Tag: Cybersecurity

SpeakUp: A New Malware Threat

On June 21, 2019

SpeakUp is a backdoor Trojan which originally affects Linux distributions and MacOS systems. However, the scope of SpeakUp attack includes any server running ThinkPHP, Hadoop Yarn, Oracle WebLogic and Apache ActiveMQ. It has been named after its command-and-control domain ‘SpeakUpOmaha[dot]com’. SpeakUp exploits remote code execution vulnerabilities to propagate internally within the infected subnet and across new IP ranges. It downloads miners in the infected systems for unauthorized cryptomining.

Mode Of Infection: For introducing the infection vector, SpeakUp takes advantage of the CVE-2018-20062 vulnerability of ThinkPHP. It is a remote command execution vulnerability.

The hackers use GET request to send malicious code to the target server. It acts as a PHP shell that executes commands sent by the module parameter in a query.
Another HTTP request is sent to the target server to serve as Perl backdoor. It is a standard injection which pulls the Intelligent Input Bus (ibus) payload and stores it on a different location.
An additional HTTP request is then sent for launching the backdoor. This request executes the Perl script and deletes the files for eradicating evidence.

Registering A New Victim: On victimizing a server, SpeakUp communicates with its command-and-control domain via POST and GET requests. It uses POST request over HTTP to send the victim ID, current version of installed script and other information to the C&C domain. The domain sends “needrgr” response to the request indicating that it is a new victim & requires registration. The Trojan then forwards complete information of the victim system by running a series of Linux commands.

Functions And Tasks: After registering the victim, the Trojan communicates with its C&C domain at regular intervals known as ‘Knock Interval’ which is 3 seconds. C&C domain commonly uses following commands:

“newtask”: It commands the Trojan to execute a code, download & execute a file, uninstall the program and send updated information.
“notask”: The command indicates that the Trojan should sleep for ‘Knock Interval’ of 3 seconds and then request for a new task.
“newerconfig”: This command indicates the Trojan to update the miner configuration file.

The Trojan defines 3 User-Agents. A User-Agent is a Python library that provides a way to detect devices such as mobile, tablet or a PC. The User-Agents defined by SpeakUp include two MacOS X User-Agents and a hashed string.
Propagation: For further propagation, SpeakUp is loaded with an additional Python script which allows the Trojan to identify, scan and infect other Linux servers within internal & external subnets.

For more information on malware threats and to know how to secure your IT system, call Centex Technologies at (254) 213-4740.

Things To Include In Your Data Response Plan

By centexitguy

On December 27, 2018

In Security

Making efforts to ensure organizational data security is of utmost importance in the wake of rising identity data breaches as well as cyber-attacks. It is extremely important to stay aware and alert of data breach incidents to minimize the effect and loss. Thus, in order to avoid the implications of data loss, one needs to design a data breach response plan.

Data Breach Response Plan acts as a guiding force to be followed when a data breach is discovered. If you already know what to do and how to do it; it would help in saving both time as well as efforts. Also, a well drafted strategy helps you avoid missteps at the time of crisis.

Setting Up A Response Plan

Define Breach: The first step is to define the term ‘breach’ i.e. deciding the type of incident that would initiate a response. For example, a phishing email might not have as much impact on the company as a ransomware attack. So, a business needs to categorize the serious issues and then work on the causes of disruption. There are many aspects that need to be monitored i.e. from compromise of private & confidential information to material loss such as distributed denial of service (DDoS).
Form The Response Team: There are numerous things that need to be done once a data breach is discovered. So, a good data response plan pre-sets the roles that everyone needs to perform. Every individual has a designated and defined task that he has to perform in the need of hour. Following are the teams who should be assigned the roles & responsibilities beforehand:
- IT Security Team
- Legal Team
- Communication Team
- Risk Management Team
- Human Resource Team
However, it is important to make sure that you vest this responsibility in your trusted employees who understand the complexity of the situation. Other factors such as size of the company, type of data breach etc. also govern the size and composition of response team.
Design Course Of Action For Every Scenario: The response plan should lay down a proper procedure of steps that need to be taken when a data breach occurs. Decide the course of action that needs to be followed for escalating the incident through the organization hierarchy once a data breach is discovered.
Setup A Follow-Up Procedure: Once you have been able to implement the plan to control a data breach, sit with your response team and review. Do a follow up and list down the problems faced by members, lessons learnt, etc.

For more information about IT Security, call Centex Technologies at (254) 213-4740.

Cybersecurity Trends For 2019

By centexitguy

On December 24, 2018

In Security

PDF Version: Cybersecurity-Trends-For-2019

Tips For Educating Employees About Cybersecurity

By centexitguy

On February 14, 2018

In Security

Computers and smart devices have replaced traditional methods of operation at the workplace. Internet has taken over the charge and our world has become a global village. While we have been able to leverage numerous benefits from the technological advancement, complete cybersecurity is still a major question.

Cyberattacks pose a major threat, however not all cyberattacks can be blamed on outsiders. Some of them might just be launched due to the negligence of your employees. Businesses are increasingly becoming vulnerable due to insider threats and the lax attitude of employees. So, in the wake of high ended cyberattacks and with the growing BYOD culture it has become vital to educate employees about cybersecurity.

Here we have listed some tips to educate employees about cybersecurity –

Educate Employees About Social Engineering Activities

Cognize your employees about social engineering attacks. Tell them not to click on suspicious links and emails from unknown sources. If there is something wary about a certain website, blog, link or email and the sender is unknown then it is best to ignore them.

Train Employees At Top Level Of Management

Cybercriminals generally target employees at top level of management who have access to sensitive information and the level of financial damage is greater. So it is important to impart additional training to CEO’S, CFO’S and other employees at that level of hierarchy to safeguard company’s confidential information.

Back To Basics

Provide training about rules for web browsing, email, social networks etc. Through this training they would be able to know the potential ways in which a cyberattack can be made and also take preventive measures to avoid the same. Also, regularly test their cyber security knowledge.

Tell Them What To do In Case They Come Across Something Suspicious

If there is something your employees feel wary of, then they should immediately contact the IT employees who are trained in handling them. Also they should notify the administrator if they come across a suspicious email, link or unusual activity. In case something major happens then unplug machine from the network.

Create A Formal Plan

Have a pre-listed set of instructions about what to do if an employee witnesses a cyberattack. The employees should be well trained to handle this situation and should know what to do if they are hacked. IT team should also draft a formal plan for cybersecurity training, This plan should be reviewed and updated every now and then keeping in mind the latest attacks and risks.

Also, important & confidential passwords as well as information should not be shared with all your employees. Practice the golden rule of giving limited access to only trusted employees. This will ensure that only those people have access to company’s sensitive information who actually need it for performing their operations.

Thus, it is extremely important to train employees about cybersecurity in order to prevent a cyberattack. For more information on IT Security, call Centex Technologies at (254) 213-4740.