Conficker Malware Remains A Threat

Information Week published an article this week talking about why the Conficker Malware won't die.  It's been 3 years since Conficker was discovered.  Information week reports that Conficker launched 59 million attacks in the fourth quarter of 2011 against 1.7 million PCs.  An impressive number for malware that should have already been eradicated.

The article on Information Week caught my eye, because I recently attended a talk where Conficker was discussed, but not in terms of the malware itself, but how it was discovered.  It was important because the talk was actually about APTs (Advanced Persistent Threats), and how to keep an organization protected from APTs.  Because APTs can come from anywhere and target almost anyone in the organization, it's tough for a single security solution to detect an APT when the threat happens.  So how does one protect against an APT?  The answer is of course, multi-layered defense.  An organization needs to defend not only the web gateway/proxy, but also the router, the workstation, and other network devices.

That leads to the next question, which is how do you detect an APT when it's happening.  And that's where Conficker comes in.  Conficker was discovered by an IT administrator who knew what a normal log looked like and immediately recognized an anomaly in his DNS logs, which led to the discovery of Conficker.  Specifically the administrator saw a spike in DNS requests for hostnames that did not map to IP addresses (Conficker automatically generates hostnames using an algorithm to look for payload servers).

The key here is familiarity with the logs on all your networking devices.  Understand what's a normal day, and recognize when your network devices are producing anomalies, and investigate when these anomalies happen.  Familiarity with your own logs may be the difference between early detection of an APT, and significant data loss.

So even though Conficker continues to haunt corporate networks, it does remind us we need to remain vigilent in security and become familiar enough with our environments that we recognize when something is out of the ordinary.

Flashback attack and MacOS vulnerability

I know I've been remiss in keeping up with this blog and the latest news out in the security and proxy industry, but sometimes life happens.  With that in mind, I'm going to recap probably the most important bit of news that happened over the last couple of months, and that was the reminder to everyone that Macs and specifically MacOS isn't completely protected from malware.  The Flashback virus was widely reported on and was estimated to have infected over 600,000 Mac computers.  Bigger news was of course that Apple first ignored the news reports and then slowly came around and said they would fix the flaw that caused the vulnerability.

But the big question for many of course, is whether any of the devices on their network helped to prevent the attack from happening, and this wasn't something that any vendor had an answer to.  But Blue Coat Systems while they didn't claim to protect you from Flashback, they did claim they helped prevent an infected system from reporting back to the botnet systems collecting data from compromised Macs.  You can read about how they did this on their security blog.

Blue Coat Acquisition Approved By Shareholders

The Blue Coat Systems acquisition by the private equity firm Thoma Bravo was approved today, February 13, 2012 during the shareholder meeting in Sunnyvale, CA. The result of this is that Blue Coat has now been taken private, and will no longer be a publicly traded company. What effect this has on the product and roadmap remains to be seen, but the company claims this will help them focus on the product without having to worry about shareholders.

Fake Video Codecs Still Going Strong

2 years ago, Blue Coat reported in their yearly security report that the top two sources of malware infection came from the fake video codec and fake a/v rouses. In the fake video codec, a link is posted to a video or the link is emailed out, and when a user clicks on the video (usually sent or posted by a known friend whose account has been hacked), they get an error saying they don't have the correct codec to play back the video and are redirected to a download of the "right" codec, which turns out to be malware. The fake a/v scam is similar, with the user getting an error that they have a virus, and are prompted to download anti-malware software that is in fact malware. Neither of these sources of malware are new and weren't new in 2009 when Blue Coat reported that they were consistently the top two sources of infection.

The trend continues this year, and Zscaler is reporting that fake video codec based malware is still going strong.

It just goes to show you users aren't as sophisticated as you think, and they do need to be protected with a secure web gateway or web proxy that has up to date anti-malware protection.

No Surprise: Android Malware is Increasing

It should be no surprise to anyone in the security industry that Android-based malware is up 472% since July 2011 according to Juniper. If you've been following the news this year, you would already have known malware on Android has been increasing faster than on any other platform. Malware targeting smartphones is up 250% from 2009 to 2010.

It's a good reminder why you need security on your network, and for mobile devices. While your secure web gateway provides security when you're on the corporate network, mobile devices like those running Android typically roam to other networks as the end-user takes the device home and on trips.

That's when cloud based security becomes important. Cloud and mobility make sense together, since the mobile client will be tied to a cloud security solution regardless of the network the end-user is using. As we see more mobility, you'll undoubtedly see more secure web vendors touting cloud as the solution.

7 Charged With Using Malware to Rack Up $14 Million

The recent news that the Department of Justice has indicted seven people for allegedly hijacking millions of computers, manipulating traffic on popular websites, and generating more than $14 million in fraudulent advertising revenue, shows that malware does indeed enable cyber-criminals to make plenty of money, which is a good indicator that there will continue to be waves of cyber-criminals and malware in the foreseeable future.

From the PC World article on the recent news:

The defendants -- six Estonians and one Russian -- allegedly hijacked more than 4 million computers using malware that rerouted Internet traffic to websites where they would get a cut of the ad revenue. Infected computers with users looking for popular websites such as Netflix, Amazon, and iTunes were rerouted to webpages that featured the defendants’ ads.

This case is supposedly the "first of its kind," according to US Attorney Preet Bharara, because the suspects set up their own "rogue servers" in order to perform the rerouting. Using their rogue servers, the defendants were allegedly able to substitute legitimate Internet ads with their own ads, thereby generating millions in advertising revenue.

According to BusinessWeek, the indictment cited a case in which an American Express ad on the Wall Street Journal's home page was replaced -- instantly, once users clicked on it -- with an ad for "Fashion Girl LA."

About 500,000 of the infected computers were located in the United States, Bharara said in a news conference in New York. The alleged scheme, which ran from 2007 to 2011, was first discovered at NASA, where 130 computers were infected.

It's an interesting case, because it uses malware to redirect the end-users browsers and basically force them to click on ads that would help the hackers make money. It could just as easily have redirected users to more malware sites.

This particular news item highlights the need to have visibility into where end-users are going on a corporate network, and to figure out what computers have been hacked and are sitting on your corporate network.

Websense on Facebook can be bypassed

Blackhat Academy is already reporting that the new Websense web filtering that will be available on Facebook can be bypassed. Earlier this month, Websense and Facebook announced that users clicking on links inside of Facebook would have those links scanned by Websense, and those URLs examined for malware, and a pop-up would appear if those links seemed to be of a malicious intent.

Blackhat Academy showed this week that they could circumvent this technology by recognizing the request for the URL was coming from Facebook, and display a different webpage to Facebook, then the actual page being delivered. Here's an example of how this works from PC World:

Blackhat Academy members, provided a live demonstration, which involved posting the URL to a JPEG file on a wall.

Facebook crawled the URL and added a thumbnail image to the wall post, however, clicking on its corresponding link actually redirected users to YouTube. This happened because the destination page was able to identify Facebook's original request and served a JPEG file.

"While most major sites that allow link submission are vulnerable to this method, sites including Websense, Google+ and Facebook make the requests easily identifiable," the Blackhat Academy hackers said.

"These sites send an initial request to the link in order to store a mirror thumbnail of the image, or a snapshot of the website being linked to. In doing so, many use a custom user agent, or have IP addresses that resolve to a consistent domain name," they explained.

Looks like Facebook is going to have to do a little work to hide the fact that these request for categorization are coming from Facebook, if they want the true value of URL filtering.