Why Your Organization Should Replace All TLS Certificates Issued by Symantec

October 2018 is a crucial month for anyone owning a website as two of the world’s biggest browsers, Chrome and Firefox, will “distrust” TLS certificates issued by Symantec.

What Is a TLS Certificate?

TLS stands for Transport Layer Security. This technology is meant to keep the internet connection secure by encrypting the information sent between the website and the browser, preventing cybercriminals from reading and modifying any information that’s being transferred.

The more popular TLS isn’t free. A website owner has to buy this technology – referred to as TLS certificate – from any of the companies trusted by browsers. Symantec was once a trusted issuer of TLS certificates by Google, the owner of Chrome, and Mozilla, the organization behind Firefox.

HTTPS, which stands for Hyper Text Transfer Protocol Secure, appears in the URL when a website uses a TLS certificate. Google has also been rewarding websites using TLS certificates with improved web rankings. As of July 2018, according to Mozilla, 3.5% of the top 1 million websites were still using Symantec TLS certificates.

When a visitor attempts to connect to a website, the browser used by the visitor requests the site to identify itself. The site then sends the browser a copy of its TLS certificate. The browser, in return, checks if this TLS certificate is a trusted one. If the browser finds that the TLS certificate can be trusted, the browser then sends back a digitally signed acknowledgment to start the TLS encrypted session.

Reasons Behind the Distrust of Symantec TLS Certificates

In March 2017, Ryan Sleevi, software engineer at Google Chrome, posted on an online forumGoogle’s findings, alleging that Symantec failed to properly validate TLS certificates. Sleevi said that Symantec mis-issued 30,000 TLS certificates over a period spanning several years.

“Symantec allowed at least four parties access to their infrastructure in a way to cause certificate issuance, did not sufficiently oversee these capabilities as required and expected, and when presented with evidence of these organizations’ failure to abide to the appropriate standard of care, failed to disclose such information in a timely manner or to identify the significance of the issues reported to them,” Sleevi said.

Symantec, for its part, said that Google’s allegations are “exaggerated and misleading”. “Google’s statements about our issuance practices and the scope of our past mis-issuances are exaggerated and misleading,” Symantec said. “For example, Google’s claim that we have mis-issued 30,000 SSL/TLS certificates is not true. In the event Google is referring to, 127 certificates – not 30,000 – were identified as mis-issued, and they resulted in no consumer harm. We have taken extensive remediation measures to correct this situation, immediately terminated the involved partner’s appointment as a registration authority (RA), and in a move to strengthen the trust of Symantec-issued SSL/TLS certificates, announced the discontinuation of our RA program.”

Mozilla, for its part, conducted its own investigation surrounding Symantec’s issuance of TLS certificates. Mozilla said it found a set of issueswith Symantec TLS certificates. A consensus proposalwas reached among multiple browser makers, including Google and Mozilla, for a gradual distrust of Symantec TLS certificates.

On October 31, 2017, DigiCert, Inc. acquired Symantec’s website security business, and on December 1, 2017 DigiCert took over the validation and replacement of all Symantec TLS certificates, including TLS certificates issued by Symantec’s subsidiaries: Thawte, GeoTrust and RapidSSL.

“DigiCert will replace all affected certificates at no cost,” DigiCertsaid in a statement. “Additionally, you don’t need to switch to a new account/platform. Continue to use your current Symantec account to replace and order your SSL/TLS certificates.” 

Implications of the Distrust of Symantec TLS Certificates

Mozillasets October 23, 2018 as the distrust date of all TLS certificates issued by Symantec. Googlesets October 16, 2018 as the distrust date for all TLS certificates issued by Symantec to non-enterprise users, while January 1, 2019 is the distrust date set by Google for all TLS certificates issued by Symantec to enterprise users. Apple, the owner of the Safari browser, sets “Fall 2018” as the date of complete distrust of Symantec TLS certificates.

In the case of Chrome, if website owners fail to replace their Symantec TLS certificates beyond the prescribed period by Google, the message below will be shown instead:

Image by Google

In the case of Firefox, the message below will be shown instead:

Image by Mozilla

As can be gleaned from the distrust notices by Google and Mozilla, failure to replace Symantec TLS certificates runs the risk of attackers trying to steal information from your organization’s website, including passwords, messages and credit card details.

According to Mozilla, whenever it connects to a website, it verifies that the TLS certificate presented by the website is valid and that the site’s encryption is strong enough to adequately protect the privacy of the visitor. If Firefox determines that the TLS certificate can’t be validated or if the encryption isn’t strong enough, the connection to the website will be stopped and instead, the message, “Your connection is not secure” will be shown, Mozilla said.

“When this error occurs, it indicates that the owners of the website need to work with their certificate authority to correct the policy problem,” Mozilla added. 

Contact us today if your organization needs assistance in replacing legacy Symantec TLS certificates.

Most Universities at Risk of DDoS Attacks

The recent distributed denial of service (DDoS) attack on the online services of the Scotland-based University of Edinburgh adds to the growing list of universities hit by DDoS attacks.

Last September 10^th, University of Edinburgh’s online services, including wireless services, websites and many online student services were disrupted for several hours as a result of a DDoS attack. The attack was done during the busy “Welcome Week” period of the university.

“I apologise for the disruption to this service, particularly during the busy Welcome Week period,” Gavin Ian McLachlan Chief Information Officer at the University of Edinburgh, said in a statement. “I realise how frustrating this must have been.”

DDoS Attacks on Colleges and Universities: Who, When and Why

A recent study conducted by Jisc provides a picture of who may be launching these DDoS attacks, in particular, on UK’s colleges and universities based on the specific time these attacks were done. 

Jisc is a UK not-for-profit company that offers internet service via the Janet Networkto UK research and education community, including the University of Edinburgh.

Jisc said, “there is evidence both circumstantial and from the justice system to suggest that students and staff may well be responsible for many of the DDoS attacks we see on the Janet Network.”

The Jisc study found that DDoS attacks on colleges and universities were usually done during school period and attacks dramatically decrease during holiday times, such as summer breaks, Christmas, Easter and May half term breaks.

“This pattern could indicate that attackers are students or staff, or others familiar with the academic cycle,” Jisc said. “Or perhaps the bad guys simply take holidays at the same time as the education sector. Whichever the case, there’s no point sending a DDoS attack to an organization if there’s no one there to suffer the consequences.”

Several students had been prosecuted in the past for attacking their colleges or universities. Adam Mudd, a student at West Herts College, pleaded guilty for launching DDoS attacks against his college; while Paras Jha, a student at Rutgers University, pleaded guilty for launching DDoS attacks against his university.

These college and university students don’t just target their own schools. In April 2017, Adam Mudd received a 2-year jail sentence for running “Titanium Stresser”, a DDoS-for-hire service that launched 1.7 million DDoS attacks against victims worldwide.

In December 2017, Jha with two college-age friends, pleaded guilty for creating the Mirai botnet – referring to the hundreds of thousands of IoT devices compromised by Jha’s group using 62 common default login details and using them as a botnet or zombie army to conduct a number of powerful DDoS attacks.

According to the U.S. Department of Justice, Jha’s involvement with the Mirai botnet ended when he posted the source code for Mirai on a criminal forum in the fall of 2016. In October 2016, internet infrastructure company Dyn became a target of DDoS attacks, which resulted in bringing down a big chunk of the internet on the U.S. east coast. The DDoS attacks against Dyn temporarily took offline major websites, such as Amazon, Twitter and Netflix. “We are able to confirm that a significant volume of attack traffic originated from Mirai-based botnets,” Dynsaid in a statement.

The Jisc study also showed a significant decrease of DDoS attacks on the Janet Network starting in April 2018. Jisc theorized that this reduction of DDoS attacks could be a result of the Operation Power Off, a coordinated operation conducted by the Dutch Police and the UK’s National Crime Agency with the support of Europol and a dozen law enforcement agencies from around the world.

Operation Power Off took down the DDoS marketplace webstresser.org and resulted in the arrests of the site’s administrators located in the UK, Croatia, Serbia and Canada.

According to the European Union Agency for Law Enforcement Cooperation (Europol), webstresser.org was the world’s biggest marketplace to hire DDoS services, with 4 million recorded attacks as of April 2018.

For as low as EUR 15 a month, individuals with little to no technical knowledge launched crippling DDoS attacks via webstresser.org, the Europol reported.

Jisc said that beyond disgruntled college and university students and staff, there are far more serious criminal players at work that these institutions ignore at their peril.

Jisc added that some of these more sophisticated DDoS attacks are designed, not just to bring down an online service offline but also to steal intellectual property, targeting valuable and sensitive and information held at these educational institutions.

Preparing for DDoS Attacks

Here are some security measures that can fortify your organization’s IT defenses in case a disgruntled student, a staff or other criminal elements decide to launch a DDoS attack against your organization:

Monitor Traffic

Look for abnormal incoming traffic, including sudden traffic rise and visits from suspicious IP addresses and geolocations. These could all be indicators that criminal elements are testing your organization’s IT defenses prior to conducting a crippling DDoS attack or attacks.

DDoS Testing 

Consider conducting your very own DDoS attack against your organization’s IT infrastructure. This simulated cyberattack, known in the cybersecurity community as pen testing, can prepare your organization when the real DDoS attacks happen.

Contact us today if you need assistance in protecting your organization against DDoS attacks.

U.S. Justice Dept. Charges Alleged Member of Lazarus Group Over WannaCry Cyberattack

The U.S. Justice Department has formally charged a North Korean national, believed to be a member of the notorious hacking group known as “Lazarus” over WannaCry cyberattack and two other high-profile attacks, the Sony Pictures cyberattack and the cyberheist at the Bangladesh Bank.

The Justice Department filed a criminal complaintlast June 8, 2018 against North Korean national Park Jin Hyok for WannaCry, Sony and Bangladesh Bank cyberattacks. This criminal complaint though wasn’t made public when it was filed. It was only made public during the recent announcement by the Justice Department.

The WannaCry, Sony and Bangladesh Bank cyberattacks are among the notorious cyberattacks in recent years. On May 12, 2017, WannaCry cyberattack shook the online world after it locked down more than 300,000 computers in over 150 countries in less than 24 hours and demanded ransom payment from victims.

The Sony Pictures cyberattack in November 2014 stunned the company after thousands of its computers were rendered inoperable and unreleased movie scripts and other confidential information were made public.

The cyberheist at the Bangladesh Bank shook the financial sector in February 2016, after the fraudulent transfer of $81 million from the bank. To date, this $81-million fraudulent bank transfer is the largest successful cybertheft from a financial institution.

The criminal complaint, specifically filed by Federal Bureau of Investigation (FBI) Special Agent Nathan Shields, stated that there’s sufficient evidence that shows Park was a member of the conspiracies that resulted to the WannaCry, Sony, Bangladesh Bank successful intrusions as well as attempted intrusions, including the attempted intrusion at the U.S. defense contractor Lockheed Martin.

Shields said that Park, a computer programmer, used to work at a China-based company Chosun Expo. This company, Shields said, is a "North Korean government front company for a North Korean hacking organization”.

Cybersecurity organizations like Symantec, BAE Systems and Kaspersky Lab have called this North Korean hacking organization as “Lazarus”.

"While some of these computer intrusions or attempted intrusions occurred months or years apart, and affected a wide range of individuals and businesses, they share certain connections and signatures, showing that they were perpetrated by the same group of individuals (the subjects),” Shields said.

Shields said that there are numerous connections between Park, his true-name email and social media accounts, and the operational accounts used by the Lazarus group to conduct the successful intrusions and attempted intrusions.

Lazarus Group

According to Shields, the strongest link between the Lazarus group and the successful intrusions in WannaCry, Sony and Bangladesh Bank, and the attempted intrusion in Lockheed Martin is the FakeTLS table.

Shields said the FakeTLS table was found in WannaCry Version 0. It was also found in all three samples of Macktruck malware found at Sony attack, the Macktruck malware found in a spear-phishing document used in the attempted intrusion at Lockheed Martin, and the Nestegg malware found at Bangladesh Bank cyberheist.

TLS, short for Transport Layer Security, refers to a cryptographic protocol that’s used to increase the security of communications between computers. The “FakeTLS”, meanwhile, refers to a protocol that mimics authentic encrypted TLS traffic, but actually uses a different encryption method. By utilizing “fake” TLS, Shields said, attackers can carry on communications without tripping security alerts as many intrusion detection systems “ignore the traffic because they assume the contents cannot be decrypted and that the traffic is a common communication protocol”.

Shields added that the following technical similarities connect the malware used in WannaCry, Sony, Bangladesh Bank and Lockheed Martin:

• Common elements or functionality of the malware that was used
• Common encryption keys used to decrypt resources associated with the malware
• Domains programmed into the malware were under the common control of a single computer or group of computers

Kaspersky Lab, for its part, said Lazarus is operating a malware factory that produces new samples via multiple independent conveyors. “The scale of the Lazarus operations is shocking,” Kaspersky Lab said.

Kaspersky Lab also agrees that Lazarus group was responsible for the WannaCry, Sony and Bangladesh Bank attacks.

According to Kaspersky Lab, from December 2015 to March 2017, its researchers collected malware samples relating to Lazarus group activity which appeared in financial institutions, casinos, software developers for investment companies and cryptocurrency businesses. Kaspersky Lab researchers found that although the Lazarus group was careful enough to wipe any traces of their illegal activities, one server that the group breached contained a serious mistake with an important evidence left behind.

The compromised server, Kaspersky Lab said, was used as a command and control center for a malware. While the group tested the compromised server using VPN/proxy servers to conceal their true IP address, the group committed one mistake as one connection came from a very rare IP address range in North Korea, Kaspersky Lab said.

Symantec, for its part, said there’s a strong link between Lazarus and WannaCry, Sony and Bangladesh Bank attacks.

According to Symantec, evidence gathered from an early version of WannaCry malware found three other malware: Trojan.Volgmer and two variants of Backdoor.Destover – software programs that were used as disk-wiping tools used in the Sony attack. Symantec added that WannaCry shares a code with Backdoor.Contopee – a malware used by the Lazarus group in intrusions at banks.

Prevention

The attack methods of Lazarus group keep on evolving. One form of cyberdefense, therefore, isn’t enough to counter these attacks. Here are some of the attack methods used by the Lazarus group and corresponding preventive measures:

1. Exercise Caution in Clicking Links

One of the intrusion methods used by Lazarus is via spear-phishing email. According to the FBI, the group made an exact copy of a legitimate Facebook email but the hyperlinked text “Log In” that supposedly lead to the official Facebook page instead goes to a URL controlled by the group and directed victims to a malware.

2. Exercise Caution in Visiting Websites

One of the intrusion methods used by Lazarus, according to Kaspersky Lab, is by hacking government websites through known security vulnerabilities. When a target visits said compromised government website, the target’s computer then becomes infected.

3. Keep All Software Up-to-Date

The simple reason that the Lazarus group was successful in its WannaCry attack is that many have failed to update their Windows operating system. WannaCry Version 2, the one that hit worldwide on May 12, 2017, compromised Windows operating systems that fail to install Microsoft’s March 14, 2017 security update and older versions of Windows that were no longer supported, including Windows XP, Windows 8, and Windows Server 2003.

Study Reveals Canadian Companies View Cybersecurity as Top Priority

According to a recent study, effective cybersecurity is a top priorityfor most Canadian organizations.

This is no surprise, considering the rise of DDoS, ransomware and other online threats in 2018. In Canada and the United States, cybersecurity has continued to make headlines, leading to wider awareness of the risks among businesses.

For example, DraftKings has finally been granted the legal right to unmask the individuals behind a DDoS attackon the company. The fantasy / sports betting brand’s operations were disrupted by the assault on August 8, which caused the website to actually go offline for 26 minutes.

DraftKings managed to trace the DDoS attack and sought a subpoena to get the relevant ISPs to uncover the identities of those involved. Though DraftKings may not have suffered a huge amount of damage or loss of business, the company’s commitment to finding out exactly who initiated the attack could inspire more brands to essentially go on the offensive following an attack.

Businesses and organizations of all sizes must take steps to protect themselves and their clients from any cybersecurity risks, and it’s a pressing concern for most Canadian firms. The survey found more and more are extra vigilant, seeking effective safeguards against DDoS, ransomware and email threats.

Almost six out of 10 businesses questioned claimed email security was a key focus, while defenses against ransomware and intrusions came hot on its heels. Cloud-based storage and productivity / collaboration tools are now common fixtures for many businesses, and due caution when using these is critical.

The Repercussions of Security Breaches

Companies may find the prospect of protecting themselves from attacks daunting, especially as DDoS attackers have grown more bold. Attacks can have a serious impact on a business’s processes: i they can’t provide the services their clients expect, their income could be affected and their reputation may be damaged in the long term.

Why? Because existing and potential customers will wonder how seriously said business takes their security. They might also wonder if the company is taking due care of their own details too. If in doubt, there are sure to be other businesses offering the same services or products out there.

Basically, DDoS attacks involve launching a bombardment of traffic against a specific IP address and genuine users trying to access the targeted website will struggle to get through. This problematic traffic is created by multiple sources, which makes blocking DDoS assaults outright more difficult than malicious activities originating from a single source.

Earlier in the year, GitHub — a well-known code repository — was subject to a major DDoS attackthat made headlines. The site was taken offline due to a 1.3Tbps (terabits per second) assault, which was the most powerful to be recorded at the time.

GitHub became aware of an issue due to outages, and called for assistance from its DDoS mitigation specialists. All incoming traffic was channeled to scrubbing centers and malicious packets were blocked effectively. Fortunately for GitHub, the attackers ceased their malicious activities after eight minutes.

Before this, another company — Dyn — was targeted in a 1.2Tbps assault in 2016. This struck in multiple sessions. The first started first thing in the morning and lasted around two hours before being stopped, while the second came later on. A third assault was launched in the late afternoon.

During these waves of DDoS attacks, Dyn saw its internet directory servers disrupted by a powerful load of requests from millions of IP addresses. This was a serious incident that had been planned with great care for maximum impact.

Taking Steps to Maximize Safety

Cybercriminals are developing increasingly sophisticated ways to disrupt and attack targets, but having an effective cybersecurity plan in place can help you to stay protected.

Below, we look at just a few of the ways you can stop a DDoS attack and potentially minimize the damage it may cause.

Spot the attack ASAP

Being able to identify when your website is under attack can help you prevent a DDoS disaster.

Problems affecting your site are an obvious indication of impending issues, and its worth getting to know what your inbound traffic patterns tend to be at different times. For example, if you can be sure your traffic tends to spike on a Saturday afternoon and a Sunday morning, any rush of traffic on a weekday could be a warning sign.

Of course, you have to be able to eliminate any potential reasons for this before panicking. A sale, large discounts or an improved marketing strategy could all lead to unexpected increases in your traffic. It sounds obvious, but is well worth bearing in mind to avoid false alarms.

Invest in more bandwidth

Another effective step to protect your business from DDoS attacks is to increase your bandwidth. Having access to more than you think you’re likely to need for everyday operations can help you accommodate larger traffic surges and shifting traffic patterns.

While this may not be viable for smaller companies on a tight budget, it could be a worthwhile option even if the bandwidth is only adjusted a little.

Making changes to your working processes and set-up gradually can help to protect you with minimal disruption, but the increase in DDoS attacks in the past couple of years demonstrates just how vital proper defenses are. Companies have to to take effective steps to ensure they remain safeguarded as attackers continue to advance their methods.

Working with professional cybersecurity specialists with years of experience helping companies across various sectors can help you stay safe. Our Automated DDoS Mitigation service provides guaranteed DDoS attack protection, with no hardware or software to buy. This service is powered by our partner’s innovative technology and includes a high-powered CDN to increase your domain’s performance by as much as 50 percent.

Want to discuss how we can help protect your business from DDoS attacks? Please don’t hesitate to get in touch. Our team is here to answer any questions you may have.

Microsoft Windows Privilege Escalation Vulnerability Leaked via Twitter

A security researcher who goes by the name “SandboxEscaper” leaked via Twitter an exploit code for a Microsoft Windows privilege escalation vulnerability.

In the now-deleted Twitter post, SandboxEscaper provided a link to a Github repository that contains the code necessary to exploit a Microsoft Windows privilege escalation vulnerability. Other security researchers have since verified the authenticity of the vulnerability exploit disclosed by SandboxEscaper.

The bug uncovered by SandboxEscaper lies in Microsoft Windows task scheduler service. Task scheduler allows users to schedule any program to run at a convenient time or when a specific event occurs. 

SandboxEscaper found that task scheduler uses unsecured API that allows an attacker, having access to a computer as a local user to gain system-level privileges, enabling the attacker to overwrite system files with malicious code to hijack Windows.

“The Microsoft Windows task scheduler SchRpcSetSecurity API contains a vulnerability in the handling of ALPC, which can allow an authenticated user to overwrite the contents of a file that should be protected by filesystem ACLs,” CERT Coordination Center (CERT/CC)described the uncovered flaw. “This can be leveraged to gain SYSTEM privileges.”

“The flaw is that the Task Scheduler API function SchRpcSetSecurity fails to check permissions,” security researcher Kevin Beaumont, for his part, noted. “So anybody  –  even a guest  –  can call it and set file permissions on anything locally.”

As a proof-of-concept, SandboxEscaper overwrites a file used by Windows' printing subsystem with a malicious code when an attempt is made to print.

According to CERT/CC, the exploit code leaked by SandboxEscaper works on 64-bit Windows 10, Windows Server 2016 systems, 32-bit Windows 10 with minor modifications and with other Windows versions with further modifications. CERT/CC said it’s currently unaware of a practical solution to this problem.

A Microsoft spokesperson told the Registerthat the company will “proactively update impacted devices as soon as possible.”

In another Twitter post, SandboxEscaper blamed depression for leaking the vulnerability exploit before Microsoft has time to issue a security update or a patch.

Exploits for privilege escalation vulnerabilities are rarely leaked to the public prior to a patch as many software vendors like Microsoft now offer financial rewards to security researchers who uncover and discreetly inform the concerned software vendors. This gives security vendors time to create a security fix to the reported problem.

Dangers of Privilege Escalation Attacks

In a privilege escalation attack, the attacker has to have local access to the computer or computer network that he or she wants to compromise. A local user needs the system administrator's password to complete certain tasks, such as overwriting system files. As such, this is given less priority by software vendors when it comes to patching.

Remote code execution attacks, on the other hand, are given high priority in terms of patching as these attacks don’t require that the attacker have local access to the target computer.

In a remote code execution attack, an attacker can install malicious code on a computer even when he or she has no local access, provided though that the computer is connected to the internet. An example of the remote code execution attack was the WannaCry attack. Hours after the WannaCry attack on May 12, 2017, Microsoft issued a security update for Windows platforms originally not covered by an earlier security patch, showing the importance of patching remote code execution attacks.

Privilege escalation attacks, however, aren’t given similar immediate attention. Privilege escalation vulnerabilities are typically patched during scheduled updates, like Microsoft’s regular security updates every second Tuesday of each month.

Client-side exploits, however, make privilege escalation attacks dangerous as attackers then effectively become local users and escalate their privileges to system administrators.

"If an attacker can gain access to a system through a client side exploit, they may then effectively become the local user, and escalate to local system,” SANS Technology Instituteinstructor Adrien de Beaupre wrote in a post "Privilege escalation, why should I care?" “Local system priv on a Windows computer is just a hop, skip, and jump away from being Domain administrator.”

Client-side exploits come in numerous and varied formats. Compared to remote execution attack like the WannaCry that has worm capability – meaning, it replicates itself without user interaction, client-side exploits need user interaction, such as clicking a malicious link or downloading a malicious email attachment.

Prevention

The fact that the exploit code is out and there’s no official patch from the software vendor should warrant some caution. However, unofficial patch has been posted by 0Patch.com

“Windows has a customer commitment to investigate reported security issues, and proactively update impacted devices as soon as possible,” a Microsoft spokesperson told Threatpost. “Our standard policy is to provide solutions via our current Update Tuesday schedule.”

That means that the next Windows update is still days away – this coming September 11^th. This gives attackers a window to exploit the flaw exposed by SandboxEscaper in the wild.

According to Kevin Beaumont, if you use Microsoft Sysmon, a sure way to find out whether a Microsoft Windows task scheduler exploit is being used is by looking for spoolsv.exe spawning abnormal processes.

Here are some general measures in preventing privilege escalation attacks like the one exposed by SandboxEscaper:

• Install software updates as soon as they’re made available.
• Use anti-virus protection.
• Educate staff about the dangers of clicking links and downloading email attachments from unknown sources.
• Practice network segmentation so that if one network is compromised the other network won’t be affected.
• Don’t allow untrusted users to install code.