Much as it irritates users, sometimes the kindest thing that an administrator can do is to limit the abilities of an unskilled user to harm themselves. There is also the corporate network to consider – the safety of organization sometimes requires that individuals are limited. IE has features to limit what the user can do which an administrator can set. They are detailed here:

http://technet.microsoft.com/en-us/library/bb457144.aspx

These can be turned against the user by malware and that does sometimes happen. Let us consider a few of them and how malware has used them to protect itself rather than the user:

Download signed ActiveX controls – disable that and pretty much every online virus scanner will stop working.

Various settings allow the administrator to block the downloading of various file types including .exe files – which would prevent the user from downloading a lot of the “quick fix” type of malware removers.

Sites can be added to the restricted zone – and if security sites are added to this zone, the user is effectively blocked from them.

Group policies can also be set even if the machine is not in a domain.

We have seen malware doing these things lately. Of course, if the user is an admin (and home users generally are) then the changes can be reversed if the user knows how - but many home users do not.

For quite a while, one tool in the arsenal of the techie removing malware is to alter the rights on an executable using cacls to prevent it running. The same trick has been used maliciously to block access to cmd.exe – The black hats have access to all the same tricks as we do.

The white hat community has stolen a trick or two in their turn. Anti-virus solutions increasingly hijack the kiservicetable or overwrite function prologues to try to prevent malware doing the same or to detect malware by getting underneath it. One of the truisms of malware detection is that you can only trust the layer above you because you have complete visibility of it. Conversely, it is hard to see what has happened below you because it may be changing your behavior without you knowing – a malicious kernel fooling a benign application. The phrase that we most commonly use is “He who hooks lowest wins”. Anti-virus and virus are both heading down the stack from userland to kernel and eventually to hypervisor level.

Malware tries to hide from antivirus programs and kills AV products when it can. Some AV software is now using stealth technology to hide from malware and try to avoid being killed or more commonly, crippled to leave the appearance of function without actually blocking the malware. It can be a challenge to work out whether subversion of the kernel is benign or malicious without a good rummage around in the debugger.

So, we have measure and counter measure, each sharing the same tools. The legitimate software community has more resources but the malware industry has everything to play for. The balance shifts all the time and it may well be that user education and not technology has the most to contribute. Social engineering remains the number one way to compromise a system… and maybe limiting the user is the lesser of the two evils.

Of course, we have done this in a very small but important way. Later versions of the browser on later operating systems run content with fewer rights. Most users never notice.

We live in interesting times, my friends

Signing off

Mark

I am sorry that I haven’t updated my blog for a while. It has been a bit of a busy time. Since there have been press releases and other people have blogged, I suppose that I can talk a bit about what I have been doing.

As I have mentioned, I have been writing lots of training material. Microsoft have been working with Law Enforcement for a while and helping them to understand some of the deeply technical elements of the cybercrime landscape. This training is targeted at LE and, since I wrote a small part of it, I get to go meet a lot of policemen and talk to them… and that is really all that I can or will say about that.

Of course, I still help corporate customers who have malware or who have been hacked or who are in some other way compromised. No names and no pack drill here but there is one thing that I am seeing over and over and over. It has become so common that it is now the first thing that I look for.

Administrators should not browse the web or do their email using a domain admin account. They really, really, really should not do this on the domain controller. They should have a separate account with (at most) ordinary user rights that they use for this sort of activity. Ideally, they should do this from a Vista box as they are hardest to compromise because of the Address Space Layout Randomization (ASLR) means that most compromise types just crash harmlessly.

Of course, you already know this. I am sure that you always use the right account for the right job but not everyone does. Six malware cases in a row and I have found the same thing. It is late at night and the admin is bored. He starts browsing the web from the (P)DC or a file server and looking for something to entertain him. He is looking for a fun game or a video (possibly a “saucy” one) and he has to download an ActiveX or a video codec. He downloads the unsigned component from some website somewhere and he gets owned. Better yet, because he is domain admin, his domain just got owned.

In each of those cases, the malware was a bot that joined the machine to a botnet and the botherder didn’t apparently pay any special attention to the machine but that was sheer luck.

So, I haven’t told you anything that you didn’t already know but if you pass on the word and someone in a branch office or a new hire or the guy covering for the admin while he is off with flu, well, then maybe his life will be a little easier, the black hats life a little harder and maybe, just maybe I will get some more sleep.

Oh, and software vulnerabilities? I haven’t seen one of those exploited this year.

Signing off

Mark

I wanted to talk about some of the things that malware does to make itself hard to remove. Most Trojans are designed to work on an average XP workstation and make assumptions based on that – which typically breaks servers in rather nasty ways.

I was recently looking at a Russian written malware implemented in VB6 – a curious choice and the developer had an odd style to his coding. It didn’t use a kernel mode rootkit which is the more common approach but relied on registry settings to do the dirty work. You might want to check these if you find yourself cleaning up a box:

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]

  DisableSR = 0x00000001

If it is a 1, you can’t do a system restore. Simple enough to fix if you can edit the registry.

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]

  DisableTaskMgr = 0x00000001

  DisableRegistryTools = 0x00000002

Except that you can’t because he disabled the registry tools and task manager. Well, task manager is no great loss. Process explorer from http://technet.microsoft.com/en-us/sysinternals/default.aspx will do the job at least as well. Disabling the registry tools is more of a problem unless you are on a network and able to remotely edit.

[HKEY_CURRENT_USER\Software\Policies\Microsoft\MMC]

  RestrictToPermittedSnapins = 0x00000001

This was used to make MMC effectively useless. By default, no snap-ins (things like perfmon or event viewer or SQL management or whatever) are in the permitted list.

Disabling CMD.EXE is a pain when trying to remove malware so he setting the following registry key  

 [HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System]

  DisableCMD = 0x00000001  

That is especially problematical for some tools that rely on batch files and some security tools do since old school can sometimes be the only way of doing something.

In this case, a few minutes work with WinPE was enough to rain on his parade but a bit of remote registry manipulation would have done the job just as well.

Hope that this helps someone

Signing off

Mark

Just a quick heads up - we know that the link from the bulletin is broken. We had a problem with propagating out the file to the web farm (it is a big old webfarm) and so the file is not universally available just yet. 

We have a lot of operations guys running around looking at all sorts of things to get this fixed and it should be fine in a few hours

Sorry about the delay

Mark

I was discussing the matter with my colleague Lesley who is much more network oriented than me – and a smart cookie as I believe that I have mentioned before. She commented that there were some very clever people who thought that firewalls had reached the end of their life. Now, my first thought was “Sure, you can have my firewall when you take it from my lifeless hands” but now I am not so sure.

Most attacks are not against the OS any more. Blackhats go for the applications (specially created documents/streams) or  the webserver (cross side scripting) or whatever. Sure, there have been some vulnerabilities that could have been exploited and people always look for more but that is not where successful attacks seem to be in practice.

Does that mean that it is safe to let any packet in? Would it be safe if every service on the network was 100% bullet proof? Well, no and no. It would be possible to flood the network even if nothing could be exploited. Anything that offers a degree of control is a help. There is also the question of disclosure. While security by obscurity is no security at all, it seems a gift to an attacker to let him know anything at all. There is a lot to be said for your company’s network  being a black box to the outside world. However, the conventional firewall is not that useful. A lot of nasty things can route through port 80. Some good things too such as SOAP or whatever it is called these days. Marketing comes up with the names. We called it RPC over HTTP among ourselves. A nasty thing is often just a good thing misused. A firewall is not much use there.

NAT (network address translation) solutions have a lot going for them. To the outside world, you have a single address or a couple of addresses that represent some computers (probably) and have ports that represent something. No easy way of knowing what the ports represent. No easy way of knowing if 2 ports are on the same real system. No way of knowing what the topology is – and the conversation is set up by a request from the inside although some things have to be open such as email. So far so good.

But does this mean the death of the DMZ? Do you just replace the firewalls with NATs? That isn’t so clear yet… but yes, maybe the conventional firewall has served its time.

Signing off

Mark

Because of my self imposed rule that all blogs must have some technical content:

Most bots don't use hard coded IP addresses for their command and control mechanism. Sometimes the engine of the bot is passed the IP address as a parameter but generally the malware does a DNS lookup. This helps the malware writer since it is fairly easy to kill a site and the DNS deref means that the site can be resurrected if WhiteHats take it down. However, it also gives us another tool.

Back in the history of the internet, there was a time when it wasn't that hard to recall the IP addresses of all the sites that you used because there were perhaps 5. When there 70 or so, people would download a list of sites and their IP addresses - the hosts file. Now we use DNS servers that look up any domain name but Windows will use the address in the hosts file first. This file is at %SystemRoot%\system32\drivers\etc\hosts and is just a plain text file with no file name extention. So, if a bit of malware wants to connect to www.mybadsite.com and you add an entry to the hosts file to 127.0..0.0 (remember that there is no place like home) then the malware will not be able to get commands or pass out information. That has largely broken it, buying you some time without otherwise breaking your infrastructure

 Signing off

 Mark

I am sorry that I haven’t blogged for a while. It has been a bit of a busy time. After developing all that training (and I would love to be able to say who the audience were but I really can’t), I was on the receiving end of some for a change.

It has been decided by the powers that be that accreditation is necessary for someone in my role. Ok, fair enough. I was offered the choice between all of the exams for MCSE+Security or CISSP. I enjoy exams rather less than root canal work so I went for the 1 rather than the many. In order to maximize my chances, I went on a weeklong cramming session in a training centre in central nowhere, Oxfordshire. A splendid Canadian called John Glover was teaching us and I am sure that he will not mind me saying that he has been around the block once or twice and knows where the bodies are buried.

The CISSP exam is 6 hours long and covers a massive range of topics including but by no means limited to:

Risk management

Continuity planning

Crisis management

Ethics

Law (and that is fun in a multinational)

Encryption

Access control

Telephone systems – no, really

International Standards

Physical Security

I have never had to consider what sort of barrier would be most effective against explosives and whether a fondness for gambling was in and of itself reason why someone should be denied a contract.

After the exam, I was sure that I had done a lot worse than the easy pass that I had in the mock and I was concerned that I had made a pig’s ear of it. The same was apparently true of pretty much everyone who has sat that exam so we shall see. If I have failed (a real possibility) then I will have publically revealed myself as a dope..

So, have I been busy learning about the latest malwares and controlling mass mailer worms rampaging through networks? Actually, no.

We are not getting that many reports of new infections and I have mostly been looking at some hacks against the application layer – typically SQL injection attacks. These still seem as popular as ever but the focus has changed a little. We used to see a lot of web defacement cases from script kiddies and these are still not uncommon but more recently, the bulk of these attacks seem to be targeting PII (Personally Identifiable Information) which can then be used for identity theft or inserting links to malware in the hope of compromising the clients who visit the legitimate website.

We have noticed a decrease in the number of malware cases coming to us over the last few months. I think that user awareness is a large factor; people are more reluctant to open strange executables. The anti-virus solutions are also getting better with updates often being daily. Whatever the reason, the business is changing.

Oh, there is also a small milestone to commemorate. According to Cenzic, Internet Explorer had the fewest reported vulnerabilities of any of the major web browsers. Firefox had 3 times as many and Opera nearly 4 times more that IE. Oh, and none of their top 10 vulnerabilities for the quarter were in MS products.  That is the first time that has happened :-)

Until next time

Mark

We have a fine crop of updates for you but I am not going to talk about those, partially because we won’t be releasing them for several hours and partially because that is the province of my much respected colleagues in the MSRC – you can always get the straight dope here: http://blogs.technet.com/msrc/

This month so far has been a fairly quiet time for me. We are seeing fewer new infections recently though the ratios of where this stuff comes from are pretty consistent. You might find the threat map at www.threatexpert.com to be an interesting read.

The Storm botnet is recruiting again, this time with Valentine cards instead of Christmas cards or promises of applications to help you track football scores. A lot of people are now aware of the techniques used by this bot and infection rates seem to be dropping a little though it is a little hard to tell. Storm uses a peer to peer protocol for its command and control mechanism and so there is no one place to monitor the network. The packets look very much like eDonkey file share activity unless you know to look for the 40 byte encrypted packet at the start.

On the subject of Storm, this is a malware that, in its most recent versions, has been very much based on social engineering. It is apparently remarkably easy to persuade people to install malware on their computers. No really, I am not making this up. Independent research shows that around 75% of malware on systems got there because a user installed it while under the impression that it was a good idea. Some of it is installed because a popup tells them that they need a video codec so they download an EXE file. Some of them respond to a popup saying that there is evidence of malware or visiting adult sites on their computer. They download the program to “fix” this problem and then the problems start. Now, you, gentle reader, I know that you would never fall for such blatant social engineering but consider your cousin, the person at the supermarket checkout, yourself when you were a kid still learning what you know now… well, they will. Not every unskilled user will fall for these tricks but enough will that it is a fertile recruiting ground. 75% of malware gets on systems this way. Who needs security vulnerabilities to spread malware?

Is it heresy to say that on a patch Tuesday? Of course, vulnerabilities matter. Wormable vulnerabilities matter a lot. A corporate network can be taken down in less than an hour by an aggressive worm if there are no mitigations in place. Targeted attacks pretty much always use some vulnerability in software. Vulnerabilities matter a lot. Updates are critical. What they are not is all of the story. Many people seem to think that they are.

One of the most common questions that I get asked when people learn what I do for a living is “Why don’t Microsoft make Windows more secure?” The answer is “We did. Look at Vista and Server 2008. We are. Look at the bulletin release schedule. Look at the malicious software removal tool.” I don’t generally say the next bit. We work very hard to improve security but we don’t have much control over the things that get exploited most often: People.

Ah, but wait a minute, I hear you say. If vulnerabilities are not the be all and end all, why are there so few malwares on (insert name of alternate OS here). The answer to this is simple and I am far from the first to say it. Why do criminals rob banks? Well, that is where the money is. Malware used to be written for bragging rights. Now it is written for money. Either way, the malware writer wants as many systems as possible affected. 19 out of 20 desktop systems run some flavor of Windows. If I want to affect as many systems as possible, which do I attack? It is a no-brainer. You develop exploits for the biggest payoff.

Does this depend on which system has the most vulnerabilities? No, not at all. If Linux had 5 times as many vulnerabilities as Windows (which I don’t think for a moment that it has) and you had a 100% success rate at compromise Linux desktops then you would have… 5% of the market. If you had a 10% success rate at compromising Windows systems then you have 9.5% of the market.  It doesn’t make sense to go for Linux as a platform for malware.

All that said, vulnerabilities in the OS are less of a factor all the time. A lot of exploits target applications these days. The antivirus product, the reader for one of the common formats like Flash or PDF or Java or whatever it is this month are at least as good a target. The people are at least as good a target. In fact, looking at the numbers, the people are 3 times better targets. We can’t make better people – and we don’t want to limit what people can do because people resent that. Look at the reputation that user access control in Vista has.

It is a tricky problem. We can make better operating systems. We can not make better people.

(Edited - The original said that we could make better people - so not what I meant)

Signing off

Mark

I am fairly often asked to remove malware from systems which the anti-malware programs on that particular PC system can’t handle. In fairness, it is often not the AV products fault. Most (more than 75%) of malware is actually installed by the users of the system after some social engineering. I know that none of you out there in blog land would do that sort of thing but it does happen. We have all downloaded drivers from the web, codecs from the web and utilities. It is easy enough to get it wrong and some of the Blackhats can make some very convincing webpages and emails that would fool your brother/mother/dentist. Anyway, that is how a lot of this nasty stuff gets on systems and one of the first things that it normally does is try to break the AV solution. Sometimes it succeeds.

I am yet to find an instance in which this has happened where the machine could not be cleaned up with the SysInternals tools and a little ingenuity. I know that I have mentioned this before but I hadn’t linked to the excellent video presentation by Mark Russinovich video: http://www.microsoft.com/emea/spotlight/sessionh.aspx?videoid=359

I would also like to mention a really good tool called Rootkit Unhooker. This was written by a Russian team who have since joined Microsoft. It is excellent for finding hijacks in the kiservicetable, hidden files and processes and similar rootkit tools. If you work with malware on a regular basis and haven’t tried this tool then you might want to search it out. I have had considerable success with this tool where some others have not been as useful.

Anyway, hopefully I will be back to some more code related posts soon but thought that this tools update could prove useful

Signing off

Mark

The honest truth is that I have been stuck on a long term project which I can't really talk about. It is not "scary secret, Die Hard 4.0" stuff but it is not something that I can share with my readers. However, I was called in on an interesting case.

 A customer found that his FTP server was being repeatedly hit by requests from odd IP addresses - all of them attempts to log in. One request would be from Prague and the next would be from Turkey. It was clear from the pattern of names that this was some form of dictionary attack. Abigail would follow Abe who followed Aaron even though the attempts were from far apart - oh, and seperated by perhaps half a second. This is typical of a botnet though they rarely attack FTP servers since it is not a high profit activity compared to some other uses.

Tracing the IP addresses, they were generally from home systems. You might wonder how I could tell that. Well, in truth, there was more than an element of guesswork in it. I can say that they were normally registered with ISPs who cater for home users and they were on slower links. They generally had few if any exposed services. It is a pretty safe bet that they were home systems.

As for where the botnet was located, that is a harder question and I can only guess but most of the addresses were in the middle east or eastern europe and the names that it was trying were typical of Jewish names - A lot of Isaacs and Rachels and Abrahams in there. A bit of research showed that what I was seeing was a typical pattern for this botnet and that it was being used to harvest information when possible.

A more interesting question for the customer who had the server was what he could do about it. The answer, sadly, is not a lot. He could appeal to law enforcement who are probably already doing all that they can to find the botherder and whitelist addresses that he knows on the firewall.

The botnets are out there and they never sleep

More updates after next week when I am back in the office and doing my normal job again.

Signing off

Mark