Bisonal: 10 years of play

/in /von

By Talos Group Bisonal is a remote access trojan (RAT) that’s part of the Tonto Team arsenal. The peculiarity of the RAT is that it’s been in use for more than 10 years — this is an uncommon and long period for malware. Over the years, it has evolved and adapted mechanisms to avoid detection while keeping the core of its RAT the same. We identified specific functions here for more than six years.
This is an extremely experienced group likely to keep their activities even after exposure, even if we identified mistakes and bad copy/paste, they are doing this job for more than 10 years. We think that exposing this malware, explaining the behavior and the campaigns where Bisonal was used is important to protect the potential future targets. The targets to this point are located in the public and private sectors with a focus on Russia, Japan and South Korea. We recommend the entities located in this area to prepare for this malware and actor and implement detections based on the technical details provided in this article.
More >>
The post Bisonal: 10 years of play appeared first on Cisco Blogs .

Source:: Cisco Security Notice

Security’s Vicious Cycle

/in /von

By Barry Fisher Security Reimagined — Solving an Old Problem with a New Approach
A decade ago this January, Steve Jobs challenged the conventional wisdom about tablets, unveiling the iPad with the words, “What this device has done is extraordinary.” Coming on the heels of iPhone’s smashing success three years earlier, the tablet, however, wasn’t a new idea.
Others had tried and failed, including Apple (remember Newton, Apple’s take on personal digital assistants?). Tablets, in fact, had been discredited as a computing category.
But with the iPad, Apple reimagined the tablet. And it was just getting started. As its ecosystem expanded with more devices, Apple has since redefined our experience as consumers. We expect a consistent, simplified way of interacting with our technology and consuming content, and we expect everything to work together and provide even more value as a group.
Security today is ripe for having its “iPad moment.” We need to challenge conventional wisdom — that every new threat vector requires a new solution. That you have to keep adding new tools and methodologies — and consequently, more people — in order to protect across users, devices, apps, and networks.
It’s time to reimagine security.
At Cisco, we’ve been doing that with SecureX, an open, integrated platform approach that simplifies our customers‘ experience, enables automation, helps them accelerate their business, and protects their future. Like Apple did with iPad, we want to redefine the user experience. And that’s just for starters.
Security platforms, of course, are not a new idea either. While other security vendors have been here before — that is, have tried to solve problems with a platform approach — much like Newton, those platforms have fallen short.
What we’re doing differently is:
Redefining how you experience your security environment.
Improving outcomes by accelerating investigations and remediation.
Addressing the complexity by integrating your security for you.
Here’s how we’re doing that, at a high level.
Redefining the user experience
At its core, SecureX enables all your security solutions to work together harmoniously while uniting both products and users into a consistent experience.
It’s not unlike using Apple’s ecosystem. When you own multiple Apple devices, you can seamlessly move between them as you consume content. And while Apple has its own apps, you can still use others, if you prefer — say, Google Maps or Microsoft Outlook.
Just like Apple’s devices work seamlessly together, an integrated, streamlined platform enables your security solutions to work as a team and share context — while users can move seamlessly from one app or interface to the next. No more swiveling chairs, conflicting alerts, or inconsistent policy management.
And just like Apple devices provide more value as a group, the more natively integrated platform solutions you use in SecureX, the more value you derive. At the same time, you can bring your own “apps” — use the security solutions you already have. We don’t expect to be your only security vendor, and interoperability is our goal.
Accelerating threat investigation and remediation
When your SecOps receives an alert about command-and-control attempts, how long does it take an analyst to investigate? Chances are, it’s more than half a day’s work. Here’s the reality:
A typical SecOps team uses a sprawling number of siloed security solutions — which means multiple consoles, separate controls, conflicting information, and manual processes. That’s why 66% of IT and security professionals surveyed by the Enterprise Strategy Group say threat detection and response is challenging due to multiple independent point tools.
Limited visibility and context are a challenge in this heterogeneous environment. In our scenario, it means the analyst has to reach out to ITOps and email teams to search for the suspicious file. In the meantime, the users‘ personal or corporate assets are staying exposed, putting them at risk.
With SecureX, the analyst’s response and remediation time would be cut by more than 50%. The analyst could immediately isolate the endpoint as a precaution; use the unified security dashboard to see a list of all users, devices, and applications; and quickly determine that the root cause is an executable file making phishing and authentication attempts.
The analyst would additionally see what other users were targeted and block the file across all threat vectors without engaging additional teams. And once the initial endpoint is back to its normal state, it can be reconnected to the network with one click.
Addressing the complexity of your environment
Today, having a collection of best-of-breed point solutions is unavoidable. You’ve invested in these tools through the years. Integration is how you can leverage these investments to improve outcomes — but therein lies the rub. As one CISO told us, “I don’t want to be in the business of integration. I want to be in the business of security.”
Your teams are already overworked. You’re constantly fighting for talent. Doing complicated and resource-intensive integrations is just another burden.
And that is where Cisco comes in. SecureX is built around the idea that not only do your solutions need to work together, but you should be able to take advantage of the investments you have today and will make tomorrow.
If you want to use mobile device management from Palo Alto and a SIEM from Splunk along with Cisco AMP for Endpoints and Umbrella, you can do that and still leverage SecureX. Certainly, the more natively integrated Cisco Security solutions you use, the better your SecureX experience — but you can derive value from SecureX even with one Cisco product. SecureX comes with every Cisco Security product.
Stay ahead of the curve
While it will take some time for us to implement all the bold ideas we have for SecureX, you can stay ahead of the curve by signing up for the SecureX waitlist. We’ll notify you when we reopen our beta program for new users, as well as send you news and updates about our integrated portfolio.
The post Security’s Vicious Cycle appeared first on Cisco Blogs.

Source:: Cisco Security Notice

Are you leaving your most valued assets up for grabs?

/in /von

By Radhika Mitra It’s no secret that companies that are investing in applications are rising competitively and having greater customer reach. However, applications have become the number one target for breaches and attacks. Let’s face it, modern applications are hard to protect, and vulnerabilities seem to be out of sight or too obscure for us to take any action. Securing applications can seem like a daunting task, but it doesn’t have to be.
In order to provide proper protections for applications, it’s important to understand their unique nature. The key characteristics that make up modern applications are:

They run everywhere

They are changing constantly

They have Unique Dependencies
These attributes help us better understand that traditional security approaches are not aligned to the dynamic nature of applications and the environments that support running them. For security engineers, it’s nearly an out of body experience to think about security beyond the infrastructure or network. However, should it really matter what equipment is running in the infrastructure if our goal is to secure our most valuable assets—applications?
The answer is no if you hadn’t already guessed. To address the daunting task of securing applications, we need to start thinking beyond the infrastructure and focus on getting security protections closer to the applications no matter where they run. Along with security being agnostic in nature to the infrastructure, it must also meet the timely demands of developers and operational engineers who are held accountable for driving new technology and innovations while remaining in compliance with regulatory or industry specific mandates. And we need to do this now because applications are the essence of today’s digital businesses.
A fundamental first step, as well as a best practice to implement when securing applications, is taking advantage of micro-segmentation. Micro-segmentation can save your application and workloads from sophisticated attacks by containing the lateral movement of threats through security policies and thereby proactively reducing the attack surface.

At Cisco, we have a rich history as a leader in the cyber security market and a key partner to our customers, help organizations – both big and small all over the world – secure their networks and workloads. Now we are empowering customers to deliver application-focused security at the speed of their digital business.
But where can you start? Which applications running in your environment do you need to start segmenting? How can you actively identify all application connections or dependencies to know where any logical boundaries exist? What tools do you now need to install to enforce all this segmentation? Why did you take the red pill and stay in Wonderland to see how deep this rabbit-hole goes?
Fortunately Cisco Tetration was built to help. Tetration brings security for applications to a new height by understanding your Wonderland universe of applications while automating the generation of policies to help segment applications based on their behavior. Segmenting is not the only attribute of Tetration, it also uses advanced security analytics to give you complete visibility into software vulnerability as well as the security posture of your company over time. Historically having this deep visibility has been a challenge for most companies, gaining insight into your applications can give you foresight to make intelligent IT decisions faster. You can see it for yourself by trying our demo now of Cisco Tetration.

The post Are you leaving your most valued assets up for grabs? appeared first on Cisco Blogs.

Source:: Cisco Security Notice

Threat Roundup for February 21 to February 28

/in /von

By Talos Group
Today, Talos is publishing a glimpse into the most prevalent threats we’ve observed between Feb 21 and Feb 28. As with previous roundups, this post isn’t meant to be an in-depth analysis. Instead, this post will summarize the threats we’ve observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat or vulnerability analysis. For the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.
Read More
Reference:
TRU02282020 – This is a JSON file that includes the IOCs referenced in this post, as well as all hashes associated with the cluster. The list is limited to 25 hashes in this blog post. As always, please remember that all IOCs contained in this document are indicators, and that one single IOC does not indicate maliciousness. See the Read More link above for more details.
The post Threat Roundup for February 21 to February 28 appeared first on Cisco Blogs.

Source:: Cisco Security Notice

‘Never Trust, Always Verify’: Duo joins forces with AMP for Endpoint

/in /von

By Sana Yousuf 29.3 billion – that’s the approximate number of devices and network connections estimated globally by 2023, according to the latest Cisco Annual Internet Report. As we get more connected, we can expect to see a massive rise in cybersecurity threats – a trend that is predicted to double from 9 million in 2018 to 15.4 million by 2023 globally. The increasing consumerization of IT and growing distributed network of users who access business critical applications are posing a real and serious challenge for security teams.
You need a platform that can meet your evolving enterprise needs to securely connect trusted users to the right applications on the network fast. You need a solution that is continuously nourished with contextual insights from your network to make access control decisions. But the real question is: How do you continually verify trust for both users and devices at scale when massive data and device proliferation is part of today’s reality?
Unifying User and Device Protection with Cisco Endpoint Security and Duo
We are beyond excited to announce that the integration between Cisco® Advanced Malware Protection (AMP) for Endpoints with Duo is now available. This powerful tandem unifies secure user access and device protection, empowering your zero-trust security platform for all users, devices and applications. This means endpoints that deemed infected or compromised will be blocked from accessing Duo-protected applications. With AMP for endpoint you get a comprehensive cloud-delivered next-generation antivirus endpoint protection platform (EPP), and advanced endpoint detection and response (EDR). It’s the endpoint security you need to stop breaches and block malware; then rapidly detect, contain, and remediates advanced threats that evade front-line defenses. On the other hand, Duo enables unified access security and multi-factor authentication (MFA) and contextual user access policies that can verify a user’s identity to ensure they are who they say they are and add more checks on the trustworthiness of devices through security health inspections.

“It’s not about getting rid of the perimeter – but rather tightening security on the inside. The new perimeter is less about the edge of the network, and now more about any place you make an access control decision.”
Wendy Nather, Head of Advisory CISOs, Cisco Duo, Summarized from Zero Trust: Going Beyond the Perimeter
Trust is neither Binary nor Permanent
Duo’s Trusted Endpoints feature lets you define and manage trusted endpoints and grant secure access to your organization’s applications with device certificate verification policies. Every time a user logs into an application using Duo, it reaches out to its cloud service that applies the Trusted Endpoints policy setting to the access attempt. The Duo prompt checks for the Duo device certificate in the user’s personal store. If present. Duo reports the endpoint as trusted. If the Duo certificate isn’t present, we report that the endpoint does not have a certificate (and is therefore not a managed endpoint). Application access may be blocked from that device. This helps you distinguish between unmanaged endpoints and managed endpoints that access your browser-based applications and enable you to set create newer policies within AMP. These new endpoints policies that we create would then tracks whether users accessing the applications have the Duo device certificate present or can block access to various applications from systems without the Duo certificate. The platform enables us to create synergy and harness integration touchpoints between technologies to basically see once and block everywhere.

Establishing Device Trust to Secure the Workforce: Visibility that informs Policy
AMP for Endpoint continuously monitoring and can quickly detect a threat, identify it’s point of origin, track its rate of progression, show you where else it’s been, see exactly what it is doing, and if it has infected any other endpoints on the network. When Duo and Cisco AMP for Endpoints have shared visibility into a Windows or macOS endpoint, Duo can block user access to applications protected by Duo from endpoints deemed compromised by AMP.

With zero-trust security from Duo, Cisco protects access to 3,000 applications for 120,000 users and 400,000 devices worldwide. Check out the ‘Duo + Cisco: Workforce Zero Trust‘ to learn more.
A Platform Approach to Security
Cisco’s vision for a security platform is built from a simple idea that we mentioned earlier -security solutions should act as a team, learning from each other, listening and responding as a coordinated unit. Our platform, Cisco SecureX, connects the breadth of Cisco’s integrated security portfolio and your entire security infrastructure for a consistent experience that unifies visibility, enables automation, and strengthens your security across your network, endpoints, cloud, and applications. We’re committed to creating a platform that delivers a better security experience at every point in your network. The seamless integration with other security technologies, backed by Talos threat intelligence, helps you block, detect, investigate, and respond to threats across your entire environment–not just at your endpoints.
Leverage Cisco Threat Response to accelerate threat investigations, Adaptive Multi-Factor Authentication (MFA) to enable zero trust and Cisco’s robust API to integrate with technology partners and get more value from your Cisco Security investment. With the AMP for Endpoint and Duo integration, we can ensure business agility by providing a secure, frictionless access to any application, from anywhere, while significantly reducing the attack surface.
If you are joining us this week at RSAC2020 come check out Endpoint Security and Duo to experience a demo within the Security area. Start securing your applications with a free trial of Duo and AMP for Endpoint today.
The post ‘Never Trust, Always Verify‘: Duo joins forces with AMP for Endpoint appeared first on Cisco Blogs.

Source:: Cisco Security Notice

Threat hunting doesn’t have to be difficult—Taking a proactive position with your cybersecurity

/in /von

By Adam G. Tomeo Your Endpoint Protection Platform (EPP) is up to date with the latest version. Your Endpoint Detection and Response (EDR) technology has all of the latest framework rules and automaton in place. Vulnerabilities and patches for hardware and software are all covered. Your Defense in Depth strategy appears to be keeping your organization secure. But, and there is always a “but”, some adversarial techniques are difficult to DETECT even on a good day. Exfiltration can be quite difficult to detect even if you are looking for it.
As advanced threats continue to proliferate throughout an organizations‘ IT resources, threat hunting as a practice has appeared. For an elite security organization, threat hunting takes a more proactive stance to threat detection. Threat hunting was a natural, security progression saved for the most mature environments where skilled personnel leverage knowledge and tools to formulate and investigate hypotheses relating to their organization’s security across the landscape. Now with technology advancements and automation, threat hunting has now become within reach for every organization.
Threat hunting is an analyst-centric process that enables organizations to uncover hidden, advanced threats, missed by automated preventative and detective controls.
Security professionals are beginning to discover threat hunting practices to advance their detection and response monitoring. Threat hunting requires a highly skilled person as well as wide-ranging data forensics and live response across the IT environment. There are only a handful of companies in verticals such as financial services, high-tech manufacturing, and defense that can claim to have advanced threat hunting teams that deliver results.
Today’s threat actors are well-organized, highly intelligent, motivated and focused on their targets. These adversaries could be lurking on your network or threating to break into it, using increasingly sophisticated methods to reach their goal. In addition, the attacks can come from many different threat surfaces to exploit the many vulnerabilities that may be present across an organizations‘ network and people. Worst of all, organizations do not know by whom, when, where or how a well-planned attack will occur. Today’s rule-based defenses and solutions have limitations, even advanced detection mechanisms struggle to anticipate how attack vectors will evolve. To mitigate threats more proactively, organizations must move quicker than the speed of the threat. The easiest way to put it, when the existing rules are undermined, it is time to start threat hunting.
Pyramid of PainThreat Hunting also allows security teams to address the top most tiers of the Pyramid of Pain, making more difficult for adversaries to impact environments. At the “Tools” level, analysts are taking away one or more specific tools that an adversary would use in an attack. At the apex of the pyramid are the TTPs (Tactics,Techniques and Procedures), when analysts detect and respond at this level, they are operating directly on the adversary’s behaviors, not against their tools, forcing them to learn new behaviors.
There are three types of hunts.
Intelligence-Driven (Atomic Indicators) – These are low-hanging fruit hunts. They are generally known threats that bypass traditional security controls
TTP-Driven (Behavioral and Compound Indicators) – These are hunts looking for techniques used by advanced attackers, where analysts take a methodological approach for discovering unknowns. Generally attempting to interrupt the adversaries TTPs (Techniques, Tactics, and Procedures)
Anomaly-Driven (Generic Behaviors) – These hunts are based on low-prevalence artifacts and outlier behaviors. These are unknown threat leads.
Benefits of Starting a Threat Hunting Practice
There are many benefits from starting a threat hunting practice. Obviously, discovering and thwarting an attack before it causes significant damage. However, what about a threat hunt that doesn’t find anything? Is that really a bad thing? Having stronger knowledge of vulnerabilities and risks on the network will allow a hardening of your security environment which in turn should equate to fewer breaches and breach attempts. Moreover, the insights gathered from threat hunts will aid in reducing the attack surface. Another key result from beginning a threat hunting practice is that security teams will realize increased speed and accuracy of threat responses. Ultimately, organizations should witness measurable improvements for key security indicators such as mean time to detect and mean time to respond.
In-House or Outsourced?
Through outsourcing, threat hunting can be accessible for organizations of all sizes, but especially for small and medium sized organization as they often do not have a Security Operations Center (SOC) as it often is too expensive to build and support. Many Mid-Market sized companies have a SOC and are considering the addition of threat hunting to their current environment. Enterprise and large organizations perhaps are looking for assurance by augmenting existing threat hunting efforts. And in many cases, these enterprise organizations simply want to empower and educate their staff.
***Just in time for RSAC, Cisco is pleased to announce that it will be adding Threat Hunting as a feature to our Cisco AMP for Endpoints offering. Our new threat hunting by Cisco Talos uniquely identifies advanced threats, alerting our customers before they can cause any further damage by:
Uncovering hidden threats faster across the attack surface using MITRE ATT&CK and other industry best practices
Performing human-driven hunts based on playbooks producing high fidelity alerts
Continually developing systematic playbooks, executing on broad, low-level telemetry on product backend
Our new threat hunting capability:
Is provided by Cisco Talos, the largest non-governmental threat intelligence organization on the planet
Is not limited to just one control point (i.e.: endpoint), instead, we hunt across multiple environments
Uniquely combines our new Orbital Advanced Search technology with expertise from elite threat hunters to proactively find more sophisticated threats
If you are at RSAC be sure to stop by our booth #6045 in the North Hall. If you aren’t at RSAC, sign up for a Cisco Threat Hunting Workshop to learn more about Threat Hunting.

The post Threat hunting doesn’t have to be difficult—Taking a proactive position with your cybersecurity appeared first on Cisco Blogs.

Source:: Cisco Security Notice

A Platform Approach + Precise Analytics = Better Equation

/in /von

By Ben Munroe There are so many companies each year at the RSA Conference, it would be useful to have some analytics to help guide your time there; which of the 700 plus vendors should you try and spend time with to solve your current problems? Similarly, customers are trying to keep up with the growing list of tools from all these companies that they can use to protect their environments.
With today’s constant deluge of attacks and complex enterprise infrastructure, a successful security program requires the right mix of ingredients. The CISOs I talk to are more likely to ask, “How many more ingredients do I have to add to the mix? I am already struggling to manage and respond to the alerts I am receiving from my current technologies. Where does it end?”

In my last blog post, I discussed the criticality of security analytics for dealing with this challenge. Without analytics, our security professionals would be even more overwhelmed than they already are, trying to make sense of non-stop alerts from various technologies. Through the use of analytics, intelligence, and automation, Cisco is helping security teams take back control of their environments and their schedules through more proactive defenses.
According to our newly released 2020 CISO Benchmark Report, a majority (77%) of respondents are planning to increase automation to simplify and speed up response in their security ecosystems over the next year. We can’t fix the current state of security overnight, but it’s a goal that Cisco is continually striving for as we expand and evolve our portfolio.
Introducing Cisco SecureX – The broadest, most integrated security platform
This week at the RSA Conference, we are announcing our new security platform, called Cisco SecureX. As the broadest, most integrated platform on the market, SecureX brings Cisco and other security products and capabilities together to work as a team. It connects the breadth of Cisco’s integrated security portfolio and customers‘ entire security infrastructure for a consistent experience that unifies visibility, enables automation, and strengthens protection.

Cisco SecureX makes it easy to establish coverage across every threat vector and access point, and evolve security to meet the needs of tomorrow. It leverages all parts of your infrastructure to enable better decision making based on comprehensive threat detection and meaningful security analytics.
You’ve probably heard others talk about security platforms before. Here’s the thing: their platforms don’t cover all the threat vectors. They don’t work with an ecosystem of third-party technologies. And they don’t integrate with core business technologies like the network.
Cisco SecureX does all of this to bring enhanced integration, visibility, and automation to security teams. This results in more streamlined, efficient, and collaborative protection across your entire infrastructure. And analytics play a key role in connecting these dots and extracting maximum value from an integrated security platform.
Precise Analytics Across the Platform
My previous blog post focused on the valuable security analytics delivered by our Network Traffic Analysis technology, Cisco Stealthwatch. While crucial, it’s important to note that Stealthwatch is just one component of our analytics capabilities, which span our entire platform and portfolio – from the network and cloud to endpoints and applications. There are now seemingly infinite avenues for attackers to infiltrate our environments, so each one must be equipped with strong security fortified by analytics and intelligence.
On the network…
Cisco Stealthwatch leverages behavioral modeling and machine learning to process billions of network transactions, detect anomalies, and reduce them to critical alerts for enhanced threat detection – even in encrypted traffic. Meanwhile, Cisco Web Security uses URL filtering, reputation analysis, and other techniques to automatically detect and block web-based threats.
In the cloud…
Cisco Umbrella uses statistical models to automatically score and classify data processed by our global network to detect anomalies, identify attacker infrastructure, and uncover known and emergent threats. This helps users remain safe while on the Internet – anytime, and from anywhere. Additionally, Stealthwatch threat detection can also be extended into the public cloud via Stealthwatch Cloud.

On the endpoints…
Our AMP for Endpoints product is trained by algorithms to “learn” to identify malicious files and activity based on the attributes of known malware. Machine learning capabilities in AMP for Endpoints can help detect never-before-seen malware at the point of entry. Additionally, Cisco Endpoint Security Analytics Built on Splunk uses behavioral analysis to obtain insight and shorten investigation time for potential threats on the endpoints, whether they are on or off the network.
Within applications…
Duo Security develops a baseline of normal access within an organization, and then analyzes each new access attempt to highlight anomalous behavior. This way, unauthorized users can be prevented from accessing sensitive applications and data. Additionally, Cisco Tetration uses security analytics to understand application behaviors for faster threat detection and consistent microsegmentation.
For More Information
Security analytics can help detect unknown threats and policy violations, and also reduce alert fatigue within security teams. The best part is, through our platform approach, these multiple analytics engines will not work in silos. Our products are being strategically integrated to exchange information, share context, increase automation, and more comprehensively protect your environment.
For more information on our Cisco SecureX platform, go to: cisco.com/go/securex. To learn more about our security analytics capabilities, go to cisco.com/go/security-analytics.
The post A Platform Approach + Precise Analytics = Better Equation appeared first on Cisco Blogs.

Source:: Cisco Security Notice

New Research Paper: Prevalence and Impact of Low-Entropy Packing Schemes in the Malware Ecosystem

/in /von

By Talos Group Detection of malware is a constant battle between the technologies designed to detect and prevent malware and the authors creating them. One common technique adversaries leverage is packing binaries. Packing an executable is similar to applying compression or encryption and can inhibit the ability of some technologies to detect the packed malware. High entropy is traditionally a tell-tale sign of the presence of a packer, but many malware analysts may have probably encountered low-entropy packers more than once. Numerous popular tools (e.g., PEiD, Manalyze, Detect It Easy), malware-related courses, and even reference books on the topic, affirm that packed malware often shows a high entropy. As a consequence, many researchers use this heuristic in their analysis routines. It is also well known that the tools typically used to detect packers are based on signature matching and may sometimes combine other heuristics, but again, the results are not completely faithful, as many of the signatures that circulate are prone to false positives
Read More >>
The post New Research Paper: Prevalence and Impact of Low-Entropy Packing Schemes in the Malware Ecosystem appeared first on Cisco Blogs.

Source:: Cisco Security Notice