With that, there’s no better date than Guy Fawkes Day to focus on the state of cybersecurity in the United Kingdom.

A Comprehensive Approach to British Cybersecurity

The UK’s National Cyber Security Centre (NCSC) was established in 2016 as the cyber arm of GCHQ with the intention of “making the UK the safest place to live and work online.” The organisation’s mission is to also “reduce the harm from cybersecurity incidents in the UK” via incident management and response.

According to the NCSC’s third annual review, the United Kingdom is taking an increasingly active and comprehensive approach to protecting organisations and users. The report describes the British cybersecurity strategy as revolving around the government’s ability to constantly share threat indicators with organizations as “active defense”.

Automating British Cyber Threat Intelligence

The UK is also looking to expand its cyber defense strategy using automation to improve its cyber threat intelligence and information sharing capabilities. For example, Operation Haulster automates the flagging of credit card fraud in the UK. The operation automatically flagged fraud on over one million stolen credit cards last year alone.

As a result, the NCSC’s Incident Management Team can now detect and stop threats in their tracks in a matter of seconds while threat intel is timely, as opposed to a matter of hours.

This new level of automation also gives the team greater visibility into where threats are coming from and who they may be targeting. For the first time ever this year, the NCSC was able to report on which sectors needed the most support. Government, higher education, IT, managed service providers and healthcare topped the list.

Conclusion

As cybercriminals continue to develop more sophisticated ways to steal data and dupe unsuspecting victims, remember, remember to stay safe online.

Learn more about how you can proactively detect malware and protect your users and data via DNS. Visit the Infoblox website or start your free trial of Infoblox’s subscription-based cybersecurity solution today.

Here’s an overview of this type of malware, how it works, and how organizations can stay protected online.

What is a RAT (remote access Trojan)?

A remote access Trojan (RAT) is a dangerous malware program that enables covert surveillance or unauthorized access to any victim’s computer or network anywhere in the world. Unlike legal remote administration tools, RATs are typically installed onto a computer or network without the victim’s knowledge. They are primarily distributed through email attachments or user-requested program downloads, such as games. This backdoor gives an attacker complete control over that computer or network, making it possible for an intruder to monitor user behavior, access and exfiltrate sensitive information, establish a botnet, take screenshots and more.

Common RATs to Hunt

Many RATs have been dominating cybersecurity headlines recently. These are just some of the well-known RATs observed by Infoblox’s Cyber Intelligence Unit.

Remcos RAT

Remcos (remote control and surveillance) RAT emerged in 2016 and is still widely used by cybercriminals today. The Infoblox Cyber Intelligence Unit recently observed Remcos being distributed via phishing email using a simplified delivery tactic. Remcos has advanced surveillance and capabilities, including ScreenLogger, audio capture, and webcam capture. It’s a popular choice for targeting Windows operating systems because it is easy for threat actors to use and control.

FlawedAmmyy RAT

Infoblox Cyber Intelligence Unit recently observed a malicious email campaign that distributed the new AndroMut malware downloader, which then dropped the FlawedAmmyy RAT to targeted victims in South Korea. Spam emails, mostly written in Korean, were sent out referencing financial quotes or invoices and carrying an attached .doc or .xls file. Once the file opened and macros were enabled, the file downloaded AndroMut, which then downloaded FlawedAmmyy. The FlawedAmmyy RAT has also been used since at least 2016, allowing threat actors to gain access to infected computers and steal credentials, files, and other data.

Adwind RAT

Infoblox also observed a malicious email campaign distributing the Adwind RAT. These emails spoofed a notification about a commercial invoice and referenced “images of shipping documents,” while containing a malicious JAR file attachment. Adwind is a Malware-as-a-Service (MaaS) platform that first appeared in 2012. It can log keystrokes, access webcams and record video, steal cryptocurrency wallet keys and VPN certificates, download and execute files, and more. Because it is a Java-based malware, Adwind can run on any operating system that supports Java Runtime Environment.

Detecting and Exterminating RATS

RATs are typically downloaded invisibly through malicious email campaigns, web links, download packages, games or .torrent files. They are covert by nature and may prevent identification of the software using a randomized filename/path structure.

Infoblox protects organizations wherever they’re deployed using a unique hybrid approach. Hybrid security gives enterprises the power to leverage the cloud to detect more of today’s most dangerous threats while integrating with the on-prem system. Organizations benefit from streamlining and automating their security operations and scale for future growth using the security tools they already have.

Learn more about Infoblox's Cyber Intelligence Unit and stay up to date on the latest threat intelligence news here.

Threat actors are targeting municipalities with ransomware and many don’t know that it’s a huge risk.

As described by the US Department of Homeland Security, ransomware is a type of malicious software, or malware, designed to deny access to a computer system or data until a ransom is paid. Ransomware can be devastating to an individual or an organization. Anyone with important data stored on their computer or network is at risk, including government or law enforcement agencies and healthcare systems or other critical infrastructure entities. Recovery can be a difficult process that may require the services of a reputable data recovery specialist, and some victims pay to recover their files. However, there is no guarantee that individuals will recover their files if they pay the ransom.

Municipalities are prime targets because the attackers know that their IT teams are small with few cyber security team members if any.  If a city’s data is held ransom, attackers know that the victims will be under a lot of pressure to pay and there’s a history of cities that have reluctantly done so in order to get their data back. For example, Lake City in Florida paid nearly a half million dollars and the city of Riviera Beach in Florida paid a $600,000 ransom in June 2019 to recover files following a ransomware attack. 

Attacks are often performed using phishing emails that include malicious attachments or via drive-by web attacks when a person visits an infected website where malware is downloaded and installed without the person’s knowledge.  Sometimes attackers put malicious files or links on “watering hole” sites that are known to be visited by employees of municipalities.

DNS is used during one or more stages of a ransomware attack as victimized systems make DNS queries to IP addresses involved in the attack, when the ransomware propagates via spam campaigns or when the infected system checks in with the command and control infrastructure.  DNS can help prevent, identify, and detect ransomware attacks and help resolve them faster. 

Infoblox can help immediately by enabling the implementation of a DNS Response Policy Zone (RPZ) to prevent access to all domains known to be associated to malware.  Infoblox threat intelligence feeds include domains used in ransomware attacks and provides protection against malicious domains.  The DNS, DHCP and IPAM data that Infoblox collects and reports provides detailed visibility into infections and can be used for prioritizing remediation.  Once a malicious threat is detected, Infoblox can share that event information and context with security tools like a SIEM, vulnerability scanners and NAC solutions to trigger these tools to either scan the device for vulnerabilities or prevent access to the network until it is deemed compliant with policy. 

The Infoblox Activity Report and Dossier tool can be used to determine if malware attacks are taking place, and to identify the source of the attacks.  Action can then be taken such as enabling more security feeds and adding malicious domains to blacklists. 

The Infoblox Cyber Intelligence team has written several Cyber Campaign Briefs on ransomware including Shade, Sodinokibi (subject of a recent DHS report), MegaCortex, Cryptomix, and Ryuk ransomware as well as a survey of ransomware in 2018, all of which are available on the Threat Intelligence Reports page.

DGAs (Domain Generation Algorithms) are rendezvous domains for malware and hacker-controlled-servers to communicate, generated by rules or algorithms, usually encoded/encrypted and often have a short life span. Hackers use DGAs to evade the detection or blocking from static blacklist-based systems, for example, (some) firewalls using threat intelligence data that does not get updated as frequently as needed.

It is not easy to detect DGAs because they satisfy the DNS protocol in every manner and there is usually no signature to identify them. This is why we use artificial intelligence/machine learning technology to detect them.

If you look at some DGA domains you can find that quite often they appear to be collections of random characters, and because of that, from lexical analysis point of view they are statically quite different from normal domains. On top of that, they usually do not resolve to IP addresses since most of them are not even registered. Both of these are very important characteristics, or “features” as called in machine learning, to be used when we train the machine learning models.

Machine learning works similar to the way human beings forecasted weather before certain modern technologies, including sensors and computers were invented. We observed lots of similar independent signals such as temperature, wind direction and animal behavior then associated them based on very long term of observation. If you think of some weather proverbs you will know what I mean. 

Just like weather forecasting, the effectiveness of using machine learning may have false detections as the training data might be biased or not applicable. Since DGAs are early indicator of malicious activities, such false detections can be handled depending on users’ risk tolerance levels.

DNS sinkholing is a very effective strategy to control access to network resources.   Infoblox builds DNS sinkholes, with Infoblox DNS Firewall or Response Poicy Zones (RPZ).  According to Infoblox documentation,  a DNS RPZ enables you to “ define RPZ rules to block DNS resolution for malicious or unauthorized hostnames, or redirect clients to a walled garden by substituting responses.”   In ordinary terms, with DNS Sinkholing (aka DNS Firewall and RPZ), a name query to a known malware site, administratively banned site or a prohibited web category will be blocked before a web connection is established.  Here's an excellent paper from SANS for anyone interested in a deeper dive into the use case for DNS Sinkholes.

DNS is well suited to controlling network access.  Since DNS operates in real-time and spans every type of operational environment, it’s an ideal tool to implement real-time network access policy. There are many applications for DNS sinkholes such as malware detection and mitigation, web content control, connections to countries that are sanctioned or unnecessary to your business, DDoS mitigation and more.  However, the most common DNS sinkholing application Infoblox sees in the market is malware detection and mitigation. Especially in the healthcare and health insurance markets.

DNS is the first line of defense for cyber threat intel since it can block IP addresses, domain names and host names so it’s important to take advantage of DNS capabilities for actioning threat intelligence.  Infoblox DNS supports over 40 million Indicators of Compromise (IOC) in real time with no service degradation.   Considering that most firewalls can’t handle more than 100,000 IOCs in real time, it makes a lot more sense to use Infoblox DNS for DNS sinkholing than a firewall.  Furthermore, firewalls at operate at the network perimeter whereas Infoblox DNS sinkholing applies to intra east-west traffic as well as north (outbound) and south (inbound) traffic.  What’s more Infoblox DNS sinkholing can be applied to mobile users and remote branches with limited technology footprints.

DNS sinkholing can be dangerous since a single bad IOC can have a big service impact across the enterprise.  That’s why Infoblox creates purpose-built intelligence for DNS that will not block known GOOD sites.  Infoblox threat intelligence focuses on garbage domains malware uses for command and control with Domain Generation Algorithms (DGA), known botnets, ransomware, command and control, malware infrastructure and other intel that can be summarized with IP address, host name or domain name.  All Infoblox intel is run through correlation and scoring engines to insure against false positives.  You can read more about DGA and other threats in this excellent white paper on DNS security threats.  Infoblox can work with your private intel or threat intelligence from your favorite intelligence provider or threat intel platform.

DNS sinkholing is included in Bloxone Threat Defense and is often called DNS Firewall in Infoblox documentation.   Infoblox is seeing an increased interest in DNS Sinkholing in the healthcare, finance, industrial and utility markets due to recent regulations and security guidelines.   So, with all the focus in DNS sinkholing lately, why not do DNS sinkholing with Infoblox DNS, the most scalable and intelligent DNS platform available?   Answer in the comments, would love to hear your thoughts.

Special thanks to Infoblox SE Ross Gibson for technical advisory and edits!

Over the past few years, podcasts have grown from a fringe media to one of the most popular ways people get their news and information. That’s definitely true in the B2B enterprise cybersecurity space.

Introducing Infoblox ThreatTalk Cybersecurity Podcast Series

Infoblox is thrilled to announce its brand-new podcast series, ThreatTalk. This new podcast will focus entirely on all things cybersecurity. Subscribers will hear the latest industry trends, solutions and best practices, and they will get exclusive insights from leading enterprise security experts about today’s threat landscape and much more.

How to Subscribe to ThreatTalk Podcast – and Why

Are you a cybersecurity professional looking to stay in the know about the latest trends and threats in enterprise security? Do you have a short attention span, and are you always on the go? If so, then this podcast is for you.

Infoblox designed this new podcast with the customer and infosec professional in mind. Listeners have easy access to the information in ways that are convenient to them and from anywhere, whether on a mobile device, at home, on a plane or the office. 

Subscribe to Infoblox’s ThreatTalk podcast today. It’s available now on Apple Podcasts (iTunes), Spotify, Google Play and Stitcher. Stay tuned for more information on SoundCloud and the Infoblox website.

Let’s talk about threats!

The Cybersecurity Excellence Awards recognize companies, products, and individuals that demonstrate excellence, innovation, and leadership in information security. The industry’s best professionals and organizations were chosen based on the impact their products and services have on the industry as well as open voting by members of the cybersecurity community.

The cyber threat landscape is rapidly changing with the introduction of SD-WAN and IoT. Traditional security approaches don’t work well in a loud first world. To effectively defend against threats, organizations need a solution that provides: 

• Visibility into transformative network architectures like SD-WAN, cloud, and IoT.
• Scalability to protect against breaches and malware in a cost-effective way.
• Automation to help respond faster to threats that enter the network by evading perimeter defenses.
• A hybrid approach to network security that protects assets and infrastructure anywhere—on- and off-premises—and that integrates tightly with existing on-premises ecosystems.

Though some of the other solutions in the market provide cloud only solution, cloud-only security architecture solutions face the following challenges:

• Cloud-only solutions make it difficult to implement threat responses in a way that completely close security gaps. For example, they can’t easily share security events with on-premises cybersecurity solutions. The lack of integration results in siloed tools and increasingly costly delays at a time when network attacks are unfolding at ever-higher speeds.
• Cloud-only solutions do not provide timely access to the troves of network data residing in on-premises assets that can help security teams better detect and remediate some of today’s most urgent network threats.
• Cloud-only solutions are unable to ensure the protection of remote offices when Internet connections go down.

With BloxOne Threat Defense, organizations get an integrated solution suite that provides hybrid security for all network environments. Pervasive, scalable, and cloud-managed, the solution suite protects users and devices anywhere, on any network—across physical, virtual or cloud infrastructure. These solutions block DNS-based data exfiltration, stop malware communications with command-and-control (C&C) servers and prevent access to

content not in compliance with security policy. They also automatically distribute threat intelligence and indicators of compromise (IOCs) to existing security infrastructure for faster incident response.

The solution suite’s hybrid security architecture employs the scalability and pervasiveness of DNS to provide comprehensive protection. It enables your organization to boost the performance of your business’s existing infrastructure investments while taking advantage of the simplified service delivery made possible through Infoblox’s next-generation SaaS platform.

Advantages of a hybrid architecture for security:

According to Comport Technology Solutions, the use of hybrid approaches that blend on-premises and cloud infrastructure will become more common because organizations want to take advantage of the cloud without giving up proximity to data residing in on-site infrastructure. For implementing security, the same argument holds true. Cloud architecture supplies several advantages, such as being able to scale threat detection and handling big data analytics, while the on-premises components of a hybrid solution can unlock valuable data and context that can be

leveraged for the response.

Infoblox’s hybrid approach to security offers you the following advantages:

• Analytics in the cloud: Certain threats like DNS data exfiltration, infiltration and tunneling can evade reputation and signature-based detection methods. To effectively detect these threats requires analytics that combine machine learning and user behavior. The cloud has greater processing capabilities to detect a wider range of threats, including data exfiltration, domain generation algorithm (DGA), Dictionary DGA, fast flux, fileless malware and more. Using the hybrid model, this detection can take place in the cloud and enforcement can happen anywhere: on-premises or in the cloud.
• Threat intelligence scaling: Infoblox threat intelligence includes data from Infoblox research and third-party intelligence providers that is aggregated and curated into one platform. Your organization can apply this comprehensive intelligence of indicators to enforce policies on-premises or in the cloud. You can also automatically distribute it to the rest of the security infrastructure. Moreover, with Infoblox, you can access additional threat intelligence from the cloud that is not available to your on-premises tools.
• Full integration with on-premises ecosystem: The hybrid model enables full integration with on-premises Infoblox and third-party security technologies, enabling your teams to unlock valuable network context and deliver faster, more accurately prioritized incident response and network-wide remediation.
• Remote survivability: With the Infoblox hybrid model, if the Internet connection goes down in one of your locations, the on-premises DNS security will continue to secure and service clients in the network, protecting remote and local users.

To learn more: Please go to https://www.infoblox.com/products/bloxone-threat-defense/ .

Infoblox is a provider of a technical threat intelligence which includes domains, FQDNs, ip-addresses and URLs. These threat intelligence indicators may be used on different platforms like NGFW, Secure Proxy, SIEM etc.

Infoblox gives you not only threat intelligence indicators to detect threats but also information on why an indicator is malicious. Using threat class and property (name) it is possible to successfully identify the type of threat as well as a mitigation procedure.  

As mentioned earlier, a SIEM platform contains all kind of events from various software and network equipment, so the indicators can be used to enrich any log messages which contain relevant fields.

For example, web-server access logs contain a source (or requestor) IP address and a URL. Both properties can be used in conjunction to detect and mitigate malicious traffic and hunt new threats. The idea is simple - that known HTTP scanners scan for specific software and vulnerabilities. Based on requested URLs we can find out what kind of tools are used and which vulnerabilities malicious actors are trying to exploit. Analyzing similar requests, we can find other hosts that scan our network. Blocking access to such scanners can significantly reduce attack surface.

An another example, on the screenshot below you can see a Splunk dashboard which displays bruteforce attempts on my SSH server (BTW it is not recommended to have SSH exposed to the Internet). The dashboard is powered by Infoblox's threat intelligence. It is worth mentioning that based on my observations, 5%-20% (depending on a day) of known scanners generate 60%-95% attacks.

To generate the report, I'm using a lookup tool I wrote, also available on GitHub (https://github.com/Homas/Splunk_AT_Lookup). The tool allows you to enrich log messages with threat intelligence (Infoblox, SURBL, Farsight, CrowdStrike etc) available via Infoblox TIDE.

The tool consists of 2 scripts:

• a script which downloads indicators and stores them in a local SQLite database. It should be executed on a schedule to periodically update DB
• a lookup tool which searchs domains/FQDNs, IPs and URLs in a local database and returns threat properties. A single indicator may be associated with one or more threat properties.

The list of indicators of compromise are continuously updated so:

• It is important to store already enriched logs to easily access this information and not lose it, in case your threat intel vendor cannot provide you access to historical data or a subscription expires. Infoblox TIDE does provide access to historical data.
• It's also worth to validate logs (e.g. DNS response logs) from the last few days on the indicators which were recently added.

To further investigate incidents Splunk offers an easy way to drilldown to Infoblox Dossier. To access Dossier from a Splunk dashboard you will need to use the following URL in the drilldown configuration:

"$row.field$" contains an indicator in a row which was clicked (there are some other options available to configure drilldown). The column may contain any supported indicator type: domain/fqdn, ip-address, url, check sum, email. Because there is no single sign-on you may be asked to authenticate.

I hope this short article was useful and showed you how to empower your SIEM with accurate and contextual threat intelligence for faster correlation of events.

Vadim

Maintaining network availability and effectively defending an enterprise network when NOC and SOC teams work in silos creates an additional challenge. Even though many network and security tools exist for SOC and NOC teams, each team typically generates its own incidents and doesn’t share information. This lack of interoperability and inability to share event data results in inefficiencies, lack of agility, limited visibility, and eventually a poor organizational security posture. According to the ESG research report on Security Operations Challenges, Priorities and Strategies in 2017, keeping up with the volume of security alerts and lack of integration between different security tools are some of the biggest challenges related to security operations. According to the same survey, investing in technologies to automate security operations and threat detection by integrating multiple tools is a top priority among security operations’ teams.

To improve efficiency and collaboration between cybersecurity and IT operations team, organizations are investing heavily in automation and orchestration of incident response to keep up with the volume of security alerts, to make decisions on prioritizing alerts and to reduce response time for incidents. In addition, according to Infosec Island article, though there are subtle differences between SOC and NOC, increasingly organizations are making the two groups work more closely together often with overlapping team members,  allowing them to break silos, gain centralized visibility and facilitate information sharing. This helps to reduce cost and improve the efficiency of both NOC and SOC teams.  For example, SOC can identify issues and recommend fixes to NOC. NOC can then analyze the impact of the fixes and make changes accordingly. Thus, closely aligning NOC and SOC teams may allow companies to integrate network and security workflows, management, and response capabilities, enabling both the organization to become more self-aware of its limitations and enhancing the ability to defend its networks.

Infoblox helps bring together NOC and SOC teams through Integrations:

As shown, Infoblox enables customers to automatically share DNS data, user and device information, rich network context and security events with different security tools such as SIEM, Vulnerability Management, Firewalls, NAC and others using STIX/TAXII data formats as well as APIs. Here is the list of technology partners Infoblox integrates with:

To summarize, Infoblox provides integrations with network and security tools mentioned above, potentially enabling SOC and NOC teams to work more closely, allowing customers to automate processes, decreasing threat response times, improving agility and receiving single pane of glass visibility across the entire network. This ultimately improves the efficiency of operations for NOC and SOC teams and enables next level automation and orchestration.

To learn more about our network and security integration, please visit https://www.infoblox.com/partners/technology-partners/ and https://community.infoblox.com/t5/Partner-Integrations/ct-p/PartnerIntegrations. 

References:
       

https://www.sans.org/reading-room/whitepapers/incident/paper/38290


https://ayehu.com/why-your-soc-and-noc-should-run-together-but-separately/


https://www.csoonline.com/article/2121964/access-control/efficiency-through-noc-soc-convergence.html


https://www.incidentresponse.com/the-different-between-the-security-operations-center-soc-network-operations-center-noc/


https://www.scmagazine.com/home/reviews/moving-the-soc-into-the-noc/


https://www.darkreading.com/attacks-breaches/blurring-the-line-between-soc-and-noc/d/d-id/1128476


https://www.intellectualpoint.com/blog/cyber-security-security-operations-center-soc-vs-network-operations-center-noc/


http://www.infosecisland.com/blogview/20589-Redefining-Security-Intelligence-with-NOC-and-SOC.html

The Case for DevOpsSec

On many levels, digital transformation and cloud adoption are all about speed. Getting to market in weeks, not months and years. With the software development method known as DevOps, those cycles are now occurring even faster. The practice unites software development (Dev) with IT operations (Ops) with the goal of releasing new product updates and enhancements quickly and frequently to meet immediate business needs. Rather than focus on one big release that may happen once or twice a year, DevOps teams perform multiple releases, working in short sprints, often two weeks or less.

DevOps is catching on fast as companies seek every advantage in hyper-competitive markets. But in the headlong rush to get new functionality into the hands of customers, important aspects of traditional software development are falling through the cracks. Among the most serious of these is security. I say that not just because I’m a CISO. In a cloud-connected world, apps and devices are the main avenues for cyberthreats of all types.

To get an idea of how security activities are getting lost, let’s compare the way security testing is done in a traditional waterfall-based software development lifecycle (SDLC) versus DevOPs. In traditional scenarios, the dev team would build a new version of a product, call it 2.0. When completed, the ball moves on to QA. Typically, no new features or code are added while QA goes about its work of conducting their testing processes.

The development cascade moves next to security teams who perform threat modeling, security reviews, static and dynamic code analysis, and pen testing in order to validate the security level. Again, working with software whose development is largely static while testing is taking place, and with a number of weeks allotted in the schedule to complete their work. QA and security are  provided blocks of time to log the bugs and escalate them during the build process.

With DevOps, the traditional development cycle, with its cascade of sequential phases is replaced with one in which each phase is ongoing and overlapping. For example, there are no code freezes with DevOps. Their work is continuous. A team might release a tiny bit of new functionality in a web app on a Tuesday. By Friday, they’ll release something else. Something early the following week, and on and on.

From a security perspective, it is very difficult to adequately test software builds that are essentially always in motion and where the time set aside for testing is often only a few days at best. As a consequence, this risk is that often enhancements to software enter the market with inadequate security testing. (It’s worth noting that QA testing is also less than ideal with the compressed cycles of DevOps, often impacting software quality).

Why the Security Risks from DevOps Are Escalating

Many of the enhancements created through DevOps are quite small and incremental. It’s tempting to think that the security risks they pose are similarly small. Keep in mind, though, that hackers, organized crime syndicates and rogue nations have become quite adept at finding and exploiting the tiniest of security flaws to execute attacks.

By far, the biggest security concern when it comes to DevOps is that this accelerated development is happening primarily with apps and devices that are cloud-connected. For example, a security flaw in a connected smart bulb in your living room could potentially enable a hacker to gain access to the systems that control the smart locks to your house. In the fall of 2016, millions of cloud-connected small appliances, including security cameras and baby monitors, were used in a massive DDoS attack that took down hundreds of web sites around the world for hours, including the New York Times, Twitter, and Netflix. Those connected devices were used as bots to attack the DNS servers at Dyn, a cloud provider of DNS services.

When you consider potential hacking scenarios involving connected cars or energy grids, it brings the imperative for heightened security in DevOps practices into sobering perspective.

How to Make DevOps More Secure

In the compressed timelines of DevOps, traditional security testing is unworkable. One option is to crowdsource. Business is booming for “white hat” organizations like BugCrowd, Synack and HackerOne. The problem with hiring outside hackers for DevOps projects, however, is that they often lack the context that comes with being an embedded part of the development lifecycle. Their view into the product being enhanced is often limited.

The far more effective approach is to ensure that product security is an ongoing process as well, baked into the development process from the very outset. Train your developers to write secure code in the first place so you don't have those issues at the end of the development process. Build security requirements in the initial product spec. Get ahead of the problem, that is the ideal situation. Whether companies racing to bring new enhancements to market in the blink of an eye will embrace this ideal remains to be seen. But it’s one I believe the tech industry as a whole should give serious consideration to. And soon.

The Domain Name Service was initially designed without too many security considerations because, in the early days of the Internet, it was not designed with a huge user base in mind or with the notion that it could be misused. Therefore the DNS protocol is vulnerable to attack and abuse. A new software is always being written to improve the efficiency and safety of the protocol, but, as in the real world, a door that opens is a door that can be forced open.

Here are some of the attacks you should know about. 

Malware

What it is:
Malware is a catch-all word that includes any type of trojan horse, spyware, viruses and worms, ransomware, spyware, and so on. Basically, anything that turns your computer from a tool that you use into a tool that the hacker uses. Depending on the type of software, it may be monitoring your clicks to steal your passwords, using your computer’s or even CRM’s resources to power their cryptocurrency mining operation, or out and out block you from accessing your computer. Many times your computer is used for illegal activities, like being harnessed for a DDoS attack or hosting child pornography.

Best Defenses:

• Keep your operating system updated regularly.
• Remove old software you don’t use.
• Enable click-to-play plugins.
• DNS based security that uses a combination of reputation, behavioral and signature-based methods to protect your data and prevent the spread of malware.
• Ensuring your entire security architecture works in unison, sharing data and intelligence for rapid threat containment

DDoS Attacks

What it is:

Distributed Denial of Service, or sometimes just Denial of Service, means to overwhelm a service provider’s or an enterprise’s infrastructure with far greater requests than their capacity. If you’ve ever seen those old comedy sketches where a person comes back from a vacation, opens the door, and is immediately buried by stacks of unread mail, it’s something like that.

Arranging a DDoS can cost only $150 on the black market, but the cost to you of a successful attack has been estimated at $100-$6,000 every minute—not counting the collateral effects of losing customers; on top of that, the DDoS is sometimes a cover for injecting even worse malware.

Best Defenses:  

• A cloud-based anti-DDoS solution that can filter or absorb attacking traffic.
• DNS based DDoS protection built into DNS servers that can mitigate not just volumetric DNS DDoS but also lower volume exploits and anomaly attacks that can crash the DNS server

Cache Poisoning

What it is:
Also known as “DNS Spoofing,” this is another technique that corrupts the domain name system. Two terms to know are “cache”, which is space reserved in your computer’s memory to more quickly load frequently accessed data, and “DNS resolver”, which is the mechanism that translates the IP address to the domain name on the client side (that’s you). Much like your computer has a cache of data, the DNS resolver does too. So, when you look up your favorite search engine or social network, it won’t waste a nanosecond looking up something it already knows.

Cache poisoning is when the hacker tunnels into that cache and misdirects a domain name to an incorrect IP address. That website can, for example, look like your banking website, and steal your identity when you put your real password into their fake website.

Best Defenses:

• Limit recursive queries
• Store only data related to the requested domain
• Maintain DNS cache to delete old IP addresses that aren’t frequently used

Data Exfiltration via DNS

What it is:

Exfiltration, if you’ve only heard the word from action movies, is a military term for “escape.” In the context of computers, it means the illicit release of data. It can be in-person or over a network. Data leaks can lead to ruined lives and losses of millions of dollars, if not more. On top of the damage done by the leak itself, lawsuits and criminal prosecutions can add additional penalties, some north of $100 million.

Best Defenses:

• Make use of blacklists of randomly generated fake domain names that would if not blocked, direct traffic to these sites and possibly steal data within the data payload.  
• Employ Cloud DNS protection that uses the latest algorithms capable of protecting data payloads.

Conclusion

The most incredible thing about security is the small amount of effort and money it takes to create catastrophic damage. Similarly, an ounce of prevention (and in this case: security) is worth many pounds of cure. There is no such thing as “the latest” security updates, the only way to prevent, or at least significantly lower the risk, of being the victim of a cyber-attack is to have a defense in depth strategy to plug any security gaps like DNS, share data and threat intelligence across the entire security infrastructure and leverage multi-pronged approach for threat detection to detect not just known threats but also zero-day attacks.

About the author:

Reuben Yonatan is the founder @ GetVoIP -- an industry leading business comparison guide that helps companies understand and choose a VoIP system for their specific needs. Follow on Twitter @ReubenYonatan

Note: This article is written by a guest blogger. The author is solely responsible for all opinions expressed in the article. 

According to the report, HIDDEN COBRA actors have likely used Joanap and Brambul malware since at least 2009, to target multiple victims including several from the media, aerospace, financial, and critical infrastructure sectors in the United States and globally. Additionally, DHS and the FBI recommend reviewing information related to Joanap and Brambul from the Operation Blockbuster Destructive Malware Report.

Joanap Remote Access Trojan

The Joanap Trojan Backdoor is a remote access tool (RAT) which targets computers running Microsoft Windows operating systems. It has features for peer-to-peer communication, data exfiltration, proxying network traffic, and downloading and executing additional malware which could extend the attackers capabilities. The Joanap RAT is typically downloaded without the system owner’s knowledge as a secondary infection.  HIDDEN COBRA and other threat actors often compromise legitimate domains in order to infect systems visiting the site as well as distribute the malware through email.

Notable functions for Joanap include:

• its ability to perform process and file management and to coordinate with other nodes
• encrypting communication using Rivest Cipher 4.
• creating a file at infection stage named mssscardprv.axlog inside the Windows “System” directory which it uses to store information including victim host IP address and hostname

Brambul SMB Malware

Brambul is a Server Message Block (SMB) malware which propagates through brute-force username and password guessing attacks against unsecure SMB shares using a list of predetermined credentials. Dropper malware is typically used to deliver it to the victim’s network in the form of a Portable Executable (PE) file or Dynamic Link Library (DLL.)  Upon activation, it attempts contact with victims’ systems on the local subnet and launches the brute-force attack against SMB ports TCP 139 and TCP 445.  Brambul is known to have remote control capabilities for command-line input, network propagation, harvesting system information and sending it via email.  It may also attempt to determine whether the Remote Desktop Protocol (RDP) is enabled on port TCP 3389 and report this to the attacker via email.

Recommendations and Mitigation

DHS and the FBI state that a successful HIDDEN COBRA intrusion could have severe impacts including data breaches, network service disruption, and damage to an organization’s reputation.  Security teams and network administrators should use the indicators provided by DHS and the FBI to identify related activity within their own network or their perimeter.  When reviewing network activity, organizations may find potentially malicious connections as well as legitimate or benign interactions.

Recommended mitigations include

• Stronger access security - Using strong user passwords and limiting user permission to least privileged access
• Timely patching - Maintaining up-to-date antivirus signatures, system and software patches from trusted sources
• Email filtering - filtering suspicious or malicious email and attachments

• DNS Response Policy Zone (RPZ) capability: Using RPZ capability on the DNS server to monitor and block any DNS queries to domains known to be part of the attackers’ infrastructure, and readily identify infected systems

• Up-to- date threat intelligence – Using aggregated, curated and timely threat intelligence across the entire security infrastructure to maximize protection

Infoblox ActiveTrust protects against cyberattacks using threat intelligence feeds that are proactively curated and contain indicators on evolving threats including ones attributed to Hidden Cobra attacks.

ActiveTrust or ActiveTrust Cloud free evaluations provide an easy way to try the full featured DNS security solution, either deployed on-premises or delivered as a cloud service.

Dr. Bin Yu, our Chief Data Scientist, leads a team of data scientists. His team has thus far conducted extensive research on various aspects such as DNS Firewalls and Domain Generation Algorithms (DGAs). 

In this webinar, Dr. Yu talks about how AI can be utilized to optimize DNS Firewalls. So far, DNS firewalls depend on the manual identification of malicious domains. With AI, we can automatically identify malicious domains based on the classifications produced by the AI models. However, the accuracy depends on the amount of data in addition to the AI techniques being used. 

Watch the webinar archive to learn more about how Infoblox is approaching the AI opportunity to provide more value to enterprises to realize the promise of AI to prevent cyber attacks.

Recommended:

Learn from Mayana Pereira of Infoblox how Artificial Intelligence can be used to detect Domain Generation Algorithms(DGAs). Watch the webinar archive.

You might be right unless you dig further.

Facebook Data Scandal

If you are not familiar with the Facebook data scandal, which has rocked millions of Facebook users in the recent past, here is a quick summary.

Cambridge Analytica, a UK based political consultancy firm, has allegedly used personal data from millions of Facebook users to run political campaigns with an objective to influence the 2016 US presidential elections. Cambridge Analytica received the data from a Facebook developer, who allegedly violated the terms of use of the Facebook Developer program in passing the data onward. 

Now the question comes. How is this related to DNS protection?

In his interview with CNN, the CEO of Facebook, Mark Zuckerberg, mentioned that protecting customer data is a fundamental responsibility of every company and if it can’t be delivered, the company doesn’t have the right to customer data.

It is indeed a powerful statement.

Every CEO should feel that way and take customer data protection very seriously. Notably, when the Equifax data breach happened in 2017, we didn’t hear similar statements from their executive team.

There could be multiple initiatives that need to be taken to prevent customer data breach. A critical initiative that should be considered by every CEO is DNS protection. Here is why.

The Mechanism for Data Exfiltration via DNS by Way of Facebook

It All Starts with an Innocent Action on Facebook

A new app that promises to tell you who your favorite friend is will appear on your Facebook news feed. A bunch of your friends has already liked it and probably shared the results from the app. You will be enticed to check it out. You will be asked to give permissions to access your data. You will oblige.

That’s the beginning of data exfiltration.

The Risks with an Open Developer Program

In an open developer program such as Facebook Developer Program, we can never tell the type of developers that could be active. There could be genuine ones as well as rogue developers. Facebook has proven to be a very effective user acquisition platform. Hence, it is possible for rogue developers to push their apps via the Facebook platform.

When those apps that use Facebook APIs are accessed from users’ computers, there could be malware that can send the data out to external C&C (Command and Control) servers, which is known as data exfiltration.  The genuine developers may not intentionally insert malware into their code, but hackers may take advantage of trending apps to inject malware and hence reach end-users’ computers through otherwise genuine apps.

Millions of Workers Access Facebook at Work

Per Statista, Facebook has 2.2 billion monthly active users as of 4^th quarter 2017. As millions of users use Facebook on their company computers when they are at work on their company network, there is a greater chance of data exfiltration of business data via those infected computers.

Unless you have a mechanism to check data exfiltration, you have no idea on what’s going on in your organization’s network.

Hence, when it comes to delivering on the promise of securing customer data it is critical to be able to detect and prevent data exfiltration. The way to prevent data exfiltration is to protect your DNS.

Infoblox Can Help Prevent Data Exfiltration with ActiveTrust Suite

Infoblox ActiveTrust products enable you to mitigate security challenges that arise from DNS-based threats. Our secure DNS solutions combine automation, centralized reporting and policy management, enhanced visibility, and unique actionable intelligence drawn from the data residing in the core of your network.

Infoblox products utilize three approaches to preventing data exfiltration: 

• Prevent malware communications with command and control servers (C&Cs) and botnets. Such prevent disrupts the cyber kill chain.
• Mitigate zero-day threats using machine learning and analytics. Collect curated threat intelligence data and distribute the verified data to existing security infrastructure to remediate threats and prevent future attacks.
• Scale enforcement on-premises and in the cloud with a hybrid security approach, which provides a much better context than either on-premises only approach or a SaaS-only approach.

Check out the Infoblox Data Exfiltration Prevention Demo. 

Conclusion

Data exfiltration exists in almost every network and many security engineers ignore it for a variety of reasons. Many a time, your organization may feel that it is sufficiently secured. The Facebook data scandal has brought out an important aspect of customer data protection, which can be delivered only if you are able to prevent data exfiltration that occurs via DNS.

Point of Sales (PoS) systems have been one of the favorite targets of hackers for a number of reasons: the high value of the data being processed, the ease of access to the data and the commonly available network connectivity to send data out. Like many other systems, PoS probably was initially designed at a time when there were fewer security incidents and had higher priority goals like more functionalities, ease-of-use and lower cost.

Credit card or debit card numbers in the PoS systems are what hackers usually go after. In the underground market, these numbers can be sold from a few dollars to more than $100 a piece. The stolen numbers are then used to create counterfeit cards or to directly purchase goods from online stores. Hackers can make a profit if they find a way to harvest those credit card numbers at scale.

We've seen plenty of PoS hacking activities in the past, especially in the retailer and restaurant industries. Notable examples of such activities in retailers include the Target data breach in 2013 and the Home Depot data breach in 2014. In both cases, the retailers had to spend millions of dollars for an internal investigation, to settle with the banks and to settle with impacted customers. Examples of those in restaurants include the data breaches of P.F.Chang's in 2014, and that of Wendy's in 2015, though they made fewer headlines because of the smaller scale of the breaches.

Often the hacker’s campaign includes the following common steps: planting malware inside a victim’s network, collecting the card data from Point of Sales terminals/servers, and then sending that data out to a server controlled by hackers. For the first step, hackers can use common malware infection methods such as remote or direct access; for the second step, their techniques include RAM scrapers, network sniffers, and database theft, among others.
 
Once the hackers successfully collect the card data, it is critical for them to send the data out. Example methods include carrying the data out with a USB disk if they have physical access to the PoS, sending out emails or sending out to FTP/HTTP servers. They can also send the data out using DNS with a method called DNS tunneling, where sensitive data can be transported using the subdomain portions of a DNS query.

New PoS Malware that Uses DNS Tunneling

Off-the-shelf, ready-to-use DNS tunneling software such as Iodine and DNSCat is already available. Recently, security researchers found a new family of PoS malware called "UDPoS" that uses DNS tunneling to pass credit card data to ns[.]service-logmeln[.]network.  (For a more detailed description, see https://blogs.forcepoint.com/security-labs/udpos-exfiltrating-credit-card-data-dns).

Based on the sample data, it is clear that the data was encrypted and there was no signature in the data itself. Thus, any signature-based-method, a common tactic to detect DNS tunnels, would fail to detect such data exfiltration. Enterprises cannot simply block the DNS protocol or port because DNS is a critical network infrastructure service. While blocking ns[.]service-logmeln[.]network would work for the sample data, hackers can simply change the domain name of their servers or even use advanced techniques such as DGA (Domain Generation Algorithm) to hide their server behind thousands of fake domain names, making blacklist-based blocking mechanisms ineffective.

Stopping PoS Attacks and DNS Tunneling

Fortunately, there is a method to detect such malicious activity—behavior-based anomaly detection in DNS. Even though the queries used by UDPoS are legitimate DNS queries, they behave quite differently than normal DNS queries in that they have very different lexical features. Giving an example, the following is one of the queries this malware generates: e8cdf1ce69ec8ac.bin.92753b5792ad47766fc0a6dc225d18[.]a0c4fce0ec0dc142692045ff94b8a9[.]d4641f118d09d2778136de79d6bebb[.]a1cad77d94396dd5550a344ddec895[.]ns[.]service-logmeln[.]network (credit: our colleagues in forcepoint)

Infoblox's product line Threat Insight was built to detect such malicious activities in DNS traffic. Not only is it trained with trillions of real DNS queries, it is also directly integrated with Infoblox DNS products. Running on-premises or in-the-cloud, Threat Insight can detect data exfiltration over DNS tunneling as used by UDPoS. Infoblox Threat Insight can be deployed off-the-shelf without any special product configuration due to its artificial intelligence and machine learning algorithms. In a test case involving UDPoS on a network equipped with Threat Insight, Threat Insight detected the UDPoS activity as malicious after 7 to 44 queries (in different query configurations). Infoblox’s DNS firewall to block all future UDPoS communications based on the detections. This makes hackers' lives miserable as their attempts would fail before significant amounts of data are exfiltrated. In addition, cloud-based Threat Insight can also detect DGA, Fast Flux (another blacklist evading technique). For details of DNSMessenger, see http://blog.talosintelligence.com/2017/03/dnsmessenger.html.

Infoblox offers a suite of security products including signature-based Advanced DNS Protection, advanced Threat Intelligence, and Threat Insight, as part of the ActiveTrust® and ActiveTrust® Cloud solutions. Together, these security products monitor DNS traffic at different checkpoints and disrupt malware communications.  For more information, please visit infoblox.com. 

I want to know the DNS DDoS architecture of Infoblox NIOS Devices.

• How they know the DNS DDoS attack? (most device knows the attack according to baseline. I wish infoblox has some intelligent feature for DNS DDoS)
• How they mitigate?
• How they report?

If u have some favorite link, feel free to comment.

Thanks. Have a nice day.

SaaS is a delivery model where the software is centrally hosted by a vendor and buyers consume the service from the cloud. Whether you are an organization using applications to run your business or a vendor providing critical software as a service to your customers, there is something for everyone in a SaaS model.

What’s in it for consumers of SaaS:

• Reduced IT overhead – Organizations consuming services from the cloud do not need to install or maintain expensive hardware or infrastructure on-premises. If consuming security from the cloud, this is a big advantage because now security can be deployed even in locations where no IT expertise is available.
• Immediate Access to Functionality – Customers get access to the SaaS service immediately upon signup without having to wait for shipment and installation of hardware or software. For example, organizations can immediately improve their security posture by signing up for a cloud based security offering.
• Flexible licensing/payment options – SaaS model provides companies an alternative to the traditional capex model where they pay upfront for any hardware needed and a perpetual software license. By shifting to an opex model, they can take advantage of lower upfront costs and more predictable recurring costs thereafter.
• Seamless upgrades – Customers don’t need to worry about updates for latest features or patching their software for vulnerabilities. The SaaS provider always has the latest secure code in the cloud. This enables customers to get immediate access to new innovations and features.
• Scale as you grow – Organizations don’t have to plan for peak capacity like they do when purchasing infrastructure. They can scale by purchasing higher tiers of the service as they grow.
• Extend reach – Since SaaS services are delivered from the cloud, it is possible to extend the usage of the services to beyond the traditional on-premises network. For example, security delivered from the cloud can easily be applied to devices on or off premises which greatly expands the use cases that can be addressed.

What’s in it for vendors:

• Latest code for all customers – Vendors can allocate resources to provide the latest and greatest to all their customers at the same time, without having to worry about a legacy of old software they may need to support.
• Speed of innovation – The speed of innovation is also much greater as vendors can make available new features and functionality to their customers much faster than with a traditional 6-month release cycle for on-premises software.
• Better Customer Insight– Companies with SaaS offerings are much closer to the customer than companies with only a traditional model because of more frequent involvement with users of their service. This means they can provide features that the customers actually need based on the feedback loop.

Many businesses are in the process of making a shift to consuming services from the cloud because they see greater business value through SaaS.

Infoblox’s ActiveTrustⓇ Cloud solution provides DNS security as a service that enables users to protect against DNS based data exfiltration and stop the execution of ransomware and other malware that communicate with C&C (command & control) sites. It uses a combination of reputation and behavioral analytics methods to detect threats, and since it is delivered from Infoblox cloud, it offers protection for devices everywhere – on or off premises.

To try ActiveTrustⓇ Cloud free for 30 days, signup here.

Gartner estimates the total data loss prevention market “in 2016 to be approximately $894 million and growing at a 9.8% CAGR, to reach $1.3 billion in 2020… By 2022, 60% of organizations will involve line-of-business owners when crafting their data loss prevention (DLP) strategy, up from 15% today. By 2020, 85% of organizations will implement at least one form of integrated DLP, up from 50% today(^2).

“The drivers for DLP investments continue to revolve around ensuring regulatory compliance, protecting intellectual property or gaining additional visibility into data movement(2)."

According to recent surveys, 46% of respondents experienced DNS-based data exfiltration and 45% experienced DNS tunneling(3). Malware and data theft are pervasive largely because conventional cybersecurity solutions such as secure email gateway (SEG), secure web gateway (SWG), next generation firewall (NGFW), data loss prevention (DLP) and intrusion prevention systems (IPS) are not designed to protect DNS.

Infoblox Data Protection and Malware Mitigation Solution is designed to address the DNS security gap described above. The Infoblox solution provides:

• Disruption of the cyber kill chain to limit malware proliferation
• Detection and protection against known and zero-day data exfiltration
• Deep visibility into the network
• Centralized reporting that can be leveraged for further analysis and planning

Disruption of Cyber Kill Chain Focus on the DNS control plane:

The Infoblox solution for data protection and malware mitigation uses a multi-pronged approach to threat detection using a combination of reputation, signature and behavioral methods. It proactively contains malware such as phishing, ransomware and more, and stops command and control communications at the DNS choke point. It enforces policy using up-to-date threat intelligence that has been aggregated, verified and curated by an in-house threat research team. Available as an on-premises solution or as a service delivered from the cloud, the solution protects users wherever they are—within headquarters, roaming, or in remote offices/branch offices.

Extending Protection across your Security infrastructure:

By sharing the DNS indicators of compromise with security ecosystem tools such as next-generation endpoint protection (NGEP), NAC, vulnerability scanners, and SIEM, the solution protects against lateral movement of threats.

DNS Data Exfiltration Protection:

The number one goal of malware is to steal sensitive information. There may be several ways of getting to sensitive data, but the pathway that is often left open and under-protected is DNS. Malicious actors know this and use DNS tunneling and other sophisticated zero-day methods to exfiltrate data over DNS queries. The Infoblox solution for data protection and malware mitigation uses a combination of reputation, signatures and behavioral analytics to detect not just standard DNS tunnels but also zero-day techniques that could be low and slow and happen over longer periods of time. This solution is offered both on-premises and in the cloud.

Deep Visibility:  

With Infoblox, you get end-to-end visibility into infected endpoints wherever they are and actionable context, including user name, MAC address, device type, and lease history, to hasten remediation. An integrated and sophisticated threat investigation tool enables rapid investigation and provides detailed information on threat actors, campaigns, and associated breaches for deep analysis.

Unified Reporting and Mining Valuable Historical DNS Data:

Infoblox provides detailed and centralized reporting for on-premises and cloud-delivered solutions that:

• Harnesses rich network data to gain actionable insights
• Monitors and analyzes your network, devices, and applications
• Provides details on malicious activities and infected devices

.

Why Should Channel Partners Care?

• Address customers’ regulatory compliance requirements to protect data. DNS is the often-ignored threat vector and Infoblox provides an opportunity to address this security gap:
  • Educate and position the Infoblox solution for protection against DNS-based data exfiltration and malware spread
  • Gain end-to-end visibility into infected endpoints
  • Consolidate and centralize reporting for on-prem and cloud based DDI infrastructure
  • Only DDI vendor that provides a hybrid (on-prem and in the cloud) option to protect data and users
  • Only DDI vendor that provides a combination of reputation, signatures and behavioral analytics to detect and protect against DNS based data exfiltration
  • Leverage Infoblox threat intelligence platform to prioritize critical threats for containment and to enhance your customers’ security ecosystem
• Grow Your Revenue
  • Address a growing data loss prevention market
  • Up-sell existing Infoblox DDI and DNS Firewall customers on this Infoblox security solution to enhance their security posture
  • Enhance your security portfolio by bundling Infoblox data protection and malware mitigation solution with your current offerings such as cloud, virtualization, managed security and networking
  • Create opportunities to cross sell additional security solutions such as Infoblox Infrastructure Protection and Infoblox Threat Containment and Operations

1. Source: Cisco 2016 Annual Security Report
2. Source: Gartner Magic Quadrant for Enterprise Data Loss Prevention, Feb 2017
3. Source: SC Magazine, Dec 2014, “DNS attacks putting organizations at risk, survey finds”