Raiders of the Lost ARP

Amateur Security Archaeologists, trying not to break things.

Author: Mike (Page 2 of 12)

cartoon showing a software supply chain being stretched to the breaking point while two big businessmen pull it in opposite directions
It seemed like such a good idea to do a stock buyback rather than support open source solutions we depend on!

What’s causing Mike’s Indigestion now? Supply Chain Heist (5 April 2024)

April 4, 2024 / / 0 Comments

Happy weekend, folks! Loads of cool stuff going on in the day job, but lots chatter focused on 2 areas on opposite sides of the software ecosystem. The resourcefulness of adversaries never ceases to amaze me. Both stories offer a lot of intricate technical details, but the big takeaway is that we’re in serious trouble unless we tackle best-practices, hygiene, and find support for the massive base of open source projects. So let’s get going!

Open Source projects need our help

Since the beginning of the Internet Age, applications and operating systems have been dependent on open source. Despite the riches raked in by for-profit companies for their software, all of them stand on the shoulders of open source software libraries and packages. I think we all get it – using open source accelerates innovation. Why reinvent the wheel, right? But it is high time that we all consider how we support those open source projects. The maintainers of those efforts are usually coding these as a passion project or hobby. And they are all overwhelmed and outmatched. Need proof? Heartbleed, Log4j, Java and NPM vulnerabilities, Shellshock, and multiple Apache Struts CVEs can jog your memory.

Last week an attentive Microsoft engineer Andres Freund luckily stumbled on a performance issue, and traced it back to a hijacked open source compression library used in most modern Linux flavors known as XZ Utils. An adversary made a 2+ year effort to gain trust as a contributor and eventually gain commit-level privileges. They then disabled testing of their contributions and slowly nudged the code base to support their efforts to embed a malicious backdoor flaw into the package. This interferes with authentication in SSH and injects code to open up a backdoor. Holy cow!

Lucky for us, Andres caught it – before the code could be promoted to released versions of Linux. But we have a big problem. Expecting these projects to operate with no funding, 1 to a few contributors, and zero support in testing and validation is supply chain suicide. It is time for the many prosperous companies that benefit from these heroic efforts give back and assist in securing these projects for the greater good.

  • Want to learn more? Kevin Beaumont does a great job talking about this entire caper holistically.
  • Want to get nerdy? The SANS ISC does a splendid job of explaining the technical how of this backdoor here.

Microsoft struggles to use their own tools securely

Lest we think that Open Source cannot be relied on and that professionals and closed source are the safest bet, Microsoft shows that no one is infallible. If you recall, APT Storm-0588 compromised Microsoft’s Exchange Online email service through information from a developers laptops and a stolen Azure signing key. Despite happening 10 months ago, Microsoft is still not publicly aware of what happened, and CISA and the US Department of Homeland Security called them out for their handling of the matter. Don’t confuse with the breach of their own senior leadership team’s email accounts, which it appears they are still struggling with months later – talk about persistence!

  • Want to learn more? Bleeping Computer’s synopsis boils it down for us. Ars Technica goes into more details about how the breach was made.
  • Want to get nerdy? You can read Microsoft’s own analysis of the situation here.

This week in AI

Seeing the confluence of massive AI adoption and the emergence of so many open-ended concerns, what is obvious is that we’ve already lost control of AI’s propogation. Talking to my good friend Mark Stephens, he clued me in on a book by Nick Bostrom called “Superintelligence: Paths, Dangers, Strategies“. Amongst other things, he discusses how AI – given a simple goal of making the best paper clip – would make decisions that eventually threaten human life. Needless to say, that book is on order!

Things I am keeping an eye on

Good Reads

  • Nothing too new – I am about 1/4th of the way into Children of Ash and Elm (the Viking history book). It’s amazing how misunderstood they are. The many languages and transitions of knowledge between groups and regions contributed to that confusion. Seems like history certainly rhymes!
  • I am also reading the latest SANS Threat Hunting Survey results, and as explained in David Bianco’s video highlights, it is concerning that more than a third of customers Threat Hunt without a formal process, and the same percentage find that it impairs security, rather than improves it!

I hope that this update unravels a little of the many mysteries we are all being impacted by in cyberspace. If you have any feedback please send it along!

cartoon of a middle-aged and bearded Indiana Jones who is trying to squeeze into an army uniform while hiding behind a stack of crates.
I wonder how long I have to wait before the attack - I can't hold it much longer!

Persistence: How Uninvited Attackers Avoid Being Bounced from the Party

April 2, 2024 / / 2 Comments

Hello folks – welcome to Part 5 of the series on MITRE ATT&CK Tactics! Today we’re talking about how adversaries maintain a foothold. Like any invading force, threat actors work hard to ensure that they get initial access, and they would rather not have to repeat that effort. Traditional aggressors most often resolve to maintaining pressure on the front once their initial attack lands. This has the effect of exhausting the defenders and ensuring they are unable to reset or respond effectively. Some attackers will leverage asymmetrical warfare elements like guerilla forces, local resistance forces, or agents to undermine defenses and guarantee access. Cyber adversaries need the same sort of effects, and that guaranteed access is arguably their highest priority. So let’s discuss the MITRE ATT&CK Persistence tactic and see why it is vital and how they might achieve it!

Continue reading
a cartoon of a bunch of computer hackers who look like the rolling stones
This isn't quite the tour we had in mind, lads! Good thing Keith's good at persistence...

What’s causing Mike’s Indigestion now? Real Stones on that one! (29 Mar 2024)

March 28, 2024 /

Wow, I am so sorry folks! it has been 3 weeks between updates – as I mentioned on LinkedIn, things have been busy on the travel front! In that crazy time, a lot of interesting things have happened that are worth a good look! Much of the biggest news this week in the world of threats is on another one of our state sponsored threat actors, APT31, so let’s see what the buzz is about.

Continue reading
AI Generated image of Mongol warriors having fun while making a scary shadow puppet show for their victims.
We should take this one to Broadway, boys! Shadow puppets are way more fun than germ warfare!

Execution: Ruthless attackers run malicious code on your systems

March 25, 2024 /

Welcome to Part 4 of our series on MITRE’s ATT&CK Tactics! At this point in the attack, adversaries have pulled the trigger on an attack and defenders have had their first fair shot at detecting the transgression. Like a fortress’s defenders seeing the build-out of siege weapons and the digging of trenches, defenders now know from where a part of the attack is coming. For the attacker, they are relying on their preparation, coordination, and focus to overcome defensive efforts. For the defender, they are likely depending on the training and processes – and their garrison’s trust and cohesion – to disrupt and repel. How able are the attackers to carry out their plan, to sap the fortifications, to breach the walls? This is the MITRE ATT&CK Execution Tactic, and it is the phase from which all later phases branch.

Continue reading
Horrible AI-generated image of Roman Soldiers all looking outward for attacks while completely ignoring things already happening inside.
Hey Salvius - are we sure Tacitus will let us know if any of these sneak in?

Initial Access: “It’s go time!” for an adversary

March 18, 2024 /

Welcome to Part 3 of a series in which we walk through MITRE’s ATT&CK Tactics! Continuing the theme of any movie portraying a conflict, this is where someone takes action against their target. In HBO’s Band of Brothers, an entire episode is spent showing how Easy Company was formed and prepared for D-Day. Not only did they drill and train on general airborne skills and fitness, but they studied their sand tables and maps intently. Eventually, someone has to call the shot – in this case Eisenhower issued the order and they boarded planes & ships. Once the paratroopers, glider troops, trailblazers, and other recon units crossed the channel, the invasion had passed the point of no return. Initial Access was attempted. If you’re the Allies, hopefully the Recon and Resource Development were done right! Now let’s see how all of that pays off for the adversary in ATT&CK – Initial Access.

Continue reading
« Older posts Newer posts »

© 2024 Raiders of the Lost ARP

Theme by Anders Noren — Up ↑

Verified by MonsterInsights