BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

Least Privilege and South Korea

Posted March 26, 2013    BeyondTrust Research Team

No, this isn’t some editorial piece about the interrelationships of varying social strata in South Korean society and Gangnam Style. Despite how interesting that may be, we are instead taking a quick look at the latest “wiper” malware to strike fear in the hearts of CTOs and IT admins alike – DarkSeoul (or Jokra or KillMBR, depending on who you ask). If you haven’t heard of DarkSeoul, here’s what you need to know:

– Trojan that wipes out harddrives
– Targeted banks and media organizations in South Korea
– No Command and Control functionality (fire and forget)
– Wiping set to commence on March 20th
– Cross-platform (Windows, UNIX, and Linux)

Well, that was short… what’s all the ruckus about then? Just as with Batchwiper, running in a Least Privilege environment would have significantly reduced the effectiveness of DarkSeoul, if not completely disabled it. In the case of this malware, the Trojan siphons credentials from mRemote and SecureCRT installations on Windows systems, looking for root credentials to UNIX and Linux boxes. In a Least Privilege environment, and in an environment managed by tools such as PowerBroker Servers for Linux & Unix (PBUL), IT can make smarter, granular decisions about what certain accounts can do. This is especially critical on infrastructural systems, which often run Linux and UNIX, responsible for production roles and other critical functionality in the enterprise environment. PBUL lets you restrict access to certain functions and system calls, which can be leveraged to potentially prevent any user from deleting critical directories, such as home and kernel. Not to mention, running in a Least Privilege environment within Windows, with the use of PowerBroker for Windows, would have hamstrung DarkSeoul even further. Running as a non-administrator within Windows severely limits malware’s capabilities, including deleting system-critical directories.

TL;DR? An ounce of prevention is worth a pound of cure… or in this case, an ounce of prevention prevents all your files from getting deleted and breaking your ATMs.

Tags:
, , , ,

Leave a Reply

Additional articles

How To Implement The Australian Signals Directorate’s Top 4 Strategies

Posted October 20, 2014    Morey Haber

The Australian Signals Directorate (ASD), also known as the Defence Signals Directorate, has developed a list of strategies to mitigate targeted cyber intrusions. The recommended strategies were developed through ASD’s extensive experience in operational cyber security, including responding to serious security intrusions and performing vulnerability assessments and penetration testing for Australian government agencies. These recommendations…

Tags:
, , , ,
asp-mvc

Exploiting MS14-059 because sometimes XSS is fun, sometimes…

Posted October 17, 2014    BeyondTrust Research Team

This October, Microsoft has provided a security update for System.Web.Mvc.dll which addresses a ‘Security Feature Bypass’. The vulnerability itself is in ASP.NET MVC technology and given its wide adoption we thought we would take a closer look. Referring to the bulletin we can glean a few useful pieces of information: “A cross-site scripting (XSS) vulnerability exists…

Tags:
4bestpracticesaudits-blog

Four Best Practices for Passing Privileged Account Audits

Posted October 16, 2014    Chris Burd

Like most IT organizations, your team may periodically face the “dreaded” task of being audited. Your process for delegating privileged access to desktops, servers, and infrastructure devices is a massive target for the auditor’s microscope. An audit’s findings can have significant implications on technology and business strategy, so it’s critical to make sure you’re prepared…

Tags:
, , , ,