Threat Level: green Handler on Duty: Pedro Bueno

SANS ISC InfoSec Handlers Diary Blog


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

Potential 0-day on Bind 9

Published: 2011-11-16
Last Updated: 2011-11-17 12:58:47 UTC
by Jason Lam (Version: 1)
9 comment(s)

Internet System Consortium has published an alert earlier as they are investigating a potential vulnerability on Bind 9. There are reports of the DNS server software crashing while generating log entry - "INSIST(! dns_rdataset_isassociated(sigrdataset))" The details on this is rather limited at this point, aside from DoS effect, it's unknown whether code execution is possible at this point. 

Reference - http://www.isc.org/software/bind/advisories/cve-2011-tbd

Update:

ISC would appreciate network captures of active attacks against this BIND vulnerabiliy. Please submit to us via Contact Form.

Update 2:

Patches are now available:
http://www.isc.org/software/bind
https://www.isc.org/software/bind/advisories/cve-2011-4313

Update 3:

There have been a number of reports of people being affected.  If you are one and you have some packets to share it would be appreciated if you can share them. We'll  anonymise any identifying info.

Thanks

Mark

Update 4:

Several honeypots have been hit with unsolicited recursive DNS queries. Whilst the query itself is normal, it is possible that this is part of a scan looking for servers that may be vulnerable.  If you happen to be monitoring your DNS and you notice a recursive request let us know.  if you can share information that would be great. Ideally a capture, but the source and the domain requested will be enough for now.  

Thanks  

Mark 

Keywords: 0day bind 9 DNS
9 comment(s)

A worm has my network, what now?

Published: 2011-11-16
Last Updated: 2011-11-16 07:42:30 UTC
by Mark Hofman (Version: 1)
1 comment(s)

You may have seen the reports that the New Zealand Ambulance service had to revert to manual processing of calls after a worm affected a number of their systems (http://computerworld.co.nz/news.nsf/news/mystery-virus-disrupts-st-johns-ambulance-service). This got me thinking about what needs to happen in order to deal with this kind of situation, but first lets set the scene. 

Most organisations will have the basic security controls in place.  They will have policies, firewalls, Antivirus on the desktop and maybe on the servers. Scanning software on email and web traffic, possibly even USB control. So how did the worm get in in the first place?  Now this is purely speculation, based on past experiences and in no way relates at all to the NZ ambulance case. We are talking hypothetically here. So What could possibly have happened?

There are a few attack vectors I can think of and no doubt you can add to this.

  • Option 1: A laptop has been off the corporate network for a while, may not have been patched or kept up to date with patches and AV.  It is infected when connected to the internet at an insecure location. When brought back into the corporate environment (e.g. plugged into the network or connected via VPN) the malware did a little jump for joy and started spreading.
  • Option 2: User browses a web page and is the victim of a drive by.  The malware is downloaded and starts spreading. 
  • Option 3: An email is opened and malware is downloaded and executed.


Any of the three above options are possible in most environments.  AV products whilst good, are far from infallible and it is easy enough to create malicious payloads that sail past most antivirus products.  Once the malware is in, it can do its thing and start attacking the rest of the infrastructure.

So if prevention is difficult, you may have to face the reality that what happened to NZ Ambulance can happen to you.  If you can't prevent you must detect. How can you identify the fact that you have an issue?  Worst case scenario, a third party tells you.  At the Storm Centre we often contact ISPs, Corporations and yes sometimes Government agencies to give them some bad news, usually they are a tad surprised. It is much better to find these things your self. It makes explanations to CEOs that much more comfortable.

What should you be looking for?  You may look at firewall logs to see what traffic from inside the network is bouncing off the firewall. Examine proxy logs to look for connections to interesting locations (insert your favourite countries here). Look for multiple connections from multiple devices in your network to a few target locations.  Examine server and AD logs to find log in attempts. You may receive complaints that things are slow, so monitor help desk calls. Systems that stop working may be a clue as well. If you can spend an hour, 30 minutes, even less to look at your logs on a daily basis, then you will be in a better position to identify weirdness.  Once detected you can react. 

You've found the worm, now what? turning the device off will contain it, but it is unlikely to make management happy, especially if you start switching off critical servers.  So you may need to do something else.  Workstations may be a bit easier to contain.  You could move them to a sandbox or walled garden environment.  Place them on this contained vlan and they can do less damage to the rest of the organisation. Ideally this is an automated process, but someone with quick fingers could in a pinch achieve this as well. If you find it is leaving your environment, you might need to change firewall rules or IDS/IPS rules.

For eradication, realistically the only safe option is to rebuild.  Re-image, redeploy the system from known good media. You could attempt a removal process documented by an AV vendor or other organisation, just remember it wasn't picked up in the first place. Since the state of the machine is unknown you are really better off to rebuild, sorry.


Putting all the above in the context of the incident handling process

Preparation
In addition to the policies and base security controls mentioned above, you may want to consider the following:

  • No local admin privileges
  • Segmentation in the network
  • IDS/IPS
  • Log Monitoring and analysis (ACLs, or internal firewalls)
  • Private VLANS
  • Darknet

Identification

  • Look for unusual network activity
  • Examine log files
  • Become familiar with your environment

Containment

  • Move the device to a sandbox VLAN
  • Switch it off
  • Implement firewall rules, ACLs other configuration changes to reduce the ability to do damage.

Eradication

  • Unfortunately rebuild is the safest option.
  • Some vendors may have a removal process
  • Identify how they got in and develop strategies to plug the hole

Recovery

  • Put systems back in a controlled fashion.
  • Monitor activities, watch for their return

Lessons Learned

  • Learn the lessons :-)
  • Fix the issues identified
  • Implement the controls that allow you to ideally prevent, but at least detect it next time.

the above is by no means complete so if you have anything to add, feel free to add a comment or let us know via the contact form.

Mark H - Shearwater

 





 

Keywords:
1 comment(s)
ISC StormCast for Wednesday, November 16th 2011 http://isc.sans.edu/podcastdetail.html?id=2137

GET BACK TO ME ASAP

Published: 2011-11-16
Last Updated: 2011-11-16 01:59:20 UTC
by Adrien de Beaupre (Version: 1)
8 comment(s)

A bit of a twist on the Nigerian 419 scam, where the scammer is claiming that they represent the UN and various governments trying to return scammed money back to the victims. It is making the rounds in various forms. I've said it before, I'll say it again, If it seems to good to be true, it is. Money sent to fraudsters in foreign countries is lost, gone forever. One looks like this:

FROM: PAUL OWENS & Co. Solicitors.

Dear Beneficiary,

We are London based solicitors working as representative solicitors to the United Nations, delegated to Nigeria for the investigation and payment of allscam victims and all unreleased payments. In the course of a recently concluded 2010 investigations and subsequent arrests of suspected fraudsters in African region, in collaboration with the present governments of Nigeria, Ghana, Cote D'Ivoire, Burkina Faso and South Africa, the UN security operatives have so far arrested and prosecuted over 300 government and banking officials and arrest is still going on.

So far, the UN security operative has also recovered about $5.1 Billion from both cash in accounts and properties and assets confiscated. It is from the address books of the arrested officials that your email address was recovered.

Right now, the United Nations (UN) and their Africa Union (AU) counterpart is paying a $3,000,000.00 compensation to those whose emails addresses and other personal data are recovered and also paying full contract or inheritance and wining amounts to those with provable information qualifying them as genuine contractors and beneficiaries of funds in the affected countries.

Which Category do you fall? Have you lost money to scam? or are you still in communication with anyone? Are you a legitimate contractor and fund beneficiary in any of the affected countries? Please respond to this e-mail for your compensation payment to be released to you.

Please, indicate clearly as you get back to me for proper guidelines and details on how to receive this compensation OR your full payment. After search through the internets and various confessions from this impostors, we found these details about you and we would want you to reconfirm I would want you to reconfirm and get back to me and I will give you directives on how you are to get your funds. Your Funds has been approved by the UN, Federal Government of Nigeria and the Federal Ministry of Finance so you are covered.

All I do need from you to reconfirm your informations properly

(1)Your Name In Full :....................
(2)Your Delivery Address:.............
(3)Your Occupation:.......................
(4)Your Contact Telephone Number:.......
(5) Age:..................
(6) Sex:..................
 

--------------------------------------------------------------

So, what do you think? Legit or scam? I am leaning towards scam. Still the odd typo and awkward grammar. Oh, and the Gmail address for the Solicitors is a bit of a giveaway. Last but not least, the phone number also belongs to "INTERNATIONAL MONETARY FUND (IMF, HEAD OFFICE NO: 23 ADEBOYE ST,APAPA LAGOS. TELEPHONE : +234-8024892004". Thanks to CJ for sending this one in. Comments?

Cheers,
Adrien de Beaupré
intru-shun.ca
Teaching SANS Sec560 in Toronto #sanstoronto, 21-26 Nov 2011
sans.org/toronto-2011-cs-2

Keywords: nigerian scam spam
8 comment(s)
Diary Archives