloz infections compromised Intel based-computers or servers running on Linux.
• 38 percent of Darlloz infections seem to have affected a variety of IoT devices, including routers, set-top boxes, IP cameras, and printers.

Figure 1. The top five regions with Darlloz infections

The five regions that accounted for 50 percent of all Darlloz infections were China, the US, South Korea, Taiwan and India. The reason for the high infections in these regions is most likely due to their large volumes of Internet users or the penetration of IoT devices.

Infected IoT devices
Consumers may not realize that their IoT devices could be infected with malware. As a result, this worm managed to compromise 31,000 computers and IoT devices in four months and it is still spreading. We expect that the malware author will continue to update this worm with new features as the technology landscape changes over time. Symantec will continue to keep an eye on this threat.

Mitigation

• Apply security patches for all software installed on computers or IoT devices
• Update firmware on all devices
• Change the password from default on all devices
• Block the connection on port 23 or 80 from outside if not required

Recientemente, varios investigadores en seguridad presentaron un documento que describe una operación larga y compleja, denominada “Operación Windigo”. Desde 2011, año en que comenzó esta campaña, más de 25,000 servidores Linux y Unix han sido comprometidos para obtener las credenciales Secure Shell (SSH) con el fin de redireccionar a los usuarios web hacia contenido malicioso y para distribuir spam. Organizaciones muy conocidas, como cPanel y Fundación Linux han sido confirmadas como víctimas. Los sistemas operativos que han sido blanco de estos ataques incluyen a OS X, OpenBSD, FreeBSD, Microsoft Windows y varias distribuciones de Linux. El documento señala que Windigo es responsable de enviar diariamente un promedio de 35 millones de mensajes spam. Adicionalmente, más de 700 servidores Web han redireccionado a más de 500,000 visitantes diariamente hacia contenidos maliciosos.

Este documento enlista tres principales componentes maliciosos (detección de nombres de ESET):

• Linux/Ebury – un backdoor OpenSSH que se utiliza para controlar servidores y robar credenciales.

• Linux/Cdorked – un backdoor HTTP utilizado para redireccionar tráfico Web.

• Perl/Calfbot – un script Perl utilizado para enviar spam.

Las consistentes campañas de los agresores se han convertido en algo común. Con los recursos adecuados, motivación y deseo, quienes atacan pueden obtener recompensas importantes por estas acciones. Dichas actividades tienen el objetivo de atacar organizaciones específicas para identificar y filtrar información delicada, pero el objetivo nuevamente ha sido económico, a través de redirecciones Web, spam y descargas automáticas.

Protección de Symantec

Los clientes de Symantec están protegidos contra el malware utilizado en la Operación Windigo con las siguientes firmas:

AV

• Backdoor.Trojan
• Linux.Cdorked
• Linux.SSHKit
• Linux.SSHKit!gen1
• Trojan.Dropper
• Trojan.Tracur!gen5
• Trojan.Tracur!gen8

IPS

• System Infected: Festi Rootkit Activity

Más información sobre la investigación acerca de la Operación Windigo está disponible en el blog de ESET.

Internet security never looked the same after Netscape Communications created the SSL certificate in 1994. Looking at the Internet’s growing popularity then, it was easy to see it becoming a dangerous medium in not-so-distant future. Developers at Netscape took the cue and started putting in the effort to utilize strong encryption algorithms in the forming of an SSL certificate, to make sure the important data stored on the web is only seen by the intended parties. Thanks to their earnest efforts; today, Secure Socket Layer (SSL) certificates have become an integral element of website security, especially in case of e-commerce and banking websites.

SSL certificates are issued by Certificate Authorities (CAs), who manage security credentials and public keys for the actual message encryption. As Internet users became more aware of Cyber Security, SSL certificates became the most sought after solution to fight cyber crime. And it still is today, when it comes to safely securing a website. Which is why, the average buyer today is spoiled with the numerous CAs distributing a variety of SSL certificates in the market.

In comes Symantec, and now it is very easy for buyers to zero in on a highly qualified and proven CA for issuing a trusted SSL certificate. Over the years, Symantec has maintained its position of being the top trusted CA distributing SSL certificates worldwide.

Symantec – Behind the Brand

Founded by Gary Hendix in 1982, Symantec is headquartered today in Mountain View, California. Although Symantec was originally focused on projects related to artificial intelligence, which included database programming, etc. But its association with SSL certificate was established later on when the internet-security giant, VeriSign sold its unit of business for trust & authentication services to Symantec which not only included SSL certificates, but Public Key Infrastructure, Verisign Trust Seal & Verisign Identity Protection services.

Today Symantec is undoubtedly the most trusted SSL certificate provider that continues to work diligently to create tremendous brand equity and offer a unique blend of the latest technology, protection and efficient, yet extremely effective services to all its customers.

According to a survey conducted by Netcraft in April 2012, Symantec had issued the highest number of active SSL certificates in the world. 811,511 to be exact, installed SSL certificates that year put them ahead of the nearest competitor by a difference of more than 200,000 certificates. This clearly indicates Symantec’s leadership in the market of global SSL certificate. Current data has sustained Symantec’s market position which deepens the trust organizations have in Symantec.

SSL and Trust

Both these terms go hand in hand when we are talking about InternetSecurity. Certificate Authorities like Symantec go through highly meticulous audits to earn the recognition of a ‘trusted issuer’ of digital certificates. Before issuance, every certificate offered by Symantec is vetted carefully. No partners or third parties take up this verification process on behalf of Symantec.

Choosing a Certificate Authority is very important. Here, you need to know that its root is trusted in browsers and that the CA has reputation that will enhance the trust.

Symantec SSL Features

Apart from these efficient traits mentioned above, there are also few a Additional Features that add up to Symantec’s credentials.

• Strong Browser Compatibility: Symantec certificates are nearly 100% compatible with all the mobile and desktop browsers.
   
• Revocation & Replacement for Free: For all the certificates with same SAN numbers, revocation and replacement is available with management console free of cost.
   
• Symantec Trust Center Account: With a mere login you can now view the status of your order, manage malware scanning, renew an expired certificate or download a backup certificate.
   
• SAN Support: With Symantec, you can now include as many as 24 additional domains in the field of subject alternative names for Unified Communications and other uses. Installation Checker: Part of our free SSL tools, this applet is used to verify the correct installation of an SSL certificate.
   
• Internationalized Domain Name: You can secure your websites with IDN support.
   
• Unlimited Server Licensing: You can purchase licenses for multiple servers by hosting a single domain name. They are used for redundant server backups, server load balancing and SSL accelerators.

Security Seals – the backbone of Trust

Norton Secured Seal

This little black checkmark on an yellow circle has a capacity to incur a tremendous amount of trust coming from millions of web-users across the world. As per the Consumer Research, January 2011, the Norton Secured® Seal is recognized by almost 77% of consumers, when compared to other competing trust marks that are available on the web.

Assuring more than 40 million Norton Safe Web consumers that the site has been authenticated by Symantec, Norton Secured Seal offers significant value to Symantec customers, who display it. It is apparent after looking at the increase in consumers’ confidence & sale and a subsequent decrease in shopping cart abandonment. Over the years, the correct usage and placement of seal on the websites have built the value of the seal by establishing a familiar mark which is preferred by consumers.

The Norton Secured® Seal, when displayed on a website, a strong message is sent across that suggests that end-users’ identity will be protected by Symantec Internet Infrastructure. However, the placement of this seal on the website is also a significant aspect. Website owners need to place it on the site wherever it is that the visitors need to be assured about the site’s authenticity and security.

Symantec brand, in association with Norton provides all the consumers the ultimate confidence which is needed to execute online transactions and other activities on the Internet that requires integrity.

Seal-In-Search

All SSL certificates by Symantec come with this feature of ‘Seal-in-Search’ as a standard. This technology displays Norton’s Secured Seal placed next to your company details when you launch a search in a search engine.

Among all the other results listed by the search engine, the website with Seal-In-Search stands out. This leads to an increased number of click-through, sales and conversions. In fact, as per Symantec US Online Consumer Study, February 2011, 94% of people say they are more likely make a purchase after looking at Norton Secured Seal.

Along with the rise in cases of identity theft and cyber crimes, customers’ reluctance has heightened to browse a website that doesn’t look safe to them. Norton Secured Seal are viewed about half a billion times a day on more than 100,000 websites across 170 countries. This seal-placement suggests that that website is trusted by Symantec™. This increases the clicks for that website by almost 18.5%, as per TheFind.com.

Symantec Product Range

As we explore the extensive range of certificates offered by Symantec, the top-notch services and excellent variety offered here makes it quite obvious why Symantec achieves highest number of SSL certificates issued worldwide.

1. Symantec Secure Site Pro with EV

Enable Server Grated Cryptography (SGC) with this certificate to ensure strong encryption.

• Extended Validation with green address bar and organization name display
• Multi SAN certificate – Secures up to 25 domains
• 99.9% browser recognition
• Encryption level – 256-bit (even in old browsers)
• SGC Enabled
• Uses chained certificates
• Single Server – Additional server license can be purchased
• Assured Re-Issuance
• NetSure warranty of $1,500,000
• 30 Days money back guarantee
• Issuance Time – 2-3 week

2. Symantec Secure Site with EV

Get the Green-URL confidence with this certificate.

• EV; Green URL and display organization’s name
• Multi SAN certificate – secure up to 25 domains
• 99.9% browser recognition
• Encryption Strength – minimum 40-bit to 256-bit maximum.
• Free Norton™ Secured Seal, Installation Checker, Vulnerability Assessment, Malware Scanning & Actionable Report
• $1,500,000 warranty
• Chained certificates are used
• Single server – additional server licensees can be purchased
• Issuance Time – 2-3 weeks
• Free self-service re-issues.

3. Symantec Secure Site Pro

Protect your business against cyber threats with Symantec’s Secure Site Pro.

• 2048 bit root certificate and 256-bit encryption
• Free Norton™ Secured Seal, Installation Checker, Vulnerability Assessment, Malware Scanning & Actionable Report
• $1,250,000 warranty – it is the highest warranty for a non-EV certificate
• 99.9% mobile and browser compatibility
• Issuance Time > 2 days; Express delivery
• Full organization validation
• Private IP addresses allowed
• Secure multiple domains on a single IP address 
• Certificate reflects domain and business name

4. Symantec Secure Site

Acertain trust in customers with Symantec SSL certificates  

• Encryption Strength – 40-bit to 256-bit
• Up to 25 domains can be secured
• 99.9% mobile and browser compatibility
• Highest non-EV/ non-SGC warranty of $1,000,000
• Daily Malware scanning
• Chained certificates used
• Issued in less than 5 days
• Free, unlimited self-service re-issues and Installation Guides
• Customer Portal to manage new and existing orders
• 30 days money back guarantee
• Private IP address allowed
• Certificate shows Domain & Business details
• Free Installation Checker and Norton Secured Seal
• Secure multiple domains on single servers that support SNI

5. Symantec Code Signing Certificate

Shrink-wrap your code for safe distribution

• Authenticate processes to verify publisher identity
• Digital Signature available for Microsoft Authenticode, VBA and Office, Sun Java, Adobe AIR and Macromedia Shockwave
• Let your customers know your code is intact and safe to download
• It includes warranty of $125,000
• Get rid of disrupting security warnings
• Time-Stamping to lower the total cost
• Valid Code Signing certificate for Unlimited Signing
• Sign Kernel-Mode software and device drivers

6. Symantec Individual Code Signing Certificate

Safely distribute your trustworthy code on the web as an individual. Its traits and benefits are same as that found in thhe regular Code Signing Certificate mentioned above.

7. Symantec Secure Site Wildcard

Secure Multiple Domains with single certificate

• Efficiently secure unlimited number of sub-domains on single domain name
• 256-bit encryption
• 99.9% browser compatibility
• 30 days money back guarantee
• Warranty price $500,000
• Issuance Period: 1-2 days
• Free lifetime self-service reissues and Norton™ Secured Seal
• Option of Installation Support available

Last year, security reporter Brian Krebs discovered that a group of attackers managed to compromise multiple companies, steal sensitive customer data and sell the details through an online identity theft store known as SSNDOB. The attackers broke into the networks of a number of major consumer and business data aggregators as well as a software development firm. Krebs revealed that the attackers then put the stolen data for sale on SSNDOB, allowing their customers to buy personal details belonging to US and UK citizens.

Symantec looked into the attacks conducted by the group behind SSNDOB, who we call the Cyclosa gang. During our investigations, we managed to identify one of the owners of the service who claims in online forums to be Armand Arturovich Ayakimyan, a 24-year-old man from Abkhazia. As we looked further into this case, we learned how he started as a visitor to a cybercrime forum looking for information on how to conduct attacks to operating a major identity theft operation. Not only that, but Symantec also found that the Cyclosa gang breached a number of other firms, including a Georgian government agency, a credit union and a bank.

Who is Armand?
Armand was born on August 27, 1989 in Abkhazia, a disputed territory in the Caucasus that borders Russia and Georgia. Both Abkhazia and a number of other regions nearby were beset with conflicts between 1991 and 1993. One conflict was the War in Abkhazia from 1992 to 1993, a dispute involving Abkhazia and Georgia over the region’s independence. According to our research, Armand moved from the capital of Abkhazia, Sukhumi, to the nearby Russian city of Sochi in early 2010 just before launching SSNDOB.

On one of Armand’s social media profiles, which has since been deleted, he says he is skilled in Web development and IT. He also appears to be a fan of the online role player game EVE Online.

Armand appears to have made a few career moves throughout his adult life, including working in a photo studio and becoming a sales manager for a cosmetics firm. He also considered using his technical skills for legitimate work, as he discussed creating an online dating service and a real estate website for properties in Abkhazia. However, neither of these services became a reality. In 2013, Armand appeared to be working at a church in Russia.

Armand’s early cybercrime life
Before 2007, Armand may have been involved in fraud, targeting Australian citizens’ financial details. While Armand appeared to have some abilities to conduct cybercrime, he still needed to learn more to run bigger financial scams.  

In 2007, he registered an account on a cybercrime forum and asked other users for advice on how to steal people’s data through their unsecured WiFi connection. Another user told him to use a search engine to do more research on the matter, suggesting that Armand still had a lot to learn.

Towards the end of that year, Armand had started to sell stolen information, offering “fresh reports” on these forums for US$2.50. He continued to seek advice on a number of attack methods, such as how to hijack chat accounts.

In 2008, he began to explore the use of remote access Trojans to obtain information from compromised computers. He requested encryption services for the popular Pinch Trojan along with a joiner, which would allow him to hide the malware and bundle it with other programs. During this year, Armand began to target US and UK citizens, hoping to make more money in the process.

Partners in crime
At the start of 2009, evidence emerged of Armand’s partnership with three other people who used the handles “Tojava”, “JoTalbot” and “DarkMessiah” on cybercrime forums. There may be other players involved with this organization but these four individuals appear to be the main actors in this group. The four of them carried out numerous acts of cybercrime, such as conducting malware-based search engine optimization and pay-per-click schemes. They also bought and sold hijacked chat accounts, botnet traffic, and personal and financial information. Armand’s relationship with Tojava was vital for the formation of SSNDOB. Tojava was allegedly responsible for introducing Armand to the world of cybercrime and carding. We believe that Tojava created many of SSNDOB’s technical features, such as its search engine and its social security number query scripts.

Around this time, Armand said that he “found” access to a “large FTP site,” giving him a point of entry to several travel agencies’ websites. He asked other forum members for advice on how to make the most of this access. Two months later, Armand advertised the sale of a database of 75,000 to 85,000 expired Russian passports, along with FTP space or accounts and the “rights” to a compromised server. This may have been the Cyclosa gang’s first major breach of a company.

Establishing SSNDOB
Soon after the breach of the travel agencies, Armand and Tojava were seen expressing interest in opening an online identity theft store and seeking tools to check and process card payments. Along with this, the pair continued to update the Cyclosa gang’s attack capabilities, seeking malware that could wipe hard drives thoroughly enough to avoid police detection and looking into getting high volumes of US and UK botnet traffic.

By the end of the year, Armand registered SSNDOB’s first domain using, oddly enough, his real first and last name and his phone number. At the start of 2010, SSNDOB was officially open for business. It sold personal data records from US$0.50 to US$2.50 and offered credit and background checks from US$5 to US$15.

The breaches
To keep their store stocked, the Cyclosa gang had to continue to attack companies for their databases of personal data. Along with the major breaches covered in Krebs’ report, Symantec found that the Cyclosa gang compromised a number of other firms. In May 2012, the Cyclosa gang breached a US-based credit union. A few months later, they compromised a bank based in California, USA, and a Georgian government agency. While the Georgian agency may not have a lot of information pertaining to US and UK citizens, it’s possible that this attack was of personal interest to the Cyclosa gang, considering Armand’s background.

SSNDOB revealed
In March 2013, SSNDOB had a setback, as Krebs first exposed the store in an investigative report. Three days after Krebs released the article, Armand deleted his profile on European social network VK.

However, despite this, the Cyclosa gang did not stop their activities. They went on to register a new domain name for SSNDOB and compromised an employee’s computer at a Nigerian financial institution with a presence in the UK. Throughout 2013, the Cyclosa gang stole data from major data brokers, along with a software development company. Considering how the attackers’ continued to escalate their activities in 2013, this may not be the last we hear of the Cyclosa gang.

The following infographic charts the path Armand made, taking him from a one man operation to an organized cybercrime gang.

Symantec protection
Symantec has the following protections in place for the attacks mentioned in this blog:

AV

• Backdoor.Kopdel 

IPS

• System Infected: Backdoor.Kopdel Activity 

El año pasado, el reportero en temas de seguridad Brian Krebs, descubrió que un grupo de criminales logró comprometer a varias compañías, robar información sensible de sus clientes y vender los datos a través de una tienda clandestina de identidades en línea, conocida como SSNDOB. Los atacantes irrumpieron en las redes de importantes negocios que agregan y usan datos de clientes y empresas, así como a una compañía desarrolladora de software. Krebs dio a conocer que los ladrones pusieron a la venta la información robada en SSNDOB, permitiendo así que sus clientes pudieran adquirir datos confidenciales de diversos ciudadanos de los Estados Unidos y el Reino Unido.

Symantec investigó los ataques que llevó a cabo la banda responsable de SSNDOB, a quienes denominamos como grupo Cyclosa. Durante las investigaciones, localizamos a uno de los dueños de este servicio, quien en varios foros en línea se identifica como Armand Arturovich Ayakimyan, un hombre de 24 años, originario de la República de Abjasia. Al adentrarnos en el caso, aprendimos cómo este individuo comenzó a visitar un foro de crimen cibernético buscando información para poder llevar a cabo una operación masiva de ataques para el robo de identidades. Además, Symantec encontró que el grupo Cyclosa también accedió a varias firmas, incluyendo una agencia del gobierno de Georgia, una institución de crédito y un banco.

¿Quién es Armand?

Armand nació el 27 de agosto de 1989 en la República de Abjasia, un territorio ubicado en la vertiente suroccidental de la cordillera del Cáucaso que colinda con Rusia y Georgia. Abjasia y otras regiones sufrieron distintos conflictos de 1991 a 1993. Uno de ellos fue la disputa territorial con Georgia, buscando su independencia, conocido como la Guerra de Abjasia, (de 1992 a 1993). De acuerdo con nuestra investigación, se mudó de Sujumi, capital de Abjasia, a la ciudad de Sochi en Rusia, justo antes de lanzar la tienda SSNDOB.

Uno de los perfiles de Armand en las redes sociales, mismo que ha sido eliminado, menciona que tiene conocimientos en desarrollo Web y TI. También se declara fanático del juego de roles en línea llamado EVE Online.

Pareciera que Armand tuvo pocos movimientos durante su carrera profesional. Colaboró en un estudio fotográfico y fue gerente de ventas para una compañía de cosméticos. Además consideró utilizar sus conocimientos técnicos para trabajos legítimos, ya que escribió sobre la posible creación de un sitio de citas en línea y una página web de bienes raíces para comercializar propiedades en Abjasia. Sin embargo, ninguno de estos proyectos se hizo realidad. En 2013 parecía que Armand trabajaba para una iglesia en Rusia.

Los inicios de Armand en el cibercrimen

Antes de 2007, Armand pudo haber estado involucrado en un fraude enfocado en el robo de datos financieros de ciudadanos australianos. Comenzaba a mostrar sus habilidades en el cibercrimen, pero todavía tenía mucho que aprender para ejecutar fraudes de mayor dimensión.

En 2007 se registró en un foro de cibercrimen y solicitó consejo a otros usuarios sobre el robo de datos de personas a través de conexiones inseguras WiFi. Otro usuario le comentó que utilizara un buscador para investigar más sobre el tema, sugiriendo que Armand todavía tenía mucho que aprender.

Hacia finales de ese año, ya había comenzado a vender información robada, ofreciendo en dichos foros “reportes actualizados” a un precio de $2.50 dólares. Continuó solicitando consejos sobre varios métodos de ataque, así como posibles maneras de secuestrar cuentas de chats.

En 2008 comenzó a experimentar el uso de Troyanos de acceso remoto para obtener información de las computadoras afectadas. Además solicitó servicios de encriptación de datos para el famoso Troyano Pinch mediante un archivo adjunto que permitía ocultar el malware y ligarlo con otros programas. Durante ese año, Armand comenzó a atacar ciudadanos de los Estados Unidos y el Reino Unido, esperando obtener más dinero durante el proceso.

Sus cómplices

A principios de 2009, se encontró evidencia de la asociación de Armand con otras tres personas que utilizaban los pseudónimos “Tojava”, “JoTalbot” y “DarkMessiah” en los foros de cibercrimen. Es posible que hubiera más actores involucrados con la organización, pero estos cuatro individuos fueron identificados como los principales responsables del grupo. Los cuatro llevaron a cabo diversos actos de cibercrimen, como la optimización de motores de búsqueda basada en malware y esquemas de pago-por-click. Además adquirieron y vendieron cuentas de chat secuestradas, robots informáticos, así como información personal y financiera. La relación de Armand con Tojava fue clave para la creación de SSNDOB. Tojava fue el responsable de introducir a Armand al mundo del cibercrimen y los fraudes con tarjetas. Creemos que Tojava desarrolló muchas de las características técnicas de SSNDOB, como su motor de búsqueda y scripts que recopilaban números de seguridad social.

Durante esta etapa, Armand mencionó que había encontrado el ingreso a un “gran sitio FTP”, que le brindó un punto de acceso a los sitios web de varias agencias de viaje. Consultó a otros miembros del foro para saber cómo aprovechar al máximo este acceso. Dos meses después puso a la venta una base de datos de 75,000 a 85,000 pasaportes rusos vencidos, así como el acceso FTP, las cuentas y los “derechos” para ingresar a un servidor. Ésta pudo haber sido la primera brecha de seguridad de gran dimensión que logró Cyclosa.

La creación de SSNDOB

Poco tiempo después de haber comprometido a las agencias de viaje, Armand y Tojava mostraron interés en abrir una tienda en línea para vender identidades robadas y buscar más herramientas para revisar y procesar pagos con tarjetas de crédito. Junto con esto, ambos continuaron afinando la capacidad de ataque de Cyclosa, buscando malware que pudiera borrar a fondo los discos duros para no dejar evidencia alguna a las autoridades, así como alcanzar mayor volumen de tráfico a través de botnets en los Estados Unidos y el Reino Unido.

A finales de ese año, Armand registró el primer dominio de SSNDOB utilizando únicamente su nombre real, apellido y número telefónico. A principios de 2010 SSNDOB fue oficialmente abierta al público. La tienda vendió archivos con información personal con un precio que iba de $0.50 a $2.50 dólares y ofrecía datos crediticios y revisión de antecedentes a un costo de $5.00 a $15.00 dólares.

Las brechas de seguridad

Para mantener el inventario de la tienda, el grupo Cyclosa siguió atacando a compañías en busca de bases de datos con información personal. Además de las brechas que mencionó el reporte de Kreb, Symantec encontró que este grupo comprometió a diversas empresas. En mayo de 2012, Cyclosa atacó una unión crediticia con base en los Estados Unidos. Pocos meses después comprometieron a un banco con sede en California y a una agencia del gobierno de Georgia. Aunque esta agencia no contaba con información acerca de ciudadanos americanos y del Reino Unido, es posible que dicho ataque fuera de interés personal para Cyclosa, tomando en cuenta los antecedentes de Armand.

Revelan a SSNDOB

En marzo de 2013, SSNDOB tuvo su primer traspié cuando Kreb expuso a la tienda en un reporte de investigación. Tres días después de que Kreb presentó el artículo, Armand borró su perfil de la red social europea llamada VK.

Sin embargo, el grupo no dio marcha atrás. Registraron un nuevo domino para SSNDOB y comprometieron la computadora de un empleado de una institución financiera nigeriana con presencia en el Reino Unido. A lo largo de 2013 la banda robó información de varios agentes de datos así como de una compañía desarrolladora de software. Tomando en cuenta cómo estos criminales continuaron incrementado sus actividades en 2013, es muy posible que esta no sea la última vez que escuchemos acerca de Cyclosa.

La siguiente infografía muestra el camino de Armand, desde que inició operaciones de manera individual hasta que formó una banda organizada especializada en el cibercrimen.

Protección de Symantec

Symantec cuenta con protección para los ataques mencionados en este documento:

AV

• Backdoor.Kopdel

IPS

• System Infected: Backdoor.Kopdel Activity

Hello all,

Today I ran into the above mentioned problem whilst trying to perform a clean install of ITMS 7.5, so I thought I would share what worked and what didn't.

Windows 2008 SP1 R2 with SQL 2012 SP1.

SQL was initially configured for Windows Authentication.  When SIM failed, I manually created the database to no avail.

I then changed to mixed authentication and changed the SA account (as I obviously didn't know what the original one was) via the UI.  Unfortuantely, the SA account had the same problem.

What worked was running the following query:

USE master
GO
ALTER LOGIN [sa] WITH PASSWORD=N'NewSAPassword', CHECK_POLICY = OFF
GO
ALTER LOGIN [sa] ENABLE
GO

This allowed SIM to create the database and begin the installation phase.  Once ITMS 7.5 was installed, and the 9 hotfixes (required a rebot beforehand), I opened the Database Settings page and switched to the AppId so that Windows Authentication could be used again (I did the same for the reports too).

Hello all,

I have attached three English EULA's pertaining to Altiris Product's as it appears that the EULA's are not easily found.

The EULA associated with the SIM install itself.

The EULA for ITMS 7.5

The EULA for the 9 hotfixes that are available after installing ITMS 7.5

I hope that this blog is continuously updated by the community adding either new English EULA's or the existing EULA's in non-English languages.

This blog talks through the most common issues being raised with support, some handy hints and what our customers are saying about us.

Updates deployed to the Connect production servers as a result of the code sprint that ended 18 March 2014.

User Facing: Desktop

• Added the ability for blog administrators to enable a feature that exposes new links in the bottom of the "About this blog" box. Clicking the "Share this blog" link lets you share the entire blog using a selection of social media tools. "Follow this blog" adds an email subscription to your profile so you'll be notified, via email, whenever new blog posts are published to the target blog.
• Upgraded the rich-text editor. This updated version of the editor gives our design team greater control over what user-submitted formatting is accepted -- an important feature as we evolve the Connect experience into one that's responsive to different viewing devices.
• Fixed an issue with missing bullets on sidebar lists that appear on blog pages.
• Fixed an Omniture bug that will allow us to more closely monitor terms that our users are searching for.
• Removed the "Send this user an email" link from user profile pages when viewed by an anonymous user.
• Fixed some issues with broken event tracking in our Omniture code.

SEO Wins

• Added Twitter and Open Graph meta data to blog pages to increase their ability to interact with Social Networks and thereby improve the distribution of Connect messages.

just some musings on recent platform-level exploits.

昨年、セキュリティニュースのレポーター、ブライアン・クレブス（Brian Krebs）氏は、ある攻撃者グループが複数の企業に侵入して重要な顧客情報を盗み出し、オンラインの個人情報売買サイト SSNDOB で販売していることを発見しました。この攻撃者グループが侵入したのは、一般消費者や企業のデータの大手アグリゲータやソフトウェア開発企業など何社ものネットワークです。クレブス氏が明らかにしたところによると、このグループは盗み出したデータを SSNDOB に公開し、米国と英国の一般ユーザーに関する個人情報を販売していました。

シマンテックは、このグループが SSNDOB の背後で行っていた攻撃を調査し、このグループを「Cyclosa（ゴミグモ）」と命名しました。調査を進めるうちに、オンラインフォーラムでこのグループの中心的メンバーと目されている人物として、アブハジア在住の Armand Arturovich Ayakimyan という 24 歳の青年を特定しました。この事案をさらに調べると、この青年は大掛かりな個人情報窃盗の実行方法について情報を探っていたことをきっかけに、サイバー犯罪フォーラムに出入りするようになったことが判明しました。それだけでなく、Cyclosa グループが多数の企業や組織に侵入しており、なかにはグルジアの政府機関や信用組合、銀行なども含まれていることも突き止めています。

Armand の正体
Armand は 1989 年 8 月 27 日アブハジアで生まれました。ロシアとグルジアの国境付近、コーカサス地方の紛争地域です。アブハジアと周辺の諸地域は 1991 年から 1993 年にかけて紛争状態に突入します。そのひとつ、1992 年から翌 93 年のアブハジア戦争では、アブハジアとグルジアが同地域の独立をめぐって衝突しました。シマンテックの調査によると、Armand は 2010 年初めにアブハジアの首都スフミから、ほど近いロシアの町ソチに転居しています。これは SSNDOB 開設の直前のことです。

ソーシャルメディアでの自身のプロフィール（現在は削除されています）によると、Armand は Web 開発と IT に高いスキルを持っているとしています。また、オンラインロールプレイングゲーム『イブオンライン（EVE Online）』のファンでもあるようです。

成人後の Armand は、写真スタジオ勤務や化粧品会社の営業マネージャーなど職を転々とします。その一方、自分の技術スキルを正規の仕事に活かすことも考え、オンラインの出会い系サイトや、アブハジアの物件を扱う不動産業の Web サイトなども計画しましたが、どちらも実現までには至りませんでした。2013 年の時点で、Armand はロシアの教会で働いていたようです。

Armand の初期のサイバー犯罪歴
2007 年以前に、Armand はすでに詐欺行為に関与していたらしく、これはオーストラリアのユーザーの銀行口座情報を狙ったものでした。このとき Armand はサイバー犯罪を手掛ける技術を持っていたようですが、さらに大掛かりな金融詐欺を仕掛けるには、まだスキルが不足していました。

2007 年、Armand はサイバー犯罪フォーラムのアカウントを取得し、セキュリティで保護されていない Wi-Fi 接続を通じて個人情報を盗み出す方法を他のユーザーに尋ねています。フォーラムでは、Armand の未熟さをほのめかしつつ、その手の情報ならインターネット上を検索してもっと勉強すべきだという回答がありました。

その年の終わり頃、Armand はこのフォーラム上で「新鮮な情報」を謳い文句に、盗み出した個人情報を 2.5 米ドルで売り始めます。その間も、チャットアカウントを乗っ取る方法など、さまざまな攻撃手法についてアドバイスを求める投稿を続けていました。

2008 年になると、リモートアクセス型のトロイの木馬を使って、侵入したコンピュータから情報の収集を始めます。当時流行していたトロイの木馬 Pinch とその協力者に暗号化サービスを依頼し、マルウェアを秘匿して他のプログラムに紛れ込ませようとしました。Armand が、さらに儲けをあげるべく米国と英国のユーザーを標的にし始めたのも、同じ年のことです。

共犯者
2009 年の初頭、Armand はサイバー犯罪フォーラムでそれぞれ「Tojava」、「JoTalbot」、「DarkMessiah」と名乗る 3 人の人物と共犯関係にあるという証拠が見つかりました。この組織にはほかにも関与していた人物がいるかもしれませんが、このグループの中心は明らかにこの 4 人です。4 人はマルウェアベースの検索エンジン最適化、ペイパークリック攻撃など、膨大なサイバー犯罪行為を実行したほか、乗っ取ったチャットアカウント、ボットネットトラフィック、個人情報や銀行口座情報なども売買していました。Armand と Tojava の関係が、SSNDOB の成立に大きく関わっています。Tojava は、Armand をサイバー犯罪とカード詐欺の世界に引きずり込んだ張本人と目されています。検索エンジンや社会保障番号のクエリースクリプトなど、SSNDOB の技術機能の多くは Tojava が作ったものとシマンテックは考えています。

この前後に、Armand は「大規模な FTP サイト」へのアクセス方法を「発見」し、何社かの旅行代理店の Web サイトに出入りできるようになったと述べています。そうしたアクセス権を最大限に活用する方法についても、Armand はフォーラムでアドバイスを求めていました。2 カ月後、Armand は 75,000 件から 85,000 件ものロシアの期限切れパスポートのデータベースを、FTP サイトまたはアカウントと、侵入したサーバーへの「アクセス権」とともに販売するという広告を掲載しています。Cyclosa グループが大々的に企業に侵入した最初のきっかけが、このデータベースだったようです。

SSNDOB の誕生
旅行代理店に侵入した直後、Armand と Tojava はオンラインの個人情報売買サイトを開設する意図を示し、カード決済をチェックして処理するツールも検討し始めました。それと同時に、2 人は Cyclosa グループの攻撃機能についても強化を続け、警察でさえ検知できないほど徹底的にハードディスクの内容をワイプ（消去）するマルウェアを開発したり、米国と英国で大量のボットネットトラフィックを取得したりといった活動に取り組んでいます。

この年の終わり頃、Armand は SSNDOB の最初のドメインを取得しますが、その登録に本名（フルネーム）と実際の電話番号を使っていたのは、不思議としか言いようがありません。2010 年に入って、SSNDOB は正式に業務を開始します。0.5 ～ 2.5 米ドルで個人情報を販売したほか、クレジットカード情報や身元調査情報も 5 ～ 15 米ドルで提供していました。

データ侵害
SSNDOB の在庫を維持するために、Cyclosa グループは企業を攻撃して個人情報のデータベースを盗み出し続ける必要がありました。クレブス氏のレポートに記載されている大々的なデータ侵害のほかにも、シマンテックは Cyclosa グループが多くの企業に侵入したことを確認しています。2012 年 5 月には、Cyclosa グループは米国に拠点を置く信用組合に侵入し、その数カ月後には、米国カリフォルニア州の銀行と、グルジアの政府機関にも侵入しています。グルジアの政府機関に米国や英国のユーザーに関する情報がそれほど多く記録されているとは思えませんが、Armand の経歴からすると、この攻撃には Cyclosa グループの個人的な意図があったとも考えられます。

正体を現した SSNDOB
2013 年 3 月、SSNDOB はついに失策を犯しました。それを最初に伝えたのが、情報売買サイトに関するクレブス氏の調査報告です。クレブス氏がこれを報じた 3 日後、Armand はヨーロッパのソーシャルネットワークサイト VK からプロフィールを削除しています。

にもかかわらず、Cyclosa グループがその活動を停止することはありませんでした。SSNDOB のために新しいドメイン名を取得し続け、英国に拠点を持つナイジェリアの金融機関の従業員のコンピュータにも侵入しています。2013 年を通じて、Cyclosa グループは主要なデータブローカーやソフトウェア開発企業からデータを盗み出し続けました。2013 年にも活動がエスカレートし続けたことを考えると、Cyclosa グループの息の根が止まったとは言えないのかもしれません。

単独犯の時代から、組織化されたサイバー犯罪グループに至るまで、Armand が辿ってきた経歴を以下の図にまとめました。

シマンテックの保護対策
シマンテックは、今回お伝えした攻撃から保護するために、以下の保護対策を提供しています。

ウイルス対策

• Backdoor.Kopdel

侵入防止システム

• System Infected: Backdoor.Kopdel Activity

* 日本語版セキュリティレスポンスブログの RSS フィードを購読するには、http://www.symantec.com/connect/ja/item-feeds/blog/2261/feed/all/jaにアクセスしてください。

There is a growing chorus of voices calling for businesses and home users to upgrade existing Windows XP installations to newer versions of Windows, if not for the features, then at least for the improved security and support. ATMs are basically computers that control access to cash, and as it turns out, almost 95 percent of them run on versions of Windows XP. With the looming end-of-life for Windows XP slated for April 8, 2014, the banking industry is facing a serious risk of cyberattacks aimed at their ATM fleet. This risk is not hypothetical — it is already happening. Cybercriminals are targeting ATMs with increasingly sophisticated techniques. 

In late 2013, we blogged about new ATM malware in Mexico, which could let attackers force ATMs to spew cash on demand using an external keyboard. That threat was named Backdoor.Ploutus. Some weeks later, we discovered a new variant which showed that the malware had evolved into a modular architecture. The new variant was also localized into the English language, suggesting that the malware author was expanding their franchise to other countries. The new variant was identified as Backdoor.Ploutus.B (referred to as Ploutus throughout this blog).  

What was interesting about this variant of Ploutus was that it allowed cybercriminals to simply send an SMS to the compromised ATM, then walk up and collect the dispensed cash. It may seem incredible but this technique is being used in a number of places across the world at this time.

In this blog, we will show you how this functionality works.

Figure 1. How attackers withdraw cash from an ATM using a phone

Connecting a mobile phone to the ATM
The criminals can remotely control the ATM by using a mobile phone which is connected to the inside of the ATM. There are multiple ways to connect a mobile phone to an ATM. A common method is to use a setup called USB tethering, which is effectively a shared Internet connection between a phone and a computer (or in this case, an ATM). 

The attackers need to set the phone up correctly, connect it to the ATM and infect the ATM with Ploutus. Once all of these steps are complete, a full two-way connectivity is established and the phone is ready to be used. 

Since the phone is connected to the ATM through the USB port, the phone also draws power from the connection, which charges the phone battery. As a result, the phone will remain powered up indefinitely. 

Sending SMS messages to the ATM
After the mobile phone is connected to the ATM and set up is completed, the criminals can send specific SMS command messages to the phone attached inside the ATM. When the phone detects a new message under the required format, the mobile device will convert the message into a network packet and will forward it to the ATM through the USB cable.

The network packet monitor (NPM) is a module of the malware which acts as a packet sniffer, watching all network traffic going on in the ATM. As soon as the compromised ATM receives a valid TCP or UDP packet from the phone, the NPM will parse the packet and search for the number “5449610000583686” at a specific offset within the packet in order to process the whole package of data. Once that specific number is detected, the NPM will read the next 16 digits and use them to construct a command line to run Ploutus. An example of such a command is shown below: 

cmd.exe /c PLOUTOS.EXE 5449610000583686=2836957412536985

In previous versions of Ploutus, the master criminal would have to share these digits with the money mule, which could allow the money mule to defraud the master criminal if they realize what the code allows them to do. In this version of Ploutus, the mule never sees the 16 digits, giving the master criminal added security and the ability to centrally control cash withdrawals. The code is active for 24 hours.

Using SMS messages to remotely control the ATM is a much more convenient method for all of the parties in this scheme, because it is discrete and works almost instantly. The master criminal knows exactly how much the money mule will be getting and the money mule does not need to linger for extended periods around an ATM waiting for it to issue the cash. The master criminal and money mule can synchronize their actions so that the money is issued just as the money mule pretends to withdraw cash or is walking past the ATM.

Putting it all together
Now that we have looked into the details of how this scheme works, here’s an overview of how it all fits together.

Figure 2. Ploutus ATM attack overview

Process overview

1. The attacker installs Ploutus on the ATM and connects a mobile phone to the machine with a USB cable.
2. The controller sends two SMS messages to the mobile phone inside the ATM.
   1. SMS 1 must contain a valid activation ID in order to enable Ploutus in the ATM.
   2. SMS 2 must contain a valid dispense command to get the money out.
3. The phone detects valid incoming SMS messages and forwards them to the ATM as a TCP or UDP packet.
4. In the ATM, the network packet monitor module receives the TCP/UDP packet and if it contains a valid command, it will execute Ploutus.
5. Ploutus causes the ATM to spew out the cash. The amount of cash dispensed is pre-configured inside the malware.
6. The cash is collected from the ATM by the money mule.

We were able to replicate this attack in our lab with a real ATM infected with Ploutus, so we can show you this attack in action in our short video.

While in this demonstration, we are using the Ploutus malware, Symantec Security Response has found several different forms of malware that are targeting ATMs. In the case of Ploutus, the attackers are trying to steal the cash from inside the ATM; however, some malware we have analyzed attempts to steal the customers' card information and PIN while other malicious software lets criminals attempt man-in–the-middle attacks. Clearly, attackers have different ideas on how best to make money from an ATM.

What can be done to protect ATMs?
Modern ATMs have enhanced security features, such as encrypted hard-drives, which can prevent these types of installation techniques. However, for older ATMs still running on Windows XP, protecting against these types of attacks is more challenging, especially when the ATMs are already deployed in all sorts of remote locations. Another difficulty that needs to be addressed is the physical security of the computer inside the ATMs. While the ATM’s money is locked inside a safe, the computer generally is not. Without adequate physical security for these older ATMs, the attacker has the upper hand.  

A number of measures could be taken to make things more difficult for the criminals. These include:

• Upgrading to a supported operating system such as Windows 7 or 8
• Providing adequate physical protection and considering CCTV monitoring for the ATM
• Locking down the BIOS to prevent booting from unauthorized media, such as CD ROMs or USB sticks
• Using full disk encryption to help prevent disk tampering
• Using a system lock down solution such as Symantec Data Center Security: Server Advanced (previously known as Critical System Protection)

With all these measures in place, attackers would find it much harder to compromise an ATM without a complicit insider. 

Symantec’s consumer, endpoint and server protection solutions will continue to support Windows XP systems for the foreseeable future; however, we strongly recommend that Windows XP users should upgrade to a more current operating system as soon as possible.

Do you worry about how to get all your email data migrated to a new environment? Often times companies don't always keep up to date with Enterprise Vault service packs and an environment may lag behind.  First one version behind, then a second, then maybe even a third.  It's a vicious cycle and in the end when it's down by a couple of version it becomes quite a scarey and/or difficult proposition to upgrade it.

So what do you do?

Move Arhive sometimes get a bad press, but, it's certainly possible to use it to migrate to a whole new environment.  Exporting to PST and importing from PST throughout the day and night for weeks isn't very appealing.  Both are possibilities if you've got the money and the time to setup a whole new environment.

But is that really it?

A better way does exist, and it'll make your migration a breeze.

There are several third party tools which exist which can be used to perform a migration to a new environment. I'm most familiar with Archive Shuttle, and if you need to skip many versions of EV, and want to go to a whole new, pristine environment, you should go for something like Archive Shuttle.  Of course you'll need to take into all your wants and needs during the migration, but the product is mature, and rich with features. It's also robust at what it migrates and pretty darn fast too.

So if you can't keep Enterprise Vault up to date, and you have to migrate to a new environment, what would you do?

Actualmente hay una voz, cada vez más insistente, pidiéndole a las empresas y los usuarios de casa que actualicen su Windows XP a una versión más nueva de Windows. Se dice que, si no es por las funciones, que sea al menos para mejorar el soporte y la seguridad de su sistema operativo. En este sentido vale la pena recordar que los cajeros automáticos son prácticamente computadoras que controlan el acceso al dinero en efectivo, y resulta que muchos de ellos funcionan con versiones de Windows XP. Con el inminente fin del soporte para Windows XP programado para el 8 de abril de 2014, la industria bancaria enfrentará el riesgo de sufrir ataques informáticos dirigidos sus cajeros automáticos. Este riesgo no es hipotético y ya se ha hecho presente y se ha identificado que delincuentes informáticos están atacando cajeros automáticos con técnicas cada vez más sofisticadas.

Hacia fines de 2013, publicamos en el blog un artículo sobre un nuevo malware para cajeros automáticos en México, que les permitía a los atacantes forzarlos para que expidieran efectivo utilizando un teclado externo. Esta amenaza recibió el nombre de Backdoor.Ploutus. Semanas después, descubrimos una nueva variante que mostraba que el malware había evolucionado para transformarse en una arquitectura modular. Adicionalmente, la nueva variante también estaba disponible en idioma inglés, lo que indicó que el autor del malware estaba expandiendo su franquicia hacia otros países. La nueva variante se identificó como Backdoor.Ploutus.B (denominado Ploutus para fines de este blog).

Lo interesante de la nueva investigación que hicimos sobre Ploutus es que esta variante les permitía a los ciberdelincuentes enviar un simple mensaje de texto al cajero automático afectado, para luego dirigirse al mismo y recoger el dinero entregado por el aparato. Esto puede parecer increíble pero esta técnica se está empleando en varios lugares del mundo en este momento y en este blog compartiremos cómo funciona esto.   

Figura 1. Forma en que los atacantes retiran dinero de un cajero automático utilizando un teléfono.

Conectar un teléfono móvil al cajero automático

Los delincuentes informáticos pueden controlar el cajero automático de forma remota utilizando un teléfono móvil que está conectado en el interior del cajero automático. Existen varias formas de conectar un teléfono móvil a un cajero automático. Un método muy común es utilizar una configuración llamada USB tethering (conexión de dispositivos), que es efectivamente una conexión a Internet compartida entre el teléfono y la computadora (o en este caso, el cajero automático).

Los atacantes deben configurar el teléfono correctamente, conectarlo al cajero automático e infectar el cajero con Ploutus. Una vez realizados todos estos pasos, se establece una conexión bidireccional y el teléfono está listo para ser utilizado.   

Dado que el teléfono está conectado al cajero automático a través de un puerto USB, el teléfono consume energía de la conexión, lo que permite cargar la batería, y por lo tanto, el teléfono puede permanecer encendido indefinidamente.    

Envío de mensajes de texto al cajero automático

Tras conectar el teléfono móvil al cajero automático y de completar la configuración, los delincuentes pueden enviar comandos específicos por mensaje de texto al teléfono conectado dentro del cajero automático. Cuando el teléfono detecta un nuevo mensaje en el formato requerido, el dispositivo móvil convierte el mensaje en un paquete de red y lo reenvía al cajero automático a través del cable USB.

El monitor del paquete de red (NPM, por sus siglas en inglés) es un módulo del malware que actúa como un rastreador y vigila todo el tráfico de la red en el cajero. En cuanto el cajero afectado recibe un paquete válido TCP (Protocolo de Control de Transmisión) o UDP (Protocolo de Datagrama de Usuario)  desde el teléfono, el NPM analiza el paquete y busca el número “5449610000583686” en un ajuste específico dentro del paquete para poder procesar todo el paquete de datos. Una vez detectado ese número específico, el NPM lee los siguientes 16 dígitos y los utiliza para crear una línea de comando para ejecutar Ploutus. Este es un ejemplo de dicho comando o instrucción sigue a continuación:         

cmd.exe /c PLOUTOS.EXE 5449610000583686=2836957412536985

En las versiones anteriores de Ploutus, el delincuente principal debía informarle estos dígitos al encargado o cómplice que recogía el dinero, lo que le daba la oportunidad de estafar al delincuente principal si supiera lo que el código les permite hacer. En esta versión de Ploutus, el cómplice nunca ve los 16 dígitos, lo que le da al delincuente principal la seguridad y la capacidad de tener control total de los retiros de dinero. El código permanece activo durante 24 horas.

El uso de mensajes SMS para controlar cajeros automáticos de forma remota es un método mucho más conveniente para todas las partes involucradas en esta estafa, dado que es discreto y funciona prácticamente de forma instantánea. El delincuente principal sabe exactamente cuánto dinero recogerá su enviado y, a su vez, quien va por el dinero no necesita quedarse merodeando cerca del cajero automático esperando a que salga el efectivo. El delincuente principal y su cómplice pueden actuar de forma sincronizada para que el dinero sea expedido en el momento exacto en que la persona simule retirar dinero o pase caminando frente al cajero automático.   

La suma de los factores del ataque

Ahora que conocemos en detalle cómo funciona esta estafa, este es un resumen del ataque completo:

Figura 2. Resumen del ataque Ploutus a cajeros automáticos

Recapitulación del proceso

1. El atacante instala Ploutus en el cajero automático y conecta un teléfono móvil a la máquina con un cable USB.
2. El delincuente envía dos mensajes de texto al teléfono móvil que está conectado al cajero.
   
   1. SMS 1 debe contener un ID de activación válido para poder activar Ploutus en el cajero.
   2. SMS 2 debe contener un comando válido para activar la entrega del dinero y poder retirar el efectivo.
3. El teléfono detecta los mensajes de texto válidos recibidos y los reenvía al cajero automático como si fuera un paquete TCP o UDP.
4. Dentro del cajero, el módulo del monitor del paquete de red recibe el paquete TCP/UDP y, si contiene un comando válido, ejecuta Ploutus.
5. Un cómplice recoge físicamente el dinero del cajero automático.

Pudimos reproducir este ataque en nuestros laboratorios con un auténtico cajero automático infectado con Ploutus. En este breve video le mostramos cómo funciona este ataque.

Si bien en esta demostración utilizamos el malware Ploutus, Symantec Security Response ha descubierto otros códigos maliciosos que están atacando a los cajeros automáticos. En el caso de Ploutus, el objetivo de los atacantes es robar dinero desde adentro del cajero, sin embargo, otros códigos que hemos analizado intentan robar el PIN y los datos de la tarjeta del cliente, mientras que algunos intentan concretar ataques de tipo “hombre en medio” (“man in the middle”). Es evidente que los atacantes tienen varias ideas de cómo robar dinero de un cajero automático. 

¿Qué podemos hacer para proteger los cajeros automáticos?

Los cajeros automáticos modernos cuentan con medidas de seguridad avanzadas, como los disco duros encriptados, que pueden evitar estos tipos de técnicas de instalación. Sin embargo, en el caso de los cajeros más antiguos que funcionan con Windows XP, la protección contra estos tipos de ataques es más complicada, en especial cuando los cajeros automáticos ya están en funcionamiento en varias ubicaciones remotas. Otro inconveniente que se debe enfrentar es la seguridad física de la computadora instalada en el cajero. Si bien el dinero en los cajeros está dentro de una caja fuerte, por lo general la computadora no está protegida. Sin un sistema de seguridad física adecuado, el atacante tiene una amplia ventaja sobre los cajeros automáticos, especialmente los más viejos.     

Algunas medidas que recomendamos considerar para complicar la tarea a los delincuentes son:

• Actualizar el sistema operativo por uno que tenga un soporte adecuado, como Windows 7 u 8.
• Contar con una protección física adecuada y pensar en la posibilidad de instalar cámaras de seguridad en los cajeros.
• Asegurar el BIOS (Sistema Básico de Entrada/Salida) para evitar que se inicien medios no autorizados, como los CD-ROM o memorias USB.
• Realizar un cifrado completo del disco para evitar su manipulación.
• Utilizar una solución de bloqueo de sistema, como Symantec Data Center Security: Service Advanced (conocida anteriormente como Critical System Protection).

Combinando estas medidas de seguridad, le será muy difícil a los atacantes infectar un cajero automático sin la ayuda de un cómplice infiltrado.

Las soluciones de seguridad para consumidores, endpoint sy protección de servidores seguirán soportando los sistemas Windows XP, sin embargo recomendamos a los usuarios de dicho sistema operativo mirar a uno más actual lo más pronto posible para reducir los riesgos.

The Symantec Validation and ID Protection Service (VIP) Enterprise Gateway v9.4 has been released, featuring a newly branded user interface, co-branded self-service portal login page, and LDAP synchronization enhancements.

Feature Highlights

Newly branded administrator interface

• New menu navigation bar helps you locate the configuration options easily
• Configuration Summary page displays configurations you have performed and a Manage link to start managing the configurations
• Actionable triggers in the service summary page, showing service status

Brand the Self-Service Portal with your organization’s logo

• Ability to brand the self-service portal login page, in addition to the end user Manage Your Credentials page.
• Complements the rebrand of VIP Manager in December

LDAP synchronization enhancements

• Configure multiple instances of LDAP Directory Synchronization Service to support load balancing and failover, multi-server User Stores, and third-party User Stores
• Ability to synchronize additional, optional attributes from the User Store to help administrators more easily search and identify users in VIP Manager       

Additional Features for VIP Enterprise Gateway

• Sign in to the Enterprise Gateway console with enterprise LDAP directory credentials
• Logging framework has been enhanced to better group and display log messages

Technical Support

We value your business and are committed to customer care.  Please contact us if we can assist or answer any questions. Symantec Support can be reached via email at: enterprise_vipsupport@symantec.com or by phone at +1-520-477-3104 or 1-800-579-2848. You can also visit the VIP support Knowledge Center.

Don’t forget to follow us on Twitter: @SymantecVIP

This is the final part of a four-part series covering twelve fundamentals for choosing a managed PKI solution, and questions to ask in the buying process.

In part 3 of our PKI blog series, we identified several features that simplify administration of a managed PKI. This week, we address mobility. It is arguably the most popular use case that enterprises struggle with today. Organizations are tasked with integrating and supporting mobile devices into the corporate network as part of a BYOD strategy. While mobile devices increase productivity and provide new ways for workforces to collaborate, they also introduce unique security challenges that keep CISOs and Security departments awake at night. In response to these challenges, enterprise security teams are turning to PKI to address security within their mobile strategies.

12. Mobile Device Support

To start, IT needs a way to securely identify and authenticate the deviceon the network; via WiFi, VPN, or from within an application. This is primarily accomplished using a digital certificate issued to the user or device. The Symantec Managed PKI is the only platform on the market that provides out-of-the-box certificate enrollment to mobile devices either natively (iOS) or in conjunction with a PKI client (Android). Built-in workflows enable certificate registration and delivery of configuration settings for VPN, ActiveSync, and other application settings. Companies can choose to leverage a set of built-in options, or upload their own .mobileconfig file. While many organizations have already made an investment in an MDM solution, many have not, or require a simple solution to deploy certificates to mobile devices. Delivering the certificate and automatically configuring settings on the device ensures fewer helpdesk calls and a better end user experience.

In addition, Symantec Managed PKI has the ability to extend secure email capabilities by delivering an S/MIME certificate as part of the configuration sent to the device. If the user has an existing S/MIME certificate enrolled on their corporate laptop or desktop, it is automatically recovered so the user has the same publicly trusted S/MIME certificate on all of their devices. Symantec can automatically publish this certificate in the corporate directory so it can be leveraged by the organization.

These examples demonstrate how the Symantec Managed PKI is enabling the enterprise to securely leverage mobile devices through the use of a simple, yet powerful, workflow. No other Managed PKI in the market today offers such a broad range of out-of-the-box workflows and capabilities associated with Mobile devices. However, for organizations that have an MDM, Symantec Managed PKI integrates with leading solutions from Symantec, AirWatch, MobileIron, and more.

Known as App Center, Symantec’s Mobility Management Suite extends additional security to mobile devices and information they contain. App Center provides an organization with comprehensive MDM controls and goes beyond these traditional measures to offer Mobile Application Management (MAM) and Mobile Information Management (MIM) all from a single management console in an on-premise or SaaS deployment model. Look to hear more about this powerful mobile suite in upcoming posts.

Questions to Ask

As a quick recap, here are a few things to remember when looking for a managed PKI to bolster mobile security.

1. Does it offer simple built-in workflows to enable mobile device configuration?
2. Does it offer documented and tested integrations with leading MDM providers?
3. Does it support the delivery and management of multiple certificates types on a device?
4. Does it offer advanced S/MIME capabilities?

Microsoft posted a security advisory today for a newly discovered, unpatched vulnerability affecting Microsoft Word. An attacker could take advantage of the Microsoft Word Remote Memory Corruption Vulnerability (CVE-2014-1761) to gain remote access to the targeted computer. The advisory indicates that the vulnerability was exploited in limited, targeted attacks. 

Users should not only be cautious about opening unknown RTF documents, but they should also avoid previewing these files in Outlook, as doing so could let the attackers exploit the vulnerability. Be aware that the default viewer for RTF documents attached to emails in several versions of Outlook is Microsoft Word. 

While patches have not yet been made available, users can apply several workarounds to minimize the risk of exploitation. Microsoft has provided a Fix it solution, which disables the ability to open RTF content in Microsoft Word. Users can also configure Outlook to display emails only in plain text format to mitigate the issue.

Microsoft has confirmed that its Enhanced Mitigation Experience Toolkit (EMET) successfully blocks the exploit. This could be an alternative solution if other workarounds cannot be applied.

Users are advised to apply patches as soon as they are made available by the vendor.

Symantec Security Response offers the following detections to protect our customers from the CVE-2014-1761 exploit. 

AV

• Bloodhound.Exploit.550

IPS

• System Infected: Fraudulent Digital Certificate

We are currently working on additional coverage and will update this blog in due course with more details.