Archiv für die Kategorie: RSS Feeds

By Ben Nahorney It can happen to the best of us. You can have robust security software deployed in your environment, and yet a threat slips through. Often it happens at a weak point that you hadn’t considered critical or just overlooked entirely. It can be a humbling experience and something that many security professionals, while loath to admit, have faced.
What follows is a cautionary tale, but one with a silver lining. It makes the case for threat hunting: A security practice where you look for threats that managed to get past your defenses and have hidden themselves within your environment. It’s a topic that we’re highlighting in our latest report in the Cisco Cybersecurity Series, Hunting for Hidden Threats: Incorporating Threat Hunting Into Your Security Program. Because while no one wants to be caught out by a threat, in today’s threat landscape, it can happen.
Meet John
It started at home one evening. While watching Netflix, John—whose name has been changed to protect the innocent—noticed an unusual amount of screen tearing. He was using a home theater PC (HTPC) that he had built, and it appeared the device was overtaxed by the stream. It had served him well over the years, but he figured the HTPC was just getting old and began to think about replacing it.
What he didn’t consider was that cryptomining was taking place in the background. Unbeknownst to John, a threat had made it into his network without being detected. However, its presence was starting to exhibit side effects.
While such behaviors can be explained by other causes, this is a great place for a threat hunt. A hunt is best begun by testing a suspicion or theory. For example, in looking at systems that exhibit screen tearing—could it be cryptomining? In a larger network, you may have users reporting strange issues like this, which can serve as the basis for a hunt. Computers turning on in the middle of the night—could it be a threat phoning home? Upload speeds spiking for short periods—is it data exfiltration? A periodically unreachable web server—DDoS activity? All of these are good starting points.
Each of these activities could be explained away by other, non-malicious factors. However, threat hunting requires a more balanced approach: It’s best not to think that every oddity is caused by malware, but it’s also important not to dismiss it too quickly.
John’s thinking fell on the side of the latter. His security implementations seemed adequate for a small, home network. He had a router with a firewall that included deep packet inspection (DPI), the HTPC was on a different subnet from devices it had no business talking to, and endpoint protections were in place and up-to-date. Well, in place on all but this HTPC.
This was a critical error. The HTPC was running Linux and John had fallen prey to security through obscurity thinking. It’s a situation where he needed to implement a new security policy within his network to cover Linux PCs.
The goal of threat hunting
This is in line with the overarching goal of threat hunting. It’s not just about uncovering threats, but also implementing policies and playbooks to shore up your security posture. In fact, some of the most successful hunts may not uncover a threat at all. Rather, they identify a weakness in the environment that needs to be addressed.
John wishes that he could say he became suspicious and started a threat hunting investigation for cryptomining. However, since nothing was flagging this as cryptomining, he wasn’t, and he didn’t. This is why having adequate logging enabled is critical. You can’t detect what you can’t see, and without logging or other monitoring tools turned on and reporting on the systems within your environment, it’s difficult to accurately assess your exposure.
The truth is that fortune played a part in identifying the threat. Being a new Cisco employee, John had the opportunity to roll out Cisco Umbrella on his home network. After switching his DNS settings over to the Umbrella servers, and checking the logs after about a day, the presence of a threat was clear. Umbrella detected activity from within his network that was attempting to connect to known cryptomining sites.
Cryptomining events (data taken from Cisco Umbrella)
After the hunt
Since a threat had been identified, this is the point where a hunt began to transition into a cleanup. John quickly grabbed a Linux antivirus scanner, installed it, and ran a scan. The results came back with six separate cryptomining installations, sprinkled around the home folder and the browser’s temp folder. John zeroed out each file’s permissions and the cryptomining events disappeared. Even better, the screen tearing was gone.
After a threat hunt, it’s important to get policies in place to prevent the threat from returning, as well as create a playbook or automation to check in the future. In John’s case, Umbrella took care of the latter. To shore up the HTPC, John formatted the entire system (to be safe), installed a more security-focused Linux distribution, and installed AMP for Endpoints.
When discovering a threat during a hunt, it’s also important to cross-check other systems for signs of similar activity. Gather indicators of compromise (IoCs), such as the hash values of the cryptomining files, and check for their presence on other systems.
One interesting side note: While John was confident he was cryptomining-free at this stage, he took the six cryptomining files and ran them through VirusTotal. Each file came back with slightly different results, but was detected by the generic signatures of 5-6 antivirus engines, further solidifying their malicious classification.
What surprised John was that the next day, when he logged into his AMP dashboard, he discovered that AMP had quarantined six files on his Windows PC. John had pulled the cryptomining files off of the HTPC, zipped them up, and had planned to archive them. However, because he scanned these files through VirusTotal, AMP was automatically updated. The files, having previously been flagged as “unknown,” were now known to be malicious. AMP pulled them out of his archive and quarantined them—an interesting turn of events that highlights the power of an integrated security solution.
Lessons learned
As a result of this experience, John’s security posture has improved. However, he’s not naive enough to think that he’s 100 percent secure. Since the incident, John has checked his environment for published IoCs using tools like Cisco Threat Response, and has enabled further logging to be able to check for unusual activity.
Whether we’ll admit it or not, the fact is John could be either you or me. Things can get through our defenses. And the consequences of having a hidden threat on a large network can reach much further than cryptomining software on a single PC. This is why threat hunting is such an important tool in any security arsenal today.
Want to learn more about threat hunting? Check out our latest paper on the topic, Hunting for Hidden Threats: Incorporating Threat Hunting Into Your Security Program. In it, we go further into threat hunting, explaining in more detail what it is, how it compares to other security disciplines, and how to kick it off within your organization.
Download your copy today!

Source:: Cisco Security Notice

By Talos Group Cisco Talos is releasing two new tools for IDA Pro: GhIDA and Ghidraaas.
GhIDA is an IDA Pro plugin that integrates the Ghidra decompiler in the IDA workflow, giving users the ability to rename and highlight symbols and improved navigation and comments. GhIDA assists the reverse-engineering process by decompiling x86 and x64 PE and ELF binary functions, using either a local installation of Ghidra, or Ghidraaas ( Ghidra as a Service) — a simple docker container that exposes the Ghidra decompiler through REST APIs.
>>

Source:: Cisco Security Notice

By Todd Reid Cisco is pleased to announce a new series of Forensic Investigation Procedures for First Responders guides that will help customers and partners triage Cisco products that are suspected of being tampered with or compromised. These guides provide step-by-step instructions for collecting information that first responders can use for forensic analysis for several different platforms, including devices that run Cisco IOS and IOS XE Software, and devices that run Cisco ASA or Firepower Threat Defense (FTD) Software.
These new documents are available on the Cisco.com Security Portal under Tactical Resources.
The following is a summary of the documents released thus far, along with a brief description of each one.
Cisco ASA Forensic Investigation Procedures for First Responders
This document provides guidance for collecting forensic evidence from the Cisco ASA 5500-X series of devices when compromise or tampering is suspected. It outlines several procedures for collecting platform configuration and run time state, examining system image hashes for inconsistencies, verifying the system and running images for proper signing characteristics, checking the ROM monitor configuration for signs of remote image loading, and procedures for obtaining both a core file and the memory text segment from an ASA platform.
The document also includes a procedure for checking the integrity of the webvpn configuration for ASA deployments implementing SSL VPN.
Cisco FTD Forensic Investigation Procedures for First Responders
This document provides steps for collecting forensic information from Cisco ASA 5500-X devices running Firepower Threat Defense (FTD) Software when compromise or tampering is suspected. This document contains procedures for collecting platform configuration and run time state, examining system image hashes for inconsistencies, verifying proper signing characteristics of FTD system and running images, retrieving and verifying the memory text segment, generating and retrieving both crashinfo and core files, and examining the ROM monitor settings for remote system image loading.
Cisco IOS Software Forensic Investigation Procedures for First Responders
This document provides guidance for collecting evidence from Cisco IOS devices when compromise or tampering is suspected and includes procedures for collecting platform configuration and run time state, examining system image hashes for inconsistencies, examining the ROM monitor region for an upgraded image, and obtaining both a core dump of the running IOS image and the contents of the memory text region.
The document also includes a procedure that provides an alternate method of image analysis if a core dump cannot be performed on a platform that is performing mission-critical traffic forwarding.
Cisco IOS XE Software Forensic Investigation Procedures for First Responders
This document provides guidance for collecting evidence from Cisco IOS XE devices when compromise or tampering is suspected and includes procedures for collecting platform configuration and run time state, examining system image hashes for inconsistencies, verifying the integrity and signing characteristics of system and running images, and exporting the text memory segment to verify the run time integrity of the IOSd process.
Dan Maunz, an Incident Manager in the CX Security Programs group contributed content for this article.

Source:: Cisco Security Notice

By Marc Blackmer We are very pleased to share the news that our Advanced Malware Protection (AMP) for Endpoints won the Approved Business Security Award from AV-Comparatives. And we’re happy about this for a couple of reasons. (Click this link to read the full report.)
Most vendors‘ marketing materials look great, your organization exists in the real world. So, having an independent third-party conduct months of testing against our technology, and us coming out a winner, helps to show the world what our customers already know: that the strength, flexibility, and ease of use of our endpoint security establishes our leadership. We have over a decade of experience in endpoint protection through Immunet (creators of AMP) and Sourcefire (creators of ClamAV).
AV-Comparatives‘ Business Main-Test Series ran from March to June and consisted of two, in-depth tests:
The Malware Protection Test
This test ran in March and consisted of having 1,311 malware samples thrown at us during that time. A passing score required a 90% or higher detection rate and this time zero false positives. We did very well scoring a 99.8% with zero false positives.
The Real-World Protection Test
The idea here was to mimic what happens in, well, the real world. This test ran from March to June and was based upon 732 test cases. The focus here was on user behaviors such as clicking malicious links, opening malicious email attachments, etc.
An efficacy score of 90% or higher and a false positive count of 100 or less were the criteria to pass this test. And, we came in with 98.9% and ranked in the lowest false positive group.
In short, AMP for Endpoints achieved test results that demonstrated a balance of strong protection rates with very low false positives. AV-Comparatives also highlighted Cisco’s broad endpoint platform support and relative ease of deployment.
Beyond antivirus
Secondly, we view this report as further evidence that the security world has moved past the legacy world of antivirus. I’m not saying antivirus doesn’t have a role to play in endpoint security. Our own ClamAV is one of the several mechanisms that AMP for Endpoints uses. What I am saying is that the ‘antivirus as a sole means of endpoint protection‘ ship has sailed – and sailed a long time ago.
The biggest problem with antivirus is that it’s not operationally efficient. That means a lower return on your investment and weaker protection of your business. Back in my IT days in the late 90s and early 2000s, antivirus was a big deal, but it was tough enough to administer when I was at a small, two-office operation let alone when I moved up a 50,000-user, global enterprise. And when the Love Letter worm hit us in 2003, that was a couple days and nights of manual remediation for our entire department, worldwide, because antivirus couldn’t remediate the problem or identify infected hosts.
Now fast forward to today’s world of fileless malware and multi-vector attacks that combine email, web, endpoints, etc. What’s antivirus going to do about those? The answer is pretty obvious.
What was surprising for me to learn recently was that the majority of organizations out there still rely on antivirus for their endpoint protection. I attribute this to deployment fatigue. Rolling out software is hard. I know. I’ve deployed my share of enterprise software. The good news about AMP for Endpoints is that we can be up and running quickly, as noted on page 28 of the AV-Comparatives report:
“Getting started with Cisco Advanced Malware Protection for Endpoints is very straightforward. The console requires no setup, and deploying the client software is quick and easy.”
The Big Picture
We believe it’s important to put our technology to the test and we feel the results speak to how our solution helps our customers protect their organizations. (I’ve included links to other real-world tests below.) We also believe that strong endpoint protection comes from being a part of an integrated security portfolio. One that dynamically shares the latest threat intelligence is the most effective way to defend against modern attacks. And we’ve designed our integrated security portfolio to do exactly that. But that’s another story for another day.
What’s next?
AV-Comparatives‘ testing is continuing through the end of the year and we are looking forward to their year-end report. Tune in here for those results.
Can’t wait for the report? Experience threat hunting with AMP for Endpoints for yourself at one of our Threat Hunting Workshops, or if you can’t wait for the event, sign up for a free trial of AMP for Endpoints at https://cisco.com/go/ampendpoints and see for yourself.
Additional reading
NSS: Achieved “Recommended” ratingMiercom: Achieved “Miercom Performance Verified” certification

Source:: Cisco Security Notice