Race to 0day in Nation State Operating Systems

Operating System change is coming…

We all know that Windows still dominates the desktop arena with Linux and MacOS trying to catch up and that Android dominates the mobile space with iOS and Windows Phone trying to catch up as well. What many of these OSs have in common is that they are developed by USA companies (hello NSA!).

With the silent (or not that silent :) cyber guerrilla going on in the Internet between the West and the East it is not surprising that many Nation States are developing their own operating systems to cut the dependency on USA software vendors.

The Sony cyber attack by North Korea (supposedly, not proven yet) has caught a lot of media attention -even President Obama has spoken about the need of increasing cybersecurity- and to make things more interesting the operating system used by North Korea government was leaked on Internet and it is currently being analyzed by many security companies and intelligence agencies to find 0day.

Several Nation States have announced the development of their own “secure (cough)” operating system, the ones I know of:

  • Red Star OS: Linux based (Red Hat) with a Windows XP look & feel used by North Korea.
  • China: Several custom OSs.
    • COS: China Operating System based on Linux for mobile devices.
    • Kylin: First version was based on FreeBSD but current version is based on Ubuntu.
  • Russia: Several custom OSs.
    • RoMOS: A customized Android OS for mobile devices (this OS doesn’t send any information to Google).
    • Linux: Russia government announced switching to Linux as the national OS this year.
  • France: Not really their own operating system but the French military switched to Linux Ubuntu (allegedly to save money).
  • India: Also announced their own secure OSs (not much details published).
  • United State of America: Several custom OSs.
    • The Defense Information Systems Agency (DISA) is developing a secure version of Android to be used in mobile devices across the government.
    • Plan X: An OS develop by DARPA to be used by the military for cyber warfare operations in real time.

The fact that Nation States are developing their own customized OS for defensive purposes forces adversaries to obtain copies of these OSs to find 0day if they want to perform offensive actions, so we can expect the 0day market to grow in the incoming years for exploits and rootkits in all of these Nation State OSs.

There is a good chance for Nation States counterintelligence to publish fake OSs and software pretending to be the real thing for adversaries so they waste their resources trying to obtain copies and time analyzing the software or why not putting offensive software inside the OS to attack the systems used to analyze the software and compromise the network.

For sure security companies and intelligence agencies from both sides (West and East) must keep an eye on the technologies used by their adversaries and have ready a bunch of 0days on these OSs as the standard/regular Windows, Android and Linux versions will probably go away.

Nation States not putting enough resources to develop their offensive capabilities will be unable to perform any actions against adversaries that use custom OSs in the future.

Reader: If you know any more Nation States OS, please let me know and if you got copies of any of them send them my way, please!! (Already got Red Star OS, thanks)

What do you think of Nation States developing their own OSs?

— Simon Roses Femerling | @simonroses

Posted in Privacy, Security, Technology | Tagged , , , , | Leave a comment

Cyber Intelligence Universe

In recent years all “cyber” is fashionable, and intelligence applied to the cyber world could not be less! The concept of intelligence has an offensive meaning due to the use by intelligence and military agencies, but now too many security vendors position their products as intelligence solutions able to identify potential threats.

With the use of these security products many private organizations “believe” that they are getting intelligence but their vision is very limited:

  1. The intelligence is obtained by the quantity and quality of their sources (many organizations don’t know nor their sources of information).
  2. The human analysis factor is vital (is not about installing a product and expect a detailed report, like everything is automated.)
  3. The focus is just outside threats (Internet) as internal threats do not exist.

It is funny or sad (depending on how you look at it) when many organizations and security vendors talk about their ability to monitor and analyze systems logs, antivirus, firewall, IDS, Honeypots, etc. to provide intelligence and then they don’t know the number of computers, users or software installed in the organization. Intelligence applied only to the outside is insufficient when internal threats are unknown.

In VULNEX (disclaimer: cybersecurity startup founded by my) we gave it some thought and developed some solutions that help in this regard, for example BinSecSweeper: a tool to analyze Windows, Linux and MacOS binaries. We can take an operating system and analyze all the binaries to determine their security posture (for example scanning all the 7000aprox binaries in Kali Linux in 30 minutes 😉 or determine if software is using obsolete libraries among other things.)

Software today is not written but composed: programmers use different libraries and commercial or open source code to compose their product in the shortest time possible and push it to market. Organizations use all kind of software without knowing whether it is safe or what is composed of, huge mistake!

bss1_cap_int_univ
Fig. 1 – Scanning software with BinSecSweeper, a peak under the hood

Another need we got in VULNEX is to obtain intelligence from source when doing code audits. These audits are complex, long and usually limited in time so it is necessary to obtain valuable information to focus on the work. In this sense we have developed Tintorera, a plugin for GCC that, while we compile a project in C, performs an analysis that helps us understand the code without having read the source itself. At this point we are not looking for vulnerabilities, but we do want to understand the relationship between functions, code metrics, complexity, and other parameters that help us be more effective to scrutinize the code and find vulnerabilities. Intelligence applied to source code! 

tintorera1
Fig. 2 – Tintorera report

tintorera2
Fig. 3 – Tintorera Graph

If you believe that your organization is doing cyber intelligence, think again and really determine your analysis capabilities and what is your vision that surely are not as good as you think…

No doubt much remains to be done in the Cyber intelligence at both internal and external sources to obtain a real and global view of threats.

Does your organization have a cyber intelligence program?

— Simon Roses Femerling @simonroses

Posted in Pentest, Security, Technology, Threat Modeling | Tagged , , , , | Leave a comment

Theoretical attacks on a Sex Robot: Roxxxy

The True Companion company markets for the last few years the first robot to have sex with: Roxxxy. Unfortunately it is not possible to find too much information about the technical features of the robot on the company website, but with the available information a few conclusions can be drawn, so I thought it would be fun to do a post about possible attack vectors.

Disclaimer: everything described here is based on information obtained from the company website and my imagination, no attack has been tested in real (yet) because I do not have this robot, but if any reader wants to send me a pair of robots to make reverse engineering, I will be happy to inform you first of all the 0day I find :)

Roxxxy-Poupee-Robot-Sexuel-True-Companion-01

You can choose different customizable versions: hair color, personality (up to 5 profiles that you can customize even more!), and according to the model it/she can even talk, have some understanding and respond to touch. These features make me think that the robot must have different types of sensors and microprocessors. Also it has USB port, Ethernet and Wi-fi so it also has the ability to communicate (can receive updates via the Internet). The USB must be connected to a Windows computer so that the robot can talk to us.

An interesting concept is that we can give our custom robot personality to other users registered at the company Forum (aka Swingers for robots) temporarily, this means that the robot can replace its personality for a limited time with another one created by other users.

Now with this information, we propose different theoretical/fictitious attack scenarios:

1. The robot could bring from manufacture some malware implant to compromise the user computer via USB.
2. It could include a malicious AP, Wifi Pineapple style, inside the robot to carry out further attacks on the network/systems.
3. An attacker could steal the robot profile (personality) to resell it to the customer (Ransomware).
4. An attacker could modify the internal engines of the robot to do damage to the customer when “having sex” (although I doubt that the robot has sufficiently powerful engines in the current version).
5. Nothing is said of the sight (vision) of the robot, but if does have it, you could use the cameras to spy on the user (Hello, NSA!)
6. Also the robot could be used to record the voice of the customer.
7. And, with all this information, blackmail the customer to not make public their sexual tastes/tendencies.
8. An attacker could send a malicious personality to the forum so victims install it on their robots with different purposes.

31400

We talk much about the risks to critical infrastructure, the Cloud, Big Data and the Internet of Things (IoT), but in the coming years the security and risks of robots will become more relevant when they are more and more present in our personal and professional lives…

What additional attacks can you think of? 😉

— Simon Roses Femerling / @simonroses

Posted in Security, Technology, Uncategorized | Tagged , , | 2 Comments

Heartbleed: pain, blood and code

All alarms went off last week when a serious security flaw called Heartbleed in the OpenSSL cryptographic library was published. This library is used by a large part of the servers on the Internet as well as much security software.

As it could not be otherwise, the conspiracy theories claim this bug was introduced or abused for some time by the NSA. Anyway, this bug proves that Open Source software isn’t safer if nobody looks at it (it has taken two years to identify this bug!) and if secure development practices are not followed.

I do not know if the OpenSSL team follows any secure development framework but the fact that a single programmer can make changes to the code without any kind of validation ¿? is a much more serious mistake than the bug itself.

It is certainly a severe blow to the Open Source community that is often presented as safer since everyone can read the code. This bug makes clear that just being Open Source isn’t enough.

I will not get tired of repeating it: it doesn’t matter if you are Open Source software or commercial software, if your company only develops software for internal use or has an ISV that develops for you, it will never be secure software if not developed following a secure development framework such as MS SDL, BSIMM or OpenSAMM.

We hope that this bug is a wake-up call for anyone who develops software about the importance of security and investing in it.

I can also confirm that this bug works like a charm 😉

What do you think about this bug?

— Simon Roses Femerling

Posted in Pentest, Security, Technology | Tagged , , , | Leave a comment

Spaniards in the Black Hat ASIA

I’m back from Black Hat ASIA 2014 in Singapore, where I had the pleasure of giving a talk on the security of cross-platform mobile technologies for developing mobile apps. The last Black Hat ASIA was in 2008 and the last time in Singapore was in 2003, time flies!

srf_bhasia2014_1

In the event there were several Spaniards such as Jose Miguel Esparza with its workshop on PDF analysis, Leonardo Nve with DNS attacks and finally Alberto García Illera and Javier Vázquez Vidal on hacking cars.

The event took place at the amazing Marina Bay Sands hotel (I recommend you to google it), and it was a success with around 1000 attendees. At the speaker dinner the organization took us to a Chinese restaurant where we could taste different specialties and drink red wine from the la Rioja (Argentina 😉 ; then, as it could not be otherwise, we explored Singapore nightlife!

srf_bhasia2014_2

My talk was the first on the first day of the event and was a great success, a roomful of people even standing (no chairs for everyone) and many questions, somewhat atypical in the Asian culture, so I would like to thank all attendees!!

My first time in Singapore but it certainly won’t be the last, perhaps next year 

My presentation available on VULNEX website.

— Simon Roses Femerling

Posted in Conference, Pentest, Technology | Tagged , , , , , , | Leave a comment

The need to evolve defensive security to offensive security

This morning I saw a job offer from Facebook looking for offensive security engineers and I thought it would be a wonderful opportunity to explore this idea and its application in corporate security.

Traditionally information security in enterprises has a defensive role based on different products (firewall, anti-virus, IDS, etc.). But when week after week we read in the media as businesses of all sizes are attacked and owned, something is wrong here!

Internet and its dangers have evolved but corporate security has not: too many companies follow decades old security schemes to protect their information.

As Nation-States develop not only their defensive capabilities but also their offensive capabilities, businesses should also enhance their offensive capabilities, not to attack other companies but to assess their own security effectively.

It is impossible that security consultants / pentesters with a limited time are able to truly verify the security of a company, which unfortunately is the model that most companies follow. No one presses the doctor when operating or the plumber when fixing a problem, but we press all the time security consultants to obtain compressive results in a short space of time.

It is necessary that corporate security evolves with offensive staff who truly understand the attackers (attacker mindset), who are capable of attacking systems and applications and have some freedom to do this in the company. These individuals are who can raise security to the next level.

Their objective is to constantly attack the company using actual techniques to discover the weak points and strengthen them, analyze malware identified in the company and even set traps to the attackers (honeypots). We should not confuse with Counter-Hacking, the idea that if we are attacked we must respond by attacking. No company should use its offensive capabilities to counter attack as this can unleash all kind of problems (legal and ethical). We must only use offensive capabilities internally to improve security, period.

Companies that do not evolve their security to a defensive and offensive model and enhance not only the technology but also its processes and people (the famous pyramid: people, processes, and technologies) are doomed to be owned for lifetime.

Has your company offensive security capabilities? How are they used?

— Simon Roses Femerling

Posted in Pentest, Security | Tagged , , , | 2 Comments

VULNEX Award and RSA USA speaker experience!

February has been both very interesting and busy! On February 17th I had the pleasure of collecting the first award of VULNEX by Spanish security magazine Red Seguridad for IT Innovation for our collaboration with DARPA (Defense Advanced Research Projects Agency of the Department of Defense, USA) which produced BinSecSweeper, a technology that allows us to verify the security posture of any binary.

You can find a great chronicle of the event here and below I am including a photo of the trophy :)

Trofeo_VULNEX

On 24-28 February I did attend for the first time the legendary RSA USA conference in San Francisco, in which I participated with a talk on security in software development and using BinSecSweeper to assess binaries entitled: “Writing Secure Software is hard, but at least add mitigations!“. I take this opportunity to thank attendees for the good feedback, I’m glad that so many liked my presentation! And of course also thank the organization for a great event.

RSA

The presentation is already available on VULNEX website.

BinSecSweeper_RSAUSA2014_1

BinSecSweeper_RSAUSA2014_2

It was my first time at RSA USA but certainly won’t be the last! In my opinion a must-attend event for all cybersecurity professionals.

Until next year!

— Simon Roses Femerling

Posted in Conference, Privacy, Security, Technology | Tagged , , , , , | Leave a comment

Enterprise Computer Security must CHANGE

Last week I had the pleasure of giving a talk entitled “Cyber Security: time for change” on my vision of corporate cyber security posture during an event organized by Page Personnel Spain (thanks for having me!), and I already advance that a change is much needed to combat the constant threats on the Internet.

The talk began with a description of the different attacker profiles from casual attackers, employees, hacktivists and cybercrime to Nation-State attackers and how security defenses are less effective depending on the attacker.

Every week we can read in the media about companies being compromised. If we look back in recent years companies like Google, Sony, Citi, RSA, Northrup Grumman, and the list continues, have been successfully attacked. These are companies with large resources and possibly a decent level of security (firewalls, IDS, anti-virus, patches policy, etc.) and still have not been able to defend themselves.

Much is being said about APT as sophisticated attackers, but it is not correct: they just know how to use their offensive capabilities more efficiently and only need one security flaw to compromise systems.

There is a security principle which I call “Reverse Continuous Assessment” that I usually speak about to my clients. It means that any computer connected to the Internet is “audited” at least once a week by some actor, what means that every system on the Internet is constantly “audited”; hence companies can no longer use the lame excuse: “we have no enemies; no one wants to attack us”. I always recommend performing periodic security assessment to know the status of our security and where to improve.

It is clear that we need a change to effectively protect ourselves. Today too many companies solely base their security strategy on the purchase of products such as firewall, IDS, antivirus, etc., which are technologies of earlier decades and clearly inadequate. There is a quote from Albert Einstein that shows this need for change: “Insanity: doing the same thing over and over again and expecting different results.”

In my view, organizations must create a true security strategy involving the entire company and changing their mentality. First of all, they must be clear on what information is valuable, what classification it has and where it is located (usually scattered throughout the organization). Only after this exercise they can begin to design their security strategy. How are they going to protect themselves when they do not know what or from who?

The security strategy should target three fronts: technology, processes and people. Just buying security products is not a real security strategy since it only applies to technology, neglecting processes and people who are equally or even more important.

Instead of intelligence I prefer to talk about vision, getting to know our organization and knowing what must be protected and from whom. Some aspects that our security strategy should address are the following:

1) 100% dedicated security team: I understand that it is difficult for many organizations, but security is much more than managing anti-virus and firewalls. It is absolutely necessary to have qualified and dedicated staff to this task. Their training should be defensive in nature and periodic (at least annual), and it is also recommended that they have some basic offensive training to understand where attackers can come from and how to repel them.

2) Training: the entire organization must receive security awareness training tailored to their jobs so they understand and avoid the dangers of the Internet, malicious documents, social networks risks, etc. Today the cost of online training is very affordable so there is no excuse.

3) Active defenses: security defenses tend to be passive, waiting to be attacked, but they should be active. It doesn’t mean to attack the attackers -which may be even illegal because we don’t know if we counterattack the attacker itself or another victim-, but make them lose their time, waste resources or even detect and identify them by using technology such as honeypots. A fantastic project for this concept is Active Defense Harbinger Distribution (ADHD).

4) Evaluate software security posture: companies have many applications installed on their systems and the security is entrusted to the software developer, but IT and/or security staff should be able to assess all these software. Security verification technologies such as VULNEX BinSecSweeper help in this regard.

5) Secure development: I will never get tired of talking about the need of developing secure software, be it a website, a mobile App or other software, since today most attacks are due to insecure applications. Much to improve in this area!

6) Greater use of security Open Source software: organizations have a tendency to buy commercial security products since they have often a better interface; however there are many security fantastic open source solutions (IDS, antivirus, firewall, etc.) that combined with commercial security products can greatly improve corporate security.

No doubt there are many more areas for improvement in the security strategy, but the ones described here are a good start. To achieve this without dying, we must have a capable team (people) and document everything (processes). Do not write hundreds and hundreds of pages that no one is going to read, but simple and well-structured documents describing the security processes and tasks.

Nobody says it is easy, but for sure it is necessary if we want to improve corporate security and protect ourselves from threats on the Internet; meanwhile we will continue watching in the media companies of any kind being compromised…

What is your opinion of the security strategy in organizations: works or not?

— Simon Roses Femerling

Posted in Pentest, Privacy, Security, Technology | Tagged , , , , , | Leave a comment

AppSecUSA & BinSecSweeper Talk

Last week the OWASP AppSecUSA 2013 conference was held in the legendary New York City , where I had the pleasure of giving a talk on security software development title “Verify Your Software for Security Bugs” and present my new project BinSecSweeper, a technology that allows you to verify the security posture of any binary on different platforms.

The development of BinSecSweeper was possible thanks to an R&D grant from the DARPA Cyber Fast Track (CFT) program to improve the security in software development. For more information, I recommend to read the description of the project here.

The conference took place at the Marriot Marquis hotel in Times Square, in the heart of Manhattan, and more than 1500 people interested in security did attend! As always in the OWASP events we could see well-known faces in the world of security with which I had the pleasure of chatting as well as new faces. A greeting to all those people!

As expected, this year many talks focused on mobile security, mainly Android and iPhone. Also there were many talks about Web security and OWASP projects, although I have to admit that some talks were not up to par.

Please find below some screenshots of BinSecSweeper, that will be published soon 😉

bss1
Fig. 1 – BinSecSweeper auditing a Windows binary under Linux

bss2
Fig. 2 – BinSecSweeper auditing a Linux binary under Linux

Thanks to the AppSecUSA team for a great event organization, it has been a pleasure to participate! See you in future editions!

— Simon Roses Femerling

Posted in Conference, Pentest, Security, Technology | Tagged , , , , , , , | Leave a comment

Book Review: iOS Hacker’s Handbook

I have been wanting to read this book for a long time, finally I managed to make time and I have to admit that it has exceeded my expectations. This magnificent work written by reputed experts in iOS, one of the top mobile platforms, on mobile security such as Charlie Miller, Dion Blazakis, Dino DaiZovi, Stefan Esser, Vincenzo Iozzo, Ralf-Philip Weinmann reveals the secrets of Apple mobile operating system.

iOS Hacker’s Handbook (ISBN: 978-1-118-20412-2) is a fascinating and very technical reading that takes us into the inner working and security of iOS to find vulnerabilities and develop exploits.

Its 11 chapters are full of source code (recommended to understand C and ASM) describing the security architecture of iOS such as encryption, sandboxing, different types of memory protections and code signing to find vulnerabilities through reverse engineering and fuzzing and develop exploits using modern techniques such as ROP.

Some of the crown jewels include the study of real vulnerabilities which have been used to win the mythical Pwn2Own contest, understanding and development of our own jailbreaks and debugging and exploitation of iOS kernel.

Taking into account that the rise of exploits sale and the price of iOS 0day for sure is a very serious and lucrative business, you must read this book (check the Forbes article on the subject)!

The work is focused on the iOS platform so no vulnerabilities and exploitation of Apps are covered, anyway for this topic there are plenty of references so we don’t miss it at all.

Without a doubt this book is a compulsory reading for any security expert who wants to delve into the bowels of iOS at the lowest level. I recommend reading the book few times to assimilate the concepts well and downloading the enclosed source code as it contains various interesting tools that we would need to exploit iOS.

I will take the opportunity of this post to mention that the company VULNEX is offering training on mobile hacking that I am sure may interest you :)

Score (1 rose, very bad / 5 roses, very good): 5 Roses (Recommended Reading)

— Simon Roses Femerling

Posted in Books, Pentest, Security, Technology | Tagged , , , , , , , , | Leave a comment