Interesting law journal paper: "Intelligence Legalism and the National Security Agency's Civil Liberties Gap," by Margo Schlanger:

Abstract: This paper examines the National Security Agency, its compliance with legal constraints and its respect for civil liberties. But even if perfect compliance could be achieved, it is too paltry a goal. A good oversight system needs its institutions not just to support and enforce compliance but also to design good rules. Yet as will become evident, the offices that make up the NSA's compliance system are nearly entirely compliance offices, not policy offices; they work to improve compliance with existing rules, but not to consider the pros and cons of more individually-protective rules and try to increase privacy or civil liberties where the cost of doing so is acceptable. The NSA and the administration in which it sits have thought of civil liberties and privacy only in compliance terms. That is, they have asked only "Can we (legally) do X?" and not "Should we do X?" This preference for the can question over the should question is part and parcel, I argue, of a phenomenon I label "intelligence legalism," whose three crucial and simultaneous features are imposition of substantive rules given the status of law rather than policy; some limited court enforcement of those rules; and empowerment of lawyers. Intelligence legalism has been a useful corrective to the lawlessness that characterized surveillance prior to intelligence reform, in the late 1970s. But I argue that it gives systematically insufficient weight to individual liberty, and that its relentless focus on rights, and compliance, and law has obscured the absence of what should be an additional focus on interests, or balancing, or policy. More is needed; additional attention should be directed both within the NSA and by its overseers to surveillance policy, weighing the security gains from surveillance against the privacy and civil liberties risks and costs. That attention will not be a panacea, but it can play a useful role in filling the civil liberties gap intelligence legalism creates.

This is similar to what I wrote in Data and Goliath:

There are two levels of oversight. The first is strategic: are the rules we're imposing the correct ones? For example, the NSA can implement its own procedures to ensure that it's following the rules, but it should not get to decide what rules it should follow....

The other kind of oversight is tactical: are the rules being followed? Mechanisms for this kind of oversight include procedures, audits, approvals, troubleshooting protocols, and so on. The NSA, for example, trains its analysts in the regulations governing their work, audits systems to ensure that those regulations are actually followed, and has instituted reporting and disciplinary procedures for occasions when they're not.

It's not enough that the NSA makes sure there is a plausible legal interpretation that authorizes what they do. We need to make sure that their understanding of the law is shared with the outside world, and that what they're doing is a good idea.

EDITED TO ADD: The paper is from 2014. Also worth reading are these two related essays.

Yesterday, the White House released a new policy document on the management of cyber incident response. The document, Presidential Policy Directive (PPD) 41, captures over a decade of lessons learned on how federal agencies respond to cyber incidents. It is clear about what federal agencies will do (as well as what they will not do) and sets up a series of mechanisms for coordinating federal action with private companies.

It fixes long-standing problems in Federal response policy, formalizing the “bubble chart” and creating unified coordination groups to coordinate with private entities and state and local governments based on what works for responding to real world disasters.

Unfortunately, nobody cares because the White House also released a Cyber Incident Severity Schema that looks like the ill-fated and often-mocked color-coded Homeland Security Advisory System and the twitterverse is all abuzz. So, instead of getting into the importance of the new presidential policy, let’s take a minute to understand why the schema is not the homeland advisory system’s “spiritual successor for hacking.”

Believe it or not, the federal government does every once in a great long while realize that something does not work and fixes it. The Obama administration eliminated the Homeland Security Advisory System because national alert levels simply were not useful. Raising the alert level to orange because of a bomb threat to the financial sector in New York would cause seaports on the West Coast to burn overtime for guard patrols. Recognizing this problem, the Department of Homeland Security (DHS) replaced it with the National Terrorism Advisory System to provide specific and actionable information to the public when such information exists.

For cyber threats, there are already multiple similar systems used to convey government information to the public and to constituency groups including US-CERT alerts and joint intelligence bulletins from the Federal Bureau of Investigation (FBI) and DHS released to select groups. The Schema does not replace or augment these systems.

All the Schema does is create a way to quickly convey the severity of an incident to senior government officials. The press statement and the Schema document are clear that it is for internal government use: “a common framework within the federal government for evaluating and assessing the severity of cyber incidents and will help identify significant cyber incidents to which the PPD’s coordination procedures would apply.”

In government, I saw first-hand the need for this kind of easy to understand rating of an incident’s severity. A breaking headline on MSNBC can easily send an agency head into a tailspin. Conversely, practitioners who routinely deal with cyber incidents can become inured to cyber threats and not move quickly to respond. Being able to use a simple and easily understood level system is just a common sense thing to do when a dozen or more agencies need to be on the same page.

I can guess that the team that developed the schema probably thought about ways to avoid using colors. I can almost guarantee that the White House debated not releasing it because they knew that the color-coding would be mocked. Yet in the end, they decided to do both because they were the right things to do.

Nobody ever gets confused about whether green or red is worse in a color hierarchy (numbers can go either way—DEFCON 1 and a category 5 hurricane are both the highest in their respective fields). And even though it is quite possible the public may never see the category rating of a cyber incident, releasing the schema is in the public interest. It helps explains the context for the PPD. Private companies may want to adopt it. At a basic level, there is no reason to make Electronic Frontier Foundation go through the process of a freedom of information act request to get it.

In many cases Red Team tools are not written because someone feels like writing a tool, or wakes up one morning thinking, “I want to write a tool today”. Red Teamers generally identify tedious tasks in their methodology and then create tools that automate these tasks for current and future assessments. As my boss likes to say, jokingly: laziness breeds ingenuity!

At Mandiant, we’ve developed (or significantly contributed to) a fair number of tools and scripts to make our lives easier. In order to ensure the broader security community is aware of these tools and where to download them from, we’re going to start releasing a “tool roundup” blog post on a semi-regular basis. The intent of these blog posts is to highlight newly developed tools, or major changes to existing tools. We also make this a fun read by including some case studies to demonstrate tool use.

Our Red Team is frequently introduced to diverse networks, technologies, defenses, and organizational structures. Each network presents new challenges that must be overcome, and with all clients, there is overlap with infrastructure and configuration. Existing public tools might not scale properly in larger environments or might not help the Red Team address specific phases of an attack life cycle. The tools being discussed have all been revised or developed in some form or fashion over the last couple of months. We hope they make your engagements easier and bring awareness to the community.

Domain Enumeration

Tool: ADEnumerator (https://github.com/chango77747/AdEnumerator)

Domain enumeration is an essential task during the reconnaissance phase of the attack life cycle. When you compromise a domain-joined system, it is fairly simple to enumerate objects from the domain using Active Directory Service Interfaces (ADSI) or the Windows “net” commands. ADSI works well from non-domain joined systems using the “runas” command with the “netonly” switch, as shown in Figure 1. It can be a hassle to craft detailed LDAP queries for ADSI to perform domain enumeration, so we automated this processing using raw LDAP queries in a tool called ADEnumerator.

Figure 1. Using PowerShell and ADSI for domain enumeration

ADEnumerator is a PowerShell module designed to query Active Directory servers from non-domain systems. The following use cases apply to ADEnumerator:

1. You harvest domain credentials from a printer, via NBNS spoofing, etc., and want to start performing domain enumeration. Note: Any domain user credential can query LDAP.
2. You want to gather more information about an account you harvested. Group naming conventions often reveal where you can use those credentials (for example, group name {systemName}_localAdmin).
3. You are provided with credentials to start an internal penetration test from a known compromise perspective, but not a domain-joined system.
4. You want to perform Active Directory enumeration from the command line so you can chain commands together.

Figure 2 demonstrates importing the ADEnumerator.psm1 module, establishing an LDAP connection to a domain controller, and executing various domain enumeration methods. There are plenty of additional methods within ADEnumerator – see the header of the script for a full list of methods.

Figure 2. ADEnumertor.psm1 import and enumeration

Alternatively, you can install Remote Server Administration Tools on your attack platform and use “runas” to execute “mmc” and add the Active Directory snap-in. Then you can change the domain to your target domain and view the entire Active Directory structure in a GUI, as shown in Figure 3.

Figure 3. Active Directory snap-in running as different user

Privilege Escalation and Lateral Movement

Tools: CredNinja (https://github.com/Raikia/CredNinja) & WMIOps (https://github.com/ChrisTruncer/WMIOps)

Have you been in a situation where you have a list of more than 100 credentials, but you are not sure which credentials are valid? Or, you’re not sure which credentials have administrative rights to a target system? CredNinja was created for just that (and it can do more!). Use cases and general functionality are as follows:

• Leverages SMB access (TCP port 445)
• Attempts to mount C$ of all provided systems, returns:

        o   Logon Failure – Invalid credentials (protection against locking out accounts included)
        o   Access Denied – Not local admin
        o   File listing – Local admin!

• Multi-threaded – so you can scale properly in those large environments
• Fingerprints target operating system version and domain membership
• If “–users” flag is enabled, it will perform a directory listing of “C:\Users” (or C:\Documents and Settings if its XP), look at the timestamp of all the home folders, and print out the users that have a home folder modified timestamp of within 100 days (this value is customizable, but the default is 100 days).
      o   Provides a quick user-hunting functionality to identify active users on the targeted system.

CredNinja is very useful when performing privilege escalation and lateral movement because you can identify systems for which your credentials have elevated privileges, and continue dumping credentials on those systems. Figure 4 demonstrates the power of CredNinja by identifying various systems where the domain credentials have local administrator rights, and whether or not credentials are invalid. CredNinja can also be run against a single system to clean up your credential list by removing invalid credentials.

Figure 4. CredNinja run against various systems using credential list

Windows Management Instrumentation (WMI) is the new hotness in terms of offensive capabilities. WMIOps is a PowerShell script that uses WMI to perform a variety of actions on hosts, local or remote, within a Windows environment. It was designed primarily for use on penetration tests or Red Team engagements. Some existing tools use WMI for offensive tasks; WMIOps was built to combine these techniques into a single tool to accomplish various tasks in the attack life cycle.

Figure 5 shows the Get-ProcessOwnersWMI method in WMIOps to get a list of users from target system Win7-Client02. User “Dick.Grayson” had local administrator privileges on Win7-Client02 and was authorized to execute arbitrary WMI commands. User “Bruce.Wayne” had running processes on Win7-Client02, which indicates that the user potentially has clear text credentials stored in Local Security Authority Subsystem Service (LSASS).

To obtain credentials for “Bruce.Wayne”, WMIOps method Invoke-RemoteScriptWithOutput is used in Figure 6 to execute a remote PowerShell process that issues command “Invoke-Expression” to download and execute the “Invoke-Mimikatz” script over HTTPS. The command also instructs the output to be sent to web server 10.181.73.210 listening on HTTPS. Mimikatz output was sent to the web server, as shown in Figure 7.

Figure 5. Get-ProcessOwnersWMI method in WMIOps to get a list of users with running processes

Figure 6. Invoke-RemoteScriptWithOutput method to call Invoke-Mimikatz and send output to the "callbacksite"

Figure 7. Mimikatz output sent from the command executed in Figure 4

Initial Vectors

Tool: EyeWitness (https://github.com/ChrisTruncer/EyeWitness)

One of the most common initial vectors into a network is default credentials to known web administrative portals such as Jboss, Apache Tomcat, Jenkins, etc. EyeWitness is known to scale networks by taking screenshots of the web page of each web server identified in your reconnaissance phase. We added an “active-scan” module to EyeWitness that provides the following functionalities:

• Signature authentication – Checks if the host has a known default credential signature and attempts to login using default credentials stored in a data file.
• Check for login – Checks to see if the root path is a web login form, or is HTTP basic authentication, and attempts to authenticate to the web application using username and password combinations stored in a data file.
• Append URLs to check for logins – Appends a list of common login pages to the web root directory. Examples of these pages are “admin”, “login”, “login.php” and more. The list of pages is stored in a data file so that it is easily customizable; feel free to add more and contribute!
      o   If a page receives a HTTP 200 response code, it will check to see if it’s a login form.
      o   EyeWitness will attempt to login to the form using username and password combinations stored in a data file.

The “active-scan” Boolean flag is shown in Figure 8. Example report and console output is shown in Figure 9 and Figure 10. An additional category called “Identified Logins” is also added to the report if EyeWitness identified a login, but was not able to authenticate to it. If you want to learn more about this module, a full blog post on this module was written here: https://www.christophertruncer.com/eyewitness-and-active-account-enumeration/.

Figure 8. Active-scan flag in EyeWitness

Figure 9. Successful authentication using the active-scan module

Figure 10. EyeWitness report output

Attacker Simulation

Tool: Egress-Assess (https://github.com/ChrisTruncer/Egress-Assess)

The combined capabilities of Mandiant, FireEye, and iSIGHT Partners brings unparalleled threat intelligence and technology to every engagement. Clients regularly ask us to identify threat actors targeting their industry specifically and to emulate their TTPs to assess the organization’s current detection capabilities. Egress-Assess is a Python tool that was created to emulate known attacker TTPs, such as IP addresses and Fully Qualified Domain Names (FQDNs) connecting to the Internet. Egress-Assess is publicly available; however, Mandiant maintains a proprietary version of Egress-Assess that contains known network-based indicators (NBIs) that replicate real threat groups.

Egress-Assess modifies the host value in the HTTP(s) header request to be a known-bad IP address or FQDN, and generates web requests to known-bad URIs. Furthermore, the tool can generate fake PII, PHI, or PCI data to emulate data theft. We use Egress-Assess to assess our client’s detection capabilities by emulating real threat group indicators and/or data theft. A list of supported threat actor groups available in the public version of Egress-Assess is shown in Figure 11. If you want to learn more about this Egress-Assess, a full blog post on this module was written here: https://www.christophertruncer.com/egress-assess-testing-egress-data-detection-capabilities/.

Figure 11. List of threat actors available in Egress-Assess

Conclusion

These are just a handful of tools and practical examples of using those tools for Red Team operations. We encourage you to play with these tools and start using them on your assessments or in your labs.

We want to reemphasize that each tool was created or modified as the need was identified. It can be very exciting to identify a need and develop tools and techniques to automate a task or accomplish an objective. Some tools introduce new techniques to accomplish a goal, while other tools simply automate existing tools and techniques to scale better. Whatever your motive, introducing new tools and techniques is an excellent way to provide awareness in our industry and generate higher quality security.

After password cracking examples with hashcat, I want to show you how to crack passwords with John the Ripper (remember we also produced hashes for John the Ripper: lm.john.out and nt.john.out).

First we use the rockyou wordlist to crack the LM hashes:

John-the-Ripper-v1.8.0-jumbo-1-Win-32\run\john.exe --wordlist=rockyou.txt --pot=john-rockyou-lm.pot lm.john.out

Option –wordlist specifies the wordlist to use, and option –pot specifies the pot file I want to create/use.

Output:

Warning: detected hash type "LM", but the string is also recognized as "HAVAL-128-4"
Use the "--format=HAVAL-128-4" option to force loading these as that type instead
Warning: detected hash type "LM", but the string is also recognized as "lotus5"
Use the "--format=lotus5" option to force loading these as that type instead
Warning: detected hash type "LM", but the string is also recognized as "MD2"
Use the "--format=MD2" option to force loading these as that type instead
Warning: detected hash type "LM", but the string is also recognized as "mdc2"
Use the "--format=mdc2" option to force loading these as that type instead
Warning: detected hash type "LM", but the string is also recognized as "mscash"
Use the "--format=mscash" option to force loading these as that type instead
Warning: detected hash type "LM", but the string is also recognized as "mscash2"
Use the "--format=mscash2" option to force loading these as that type instead
Warning: detected hash type "LM", but the string is also recognized as "NT"
Use the "--format=NT" option to force loading these as that type instead
Warning: detected hash type "LM", but the string is also recognized as "nt2"
Use the "--format=nt2" option to force loading these as that type instead
Warning: detected hash type "LM", but the string is also recognized as "Raw-MD4"
Use the "--format=Raw-MD4" option to force loading these as that type instead
Warning: detected hash type "LM", but the string is also recognized as "Raw-MD5"
Use the "--format=Raw-MD5" option to force loading these as that type instead
Warning: detected hash type "LM", but the string is also recognized as "Raw-MD5u"
Use the "--format=Raw-MD5u" option to force loading these as that type instead
Warning: detected hash type "LM", but the string is also recognized as "ripemd-128"
Use the "--format=ripemd-128" option to force loading these as that type instead
Warning: detected hash type "LM", but the string is also recognized as "Snefru-128"
Use the "--format=Snefru-128" option to force loading these as that type instead
Loaded 47 password hashes with no different salts (LM [DES 128/128 SSE2])
Warning: poor OpenMP scalability for this hash type
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
123456           (user01)
RACHELL          (user03:1)
AMOROSA          (user07:1)
BEAUFOR          (user10:1)
GIRLISH          (user06:1)
2020             (user06:2)
1                (user09:2)
007              (user12:2)
THURLOW          (user09:1)
OVEJA            (user07:2)
EANNE            (user03:2)
AS               (user22)
MAISIE2          (user12:1)
F                (user29:2)
ZORDIC7          (user04)
YELIZ6           (user14)
TADOB            (user15)
R                (user28:2)
LM11819          (user16:1)
KURT!!!          (user05)
CUNINGO          (user17)
LZAC08@          (user19)
FEPARAG          (user20:1)
4537584          (user08:1)
24g 0:00:00:00 DONE (2016-07-15 23:57) 27.39g/s 16374Kp/s 16374Kc/s 461233KC/s "WHENIC..♦*♥7▒VA
Warning: passwords printed above might be partial
Use the "--show" option to display all of the cracked passwords reliably
Session completed

And then we use option –show to display the (partially) recovered passwords:

John-the-Ripper-v1.8.0-jumbo-1-Win-32\run\john.exe --show --pot=john-rockyou-lm.pot lm.john.out

Output:

user01:123456:S-1-5-21-3188177830-2933342842-421106997-1106::
user03:RACHELLEANNE:S-1-5-21-3188177830-2933342842-421106997-1108::
user04:ZORDIC7:S-1-5-21-3188177830-2933342842-421106997-1109::
user05:KURT!!!:S-1-5-21-3188177830-2933342842-421106997-1110::
user06:GIRLISH2020:S-1-5-21-3188177830-2933342842-421106997-1111::
user07:AMOROSAOVEJA:S-1-5-21-3188177830-2933342842-421106997-1112::
user08:4537584???????:S-1-5-21-3188177830-2933342842-421106997-1113::
user09:THURLOW1:S-1-5-21-3188177830-2933342842-421106997-1114::
user10:BEAUFOR???????:S-1-5-21-3188177830-2933342842-421106997-1115::
user12:MAISIE2007:S-1-5-21-3188177830-2933342842-421106997-1117::
user14:YELIZ6:S-1-5-21-3188177830-2933342842-421106997-1119::
user15:TADOB:S-1-5-21-3188177830-2933342842-421106997-1120::
user16:LM11819???????:S-1-5-21-3188177830-2933342842-421106997-1121::
user17:CUNINGO:S-1-5-21-3188177830-2933342842-421106997-1122::
user19:LZAC08@:S-1-5-21-3188177830-2933342842-421106997-1124::
user20:FEPARAG???????:S-1-5-21-3188177830-2933342842-421106997-1125::
user22:AS:S-1-5-21-3188177830-2933342842-421106997-1127::
user28:???????R:S-1-5-21-3188177830-2933342842-421106997-1133::
user29:???????F:S-1-5-21-3188177830-2933342842-421106997-1134::

24 password hashes cracked, 23 left

Cracking NTLM hashes is done with a similar command, it’s just the name of the files that changes:

John-the-Ripper-v1.8.0-jumbo-1-Win-32\run\john.exe --wordlist=rockyou.txt --pot=john-rockyou-nt.pot nt.john.out

Output:

Warning: detected hash type "NT", but the string is also recognized as "nt2"
Use the "--format=nt2" option to force loading these as that type instead
Loaded 43 password hashes with no different salts (NT [MD4 128/128 SSE2 + 32/32])
Warning: no OpenMP support for this hash type
Press 'q' or Ctrl-C to abort, almost any other key for status
123456           (user01)
mychemicalromance (user02)
beautifulprincess (user11)
beaufort1        (user10)
thurlow1         (user09)
rachelleanne     (user03)
maisie2007       (user12)
maiseythorne2007 (user13)
zordic7          (user04)
yeliz6           (user14)
tadob            (user15)
lm1181992        (user16)
kurt!!!          (user05)
girlish2020      (user06)
cuningo          (user17)
amorosaoveja     (user07)
Lzac08@          (user19)
Horselover1493@hotmail.com (user18)
FEPARAGON        (user20)
453758487l       (user08)
20g 0:00:00:01 DONE (2016-07-16 00:06) 19.15g/s 13739Kp/s 13739Kc/s 411618KC/s    000..♦*♥7▒Vamos!♥
Use the "--show" option to display all of the cracked passwords reliably
Session completed

And then we use option –show to display the recovered passwords:

John-the-Ripper-v1.8.0-jumbo-1-Win-32\run\john.exe --show --pot=john-rockyou-nt.pot nt.john.out

Output:

user01:123456:S-1-5-21-3188177830-2933342842-421106997-1106::
user02:mychemicalromance:S-1-5-21-3188177830-2933342842-421106997-1107::
user03:rachelleanne:S-1-5-21-3188177830-2933342842-421106997-1108::
user04:zordic7:S-1-5-21-3188177830-2933342842-421106997-1109::
user05:kurt!!!:S-1-5-21-3188177830-2933342842-421106997-1110::
user06:girlish2020:S-1-5-21-3188177830-2933342842-421106997-1111::
user07:amorosaoveja:S-1-5-21-3188177830-2933342842-421106997-1112::
user08:453758487l:S-1-5-21-3188177830-2933342842-421106997-1113::
user09:thurlow1:S-1-5-21-3188177830-2933342842-421106997-1114::
user10:beaufort1:S-1-5-21-3188177830-2933342842-421106997-1115::
user11:beautifulprincess:S-1-5-21-3188177830-2933342842-421106997-1116::
user12:maisie2007:S-1-5-21-3188177830-2933342842-421106997-1117::
user13:maiseythorne2007:S-1-5-21-3188177830-2933342842-421106997-1118::
user14:yeliz6:S-1-5-21-3188177830-2933342842-421106997-1119::
user15:tadob:S-1-5-21-3188177830-2933342842-421106997-1120::
user16:lm1181992:S-1-5-21-3188177830-2933342842-421106997-1121::
user17:cuningo:S-1-5-21-3188177830-2933342842-421106997-1122::
user18:Horselover1493@hotmail.com:S-1-5-21-3188177830-2933342842-421106997-1123::
user19:Lzac08@:S-1-5-21-3188177830-2933342842-421106997-1124::
user20:FEPARAGON:S-1-5-21-3188177830-2933342842-421106997-1125::

20 password hashes cracked, 23 left

 

Hovertext: Once you realize there is no hope, you can relax and just enjoy the progress in machine learning.

New comic!
Today's News:

GRR Rapid Response is an incident response framework focused on remote live forensics. It based on client server architecture, so there’s an agent which is installed on target systems and a Python server infrastructure that can manage and communicate with the agents. There are agents for Windows, Linux and Mac OS X environments. Overview To...

Read the full post at darknet.org.uk

THE DIRECTOR OF NATIONAL INTELLIGENCE on Monday blamed NSA whistleblower Edward Snowden for advancing the development of user-friendly, widely available strong encryption.

“As a result of the Snowden revelations, the onset of commercial encryption has accelerated by seven years,” James Clapper said during a breakfast for journalists hosted by the Christian Science Monitor.

The shortened timeline has had “a profound effect on our ability to collect, particularly against terrorists,” he said.

When pressed by The Intercept to explain his figure, Clapper said it came from the National Security Agency. “The projected growth maturation and installation of commercially available encryption — what they had forecasted for seven years ahead, three years ago, was accelerated to now, because of the revelation of the leaks.”

Asked if that was a good thing, leading to better protection for American consumers from the arms race of hackers constantly trying to penetrate software worldwide, Clapper answered no.

“From our standpoint, it’s not … it’s not a good thing,” he said.

Technologists have been tirelessly working to strengthen encryption for decades, not just the past few years. But Snowden’s revelations about the pervasiveness of mass surveillance clearly accelerated its more widespread availability.

And technologists say the threat of law enforcement “going dark” has been overhyped. For instance, there are almost always ways to hack around encryption, even if you can’t break it.

Clapper acknowledged that there is no such thing as unbreakable encryption from his perspective. “In the history of mankind, since we’ve been doing signals intelligence, there’s really no such thing, given proper time, and proper application of technology.”

Top photo: Director of National Intelligence James Clapper.

The post Spy Chief Complains That Edward Snowden Sped Up Spread of Encryption by 7 Years appeared first on The Intercept.

Last summer I paid a visit to Georgetown University’s Lauinger Library as part of my research on legendary CIA counterspy James Jesus Angleton. I went there to investigate Angleton’s famous mole hunt, one of the least flattering episodes of his eventful career. By the early 1960s, Angleton was convinced the KGB had managed to insert a penetration agent high in the ranks of the CIA.

In researching and writing a biography of Angleton, I constantly confront a conundrum: Was the man utterly brilliant? Or completely nuts?

Angleton is one of America’s archetypal spies. He was the model for Harlot in Harlot’s Ghost, Norman Mailer’s epic of the CIA, a brooding Cold War spirit hovering over a story of corrupted idealism. In Robert De Niro’s cinematic telling of the tale, The Good Shepherd, the Angletonian character was a promising product of the system who loses his way in the moral labyrinth of secret intelligence operations.

In real life, Jim Angleton was a formidable intellectual and canny bureaucrat who helped shape the ethos of the Central Intelligence Agency we have today. His doctrine of counterintelligence was widely influential, not only in the CIA but in the intelligence services of all the English-speaking countries. He pioneered pre-digital techniques of mass surveillance via an illicit mail-opening program called LINGUAL. He fed the intel to J. Edgar Hoover’s COINTELPRO operatives at the FBI who used it to harass, disrupt, and discredit leftist, antiwar, and civil rights groups from the 1950s to the 1970s. His close liaison with the Mossad in the 1950s and 1960s helped forge a wide-ranging U.S.-Israel strategic relationship that has been central to U.S. foreign policy ever since.

Like them or not, his accomplishments were large. So were his mistakes.

Angleton’s fruitless mole hunt paralyzed the agency’s operations in the Soviet Union in the late 1960s. Speaking in 2012 at a conference on Angleton’s legacy, historian Christopher Andrew offered a nuanced view on the agency’s notorious mole hunter. “When somebody as bright, as distinguished, and so capable of friendship as Jim Angleton makes these sort of appalling errors that he does,” Andrew said, “then we are faced with one of the greatest personal tragedies in the modern history of U.S. and British intelligence.”

Yet no historian can give short shrift to the man whom the Daily Beast recently dubbed “The Spider.” Angleton, who died in 1987, was a master of Cold War power politics, and a seer of the coming U.S. surveillance state. His charisma gained him the confidence of several famous poets, a future pope, four Mossad chiefs, a presidential mistress, a couple of Mafiosos, the odd New York intellectual, and a global network of like-minded spooks.

Whatever his faults, Angleton acted zealously on a theory of history whose validity is hard to accept and hard to dispute. He believed that secret intelligence agencies controlled the destiny of mankind. During his 27-year career at the CIA, from 1947 to 1974, he acted as if the CIA and the KGB were struggling over the future of civilization itself — which, of course, they were.

The Cold War is over and Angleton is gone, but the espionage techniques he mastered — mass surveillance, disinformation, targeted assassination, and extrajudicial detention — remain with us, albeit on a much larger scale. Since September 11, 2001, the power of secret intelligence agencies to shape our future is obvious.

Yet it wasn’t until I went to Georgetown in search of one of Angleton’s darkest secrets that I came away with a personal lesson in how the CIA makes history — by erasing it.

How much damage Angleton’s false accusations did is still disputed.

His defenders insist he protected the agency’s operations far more than he harmed them. One of his critics, veteran intelligence reporter David Wise, says that Angleton ruined the careers of dozens of innocent people.

To clarify the issue, I consulted two collections in the Georgetown library’s manuscript collections. These were the papers of two senior CIA officers who knew Angleton well. Cleveland Cram, a former London station chief, was one of Angleton’s harshest critics in the agency. Ed Applewhite, a classmate of Angleton’s in the Yale class of 1941, was a trusted career officer who worked with the counterintelligence chief.

I hoped the papers of these CIA men might illuminate the financial cost of the mole hunt, something that has eluded Angleton’s previous biographers. It is known that the CIA arranged restitution for some of those falsely accused by Angleton. But the total number of victims and the compensation paid is not something that the agency cares to talk about.

The Applewhite papers looked to be an especially promising source of information. Records for the seven boxes of material that Applewhite’s estate donated to the library in 2005 indicated that he had an extensive correspondence with Peter Karlow, the first victim of Angleton’s mole hunt.

A career CIA officer who lost a foot during World War II, Karlow served in Europe throughout the 1950s, rising in the ranks of the agency’s Technical Services Division, which provides technological solutions to espionage problems (sort of like “Q” in James Bond films). He fell under suspicion in 1962, based on the flimsiest of evidence supplied by Anatoly Golitsyn, a former KGB officer, whose allegations of Soviet penetration entranced Angleton. Hoping to become chief of the Technical Services Division, Karlow was put on leave and subjected to intense FBI surveillance and investigation, which turned up nothing incriminating.

Karlow asked for his job back. Angleton insisted he had not been exonerated, and Karlow was forced to resign in 1963. He was entirely innocent. More than 25 years later, the CIA apologized to Karlow and compensated him with a reported payment of close to $500,000.

According to the library’s records, Applewhite had corresponded with Karlow from 1987 to 1994. Applewhite possessed a memo about Karlow’s request for restitution under a law known as the “Mole Relief Act.” Applewhite also composed an unpublished manuscript that included chapters about Angleton titled “The Bogey Man” and the Robert Ludlum-esque “The Angletonian Captivity.”

A dozen boxes of Cleveland Cram’s papers also offered hope of clarifying what the mole hunt cost in terms of lives and money. In the late 1970s and early 1980s, the CIA hired Cram to write an 11-volume study of Angleton’s tenure as counterintelligence chief. His encyclopedic opus has never been declassified, but Cram was not shy about sharing his severe judgment of Angleton’s professionalism in a separate CIA monograph based on some of his research. The library records for the Cram papers identified a wide range of Angleton-related material.

When I asked to see the Cram and Applewhite papers, a staff archivist told me both collections had been removed from public view. The CIA, he explained, was reviewing the boxes for “security material.” He said he thought the material would be returned “by the fall” of 2015. When I asked to see the library records for the Cram papers again, I was told the CIA had removed those from public view, too.

“They knew you were coming,” Tim Weiner told me. Author of the best-selling CIA history Legacy of Ashes, Weiner suggested the agency had learned I was writing an Angleton biography and acted preemptively to protect itself.

Perhaps insufficiently paranoid, I hadn’t thought of that possibility, but I can’t dismiss it now. Trade publications reported in January 2015 that I had signed a contract for the Angleton biography. The Cram and Applewhite papers were removed from public view in the spring of 2015, according to one Georgetown employee.

I checked with Tom Blanton, director of the nonprofit National Security Archive in Washington, who advised me to file a Freedom of Information Act request for the material. If the agency had possession of the papers, he noted, then it would be legally obliged to separate the classified material and release any unclassified information. If the agency didn’t respond quickly, he noted, I could file a lawsuit.

The CIA’s information and privacy coordinator, Michael Lavergne, wrote back to say the agency couldn’t possibly fulfill my request “as it does not know what the Cleveland Cram papers are or consist of.”

Playing dumb is a CIA art form, so I contacted the Georgetown library’s chief archivists, seeking to know the date when the agency took possession of the papers and how I might better describe the materials for the CIA. When they didn’t respond, I contacted the university’s public affairs office and was finally let in on Langley’s sleight of hand. Georgetown spokesperson John Kenchelian informed me via email that “the CIA has not taken possession of the documents, they are still in Georgetown’s possession.”

That means the Freedom of Information Act does not apply, and thus I have no legal avenue for pursuing the material. I can’t sue the CIA for the Cram and Applewhite papers, because they are not in the hands of the government.

“The CIA will be reviewing the documents at a yet to be determined time and date for potentially classified material,” Kenchelian added.

A CIA spokesperson said the university is “in the process of sending” the Cram and Applewhite papers to the agency.

“We thank Georgetown for its actions to ensure that classified material is not mistakenly disclosed to the public,” the spokesperson said. “Once the files are provided to CIA, we will review and return the documents to Georgetown as expeditiously as possible.”

In any case, the material will not be available while I’m writing my book.

The CIA has the legal right to secure material that is legitimately classified. It is unlikely, however, that the ancient papers of these two deceased men contain any classified information. The CIA isn’t protecting national security. It is covering its proverbial rear end. By removing the Cram and Applewhite papers from public view, the agency has, in essence, redacted some of the details of an embarrassing chapter in the agency’s history. But while the records technically remain in the hands of Georgetown and off-limits to FOIA, the CIA kept this harmless material beyond the reach of law and the eyes of reporters and historians.

Policy and ethics aside, I’m impressed. My attempt to write a more comprehensive history of Angleton’s mole hunt has been limited. My plans to quote Cram and Applewhite on Angleton’s legacy have been called into question. My chapter describing the human toll (and the taxpayer’s bill) for the mole hunt will have to be revised. As I write the story of one of the CIA’s most notorious characters, the agency is redacting my book, and there’s not a damn thing I can do about it. That’s how the CIA writes history.

The post How the CIA Writes History appeared first on The Intercept.

Just last month, DARPA launched a project dubbed "Improv," inviting hackers to transform simple household appliances into deadly weapons. Now, the Defense Advanced Research Projects Agency is finding someone in the private sector to develop a hacker-proof "secure messaging and transaction platform" for the U.S. military. Darpa wants researchers to create a secure messaging and transaction

THE CHIEF of the independent government agency tasked with evaluating the risk that federal counterterrorism programs present to Americans’ constitutional rights is stepping down unexpectedly.

David Medine, who was confirmed as chairman of the Privacy and Civil Liberties Oversight Board shortly before NSA whistleblower Edward Snowden revealed the massive scale of the U.S. government’s spying operations, has been tugging on the reins of expanding government surveillance power since.

The board is often referred to by its acronym, PCLOB, pronounced “pee-clawb.”

Medine was scheduled to stay on until January 2018. His last day will now be July 1.

“During my tenure and thanks to the support of the president and Congress, the board has been able to carry out its timely mission of conducting oversight and providing advice to ensure that federal counterterrorism efforts properly balance national security with privacy and civil liberties,” Medine said in a statement about his resignation on Tuesday.

Medine wrote that he has decided to work to protect low-income consumers and the privacy of their data in developing countries, but he did not name the organization he’ll be joining.

Prior to joining the board, Medine worked on similar issues — privacy and data security — both in government, including at the Federal Trade Commission, and private practice. He could not be reached for comment Tuesday morning.

President Barack Obama thanked him in an emailed statement, but gave no indication of when he might nominate a replacement or who it might be. “David has served our nation as PCLOB chairman during an especially momentous period, coinciding with a concerted examination of our national security tools and policies to ensure they are consistent with my administration’s commitment to civil liberties and individual privacy,” Obama wrote.

The Privacy and Civil Liberties Oversight Board, first created in 2004 after counterterrorism efforts ramped up in response to the 9/11 attacks, was shuttered and reborn as an independent watchdog in 2013.

The bipartisan five-member panel — chosen by the president and confirmed by the Senate — had access to many of the classified details that surveillance reformers have been clamoring for since Snowden, and its reports have become central to the ongoing debate.

In 2014, the board criticized the NSA’s mass surveillance program vacuuming up millions of Americans’ telephone records, supposedly authorized under Section 215 of the USA Patriot Act —  concluding that there was no real legal foundation for it and it wasn’t fighting terrorism anyway.

Congress chose to shutter the program in 2015, replacing it with a new one that keeps the phone records in the hands of the telephone companies, not on the NSA’s servers.

But PCLOB’s review of the NSA’s overseas spying frustrated privacy and civil liberties activists. The board’s review of the NSA’s surveillance program under Section 702 of the Foreign Intelligence Surveillance Act left unanswered many central questions, including: How much American data is swept up in a program ostensibly intended to capture only foreign communications?

And the board is only now working on a report on the most massive body of spying: NSA surveillance conducted under the Reagan-era Executive Order 12333. Medine’s departure “will not affect the 12333 report,” writes PCLOB spokesperson Jen Burita in an email to The Intercept. “The board is still going to release it this year.”

Top Photo: David Medine, chairman of the Privacy and Civil Liberties Oversight Board.

The post Top Privacy Watchdog Suddenly Resigns appeared first on The Intercept.

After a bizarre series of events this weekend, the days when the presidential campaign was mainly concerned with the size of Donald Trump’s hands and Hillary Clinton’s “damn emails” might now have to be reclassified as the “normal” part of the election season.

Here’s a brief recap of one of the most densely strange weekends in American political history.

Things started to go off the rails on Friday, when Clinton, attending the funeral of another former first lady, Nancy Reagan, offered up a startlingly inaccurate account of “how difficult it was for people to talk about HIV/AIDS back in the 1980s” until a national conversation finally began “because of both President and Mrs. Reagan — in particular Mrs. Reagan.”

Hillary Clinton: The Reagans, particularly Nancy, helped start "a national conversation" about HIV and AIDS. https://t.co/7sZp8X53fb

— MSNBC (@MSNBC) March 11, 2016

Clinton, who is trying to take credit for the most popular parts of her husband’s presidency and avoid blame for its failures, went on to credit Nancy Reagan for “very effective, low-key advocacy” that “penetrated the public conscience, and people began to say, ‘Hey, we have to do something about this too.’”

Among many others, Michael Specter, who covered the AIDS epidemic for the Washington Post, pointed out in the New Yorker that this was not only completely untrue, but bafflingly so:

President Reagan’s first speech on the subject wasn’t until May 31, 1987. By then, more than twenty-five thousand people, the majority of them gay men, had died in the United States. His administration ridiculed people with AIDS — his spokesman, Larry Speakes, made jokes about them at press conferences — and while I do think it rude to speak ill of the dead, particularly on the day of a funeral, this issue cannot be ignored. Nancy Reagan refused to act in any way in 1985 to help her friend Rock Hudson when he was in Paris dying of AIDS. (Last year, BuzzFeed published documents that make this clear.)

Under pressure from activists with a better grasp on the reality of how the Reagans actually did the opposite of what Clinton said, she issued a correction later in the afternoon, in which she said she “misspoke,” somehow confusing Nancy Reagan’s advocacy, as a private citizen, for stem-cell research and the need to find a cure for Alzheimer’s disease after it afflicted her husband, with her silence on AIDS when she lived in the White House.

Reagans started a "national convo about AIDS" only if people screaming "WHY WON'T YOU TALK ABOUT AIDS?!?" at them counts. @HillaryClinton

— Dan Savage (@fakedansavage) March 11, 2016

Did you know @HillaryClinton that #Reagans' silence on #HIV inspired #AIDS activists' slogan "Silence = Death?" pic.twitter.com/FeEF0Oy591

— Scott Wooledge (@Clarknt67) March 11, 2016

Hillary Clinton’s statement on her comments about the Reagans' record on HIV and AIDS: pic.twitter.com/RtIs0zpJfk

— Hillary Clinton (@HillaryClinton) March 11, 2016

Normally, Clinton could have been expected to be pressed much harder to explain how she came to say something so blatantly untrue — as she was eight years ago, when she “misspoke” by claiming to have been under sniper fire on a visit to postwar Bosnia — but then protesters in Chicago managed to shut down a rally for Trump on Friday night and attention veered back to the increasing threat of violence at his campaign events.

After Trump decided not to attend that rally, the event shifted into something unpredictable, as protesters, many of them young and black, celebrated inside the hall by singing Kendrick Lamar’s “Alright,” and angry Trump supporters, many older and white, began to file out. There were some scuffles between the two groups, and heated words were exchanged. Up on the abandoned podium, one of the protesters, Jedidiah Brown, ripped up posters for the candidate and was dragged away by security.

#TrumpRally protesters chant "We gonna be alright" after announcement of a Trump no-show. pic.twitter.com/FXce08oWzI

— Chicago Reader (@Chicago_Reader) March 12, 2016

#TrumpRally Some of the people who stopped Trump in Chicago @AliAbunimah @Sarah4Justice pic.twitter.com/Pmqwq5qiu7

— Bill Chambers (@Chgofenian) March 12, 2016

I have never felt more American. We CANCELLED THE TRUMP RALLY.

— Michael Joseph Garza (@ampersandcastle) March 12, 2016

Here is @livelifefreed doing God's work #TrumpRally pic.twitter.com/wIiYq1tcU7

— Zoe (@YourFavoriteZoe) March 12, 2016

Of all I heard tonight, "The crack house is that way!" stands out. It's what a Trump supporter yelled at three young black women protesters.

— Jamil Smith (@JamilSmith) March 12, 2016

One of the demonstrators, Michael Joseph Garza, described a remarkable scene that followed the rally. Garza wrote on Facebook that he and some of the other protesters tried to defuse the tension between them and the candidate’s fans by forming small channels in the crowd to allow them to leave.

“As people are walking out we’re saying things like ‘Bye racists,’ ‘You lost. Please just go home now,’” Garza wrote. Then he spotted an older woman wearing a Trump campaign T-shirt. “This woman is a human being and although I don’t share her views,” he recalled thinking, “I start yelling, ‘I will respect my elders. Please. Leave.’” An image shared later on Twitter by a Chicago Tribune photographer, E. Jason Wambsgans, shows what happened next. As Garza gestured with his hand for the woman to use the path through the crowd that he and the other protesters had cleared, she looked into his eyes and, in his account, said, “Go? Back in my day, you know what we did?” She then raised her arm in a Nazi salute.

Outside #TrumpChi rally. pic.twitter.com/wzEZfJD4Sy

— e. jason wambsgans (@ejwamb) March 12, 2016

The photograph of the woman, Birgitt Peterson, an immigrant from Germany who has been a Republican convention delegate in the past, quickly spread across social networks where it was used as ammunition against Trump supporters who deny that the candidate’s rhetoric has energized white nationalists.

Peterson, for her part, denied in an interview with the New York Times that she was racist in any way, offering the confused explanation that she was goaded into the gesture by the protesters and was only trying to show young people who compared Trump to Hitler the proper way to do a Nazi salute. “If you want to do it right, you do it right,” she said.

That explanation was undercut somewhat by the fact that she later admitted to the Chicago Tribune that she did say, “Hail to the German Reich,” in German, as she made the salute.

Saturday morning dawned with one of Trump’s most die-hard supporters, his eldest son, Donald Trump Jr., latching onto an internet conspiracy theory to try to distance the campaign from the Nazi salute. Relying on the impeccable research skills of the actor James Woods, Trump the younger shared a false rumor that the woman who gave the salute had been identified as Portia Boulger, the social media director of Women for Bernie Sanders.

Even after Boulger proved that she was not in Chicago on Friday night, and no longer has the hair style that made her look somewhat similar to the Trump supporter who freely admitted making the salute, the candidate’s son continued to spread the false accusation that the image had been “staged” by the Sanders campaign to tarnish his father’s supporters. He eventually deleted his tweets, but not before they had been widely shared, and he posted no explanation or apology. Woods, for his part, later issued a correction of sorts, but left up his original tweet asserting the salute was made by an “agitator/operative” for Sanders, a falsehood that’s now been shared more than 4,600 times on the social network.

Later in the morning, the tension was palpable as Trump returned to the campaign trail in Dayton, Ohio, and a young protester tried to vault onto the podium before being restrained as Secret Service agents surrounded the candidate.

#TrumpRally in Dayton where someone screamed behind Trump and security jumped on stage and surrounded him: pic.twitter.com/szMXAd6sc6

— Mashable News (@MashableNews) March 12, 2016

That incident had a bizarre coda when Trump later asserted that the protester, Tommy DiMassimo, a student at Wright State University in Dayton, “has ties to ISIS.”

USSS did an excellent job stopping the maniac running to the stage. He has ties to ISIS. Should be in jail! https://t.co/tkzbHg7wyD?ssr=true

— Donald J. Trump (@realDonaldTrump) March 12, 2016

Trump’s evidence appeared to be nothing more than a hoax video posted online that mixed DiMassimo’s own video of himself at a student protest last year with a photo-shopped image of him holding a gun before an Islamist flag, and music taken from a real ISIS video. That video was uploaded to YouTube after the incident on Saturday by someone who claimed, falsely, to have copied it from DiMassimo’s account.

Unfortunately for the Trump campaign, genuine video soon surfaced online of the candidate’s supporters leaving a rally in Cincinnati on Saturday, shouting at protesters: “Go to Auschwitz!” and “Go back to Africa!”

"Go back to Africa," suggests camo-clad Trump supporter. Video: pic.twitter.com/apQ1hD14D5

— tonydokoupil (@tonydokoupil) March 12, 2016

With attention once again so firmly placed on the volatile situation at Trump rallies, Clinton then committed another unforced error at one of her own campaign events on Saturday in St. Louis.

Just before 1 p.m., Amy Chozick of the New York Times reported on Twitter that Clinton suggested that her advocacy for universal health insurance in the 1990s came well before that of Bernie Sanders.

"I don't know where he was when I was trying to get health care in '93 and '94," a fired up @HillaryClinton says of Sanders.

— Amy Chozick (@amychozick) March 12, 2016

“I always get a little chuckle when I hear my opponent talk about doing it,” she told supporters. “Well, I don’t know where he was when I was trying to get health care in ’93 and ’94,” she added sarcastically.

Just four minutes after Chozick’s tweet of the remarks, the rapid-response director for the Sanders campaign, Mike Casca, supplied a photograph and video of Sanders standing with Clinton at an event in 1993 to promote health insurance reform.

literally standing right behind her. https://t.co/B2cvs4UNth https://t.co/oVA6WccMmZ pic.twitter.com/QeKLnBG337

— mike casca (@cascamike) March 12, 2016

A few minutes after that, the Sanders campaign also produced a signed and dated photograph of the two of them together from that year, inscribed by Clinton, “To Bernie Sanders, with thanks for your commitment to real health care access for all Americans.”

"with thanks for your commitment to real health care access for all Americans" – 1993 @amychozick pic.twitter.com/HDyUMtiNph

— arianna jones (@ariannaijones) March 12, 2016

By the end of the day, a remix of the video of the two events was posted on Twitter and shared tens of thousands of times.

I don't know where he was pic.twitter.com/kT4sTZTS8m

— Timothy Burke (@bubbaprog) March 12, 2016

Sunday started off with Trump responding to widespread calls for him to tone down his rhetoric by using Twitter to step it up instead: Embracing the discredited theory that supporters of Bernie Sanders are being dispatched to disrupt his rallies, he threatened to send his followers to the Vermont senator’s events.

Bernie Sanders is lying when he says his disruptors aren't told to go to my events. Be careful Bernie, or my supporters will go to yours!

— Donald J. Trump (@realDonaldTrump) March 13, 2016

A short time later, Chuck Todd of NBC confronted Trump with the fact that the video of the protester in Dayton he had based his ISIS accusation on, and shared with his millions of Twitter followers, was fake. Even so, Trump refused to accept that the video had not been made by the protester himself. “All we did was put out what he had on his internet,” Trump said. Informed by Todd that there was simply no evidence that the video was genuine, and no one in law enforcement intended to arrest DiMassimo based on the hoax, Trump replied, in what could be the new motto for his campaign, “What do I know about it? All I know is what’s on the internet.”

Trump: "All I know is what's on the Internet."
Reddit is running for president!

— Nick Confessore (@nickconfessore) March 13, 2016

The post Was This the Strangest Weekend in American Political History? appeared first on The Intercept.

Spare us your files, guv?

Microsoft is asking its certificate authority (CA) affiliates to send it their own copies of audit data after a MS system crash resulted in data loss.…

Just pass the background test

The Pentagon will next month launch the US government's first bug bounty program encouraging hackers to break into its websites in what could lead to a broader invitation to hack state assets for cash.…

Hackers can break TLS using SSLv2

Security researchers have discovered a new technique for deciphering the contents of supposedly secure communications.…

Locky is a new ransomware that has been released (most probably) by the Dridex gang (source). Not surprisingly, it is well prepared, which means that the threat actor behind it has invested sufficient resources for it, including its mature infrastructure. Let’s take a look.

Analyzed samples

• 7a23368ee84781d7584e058a9922f324
  
  • payload: 74dde1905eff75cf3328832988a785de <- main focus of this analysis
• d9df60c24ceca5c4d623ff48ccd4e9b9
• e7aad826559c8448cd8ba9f53f401182

Behavioral analysis

Locky is usually delivered via downloader in MS Office document (i.e. DOC) or JavaScript – e-mail attachment in a phishing campaign. The payload is a 32-bit Windows executable, containing the malicious core packed in a crypter/dropper (they are various, with various icons).

After being deployed it disappears and runs its dropped copy (renamed to svchost.exe) from the %TEMP% folder.

Encryption process

Files that have been encrypted are fully renamed. The beginning of the name (first 16 characters) is the unique ID of the victim. Then comes the ID of the file and the extension .locky that is typical for this ransomware.

The encrypted content has a high level of entropy and no patterns are visible.

Below: visualization of raw bytes of square.bmp. Left: unencrypted, right: encrypted.

 

After executing, Locky displays the ransom note in text and bitmap forms, setting the latter as the affected user’s wallpaper.

Text is localized to the language detected in the system. Translation looks professional enough (not from the auto translator), which may indicate that the threat actors target multiple countries – and prepared about this particular detail well. See sample translations (Polish, Spanish) here.

Registry keys

Looking at the registry we can find that a few elements have been added.

Key in autorun, to start the malware automatically after the system restart:

Data specific to the victim – individual ID, public RSA key and text of the ransom note to be displayed:

Public key stored in the registry:

Website for the victim

Each Locky victim has a Web page that can be accessed via Tor. These pages contain further instructions to the victim and support for managing payments.

Network communication

Locky communicates with the CnC, but it is difficult to analyze it via simple sniffing tools because full communication is encrypted:

More about the protocol can be learned by reading the code…

Inside

Every sample of Locky comes packed in some crypter, so the code is unreadable at first.

However, the core itself is not that obfuscated. After unpacking the outer layer of its defense, we can see valid strings and function calls. They give some explanation to the unreadable network capture. The RSA key as well as the ransom note are fetched from the server by a HTTP based protocol. The current sample comes with a list of 3 IP addresses.

• 31.41.47.37
• 188.138.88.184
• 85.25.138.187

Additionally it makes use of  DGA – Domain Generation Algorithm (more described here).

Communication protocol

Locky’s communication protocol is pretty simple: it consists of a POST request with parameters in a typical key=value format. However, as mentioned before, they are not sent by an open text, but wrapped and encrypted. First, the request is prepared and it’s parameters are filled. Then its MD5 is calculated. Both elements are concatenated and encrypted together.

Example of wrapped request (before encryption):

Similarly, when the response comes, first it gets decrypted, then its MD5 is validated – and if it passed the validation then it is parsed.

Example of received response (encrypted):

Decrypting:

Decrypted response turns out to be an RSA key prompted by its hash:

Locky uses 3 commands (identified by the key act):

• getkey
• gettext
• stats

We have explained the actions in further detail below.

[getkey] Initial registration and fetching the RSA key:

id=[16]&act=getkey&affid=1&lang=[2:lang]&corp=[0-1]&serv=[0-1]&os=[Windows name]&sp=[num]&x64=[0-1]

Unique user ID is 16 byte long hexadecimal string, created locally (pseudocode):

win_dir = GetWindowsDirectory
mount_point_name = GetVolumeNameForVolumeMountPoint(win_dir)
GUID = get_GUID(mount_point_name)
md5sum = MD5(GUID)
id = md5sum.uppercase().substr(0,16)

After that follows:

Language: obtained by functions: GetLocaleInfo , GetUserDefaultUILanguage. System info – fetched by GetVersionEx and GetSystemMetrics(SM_SERVERR2) and translated to the built in lists. IsWow64Process is used to identify if the system is 64bit.

[gettext] Fetching the ransom text:

id=[16]&act=gettext&lang=[2:lang]

[stats] Sending statistics about encrypted files:

id=[16]&act=stats&path=[root_path]&encrypted=[num]&failed=[num]&length=[num]

What is attacked?

Locky attacks 3 types of local drives: fixed, removable and ramdisks…

…as well as network resources. Network shares are mapped using WNetAddConnection2

For every drive a new encrypting thread is started.

How does the encryption work?

In the ransom note attackers claimed that Locky uses both RSA and AES algorithms. Looking at the code we can confirm this. Cryptography is implemented using Windows Crypto API and really uses the mentioned algorithms.

First, RSA key (2048 bit) is fetched from the server and imported:

The RSA key is used to encrypt AES keys, which are randomly generated for each file.

Below – importing a random AES key (128 bit long):

Processing of the files starts by enumerating them and storing in a list. Then the encryption proceeds by this list.

Every thread collects statistics about the encrypted files (i.e summary of how many files has been encrypted in a particular path):

Statistics are encrypted and sent to the C&C.

Ransom note

As mentioned before, ransom note in a language detected language by GetUserDefaultUILanguage is downloaded from the server.

Most ransomware drops ransom notes in HTML form, and then opens it in a Web browser. Locky does something more interesting: it renders and sets a bitmap as wallpaper.

Bitmap rendering:

Wallpaper settings are edited by registry keys:

After successful rendering and saving the bitmap, it sets it as a wallpaper using SystemParamsInfo (action 0x14 = SPI_SETDESKWALLPAPER)

Conclusion

Locky struck in February but it has already gained popularity. Due to the fact that it is a wide spread attack, carried by the same entities that distribute Dridex, it easily triggered interest of many researchers. Upon closer inspection, however, we can say that it is not that different from common ransomware. It looks solidly written and well prepared, but it doesn’t show too much novelty so far.

Appendix

• http://community.hpe.com/t5/Security-Research/Feeling-even-Locky-er/ba-p/6834311#.VtyC-M3iuV7 – Locky administration panel
• http://blog.fortinet.com/post/a-closer-look-at-locky-ransomware-2 – “A Closer Look at Locky Ransomware” by Fortinet
• https://www.proofpoint.com/us/threat-insight/post/Dridex-Actors-Get-In-the-Ransomware-Game-With-Locky – “Dridex Actors Get In the Ransomware Game With Locky”
• https://blogs.forcepoint.com/security-labs/locky-ransomware-encrypts-documents-databases-code-bitcoin-wallets-and-more
• http://phishme.com/locky-a-new-encryption-ransomware-borrowing-ideas-from-the-best/
• https://www.sensepost.com/blog/2016/understanding-locky/

 

Details about a new vulnerability related ...(more)...

Another 15-year-old teenager got arrested from the land of cakes, Scotland, by British Police for breaking into the FBI Systems on 16th February. Under the Britain’s anti-hacking law, Computer Misuse Act 1990, the boy has been arrested for his role in hacking and unauthorized access to the digital material. <!-- adsense --> Federal Agents had fled to Glasgow in an attempt to carry out a

These networks are clusters of the Angler EK and other badness. I tend to Tweet about Angler IPs rather than blog about them. Following the #AnglerEK hashtag at Twitter can yield more information, often in realtime. All the links go to Pastebin with more information about the IPs and the blocks. Note that a few of these blocks do contain some legitimate Russian-language sites, but if your

This is an overview of the most popular exploit kits that we have caught in our honeypots in the past few weeks and have tested against Malwarebytes Anti-Exploit.

For those interested in studying or replaying those captures (at your own risk!!), the corresponding Fiddler saz files can be downloaded here and opened with the usual password.

Angler EK

Neutrino EK

Nuclear EK

Magnitude EK

RIG EK

Hide our snooping? Why bother asks China's Google clone

Sit down, so you don't injure yourself falling down in surprise: the browser provided by China's Baidu is a privacy nightmare.…

EMET knocks out EMET. And the winner is ... nobody. Except Linux advocates

FireEye security wonks Abdulellah Alsaheel and Raghav Pande have twisted the barrels of Microsoft's lauded EMET Windows defense gun 180 degrees and fired.…

New API, policies and open source manager added to ward off future stolen creds attacks

Hosting outfit Linode has announced a slew of changes to its user procedures after a long analysis of the attack that led to a system-wide password reset in January. It's also determined that the breach was the result of customer credential theft.…

I remember seeing the Apple commercial back in the day when it came out that depicted 1984 as the catchy advertising plot point for the Mac computer at the time. If only Woz and Jobs has known just how prophetic those images would be today. I remember too back in 1993 when the idea was floated and a governmental movement began to have a back door (aka a clipper chip) inserted into systems to allow access by the government *cough NSA cough* to be able to see the “evil doers” and stop them. I also remember the sane stopped that from happening. Well, that was then and this is now, well past 9/11 and nigh on 16 years later, we are faced with not only a government toying with the idea again but a federal body demanding through writ of law that a company break the system they have created for what is being touted as the greater good.

Friends while I agree terrorism is bad (I was there a day after 9/11 and worked with the red cross there) I have to stop short at believing that the GWOT needs for us all to give up ALL semblance of personal privacy to fight the terrorists. In fact, I would like to call bullshit on the FBI’s and Comey’s desires to break the systems of cryptography for an alleged boon to the fight on terror. It has become clear that the director of the FBI is not a tech guy and does not understand crypto very well but that is no excuse to continue to leverage the courts to try to induce a company to break it’s system for one phone let alone the notion that this one instance would not be re-used and re-packaged to do so again whenever they (the FBI) liked. This is precedent time, not just a one off issue with a terrorists phone that may or may not have any data on it concerning other actors who may have radicalised Sayed Farook and his wife.

Clearly we are at a precipice here in our digital democracy that has been building for some time. I have attended more than a few seminars by the ACLU and the Electronic Frontier Foundation on the 4rth Amendment and the digital domain and I have to tell you we are all behind the 8 ball on this one with the way the government lawyers tend to think. I have seen people compelled to give their passwords against the 5th Amendment as well and folks it’s time for you to be rather concerned about this. This is the time to really fund the EFF and to bone up on your own rights where these matters are concerned. It is also time for the cypherpunks out there to double and triple in numbers. I hate to say it but I will put it in the common derpy vernacular that is all the rage now…

We are all at cyber war.

When you are at cyber war with a nation state you will lose.

Now, the US and the FBI are becoming the definition of a Nation State Actor. Though, not on a foreign nation. They are targeting you too.

Over reach by the FBI has been a thing for a long time and if you just Google it you will be able to read quite a lot about it. Now consider all of the machinations of the TAO and all of the legal wrangling their lawyers have done to make what they are doing rationalize as legal. Remember John Yoo? Well you should and if you don’t Google him up. It’s easy for lawyers to fuzz the legalities and the moralities into an ethics-less pile of phrases that only allow them to get away with things. I am going to guarantee you now that if this order goes through and Apple is forced to back door the iPhone at a base level, it will be re-used and it will be abused just like the use of STINGRAYS have been lately and it won’t stop there. Once the precedent has been set in law, the legal bar has been set and then it is just a matter of how long until the rights we all have been granted in the US under the Constitution get even more eroded by slick ideas and arguments by those with an agenda of fear.

Honestly, if you look at the history of the terrorism that has occurred these people are known quantities already and that is without the use of back doors or breaking hacking and negating rights. This is not a crypto issue but more so a law enforcement issue of not being able to keep up with their own databases. Please people, don’t buy into crypto being a clear and present danger to you and yours. Crypto is no existential threat, instead the abuse of the laws we have on the books is. Ordering Apple is just the next worst step on the slippery slope to becoming that which we have seen in the 1984 commercial.

Dr. K.

 

YESTERDAY, APPLE CEO TIM COOK published an open letter opposing a court order to build the FBI a “backdoor” for the iPhone.

Cook wrote that the backdoor, which removes limitations on how often an attacker can incorrectly guess an iPhone passcode, would set a dangerous precedent and “would have the potential to unlock any iPhone in someone’s physical possession,” even though in this instance, the FBI is seeking to unlock a single iPhone belonging to one of the killers in a 14-victim mass shooting spree in San Bernardino, California, in December.

It’s true that ordering Apple to develop the backdoor will fundamentally undermine iPhone security, as Cook and other digital security advocates have argued. But it’s possible for individual iPhone users to protect themselves from government snooping by setting strong passcodes on their phones — passcodes the FBI would not be able to unlock even if it gets its iPhone backdoor.

The technical details of how the iPhone encrypts data, and how the FBI might circumvent this protection, are complex and convoluted, and are being thoroughly explored elsewhere on the internet. What I’m going to focus on here is how ordinary iPhone users can protect themselves.

The short version: If you’re worried about governments trying to access your phone, set your iPhone up with a random, 11-digit numeric passcode. What follows is an explanation of why that will protect you and how to actually do it.

If it sounds outlandish to worry about government agents trying to crack into your phone, consider that when you travel internationally, agents at the airport or other border crossings can seize, search, and temporarily retain your digital devices — even without any grounds for suspicion. And while a local police officer can’t search your iPhone without a warrant, cops have used their own digital devices to get search warrants within 15 minutes, as a Supreme Court opinion recently noted.

The most obvious way to try and crack into your iPhone, and what the FBI is trying to do in the San Bernardino case, is to simply run through every possible passcode until the correct one is discovered and the phone is unlocked. This is known as a “brute force” attack.

For example, let’s say you set a six-digit passcode on your iPhone. There are 10 possibilities for each digit in a numbers-based passcode, and so there are 10⁶, or 1 million, possible combinations for a six-digit passcode as a whole. It is trivial for a computer to generate all of these possible codes. The difficulty comes in trying to test them.

One obstacle to testing all possible passcodes is that the iPhone intentionally slows down after you guess wrong a few times. An attacker can try four incorrect passcodes before she’s forced to wait one minute. If she continues to guess wrong, the time delay increases to five minutes, 15 minutes, and finally one hour. There’s even a setting to erase all data on the iPhone after 10 wrong guesses.

This is where the FBI’s requested backdoor comes into play. The FBI is demanding that Apple create a special version of the iPhone’s operating system, iOS, that removes the time delays and ignores the data erasure setting. The FBI could install this malicious software on the San Bernardino killer’s iPhone, brute force the passcode, unlock the phone, and access all of its data. And that process could hypothetically be repeated on anyone else’s iPhone.

(There’s also speculation that the government could make Apple alter the operation of a piece of iPhone hardware known as the Secure Enclave; for the purposes of this article, I assume the protections offered by this hardware, which would slow an attacker down even more, are not in place.)

Even if the FBI gets its way and can clear away iPhone safeguards against passcode guessing, it faces another obstacle, one that should help keep it from cracking passcodes of, say, 11 digits: It can only test potential passcodes for your iPhone using the iPhone itself; the FBI can’t use a supercomputer or a cluster of iPhones to speed up the guessing process. That’s because iPhone models, at least as far back as May 2012, have come with a Unique ID (UID) embedded in the device hardware. Each iPhone has a different UID fused to the phone, and, by design, no one can read it and copy it to another computer. The iPhone can only be unlocked when the owner’s passcode is combined with the the UID to derive an encryption key.

So the FBI is stuck using your iPhone to test passcodes. And it turns out that your iPhone is kind of slow at that: iPhones intentionally encrypt data in such a way that they must spend about 80 milliseconds doing the math needed to test a passcode, according to Apple. That limits them to testing 12.5 passcode guesses per second, which means that guessing a six-digit passcode would take, at most, just over 22 hours.

You can calculate the time for that task simply by dividing the 1 million possible six-digit passcodes by 12.5 per seconds. That’s 80,000 seconds, or 1,333 minutes, or 22 hours. But the attacker doesn’t have to try each passcode; she can stop when she finds one that successfully unlocks the device. On average, it will only take 11 hours for that to happen.

But the FBI would be happy to spend mere hours cracking your iPhone. What if you use a longer passcode? Here’s how long the FBI would need:

• seven-digit passcodes will take up to 9.2 days, and on average 4.6 days, to crack
• eight-digit passcodes will take up to three months, and on average 46 days, to crack
• nine-digit passcodes will take up to 2.5 years, and on average 1.2 years, to crack
• 10-digit passcodes will take up to 25 years, and on average 12.6 years, to crack
• 11-digit passcodes will take up to 253 years, and on average 127 years, to crack
• 12-digit passcodes will take up to 2,536 years, and on average 1,268 years, to crack
• 13-digit passcodes will take up to 25,367 years, and on average 12,683 years, to crack

It’s important to note that these estimates only apply to truly random passcodes. If you choose a passcode by stringing together dates, phone numbers, social security numbers, or anything else that’s at all predictable, the attacker might try guessing those first, and might crack your 11-digit passcode in a very short amount of time. So make sure your passcode is random, even if this means it takes extra time to memorize it. (Memorizing that many digits might seem daunting, but if you’re older than, say, 29, there was probably a time when you memorized several phone numbers that you dialed on a regular basis.)

Nerd tip: If you’re using a Mac or Linux, you can securely generate a random 11-digit passcode by opening the Terminal app and typing this command:

python -c 'from random import SystemRandom as r; print(r().randint(0,10**11-1))'

It’s also important to note that we’re assuming the FBI, or some other government agency, has not found a flaw in Apple’s security architecture that would allow them to test passcodes on their own computers or at a rate faster than 80 milliseconds per passcode.

Once you’ve created a new 11-digit passcode, you can start using it by opening the Settings app, selecting “Touch ID & Passcode,” and entering your old passcode if prompted. Then, if you have an existing passcode, select “Change passcode” and enter your old passcode. If you do not have an existing passcode, and are setting one for the first time, click “Turn passcode on.”

Then, in all cases, click “Passcode options,”  select “Custom numeric code,” and then enter your new passcode.

Here are a few final tips to make this long-passcode thing work better:

• Within the “Touch ID & Passcode” settings screen, make sure to turn on the Erase Data setting to erase all data on your iPhone after 10 failed passcode attempts.
• Make sure you don’t forget your passcode, or you’ll lose access to all of the data on your iPhone.
• Don’t use Touch ID to unlock your phone. Your attacker doesn’t need to guess your passcode if she can push your finger onto the home button to unlock it instead. (At least one court has ruled that while the police cannot compel you to disclose your passcode, they can compel you to use your fingerprint to unlock your smartphone.)
• Don’t use iCloud backups. Your attacker doesn’t need to guess your passcode if she can get a copy of all the same data from Apple’s server, where it’s no longer protected by your passcode.
• Do make local backups to your computer using iTunes, especially if you are worried about forgetting your iPhone passcode. You can encrypt the backups, too.

By choosing a strong passcode, the FBI shouldn’t be able to unlock your encrypted phone, even if it installs a backdoored version of iOS on it. Not unless it has hundreds of years to spare.

The post Upgrade Your iPhone Passcode to Defeat the FBI’s Backdoor Strategy appeared first on The Intercept.

 

It’s time for our weekly roundup of all things Infosec!

On the blog, we covered Safer Internet Day and then followed up with a very unsafe Internet, in the form of DMA Locker Ransomware. We took a look at a reasonably rare example of Airbnb phishing, and also explained how you can do your best to steer clear of PUPs. We finished things off with a deep-dive into a Skype Malvertising campaign.

As for the rest of the news…

• Stingray mobile phone trackers are receiving some attention after heavy use by Law Enforcement in New York.
• PBX phone system hacking nets $50 million over four years for scammers – until it all goes horribly wrong for them.
• The Internet of Things is a big deal, and also somewhat insecure. New guidelines are now trying to help steer the IoT to a slightly more secure standing.
• Banks are once again under threat from Carbanak.
• The Malware Museum opens its doors to the public.
• Gamers who like to cheat in the popular videogame Hearthstone are the final destination for a new piece of Malware.
• A deepdive into the world of a “global cyberespionage campaign” called Poseidon.
• Darknet phishing ahoy, as scammers imitate a dubious site to grab some login credentials.

Safe surfing, everyone!

The Malwarebytes Labs Team

Malware could be on your application whitelist if you haven't caught up on patching

Researchers at Blue Frost Security have disclosed a bug that let them evade FireEye's analysis engine, getting a short-lived but dangerous way to whitelist malware.…

So what do you expect from an Artificially intelligent program run by the government intelligence agency? Possibly killing innocent people. The real-life SKYNET, the fictional malevolent artificial intelligence in the Terminator movies, run by the US National Security Agency (NSA) is a surveillance program that uses cell phone metadata to track the GPS location and call activities of

In the escalating battle between the Federal Bureau of Investigation (FBI) and Apple over iPhone encryption, former National Security Agency (NSA) contractor Edward Snowden and Google chief executive Sundar Pichai just sided with Apple's refusal to unlock iPhone. Yesterday, Apple CEO Tim Cook refused to comply with a federal court order to help the FBI unlock an iPhone owned by one of the

Download PDF

The year in figures

According to Kaspersky Lab, in 2015

• The proportion of spam in email flows was 55.28%, which is 11.48 percentage points lower than in 2014.
• 79% of spam emails were no more than 2 KB in size.
• 15.2% of spam was sent from the US.
• 146,692,256 instances that triggered the ‘Antiphishing’ system were recorded.
• Russia suffered the highest number of phishing attacks, with 17.8% of the global total.
• Japan (21.68 %) took the lead in the ranking of unique users attacked by phishers.
• 34.33% of phishing attacks targeted online financial organizations (banks, payment systems and online stores).

New domain zones in spam

In early 2015, we registered a surge in the number of new top-level domains used for distributing mass mailings. This was caused by the growth in interest among spammers for the New gTLD program launched in 2014. The main aim of this program is to provide organizations with the opportunity to choose a domain zone that is consistent with their activities and the themes of their sites. The business opportunities provided by New gTLD were enthusiastically endorsed by the Internet community, and active registration of new domain names is still ongoing.

In 2015, proportion of #spam was 55.28% down from 66.76% in 2014 #KLReport

Tweet

However, new domain zones almost immediately became an arena for the large-scale distribution of spam, as cybercriminals registered domains to spread mass mailings. At first, there was some logical connection between the theme of the spam and the domain name, but this changed as the year went on and the domain names used in mass mailings were, on the whole, not related to the subject of the spam. However, even now we still come across isolated cases where the connection is noticeable. For example, online dating sites are often placed in the .date zone.

This lack of any connection between the domain name and spam theme was mainly caused by the cost of new domains. The attackers try to choose the cheapest possible hosting because the sites will often be used just once for a specific spam mass mailing, so the domain name does not play a major role. Instead, the deciding factors tend to be the cost of the domains and the discounts that small registrars are willing to provide for bulk purchases.

Spammer tricks: methods for expressing domain names

Scammers try to make every email unique in order to bypass mass filtering and complicate the work of content filters. It is quite easy to make each text different by using similar characters from other alphabets, or by changing the word and sentence order, etc. But there is always the address of the spammer site – it can’t be changed so easily, and the whole point of sending out spam is for users to click a link to the advertised site. Over the years, spammers have come up with numerous ways to hide the spammer site from anti-spam filters: redirects to hacked sites, generation of unique links to short URL services, the use of popular cloud services as redirects, etc.

In 2015, 79% of spam emails were less than 2 KB in size #KLReport

Tweet

In 2015, in addition to the methods mentioned above, spammers also focused on ways of expressing domain names and IP addresses. Here we take a closer look at these tricks by studying examples taken from a variety of spam messages.

Special features of the IP protocol: different IP formats

The standard method of writing IP addresses IPv4 is the dotted-decimal format where the value of each byte is given as a decimal number from 0 to 255, and each byte is separated by a dot. However, there are other formats that browsers will interpret correctly. These are binary, octal, hexadecimal formats, and the format dword/Undotted Integer when every IP byte is first converted to a hexadecimal format, then all the bytes are written in one number in the order they were written in the IP address, and then this number is converted into the decimal system. All these formats can be combined by writing each part of the IP in a different way, and the browser will still interpret it correctly!

These techniques are exploited by spammers. They write the same IP addresses in many different ways, including the method of combining different formats:

• oct – hex

• oct – dword

• hex – dword

Addresses in hexadecimal format can be written with and without dots separating the numbers:

Additionally, 4294967296 (256^4) can be added any number of times to the number in the Integer format, and the result will still be interpreted as the same IP address.

In 2015, 15.2% of spam was sent from the US #KLReport

Tweet

In the decimal format, the number 256 can be added to each part of the IP address any amount of times – as long as there is a three-digit result, the address will be interpreted correctly.

In the octal format, any number of leading zeros can be added to the IP address, and it will remain valid:

You can also insert any number of forward slashes in the address:

Although in some legal libraries IP addresses can be stored in different formats, it is prohibited to use any format other than the standard dotted-decimal in the URL (i.e., in the links being referred to).

Obfuscation of an IP address, or how many ways can a number be written in Unicode

We have already written about the obfuscation of key words in spam using various Unicode ranges.

The same tricks can be applied when writing IP addresses and domain names. With regards to an IP, in 2015 spammers often used Unicode numbers from the so-called full-size range. Normally, it is used with hieroglyphic languages so that Latin letters and numbers do not look too small and narrow compared to the hieroglyphics.

We also came across figures from other ranges – figures in a circle, figures that are underscored, etc.:

Obfuscation of domains

As mentioned above, this trick also works with domains. Unicode has even more letter ranges than numerical. Spammers often used multiple ranges in a single link (changing them randomly in every email, thereby increasing the variability within a single mass mailing).

To make the links even more unique, rather than obfuscating the spammer site itself the scammers obfuscated short URL services where the links to the main site were generated in large quantities:

Interpreting URL symbols

URLs contain special symbols that spammers use to add ‘noise’. Primarily, it is the @ symbol which is intended for user authentication on the site. A link such as http://login:password@domain.com means that the user wants to enter the site domain.com using a specific username (login) and password. If the site does not require authentication, everything that precedes the @ symbol, will simply be ignored. We came across mass mailings where spammers simply inserted the @ symbol in front of the domain name and mass mailings where the @ symbol was preceded with a random (or non-random) sequence:

It is interesting that this technique was used to obfuscate links; that is usually the prerogative of phishers. This method of presenting URLs can be used by fraudsters to trick users into thinking that a link leads to a legitimate site. For example, in the link http://google.com@spamdomain.com/anything the domain that the browser accepts is spamdomain.com, not google.com. However, in order to trick users, spammers have used another domain-related technique: they registered lots of domains beginning with com-. With third-level domains the links in emails looked like this: http://learnmore.com-eurekastep.eu/find

If you don’t look carefully, you might think that the main domain is learnmore.com, whereas it is in fact com-eurekastep.eu.

In addition to the @ symbol, scammers filled links with other symbols: www.goo&zwj.g&zwjl/0Gsylm.

For example, in the case above the “&zwj” fragment in the goo.gl domain has been inserted randomly in different parts of the domain making the link unique in each email. This insertion is called a zero-width joiner; it is used to combine several individual symbols in the Hindi languages as well as emoticons in one symbol. Within the domain, it obviously carries no semantic meaning; it simply obfuscates the link.

Yet another method of obscuring links is the use of a “soft hyphen” (SHY). In HTML, SHY is a special symbol that is not visible in the text, but if a word containing a special symbol doesn’t fit in at the end of a line, the part after the special symbol is moved to the next line, while a hyphen is added to the first part. Typically, browsers and email clients ignore this symbol inside links, so spammers can embed it anywhere in a URL and as often as they like. We came across a mass mailing where soft hyphens had been inserted in the domain more than 200 times (hexadecimal encoding):

As well as the soft hyphen there are other special symbols used in domains – the sequence indicator (& ordm;), the superscripts 1 and 2 (& sup1 ;, & sup2;) – that can be interpreted by some browsers as the letter “o” and the figures “1” and “2” respectively.

Reiteration of a popular domain name

Another original way of adding noise to links used by spammers in 2015 was the use of a well-known domain as a redirect. This trick is not new, but this time the fraudsters added the same well-known domain several times:

Emails without a URL

It is also worth mentioning those cases where no domains were used at all. Instead of a URL, a number of spam mailings contained a QR-code.

Other mass mailings prompted the user to enter a random sequence in a search engine; the link to the site appeared at the top of the search results:

World events in spam

The next Olympic Games in Brazil only take place in the summer of 2016, but already in 2015 fraudulent notifications of lottery wins dedicated to this popular sporting event were being registered. These included emails containing an attached PDF file that informed recipients that their address had been randomly selected out of millions of email addresses. In order to claim the prize it was necessary to respond to the email and provide specific personal information. In addition to the text, the attachments contained different graphical elements (logos, photos, etc.). The fake lottery win notifications, which were of a considerable length, were often sent out with attachments to bypass spam filtering.

In 2015, ‘Nigerian’ scammers exploited political events in Ukraine, the war in Syria, the presidential elections in Nigeria and earthquake in Nepal to convince recipients that their stories were genuine. The authors primarily sought help to invest huge sums of money or asked for financial assistance. These so-called Nigerian letters made use of the customary tricks to deceive recipients and extort money from them.

Emails about the war in Syria often mentioned refugees and Syrian citizens seeking asylum in Europe. Some emails were made to look as if they had been sent directly from refugee camps and contained complaints about the poor conditions.

Statistics

Proportion of spam in email traffic

In 2015, the proportion of spam in email traffic was 55.28%, which is 11.48 percentage points lower than the previous year.

The proportion of spam in email traffic, 2015

The most noticeable drop was registered in the first months of 2015 – from 61.86% in January to 53.63% in April. The fluctuations throughout the rest of the year were inconsiderable – within 1-2 percentage points.

Sources of spam by country

Sources of spam by country, 2015

In 2015, there was a slight change to the top three sources of spam: China (6.12%) dropped to fourth although the proportion of spam distributed from that country actually increased by 0.59 percentage points. Replacing it in third place was Vietnam (6.13%), which saw 1.92 percentage points added to its share. Russia (6.15%) remained in second place with an increase of 0.22 percentage points, while the US (15.16%) remained the undisputed leader despite a decrease of 1.5 percentage points.

In 2015, users in USA were targeted by 4.92% of worldwide malicious emails #KLReport

Tweet

As was the case in 2014 Germany came fifth (4.24%), with its contribution increasing by 0.24 percentage points. The rest of the Top 10 consisted of Ukraine (3.99%, +0.99 p.p.), France (3.17%, +0.62 p.p.), India (2.96%, no change), Argentina (2.90%, -0.65 p.p.) and Brazil (2.85%, +0.42 p.p.).

The size of spam emails

The size of spam emails in 2015

The proportion of super-short spam emails (under 2 KB) grew in 2015 and averaged 77.26%, while the share of emails sized 2-5 KB fell to 9.08%. The general trend of 2015 was a reduction in the size of emails.

Malicious attachments in email

The Top 10 malicious programs spread by email in 2015

The notorious Trojan-Spy.HTML.Fraud.gen remained the most popular malicious program sent by email. This program is a fake HTML page sent via email that imitates an important notification from a large commercial bank, online store, or software developer, etc. This threat appears as an HTML phishing website where a user has to enter his personal data, which is then forwarded to cybercriminals.

Trojan-Downloader.HTML.Agent.aax was in second, while ninth and tenth positions were occupied by Trojan-Downloader.HTML.Meta.as. and Trojan-Downloader.HTML.Meta.ay respectively. All three are HTML pages that, when opened by users, redirect them to a malicious site. Once there, a victim usually encounters a phishing page or is offered a download – Binbot, a binary option trading bot. These malicious programs spread via email attachments and the only difference between them is the link that redirects users to the rigged sites.

Third was Trojan-Banker.Win32.ChePro.ink. This downloader is a CPL applet (a Control Panel component) that downloads Trojans designed to steal confidential financial information. Most malicious programs of this type are aimed at Brazilian and Portuguese banks.

Email-Worm.Win32.Mydoom.l was in fourth place. This network worm spreads as an email attachment via file-sharing services and writable network resources. It harvests email addresses from infected computers so they can be used for further mass mailings. To send the email, the worm directly connects to the SMTP server of the recipient.

Next came Trojan.JS.Agent.csz and Trojan-Downloader.JS.Agent.hhi, which are downloaders written in JavaScript. These malicious programs may contain several addresses (domains) which the infected computer consecutively calls. If the call is successful, a malicious EXE file is downloaded in the temp folder and run.

Trojan-PSW.Win32.Fareit.auqm was in eighth position. Fareit Trojans steal browser cookies and passwords from FTP clients and email programs and then send the data to a remote server run by cybercriminals.

Malware families

Throughout the year, Upatre remained the most widespread malware family. Malware from this family downloads the Trojan banker known as Dyre/Dyreza/Dyzap.

MSWord.Agent and VBS.Agent occupied second and third places respectively. To recap, these malicious programs are DOC files with an embedded macro written in Visual Basic for Applications (VBA), which runs on opening the document. It downloads and runs other malware, such as Andromeda.VBS.Agent. As the name suggests, it uses the embedded VBS script. To download and run other malware on the user’s computer the malicious programs of this family utilize the ADODB.Stream technology.

The Andromeda family came fourth. These programs allow the attackers to secretly control infected computers, which often become part of a botnet. Noticeably, in 2014 Andromeda topped the rating of the most widespread malware families.

In 2015, #Japan (21.68 %) took the lead in the ranking of unique users attacked by phishers #KLReport

Tweet

The Zbot family came fifth. Representatives of this family are designed to carry out attacks on servers and user computers, and also for capturing data. Although ZeuS/Zbot is capable of carrying out various harmful actions, it is most often used to steal banking information.

Countries targeted by malicious mailshots

Distribution of email antivirus verdicts by country, 2015

For the previous three years, the Top 3 countries most often targeted by mailshots has remained unchanged – the US, the UK and Germany. However, in 2015, spammers altered their tactics and targets. As a result, Germany came first (19.06%, +9.84 p.p.) followed by Brazil (7.64%, +4.09 p.p.), which was only sixth in 2014.

The biggest surprise in Q3, and the whole of 2015, was Russia’s rise to third place (6.30%, +3.06 p.p.). To recap, in 2014 Russia was ranked eighth with no more than 3.24% of all malicious spam being sent to the country.

We would like to believe that despite the trend seen in recent quarters, the number of malicious mass mailings sent to Russia will decrease. As for the total number of malicious attachments sent via email, their number is likely to grow in 2016 and the theft of personal information and Trojan ransomware will occupy the top places.

Special features of malicious spam

In spam traffic for 2015 we registered a burst of mass mailings with macro viruses. The majority of emails containing macro viruses in Q1 were sent in attachments with a .doc or .xls extension and belonged to the Trojan downloader category designed to download other malicious programs.

As a rule, the malicious attachments imitated various financial documents: notifications about fines or money transfers, unpaid bills, payments, complaints, e-tickets, etc. They were often sent on behalf of employees from real companies and organizations.

In 2015, 34.33% of phishing attacks targeted clients of financial organizations #KLReport #banking

Tweet

The danger posed by macro viruses is not restricted to their availability and ease of creation. A macro virus can infect not only the document that is opened initially but also a global macro common to all similar documents and consequently all the user’s documents that use global macros. Moreover, the VBA language is sufficiently functional to be used for writing malicious code of all kinds.

In 2015, cybercriminals specializing in malicious spam continued to distribute malware in non-standard archive formats (.cab, .ace, .7z, .z, .gz). These formats were introduced long ago and are used by specialists in software development and installation, but they are largely unknown to ordinary users, unlike ZIP and RAR. Another difference is the high degree of file compression. These malicious archives were passed off as a variety of attachments (orders, invoices, photographs, reports, etc.) and contained different malicious programs (Trojan-Downloader.Win32.Cabby, Trojan-Downloader.VBS.Agent.azx, Trojan-Spy.Win32.Zbot .iuk, HawkEye Keylogger, etc.). The vast majority of emails were in English, though there were messages in other languages.

In 2014, cybercriminals were particularly active in sending out fake emails from mobile devices and notifications from mobile apps containing malware and adverts. In 2015, the mobile theme continued: malicious programs were distributed in the form of .apk and .jar files, which are in fact archived executable application files for mobile devices. Files with the .jar extension are usually ZIP archives containing a program in Java, and they are primarily intended to be launched from a mobile phone, while .apk files are used to install applications on Android.

In particular, cybercriminals masked the mobile encryption Trojan SLocker behind a file containing updates for Flash Player: when run, it encrypts images, documents and video files stored on the device. After launching, a message is displayed telling the user to pay a fee in order to decrypt his files. Another .jar archive contained Backdoor.Adwind written in Java. This multi-platform malicious program can be installed not only on mobile devices but also on Windows, Mac and Linux.

The attackers who send out malware in files for mobile devices are most probably hoping that recipients using email on a mobile device will install the malicious attachment.

With every year, cybercriminals are becoming more interested in mobile devices. This is primarily due to the constant increase in activity by mobile users (using messengers and other methods of exchanging data) and the migration of different services (e.g., financial transactions) to mobile platforms, and of course, one user may have several mobile devices. Secondly, it is due to the emergence of various popular apps that can be used by cybercriminals both directly (for sending out spam, including malicious spam) and indirectly (in phishing emails). For example, users of the popular messenger WhatsApp fall victim to not only traditional advertising spam but also virus writers. Mobile users should be especially careful because cybercriminal activity in this sphere is only likely to increase.

Phishing

Main trends

In 2015, the Anti-Phishing system was triggered 148,395,446 times on computers of Kaspersky Lab users. 60% (89,947,439) of those incidents were blocked by deterministic components and 40% (58,448,007) by heuristic detection components.

Methods of distributing phishing content

The methods used by cybercriminals to spread phishing content have long gone beyond the framework of email clients. For example, one of the most popular ways of distributing phishing pages is pop-up ads. In 2015, we came across a variety of fraudulent schemes utilizing this simple trick: the fake page automatically opens in the browser when a user visits certain sites, including legitimate ones, but uses pop-up advertising.

Cybercriminals used this technique to attack customers of Russian banks in the third and fourth quarters of 2015.

The fraudulent page to which the victim is redirected by a pop-up advert

Other popular themes of the year

As we mentioned in Q1, the contribution of the ‘Delivery company’ category is very small (0.23%), but it has recently experienced a slight increase (+0.04 p.p.). In addition, DHL, one of the companies in this category, was among the Top 100 organizations most often targeted by phishers.

This method – an email sent on behalf of a delivery firm – is often used by fraudsters to distribute malicious attachments, gather personal information and even collect money.

Phishing email sent on behalf of FedEx

The attackers are especially active in this category in the run-up to holidays when people tend to buy presents using popular delivery services.

Email tricks

Scammers have long made successful use of PDF attachments in phishing attacks. These files are usually a form for entering personal information that is sent to the fraudsters by pressing a button in the file. However, in 2015 we saw a surge of emails in which the text message and the link to the phishing page were included in the PDF document. The text in the body of the message was reduced to a minimum to bypass spam filtering.

These tricks are used against organizations in all categories. In 2015, many attacks of this type targeted banking and mail organizations.

Example of a phishing email. The body of the message contains only the text imitating the heading of the email to which this email is allegedly responding. The email has an attached PDF file that contains the link to the phishing page.

We came across numerous PDF files that redirected victims to phishing websites. The fraudsters encouraged the user to click on ‘View pdf File’ to read the contents of the file.

A phishing email with an attached PDF file containing a redirect to a phishing website

The geography of attacks

Top 10 countries by percentage of attacked users

Japan had the highest proportion of users subjected to phishing attacks (21.68%), a 2.17 p.p. increase from the previous year.

The percentage of users on whose computers the anti-phishing system was triggered out of the total number of users of Kaspersky Lab products in the country, 2015

Top 10 countries by percentage of attacked users

Last year’s leader, Brazil (21.63%), fell to second place with a drop of 5.77 percentage points in the number of attacked users. It was followed by India (21.02%, -2.06 p.p.) and Ecuador (20.03%, -2.79 p.p.).

The distribution of attacks by country

Russia accounted for the greatest share of phishing attacks, with 17.8% of the global total, an increase of 0.62 percentage points compared to the previous year.

Distribution of phishing attacks by country in 2015

Behind Russia in second place was Brazil (8.74%, +1.71 p.p.), followed by India (7.73%, +0.58 p.p.), the US (7.52%, +0.32 p.p.), with Italy rounding off the Top 5 (7.04%, +1.47 p.p.).

Organizations under attack

The statistics on organizations used in phishing attacks are based on the triggering of the heuristic component in the anti-phishing system. The heuristic component is triggered when a user tries to follow a link to a phishing page and there is no information about the page in Kaspersky Lab’s databases.

Distribution of organizations subject to phishing attacks by category, 2015

In 2015, we saw significant growth in the proportion of phishing attacks on organizations belonging to the ‘Online finances’ category (34.33%, +5.59 pp): they include the ‘Banks’, ‘Payment Systems’ and ‘Online stores’ categories. Of note is the increase in the percentage of targeted organizations in the ‘Telephone and Internet service providers’ (5.50%, +1.4 p.p.) and ‘Social networking sites and blogs’ (16.40%, +0.63 p.p.) categories.

Top 3 organizations attacked

In 2015, Yahoo! was once again the organization targeted most by phishers, although its share decreased considerably – 14.17% vs 23.3% in 2014. We presume this decrease is a result of the company combating these fake domains. We see that Yahoo!, as well as many other organizations, registers lots of domains that could theoretically be used by the attackers as they are derived from the original domain name.

Conclusion and forecasts

In 2015, the proportion of spam in email traffic decreased by 11.48 percentage points and accounted for 55.28%. The largest decline was observed in the first quarter; from April the fluctuations stabilized and were within a few percentage points. This reduction was caused by the migration of advertising for legal goods and services from spam flows to more convenient and legal platforms (social networks, coupon services, etc.), as well as by the expansion of the “gray” zone in mass mailings (mass mailings sent both to voluntary subscribers and to people who have not given their consent). We assume the share of spam will continue to decrease in 2016, though the decline will be insignificant.

The number of malicious and fraudulent messages, however, will increase. It is possible that the attackers will once again make use of their customary tricks as was the case in 2015 (mass mailings of macro viruses and non-standard attachment extensions). The mobile theme may also become yet another weapon in the cybercriminals’ arsenal to spread malware and fraudulent spam.

The number of new domains created by spammers especially for distributing mass mailings will continue to grow. We also expect to see an expansion in new domain zones used as spammer resources.