Evidence Overlooked in Casey Anthony Murder Case

This looks really bad forensic reporting from this point.  Where was the mess up? examiners? prosecution?

Casey Anthony Likely Googled 'Foolproof Suffocation': Report - HuffingtonPost

http://www.huffingtonpost.com/2012/11/21/casey-anthony-foolproof-suffocation_n_2172514.html

HTML attach phishing

Nothing groundbreaking, just another sneaky little phishing trick via an html file attached to an email.

So below is the actual message showing the body of the message and the attachment.

Going through the file manually shows a lot of valid HSBC links/images for presentation to the user. However look at this little "post" fella...

Here is the finished product:

Looks legit right?

Obama Order Sped Up Wave of Cyberattacks Against Iran - New York Times

Nothing new or groundbreaking in this article, but it does a nice job of bringing together some of the pieces and there is a nice "How a Secret Cyberwar Program Worked" graphic.

"WASHINGTON — From his first months in office, President Obama secretly ordered increasingly sophisticated attacks on the computer systems that run Iran’s main nuclear enrichment facilities, significantly expanding America’s first sustained use of cyberweapons, according to participants in the program."

Story link > here <

Mac OS XJava Flaw

According to Dr.Web more than 55,000 Macs are infected with the so-called Flashback Trojan. The vulnerability that the attackers are using is with the Java for OS X Lion. (CVE-2012-0507)

My .02:  With the popularity of Apple products going up and up, it was only a matter of time that attacks started shifting (even ever so slightly). While MS boxes have been and will be targets for a long time, the Mac world has been slowly becoming into focus for attackers.  However, I'd suspect there to be a bigger attacker push into the mobile platforms rather than Mac in the coming year(s). Mobile platforms (iOS & Android) are more ubiquitous by far and more people would have a cell phone than a computer of any sort. Besides, people do stuff on their phones they would never do on their computer...the weak link gets weaker...

More reading:

Ars Technica - Mac Flashback trojan exploits unpatched Java vulnerability, no password needed

Krebs on Security - Urgent Fix for Zero-Day Mac Java Flaw

F-Secure - Mac Flashback Exploiting Unpatched Java Vulnerability

ESET - Mac Flashback Trojan: If you use Java the time to patch your Mac is now

Incident Response Essentials p2

We left off at listing some of the bare minimum of artifacts needed to conduct analysis on systems that are suspected of being compromised. Before we get to tools there should be some discussion about "how" to get the artifacts.

The focus will be the acquisition of these artifacts on live systems. There are big differences in live and dead host acquisition, but right now I am focusing on live remote acquisition on an enterprise level.

So what do you need to do live remote acquisitions?

Network access:
Goes without saying, but if your enterpise has firewalls/host ips agents/ipsec/networking filtering/DACLs protecting hosts you will want to get some sort of pre-planned access capability.  If you don't you will waste valuable time getting what you need...  A little pre-planning here is key. Since we are talking about a Windows environment you will typically see systems with Windows SMB (a.k.a File & Printer Sharing) access. (IPC$).

Authentication:
In short, you'll need to be authenticated as a user with administrator privileges. Whether this is a domain admin account in the local admins group or local account, you need to have admin privileges to snag these artifacts. You'll also need that level access to connect to the box remotely.

• Side note: You are likely responding to compromised systems with elevated privileges across the organization, and when investigating these systems those credentials could become compromised themselves. You need to adjust accordingly and I suggest creating a privileged account that is only used for IR work and heavily defended: quickly expiring passwords, heavy logging alerts on it's use, etc...

For more info see a great post on the SANS Computer Forensics Blog about this very topic:
Protecting Privileged Domain Accounts: Safeguarding Password Hashes



So you have access and the rights. Now what?

At this point you've identified the target system, you have access, now you need to get the tools/scripts to the box. **depending on your tool(s). Some tools don't have remote capability so getting them on the target box is needed.

You can do this by manually mapping and copying, copying the files from a central repository, or even have them pre-deployed on the box. (I am not necessarily a fan of pre-deployment...considering your pre-deployed tools could be tampered with on the compromised system). Utilizing a central repository can give you control over the files but allowing the ability to pull the files down to the suspect system.

To actually run the tools you will need the ability to run commands remotely. To stay with the enterprise Windows environment, PsExec is an excellent tool for these type of operations. (do it securely though, depending on how you do it, it can pass the password in cleartext.) Consider launching a command prompt on the local system with the IR account, and then run PsExec. The remote process will run under the account PsExec was launched from, and in this case it will be the IR account.

Incident Response Essentials p1

Obviously there are multiple layers and scenarios to consider when responding to incidents. And the tools you use to detect/collect/analyze/mitigate really depend on the threat scenario.

So what are the basics?  What do I need for the bare minimum for response operations? (w/ a focus on Windows systems)

Below is a list of the items I like to collect for response operations: (your mileage may vary)

• $MFT- Master File Table for later parsing/analysis
• Prefetch files
• ntuser.dat(s) - just grab em all...
• AutoRuns - reg entries/startup folders/services/etc.
• Network info - ipconfig/netstat - dnscache - hosts file
• Event Logs - OS logs - AV logs - other app logs (if applicable)
• Scheduled Tasks 
• Loaded DLLs
• Memory Dumps**  If possible I like to capture the running memory from the system if space and time allows. A lot of good stuff can be pulled out of running memory if you want to learn about the malware/attack more. Will go deeper into this topic in a later post.

BTW, you can get this information easily utilizing some scripting and free tools. I'll cover those tools (free & not free) in another blog post.

FBI says Russian spies got close to Cabinet - Washington Times

Some interesting tid bits about the Russion spy ring break up last year:

[snip]-- a key break in the case developed in the mid-2000s after the FBI was able to decipher coded electronic communications between Moscow and the deep-cover spies. The communications were used to unravel the network, ending the FBI probe that began more than a decade ago.
Breaking the electronic codes used by the “illegals,” as the Moscow spies are called, was a milestone in the case that allowed FBI agents to pose as the spies’ handlers and identify the spies.
“Ultimately, at the end of the case, we were able to become the Russians,” Mr. Figliuzzi said. “The point where we decrypted the communications allows us to basically own the network.”

Full story at the Washington Times: FBI says Russian spies got close to Cabinet - Washington Times

From the man who discovered Stuxnet, dire warnings one year later

Stuxnet, the cyberweapon that attacked and damaged an Iranian nuclear facility, has opened a Pandora's box of cyberwar, says the man who uncovered it. A Q&A about the potential threats.

Continued at  Christian Science Monitor....

Operation Shady RAT

Operation Shady RAT - "Operation Shady rat ranks with Operation Aurora (the attack on Google and many other companies in 2010) as among the most significant and potentially damaging acts of cyber-espionage yet made public. Operation Shady rat has been stealing valuable intellectual property (including government secrets, e-mail archives, legal contracts, negotiation plans for business activities, and design schematics) from more than 70 public- and private-sector organizations in 14 countries. The list of victims, which ranges from national governments to global corporations to tiny nonprofits, demonstrates with unprecedented clarity the universal scope of cyber-espionage and the vulnerability of organizations in almost every category imaginable." - Vanity Fair

Original Story: Operation Shady RAT - Vanity Fair

(update) McAfee Labs Blog: Revealed Operation Shady RAT

(update) McAfee Operation Shady RAT report (pdf)

MoonSols BlackMoon Memory Analyst

So I got lucky enough to take a look at the memory analysis tool being developed by MoonSols called BlackMoon Memory Analyst.  Currently the tool is in Beta, but already it is looking to be a pretty solid memory analysis tool.

I can only compare it to the tools I have used such as: ResponderPro, Memoryze/Auditviewer, limited exposure to Volatility, and have worked with the fairly new Redline.  From the current looks of things BlackMoon Memory Analyst will be real nice option to take a look at when you are evaluating what you want to use.

It has a nice clean interface and navigating it is pretty easy.  I did have some issues navigating or finding things, but that could be primarily because I am slow. The tool is still in Beta so there are still some kinks in my testing. I am learning some of the functionality without reading the manual (bah! who needs a manual) so you have to take that into consideration... :)  If you've done memory analysis before though, it isn't very hard to find what you are looking for.

When initially opening it you get the choice of opening a raw memory dump, hibernation file, or Microsoft crash dump.  It has a report function that dumps out to .xml format so it should be digestible by a whole host of systems you may be able to use for IOC analysis across the enterpise.

Just some screen shots:

As a side note: MoonSols recently released their quick and easy DumpIt memory tool.  It is fast!! Check it out here: http://www.moonsols.com/2011/07/18/moonsols-dumpit-goes-mainstream/

Internet in a Suitcase

Interesting read about how the U.S. is funding secret internet access for communications in and out of countries when their governments shut the internet down.

U.S. Funding Secret Internet Access for Dissidents Abroad

My favorite is a picture of the "Internet in a Suitcase"....

Hacked - Next Up: IMF

 Reports that the International Monetary Fund (IMF) was breached.  This story though has mentions of "nation state" .......  Any guesses on where the that software might have come from?

IMF hit by '"very major" cyber security attack
Source: BBC

Computer tech tricked women into taking laptops into bathroom - AP

What were these people thinking?  Well they're Mac users afterall... :)  You can't make this stuff up.

Fullerton, Calif. • A Southern California computer repairman suspected of installing spyware on laptops that enabled him to snap and download photographs of women showering and undressing in their homes was arrested Wednesday at his home, police said.

Police began investigating when a Fullerton resident complained about suspicious messages appearing on his daughter’s computer last year. Trevor Harwell installed software that took control of computer webcams on his clients’ Mac laptops, Fullerton police Sgt. Andrew Goodrich said. He was released later Wednesday after posting $50,000 bond, Goodrich said.

The software sent fake error messages telling users to “fix their internal sensor soon,” and “try putting your laptop near hot steam for several minutes to clean the sensor,” Goodrich said.

The error message prompted some victims to take their laptops into the bathroom with them when they showered, he said.

Original Story Link

LulzSec Compromises Infragard

Appears that LulzSec compromised the Atlanta Chapter of Infragard's site...

LulzSec Infragard Hack

Chinese Hacker Cracks Hundreds of Gmail Accounts of U.S. & Asia : The Hacker News

From: The Hacker News

Google spilled the details on Wednesday via its official blog:
Through the strength of our cloud-based security and abuse detection systems*, we recently     uncovered a campaign to collect user passwords, likely through phishing. This campaign, which appears to originate from Jinan, China, affected what seem to be the personal Gmail accounts of hundreds of users including, among others, senior U.S. government officials, Chinese political activists, officials in several Asian countries (predominantly South Korea), military personnel and journalists.
The goal of this effort seems to have been to monitor the contents of these users’ emails, with the perpetrators apparently using stolen passwords to change peoples’ forwarding and delegation settings.


Chinese Hacker Cracks Hundreds of Gmail Accounts of U.S. & Asia : The Hacker News

Memory Analysis Tools Developments

I've been a user of ResponderPro...and have used the open-source tools as well such as Volatility, Memoryze, etc...but ResponderPro really just has features and capability that make it a great tool. It saves me a lot of time and effort. It is expensive though.

However, recently HBGary released Responder CE, a community version of their paid-for Responder products. That is good news.  I haven't had the time to test it, but it may be just the thing you need to start analyzing memory in an efficient manner without some of the hiccups or issues with other tools.

This post though is actually more about the new release of Mandian Redline. Mandiant released Redline 1.0 and this looks like another great tool to use when analyzing memory.  I did get to play with a bit and it appears to be a solid tool; I will be testing it some more against some memory dumps alongside Responder to put it through it's paces.  Really like the fact I can use FDpro dumps I already have.  So far I've been really impressed.

Screenshot below of a friendly remnant of Zeus....

 

A Declaration of Cyber-War - Vanity Fair

Awesome writeup about the Stuxnet event.  It reads like a story more than like an article....

A Declaration of Cyber-War - Vanity Fair

Last summer, the world’s top software-security experts were panicked by the discovery of a drone-like computer virus, radically different from and far more sophisticated than any they’d seen. The race was on to figure out its payload, its purpose, and who was behind it. As the world now knows, the Stuxnet worm appears to have attacked Iran’s nuclear program. And, as Michael Joseph Gross reports, while its source remains something of a mystery, Stuxnet is the new face of 21st-century warfare: invisible, anonymous, and devastating.

Stuxnet from Israel/US?

According to the New York Times, Stuxnet was tested/developed in Israel. There was cooperation between other nations in it's development as well.

Israel Tests on Worm Called Crucial in Iran Nuclear Delay

If true, not all that surprising. 

National Internet ID?

Get ready...here it comes...

From: Engadget.com

Obama administration moves forward with unique internet ID for all Americans, Commerce Department to head system up

"President Obama has signaled that he will give the United States Commerce Department the authority over a proposed national cybersecurity measure that would involve giving each American a unique online identity."

Quite the debate will ensue. Privacy...Security...

BackTrack 4 R2 available

I am a few days behind...but BackTrack 4 R2 is available.

Changes:

• Kernel 2.6.35.8 – *Much* improved mac80211 stack.
• USB 3.0 support.
• New wireless cards supported.
• All wireless Injection patches applied, maximum support for wireless attacks.
• Even *faster* desktop environment.
• Revamped Fluxbox environment for the KDE challenged.
• Metasploit rebuilt from scratch, MySQL db_drivers working out of the box.
• Updated old packages, added new ones, and removed obsolete ones.
• New BackTrack Wiki with better documentation and support.
• Our most professional, tested and streamlined release ever.

http://www.backtrack-linux.org/backtrack/backtrack-4-r2-download/