Hitachi Incident Response Team2015.10.05 10:45:42 +09'00'
HIRT: Annual Report 2014

HIRT: Annual Report 2014
Hitachi Incident Response Team (HIRT)
http://www.hitachi.com/hirt/
OMORI BELLPORT Tower B, 6-26-2 Minamioi, Shinagawa, Tokyo, Japan 140-8573

Introduction

Looking back, 2014 was a year of reconsideration ofvulnerability handling.
Heartbleed, Shellshock and POODLE. These are aliases
assigned to vulnerability. In 2014, vulnerabilities werereported that had wide-spread effectsaffected and attracted
attention (Table 1).
CVE-2014-10001. This is a CVE-ID number using the
new syntax. On January 1, 2014, the numbering format thatuses a CVE (Common Vulnerability and Exposures) toassign unique IDs to security flaws that exist insideprograms themselves was changed so as to remove the limiton the number of arbitrary digits. (Table 2).
7,937. This is the number of CVE-IDs that have beenregistered in the NVD. The numbers of vulnerabilities
registered in the representative vulnerability databases areon an increasing trend (Figure 1), despite the discrepancies
among them due to the different identificationss used forcounting vulnerabilities.
Table 1: Representative vulnerabilities reported in 2014.
Time
January 2014
April 2014

September 2014

October 2014
November 2014

OutlineUDP-Based Amplification attacks (reflection attacks)
Heartbleed
Vulnerability of OpenSSL Heartbeat extension(CVE-2014-0160)
Remote command execution vulnerabilities in
Apache Struts ClassLoader (CVE-2014-0094,
CVE-2014-0112, CVE-2014-0113, CVE-2014-0114,
CVE-2014-0116)
Vulnerability of Microsoft Internet Explorer(CVE-2014-1776)
Shellshock
GNU bash vulnerabilities (CVE-2014-6271,
CVE-2014-7169, CVE-2014-6277, CVE-2014-6278)
POODLESSL 3.0 vulnerability (CVE-2014-3566)
Microsoft Schannel vulnerability (CVE-2014-6321)

In 2014, it emerged that social infrastructure, which has
been constructed utilizing the internet on a base of
information systems, industrial control systems and so forth,
are is faced with the issue of vulnerability as a threat that
could lead to incidents. This suggests it is necessary toprogressively confront, through daily cyber countermeasureactivities, issues of vulnerability that could constitute new
threats. This awareness is spreading, and may be said tohave started making incident-response activities include not
only after-the-fact action for after an incident has occurred,
but also advance readiness – that is, countermeasures forvulnerabilities to eliminate their potential for leading toincidents.
The specific role of HIRT (Hitachi Incident ResponseTeam) as a CSIRT (Computer/Cyber Security Incident
Response/Readiness Team) remains, as before, to lead thecyber security measure activities of the Hitachi Group,
through vulnerability countermeasures - activities toeliminate vulnerabilities that could pose a threat for cybersecurity, and incident responses - activities to avert andresolve cyber attacks when they occur. Further, we consider
that the requirements for CSIRTs in carrying out
vulnerability countermeasures and incident responses are topossess the capabilities for "predicting and altering from atechnical point of view", "making technical collaboration"and "collaborating with external communities on thetechnical aspects".
18,000

Number of vulnerabilities

NVD
Secunia
OSVDB
SecurityFocus

16,00014,00012,00010,000
8,000
6,000
4,000

2,000

Table 2: New syntax for CVE identifiers.

2013

2011

2009

NNNN.....N was arbitrary digits.
Leading 0's will only be used in
IDs 1 to 999.
CVE-2014-0123
CVE-2014-54321
CVE-2014-456132
CVE-2014-7654321

2007

NNNN was fixed at 4 digits.
Annual upper limit was 9,999
cases.
CVE-1999-0067
CVE-2005-4873
CVE-2012-0158

2005

CVE-YYYY-NNNN.....N2003

CVE-YYYY-NNNN

2001

New syntax

1999

1995

0

Old syntax

1997

1

Figure 1: Numbers of vulnerabilities registered invulnerability databases.

Copyright © Hitachi Incident Response Team(HIRT). 2014. All rights reserved.

HIRT: Annual Report 2014

Number of cases

We are not envisioning special requirements here. It is amatter of making use of experience in incident operations(the series of security measure activities implemented inorder to predict and prevent damage from incidents and tolessen the expansion of damage after incidents occur) so as
to "catch any signs of future threats and take actions as
early as possible". As an organization that possesses theseroles, HIRT leads the way in vulnerability countermeasuresfor products and services and in incident responses formalware infection damage and information leakage, besides
shouldering duties as the Hitachi Group's integrated CSIRT
liaison organization.

Overview of activities in 2014

Number of Website injections

1,000

Overview of Threats and Vulnerabilities(1) Overview of Threats
The known threats like targeted attack and website
compromised actions have continued to cause damage. The
feature of 2014 in terms of incidents was that damage bymalicious programs that target online banking became
serious. Meanwhile, as regards attack methods, ransomware,
which holds the files in a PC to ransom, raised its head, andthe following methods became steady occurrences:password list attacks in which account information isarchived and used for attempting unauthorized access atvarious sites to steal personal information, etc., andamplification attacks (also known as reflection attacks) thatuse amplification of request/response messages.


800
600
400

Number of website injctions(on IP address based)

Website injections in Japan
ongoing since March 2013
Gumblar200
0
2009/01 2010/01 2011/01 2012/01 2013/01 2014/01

In particular, sites have been compromised because thevulnerabilities of their old-version content management
systems (such as Wordpress, Movable Type, Joomla!,
Drupal), or of plug-ins for them, were exploited.

Damage by malicious programs that target online
banking

Ransomware"Ransomware" is a generic term for malicious programs
that hold the files in a PC to ransom. According to a reportby Symantec, there were 8.8 million cases in 2014 (2.1
times the number in 2013), among which, ransomware thatencrypts the files in a PC and demands money in return fordecrypting them rose sharply to 0.373 million (45 times thelevel in 2013)[2]. Though the impacted files are easier to
identify than with information exploitation, ransomware has
the potential to directly impact business continuity if it
encrypts important files. Cyber attack countermeasuresneed to turn their attention to information destruction as
well as information exfiltration.

Steady occurrence of website invasive actions

Incidents of website alteration in Japan with the intentionof infecting the sites with redirecting malware have been
continuing since March 2013. Looking at the number ofreported cases, one sees that these alterations are continuing
to occur in larger quantities than the Gumblar incidents thattook place in 2009 (Figure 3).

Copyright © HIRT. 2014. All rights reserved.

2014/01

Figure 3: Number of reported cases of website injections.
(Source: JPCERT/CC).

According to a National Police Agency Report, there werea total of 1,876 cases of fraudulent money transfer damage
in Japan in 2014 (1.4 times more than in 2013), amounting
to some 2.910 billion yen in total damage (double the 2013
level) (Figure 2)[1]. Characteristics of these cases were theexpansion of damage related to accounts in the name ofcorporations, and the increased deviousness andsophistication of tricks that use malicious programs to
executefraudulent
moneytransfer
processing
automatically.


2013/01

1,200This section focuses on the threats and vulnerabilities, andHIRT's activities, in 2014.

2.1

2012/01

Figure 2: Monthly cases of fraudulent money transfer
damage. (Source: National Police Agency)

This report will introduce a summary of the threats andvulnerabilities, and the activities of HIRT, in 2014.

2

300
250
200
150
100
50
0
2011/01



Password List Attacks (List-Based Attacks)

Figure 4 shows the number of password list attacks
reported in Japan, aggregated from publicly-available
information. From April 2013, these cases, in which
account information (ID and password lists) obtained bysome means or other is archived and unauthorized log-ins
are attempted using such account information list archives,
are occurring on a continuous basis.

2

HIRT: Annual Report 2014

Number of cases(2) Overview of Vulnerabilities
8

6

The total number of vulnerabilities entered in the NIST
NVD (National Vulnerability Database) was 7,937 in 2014[4]. About 20% (1,768) of the vulnerabilities were in web
software application products (Figure 7). Breaking thesedown, cross-site scripting (XSS) and SQL injection accountfor about 80%, which is a continuing trend (Figure 8).
Likewise, some 60% of the vulnerabilities in operational
websites that were reported to the IPA are accounted for bycross-site scripting (XSS) and SQL injection, and this too isa continuing trend, with close to 600 a year of thesevulnerabilities being reported (Figure 9) [5].

4202013/01

2013/07

2014/01

2014/07

Figure 4: Number of reports concerning password list
attacks.

400 (Gbps)

Overall Trend

350
300
10,000

200
150
100
50
0

2011

2012

2013

2014

Figure 5: Trend in DrDoS attack peak traffic.
(Source: Arbor Networks) [3]

28 - 54
556.9
6.3
3.8
30.8
358.8

Request(IP spoofing)

2,000
0

2,500
2,000
1,500

Cross-Site Request Forgery (CSRF)
Path Traversal
SQL Injection
Cross-Site Scripting (XSS)

1,000
500
0

Attacker

Figure 8: Changes in the number of vulnerabilities reported
for software products of web application(Source: NIST NVD).

Figure 6: Reflector attack.

Reflection Attacks
Number of Vulnerabilities



4,000

1998
1999
2000
2001
2002
2003
2004
2005
2006
2007
2008
2009
2010
2011
2012
2013
2014

DNS
NTP
SNMPv2NetBIOSSSDP
CharGEN

TargetedserverNumber of Vulnerabilities

Response

Amplification
Factor

6,000

Figure 7: Number of Vulnerabilities Reported(Source: NIST NVD).

DNS/NTP Server
UPnP Device

ProtocolWeb Application
Other

DDoS attack peak traffic is on an increasing trend (Figure5), and the threat from DDoS attacks is ongoing.
Manifesting in 2013, DrDoS (Distributed Reflective Denialof Service) is an attack method whereby a packet istransmitted, from a spoofing IP address, to a service thatoffers a high request/response message amplification factor(a high value for response size / request size) and will serve
as a springboard. In early 2014, DrDoS attacks that use the
SSDP (Simple Service Delivery Protocol) of equipment that
supports UPnP (Universal Plug and Play) began to bereported, in addition to those on DNS servers (openresolvers) and NTP servers (Figure 6).

1,600
1,400
1,200
1,000
800
600
400
200
0

Cross-Site Request Forgery (CSRF)
Path Traversal
SQL Injection
Cross-Site Scripting (XSS)

1998
1999
2000
2001
2002
2003
2004
2005
2006
2007
2008
2009
2010
2011
2012
2013
2014

2010

8,000

1998
1999
2000
2001
2002
2003
2004
2005
2006
2007
2008
2009
2010
2011
2012
2013
2014

Number of vulnerabilities

250

Figure 9: Changes in the number of vulnerabilities reported
for websites (Source: IPA and JPCERT/CC).
3

Copyright © HIRT. 2014. All rights reserved.

HIRT: Annual Report 2014

Number of reports

25

incorporates the perspectives of individual businessdomains, HIRT-FIS (Financial Industry Information
Systems HIRT) engaged as main actor in internal/externalreadiness activities for the financial domain.

ICS-CERT Advisory
ICS-CERT Alert

20

Phase 3
Establish a virtual, horizontal incident response framework(HIRT Center - IRT - IRT supporting staff) >>> Install and promote theincident operations throughout the whole Hitachi Group15
10All Business Divisions of Hitachi & Groups Companies

5

SI Vender IRT
Business Division orGroupcompany IRT
事業部・グループ会社IRT- Security information- Security review consulting- Technical support for evaluation tools- Education planning and offering

Operation Chief

0
2010

2011

2012

2013

HIRT
Center2014

Figure 10: Change in the number of control systemvulnerabilities reported (Source: ICS-CERT).

実行責任者

Vulnerability
Handling Chief
脆弱性関連情報

Units that need support

ハンドリング責任者
IRT連絡窓口担当者

IRT Liaison Staff

Product Vendor IRT

Phase 2 IRT supporting staff
Strengthen Partnershipwith IRT supporting staff
Phase 1
Improve Collaboration with Business Divisionsand Group Companies' IRT
Internal User IRTIndustrial Control System Products

Category
Phase 1The ICS-CERT (Industrial Control System-CERT) issued
3 alerts and 99 advisories (Figure 10). 16 of the advisories
concerned vulnerabilities due to inadequate verification of
input data (CWE-20), and another 13 concerned
vulnerabilities due to stack buffer overflow (CWE-121). A
further 10 related to vulnerabilities in products that
implement the DNP3 (Distributed Network Protocol) that isused at electric power, water supply and similar facilities(there were 15 such cases in 2013).

2.2

HIRT Activities
Phase 2This subsection describes the HIRT activities in 2014.
(1) Improvement of Hitachi Group CSIRT activities(Phase 3)

Phase 3

In 2010, we started improvements of Hitachi GroupCSIRT activities with the goal of "instilling incident
operations into the whole Hitachi Group" (Figure 11). In
2014, the fifth year of the activities, we opened a HIRTLaboratory Project Room inside the Yokohama ResearchLaboratory's facilities to mark the start year of Phase 3. The
purposes of this Project Room are to be a locus for passing
on technical skills and to serve as a hub for support
activities and for collaboration with the ResearchLaboratory. In 2014, we introduced here equipment withthe purpose of handing on technical skills for analyzing the
malware and so forth used in cyber attacks. Regarding theuse of the Project Room to pass on technical skills, intandem with a HIRT OPEN Meeting (Technical Meeting),
we proceeded with analysis of the operation of the malware
and so forth used in cyber attacks, and investigation todetermine the phenomena from the recorded traces (Table3) [*a].

Figure 11: Scenario on a Virtual, Horizontal
Incident Response System.

[*a] HIRT OPEN Meeting
HIRT OPEN Meeting is an activity is to popularize the HIRT community
on the basis of relationships of trust. The meetings are held in line with
policies of "offering an opportunity for HIRT Center members to share
information about HIRT activities", "offering an open event for people ofthe Hitachi Group to learn about the HIRT Center's activities for the HIRT
Center members to share information with and get opinions from non
HIRT Center members", and "providing an opportunity to call forparticipation in the HIRT community on the basis of relationships of trust".
HIRT OPEN Meeting (Technical Meeting)Technical Meeting is for designers, system engineers and persons willingto share their technical expertise come together to share and learn thetechnical know-how necessary to build security into products and services.

(2) Trial IRT activities for individual domains
Moving ahead with readiness activities at
HIRT-FIS

In order to put into practice the three-tiered cycle forincident response and readiness (Figure 12) that
Copyright © HIRT. 2014. All rights reserved.

Concrete Measures
Improve Collaboration with IRT of Business
Divisions and Group Companies- Promote support activities with the collaboration
between the IRT of Business Divisions and Group
Companies- Establish an IRT coalition framework andmechanism to share technological know-how using
the HIRT OPEN Meetings- Disseminate information about
solutions/countermeasures for the problems
discussed in the security review consultation.
Strengthen Partnership with IRT supporting staffs- Trial collaboration with IRT supporting staffs (ofbusiness divisions and group companies)- Bottom up the IRT activities with the IRT
supporting staffs as a starting point
Establish Virtual, Horizontal Incident Response
System- Promote various support activities by the HIRT
Center, IRTs and IRT collision support members- Develop a HIRT in a broad sense (virtualorganization model) by combining the user
collaboration model (Phase 1 and 2) and entity
collaboration model (Phase 3).

4

HIRT: Annual Report 2014

表 1：HIRT-FIS Security Notes

In the HIRT-FIS internal activities, they proceeded withgathering and analyzing financial-related security
information and issuing HIRT-FIS reports. In the external
activities, they held view-exchange meetings withfinancial-related CSIRTs, and tried out weekly
dissemination of HIRT-FIS Security Notes in order to put
out feelers for collaboration with financial-related CSIRTs(Figure 13). The HIRT-FIS Security Notes are simple
reports that cover subjects such as financial-related security
incidents that have arisen in Japan or overseas, relevant
regulations and so forth.

Item
Number issued
Number of recipients
Number of receivingorganizations

2013
10 Notes
4 persons2 organizations

2014
48 Notes
9 persons
5 organizations

Table 3: HIRT OPEN Meeting (Technical meeting) in
2014.
Month
January

February

March

May
June
AugustSeptember
November

OutlineExplication of Java7 update51 security changes
Hands-on: survey using checklist for incident initial
response[External instructor]
Jack YS Lin (JPCERT Coordination Center (General
Foundation))
A Security Incident in China - "DarKnight"[External instructor]
Masafumi Negishi (Internet Initiative Japan Inc.)The Surveilled Internet
Advanced HIRT OPEN Meeting
Hands-on: Making website security settings
Hands-on: Making website security settings[External instructor]
Nobuaki Hirahara (Trend Micro)"General Coping Flow for Targeted Attacks" and"Proactive Countering and Profiling Using Big
Data" - What Are They?
Advanced HIRT OPEN Meeting
Seminar on Technical Countermeasures for External
Server Vulnerability Surveys

Figure 13: Example of the HIRT-FIS Security Notes thatare disseminated weekly to financial-domain CSIRTs.


We moved ahead with approaching vulnerability
countermeasures from the three perspectives of
specification designs, codes and configurations, and alsowith constructing anticipative cases for codes andconfigurations in tandem with the product development
departments.


Codes: We deliberated the coping action for when aproduct vulnerability is pointed out, taking into
consideration the framework for vulnerability
handling.

Configurations: We began activities for upgrading
security settings ("Hitachi Checklist Program"), using
as reference the NCP (National Checklist Program) [6]promoted by the U.S. federal government.

Industrial
Financial
Customer system Service provisionsystem(1) Incident(1) Incident

Vulnerability countermeasures for industrial
control systems

Internal infrastructure(1) Incident(2) Incident response[responsibility: Cyber
Countermeasures Office](4) Incident readiness(3) System for cyber attack(3) Industry standards for cyber attack
countermeasurescountermeasures[responsibility: Cyber[responsibility: IRT for theCountermeasures Office]industry domain](2) Incident response[responsibility: QA](3) Strengthening of Partnership with the CSIRT
Community
As concrete activities for strengthening our partnershipwith the CSIRT community, we continued with thegatherings with NTT-CERT [7] that we have been holding
periodically since 2006, at which we exchanged
information for improving CSIRT activities. Also, we
participated in the launching of the Nippon CSIRT
Association's SSH Server Secure Configuration Working
Group, and carried out information dissemination incooperation with its Incident Information Utilization
Framework Working Group [16].

(6) Incident readiness(5) Security measures compromised(5) Security measures compromisedby novel attacks
by novel attacks[responsibility: HIRT]

Figure 12: System view of "Three-tiered cycle for Incident
Response and Readiness" approach.

5

Copyright © HIRT. 2014. All rights reserved.

HIRT: Annual Report 2014
Regarding vulnerability of GNU bash – shellshock

Struts: Regarding vulnerabilities that allow operationof ClassLoader (CVE-2014-0094, CVE-2014-0112,
CVE-2014-0113)

Regarding vulnerability that allows OpenSSL
information leakage – Heartbleed

set up to play the role of coordinator inside Hitachi andwith external entities, after the other three IRTs had largely
taken shape.

(4) Other Activity
Participation in MWS (anti Malware engineering
workshop) 2014.
We took part in this workshop with the aim ofsupporting research activities for malware
countermeasures and contributing, through suchsupport, to the formation of the next-generation
CSIRT community.

Contributed an article on vulnerability
countermeasures titled "Vulnerability Information to
Keep in Mind", to the ITpro CSIRT Forum held by
Nikkei Business Publications, Inc. [8].

3

HIRT

To give you an in-depth understanding of HIRT, thissection describes the organizational model adopted, the
HIRT/CC, a coordinating unit, and the activities currently
promoted by the HIRT/CC.

3.1

Figure 14: Four IRTs as an organizational model.

Table 4: Role of each IRT.

Organizational Model
Category
HIRT/CC

We have adopted an organizational model that consists offour IRTs (Figure 14 and Table 4). There are three IRTs forthe case with Hitachi Group itself; Product Vendor IRT; SI
Vendor IRT, and Internal User IRT; each corresponding to
one of the IRT's aspects: the Product Vendor IRT
corresponds to the aspect of developer of products such as
information systems and control systems, the SI Vendor
IRT to that of a system integrator/service provider that uses
those products, and the Internal User IRT to that of aninternet user that operates and manages its own enterprise.
By adding to these a fourth IRT - the HIRT/CC (HIRT
Coordination Center), which carries out coordination work
among the others - a model is obtained which we
considered would be able to implement efficient andeffective security measure activities that achieve
collaboration among the IRTs, while making clear theirindividual functions. The name "HIRT" signifies theincident operation activities promoted by the Hitachi Group
as a whole, in the broad sense, and signifies the HIRT/CC(HIRT Center) in the narrow sense.

SI Vendor
IRT

Product
Vendor
IRTInternal
User IRT

In fact, four phases (set forth in Table 5) had to be gone
through in order to put the four IRTs in place. For eachphase, there was an "impetus" that encouraged
organizational formation. For instance, the impetus for thesecond phase - establishing of the Product Vendor IRT was the fact that the vulnerability in SNMP [9] reported by
CERT/CC had affected large numbers of Hitachi products.
The impetus for the third phase - establishing of the SI
Vendor IRT - was the commencement of the Information
Security Early Warning Partnership. The HIRT Center was
Copyright © HIRT. 2014. All rights reserved.

6

Role
Corresponding sections: HIRT/CC- Provides a point of contact to external CSIRT
organizations, such as FIRST, JPCERT/CC andCERT/CC.
- Provides coordination among the SI Vendor,
Product Vendor and Internal User IRTs.
Corresponding sections: Sections providing
SI/services- Promotes CSIRT activities for customer systems.
- Provides customer systems with equivalent
security against reported vulnerabilities to thatfor internal systems.
Corresponding sections: Sections developing
products- Provides support to promote vulnerability
measures for Hitachi products and the release of
information concerning such countermeasures- Promptly investigates whether a reported
vulnerability has an impact on Hitachi products,
notifies users of the impact, if any, and provides
a security fix.
Corresponding sections: Sections administeringinternal infrastructures- Provide support to promote security measures forinternal networks lest Hitachi websites should be
used as a base for making unauthorized access.

HIRT: Annual Report 2014

Table 5: Phases until the organization was formed.
Phase
April 1998
1st phase
Establishing theInternal User IRT(1998 - 2002)<Establishment>
2nd phase
Establishing the
Product Vendor
IRT(From 2002 -)<Establishment>
3rd phase
Establishing the
SI Vendor IRT(From 2004 -)<Establishment>
4th phase(October 2004)<Establishment>
1st phase(2010-2011)<Improvement>
2nd phase(2012-2013)<Improvement>
3rd phase(2014-2015)<Improvement>

3.2

The organization of the HIRT/CC features the
combination of vertical and horizontal collaboration ofpeople and units. More specifically, this model has
achieved a flat and cross-sectional organizational system
for implementing measures and coordinating ability throughdistribution if functions by creating a virtual organizationconsisting of dedicated personnel and those who areassigned to HIRT as an additional task. Such organization
is based on the concept that the performance of duties by
each section and cooperation among sections are necessary
to solve security issues, given the great diversification
among components in the information systems.

Overview
We started CSIRT activities as a project toestablish a Hitachi CSIRT framework.
In order to run a Hitachi CSIRT on a trial
basis, we formed a cross-sectional virtual
team within the Hitachi group to start
mailing list based activities. Most of themembers comprised internal security experts
and those from sections administeringinternal infrastructures.
In order to start conducting activities
seriously as a Hitachi CSIRT, the sections
developing products played a central role inestablishing an organizational structure of
the Product Vendor IRT with related
business sites through cooperation frominternal security experts, the sections
administering internal infrastructures, thesections developing products and the Quality
Assurance Department.
We started to form an SI Vendor IRT withthe sections providing SI/services. In order toswiftly implement proactive measuresagainst vulnerabilities, as well as reactive
measures against incidents, via partnershipwith Internet communities, we started toform HIRT/CC, which provides a point ofcontact for external organizations andenhances coordination among Internal IRTs.
We established the HIRT/CC.

3.3

Main Activities of HIRT Center

The main activities of the HIRT center currently being
promoted include CSIRT activities for internalorganizations (Table 6) and those for external organizations(Table 7). The internally-oriented CSIRT activities
comprise issuing alerts and advisories that embody theknow-how obtained through gathering and analyzing
security information. Besides those, we are currently
engaged in activities to feed such knowledge back into
product development processes in the form of various
guidelines and support tools.

Table 6: (Internally) promoting projects.
Category
Collecting,analyzing andproviding security
information

Improvements of Hitachi group CSIRT
activities
Goal: instilling incident operation into thewhole Hitachi Group

Promotingproactive measuresagainstvulnerabilities, aswell as reactive
measures against
incidents for
products/services
Enhancing security
technology for
products/services

Position of HIRT/CC

The HIRT/CC is positioned under Information andTelecommunication Systems Company and has the role of
not only a coordinator within and with the entities outside
Hitachi but also a leader in promoting security technology.
The main area of activity is to support the Product andService Security Committee technically, to promotesecurity efforts from the technical and institutional aspect incooperation with the IT and Security Strategy Division,
Information Technology Division and Quality Assurance
Division.

Developing aframework forresearch activities

Moreover, it also includes helping each business divisionand group company implement proactive security measuresagainst vulnerabilities, as well as reactive measures against
incidents, and promoting security measures throughpartnerships among organizations as a point of contact for
CSIRT activities in the Hitachi group (Figure 15).
7

Overview- Promoting Information Security Early
Warning Partnership (Information
concerning proactive measures against
vulnerabilities, as well as reactive
measures against incidents/horizontal
deployment of know-how)- Building a wide-area observation network
based on the concepts of the Hitachi
Security Operation Center Information
eXchange (SOCIX)- Strengthening of collaboration with IRT
contact points of business divisions andgroup companies (Phases 1 and 2- Passing on of techniques for the incident
operation- Promoting the publication of security
information from external websites using
the Security Information Integration Site-- Establishment of processes forbuilding-in of security (approach fromthe three perspectives of specifications,codes and configurations, and in addition
move ahead with creating precedents incontrol devices and systems)- Developing a framework for joint
research with the Yokohama ResearchLaboratory

Copyright © HIRT. 2014. All rights reserved.

HIRT: Annual Report 2014

Information and Telecommunication Systems

HQ

Information Technology Division

We are now promoting activities to expand the HitachiGroup's commitment to product and service security toInternet users via our security portal website, as a proactive
measure against vulnerabilities, as well as reactive
measures against incidents.

Lead institutional aspects
IT & Security Strategy Division

Information Management Committee

Quality Assurance Division

Security Technology Subcommittee

Deployment of measures
Technical
SupportHIRT Center

Lead technical aspects
Point of contact for Hitachi IRTs
(Mutual corporation
among organizations)Mutualcollaboration

Hitachi business division andgroup companies

Collaborationon technical aspects

In particular, for issuing security information forvulnerabilities and incidents, to external entities, we also
adopt an approach in which an "Emergency Level" of
information is determined and a "Website Level" at which
the information is to be published is selected, in addition tojust routinely publishing security information via our
security portal website (Figure 17).

SI Vendor
IRT
Division/Gr. Company IRT
Operation Chief- Vulnerability Handling Support- Incident Response Support etc.

External IRT Communities• CSIRT organizations (CERT/CC (US), CPNI (UK), JPCERT/CC (JP))• Governmental organizations (Cabinet Secretariat, Ministry of Economy,
Trade and Industry, Ministry of Internal Affairs and Communications,
National Police Agency, etc.)• Product and software vendors (Microsoft, FFRI, etc.)• ISP (NTT, IIJ, etc.)• Security vendors (IBM-ISS, LAC, Trend Micro, Secure Brain)

Vulnerability
Handling Chief
IRT Liaison Staff

Internal User
IRT

Product Vender
IRT

Division/Gr. Company IRT

Division/Gr. Company IRT

Operation Chief

Operation Chief

Vulnerability
Handling Chief

Vulnerability
Handling Chief

IRT Liaison Staff

IRT Liaison Staff

Figure 15: Position of HIRT Center.
Table 8: Classification of security information
issued by HIRT.

Table 7: (Externally) promoting projects.

Strengthening theoverseas
partnership for
CSIRT activities

Developing aframework forresearch activities

Overview- Deploying proactive measures against
vulnerabilities based on the Information
Security Early Warning Partnership- Promoting activities related to the Nippon
CSIRT Association- Improving partnerships with overseas
CSIRT organizations/product vendor
IRTs through lectures or events at FIRST
conferences- Promoting UK WARP related activities.
- Countermeasures against vulnerabilities,
such as CVE and CVSS, andstandardization of incident response(ISO, ITU-T) [*b] [10]- Establish a joint research between Meiji
University (Professor Hiroaki Kikuchi)
and HIRT.
- Participating in academic research
activities, such as a workshop to develop
human resources for research on malware
countermeasures (MWS) [11]ID number
HIRT-FUPyynnn

HIRT-yynnn

HIRT-FYIyynnn

200
Number of issues

Category
Strengthening thedomestic
partnership for
CSIRT activities

100
50
0

Figure 16: Number of issues of security information
by ID number.

[*b]Under ISO SC27/WG3, work began in 2007 to develop a"Vulnerability Disclosure" international standard (29147), and in 2010 todevelop a "Vulnerability Response Procedure" international standard(30111). These international standards were completed in February 2014
and November 2013 respectively.
Work to develop a "Cyber Security Information Exchange Framework(X.cybex)" international standard covering CVE (Common Vulnerability
and Exposures), CVSS (Common Vulnerability Scoring System) and soforth has been proceeding since 2009 under ITU-T SG17 Q.4.

Copyright © HIRT. 2014. All rights reserved.

HIRT-FYIHIRT-FUP
HIRT

1998
1999
2000
2001
2002
2003
2004
2005
2006
2007
2008
2009
2010
2011
2012
2013
2014

HIRT security information in internally-oriented alerts andadvisories has been broken down into two types since June
2005. One is HIRT security information that aims to
distribute alerts and hot topics widely, and the other is
HIRT-FUP information, which is used to request individual
sections to take counter-action. This distinction is for thesake of information propagation and priority ranking.
(Table 8 and Figure 16). To communicate information
efficiently, we condense it to reduce the number of
information items and release it in tandem with the IT &Security Strategy Division and the Quality Assurance
Division.

150

Usage
Priority: Urgent
Distributed to: Only relevant sections
Is used to notify relevant sections ofvulnerability when an HIRT member has
found such vulnerability in a Hitachi groupproduct or a website, or received suchinformation.
Priority: Middle - HighDistributed to: No restriction
Is used to widely call attention to proactive
measures against vulnerabilities, as well asreactive measures against incidents.
Priority: Low
Distributed to: No restriction
Is used to notify people of HIRT OPEN
Meetings or lecture meetings.

Figure 17: Conceptual view of issuing information based on"Emergency Level" x "Website Level".
8

HIRT: Annual Report 2014

4(4) Winning of (ISC)2 Asia-Pacific ISLA 2013

Activity Summary from 1998 to 2013

We won the 2013 Senior Information Security
Professional Award for ISLA (Information Security
Leadership Achievements) from (ISC)2, which runs the
CISSP information security certification and is highly
appraised for its contributions to the vulnerability
countermeasure activities pertaining to the JVN (Japan
Vulnerability Notes), in which HIRT is involved [13]．

This section describes the activities for each year from1998 when the HIRT project started.

4.1

The Year 2013

(1) Improvement of Hitachi Group CSIRT activities(Phase 2)(5) Other Activity

In 2013 - the fourth year of the improvements and the final
year of Phase 2 - we moved ahead with entrenching loci forpassing on techniques for cyber security countermeasures,in concert with the HIRT supporting staff (staff who workwith the HIRT Center to actively promote IRT activities).



4.2

For the passing on of the techniques, we divided them into
three: (a) analysis (reverse engineering) of the behavior of
the malware and so forth used in cyber attacks, (b)investigation (forensics) to extract information and datafrom computers to serve as digital evidence, and (c)assessment (penetration) to looks for the vulnerabilities,
then possibly attempting to exploit them if access may begained.

2012 was the third year of the improvements and in it westarted Phase 2, which is to strengthen collaboration inside
the Hitachi Group through the HIRT supporting staff.
Disseminating Countermeasure Information through
HIRT OPEN MeetingsStart of Advanced HIRT OPEN Meetings(2) Trial IRT activities for individual domains

Moving ahead with readiness activities at
HIRT-FIS

We started trial IRT activities for individual domains, inorder to take the approach of the three-tiered cycle forincident response and readiness that incorporates theperspectives of individual business domains (Figure 12).

For external readiness in the financial domain, we began
trial weekly distribution of the HIRT-FIS Security Notes.


Vulnerability countermeasures for industrial
control systems

Also, as an advanced endeavor in the financial domain, we
set up HIRT-FIS inside our financial section on October 1,
2012 (Figure 19).

We established a framework for vulnerability handlingand incident handling with HIRT as basic point of contact
for external organizations (Figure 18) [12].

Positioning(3) Strengthening of Partnership with the CSIRT
Community

Framework

Domains
HIRT-FIS

We carried out information dissemination in cooperation
with the Nippon CSIRT Association’s Incident Information
Utilization Framework Working Group [16]．
The Year 2012

(1) Start of improvement of Hitachi Group CSIRT
activities (Phase 2)(2) Trial IRT activities for individual domains
Participation in MWS (anti Malware engineering
workshop) 2013 [11].

GeneralRegarding the domestic web page alteration incidents
ongoing since March 2013.

HIRT

:
:

Specific

Financial domain
HIRT-FIS(Financial Industry
Information Systems HIRT)・・・ domain
HIRT-###

Figure 19: Positioning and framework of IRT activities forindividual industry domains(3) Strengthening of Partnership with the CSIRT
community

Vulnerability
handling for IT

Vulnerability
handling for ICS

CERT/CCJPCERT/CCICS-CERT
Figure 18: Framework for vulnerability handling.
9

On February 29, 2012 we held the CSIRT Workshop
2012 as an opportunity for exchange of opinions on
corporate CSIRT, targeting corporate staff interested
in CSIRT activities [14].

Together with the FIRST member teams in Japan, we
held the FIRST Technical Colloquium 2012 Kyoto at
the Kyoto International Community House from
November 13 to 15, 2012 [15].

In order to continue with study of "Future of Global
Vulnerability Reporting", which was raised at the
Copyright © HIRT. 2014. All rights reserved.

HIRT: Annual Report 2014


FIRST Technical Colloquium 2012 Kyoto, we
launched a Vulnerability Reporting and DataeXchange SIG (Special Interest Group) inside FIRST.

December 2011: "Circumstances Surrounding
Android (Trends in the Android Malware)" by
Norihiko Maeda, Kaspersky Labs Japan(4) Lectures(5) Other activities



March 2012: "Framework for Promoting Security
Measures in Organizations" by Nobuo Miwa, S&J
ConsultingAugust 2012: "Elements and Implementation of
Database Security" by Haruto Kitano, Oracle
Corporation Japan

September 2012: "Trends in Cyber Attacks and theCutting Edge of Cyber Security Research" by Daisuke
Inoue, National Institute of Information andCommunications Technology



4.3

4.4

We began activities for Phase 1 of the improvement of
Hitachi Group CSIRT activities, with the goal of "installingincident operation into the whole Hitachi Group". In 2010,
the initial year of Phase 1, we concentrated our efforts onentrenching the liaison meetings (operational and technicalmeetings) for the vulnerability-related information handlingofficers and IRT liaison staff.

The Year 2011Operational Meeting (once/term): for thevulnerability-related information handling officers and
IRT liaison staff, held with the objectives of sharing
and passing on the operational know-how necessary
for IRT activitiesTechnical Meeting (2-4 times/term): for designers,
system engineers and persons able to assist with
disseminating technological expertise, held in order todisseminate the technological expertise necessary forbuilding security into products and services.

(1) Improvement of Hitachi Group CSIRT Activities(Phase 1)
2011 was the second and concluding year of Phase 1, andin it we concentrated our efforts on entrenching the support
activity cycle (issue identification, analysis, countermeasuredeliberation and deployment) that links with the Divisions
and the Group Company IRTs.
Drew up a list of check points to be re-verified in FY2010

Expanded HIRT OPEN Meeting (Technical Meeting)(2) Strengthening of Partnership with the CSIRT
Community
In December 2012, we provided support for the holding of
the Nippon CSIRT Association's International Partnership
Workshop Also, in cooperation with the Nippon CSIRT
Association's Incident Information Utilization Framework
Working Group, we carried out information disseminated[16]:(2) Disseminating Information on Vulnerability inControl System Products
We elected to deal with vulnerability in control systemproducts on a monthly basis, because the number ofvulnerabilities reported for such products had increased,
and in order to routinely determine the trends in thevulnerabilities reported.
(3) Strengthening of Partnership with the CSIRT
Community
We carried out information transmission in cooperation
with the Nippon CSIRT Association's Incident Information
Utilization Framework Working Group.


A website with the information about Gumblar
countermeasureInformation on the SSL attack by the Botnet PushDo

Information about Stuxnet(3) Other activity

In July 2010, we provided backing for the organizingof an "Academy CERT Meeting" in collaboration with
JPCERT/CC, to help Indonesia's academic CSIRT
activities [17].

"Survey on Malware Circulating Within the P2P File
Exchange Environment" [18]Since 2007, many Antinny-type known malwares thatare liable to cause information leakage have beenswarming on the "Winny" P2P file-sharing
environment (Figure 20).

Web Malware "mstmp" exploiting Mash-up(4) Lectures
July 2011: "Defining Security Requirements for Web
Application Development" by Hiroshi Tokumaru,
HASH Consulting Corporation



September 2011: "Difficulties and Actual Practice in
the Information Leakage Countermeasure Field Tracking Down Malicious Data Diffusion Crimes" by
Toshifumi Tokuda, IBM Japan

Copyright © HIRT. 2014. All rights reserved.

The Year 2010

(1) Start of Improvement of Hitachi Group CSIRT
Activities (Phase 1)

November 2012: "A Look Back Over Remote Control
Incidents, the Firstserver Problem and theLeap-Second Problem" by Tetsutaro Uehara, The
Research Institute of Information Security (NPO)

Cooperated with the standardization activities for
ITU-T's Cybersecurity Information Exchange
Framework ("CYBEX")

10HIRT: Annual Report 2014

4.6

Information leakage malware ratio in all files
Information leakage malware ratio in archive files

20%(1) Supporting countermeasures against DNS cachepoisoning vulnerability

15%

We held an HIRT OPEN Meeting "Roles of DNS and Useof Related Tools" in December as a countermeasure to DNS
cache poisoning vulnerability, in order to describe DNS
behavior and how to use tools. To help promote DNS cachepoisoning countermeasures in Japan, the materials prepared
for the HIRT OPEN Meeting were provided as a reference,
based on which "Countermeasures against DNS Cache
Poisoning vulnerability" [ 21 ] issued from the IPA in
January, 2009, was created.

10%
5%
2010

2009

2008

2007

0%

Figure 20: Change in Malware Circulating in Winny That
Causes Information Leakage.

4.5

The Year 2008

(2) Holding JWS2008

The Year 2009

March 25-28, 2008, we held the FIRST Technical
Colloquium, a FIRST technical meeting, and Joint
Workshop on Security 2008, Tokyo (JWS2008), a domestic
CSIRT technical workshop, with a team of domestic FIRST
members [22].

(1) Start of Product/Service Security Feedback
To give feedback to the product development processes
about the know-how we learned from the experience ofvulnerability fighting and incident response, we started toprovide support for each process (Figure 21).

(3) Participation in the domestic COMCHECK Drill
2008
Basic
knowledge

Quotation

Basic
on
Basic
courseBasic course
course on
on
web
web
application
web application
application
security
security
security

DesignSupport ofSupportSupport ofof
security
review
security
security review
review

Implementationand construction

Test

Operation

Hands-onHands-oncourse
Hands-oncoursecourse ofof webwebofapplication
web application
application
security
inspection
inspection

SupportSupport forfor
Supportfor
adpopting
adpoptingadopting
contermeasurescontermeasurescountermeasuresinin incidents
incidents

inspection

Training in theTrainingininthe
theTraining
use
inspectionuse ofinspectionuseofofinspecti
on
tools
tools
tools

With a view to ensuring that in-house information security
departments of various organizations could communicate
with each other, we participated in a domestic
COMCHECK Drill (Drill name: SHIWASU, was held by
the Nippon CSIRT Association on December 4, 2008).

in incidents

Support of log

Supportofof loglog
Supportchecking
checking
checking

Figure 21: Systematizing HIRT support activities(Web application security).

(4) Award with the Commerce and Information Policy
Bureau Chief Prize, Ministry of Economy, Trade andIndustry (Information Security Promotion Section)(2) Providing Security Engineer Training

In the 2008 Information Technology Promotion Monthly
Period memorial ceremony held by Information
Technology Promotion Conference (Ministry of Economy,
Trade and Industry, Cabinet Office, Ministry of Internal
Affairs and Communications, Ministry of Finance Japan,
Ministry of Education, Culture, Sports, Science andTechnology, Ministry of Land, Infrastructure andTransport) on October 1, 2008. We were awarded with the"Commerce and Information Policy Bureau Chief Prize,
Ministry of Economy, Trade and Industry (Information
Security Promotion Section)" [23].

As part of the security engineer training program utilizing
the CSIRT activities, we accepted a trainee and trained him
for six months with the focus on web system security.
(3) Lectures
July 2009: "Web Application Security" by Hiromitsu
Takagi, National Institute of Advanced Industrial
Science and Technology (AIST)

July 2009: "NTT-CERT Activity" by, Takehiko
Yoshida, NTT-CERT(5) Lectures(4) Other Activities
"Survey on Malware Circulating within the P2P File
Exchange Environment" [19]February 2009: Gave an web application development
exercise for NTT Group at a workshop organized by
NTT-CERT

April 2008: "Management of High Reliability
Organizations" by Aki Nakanishi, the Faculty ofBusiness Administration, Meiji University.

(6) Other Activity
In order to partially reveal the actual circumstances oftargeted attack as a part of efforts to develop a newinter-organization collaboration, we provided relatedorganizations with a malware-attached e-mail, which faked
itself as Call for Papers (CFP) for the symposium held by
the Computer Security Symposium 2008 of Information
Processing Societies Japan as a sample [24].

In cooperation with the Incident Information
Utilization Framework Working Group of Nippon
CSIRT Association, information dissemination using
cNotes (Current Status Notes) [20] which tries tovisualize the observational data.
11

Copyright © HIRT. 2014. All rights reserved.

HIRT: Annual Report 2014

4.7

The Year 2007

(2) Enhancing Web Application Security
In October 2006, as part of security measures of web
application in the Hitachi group, we created guidelines andchecklists and provided support for their implementation in
the Hitachi group. We updated "Web Application Security
Guide (Development) V2.0" by adding new vulnerabilities,
such as LDAP injection and XML injection, and a method
for checking the existence of such vulnerabilities.

(1) Starting Hands-on Security Training at HIRT OPEN
Meetings
In 2007, to promote the practical use of the guideline"Web Application Security Guideline", we provided ahands-on, exercise-based HIRT OPEN Meeting twice inMarch and June for the web application developer.
(2) Founding the Nippon CSIRT Association(3) Calling Attention to Information Leakage Caused by
P2P File Exchange Software
Antinny is a virus that has penetrated widely via "Winny",
file exchange software that appeared in August 2003. The
virus causes infected PCs to leak information and attack
particular websites. In April 2006, HIRT issued a security
alert entitled "Prevention of Information Leakage Causedby Winny and Proactive Measures against It" based on
previous experience of threats.

80
70
60
50
40
30
20
10
0

(4) Starting Product Security Activities for Intelligent
Home Appliance and embedded Products
We have started product security activities for intelligent
home appliance and embedded products. HIRT focused on
the Session Initiation Protocol (SIP), a call control protocol
used for Internet telephony, and summarized related
security tools and measures into a report.
(5) Strengthening Partnership with the CSIRT
Community

1998
1999
2000
2001
2002
2003
2004
2005
2006
2007
2008
2009
2010
2011
2012
2013
2014

Total number of teams

In order to develop a system based on a strong trusting
relationship among CSIRTs that can successfully andpromptly react to events that single CSIRTs find it difficult
to solve, we founded the Nippon CSIRT Association withIIJ-SECT (IIJ), JPCERT/CC, JSOC (LAC), NTT-CERT(NTT) and SBCSIRT (Softbank) in April 2007 [25]. As of
December 2014, 69 teams have been joined (Figure 22).

In March 2006, we introduced Hitachi's CSIRT activities
in a workshop held by NTT-CERT to exchange information
to improve CSIRT activities with each other.

Figure 22: Change in Number of Nippon CSIRT
Association Members.
(3) Joining UK WARP

(6) Lectures

In order to strengthen the overseas partnership on CSIRT
activities, we joined the Warning, Advice and Reporting
Point (WARP), promoted by the Centre for the Protectionof National Infrastructure (CPNI), a British government
security organization, in May 2007 [26].

May 2006: "Security for embedded systems", by Yuji
Ukai, eEye Digital Security



September 2006: "Measures against Botnet inTelecom-ISAC Japan", by Satoru Koyama,
Telecom-ISAC Japan(4) Lectures(7) Other Activities

4.8

July 2008: "Vulnerability Assessment through Static
Analysis" by Yuji Ukai, Fourteenforty ResearchInstitute, Inc.



4.9

The Year 2006

The Year 2005

(1) Joining FIRST(1) Providing a Unified Point of Contact for
Vulnerability Reporting

In January 2005, to boost experience in CSIRT activities
while creating an organizational structure to addressincidents in partnership with CSIRT organizations overseas,
we joined the Forum of Incident Response and Security
Teams (FIRST), an international community for computer
incident handling teams [ 28 ]. The preparation period
extended for about one year, since any team wishing to join
the community must obtain recommendations from two
member teams before doing so.

In
November
2006,
in
order
to
circulatevulnerability-related information properly in the Hitachigroup and thereby promote measures against vulnerabilities
in Hitachi software products and websites, we provided aunified point of contact for receiving reports onvulnerabilities found in software products and web
applications.

Copyright © HIRT. 2014. All rights reserved.

Starting to sign a digital signature to technicaldocuments (PDF files) issued from HIRT [27]12

HIRT: Annual Report 2014

As of December 2014, a total of 316 teams have joined
this community, including 23 Japanese teams (Figure 23)[*c].
Total number of teams
Total number of Japanese teams

The Information Security Early Warning Partnership
started in July 2004 when the "Standard for Handling
Information Related to Vulnerabilities in Software, etc."
was implemented [29][30].

25

250

20

200

15

150

10

100
50

5

0

0

Total number of Japanese teams

300(1) Participating in the Information Security Early
Warning Partnership

30

1998
1999
2000
2001
2002
2003
2004
2005
2006
2007
2008
2009
2010
2011
2012
2013
2014

Total number of teams

350

4.10 The Year 2004

The Hitachi group registered itself as a productdevelopment vendor to the Partnership, using HIRT as apoint of contact, and started publishing Hitachi'svulnerability handling status on JP Vulnerability Notes(JVN) [31].
(2) Enhancing Web Application Security
In November 2004, we created the "Web Application
Security Guide (Development), V1.0" and distributed it
throughout the Hitachi group. The guide summarizes
typical problems that need to be considered when designingand developing web applications, and provides an overview
of measures taken to solve such problems.

Figure 23: Changes in the number of members of FIRST.
(2) Setting Up a Security Information Portal Site
In September 2005, in order to provide Internet users withcomprehensive information on security problems applicableto the products and service of the Hitachi group, we set up a
security information portal site within which the security
information provided through the websites of Hitachi
business divisions and group companies is integrated(Figure 24). We also created "Guidance for Providing
Security Information from Websites to External Users,
V1.0".

(3) Lectures

4.11 The Year 2003
(1) Starting Web Application Security Activities

Releasing information to the public Request for investigation

Security information portal site:
Japanese: http://www.hitachi.co.jp/hirt/
English: http://www.hitachi.com/hirt/

We started to consider a method for enhancing web
application security and developed the "Procedure forCreating a Security Measure Standard for Web Application
Development V1.0" with business divisions.

The Hitachi group
IPA, JPCERT/CC
Information
Security Early
Warning
Partnership
Information
disclosure

Request forinvestigation

Affected products
and mesurements

Providing security
information via adomestic security portalsite

HIRT/CC
Aggregating
statusInformation
disclosure

Request forinvestigation

Sections developing
products

Affected
products

Investigationand measures
Preparing for
information
disclosure

Measurements

Providing security
information via Hitachigroup security potal site

January 2004: "Security business affairs after Blasterin the US", by Tom Noonan, President and CEO ofInternet Security Systems (ISS)(2) Disseminating Vulnerability Information fromNISCC throughout Hitachi
Following the dissemination of vulnerability informationfrom CERT/CC in 2002, we started obtaining/publishing
information in accordance with the NISCC (currently,
CPNI) Vulnerability Disclosure Policy. 006489/H323 ofJanuary 2004 for security information on a Hitachi productwas first published in NISCC Vulnerability Advisory after
starting the activity [32].

Providing businessdivisions and subsidiarycompanies with security
information

Figure 24: Providing security informationon the Hitachi security information portal.
[*c] CDI-CIRT (Cyber Defense Institute), CFC (Cyber Force Center of the
National Police Agency's Info-Communications Bureau), DeNA CERT(DeNA)，FJC-CERT (Fujitsu)，HIRT (Hitachi)，IIJ-SECT (IIJ)，IPA-CERT(Information-technology Promotion Agency), JPCERT/CC，JSOC (LAC)，
KDDI-CSIRT (KDDI)，KKCSIRT (Kakaku.com)，MBSD-SIRT (Mitsui
Bussan Secure Directions)，MIXIRT (Mixi)，MUFG-CERT (Mitsubishi
UFJ Financial Group)，NCSIRT (NRI Secure Technologies), NISC
(National Information Security Center)，NTT-CERT (NTT)，NTTDATA-CERT (NTT Data)，Panasonic PSIRT (Panasonic)，
Rakuten-CERT (Rakuten)，RicohPSIRT (Ricoh)，SBCSIRT (Softbank) and
YIRD (Yahoo).

(3) Strengthening the Domestic Partnership for CSIRT
Activities
To strengthen the domestic partnership for CSIRT
activities, we hold meetings with domestic teams that are
members of FIRST, and individual meetings with
NTT-CERT and Microsoft Product Security Team (PST) to
exchange opinions, and have established a contact network
to be used, for example, when a website is found to havebeen tampered with.
13

Copyright © HIRT. 2014. All rights reserved.

HIRT: Annual Report 2014

Information Related to Vulnerabilities in Software, etc." inJuly 2004, the roles of the trial site were transferred toJapan Vulnerability Notes (JVN), a site releasing
information on reported vulnerabilities (http://jvn.jp/).

(3) Providing a Point of Contact for External
Organizations
In line with the more active reporting and releasing of
information concerning the discovery of a vulnerability, we
provided a point of contact, as shown in Table 9, that
initiates actions when vulnerabilities or malicious actions in
Hitachi products and Hitachi-related websites are pointedout.

4.13 The Year 2001
(1) Investigating the Activities of Worms Attacking Web
Services
We investigated the activities of worms attacking web
services in 2001, CodeRed I, CodeRed II and Nimda, from
June 15, 2001 to June 30, 2002, based on the log data fromthe websites on the Internet. For CodeRed II and Nimda(Figure 26), which caused significant damage in Japan, thelog reveals that the time span between the time at which theattack was first logged and the date on which attacks
occurred most frequently was only approximately two days,
indicating that damage caused by the worms had spread
rapidly and widely.

Table 9: Information on point of contact.
Name
Address"HIRT": Hitachi Incident Response Team.
Kashimada 1-1-2, Saiwai, Kawasaki City,
Kanagawa, 212-8567 Japan

E-mailPGP key

KeyID = 2301A5FA
Key fingerprint
7BE3 ECBF 173E 3106 F55A
011D F6CD EB6B 2301 A5FA
pub 1024D/ 2003-09-17
HIRT: Hitachi Incident Response Team

Number of access counts

2,000

4.12 The Year 2002
(1) Disseminating Vulnerability Information from
CERT/CC throughout Hitachi
SNMP vulnerability [9] reported from CERT/CC in 2002
affected a wide range of software and devices. This
provided an opportunity to start the Product Vendor IRT
and obtaining/publishing information based on the
CERT/CC Vulnerability Disclosure Policy [ 33 ].
VU#459371 of October 2002 for security information on
Hitachi product was first published in the CERT/CC
Vulnerability Notes Database after commencing thisactivity [34].

2004

In order to measure the severity level of vulnerability
exploited for destructive or security-compromising
activities, we investigated the severity metrics used byrelevant organizations and summarized the results into areport.
CERT/CC publishes notes called "Vulnerability Notes"[ 37 ] for vulnerability. It provides the Severity Metricindicating the severity of vulnerability [ 38 ] Common
Vulnerabilities and Exposures (CVE) classified information
security vulnerabilities into "Vulnerabilities" and"Exposures" and focuses on the former [39]. The former isdefined as mistakes in software to violate a reasonablesecurity policy and the latter as environment-specific,
configuration issues or mistakes in software used to violatea specific policy. The National Institute of Standards andTechnology (NIST) uses whether or not a CERT advisory
and CVE identifier number has been issued as a guide to
determine the severity of vulnerability, and classifies
vulnerabilities into three levels in the ICAT Metabase [40],a predecessor of NVD.

2005

▲ JVN working group formed in June 2002
▲ Trial site (jvn.doi.ics.keio.ac.jp) to the public in February 2003
▲ JVNRSS stared in July 2003
▲ VN-CIAC stared in December 2003

▲ TRnotes stared in January 2004
▲ jvn.jp to the public in June 2004

Figure 25: Building and running a JVN trial site.
With the implementation of the "Standard for Handling
Copyright © HIRT. 2014. All rights reserved.

0(1) Investigating the Severity Metrics for Vulnerabilities

2004/07/08~
Running official website

2003/02/03~2004/07/07
Trial site running period

500

4.14 The Year 2000

We provided support to build and operate a trial website,
JPCERT/CC Vendor Status Notes (JVN)(http://jvn.doi.ics.keio.ac.jp/), in February 2003, as an
attempt to improve the domestic circulation of security
information (Figure 25) [35][36].
2003

1,000

Figure 26: Changes in the number of Nimda log counts
found during the observation period (for Nimda).

(2) Assisting JPCERT/CC in Building Vendor Status
Notes

2002

1,500

14

HIRT: Annual Report 2014

Note that as severity metrics for vulnerabilities vary,depending on organizations, the Common Vulnerability
Scoring System (CVSS) [41] was proposed as a common
language with which to evaluate the severity ofvulnerability in a comprehensive and general way in 2004.

5

Social infrastructure, which has been constructed utilizing
the internet on a base of information systems, industrial
control systems and so forth, are is faced with the issue ofvulnerabilities as a threat that could lead to incidents. It isnecessary to progressively confront, through daily cybercountermeasure activities, issues of vulnerability that could
constitute new threats. At HIRT, we will be moving
progressively forward with activities that "catch any signsof future threats and take actions as early as possible", so as
to deal with new threats. Also, we will be contributing to
the realization of safe and reassuring social infrastructure,in ways such as promoting trusted CSIRT activities tailoredto particular domains and fostering loci for liaison withacademia that will lead to the next-generation CSIRT
community.

4.15 The Year 1999
(1) Launch of the hirt.hitachi.co.jp domain
To improve the provision of security information to the
Hitachi group, we created an internal domain for HIRT
projects to set up a website (hirt.hitachi.co.jp) in December
1999.
(2) Investigation of website defacement
Website defacement was a major type of incidents since it
occurred for the first time in the US in 1996 until the
network worm era started (2001 - 2004). We conducted a
research on webpage defacing from 1999 to 2002 to findout how malicious activities were performed (Figure 27).
Number of website defacements

Conclusion(August 13, 2015)

3,000
2,500
2,000
1,500

1,000
500

0
1995 1996 1997 1998 1999 2000 2001 2002

Figure 27: Changes in the number of websites defacements.

4.16 The Year 1998
(1) Starting to provide HIRT security information
In April 1998, we started to provide information on
security measures mainly using an internal mailing list andan internal website for HIRT projects. This information isbased on the security information issued by CERT/CC,
JPCERT/CC, and product vendors (Cisco, HP, Microsoft,
Netscape, Sun Microsystems, etc.).
(2) Lectures
On June 25 - 26, 1998, we provided "Network security"
training for Hitachi. We invited an US security expert who
had also participated in the US Security Conference
DEFCON [42] as a speaker as an instructor.

15

Copyright © HIRT. 2014. All rights reserved.

HIRT: Annual Report 201423) 2008 Information Technology Period Promotion Awarding companies that have contributed to thepromotion of information technology in 2008 (2008/10),

References
1) National Police Agency: Occurrence of Fraudulent
Money Transfer Crimes Relating to Internet Banking in
2014, http://www.npa.go.jp/cyber/pdf/H270212_banking.pdf
2) Symantec, 2015 Internet Security Threat Report, Vol. 20

http://www.jipdec.or.jp/archives/project/gekkan/2008/ceremony/prize02.ht
ml24) IPSJ, Information Processing: Malware: 5. column:
Targeted Email Attack for CSS2008 CFP (2010/3),

http://www.symantec.com/security_response/publications/threatreport.jsp

https://ipsj.ixsq.nii.ac.jp/ej/?action=repository_uri&item_id=69232&file_id=125) CSIRT - Nippon CSIRT Association, http://www.nca.gr.jp/

3) Arbor Networks, ATLAS Q3 2014 DDoS Attack Trends
http://www.slideshare.net/Arbor_Networks/atlas-q3-2014-ddos-attack-trends26) WARP (Warning, Advice and Reporting Point),

4) NIST NVD (National Vulnerability Database),

http://www.warp.gov.uk/

http://nvd.nist.gov/

27) GlobalSign Adobe Certified Document Services,5) Information-Technology Promotion Agency, Japan:
Quarterly Reports,

http://jp.globalsign.com/solution/example/hitachi.html

28) FIRST (Forum of Incident Response and Security
Teams), http://www.first.org/
29) Ministry of Economy, Trade and Industry, Notification
No. 235: Standard for Handling Information Related toVulnerabilities in Software, etc., (2004/7),

http://www.ipa.go.jp/security/english/quarterlyrep_vuln.html

6) NIST, National Checklist Program
http://www.nist.gov/itl/csd/scm/ncp.cfm7) NTT-CERT (NTT Computer Security Incident Response
and Readiness Coordination Team), http://www.ntt-cert.org/
8) ITpro Security, http://itpro.nikkeibp.co.jp/security/
9) CERT Advisory CA-2002-03, "Multiple Vulnerabilities
in Many Implementations of the Simple Network
Management Protocol(SNMP)" (2002/2),

http://www.meti.go.jp/policy/netsecurity/downloadfiles/vulhandlingG.pdf

11) anti Malware engineering workshop,30) Information-technology Promotion Agency, Japan:
Information Security Early Warning Partnership Guideline(2004/7), http://www.ipa.go.jp/security/ciadr/partnership_guide.html
31) JVN (Japan Vulnerability Notes), http://jvn.jp/32) NISCC: NISCC Vulnerability Advisory 006489/H323:
Vulnerability Issues in Implementations of the H.323
Protocol (2004/1), http://www.kb.cert.org/vuls/id/JSHA-5V6H7S
33) CERT/CC Vulnerability Disclosure Policy,

http://www.iwsec.org/mws/2015/

http://www.cert.org/kb/vul_disclosure.html

12) HIRT-PUB10008： Hitachi Vulnerability Disclosure
Process (2011/9),

34) US-CERT: Vulnerability Note VU#459371: Multiple
IPsec implementations do not adequately validate
authentication data" (2002/10),

http://www.cert.org/advisories/CA-2002-03.html

10) HIRT-PUB14008: Cybersecurity information exchange
framework CYBEX,
http://www.hitachi.co.jp/hirt/publications/hirt-pub14008/index.html

http://www.hitachi.com/hirt/publications/hirt-pub10008/index.html

13) (ISC)2: Information Security Leadership Achievements(ISLA)プログラム, https://www.isc2.org/japan/isla.html
14) CSIRT Workshop 2012,

http://www.kb.cert.org/vuls/id/459371

35) Considerations on JPCERT/CC Vendor Status Notes
DB: JVN, CSS2002 (2002/10),
http://jvn.doi.ics.keio.ac.jp/nav/CSS02-P-97.pdf

http://www.hitachi.co.jp/hirt/topics/20120229.html
http://www.first.org/events/colloquia/kyoto201236) Development of JVN to Support Dissemination of
Security Information (2005/5),

16) Nippon CSIRT Association: incident response,

http://www.hitachi.co.jp/hirt/csirt/jvn/index.html

15) Kyoto 2012 FIRST Technical Colloquium,
http://www.nca.gr.jp/2010/incidentresponse.html

37) CERT/CC Vulnerability Notes Database,17) SGU MIT Workshop Academy CERT Meeting(2010/7),

http://www.kb.cert.org/vuls

http://academy-cert-indonesia.blogspot.jp/2010/06/academy-cert-meeting.html38) CERT/CC Vulnerability Note Field Descriptions,
http://www.kb.cert.org/vuls/html/fieldhelp18) Malware Circulating in P2P File Exchange Software
Environment (2011) (2011/9),

39) CVE (Common Vulnerabilities and Exposures),http://cve.mitre.org/
40) ICAT, http://icat.nist.gov/(not available)

http://www.hitachi.co.jp/hirt/publications/hirt-pub11003/index.html

41) CVSS (Common Vulnerability Scoring System),

19) 2009 Survey on information leakage via P2P File
Exchange Software Environment (2009/12),

http://www.first.org/cvss/
42) DEFCON, http://www.defcon.org/

http://www.hitachi.co.jp/hirt/publications/hirt-pub09008/index.html

20) cNotes: Current Status Notes,[Author]Masato Terada
After launching HIRT activities in 1998 on a trial basis, he launched aresearch site (http://jvn.doi.ics.keio.ac.jp/), a predecessor of JVN(http://jvn.jp/), in 2002 and acted as a point of contact for HIRT in order topromote external CSIRT activities, including participation in FIRST, aninternational CSIRT organization in 2005. Also, he works as a technicalmember of the JPCERT Coordination Center, a researcher of theInformation Technology Promotion Agency, Japan, Telecom ISAC asteering committee member, and a chief of the steering committee for the
Nippon CSIRT Association.

http://jvnrss.ise.chuo-u.ac.jp/csn/index.cgi21) Information-Technology Promotion Agency, Japan:
Countermeasures against DNS Cache Poisoning (2009/2),
http://www.ipa.go.jp/security/vuln/DNS_security.html

22) Recording Site for Joint Workshop on Security 2008,
Tokyo (2008/3), http://www.nca.gr.jp/jws2008/index.html

Copyright © HIRT. 2014. All rights reserved.

16