Hitachi Incident Response Team2013.11.18 09:52:16 +09'00'
HIRT: Annual Report 2012

HIRT: Annual Report 2012
Hitachi Incident Response Team (HIRT)
http://www.hitachi.com/hirt/
Kashimada 1-1-2, Saiwai, Kawasaki, Kanagawa, 212-8567 Japan

1

Introduction2012 was a year in which CSIRT (Computer Security
Incident Readiness/Response Team) took a major step
forward amid the third or settlement phase (Figure 2) ofunfolding CSIRT activities, which is based on theregional characteristics of Japan (what may be termed"localization"). The backdrop to this was the varied slew
of security incidents that occurred in 2011 and thetendency for those under cyber attack to utilize CSIRTs
as specialist capabilities for dealing with the incidents.
This tendency can be glimpsed from the specialized andpragmatic collaboration utilizing CSIRTs mentioned in
the Information Security Measure Promotion Council's
Forms to be Taken by Public-Private Collaboration
Regarding Information Security Measures, published on
January 19, 2012 [1].
I. Countermeasures regarding information sharing, etc., that the
government should take with regard to targeted attack(Omission of middle part of a text)
In public-private collaborations, rather than sharing
in-formation among organizations in a vague manner, it isimportant for each organization to set up a specialist team withthe capability to make emergency responses to information
security incidents (hereinafter referred to as "CSIRT"(Computer Security Incident Response Team), etc.), and forspecialized and pragmatic collaboration to be carried out among
the CSIRTs, etc., inside the various organizations, both public
and private.

action (targeted attack), leading up to a invasive action ona particular organization that is the ultimate target (Figure
1).
Therefore, security measures and incident responses forsuch attacks are designed to counter attacks that to aconsiderable extent act on, or are acted on by, otherorganizations. This is an approach that is not consideredin the "entry-dispersion-exit countermeasure" typemulti-layered defense of organizational-internal systems,
and we believe that it is here that the significance ofspecialized, pragmatic collaboration among organizations
via CSIRTs resides.
We consider that the requirements for CSIRTs incarrying out vulnerability countermeasures and incident
responses are to possess the capabilities for "predicting
and alerting from a technical point of view", "making
technical coordination" and "collaborating with external
communities on the technical aspects". We are notenvisioning special requirements here.
(1) Sending of email
with malware attached

Outcome of invasive action isused for next targeted attack(2) Installation of
RAT tools(3) Email theft
Organization for targeted attack

From the very words "targeted attack" that come up in
the Forms to be Taken by Public-Private Collaboration,
one is apt to think of an invasive action that is targeted ata particular organization only. In most cases however,targeted attack - typified by the APT (Advanced
Persistent Threats) that have been in the limelight since2010 - are of a chain type (stepping-stone type) in which
the outcome of one invasive action is utilized for the next
Launch of HIRT Project

1998-2003(4)Sending of email withmalware attached using stolen email
Related organization

Figure 1: Chain type (stepping-stone type) targeted
attack.

Establishment of HIRT Center

2004-20092010-2015

Predawn Phase

Settlement Phase[ Local CSIRT Activities ]Acknowledge Phase[ Characteristics of Incident ]Homogeneous, wide-spread, one-shot damage Homogeneous, wide-spread, chain reaction damage
Website defacement
Malware-infected attached files
Network worms

Different and localized damage for each attack
Targeted attacks
Strategic Attacks

Figure 2: Positioning of CSIRT activities and development of incidents in Japan.
Copyright © Hitachi Incident Response Team(HIRT). 2012. All rights reserved.

HIRT: Annual Report 2012

The role of CSIRTs is to make use of their experience inincident operation (the series of security measure actions
implemented in order to predict and prevent damage fromincidents and to lessen the expansion of damage afterincidents occur) so as to "catch any sign of future threats
and take actions as early as possible".

Figure 3). Specific instances of such counter-actions are
the J-CSIP (Initiative for Cyber Security Information
Sharing Partnership for Japan) [ 3 ] promoted by the
Ministry of Economy, Trade and Industry since 2012 andthe Cyber Intelligence Information Sharing Network [4]promoted by the National Police Agency.

As an organization that possesses these capabilities androles, HIRT (Hitachi Incident Response Team) leads theway in countermeasures for product and service
vulnerability countermeasures and incident responses formalware infection and information leakage, besides being
responsible - as the Hitachi Group's integrated CSIRT
liaison organization - for implementing activities,
mechanisms and framework for enhancing Hitachi's brandimage in the field of security.



By progressively characterizing the attacker - What is ittrying to execute? How is it trying to do it? and so on the attacker's patterns, behavior, TTP (Tactics,
Techniques and Procedures), intentions and so forth are
made clear, and a campaign analysis is carried out.

This report will introduce a summary of the vulnerabilities
and threats and the activities of HIRT in 2012.

Table 1: Cases of chain type (stepping-stone type) invasive
actions.
Time
April 2011

Overview of activities in 2012

2

Utilizing attack observables (what can be observed
through an attack) and attack indicators (things for
detecting an attack)This section focuses on HIRT activities in 2012.

2.1

Overview of Threats and Vulnerabilities(1) Overview of Threats

May 2011

The known threats like targeted attack, website
compromised actions and USB malware (e.g. Conficker)
have continued to cause damage. Features of 2012 werethat denial-of-service attacks and website compromised
actions by "hacktivists" became steady occurrences, andthat inside Japan there manifested remote-control viruses(in October 2012), pop-up type phishing (also in October2012) and other security incidents that impacted ordinary
users.

August2011



Table 2: Stages of counter-action against APT.

Targeted attack

APT (advanced persistent threats) has been attracting
attention since 2010 as targeted attack. Table 1 shows forthcases of targeted attacks that are categorized as chain type(stepping-stone type).
In the U.S., a "Cyber Kill Chain" approach is underconsideration to deal with such chain type targeted attack.
This approach has the following features, as reported by
Lockheed Martin at the ICIW (International Conference on
Information Warfare and Security) in 2011 [2].
Dividing the counter-actions into stages

This is an application of the U.S. Air Force's Kill Chain(F2T2EA) military concept to cyber attack
countermeasures, and takes the form of a 7-stage attack
counter-action model (Table 2).
Implementing counter-actions from the initial stage
onwardWhereas formerly the start point in mostcounter-actions was the detection of malware after entry(left chart of Figure 3), this approach also accommodates
counter-actions that take as their start point the stage
where the targeting email or similar is sent (right chart of
Copyright © HIRT. 2012. All rights reserved.

OutlineIn April 2011, customer information (email
addresses, etc.) was stolen from the email systemof Epsilon company. In the same month, messages
that directed to illicit sites were transmitted to thestolen email addresses.
In March 2011, RSA SecurID-related information
was stolen from EMC Corporation. In mid-May,an invasive action on Lockheed Martin occurredthat made ill use of the RSA SecurID-related
information.
On August 26, email was stolen from the Societyof Japanese Aerospace Companies. On the sameday, malware was inserted into the stolen email,which was then used as targeted email against theSociety's member companies.

#
1

Stage
Reconnaissance2

Weaponization

3

Delivery4

Exploitation

5

Installation

6

Command andControl(C2)7

Actions on
Objectives

OutlineSurveying targets for attack, via
websites, mailing lists and so forth
Preparing methods (such as injecting in
an office document or PDF) for
executing the exploit code
Delivering the exploit code via email,websites, USB memories and so forth
Execution of the prepared exploit code
under the target environment
Installing a RAT [*a] or back door, etc.,
in the target environment
Establishing remote control
communication paths from the RAT orback door, etc., to the command server
Execution of the ultimate objective theft, disruption, etc. - or expansion ofinvasive action in the organization's
internal network[*a] RAT: stands for Remote Access Trojan or Remote Administration
Tool. Program for operating a system that has been penetrated from aremote location. Used for stealth/theft activities and so on.

2

HIRT: Annual Report 2012

Reconnaissance

Reconnaissance

Weaponization

Weaponization

Analysis

Delivery

Delivery

Detection

Exploitation

Exploitation

Analysis

Installation

Installation

Detection

Command andControl (C2)

Command andControl (C2)

Actions on
Objectives

Actions on
Objectives

with the feature to infect via a USB memory stick),
infection spread to the closed networks via a physicalmeditational means. Since 2009, the number of reports on
the USB malware infection in Japan has been decreasing(Figure 5) [ 5 ]. However, according to the report of theConficker Work Group, the number of computers infectedwith Conficker is about 2 million on the IP address base(Figure 6) [6].
(2) Overview of Vulnerabilities
The total number of vulnerabilities entered in the NIST
NVD (National Vulnerability Database) [7] was 5,279 in
2012. 20 percent (1,029) of these were vulnerabilities in
web software application products (Figure 7). Looking at
the breakdown, it continues to be the case that cross-site
scripting (XSS) and SQL injection account for about 80
percent of the vulnerabilities (Figure 8). XSS and SQL
injection also account for some 60 percent of thevulnerabilities in operational websites that were reported to
the IPA, with some 600 cases a year of these vulnerabilities
being reported (Figure 9) [8].

Figure 3: Shift in start points for counter-actions.
(1) Surveying of website group
Landing website Malware distribution
website (Infector)(Redirector)(2) Redirect-code
injection

Group of websites accessed bytargeted organization

The ICS-CERT (Industrial Control System-CERT) has
issued 29 alerts and 81 advisories concerning vulnerabilities(Figure 10). Eight of the advisories (accounting for 10
percent) pointed out that credentials such as passwords andprivate keys were hard coded. Also, a large majority of thealerts issued in January 2012 concerned the PLC(programmable logic controller) vulnerabilities that wereidentified in a report at the SCADA Security ScientificSymposium held in mid-January.

(3) Download themalware executable

Organization for targeted attack

Figure 4: Watering Hole Attack.
Table 3: Cases of Watering Hole Attack.
Time
Since 2009

Watering Hole Attack

In the year 2000, malware was circulated by means ofemail attachments. By 2008, malware was circulated bymeans of websites. A similar development has taken placein targeted attack.
In 2011, targeted attack via email manifested themselves.
In 2012, there was a rapid expansion in the ruse whereby
tricks are stowed in a group of websites that people in atargeted organization are highly likely to visit, and thosewebsites are then used as landing sites (redirectors) (Table3). These are called "Watering Hole Attack" because lying
in wait for users at a targeted organization to visit a landing
website (redirector) is similar to a lion ambushing its prey
at a watering hole (Figure 4). The gambit used here is thatthe landing websites redirect visitors to malware
distribution websites. Technically this is a similar
mechanism to the type of malware that redirects to a
website - malware typified by Gumblar.
May 2012

June & July2012

December
2012

Conficker

Conficker emerged as a worn that exploited Vulnerability
in Windows, "Server Service Could Allow Remote Code
Execution (MS08-067)" in around November 2008. In
December 2008, by modification of Conficker (enhanced
3

OutlineElderwood Project [9][Infector]
Exploiting Adobe Flash Player vulnerabilities(CVE-2012-0779，CVE-2012-1535)，an Internet
Explorer vulnerability (CVE-2012-1875) and an
XML core service vulnerability(CVE-2012-1889)
Amnesty International Hong Kong (amnesty.org)[Infector]
Exploiting an Internet Explorer vulnerability(CVE-2012-1875)
VOHO campaign [10][Redirector] Prince George's County，Rockland
Trust and etc.
[Infector] Toronto Curling Association, etc.
Exploiting a Java vulnerability(CVE-2012-1723) and an XML core service
vulnerability (CVE-2012-1889)
Council on Foreign Relations[Infector]
Exploiting an Internet Explorer vulnerability(CVE-2012-4792)

Copyright © HIRT. 2012. All rights reserved.

25
Number of reports

7 (M)
6
5
4
3
2
1

20

2012

2011

2010

2009

2008

2007

2006

2005

ICS-CERT Advisory
ICS-CERT Alert

15
10
5

2010/04

2011/04

10/01
10/03
10/05
10/07
10/09
10/11
11/01
11/03
11/05
11/07
11/09
11/11
12/01
12/03
12/05
12/07
12/09
12/11

0

0
2009/04

2012/04

Figure 6: Number of Infection of ConfickerA+B(per day).

Figure 10: Change in the number of control systemvulnerabilities reported (Source: ICS-CERT).

2.2
7,000
6,000
5,000
4,000
3,000
2,000
1,000
0

Web Application
Other(1) Start of improvement of Hitachi Group CSIRT
activities (Phase 2)
In 2010, we started improvements of Hitachi GroupCSIRT activities with the goal of "installing incident
operation into the whole Hitachi Group" (Figure 12). 2012
was the third year of the improvements and in it we started
Phase 2 (Figure 11), which is to strengthen collaboration
inside the Hitachi Group through the HIRT supporting staff(staff who work with the HIRT Center to actively promote
IRT activities).

Figure 7: Number of Vulnerabilities Reported(Source: NIST NVD).


2,500
2,000
1,500

HIRT Activities

This subsection describes the HIRT activities in 2012.

1998
1999
2000
2001
2002
2003
2004
2005
2006
2007
2008
2009
2010
2011
2012

Number of vulnerabilities

2004

Figure 9: Changes in the number of vulnerabilities reported
for websites (Source: IPA and JPCERT/CC).

Figure 5: Number of Infection of USB Malware(per month).

Cross-Site Request Forgery (CSRF)
Path Traversal
SQL Injection
Cross-Site Scripting (XSS)

1,000
500



0

Disseminating Countermeasure Information
through HIRT OPEN Meeting

We continued with rounding out the countermeasure
dissemination through HIRT OPEN Meeting, and in
addition we had the IRT supporting staff assist as
instructors in mainly hands-on seminars (Figure 8: Changes in the number of vulnerabilities reported
for software products of web application(Source: NIST NVD).
Copyright © HIRT. 2012. All rights reserved.

Drawing up a list of check points to be re-verified
in FY 2011

Carrying on from FY 2010, we compiled into a list ofcheck points the issues that had emerged through security
reviews, incident response support and other operations.
For FY 2011, we drew up as check points the issues duringsystem construction, at the start of service provision and formaintenance.

1998
1999
2000
2001
2002
2003
2004
2005
2006
2007
2008
2009
2010
2011
2012

Number of Vulnerabilities

2003

08/01
08/04
08/07
08/10
09/01
09/04
09/07
09/10
10/01
10/04
10/07
10/10
11/01
11/04
11/07
11/10
12/01
12/04
12/07
12/10

1998

0

2002

200

2001

400

2000

600

Cross-Site Request Forgery (CSRF)
Path Traversal
SQL Injection
Cross-Site Scripting (XSS)

1,600
1,400
1,200
1,000
800
600
400
200
0

1999

WORM_DOWNAD(Conficker)
WORM_AUTORUN
MAL_OTORUN

800
Number of reports

Number of Vulnerabilities

HIRT: Annual Report 2012

4

HIRT: Annual Report 2012

Table 4) [*b] as part of moving forward with Phase 2.
Through these activities, we expanded the IRT supporting
staff who are able to assist in each field.

lead in studying and moving ahead with CSIRT activities
tailored to domains (Figure 14).

All Business Divisions of Hitachi & Group Companies
・Security information
・Security review consulting
・Technical support for evaluation tools
SI Vender IRT
・Education planning and provision

As a part of the strengthening of collaboration with HIRT
supporting staff, we started holding periodic (once or twice
per term) Advanced HIRT OPEN Meeting that iscoordinated with existing ML for horizontal disseminationof IRT activities. The Advanced HIRT OPEN Meeting
handles subjects such as targeted attacks that have actuallyoccurred, and attack methods, undetermined informationand so forth that have come under attention. They further
have the objective of creating sites for practicing"face-to-face information exchange instead of facelessinformation exchange", and thereby offering the IRT
supporting staff opportunities to experience aspects of IRT
activities while broadening their horizons.

Product Vendor IRT

HIRTCenterAnalysis, study ofcountermeasures

Sections that needsupportCollaboration with IRTs and
IRT supporting staff

Internal User IRT

Staff combining HIRTwith other duties

Utilization of HIRT OPEN
Meetings

IRT supporting staff

FY 2012Figure 11: Phase 2 activities.

Phase 3
Establish a virtual, horizontal incident response framework(HIRT Center - IRT - IRT supporting staff) >>> Install and promote theincident operations throughout the whole Hitachi Group

Three-tiered cycle for Incident Response andReadiness

All Business Divisions of Hitachi & Groups Companies

In countering cyber attacks, incident responses(after-the-fact counter-actions) are of course important forresolving vulnerability cases when they occur, but it is also
indispensable to promote readiness (before-the-factcounter-actions) based on incidents and trends. Accordingly,
by taking an "Three-tiered cycle for Incident Response andReadiness" approach (Figure 13) that incorporates theperspectives of individual business domains, we arepromoting readiness (before-the-fact counter-actions) for
individual business domains while clarifying therole-sharing and collaboration with the sections.
Issue identification
Reconsideration of security
review consulting and incident
response experiences

Countermeasure
dissemination(3) Trial IRT activities for individual domains


FY 2011

FY 2010(2) Start of Advanced HIRT OPEN Meeting

SI Vender IRT
Business Division orGroupcompany IRT
事業部・グループ会社IRT- Security information- Security review consulting- Technical support for evaluation tools- Education planning and offering

Operation Chief

HIRT
CenterPhase 1

実行責任者

Units that need support

Vulnerability
Handling Chief
脆弱性関連情報

ハンドリング責任者
IRT連絡窓口担当者

IRT Liaison Staf f

Product Vendor IRT

Phase 2

Internal User IRT

Strengthen Partnershipwith IRT supporting staff

IRT supporting staff

Improve Collaboration with Business Divisionsand Group Companies' IRT

Category
Phase 1

HIRT-FIS: Advanced endeavor in the financial
domainOn October 1, 2012, we organized up HIRT-FIS(Financial Industry Information Systems HIRT) inside ourfinancial section. Positioned as a subset of HIRT for aparticular field, HIRT-FIS is one of the endeavors for
putting into effect the three-tiered cycle for Incident
Response and Readiness and aims to be a path breaking
CSIRT professional team tailored to the financial domain.
Its background is that we considered that in the area ofcyber attack countermeasures, there was a need for
responses in line with the background circumstances andtrends in particular domains, and are therefore taking thePhase 2Phase 3[*b] HIRT Open Meeting
HIRT Open Meeting is an activity is to popularize the HIRT community on
the basis of relationships of trust. The meetings are held in line with
policies of "offering an opportunity for HIRT Center members to share
information about HIRT activities", "offering an open event for people ofthe Hitachi Group to learn about the HIRT Center's activities for the HIRT
Center members to share information with and get opinions from non
HIRT Center members", and "providing an opportunity to call forparticipation in the HIRT community on the basis of relationships of trust".
HIRT Open Meeting (Technical Meeting)Technical Meeting is for designers, system engineers and persons willingto share their technical expertise come together to share and learn thetechnical know-how necessary to build security into products and services.

Concrete Measures
Improve Collaboration with IRT of Business
Divisions and Group Companies- Promote support activities with the collaboration
between the IRT of Business Divisions and Group
Companies- Establish an IRT coalition framework andmechanism to share technological know-how using
the HIRT OPEN Meetings- Disseminate information about
solutions/countermeasures for the problems
discussed in the security review consultation.
Strengthen Partnership with IRT supporting staffs- Trial collaboration with IRT supporting staffs (ofbusiness divisions and group companies)- Bottom up the IRT activities with the IRT
supporting staffs as a starting point
Establish Virtual, Horizontal Incident Response
System- Promote various support activities by the HIRT
Center, IRTs and IRT collision support members- Develop a HIRT in a broad sense (virtualorganization model) by combining the user
collaboration model (Phase 1,2) and entity
collaboration model (Phase 3).

Figure 12: Scenario on a Virtual, Horizontal
Incident Response System.

5

Copyright © HIRT. 2012. All rights reserved.

HIRT: Annual Report 2012(4) Scoring CVSS to security information at the HIRT
websiteTable 4: HIRT OPEN Meeting (Technical meeting) in
2012.
Month
March

We have begun scoring basic CVSS (Common
Vulnerability Scoring System) values to the informationthat is published by the HIRT website. These values areindicated alongside the titles of the information. In cases
where one security information item covers multiple
vulnerabilities, we select the largest value among the CVSS
score items.

Outline[External instructor]
Nobuo Miwa (S&J Consulting)
Framework for Promoting Security Measures in
Organizations[IRT supporting staff]
Hands-on: Forensics at a compromised SSH
system[IRT supporting staff]
Hands-on: Guide to Drawing Up Basic Security
Specifications - Group discussion using
Worksheet 1 [External instructor]
Haruto Kitano (Oracle Corporation Japan)
Elements and Implementation of Database
Security
Seminar of countermeasures for external server
vulnerabilities checking[External instructor]
Daisuke Inoue (National Institute of Information andCommunications Technology)
Trends in Cyber Attacks and the Cutting Edge ofCyber Security Research
Cyber Attack Countermeasures at a Defensive
Perspective[External instructor]
Tetsutaro Uehara (The Research Institute ofInformation Security (NPO))
A Look Back Over Remote Control Incidents, theFirstserver Problem and the Leap-Second
ProblemMay

July

AugustSeptember

OctoberNovember[Example]
Cross-site scripting (XSS) vulnerability in Hitachi IT
Operations product(CVSS:<a href="http://jvndb.jvn.jp/cvss/ScoreCalc2.swf?
name=HS12-001&vector=(AV:N/AC:M/Au:N/C:N/I:P/A:N)&lang=ja&g=1">4.3</a>)(5) Strengthening of Partnership with the CSIRT
community

Together with NTT-CERT，OKI-CSIRT and JPCERT/CC,
we held on February 29, 2012 the CSIRT Workshop 2012as an opportunity for exchange of opinions on corporate
CSIRT, targeting corporate staff interested in CSIRT
activities[ 11 ]. Besides presenting examples of CSIRT
implementation and CSIRT organization activities inJapanese companies, this workshop featured a lecture titled"The Government's Endeavors for Strengthening
Public-Private Collaboration and Collaboration with Private
CSIRTs and the Like", given by an official from the
National Information Security Center.
Industrial
Financial
Customer system Service provisionsystem(1) Incident(1) IncidentInternal infrastructure(1) Incident(2) Incident response[responsibility: Cyber
Countermeasures Office](4) Incident readiness(3) System for cyber attack(3) Industry standards for cyber attack
countermeasurescountermeasures[responsibility:
Cyber[responsibility: IRT for theCountermeasures
Office]industry domain]

This Technical Colloquium had the theme phrase"Incident Response: Collaboration and Sharing" and was
utilized as a site for working toward building a frameworkfor swift and optimal responses based on strong
relationships of trust among CSIRTs. Also, on the "Summit
Days" when attention was focused on particular topics, we
had exchanges of views on "Future of Global Vulnerability
Reporting".

(6) Incident readiness(5) Security measures compromised(5) Security measures compromisedby novel attacks
by novel attacks[responsibility: HIRT]

Figure 13: System view of "Three-tiered cycle for Incident
Response and Readiness" approach.



HIRT-FIS
GeneralHIRT::Specific

Financial domain
HIRT-FIS(Financial Industry
Information Systems HIRT)

・・・ domain
HIRT-###

Participation in MWS (anti Malware engineering
workshop) 2012

Through our participation in MWS we are supporting
research activities for malware countermeasures, andFigure 14: Positioning and framework of IRT activities forindividual industry domains
Copyright © HIRT. 2012. All rights reserved.

Launching of FIRST VRDX-SIG

In order to continue with study of "Future of Global
Vulnerability Reporting", which was raised at the FIRSTTechnical Colloquium 2012 Kyoto, we launched a
Vulnerability Reporting and Data eXchange SIG (Special
Interest Group) inside FIRST.

Framework

Domains

Holding of FIRST Technical Colloquium 2012
Kyoto

Together with the FIRST member teams in Japan, we helda FIRST Technical Colloquium at the Kyoto International
Community House from November 13 to 15, 2012 [12].
The FIRST Technical Colloquiums are gatherings held in
various regions roughly 3 or 4 times a year.

(2) Incident response[responsibility: QA]

Positioning

Holding of CSIRT Workshop 2012

6

HIRT: Annual Report 2012

through such support activities we are also aiming tocontribute to the fostering of academic human resourcesthat will feed into the next-generation CSIRT community.

was the fact that the vulnerability in SNMP [16] reportedby CERT/CC had affected large numbers of Hitachi
products. The impetus for the third phase - establishing of
the SI Vendor IRT - was the commencement of theInformation Security Early Warning Partnership. The HIRT
Center was set up to play the role of coordinator inside
Hitachi and with external entities, after the other three IRTs
had largely taken shape.

(6) Other Activity






Created a guidebook for new FIRST members [13]Gave a report on a "Feasibility study of scenario-based
self-training material for incident responses" at the24th Annual FIRST Conference [14]Contributed a paper on vulnerability countermeasures
titled "Must-Read Vulnerability Information" to the
ITpro CSIRT Forum held by Nikkei Business
Publications, Inc. [15]Published a report on HIRT's activities on our security
information portal (Table 5).
Table 5: Reports Publishedon the Security Information Portal.

Number
HIRT-PUB12001

3

Title
Topics in 2011 Regarding Problems forTransition from Old-Generation
Encryption (commonly known as"Encryption Problems 2010")

HIRT

To give you an in-depth understanding of HIRT, thissection describes the organizational model adopted, the
HIRT/CC, a coordinating unit, and the activities currently
promoted by the HIRT/CC.

3.1

Figure 15: Four IRTs as an organizational model.

Organizational Model

Table 6: Role of each IRT.
Category
HIRT/CC

We have adopted an organizational model that consists offour IRTs (Figure 15 and Table 6). There are three IRTs forthe case with Hitachi Group itself; Product Vendor IRT; SI
Vendor IRT, and Internal User IRT; each corresponding to
one of the IRT's aspects: the Product Vendor IRT
corresponds to the aspect of developer of products such as
information systems and control systems, the SI Vendor
IRT to that of a system integrator/service provider that uses
those products, and the Internal User IRT to that of aninternet user that operates and manages its own enterprise.
By adding to these a fourth IRT - the HIRT/CC (HIRT
Coordination Center), which carries out coordination work
among the others - a model is obtained which we
considered would be able to implement efficient andeffective security measure activities that achieve
collaboration among the IRTs, while making clear theirindividual functions. The name "HIRT" signifies theincident operation activities promoted by the Hitachi Group
as a whole, in the broad sense, and signifies the HIRT/CC(HIRT Center) in the narrow sense.

SI Vendor
IRT

Product
Vendor IRT

Internal
User IRT

In fact, four phases (set forth in Table 7) had to be gone
through in order to put the four IRTs in place. For eachphase, there was an "impetus" that encouraged
organizational formation. For instance, the impetus for thesecond phase - establishing of the Product Vendor IRT 7

Role
Corresponding sections: HIRT/CC- Provides a point of contact to external CSIRT
organizations, such as FIRST, JPCERT/CC andCERT/CC.
- Provides coordination among the SI Vendor,
Product Vendor and Internal User IRTs.
Corresponding sections: Sections providing
SI/services- Promotes CSIRT activities for customer systems.
- Provides customer systems with equivalent
security against reported vulnerabilities to thatfor internal systems.
Corresponding sections: Sections developing
products- Provides support to promote vulnerability
measures for Hitachi products and the release of
information concerning such countermeasures- Promptly investigates whether a reported
vulnerability has an impact on Hitachi products,
notifies users of the impact, if any, and provides
a security fix.
Corresponding sections: Sections administeringinternal infrastructures- Provide support to promote security measures forinternal networks lest Hitachi websites should be
used as a base for making unauthorized access.

Copyright © HIRT. 2012. All rights reserved.

HIRT: Annual Report 2012

Table 7: Phases until the organization was formed.
Phase
April 1998
1st phase
Establishing theInternal User IRT(1998 - 2002)

2nd phase
Establishing the
Product Vendor
IRT(From 2002 -)3rd phase
Establishing the
SI Vendor IRT(From 2004 -)October 2004

3.2

among components in the information systems.

Overview
We started CSIRT activities as a project toestablish a Hitachi CSIRT framework.
In order to run a Hitachi CSIRT on a trial
basis, we formed a cross-sectional virtual
team within the Hitachi group to start
mailing list based activities. Most of themembers comprised internal security experts
and those from sections administeringinternal infrastructures.
In order to start conducting activities
seriously as a Hitachi CSIRT, the sections
developing products played a central role inestablishing an organizational structure of
the Product Vendor IRT with related
business sites through cooperation frominternal security experts, the sections
administering internal infrastructures, thesections developing products and the Quality
Assurance Department.
We started to form an SI Vendor IRT withthe sections providing SI/services. In order toswiftly implement proactive measuresagainst vulnerabilities, as well as reactive
measures against incidents, via partnershipwith Internet communities, we started toform HIRT/CC, which provides a point ofcontact for external organizations andenhances coordination among Internal IRTs.
We established the HIRT/CC.

3.3

The main activities of the HIRT center currently being
promoted include CSIRT activities for internalorganizations (Table 8) and those for external organizations(Table 9). The internally-oriented CSIRT activities
comprise issuing alerts and advisories that embody theknow-how obtained through gathering and analyzing
security information. Besides those, we are currently
engaged in activities to feed such knowledge back into
product development processes in the form of various
guidelines and support tools.
HIRT security information in internally-oriented alerts andadvisories has been broken down into two types since June
2005. One is HIRT security information that aims to
distribute alerts and hot topics widely, and the other is
HIRT-FUP information, which is used to request individual
sections to take counter-action.This distinction is for thesake of information propagation and priority ranking.
(Table 10 and Figure 17). To communicate information
efficiently, we condense it to reduce the number of
information items and release it in tandem with the IT &Security Strategy Division and the Quality Assurance
Division.
We are now promoting activities to expand the HitachiGroup's commitment to product and service security toInternet users via our security portal website, as a proactive
measure against vulnerabilities, as well as reactive
measures against incidents.

Position of HIRT/CC

The HIRT/CC is positioned under Information andTelecommunication Systems Company and has the role of
not only a coordinator within and with the entities outside
Hitachi but also a leader in promoting security technology.
The main area of activity is to support the Product andService Security Committee technically, to promotesecurity efforts from the technical and institutional aspect incooperation with the IT and Security Strategy Division,
Information Technology Division and Quality Assurance
Division.

Information
Information andand Telecommunication
Telecommunication Systems
Systems
Information Management
Headquarters
Information Management
Committee

Moreover, it also includes helping each business divisionand group company implement proactive security measuresagainst vulnerabilities, as well as reactive measures against
incidents, and promoting security measures throughpartnerships among organizations as a point of contact for
CSIRT activities in the Hitachi group (Figure 16).

Leader of a
Headquarters
system aspect Headquarters
IT & Security
Strategy Division
Information Technology
Division
Quality Assurance Division

Information Security Planning
Committee

Mutual cooperation in technicaland system aspects

Product and Service Security
Committee- Providing support for vulnerability
and incidents response- Providing information, consulting
and cooperation

HIRT
HIRTCenter
CenterLeader of a technical aspect
Point of contact for Hitachi IRTs
(Mutual corporation among organizations)

The organization of the HIRT/CC features the
combination of vertical and horizontal collaboration ofpeople and units. More specifically, this model has
achieved a flat and cross-sectional organizational system
for implementing measures and coordinating ability throughdistribution if functions by creating a virtual organizationconsisting of dedicated personnel and those who areassigned to HIRT as an additional task. Such organization
is based on the concept that the performance of duties by
each section and cooperation among sections are necessary
to solve security issues, given the great diversification
Copyright © HIRT. 2012. All rights reserved.

Main Activities of HIRT Center

Operation Chief
Vulnerability
Handling Chief
IRT Liaison StaffAll
All BusinessBusiness Divi
Divisionssionsofof Hitachi
Hitachi&& Groups
Groups Companies
Companies

External
External IRT
IRT communities
communities-- CSIRT
CSIRTorganizationsorganizations (CE(CERT/CC
RT/CC (US),(US), CPCPNI
NI (UK(UK),), JPCEJPCERT/CC
RT/CC (JP))(JP))-- Governmental
Governmental organizationsorganizations (Cabinet(Cabinet Secretariat,
Secretariat, Ministry
Ministry ofofEc
Economy,onomy, Trade
Trade andandIndustry,
Industry, Ministry
Ministry ofofInternalInternal Affairs
Affairs andand Communications,
Communications, National
National Police
Police Agency,
Agency,etc.)
etc.)-- ProductProduct andand software
software vendors
vendors (Mic
(Microsoft,rosoft, FFR,
FFR, etc.)
etc.)-- ISP
ISP (NTT,(NTT, IIJ,
IIJ, etc.)
etc.)-- Security
vendors(IBM-ISS,
LAC,
Trend
Micro,
SecureSecurity vendors (IBM-ISS, LAC, Trend Micro, Secure Brain)
Brain)

Figure 16: Position of HIRT Center.

8

HIRT: Annual Report 2012

Table 10: Classification of security information
issued by HIRT.

HIRT-FYIyynnn

Strengthening theoverseas
partnership for
CSIRT activities

Developing aframework forresearch activities

180
160
140
120
100
80
60
40
20
0

HIRT-FYIHIRT-FUP

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

HIRT

Figure 17: Number of issues of security information
by ID number.

Table 9: (Externally) promoting projects.
Category
Strengthening thedomestic
partnership for
CSIRT activities

Usage
Priority: Urgent
Distributed to: Only relevant sections
Is used to notify relevant sections of avulnerability when an HIRT member has
found such vulnerability in a Hitachi groupproduct or a website, or received suchinformation.
Priority: Middle - HighDistributed to: No restriction
Is used to widely call attention to proactive
measures against vulnerabilities, as well asreactive measures against incidents.
Priority: Low
Distributed to: No restriction
Is used to notify people of HIRT OPEN
Meetings or lecture meetings.

2001

Developing aframework forresearch activities

HIRT-yynnn

1999

Enhancing security
technology for
products/services

ID number
HIRT-FUPyynnn

1998

Promotingproactive measuresagainstvulnerabilities, aswell as reactive
measures against
incidents for
products/services

Overview- Promoting Information Security Early
Warning Partnership (Information
concerning proactive measures against
vulnerabilities, as well as reactive
measures against incidents/horizontal
deployment of know-how)- Building a wide area observation network
based on the Hitachi Security Operation
Center Information eXchange (SOC-IX)- Reinforcing the security foundation
within the Hitachi Group througheducation for sections addressing
security within the companies- Accumulating and deploying technicalknow-how for countermeasures against
vulnerabilities and incident response- Promoting the publication of security
information from external websites using
the Security Information Integration Site
- Improving the process to provide security(each guideline for development,
inspection and operation)- Enhancing and expanding support andprocesses though internal support
activities- Enhancing web application security- Developing a framework for joint
research with the Yokohama ResearchLaboratory (for P2P observation, etc)

Number of issues

Category
Collecting,analyzing andproviding security
information

2000

Table 8: (Internally) promoting projects.

Overview- Deploying proactive measures against
vulnerabilities based on the Information
Security Early Warning Partnership- Promoting activities related to the Nippon
CSIRT Association- Improving partnerships with overseas
CSIRT organizations/product vendor
IRTs through lectures or events at FIRST
conferences- Promoting UK WARP related activities.
- Countermeasures against vulnerabilities,
such as CVE and CVSS, andstandardization of incident response(ISO, ITU-T) [*c]- Establish a joint research between Tokai
University (Professor Hiroaki Kikuchi)
and HIRT.
- Participating in academic research
activities, such as a workshop to develop
human resources for research on
malware countermeasures (MWS) [17]Figure 18: Conceptual view of issuing information based on"Emergency Level" x "Website Level".

In particular, for issuing security information forvulnerabilities and incidents, to external entities, we also
adopt an approach in which an "Emergency Level" of
information is determined and a "Website Level" at which
the information is to be published is selected, in addition tojust routinely publishing security information via our
security portal website (Figure 18).

[*c] Work had begun in 2007 in ISO SC27/WG3 to develop aninternational standard "Vulnerability Disclosure (29147)". Work had begun
in 2009 in ITU-T SG17 Q.4 to develop an international standard "Cyber
security Information Exchange Framework (X.cybex)".

9

Copyright © HIRT. 2012. All rights reserved.

HIRT: Annual Report 2012technical meeting) for the vulnerability-related information
handling officers and IRT liaison staff.

Activity Summary from 1998 to 2011

This section describes the activities for each year from1998 when the HIRT project started.

The Year 2011(1) Improvement of Hitachi Group CSIRT Activities(Phase 1)2011 was the second and concluding year of Phase 1, andin it we concentrated our efforts on entrenching the support
activity cycle (issue identification, analysis, countermeasuredeliberation and deployment) that links with the Divisions
and the Group company IRTs.

(2) Strengthening of Partnership with the CSIRT
Community

Drew up a list of check points to be re-verified in FY
2010
Expanded HIRT OPEN Meeting (Technical Meeting)

In December 2012, we provided support for the holding of
the Nippon CSIRT Association's International Partnership
Workshop Also, in cooperation with the Nippon CSIRT
Association's Incident Information Utilization Framework
Working Group, we carried out information disseminated[18]:(2) Disseminating Information on Vulnerability inControl System Products
We elected to deal with vulnerability in control systemproducts on a monthly basis, because the number ofvulnerabilities reported for such products had increased,
and in order to routinely determine the trends in thevulnerabilities reported.
(3) Strengthening of Partnership with the CSIRT
Community





4.2

Information on the SSL attack by the Botnet PushDo

Information about Stuxnet

Web Malware "mstmp" exploiting Mash-upJuly 2011: "Defining Security Requirements for Web
Application Development" by Hiroshi Tokumaru,
HASH Consulting Corporation
September 2011: "Difficulties and Actual Practice in
the Information Leakage Countermeasure Field Tracking Down Malicious Data Diffusion Crimes" by
Toshifumi Tokuda, IBM Japan
December 2011: "Circumstances Surrounding
Android (Trends in the Android Malware)" by
Norihiko Maeda, Kaspersky Labs Japan

Information leakage malware ratio in all files
Information leakage malware ratio in archive files

15%
10%
5%

Cooperated with the standardization activities for
ITU-T's Cybersecurity Information Exchange
Framework ("CYBEX")

2007

0%

The Year 2010

Figure 19: Change in Malware Circulating in Winny That
Causes Information Leakage.

(1) Start of Improvement of Hitachi Group CSIRT
Activities (Phase 1)
We began activities for Phase 1 of the improvement of
Hitachi Group CSIRT activities, with the goal of "installingincident operation into the whole Hitachi Group". In 2010,
the initial year of Phase 1, we concentrated our efforts on
regular holding of liaison meetings (operational and
Copyright © HIRT. 2012. All rights reserved.

In July 2010, we provided backing for the organizingof an "Academy CERT Meeting" in collaboration with
JPCERT/CC, to help Indonesia's academic CSIRT
activities [19].
"Survey on Malware Circulating Within the P2P File
Exchange Environment" [20]Since 2007, many Antinny-type known malwares thatare liable to cause information leakage have beenswarming on the "Winny" P2P file-sharing
environment (Figure 19).

20%(5) Other activities(4) Lectures


A website with the information about Gumblar
countermeasure(3) Other activity

We carried out information transmission in cooperation
with the Nippon CSIRT Association's Incident Information
Utilization Framework Working Group.




2010



Operational Meetin (once/term): for thevulnerability-related information handling officers
and IRT liaison staff, held with the objectives ofsharing and passing on the operational know-how
necessary for IRT activities
Technical Meeting (2-4 times/term): for designers,
system engineers and persons able to assist with
disseminating technological expertise, held in order
to disseminate the technological expertise necessary
for building security into products and services.

2009

4.1



2008

4

10

HIRT: Annual Report 2012

4.3

The Year 2009(2) Holding JWS2008
March 25-28, 2008, we held the FIRST Technical
Colloquium, a FIRST technical meeting, and Joint
Workshop on Security 2008, Tokyo (JWS2008), a domestic
CSIRT technical workshop, with a team of domestic FIRST
members [24].

(1) Start of Product/Service Security Feedback
To give feedback to the product development processes
about the know-how we learned from the experience ofvulnerability fighting and incident response, we started toprovide support for each process (Figure 20).

Basicknowledge

Quotation

Basic
on
Basic
courseBasic course
course on
on
web
web
application
web application
application
security
security
security

DesignSupport ofSupportSupport ofof
security
review
security
security review
review

Implementationand construction

Test
Hands-onHands-oncourse
Hands-oncoursecourse ofof webwebofapplication
web application
application
security
inspection
inspection
inspection
Training in theTrainingininthe
theTraining
use
inspectionuse ofinspectionuseofofinspecti
on
tools
tools
tools

(3) Participation in the domestic COMCHECK Drill
2008
With a view to ensuring that in-house information security
departments of various organizations could communicate
with each other, we participated in a domestic
COMCHECK Drill (Drill name: SHIWASU, was held by
the Nippon CSIRT Association on December 4, 2008).

Operation
Support for

Support for
Supportfor
adpopting
adpoptingadopting
contermeasurescontermeasurescountermeasuresinin incidents
incidents
in incidents
Support of log

Supportofof loglog
Supportchecking
checking
checking(4) Award with the Commerce and Information Policy
Bureau Chief Prize, Ministry of Economy, Trade andIndustry (Information Security Promotion Section)

Figure 20: Systematizing HIRT support activities(Web application security).

In the 2008 Information Technology Promotion Monthly
Period memorial ceremony held by Information
Technology Promotion Conference (Ministry of Economy,
Trade and Industry, Cabinet Office, Ministry of Internal
Affairs and Communications, Ministry of Finance Japan,
Ministry of Education, Culture, Sports, Science andTechnology, Ministry of Land, Infrastructure andTransport) on October 1, 2008. We were awarded with the"Commerce and Information Policy Bureau Chief Prize,
Ministry of Economy, Trade and Industry (Information
Security Promotion Section)" [25].

(2) Providing Security Engineer Training
As part of the security engineer training program utilizing
the CSIRT activities, we accepted a trainee and trained him
for six months with the focus on web system security.
(3) LecturesJuly 2009: "Web Application Security" by Hiromitsu
Takagi, National Institute of Advanced Industrial
Science and Technology (AIST)
July 2009: "NTT-CERT Activity" by, Takehiko
Yoshida, NTT-CERT(5) Lectures(4) Other Activities




4.4



"Survey on Malware Circulating within the P2P File
Exchange Environment" [21]February 2009: Gave an web application development
exercise for NTT Group at a workshop organized by
NTT-CERTIn cooperation with the Incident Information
Utilization Framework Working Group of Nippon
CSIRT Association, information dissemination using
cNotes (Current Status Notes) [22] which tries tovisualize the observational data.

April 2008: "Management of High Reliability
Organizations" by Aki Nakanishi, the Faculty ofBusiness Administration, Meiji University.

(6) Other Activity
In order to partially reveal the actual circumstances oftargeted attack as a part of efforts to develop a newinter-organization collaboration, we provided relatedorganizations with a malware-attached e-mail, which faked
itself as Call for Papers (CFP) for the symposium held by
the Computer Security Symposium 2008 of Information
Processing Societies Japan as a sample.

The Year 2008

4.5

The Year 2007

(1) Supporting countermeasures against DNS cachepoisoning vulnerability(1) Starting Hands-on Security Training at HIRT OPEN
Meetings

We held an HIRT OPEN Meeting "Roles of DNS and Useof Related Tools" in December as a countermeasure to DNS
cache poisoning vulnerability, in order to describe DNS
behavior and how to use tools. To help promote DNS cachepoisoning countermeasures in Japan, the materials prepared
for the HIRT OPEN Meeting were provided as a reference,
based on which "Countermeasures against DNS Cache
Poisoning vulnerability" [ 23 ] issued from the IPA in
January, 2009, was created.

In 2007, to promote the practical use of the guideline"Web Application Security Guideline", we provided ahands-on, exercise-based HIRT OPEN Meeting twice inMarch and June for the web application developer.
(2) Founding the Nippon CSIRT Association
In order to develop a system based on a strong trusting
relationship among CSIRTs that can successfully andpromptly react to events that single CSIRTs find it difficult
to solve, we founded the Nippon CSIRT Association with
11

Copyright © HIRT. 2012. All rights reserved.

HIRT: Annual Report 2012

IIJ-SECT (IIJ), JPCERT/CC, JSOC (LAC), NTT-CERT(NTT) and SBCSIRT (Softbank) in April 2007 [26]. As of
December 2012, 31 teams have been joined (Figure 21).

alert entitled "Prevention of Information Leakage Causedby Winny and Proactive Measures against It" based on
previous experience of threats.
(4) Starting Product Security Activities for Intelligent
Home Appliance and embedded Products

Total number of teams

35

We have started product security activities for intelligent
home appliance and embedded products. HIRT focused on
the Session Initiation Protocol (SIP), a call control protocol
used for Internet telephony, and summarized related
security tools and measures into a report.

30
25

20
15
10

(5) Strengthening Partnership with the CSIRT
Community

5
0

1998
1999
2000
2001
2002
2003
2004
2005
2006
2007
2008
2009
2010
2011
2012

In March 2006, we introduced Hitachi's CSIRT activities
in a workshop held by NTT-CERT to exchange information
to improve CSIRT activities with each other.

Figure 21: Change in Number of Nippon CSIRT
Association Members.

(6) Lectures(3) Joining UK WARP

In order to strengthen the overseas partnership on CSIRT
activities, we joined the Warning, Advice and Reporting
Point (WARP), promoted by the Centre for the Protectionof National Infrastructure (CPNI), a British government
security organization, in May 2007 [27].

(7) Other Activities
(4) LecturesMay 2006: "Security for embedded systems", by Yuji
Ukai, eEye Digital Security
September 2006: "Measures against Botnet inTelecom-ISAC Japan", by Satoru Koyama,
Telecom-ISAC Japan

July 2008: "Vulnerability Assessment through Static
Analysis" by Yuji Ukai, Fourteenforty ResearchInstitute, Inc.

4.7

Starting to sign a digital signature to technicaldocuments (PDF files) issued from HIRT [28]The Year 2005

(1) Joining FIRST

4.6

The Year 2006

In January 2005, to boost experience in CSIRT activities
while creating an organizational structure to addressincidents in partnership with CSIRT organizations overseas,
we joined the Forum of Incident Response and Security
Teams (FIRST), an international community for computer
incident handling teams [ 29 ]. The preparation period
extended for about one year, since any team wishing to join
the community must obtain recommendations from two
member teams before doing so.

(1) Providing a Unified Point of Contact for
Vulnerability ReportingIn
November
2006,
in
order
to
circulatevulnerability-related information properly in the Hitachigroup and thereby promote measures against vulnerabilities
in Hitachi software products and websites, we provided aunified point of contact for receiving reports onvulnerabilities found in software products and web
applications.

As of December 2012, a total of 269 teams have joined
this community. The following 23 Japanese teams havejoined: CDI-CIRT (Cyber Defense Institute), CFC (Cyber
Force Center of the National Police Agency's
Info-Communications Bureau), DeNA CERT (DeNA)，FJC-CERT (Fujitsu)，HIRT (Hitachi)，IIJ-SECT (IIJ)，
IPA-CERT (Information-technology Promotion Agency),
JPCERT/CC ， JSOC (LAC) ， KDDI-SOC (KDDI) ，
KKCSIRT (Kakaku.com)，MBSD-SIRT (Mitsui Bussan
Secure Directions) ， MIXIRT (Mixi) ， MUFG-CERT(Mitsubishi UFJ Financial Group)，NCSIRT (NRI Secure
Technologies), NISC (National Information Security
Center) ， NTT-CERT (NTT) ， NTTDATA-CERT (NTT
Data) ， Panasonic PSIRT (Panasonic) ， Rakuten-CERT(Rakuten)，RicohPSIRT (Ricoh)，SBCSIRT (Softbank) and
YIRD (Yahoo) (Figure 22).

(2) Enhancing Web Application Security
In October 2006, as part of security measures of web
application in the Hitachi group, we created guidelines andchecklists and provided support for their implementation in
the Hitachi group. We updated "Web Application Security
Guide (Development) V2.0" by adding new vulnerabilities,
such as LDAP injection and XML injection, and a method
for checking the existence of such vulnerabilities.
(3) Calling Attention to Information Leakage Caused by
P2P File Exchange Software
Antinny is a virus that has penetrated widely via "Winny",
file exchange software that appeared in August 2003. The
virus causes infected PCs to leak information and attack
particular websites. In April 2006, HIRT issued a security
Copyright © HIRT. 2012. All rights reserved.

12

HIRT: Annual Report 2012

4.8
Total number of teams

30

250

25

200

20

150

15

100

10

50

5

0

0

(1) Participating in the Information Security Early
Warning Partnership

Total number of Japanese teams

Total number of Japanese teams

1998
1999
2000
2001
2002
2003
2004
2005
2006
2007
2008
2009
2010
2011
2012

Total number of teams

300

The Information Security Early Warning Partnership
started in July 2004 when the "Standard for Handling
Information Related to Vulnerabilities in Software, etc."
was implemented [30][31].
The Hitachi group registered itself as a productdevelopment vendor to the Partnership, using HIRT as apoint of contact, and started publishing Hitachi'svulnerability handling status on JP Vulnerability Notes(JVN) [32].

Figure 22: Changes in the number of members of FIRST.

(2) Enhancing Web Application Security
In November 2004, we created the "Web Application
Security Guide (Development), V1.0" and distributed it
throughout the Hitachi group. The guide summarizes
typical problems that need to be considered when designingand developing web applications, and provides an overview
of measures taken to solve such problems.

(2) Setting Up a Security Information Portal Site
In September 2005, in order to provide Internet users withcomprehensive information on security problems applicableto the products and service of the Hitachi group, we set up a
security information portal site within which the security
information provided through the websites of Hitachi
business divisions and group companies is integrated(Figure 23). We also created "Guidance for Providing
Security Information from Websites to External Users,
V1.0".

(3) Lectures

4.9

Releasing information to the public Request for investigation

Security information portal site:
Japanese: http://www.hitachi.co.jp/hirt/
English: http://www.hitachi.com/hirt/

Information
disclosure

Request forinvestigation

Affected products
and mesurements

Providing security
information via adomestic security portalsite

HIRT/CC
Aggregating
statusInformation
disclosure

Request forinvestigation

Sections developing
products

Affected
products

Investigationand measures
Preparing for
information
disclosure

Measurements

Providing security
information via Hitachigroup security potal site

January 2004: "Security business affairs after Blasterin the US", by Tom Noonan, President and CEO ofInternet Security Systems (ISS)The Year 2003

(1) Starting Web Application Security Activities
We started to consider a method for enhancing web
application security and developed the "Procedure forCreating a Security Measure Standard for Web Application
Development V1.0" with business divisions.

The Hitachi group
IPA, JPCERT/CC
Information
Security Early
Warning
Partnership

The Year 2004

(2) Disseminating Vulnerability Information fromNISCC throughout Hitachi
Following the dissemination of vulnerability informationfrom CERT/CC in 2002, we started obtaining/publishing
information in accordance with the NISCC (currently,
CPNI) Vulnerability Disclosure Policy. 006489/H323 ofJanuary 2004 for security information on a Hitachi productwas first published in NISCC Vulnerability Advisory after
starting the activity [33].

Providing businessdivisions and subsidiarycompanies with security
information

Figure 23: Providing security informationon the Hitachi security information portal.

(3) Providing a Point of Contact for External
Organizations
In line with the more active reporting and releasing of
information concerning the discovery of a vulnerability[34], we provided a point of contact, as shown in Table 11,that initiates actions when vulnerabilities or malicious
actions in Hitachi products and Hitachi-related websites arepointed out.

(3) Strengthening the Domestic Partnership for CSIRT
Activities
To strengthen the domestic partnership for CSIRT
activities, we hold meetings with domestic teams that are
members of FIRST, and individual meetings with
NTT-CERT and Microsoft Product Security Team (PST) to
exchange opinions, and have established a contact network
to be used, for example, when a website is found to havebeen tampered with.

13

Copyright © HIRT. 2012. All rights reserved.

HIRT: Annual Report 2012

June 15, 2001 to June 30, 2002, based on the log data fromthe websites on the Internet. For CodeRed II and Nimda(Figure 25), which caused significant damage in Japan, thelog reveals that the time span between the time at which theattack was first logged and the date on which attacks
occurred most frequently was only approximately two days,
indicating that damage caused by the worms had spread
rapidly and widely.

4.10 The Year 2002
(1) Disseminating Vulnerability Information from
CERT/CC throughout Hitachi
SNMP vulnerability [16] reported from CERT/CC in 2002
affected a wide range of software and devices. This
provided an opportunity to start the Product Vendor IRT
and obtaining/publishing information based on the
CERT/CC Vulnerability Disclosure Policy [ 35 ].
VU#459371 of October 2002 for security information on
Hitachi product was first published in the CERT/CC
Vulnerability Notes Database after commencing thisactivity [36].

1,800
access counts
Number of 痕跡数

1,600(2) Assisting JPCERT/CC in Building Vendor Status
Notes

2002/Jun/20

2002/May/31

2002/May/11

2002/Apr/1

2002/Apr/21

2002/Mar/12

2002/Jan/31

2002/Feb/20

2002/Jan/11

2001/Dec/2

2001/Dec/22

2001/Nov/12

2001/Oct/3

2001/Oct/23

2001/Sep/13

2001/Aug/4

2001/Aug/24

2001/Jul/15

2005▲ JVN working group formed in June 2002
▲ Trial site (jvn.doi.ics.keio.ac.jp) to the public in February 2003
▲ JVNRSS stared in July 2003
▲ VN-CIAC stared in December 2003

Note that as severity metrics for vulnerabilities vary,depending on organizations, the Common Vulnerability
Scoring System (CVSS) [43] was proposed as a common
language with which to evaluate the severity ofvulnerability in a comprehensive and general way in 2004.

▲ TRnotes stared in January 2004
▲ jvn.jp to the public in June 2004

Figure 24: Building and running a JVN trial site.

4.11 The Year 2001
(1) Investigating the Activities of Worms Attacking Web
Services
We investigated the activities of worms attacking web
services in 2001, CodeRed I, CodeRed II and Nimda, from
Copyright © HIRT. 2012. All rights reserved.

200

CERT/CC publishes notes called "Vulnerability Notes"[ 39 ] for vulnerability. It provides the Severity Metricindicating the severity of vulnerability [ 40 ] Common
Vulnerabilities and Exposures (CVE) classified information
security vulnerabilities into "Vulnerabilities" and"Exposures" and focuses on the former [41]. The former isdefined as mistakes in software to violate a reasonablesecurity policy and the latter as environment-specific,
configuration issues or mistakes in software used to violatea specific policy. The National Institute of Standards andTechnology (NIST) uses whether or not a CERT advisory
and CVE identifier number has been issued as a guide to
determine the severity of vulnerability, and classifies
vulnerabilities into three levels in the ICAT Metabase [42],a predecessor of NVD.

2004/07/08~
Running official website

2003/02/03~2004/07/07
Trial site running period

400

In order to measure the severity level of vulnerability
exploited for destructive or security-compromising
activities, we investigated the severity metrics used byrelevant organizations and summarized the results into areport.

KeyID = 2301A5FA
Key fingerprint
7BE3 ECBF 173E 3106 F55A
011D F6CD EB6B 2301 A5FA
pub 1024D/ 2003-09-17
HIRT: Hitachi Incident Response Team

2004

600

(1) Investigating the Severity Metrics for Vulnerabilities"HIRT": Hitachi Incident Response Team.
890 Kashimada, Saiwai, Kawasaki City,
Kanagawa, 212-8567

2003

800

4.12 The Year 2000

E-mail

2002

1,000

Figure 25: Changes in the number of Nimda log counts
found during the observation period (for Nimda).

Table 11: Information on point of contact.

PGP key

1,200

0

We provided support to build and operate a trial website,
JPCERT/CC Vendor Status Notes (JVN)(http://jvn.doi.ics.keio.ac.jp/), in February 2003, as an
attempt to improve the domestic circulation of security
information (Figure 24) [37][38]. With the implementationof the "Standard for Handling Information Related toVulnerabilities in Software, etc." in July 2004, the roles of
the trial site were transferred to Japan Vulnerability Notes(JVN), a site releasing information on reported
vulnerabilities (http://jvn.jp/en/index.html).

Name
Address

1,400

14

HIRT: Annual Report 2012

new forms of collaboration utilizing CSIRT, in such ways
as promoting CSIRT activities tailored to particularindustry types and other fields, and making contributions tothe cultivation of academic human resources that will leadto the formation of the next-generation CSIRT community.

4.13 The Year 1999
(1) Launch of the hirt.hitachi.co.jp domain
To improve the provision of security information to the
Hitachi group, we created an internal domain for HIRT
projects to set up a website (hirt.hitachi.co.jp) in December
1999.

(May 14, 2013)(2) Investigation of website defacement

Number of website defacements

Website defacement was a major type of incidents since it
occurred for the first time in the US in 1996 until the
network worm era started (2001 - 2004). We conducted a
research on webpage defacing from 1999 to 2002 to findout how malicious activities were performed (Figure 26).

References
1) National Information Security Center: Forms to be
Taken by Public-Private Collaboration Regarding
Information Security Measures,

3,000
2,500
2,000

http://www.nisc.go.jp/conference/suishin/ciso/dai4/pdf/1-1.pdf

2) Eric M. Hutchings et al.: Intelligence-Driven Computer
Network Defense Informed by Analysis of AdversaryCampaigns and Intrusion Kill Chains (ICIW2011)
3) Information-technology Promotion Agency, Japan:
Cyber Information Sharing Initiative (J-CSIP)

1995/01
1995/07
1996/01
1996/07
1997/01
1997/07
1998/01
1998/07
1999/01
1999/07
2000/01
2000/07
2001/01
2001/07
2002/01
2002/07

1,500
1,000
500
0

http://www.ipa.go.jp/security/J-CSIP/

4) National Police Agency: Updated Information On CyberIntelligence During the First Half of FY2012

Figure 26: Changes in the number of websites defacements.

http://www.npa.go.jp/keibi/biki3/20120823kouhou.pdf

5) Trend Micro Incorporated: Report on Internet Threat,

4.14 The Year 1998

http://jp.trendmicro.com/jp/threat/security_news/monthlyreport/index.html

6) Conficker Work Group - ANY - Infection Tracking,(1) Starting to provide HIRT security information

http://www.confickerworkinggroup.org/wiki/pmwiki.php/ANY/InfectionT
racking

In April 1998, we started to provide information on
security measures mainly using an internal mailing list andan internal website for HIRT projects. This information isbased on the security information issued by CERT/CC,
JPCERT/CC, and product vendors (Cisco, HP, Microsoft,
Netscape, Sun Microsystems, etc.).

7) NIST NVD (National Vulnerability Database),
http://nvd.nist.gov/

8) Information-Technology Promotion Agency, Japan:
Quarterly Reports,
http://www.ipa.go.jp/security/english/quarterlyrep_vuln.html

9) Symantec: "The Elderwood Project",
http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the-elderwood-project.pdf(2) Lectures

10) EMC: "The VOHO Campaign: An In-Depth Analysis",

On June 25 - 26, 1998, we provided "Network security"
training for Hitachi. We invited an US security expert who
had also participated in the US Security Conference
DEFCON [44] as a speaker as an instructor.

http://www.emc.com/collateral/hardware/solution-overview/h11146-the-vo
ho-campaign-so.pdf

11) CSIRT Workshop 2012,
http://www.hitachi.co.jp/hirt/topics/20120229.html

12) Kyoto 2012 FIRST Technical Colloquium,

5

Conclusion

http://www.first.org/events/colloquia/kyoto2012
13) FIRST Japan Teams, http://www.facebook.com/first.japan.teams

Damage from known threats is ongoing. Meanwhile,
threats from new cyber attack activities have emerged andare giving rise to damage. Further, it has become evident
that damage from cyber attack activities is to a considerable
extent designed to act on other organizations or to be acted
on by other organizations. Given such circumstances, it isessential to realize specialized and pragmatic collaboration
among organizations by means of CSIRTs.

14) Feasibility study of scenario-based self-training
material for incident responses, 24th FIRST Annual
Conference(2012/6),

In line with changes in the incident occurrence situation,
HIRT will be proceeding with activities to disseminate
countermeasures early as part of its efforts to "catch any
sign of future threats". We intend also to experiment with

http://www.cert.org/advisories/CA-2002-03.html

http://www.first.org/conference/2012/program/index.html
15) ITpro Security, http://itpro.nikkeibp.co.jp/security/16) CERT Advisory CA-2002-03, "Multiple Vulnerabilities
in Many Implementations of the Simple Network
Management Protocol(SNMP)" (2002/2),17) anti Malware engineering workshop,
http://www.iwsec.org/mws/2012/18) Nippon CSIRT Association: incident response,
http://www.nca.gr.jp/2010/incidentresponse.html

15

Copyright © HIRT. 2012. All rights reserved.

HIRT: Annual Report 201219) SGU MIT Workshop Academy CERT Meeting(2010/7), http://idsirtii.or.id/academy-cert-meeting/20) Malware Circulating in P2P File Exchange Software
Environment (2011) (2011/9),41) CVE (Common Vulnerabilities and Exposures),http://www.hitachi.co.jp/hirt/publications/hirt-pub11003/index.html

http://www.first.org/cvss/
44) DEFCON, http://www.defcon.org/

http://cve.mitre.org/
42) ICAT, http://icat.nist.gov/(not available)

43) CVSS (Common Vulnerability Scoring System),21) 2009 Survey on information leakage via P2P File
Exchange Software Environment (2009/12),
http://www.hitachi.co.jp/hirt/publications/hirt-pub09008/index.html

22) cNotes: Current Status Notes,
http://jvnrss.ise.chuo-u.ac.jp/csn/index.cgi23) Information-Technology Promotion Agency, Japan:
Countermeasures against DNS Cache Poisoning (2009/2),
http://www.ipa.go.jp/security/vuln/DNS_security.html

24) Recording Site for Joint Workshop on Security 2008,
Tokyo (2008/3), http://www.nca.gr.jp/jws2008/index.html
25) 2008 Information Technology Period Promotion Awarding companies that have contributed to thepromotion of information technology in 2008 (2008/10),
http://www.jipdec.or.jp/archives/project/gekkan/2008/ceremony/prize02.ht
ml26) CSIRT - Nippon CSIRT Association, http://www.nca.gr.jp/

27) WARP (Warning, Advice and Reporting Point),
http://www.warp.gov.uk/

28) GlobalSign Adobe Certified Document Services,
http://jp.globalsign.com/solution/example/hitachi.html

29) FIRST (Forum of Incident Response and Security
Teams), http://www.first.org/
30) Ministry of Economy, Trade and Industry, Notification
No. 235: Standard for Handling Information Related toVulnerabilities in Software, etc., (2004/7),
http://www.meti.go.jp/policy/netsecurity/downloadfiles/vulhandlingG.pdf

31) Information-technology Promotion Agency, Japan:
Information Security Early Warning Partnership Guideline(2004/7), http://www.ipa.go.jp/security/ciadr/partnership_guide.html32) JVN (Japan Vulnerability Notes), http://jvn.jp/
33) NISCC: NISCC Vulnerability Advisory 006489/H323:
Vulnerability Issues in Implementations of the H.323
Protocol (2004/1), http://www.kb.cert.org/vuls/id/JSHA-5V6H7S
34) Information-Technology Promotion Agency, Japan:
Research Reports on Policy for Security Vulnerability
Information Disclosure (2003/9),
http://www.ipa.go.jp/security/awareness/vendor/vulnerability200309012.p
df35) CERT/CC Vulnerability Disclosure Policy,
http://www.cert.org/kb/vul_disclosure.html

36) US-CERT: Vulnerability Note VU#459371: Multiple
IPsec implementations do not adequately validate
authentication data" (2002/10),
http://www.kb.cert.org/vuls/id/459371

37) Considerations on JPCERT/CC Vendor Status Notes
DB: JVN, CSS2002 (2002/10),[Author]Masato Terada
After launching HIRT activities in 1998 on a trial basis, he launched aresearch site (http://jvn.doi.ics.keio.ac.jp/), a predecessor of JVN(http://jvn.jp/), in 2002 and acted as a point of contact for HIRT in order topromote external CSIRT activities, including participation in FIRST, aninternational CSIRT organization in 2005. Presently, he works as atechnical member of the JPCERT Coordination Center, a researcher of theInformation Technology Promotion Agency, Japan, Telecom ISAC asteering committee member, and vice chief of the steering committee for the
Nippon CSIRT Association.

http://jvn.doi.ics.keio.ac.jp/nav/CSS02-P-97.pdf38) Development of JVN to Support Dissemination of
Security Information (2005/5),
http://www.hitachi.co.jp/rd/portal/story/jvn/index.html

39) CERT/CC Vulnerability Notes Database,
http://www.kb.cert.org/vuls40) CERT/CC Vulnerability Note Field Descriptions,
http://www.kb.cert.org/vuls/html/fieldhelp

Copyright © HIRT. 2012. All rights reserved.

16