Wednesday, 19 December 2018

Top-5 Predictions for 2019: Cyber Threats and How to Protect


Written by: Stuart Peck, Director of Cyber Security Strategy, ZeroDayLab 


2018 has been an eventful year, especially with the introduction of GDPR and the California Consumer Privacy Act, a never-ending barrage of high-profile breaches, sophisticated malware and crypto jacking campaigns, and a ramp up in criminal and fraudulent activities. Reviewing the events from the last 12 months, it’s clear that although there has been a significant increase of attacks, the attack vectors remain vastly the same as they have always been: human error, configuration issues, weaknesses in the supply chain and, unsurprisingly, patching problems!

So, without dampening the Christmas Spirit (too much), what does 2019 potentially have in store for us? What can organisations do pre-emptively to reduce the likelihood and impact of a cyber-attack? Here are my top 5 predictions for 2019;


1.     More Third Party Applications / Code Libraries will be targeted.

Organisations focus on protecting their own critical assets with significant investments in resources and technologies, but then either give access (or share critical data) with third parties who are not as mature. In 2018, we've seen some examples where Open-Source or third-party integrations have been abused by attackers, with Magecart’s JavaScript injection being a primary example. With API abuse to steal authentication tokens also on the rise, the impact of this attack can be significant, not only exposing client / customer data, but potentially the entire supply chain, similar to the recent Facebook breach. In 2019, I predict that this will be the vector of choice for a few reasons;

1) Many organisations don't conduct regular security reviews on their supply chain, let alone review the impact of using third-party code libraries and integrations.
2) These attacks are easy to scale and are therefore cost effective for attackers.
3) The yields and likelihood of selling off or sharing the techniques to other groups is also very high, again making this a profitable exercise.

2.       Business Email Compromise attacks will evolve.

In 2018, ZeroDayLab saw a significant increase in not only the intensity of business email compromise campaigns, but the sophistication used by attackers. In the last Quarter of 2018, attackers were using more advanced techniques to compromise supply chain mailboxes to harvest invoices and other information, usually to craft highly convincing phishing emails that either deliver malware aim to defraud their target out of funds. These attacks, although not new, have adapted as awareness of Whaling (CEO Scamming), has matured, but the techniques witnessed in Q4 2018 will proliferate in 2019, and catch unsuspecting organisations off guard.

3.       Crime-as-a-service will be a driving factor behind many attacks.

After high profile Global Ransomware attacks such as NotPetya and Wannacry, it seems in 2018, Ransomware attacks have dropped off the face of the earth, mainly due to awareness, volatility in crypto currencies, and increased attention from law enforcement. However, bucking the downward trend is ransomware-as-a-service offerings such as “GandCrab”, which have both seen an upturn in infections, and maturity of the offering to their criminal consumers, with reported ill-gotten gains in the millions. 

Crime-as-a-service has all but removed the barrier to entry to cyber-crime, with hacking-as-a-service, malware / ransomware-as-a-service and now phishing-as-a-service featuring highly on the Dark Web and Telegram; these platforms provide even the most novice of criminals the ability to target relatively mature organisations with some level of success. This trend is only going to rise in 2019.

4.       Lack of visibility will be punished

There are a few things that the recent Marriot breach has taught us: blind spots can be punishing, attackers are constantly looking for ways to compromise assets that organisations have no visibility of, or even worse, are not in an asset register and therefore have no idea of its existence. The rise of Shadow IT, where solutions and technology are purchased without the knowledge of IT / Information Security, provides attackers a target where in most cases there is no protection or monitoring for unauthorised access. This opportunity allows the attacker to potentially pivot on to a more critical system, or in worst case scenarios, actual access to personal information.

In both cases, these are an easy attack surface with significant oversight. Attackers constantly use tools like Shodan and Censys to discover public facing assets with default / weak passwords, weak encryption, or any of the critical risks found within the OWASP Top Ten; these are quick wins for attackers and deal a devastating blow to organisations with a huge impact to reputation, and usually catch the information security team off guard.

5.       Cloud Security Misconfiguration

Although great strides have been made to improve the security of critical assets in the cloud, organisations still haven’t fully embraced the protection available, or worse, have misconfigured environments allowing attackers to capitalise on this. There have been many incidents in 2018 that highlighted this: open S3 buckets with vast amounts of customer data unencrypted and available to anyone, weak admin credentials with no MFA, private keys posted in GitHub repositories, the list goes on. Human error is a factor that the cloud sadly won’t fix, only expedite, with significant consequences for organisations that don’t embrace the Sec in ‘DevSecOps’! With increased Governance around the protection of the Privacy and Security of PII (Personal Identifiable Information), those fully adopting the benefits of the cloud also need to fully enforce the security controls.

There is some good news, however; there are many things organisations can do to reduce the impact of the aforementioned security risks;

  1. Ensure Asset registers are fully up to date and include any cloud-based applications and systems within these. In addition, ensure they are patched to the latest version, or highlight the risk for those that cannot be, with the relevant justifications and mitigation. This seems simple, but the volume of organisations that don’t have a fully up to date and relevant register is significant.
  2. Conduct regular Ethical Hacking Assessments on your risky assets, especially those that are public facing. Check cloud and internal networks for misconfiguration - the quickest win to prevent abuse from attackers. Also test those integrations; understand how and where you are exposed.
  3. Train Developers and Operational teams (DevOps) on secure coding and deployment principles. Ensure these are documented through a defined set of procedures and policies. Also ensure developers are using secure coding frameworks, and not using risky third party libraries, or untested open-source object.
  4. Conduct regular BIA (Business Impact Assessments), to help define critical assets, and ensure they have the relevant controls in place - essentially find your blind spots and fix them!
  5. Conduct Supplier Evaluation Risk Assessments regularly, understand the security maturity of your critical suppliers, and act to address those that expose you to unnecessary risk.

By conducting the above activities in 2019, you’ll not only reduce the risk to your critical assets, but also have the appropriate intelligence to develop a strategy moving forward.

Monday, 17 September 2018

ZeroDayLab Discovers EE Local Privilege Escalation Vulnerability CVE-2018-14327

EE forms part of BT Group, the largest digital communications company in UK, and boasts of serving more than 31 million connections across its mobile, fixed and wholesale networks. But it was a flaw in EE’s 4G Mini WiFi modem that caught the eye of ZeroDayLab Security Consultants, and that when installed weakened the customers defenses. As a result of the vulnerability cyber criminals would be able to bypass access permissions and gain full administrative/system rights by escalating privileges, once they have gained access to the EE customer’s Laptop or PC. This means the cyber criminal is able to perform any number of malicious actions, such as planting Malware, Rootkits, Log key strokes or stealing personal information.

In this article we take you through the vulnerability found by ZeroDayLab and the action EE customers need to take to apply the patch to fix this vulnerability.

EE customers have been going about their business up and down the country, connecting to the web while on the move oblivious to the potential danger that their latest gadget has been exposing them to. ZeroDayLab’s Chief Technical Officer Paul Brereton said “by installing the EE modem, users have been unwittingly significantly weakening the security of their operating environment (Windows), allowing a local attacker, malicious application or targeted malware to gain full unrestricted administrative access to the operating environment and bypassing the protections in place.”

The vulnerability discovered by ZeroDayLab is exploitable with relatively little effort from a potential cyber criminal – the level of sophistication and effort required to execute this attack is minimal, making this a significant vulnerability.

ZeroDayLab took the decision not to disclose this vulnerability without first working with EE to find a suitable patch. This vulnerability was discovered by one of ZeroDayLab’s Security Consultants, Osanda Malith Jayathissa (@OsandaMalith). Here Osanda talks you through the details of the vulnerability and the resulting patch from EE below.

The Vulnerability
The EE 4G WiFi Modem installs a service called Alcatel OSPREY3_MINI Modem Device Helper (The modem is manufactured by Alcatel). It’s here that we found the unquoted service path vulnerability.

C:\>sc qc "Alcatel OSPREY3_MINI Modem Device Helper"
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: Alcatel OSPREY3_MINI Modem Device Helper
        TYPE               : 110  WIN32_OWN_PROCESS (interactive)
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\Web Connecton\EE40\BackgroundService\ServiceManager.exe -start
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Alcatel OSPREY3_MINI Modem Device Helper
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem


You can’t directly write files because of folder permissions, which at first sight would suggest this issue isn’t worthy of being reported. If however you look at the folder permissions of the “EE40” folder and low and behold, these had been set to “Everyone:(OI)(CI)(F)”. The result being that any user can read, write, execute, create, delete or do any number or malicious actions inside that folder and its subfolders. The ACL rules had OI – Object Inherit and CI – Container Inherit which means all the files in this folder and subfolders have full permissions.

C:\Program Files (x86)\Web Connecton>icacls EE40
EE40 Everyone:(OI)(CI)(F)
     NT SERVICE\TrustedInstaller:(I)(F)
     NT SERVICE\TrustedInstaller:(I)(CI)(IO)(F)
     NT AUTHORITY\SYSTEM:(I)(F)
     NT AUTHORITY\SYSTEM:(I)(OI)(CI)(IO)(F)
     BUILTIN\Administrators:(I)(F)
     BUILTIN\Administrators:(I)(OI)(CI)(IO)(F)
     BUILTIN\Users:(I)(RX)
     BUILTIN\Users:(I)(OI)(CI)(IO)(GR,GE)
     CREATOR OWNER:(I)(OI)(CI)(IO)(F)
     APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(I)(RX)
     APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(I)(OI)(CI)(IO)(GR,GE)
     APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(I)(RX)
     APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(I)(OI)(CI)(IO)(GR,GE)

Successfully processed 1 files; Failed processing 0 files

C:\Program Files (x86)\Web Connecton>
C:\Program Files (x86)\Web Connecton>
C:\Program Files (x86)\Web Connecton>icacls EE40\BackgroundService
EE40\BackgroundService Everyone:(OI)(CI)(F)
                       Everyone:(I)(OI)(CI)(F)
                       NT SERVICE\TrustedInstaller:(I)(F)
                       NT SERVICE\TrustedInstaller:(I)(CI)(IO)(F)
                       NT AUTHORITY\SYSTEM:(I)(F)
                       NT AUTHORITY\SYSTEM:(I)(OI)(CI)(IO)(F)
                       BUILTIN\Administrators:(I)(F)
                       BUILTIN\Administrators:(I)(OI)(CI)(IO)(F)
                       BUILTIN\Users:(I)(RX)
                       BUILTIN\Users:(I)(OI)(CI)(IO)(GR,GE)
                       CREATOR OWNER:(I)(OI)(CI)(IO)(F)
                       APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(I)(RX)
                       APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(I)(OI)(CI)(IO)(GR,GE)
                       APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(I)(RX)
                       APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(I)(OI)(CI)(IO)(GR,GE)

Successfully processed 1 files; Failed processing 0 files

Since “ServiceManager.exe” executable is a Windows service, by planting a malicious program with the same name “ServiceManager.exe” would result in executing the binary as “NT AUTHORITY\SYSTEM” giving highest privileges in a Windows operating system. This vulnerability can be used to escalate privileges in a Windows operating system locally. For example, an attacker can plant a reverse shell from a low privileged user account and by restarting the computer, the malicious service will be started as “NT AUTHORITY\SYSTEM” by giving the attacker full system access to the remote PC.

And now for the fix.

Updating to the Patched Version

The vulnerable software version is “EE40_00_02.00_44”



After reporting the vulnerability to EE, they have released a patch to update the modem. Follow these steps to update your modem to the latest patch update.

1.       Go to your router’s default gateway: http://192.168.1.1.       
2.    Click on the “Check for Update” text to update your firmware.

After updating, the patched software version is “EE40_00_02.00_45” and remove the previously installed software from your computer.






Disclosure Timeline

05-07-2018: The ZeroDayLab Consultant (Osanda Malith Jayathissa), reported the issue to EE via twitter
05-07-2018: Reported to Alcatel via email.
12-07-2018: Osanda Malith Jayathissa contacted MITRE.
16-07-2018: CVE assigned CVE-2018-14327.
25-07-2018: EE contacted Osanda Malith Jayathissa via email for more technical details.
26-07-2018: Phone call between Osanda Malith Jayathissa and EE to discuss the vulnerability further.
26-07-2018: EE confirms that patch will go live within one week.
03-08-2018: Osanda Malith Jayathissa contacted EE for an update on the patch and EE stated that they will respond with more information by Friday 10th of August.
10-08-2018: EE said that patch had been delayed and will notify Osanda Malith Jayathissa with an update.
23-08-2018: EE replies with a patch update for Osanda Malith Jayathissa to verify. The ZeroDayLab Consultant confirmed the patch was working successfully.
03-09-2018: EE notified Osanda Malith Jayathissa saying the patch was released.



About ZeroDayLab

ZeroDayLab is a CREST accredited IT Security consultancy whose sole purpose is to help reduce the risk of cyber-attack and data breaches in your business. In doing so, we help to protect your business from loss of revenue, reputational damage, regulatory fines and disruption to operations.

Our success has meant we now work with some of the biggest and most influential global organisations, across almost every industry, including Financial Services, E-business, Retail, Telco, Travel & Leisure, Pharmaceuticals, Defense and Transport.

Many of our clients say that they choose us because of our unique approach to Total Security Management, that enables us to cater for all your Ethical Hacking, Governance, Risk, and Compliance, Education & Training, and Managed Service needs. We do this in a way that is appropriate, proportionate and right for the level of risk in your business. On time, every-time, and always in budget.

We deliver these services together with a dedicated team, made up of the very best industry talent, who consistently deliver the highest level of service to our clients. Our approach will provide you with detailed reporting and the actionable insights you need to prioritise and reduce risk at the fastest possible rate.

Wednesday, 25 July 2018

Cybersecurity: Invest Early to Protect Your Organization Long Term





Organisations should embrace cyber security compliance to ensure they can effectively navigate the threat landscape.



Recently, I met up with an old friend who’s a project manager for a small company in a highly regulated space. She told me of the trouble she's having getting her team to take compliance reporting requirements seriously. Because the company hasn't appointed a dedicated compliance manager, compliance responsibilities have been dropped in her lap. They have introduced a technology that is garnering a lot of attention in their field, so much so that they've been featured in trade magazines as an industry-disrupter. The team features some truly brilliant minds for whom this company represents the fruition of their life's work. What she's struggling with is getting her colleagues to see that the absence of a coherent body of controls, supported by verification and enforcement mechanisms, can lead to an abrupt and ignominious end for their company while also damaging their individual professional reputations.

Her problem is quite common. Organisations of all sizes are constantly looking for ways to be lean, so securing a Governance, Risk and Compliance (GRC) Lead is far down the list of budgetary priorities for many. In fact compliance programs are often regarded as a distraction, or even worse, a roadblock to innovation. Where such a dim view is held of the GRC role, compliance responsibilities are assigned in an ad-hoc manner with the directive from on high being to merely get the team ‘over the line.’  Of course, to an untrained eye, that line is hard to see. Then there's the matter of having the appropriate skill set and professional acumen to develop a strategy for getting across that line.

Rather than focusing merely on getting across an imaginary line, the organisations that are positioning themselves best for success over the long term are those that go above and beyond baseline security requirements. These organisations embrace a firm security posture because they want to establish in the minds of their clients and partners that they can be trusted with their most vital data. Once their information security practices achieve a high level of maturity, they don’t rest on their laurels. Instead they apply the principle of continuous improvement so that their defensive strategy evolves to adjust to the constantly changing threat landscape. By taking such a firm stance on cyber security, these organisations are not only protecting their critical data, they are protecting the organisation’s brand itself. This forward thinking approach to cyber security also enables these organisations to meet newer, and more stringent, regulatory requirements with only a few adjustments to their standard operations.

In young, disruptive firms like my friend's company, a GRC Lead's role is akin to that of an artist's manager, where the artist is freed to focus on the art while the manager addresses business matters. At her company, the GRC Lead must be capable of understanding the company's business model, identifying the various risks that the company faces, and building a control framework that aligns with business objectives while addressing those risks.

In taking this approach to building the company’s control framework, the GRC Lead increases the likelihood that the controls are appropriate to the business. From there the GRC Lead must craft assurance activities, such as evidence gathering and reporting, that can be generated in as efficient a manner as possible. Coherent compliance processes are more likely to be adopted by the people tasked with them, because they’re sensible as opposed to appearing to be onerous and arbitrary bureaucratic exercises. Successful GRC Leads create coherent compliance processes first by understanding control objectives, clearly explaining these objectives to the team, leveraging existing technologies to automate control activities (easing the burden on the staff) and then streamlining the reporting cycle. The streamlined reporting cycle affords decision makers the most up-to-date view into the organisation's cyber security risk exposure. With these reports, the GRC Lead must present to the decision makers concise, clear options for addressing these risks which explain their business impact as well as any actions needed to reduce the risk. Level of effort required to addressing a risk must be included in this explanation, so business leadership can make sound investment decisions that are in-line with their risk appetite. Beyond addressing current risks, the GRC Lead must keep an eye on the road ahead to see what threats may be looming on the horizon. Does this sound like a part time job?

It's not. Increasingly companies are coming to this realisation. The evidence is all around us. Reputations are being gutted by massive data breaches and poorly managed responses to them. Then there’s the introduction of regulations with real teeth, such as GDPR, which can take a huge bite out of a company's revenue. Leading organisations are responding by taking a pro-active approach to cyber security. They’re strengthening their security posture not because they see it as a necessary evil, but because they recognize it as a competitive advantage that will enable them to more effectively fight off the threats that could take down their weaker rivals. Plus, in the long run, it’s far less expensive to make minor adjustments to your operational practices in adhering to a new regulation than to turn your organisation upside down with each roll out of a new regulatory regime. For mature organisations, complying with new regulations may be as simple as conducting a control mapping exercise, for immature organisations compliance can require a major investment in resources as well as an enterprise wide cultural shift. Furthermore, when driven by regulations, rather than by a long-term strategy harmonious with business objectives, investments in cyber security can be wasteful and not truly fit for purpose. So, the key is to envision the strong, resilient posture you want for your organisation and work towards that. With that in mind I'll be delivering a series of webinars on practical steps in building up your organisation’s cyber security program.

However, please feel free to contact me in the meantime so we can discuss firming things up at your organisation.


Tuesday, 17 July 2018

Manual Pen Testing vs. Automated Scanning





One of the more common questions we at ZeroDayLab are asked is what we see as the benefits of a manual penetration testing approach versus automated solutions and vulnerability scanning, and how to best leverage the two to drive meaningful improvement to an organisations security posture. The terms are often used interchangeably and while both are essential parts of a mature information security program, the two are completely different in terms of expected results and benefits.

Vulnerability scanning refers to the use of automated scanners such as Nessus, Nexpose, and a plethora of other tools to scan systems in an attempt to identify known vulnerabilities which may be present on those systems. Additionally, many scanners exist which are tailored specifically for application security and attempt to identify common appsec related vulnerabilities such as SQL Injection, Cross-Site Scripting (XSS), XML External Entity Injection (XXE), and many other vulnerabilities, but are ultimately unable to exploit these same vulnerabilities to provide a real world understanding of what is at stake.

Although vulnerability scanning solutions have come along way in the last few years, they are still overly prone to false positives and can often be misleading, confusing, and time consuming for employees who are unsure how to validate the findings and who may struggle to understand the true risk and business impact associated with identified vulnerabilities on an organisation in order to effectively prioritise remediation steps.

Vulnerability scanning when used as part of a continual process within an information security program can make great strides towards elimination of low hanging fruit and vulnerabilities which are easy to discover and exploit, and can even help a company meet compliance requirements. Many companies run mature vulnerability assessments internally where scans are performed on a monthly, bi-monthly, or quarterly basis, or as part of infrastructure upgrades or migrations, and prior to major releases on a development life cycle. This is a crucial element of any mature security program and is a fast and efficient way to establish and maintain a baseline of security controls.

That being said, automated vulnerability scanning solutions lack the ability to report on discovered vulnerabilities in a meaningful way as the severity of vulnerabilities are often not representative of the true severity, and crucial information such as vulnerability details, reproduction steps, and remediation steps are often extremely difficult to understand or translate in such a way as to provide meaningful assistance in the development of a meaningful plan of action.

Manual penetration testing on the other hand employs a more hands-on approach which more closely emulates real world attack scenarios and is intended to identify logic flaws and vulnerabilities which pose a more significant threat to a company by highlighting the true business impact of discovered vulnerabilities to a company’s business model. Unlike vulnerability assessments which are typically one dimensional, penetration testing typically consists of 5 core phases:

·         Reconnaissance and Information Gathering
·         Discovery and Enumeration
·         Exploitation
·         Post Exploitation
·         Analysis and Reporting

One of the major benefits of manual penetration testing is that it allows for a more in-depth review of network infrastructure and applications and allows a company to more easily understand not only risk, but how to more effectively prioritise and remediate discovered vulnerabilities. Another significant advantage of penetration testing is that during an assessment a penetration tester can often use bits of information that automated scanners are unable to process and understand such as error messages and anomalous behaviour and identify ways in which normally lower risk vulnerabilities can be used in conjunction to create a significantly more dangerous attack chain.

Potentially the most significant benefit of a manual penetration test though, lies in what happens after a vulnerability is discovered. Post exploitation is in many cases where the real value of a penetration test exists and is where a penetration tester can assess what the true risk associated with a compromise is. Can an attacker escalate privileges? Can an attacker use a compromised web application or system to pivot further into the network? Can an attacker leverage a vulnerability or misconfiguration to ex-filtrate sensitive data? Can an attacker deface a website or otherwise cause a denial of service that would prevent end users from utilising the service and cause significant financial loss to a company?

Finally, penetration testing reports are much more granular and specific as compared to the output generated by automated tools and are crucial to driving effective remediation of discovered vulnerabilities and helping management as well as technical staff understand what is at risk, and what steps can be taken to lessen or eliminate that risk entirely.

Penetration testing and vulnerability assessments should work together and in stages to provide the best benefit to a company and help them move up the information security maturity curve. Companies should perform vulnerability assessments early and often to not only establish a baseline of the company’s overall security posture, but to build a road-map of how to strengthen that security posture over time, and is the first step in the development of a mature security program. Penetration testing is most efficient and valuable when an organisation’s security posture is relatively strong and similarly should be performed regularly to cover the gaps missed by vulnerability assessments. They help to identify key areas of concern and steps necessary to further elevate an organisation’s overall security posture and to continually progress up the security maturity curve.