Information Security

Posts related to information security, including news, tutorials, malware analysis, and threat intelligence.

Emotet malspam campaign exploits reliance on magic for file type detection

A screenshot of a VirusTotal results page showing a detection rate of 10/58 for a Emotet dropper document

Emotet is a Trojan designed to steal banking information. It is frequently spread by sending phishing emails to governments, banks, healthcare organizations, and schools. The phishing emails will often claim to be an invoice, with a malicious Microsoft Word document attached. The email may often appear to be from a trusted supplier. Once the attachment or link is opened, the target is prompted to click “Enable content”, which would allow the dropper to install Emotet.

Screenshot of a Emotet dropper document open in Microsoft Word 2016.
The document clams that the user must click “enable content” to view it, but doing so would actually install malware

I recently encountered two Emotet dropper samples (0b9ccb04553ba5f1ce784630ef9b2c478ed13a96e89c65dcd9c94205c235ea12 and eff6619aee017ee5d04c539ff12c63a199a1e489660f7156b95e562667393d3c) that would not run correctly in my malware sandbox. I soon found the cause of the problem: the file type had been detected as a generic XML file, rather than what it really is: a Microsoft Word document.

Read moreEmotet malspam campaign exploits reliance on magic for file type detection

How to inspect the certificate of a mail server over a CLI

If you ever need to inspect the certificate of a remote SMTP server, you can use the openssl CLI tool.

If you need to check STARTTLS:

openssl s_client -connect mail.example.com:25 -starttls smtp

Or, for a standard secure SMTP port:

openssl s_client -connect mail.example.com:465

To save the certificate to a file, just redirect the output:

openssl s_client -connect mail.example.com:25 -starttls smtp > mail.example.com.crt

Demystifying DMARC: A guide to preventing email spoofing

A screenshot of a premade aggreate/summary DMARC dashboard in ELK using data from pardeemarc

DMARC can stop spoofed spam and phishing from reaching you and your customers, protecting your information security and your brand. However, complexity and misconceptions deter many organizations from ever deploying it. Part mythbusting , part implementation guide, this post explains the shortcomings of SPF and DKIM, what DMARC is, how to deploy DMARC properly, and how to respond to DMARC reports – all without the need for an additional vendor, thanks to open source software!

Read moreDemystifying DMARC: A guide to preventing email spoofing

Lessons Learned from the US Federal Government’s Ongoing Deployment of SPF and DMARC

Two soldiers process mail in a US Army Forward Operating Base Mailroom

SPF and DMARC are standards that describe how the origins of email messages should be verified, to prevent email spoofing. I spent some free time over the past few weeks creating checkdmarc , a Python 3 module and command-line interface that can validate and troubleshoot SPF and DMARC records across multiple domains, with the intent of building it into a web application that will process DMARC reports. The Department of Homeland Security recently launched an initiative to deploy SPF, DMARC, and other best practices on most federal agency domains by issuing BOD 18-01. This created the perfect case study of common challenges and mistakes when deploying SPF and DMARC across very large organizations, and even a few small ones.

2018-01-30 update: I have made many improvements to my script, corrected a few of my own misconceptions about DMARC I had in this post, and switched to updated results from 2018-01-28.

Read moreLessons Learned from the US Federal Government’s Ongoing Deployment of SPF and DMARC

How to install YARA and write basic YARA rules to identify malware

A screenshot of a YARA rule with syntax highlighting

YARA is described as “The pattern matching Swiss knife for malware researchers (and everyone else)”. Think of it as like grep, but instead of matching based on one pattern, YARA matches based on a set of rules, with each rule capable of  containing multiple patterns, and complex condition logic for further refining matches. It’s a very useful tool. Let’s go over some practical examples of how to use it.

Read moreHow to install YARA and write basic YARA rules to identify malware

WannaCry ransomware analysis: Samples date back to at least early February 2017

VirusTotal results showing the earliest observed sample of Wannacry ransomware

The WannaCry ransomware worm has spread panic and destruction as it infects hundreds of thousands of systems around the world; a rate not seen since the Blaster and Sasser worms of 2003. WannaCry — also known as WannaCrypt, WannaCryptor, WanaCrypt0r, WCry, or WCrypt — leverages vulnerabilities that Microsoft patched in the March MS17-010 Security Bulletin, after taking the unprecedented step of canceling the February Patch Tuesday.

While collecting samples of WannaCry, I found a sample that predates the worm version. The sample was compiled on February 9th, and uploaded to VirusTotal on February 10th. While compile timestamps can be faked, the closeness to the upload date suggests that the compilation timestamp is legitimate.

Read moreWannaCry ransomware analysis: Samples date back to at least early February 2017

Google Pixel phones can be unlocked with a recording of a trusted voice by default

user manually enables "Ok Google" Trusted Voice

The headline feature of the new Google Pixel phones is deep integration between the operating system and the Google Assistant AI. By default, the Google Assistant can be activated even when the phone is locked and the display is off, if the device hears the trusted voice say the hot word, “Ok Google”. This also has the effect of unlocking the device, meaning that anyone with a recording of the trusted voice saying “Ok Google” — or even someone with a similar voice — can easily unlock the device.

Read moreGoogle Pixel phones can be unlocked with a recording of a trusted voice by default

PSA: The latest Google Chrome release trips EMET’s EAF+ mitigation

A screenshot of the EAF+ error generateted W=by the latest Google Chrome release when used with the defualt EMET config

When Google Chrome updated to 53.0.2785.101 on my Windows systems, I encountered an onslaught of alerts from EMET, which was killing chrome.exe processes for EAF+ violations as fast as Chrome kept trying to spawn them (each tab in Chrome is a separate process). Luckily, this problem is easily fixable.

Read morePSA: The latest Google Chrome release trips EMET’s EAF+ mitigation

HHS: Ransomware encryption of ePHI is a HIPAA breach

Colorful shelves of paperrecords at a dental clinic Credit: Tom Magliery License: CC BY-NC-SA 2.0

As a growing number of medical facilities are struck by ransomware, the US Department of Health and Human Services (HHS) has published a fact sheet describing how businesses that process electronic Protected Health Information (ePHI) should defend against and respond to ransomware.

Read moreHHS: Ransomware encryption of ePHI is a HIPAA breach

Prevent ransomware from succeeding with strategic defense-in-depth

Thoughtfully placed countermeasures can prevent ransomware like Petya, shown in this screenshot

Ransomware has become the weapon of choice for financially motivated cybercriminals. Individuals, hospitals, businesses, schools, police departments, and government agencies have all been victims of highly disruptive ransomware, resulting in ransom payments totaling at least $24 million in 2015, according to the DoJ and DHS. It doesn’t take much to start a ransomware campaign, and the returns can be extremely high. Fortunately, the steps to prevent ransomware from succeeding are equally simple and low cost.

Read morePrevent ransomware from succeeding with strategic defense-in-depth