Connect with us

Cyber Security

MoonBounce UEFI implant used by spy group brings firmware security into spotlight



Researchers uncovered a stealthy UEFI rootkit that’s being used in highly targeted campaigns by a notorious Chinese cyberespionage group with suspected government ties. The group is known for using software supply-chain attacks in the past. Dubbed MoonBounce by researchers from Kaspersky Lab, the implant’s goal is to inject a malicious driver into the Windows kernel during the booting stages, providing attackers with a high level of persistence and stealthiness.

While MoonBounce is not the first UEFI rootkit found in the wild — LoJax, MosaicRegressor are two examples– these types of implants are not common because they require knowledge of low-level firmware programming. They are typically found in the arsenal of well-resourced and sophisticated attacker groups.

What is an UEFI rootkit?

The Unified Extensible Firmware Interface (UEFI) is the modern replacement for the BIOS. In fact, the terms are still used interchangeably in many cases since most modern BIOSes follow the UEFI standard and specification. The firmware is stored on a memory chip called the SPI flash that’s soldered on the motherboard and contains the code necessary to initialize all the other hardware components and configure them before execution is passed to the bootloader code that starts the main operating system and its kernel.

The UEFI contains various drivers that are used to talk to the other chips on the motherboard as well as the CPU and other peripherals. Getting malicious code to execute into such an early initialization phase of a device is extremely powerful because there is no antivirus or intrusion detection solution that runs at that level. Also, the operating system’s security features such as digital signature verification for drivers has not yet been initialized and can be disabled or bypassed.

UEFI rootkits essentially get a head start to and a privileged position over most other defenses found on a typical computer. They can be hard to detect and can even prevent normal UEFI updates. Researchers have recently found a similar low-level implant that infects the baseband management controller (BMC) firmware of HPE servers and works on similar principles.

Boot-level rootkits are the reason why the PC industry has added firmware security features over the past 10 years. For example, UEFI has SecureBoot, which relies on public key cryptography to verify that all code loaded during the boot process — from UEFI drivers and applications to the OS bootloader and the OS kernel — have been digitally signed by a trusted party. Various regions of the UEFI memory need to remain read-only or non-executable.

However, while UEFI is a standard, PC manufacturers maintain their own implementations customized for their devices. This means the UEFI firmware of a computer from one vendor will be slightly different then the UEFI firmware from a computer from another manufacturer. Vulnerabilities have been identified over the years in the UEFI firmware implementations of various vendors that could allow attackers to bypass UEFI security features. That’s why it’s also important to maintain the ability to easily deploy UEFI updates from inside the OS and to keep the firmware up to date.

How does MoonBounce work?

MoonBounce was found in an UEFI component called CORE_DXE, DXE standing for Core Execution Environment. This component initializes data structures and function interfaces that are then called by other DXE drivers. The attackers appended malicious shellcode top the CORE_DXE image and then made modifications to the code to hook certain legitimate function calls and divert their execution to their shellcode.

“Note that at the time of writing we lack sufficient evidence to retrace how the UEFI firmware was infected in the first place,” the Kaspersky researchers said in their report. “The infection itself, however, is assumed to have occurred remotely. While previous UEFI firmware compromises (i.e., LoJax and MosaicRegressor) manifested as additions of DXE drivers to the overall firmware image on the SPI flash, the current case exhibits a much more subtle and stealthy technique where an existing firmware component is modified to alter its behavior.”

This type of modification implies the attackers had access to the original firmware image. This can be achieved if attackers had remote access to the machine and administrative privileges to extract and flash the firmware.

Once executed, the malicious UEFI shellcode injects a malicious driver in the early execution stages of the Windows kernel and this driver then injects a user-mode malware program into the svchost.exe process once the operating system is up and running. The user mode piece of malware is a loader that reaches out to a hardcoded command-and-control server to download and execute additional payloads, which the researchers were not yet able to recover.

The Kaspersky researchers said they’ve identified MoonBounce on a single victim machine so far, so it’s hard to say how widespread its use is. However, it’s likely part of a highly targeted cyberespionage campaign.

The researchers found additional malware on other machines that were located on the same network, including one called ScrambleCross or SideWalk that has been documented in the past and attributed to a Chinese cyberespionage group known under various names including APT41, Barium or Winnti.

Who is APT41?

APT41 is believed to be a cyberespionage group that has ties to the Chinese government. It has been operating since at least 2012 and has targeted organizations across many sectors with the goal of intelligence collection. However, the group is also known for launching financially motivated attacks against the online gaming industry which do not seem to match a state-related interest, so it could be acting as a contractor rather than a team within an intelligence agency.

In September 2020, the U.S. Department of Justice unsealed indictments against three Chinese and two Malaysian nationals in connection with APT41 attacks. Three of them were involved in the management of a company called Chengdu 404 Network Technology that was allegedly serving as a front company for the group’s activities.

APT41 uses an arsenal of over 46 different malware families and tools as well as sophisticated techniques such as software supply-chain attacks. One example is the 2017 attack against CCleaner that resulted in poisoned copies of the popular utility being distributed to 2.2 million users. The group is also believed to be responsible for ShadowPad, a software supply-chain attack that resulted in the distribution of malicious versions of a commercial enterprise server management tool called Xmanager.

“As a safety measure against this attack and similar ones, it is recommended to update the UEFI firmware regularly and verify that BootGuard, where applicable, is enabled,” the Kaspersky researchers said. “Likewise, enabling Trust Platform Modules, in case a corresponding hardware is supported on the machine, is also advisable. On top of all, a security product that has visibility into the firmware images should add an extra layer of security, alerting the user on a potential compromise if such occurs.”

Copyright © 2022 IDG Communications, Inc.

Source link

Cyber Security

In-house vs. Outsourced Security: Understanding the Differences



Cybersecurity is not optional for businesses today. Ignoring security can result in a devastating breach or a productivity-sapping attack on the organization. But for many small- and medium-sized businesses (SMBs), the debate often revolves around whether to hire a third party or assemble an in-house security operations team.

Both options have their own pros and cons, but SMBs should weigh several factors to make the best decision for their own unique security needs. An in-house team, a managed security services provider (MSSP), or even a hybrid approach can make sense for various reasons.

Before choosing to build an in-house security team or outsource to an MSSP, businesses must first evaluate their unique needs to ensure the choice lays a foundation for future success.

Weighing control vs. costs

The obvious reason for assembling your own security team is control and immediate knowledge of what goes into your security operations.

“Handling security internally means you will sometimes have better visibility and centralized management,” says Scott Barlow, vice president of global MSP and cloud alliances at Sophos. “That said, if you outsource with the right service provider, visibility into what is going on should not be an issue.”

For many smaller organizations, the cost of running an in-house security program is prohibitive. Hiring skilled security specialists is expensive, and they are often difficult to find. They require regular training, and certifications must be kept fresh – typically at a cost to the employer.

“When you outsource to an MSSP, you will be paying a lot less than paying a senior security executive,” Barlow says. “I suggest that organizations conduct a cost analysis of outsourcing compared to paying salaries. Much of the time, it’s better to outsource.”

There are also technology and license costs to consider. Keeping software licenses up to date can consume both time and money, whereas working with an MSSP means access to the latest technology without worrying about license costs.

If both are important, try a hybrid model

Of course, some large organizations might need an in-house security presence.

“Generally, the larger you become, the more you need someone internally. That is where a co-managed model makes the most sense,” Barlow says.

In a hybrid model, companies tap outside support to collaborate with an internal security executive or team. This approach allows for more scalability while also providing the business with plenty of expertise through their relationship with the MSSP.

“Maybe you want to outsource a portion of the services because you can’t cover 24-7. Or maybe you need coverage on weekends,” Barlow says.

One major benefit to tapping outside support: your in-house team will have more time to focus on mission-critical objectives.

“With a hybrid approach, the internal IT and security teams can pivot to focus on more revenue generating activities,” Barlow says.

Click here to learn more.

Copyright © 2022 IDG Communications, Inc.

Source link

Continue Reading

Cyber Security

Prevention or Detection: Which Is More Important for Defending Your Network?



When it comes to physically protecting a building, you have two primary defenses: prevention and detection. You can either prevent people from entering your property without your permission, or you can detect when they have already trespassed onto your property. Most people would prefer to prevent any trespassing, but a determined adversary is always going to be able gain access to your building, given enough time and resources. In this scenario, detection becomes the only alternative.

The same holds true for protecting assets in the digital world. We have the same two primary defenses: prevention and detection. And just like in the physical world, a determined adversary is going to gain access to your digital assets, given enough time and resources. The question will be: How quickly are you able to determine that an adversary has penetrated your network?

If you can’t prevent, you must discover

This is where detection comes in. Do you have the right tools and procedures in place to find attacks quickly when they are occurring? Most businesses do not. It takes days, weeks, and often even months before an attack is discovered. The gap between breach and discovery is known as dwell time, which is estimated to be more than 200 days in most cases and, according to IBM, as many as 280 days in some instances. If it takes this long to discover that an attack is in process, it may be impossible to determine the root cause if you don’t have enough historical data to review.

Therefore, it is just as important, and maybe even more important, to spend money increasing your ability to detect when a breach has occurred rather than to determine when a breach is actively occurring or to see that specific firewall (FW) or intrusion detection system (IDS) rules have actively prevented an attack. New attacks are taking place all the time, and bad actors are constantly coming up with new ways of infiltrating your network. It is important to understand that, at some point, a bad actor is going to get through and penetrate your network. What will be vitally important is whether you are able to see the attack when it is taking place, or shortly after, or whether instead the attack will be discovered weeks or months after the fact. In the latter case, do you have enough historical data to go back and determine when the attack started, or will that data be long gone by the time you notice something is wrong?

Saving the data you need

It is important to have several months’ worth of data so that you can go back and determine the initial compromise on your network. Having an advanced network detection and response (NDR) tool such as NETSCOUT’s Omnis Cyber Intelligence (OCI) can ensure that you have the data you need. OCI stores all of the relevant information, including layer 2-7 metadata and packets that you need to determine the root cause of an attack—not just flow data that won’t help in this situation.

How much historical network traffic are you storing? Do you have enough data to go back and research the start of an attack if it occurred 200 days ago? Or are you going to rely on catching bad actors faster than the industry average? It is important to understand the need for leveraging both prevention and detection capabilities and ensuring that you have enough storage to thoroughly investigate an attack when it occurs.

Watch this video to see how NETSCOUT can help your back-in-time investigation.

Copyright © 2022 IDG Communications, Inc.

Source link

Continue Reading

Cyber Security

Want to Help Your Analysts? Embrace Automation and Outsourcing.



While the security tools we choose to invest in can undoubtedly make or break our success, one area we tend to focus less on is the human component of cybersecurity. Yet today, two-thirds of global leaders claim that the global skills shortage creates additional cyber risks for their organization, including 80% who reported experiencing at least one breach during the last 12 months that they attributed to the cybersecurity skills gap.

The always-changing threat landscape, with fewer skilled people makes it nearly impossible to keep ahead of threats. That’s why it’s time to talk about the human element – specifically your Security Operations Center (SOC) analysts – and their role in your cybersecurity framework.

Helping the Humans in Your Security Stack: Enhance, Automate, and Outsource

When you consider your security stack, you probably immediately think of the technology you use. And you’re likely already consuming these as a service. Security vendors operate, maintain, and improve critical security capabilities for the tech you use, keeping those tools tuned to be resilient against the latest threats so your team can focus on more critical tasks.

But what about the people? They’re just as much a part of your security stack as any firewall, endpoint, application, devices, or sandboxing tool. But there’s likely less of a roadmap for their continual improvement. Your analysts are playing a constant catch up game with alerts, which leaves no time for professional development. You’ve probably considered evaluating which tasks the SOC performs that you could automate or outsource, but a lengthy list of other to-dos often means that process improvements get deprioritized.

If your team is overwhelmed, you’re not alone. Here’s the good news: You can take steps to strengthen your organization’s security posture while simultaneously reducing your analysts’ workloads (and lowering the chances that they’ll burn out).

The first is to enhance their capabilities by choosing the right technology and making time for training when possible. Next is to automate many of your team’s processes to improve accuracy, mean time to detection (MTTD), and mean time to remediation (MTTR). Lastly, there are simply some aspects of cybersecurity you’ll want to outsource to keep your team focused on the most critical tasks.

Enhance Their Capabilities with the Right Technology and Training Opportunities

If you’re like most of us, your SOC teams are heads-down sifting through alerts, logs, and tasks. They find it challenging to find the time to stay sharp as they’re focused on the evolving threat landscape and supporting (and improving) your organization’s security posture.

That said, practice – even if done every few months ­– will make your team better and faster in responding to attacks. Make the time for it. Build and test your processes and playbooks, and then allocate time for tactical training sessionsbased on real-world attacks. Consider partnering with an outside organization to help hone skills and provide additional insights into potential security gaps. Also, take advantage of onboarding and training programs that support short learning curve objectives.

Automate Processes to Improve Accuracy and Efficiency

The goal of every cybersecurity leader today should be to establish a unified security framework across the entire organization that prioritizes synergetic systems and centralized processes to deliver ML-powered automation. If you’re just starting with automation, looking within your team and identifying repetitive processes that may benefit from automation is a good jumping-off point. Consider log review, bot activity monitoring, and initial alert triage for starters.

Remember that AI and ML are only as good as the data they’re trained on and the people who teach and optimize them. When engaging with vendors offering ML-powered solutions, you must look inside the organization and figure out who’s designing their models. What datasets are they working with? What AI training models do they use? Ensure that the processes and automation used to gather, process, identify, and respond to incidents are trustworthy. 

Outsource to Improve (or Redirect) Your Team’s Focus

The current intensity we see across the threat landscape, both in velocity and sophistication, means we all need to work harder to stay on top of our game. But that can only get you so far. Working smarter means outsourcing certain tasks – like incident response and threat hunting – so your team can refocus on other strategic priorities.

This is why relying on a Managed Detection and Response (MDR) provider, Incident response (IR) or a SOC-as-a-service offering is helpful. Such enhancements are a critical way to eliminate noise, help your team focus on their most important tasks, and advance your business. Outsourcing can either be used as a temporary measure until your analysts are past the learning curve of new technology, or you can use these services as a permanent extension of your security team, adding professional expertise when and where you need it.

Don’t Forget About Employee Cybersecurity Education

There are many ways to support your SOC analysts, from enhancing their skills through training and certification to outsourcing your detection and response activities.

Yet security is everyone’s job, not just the responsibility of you and your analysts. In many cases, your employees are your first line of defense, which is why everyone in the organization must understand basic cybersecurity principles.

When you invest in ongoing training programs to help your workforce enhance their security knowledge, combined with tools like ongoing phishing simulation services, you enable them to be strong partners to your SOC. It’s one more important opportunity – beyond training, automation, and outsourcing – to support the people who are part of your cybersecurity stack.

Learn more about how Fortinet’s team of cybersecurity experts can help you enhance, automate, and outsource critical security functions to keep your organization secure.  


Copyright © 2022 IDG Communications, Inc.

Source link

Continue Reading