On-Demand Webinar | July, 13, 2015
Watch the replay!
This webcast is a high level summary of the Elastic Botnet Report released by Novetta June 11, 2015. The report details exploits of an ElasticSearch vulnerability to create distributed denial-of-service (DDoS) botnet infrastructures using the Elknot and BillGates DDoS malware families, and includes:
* An overview of the vulnerability
* Specifics about the threat actors
* Analysis of the malware functionality
* Remediation steps to help detect and remove infections.
The Trouble with Elasticsearch, Elknot and Her Big Brother, BillGates Malware
Following a publicly reported vulnerability in Elasticsearch’s Groovy scripting engine earlier this year, reports of widespread scanning and exploitation attempts began to circulate. In order to better understand the motivations and resources of attackers actively exploiting this vulnerability, Novetta has designed an open-source honeypot that simulated servers running vulnerable Elasticsearch instances and deployed a network of the honeypots consisting of several geographically distributed instances; Novetta has also created a video tutorial detailing how to set up the honeypot for interested researchers. Our subsequently collected data, presented in the following in-depth report, highlight how potentially multiple actors are exploiting the Elasticsearch…
Hardening Xen against VENOM-style attacks
The recent disclosure of the VENOM[1] bug affecting major open-source hypervisors, such as KVM and Xen, has been circulating in the tech news as of 5/13/15, causing many to reevaluate their risks when using cloud infrastructures. That is a very good thing indeed. Virtualization and the cloud have been erroneously considered by many to be a silver bullet against intrusions and malware in general. The fact is that the cloud is anything but a safe place. There are inherent risks in the cloud but it is important to put those risks in context. Hypervisors, same as any other complex software systems,…
Advanced Methods to Detect Advanced Cyber Attacks: Relay Finder
This post is the seventh of a multi-part series called Advanced Methods to Detect Advanced Cyber Attacks. The series explores advanced investigative analytic searches that analyze network traffic and enable incident responders and security analysts to think and react as fast as the attackers targeting their organization’s network. Today we’ll review a network traffic search technique that takes full advantage of the historic visibility and rapid querying capability of an advanced network traffic analysis system. This analytic is most relevant for large enterprises and law enforcement agencies that routinely search through large and potentially disparate volumes of network traffic during investigations,…
Why the DoD Uses Advanced Network-traffic Analytics to Secure its Network: Series Introduction and Preview
This post is an introduction to a multi-part series that will explain how and why the Department of Defense has moved beyond automated alerting to defend its networks. According to the Ponemon study, “2014: A Year of Mega Breaches” published in January 2015:[clear-line] More than half of the most serious data breaches are not discovered until one year after the incident, and most of these are discovered accidentally. In nearly two-thirds of organizations, IT departments fail to stop the most serious breaches because attackers “evaded existing preventive security controls.” More than half of all senior management are now “extremely concerned”…
70% of a Security Analyst’s Day is a Waste of Time
Last week I posted a blog about how in a past life I had spent 30 days doing excruciating, tedious, data fusion work to piece together an answer to a basic question around how our company had done at a trade show, and how this experience is directly relevant to the life of a security analyst. I was not a marketing analyst, so this was not my day-to-day job, and I was really curious as to how much time someone who does do analysis day-in and day-out, a security analyst, spends wrangling data from multiple systems in a similar multi-database…
Can Marketing Analysis Possibly be Similar to Cyber Security Analysis?
As a marketing professional, it’s my job to understand and communicate to my customers and potential customers. In the highly technical world of cyber security, this can often be difficult, not because I don’t or can’t understand the technology (I am a former engineer and coder), but because almost instantly when a cyber professional hears the word marketing in my title, they often assume I know nothing (or worse, but I won’t go into that here). So, I thought I’d take the opportunity to relate a story from my marketing life that is directly related to the job of a cyber…
Why the DoD Uses Advanced Network-traffic Analytics to Secure its Network
Advanced network-traffic analytics changed the way many of the largest agencies within the Department of Defense handle their cyber security efforts, and we’ve just published a whitepaper describing why and how. The paper provides important information about how an enterprise can significantly reduce damages caused by sophisticated attackers, including: A description of the limitations of today’s security solutions and how advanced network-traffic analytics can help improve enterprise security. Two case studies about how the Department of Defense benefits today from advanced analytics. A high-level review of the technical architecture of an advanced network analytics solution and how it can be used to…
Bird’s Eye View, An Executive Summary Report for Cyber Security Practitioners
Bird’s Eye View is a new executive summary report generated by Novetta’s Threat Research Group to provide a high-level summary of recent noteworthy cyber security events. It is intended to serve as a brief, detailed narrative offering additional context and insight for cyber security practitioners and other interested readers. Bird’s Eye View also offers nuanced analysis and context around often-hyped public threat reporting for Directors and Executives who are too busy to read detailed, technical reporting. Many well-researched and highly technical reports often provide little higher-level context to help explain relevant cyber events, particularly for strategic decision makers or those…
‘Can Security Analytics Replace Humans?’
Why do we think that we can eliminate human creativity, insight and inspiration from the process of defending a network from attacking human creativity, insight and inspiration?
