BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

Putting out the Flames

Posted May 30, 2012    Marc Maiffret

Stop me if you’ve heard this one before: there is a new piece of malware and this one is even worse than the last one. It is bigger, scarier, more complex and will take years, according to some estimates, to actually ever know what the malware really does. And of course it already has a plethora of names  depending on which anti-virus company or research group tried to stake their claim of being the first to discover it.  Welcome to this month’s installment of Scary Malware Theater, starring Flame.

While the anti-virus industry does as they always do and spends the vast majority of their time breaking down this piece of malware in a game of “let my firm tell the media some new interesting fact before the competing firm” the rest of you actually working in the real world of IT are stuck wondering when you will be hit by this malware (or the next one) and why this constant cycle of reactive discovery seems to have no end.

Don’t get lost in all of the noise though; the reality is this malware attack is still limited in scope and from all that we know so far, it is very easily preventable with the right solutions and process.  Yes, that’s right, a security company just told you to relax, breathe and respond, not just react. We want to help by providing some context.

Success in security does not come from the constant cycle of malware analysis but rather the relentless analysis of the ways that malware can get onto a system in the first place. That is to say we need to work towards proper IT security practices that reduce attack surface and provide streamlined operational processes for doing something about preventing these attacks.

To that end, for the tireless IT and security folks at large and customers of eEye and BeyondTrust, I want to break down how this malware is currently known to spread and what you can do about it.

The Flame malware is currently leveraging two older Microsoft vulnerabilities that have been patched since August and September of 2010(specifically, that is Microsoft Security Bulletin’s MS10-046 and MS10-061).

In this case you should have a proper vulnerability and patch management process within your organization to verify that you do not have these unpatched vulnerabilities which Flame has been known to use.

Secondarily, the Flame malware has been shown to have capabilities to leverage Windows Domain Administrator credentials to further spread to other systems. While some investigation is being done it is recommended that best practices are followed to ensure your organization is running with “least privilege ” user accounts so as to not more easily allow malware to embed within a system and further propagate.

Specifically for eEye, now BeyondTrust customers and community users there are many ways that the BeyondTrust Retina CS Vulnerability Management platform can help you get visibility and control over this Flame malware. If you don’t already us our free Retina Community security products, now is as good a time as any to go grab it.  Go ahead, we’ll wait right here.

Flame Vulnerability/Malware/Attack Identification

Stay Cool with these Flame Retardant Steps

BeyondTrust’s flagship Retina CS Vulnerability Management solution has the capability to identify both systems infected with the Flame malware and systems with vulnerabilities that Flame malware can leverage for infection. The following are the relevant product related audits/identifiers.

Detection of Flame malware

Retina Network Security Scanner

  • Audit ID: 16484 – Audit Name: Flame/sKyWIper Malware Detected – Modules
  • Audit ID: 16486 – Audit Name: Flame/sKyWIper Malware Detected – ~DEB93D.tmp
  • Audit ID: 16487 – Audit Name: Flame/sKyWIper Malware Detected – Registry
  • Audit ID: 16488 – Audit Name: Flame/sKyWIper Malware Detected – Audio Driver

Blink Endpoint Security

  • Malware Signature Name: W32/Flamer.A

Blink Endpoint Security/Retina Protection Agent

  • Rule ID: 10133 – Attack Rule Name: Print Spooler RCE Attack
  • Rule ID: 110287 – Attack Rule Name: LNK File Attack

Detection of Flame vulnerabilities

Microsoft Bulletin MS10-046

  • Audit ID: 13247 – Audit Name: Microsoft Windows Shortcut Remote Code Execution (2286198)

Microsoft Bulletin MS10-061

  • Audit ID: 13426 – Audit Name: Microsoft Windows Print Spooler Remote Code Execution (2347290) – Remote
  • Audit ID: 13432 – Audit Name: Microsoft Windows Print Spooler Remote Code Execution (2347290)

Remediation of Flame vulnerabilities

  • Retina CS has the ability to do patching of Microsoft and third party application vulnerabilities in a closed loop process that takes you all the way from identifying vulnerabilities, such as those used by Flame, to remediation, through the deployment of a patch.
  • Retina CS specifically has the capability to automate the deployment of the two known Microsoft vulnerabilities that Flame has been leveraging.

The most important thing about the solutions we provide our customers and the community is that we not only provide the most comprehensive means to identify, prevent and remediate even the most sophisticated attacks but we do so in a way that is operationally efficient – true Context Aware Security Intelligence.

To that end I will close off this blog post with a screen shot of a simple “Smart Rule” group that customers and the community can create to have a quick view within less than 1 minute of what the Flame malware means to your organization. I hope this shows how quickly our solutions can give you back the visibility and control of security in your organization to cut through the noise and get down to what the scary “threat of the moment” really means to your organization.

Smart Rules in Retina CS

Tags:
, , , ,

Leave a Reply

Additional articles

6

A Quick Look at MS14-068

Posted November 20, 2014    BeyondTrust Research Team

Microsoft recently released an out of band patch for Kerberos.  Taking a look at the Microsoft security bulletin, it seems like there is some kind of issue with Kerberos signatures related to tickets. Further information is available in the Microsoft SRD Blogpost So it looks like there is an issue with PAC signatures.  But what…

Tags:
, , , ,
Password Game Show

Managing Shared Accounts for Privileged Users: 5 Best Practices for Achieving Control and Accountability

Posted November 20, 2014    Scott Lang

How do organizations ensure accountability of shared privileged accounts to meet compliance and security requirements without impacting administrator productivity? Consider these five best practices…

Tags:
, , , , , ,
Triggering MS14-066

Triggering MS14-066

Posted November 17, 2014    BeyondTrust Research Team

Microsoft addressed CVE-2014-6321 this Patch Tuesday, which has been hyped as the next Heartbleed.  This vulnerability (actually at least 2 vulnerabilities) promises remote code execution in applications that use the SChannel Security Service Provider, such as Microsoft Internet Information Services (IIS). The details have been scarce.  Lets fix that. Looking at the bindiff of schannel.dll, we see a…

Tags:
, , , , ,