mrmoor/cyber-threat-intelligence huggingface dataset:
The attacker steals the victims computing resources and translates it into a cryptocurrency like Bitcoin.
This new kind of attack tells us that at least some cybercriminals are starting to view theft of victim’s computing power to translate into cryptocurrencies as a better business proposition than the traditional practice of loading malware on the victim’s system through drive-by downloads.
And our research shows that this isn’t an isolated event.
Our researchers analyzed over 1,000 of sites and what they found was very telling.
The good news is that these attacks are more like denial of service attacks: they don’t do lasting harm to your system and they end when you leave the site.  The bad news is that these are harder to defend against than typical drive-by download attacks.
Where drive-by download attacks usually exploit unpatched vulnerabilities, the root of these attacks is that they abuse otherwise legitimate functionality: you can’t prevent them by being fully patched.
Security products that take a comprehensive, layered approach can help prevent these attacks.
And if you think your system is being affected by one of these attacks, you can, in most cases, end the attack by either leaving the site or closing the browser.
Most of all, this latest development shows how a changing economic landscape in turn changes the cybercrime landscape.
Loading malware through drive-by downloads is so 2012: in 2017 it’s about drive-by mining attacks to earn cryptocurrencies.
This post is also available in:      日本語 (Japanese)  This Unit 42 blog provides an update on the threat situation surrounding the WanaCrypt0r ransomware attacks and how the attack propagates.
Initial reports said that the WanaCrypt0r attack began as part of a spam/phishing campaign.
Unit 42 and other researchers have concluded that these reports are not substantiated.
While the initial attack vector for these attacks is unknown, it is certain that the spread of the ransomware occurs through active exploitation of the ETERNALBLUE vulnerability (CVE-2017-0144) in Microsoft Windows.
Patches for this vulnerability for all supported versions of Windows have been available since March 2017.
On Friday May 12, 2017, Microsoft took the extraordinary step of releasing patches for out-of-support versions of Windows to help protect against these attacks.
As the attack leverages this Microsoft vulnerability, the most appropriate first step to take against the attack is to apply the patches.
Unit 42 researchers have confirmed that the patch is effective against the WanaCrypt0r Ransomware attacks.
In addition, Palo Alto Networks, and other vendors, including our fellow members of the Cyber Threat Alliance, have released additional protections that help prevent the spread of the WanaCrypt0r ransomware.
For information on Palo Alto Networks protections, please see our posting Palo Alto Networks Protections Against WanaCrypt0r Ransomware Attacks.
As with all ransomware attacks, Palo Alto Networks and Unit 42 recommends that anyone affected NOT pay the ransom.
Unit 42 is not aware of any reports where paying the ransom to the WanaCrypt0r attackers has resulted in the recovery of data.
In addition, Unit 42 research has shown that very few have attempted to pay the ransom.
Unit 42 is following this situation very closely and will update this blog with any new information as it becomes available.
WanaCrypt0r is a global ransomware attack that emerged on Friday, May 12, 2017.
It immediately gained broad media attention, due to its destructive nature, how widespread it was, and multiple high profile victims.
This attack uses the version 2.0 of this ransomware.
WanaCrypt0r v 1.0 was first reported a few months ago but did not include the worm capability associated with this attack.
Reports quickly emerged that this attack was effective due to the presence of code exploiting a vulnerability (CVE-2017-0144) in Microsoft Windows (code named: ETERNALBLUE) that was released as part of the Equation Group dump by the Shadow Brokers in their fifth leak on April 14, 2017.
Microsoft patched this vulnerability as part of the March 2017 Monthly Security Update Release by Microsoft Security Bulletin MS17-010.
This is a SYSTEM-level remote code execution (RCE) in the handling of the Server Message Block (SMB) protocol in Microsoft Windows.
The attack uses this vulnerability to spread the WanaCrypt0r ransomware on the network.
This is a classic network worm-class vulnerability like MS-Blaster and Conficker.
Early reports indicated that the initial attack vector was via spam and/or phishing email.
However, this has not been confirmed and is unlikely to account for the global spread of the malware.
When the WanaCrypt0r ransomware executes successfully, it will encrypt key files on the system and display a ransom note as shown below (SOURCE: Microsoft).
Figure 1 Ransom note for WanaCrypt0r
One thing reports have indicated that make this attack unique is a “killswitch” capability built into the malware.
This “killswitch” will prevent the WanaCrypt0r ransomware from executing.
The “killswitch” is code which will attempt to connect to an extremely long domain that should not resolve.
The initial variant of WanaCrypt0r uses hxxp://iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea[.]com, however, there are reports of newer variants using different domains.
If it was successful in connecting to the domain, the ransomware would not execute.
However, it was easily subverted to work against the malware.
A security researcher in the United Kingdom initially registered this domain in order to track this threat, and soon discovered that in doing so, he had enabled this “killswitch”, causing a number of instances of WanaCrypt0r to not execute for a large number of infected systems.
On Friday, May 12, 2017, Microsoft announced that they were making an emergency patch available for out-of-support versions of Windows (Windows XP, Windows 8 and Windows Server 2003).
As of this writing attacks appear to have subsided.
This is likely due to increased uptake of the patch MS17-010 in light of the WanaCrypt0r attacks, as well as efforts made within the security community.
Unit 42 research shows there is likely very little actual payment of ransom.
We analyzed our known WanaCrypt0r samples and extract the following Bitcoin (BTC) addresses likely associated with the attackers and associated totals:  This results in a total of 36 BTC, or roughly $63k based on the current price of BTC.
Given that WanaCrypt0r requests $300 per infected machine, we can infer that approximately 210 victims have made payments to the attackers.
Therefore, there appears to be little recon as part of this attack.
There are some reports that there may be scanning of TCP port 445, which is one of the ports associated with SMB.
But these reports haven’t been conclusively verified.
There is no consensus in the industry on what the delivery method/initial infection vector is.
There have been several theories:  Unit 42 believes the most likely delivery method is method #2.
However, this is not conclusively provenLateral Movement
The WanaCrypt0r ransomware spreads itself by heavily scanning over TCP port 445 (associated with SMB) and attempting to exploit the ETERNALBLUE vulnerability on systems.
A successful attack against this vulnerability will infect the target system with the WanaCrypt0r ransomware, which will encrypt data on the target system and attempt to spread itself once again.
Multiple vendors report that the malware includes the ability to spread via port 445 scans and attacks against the ETERNALBLUE vulnerability not only on internal networks but also across the Internet.
These reports indicate that in addition to the internal lateral movement already outlined, the WanaCrypt0r ransomware will scan for port 445 on random external IP addresses and if it finds an IP address with an open port 445, it will then scan all devices on the same /24 IP range (i.e. that share the first three octets as that IP address with the open port 445).  In general, WanaCrypt0r does not have C2 capabilities but it does utilize the TOR network to communicate encryption keys for decryption upon payment of ransom.
It has been reported that the DOUBLEPULSAR backdoor (also from the Equation Group leak by Shadow Brokers) is installed and used to execute the malware after successful exploitation of a host via ETERNALBLUE, but this warrants further analysis.
Overall, WanaCrypt0r has been a notable incident within the security community, as the threat couples a wormable vulnerability/exploit with a ransomware family.
Users are urged to apply the necessary Microsoft patch to protect themselves against this threat.
For protections, customers are advised to view this blog post that outlines the various ways the Palo Alto Networks platform prevents this threat.  Cyber Threat Alliance member ElevenPaths has developed a tool which can be used to attempt to recover some files deleted by WanaCrypt0r.
You can find more information on this tool here.
Register for Ignite ’17 Security Conference  Vancouver, BC June 12–15, 2017
Ignite ’17 Security Conference is a live, four-day conference designed for today’s security professionals.
The latest episode of the Don’t Panic cybersecurity podcast is now live.
In this latest episode, Ryan goes back to the topic he talked about in his 2018 predictions piece “The Era of Software Supply-Chain Attacks Has Begun”: Software Supply Chain attacks.
As a reminder, “Don’t Panic,” is the official podcast of Unit 42, the Palo Alto Network threat intelligence team and features Palo Alto Networks CSO Rick Howard and Palo Alto Networks Senior Vice President, Threat Intelligence Ryan Olson.  You can find this episode and other Palo Alto Networks podcasts on iTunes, Google Play, or integrate the RSS feed into your favorite service.
Late last month reports surfaced that a new Internet Explorer vulnerability (CVE-2014-1776) was being exploited in targeted attacks.
The vulnerability allows an attacker to take full control over the system after a user views a web page in their browser.
According to Microsoft, it affects versions of Internet Explorer from version 6 to 11, meaning that almost all IE users are vulnerable to this bug.
This vulnerability is so widespread that Microsoft has released patches to protect Windows XP, for which Microsoft has ended support since April 8, 2014.
Researchers from Palo Alto Networks have investigated this exploit in depth and concluded that this is a Use-After-Free vulnerability that occurs when Internet Explorer tries to reuse a freed CMarkup object.
Attackers can manipulate memory allocations by using JavaScript to allocate an object that is freed before all references to that object are removed.
Once the object is free the Flash file will overwrite a length field in the vector object and allow arbitrary memory access.
After that the exploit uses a ROP chain to overwrite the virtual function table of a sound object to gain full control.
The exploit utilized several advanced exploit techniques to make it almost 100% reliable.
The exploit used in the wild contains two major parts, one is HTML which sets up the page to exploit, and the other is a Flash file which builds the memory layout in IE process and triggers the bug.
Two parts must be combined to ensure a successful attack.
The attack separated critical code into different pieces so that researchers could not reproduce the original exploit until they have both files.
The techniques used in this exploit are similar to those used in other recent attacks.
Last year, exploitation of CVE-2013-3163 targeted Internet Explorer 8 and earlier this year, we found exploitation of CVE-2014-0322 in Internet Explorer 10.
Similarities in each of these exploits indicate that they may have been created by the same author.
All three exploits share the same exploit techniques:  All the Flash files used across the exploits have similar structures and even the same variable names.
For example, they all use the Timer object to check if a Vector object is modified.
The Timers are all set to repeat every one second for 4,096 seconds.
The Vector object is named ‘s’ and the Sound object is named “ss” in the Flash files used in all three exploits.
The following code is snippet from the disassembled ActionScript code of CVE-2014-1776.
Neither of these variables is actually used in this exploit.
If we go back and examine the exploit code for CVE-2013-3163, we see that the string ‘org’ was originally used as the trigger, and the variable ‘found’ was originally used as a flag indicating if the Vector object was modified.
It appears that the attacker reused the code from the earlier exploit and forgot to remove the unnecessary variables.
s[_local28][(((_local41 - _local12) / 4) + 9)] = _local9;  s[_local28][(((_local41 - _local12) / 4) + 10)]
= 13078672;
s[_local28][(((_local41 - _local12) / 4) + 11)]
= _
s[_local28][(((_local41 - _local12) / 4) + 12)]
= 3096481936;
s[_local28][(((_local41 - _local12) / 4) + 13)]
= (this.m_longArrBase - 8);
s[_local28][(((_local41 - _local12) / 4) + 14)]
s[_local28][(((_local41 - _local12) / 4) + 15)]
= this.m_rawLen;
s[_local28][(((_local41 - _local12) / 4) + 16)]
= 3968066955;
s[_local28][(((_local41 - _local12) / 4) + 17)]
= 753635372;
The exploit uses the code above to restore the corrupted object and save the stack frame on the heap so that the process would not crash after the exploit is successful.
All three exploits use the same method and similar addresses to achieve that goal, even including the same hard coded assembly and registers.
_local10 = this.m_ZwProtectAddr;  _local41 = _local6;  s[_local28][((((_local6 - _local12) / 4) - 2) - 4)] = (_local41 & 0xFFFFF000);  s[_local28][((((_local6 - _local12) / 4) - 1) - 4)] = 0x3000;  s[_local28][((_local6 - _local12) / 4)] = _local10;  s[_local28][(((_local6 - _local12) / 4) + 1)] = (_local41 + 28);  The code above shows the Flash code setting up the ROP chain to bypass DEP and includes another interesting marker.
Normally programmers begin counting at 0 when referencing arrays, but in all three exploits they began at -2, which is quite unusual.
Additionally, each sample uses a Sound object named ‘snd’ to gain control, and they all invoke the function toString().
The many similarities between these exploits lead us to believe they were written by the same actor or group.
Or at the very least, a common template has been used to craft exploits for the three Internet Explorer vulnerabilities we analyzed.
This re-use of techniques is common among exploits, even if they were not developed by the same group, and Palo Alto Networks employs a unique payload-based signature detection methodology, which is able to look at the behaviors of an exploit to prevent similar attacks in the future.
Palo Alto Networks customers with a Threat Prevention subscription were automatically protected from exploitation of these vulnerabilities:  We suggest customers ensure they are running the latest content version on their devices and apply the patches Microsoft released on May 1, 2014.  Sign up to receive the latest news, cyber threat intelligence and research from us  Please enter your email address!
In October 2017, Palo Alto Networks Unit 42 published research showing how attackers were adapting attack techniques to generate cryptocurrency for themselves.
In that research, we also showed how these attacks were very broad and grew very quickly.
At the time, we said that the sudden, surging value of cryptocurrencies was likely behind the sudden, strong rise of these new attacks.
We said that if cryptocurrency values continue to remain high, we could expect to see attackers continue to focus on finding ways to carry out attacks to gain cryptocurrency, and that those attacks would continue to adapt proven attack techniques.
Unit 42 has just released new research showing that attackers are indeed continuing to adapt existing techniques to generate cryptocurrency.
In our research posting “Large Scale Monero Cryptocurrency Mining Operation using XMRig” we detail a new malware campaign that is global in scale, very large in the likely number of victims and uses well established techniques to mine the Monero cryptocurrency.
Monero is a cryptocurrency similar to bitcoin but notable for its increased emphasis on providing a higher level of privacy around its transactions.
Like bitcoin, Monero is generated through “mining” a computationally intensive process that provides cryptocurrency credit in exchange for computing resources provided in service to the cryptocurrency and its transaction infrastructure.
The operation that Unit 42 has recently uncovered works to deliver XMRig, software that is used to mine the Monero cryptocurrency, to victims’ systems without their knowledge or consent.
While XMRig isn’t itself specifically malware, it’s being delivered using malware-delivery techniques without the user’s knowledge and consent just like malware.
The attackers are doing this by using URL shorteners to make XMRig look like other, legitimate, and expected programs.
This is a method attackers have used for years to deliver malware and they are using it now to get coinmining software on to people’s systems illicitly.
The attackers’ use of URL shortners enables our Unit 42 researchers to get an idea of the size, scope, and scale of this operation.
And these are all notable and sobering.
First, this is a young campaign.
Our research shows this operation to be only about four months old.
Second, this is a very large campaign.
Our researchers can show that about one-half of the samples we found have affected 15 million people worldwide.
While we can’t see how many people the other half of the samples affect, it’s a reasonable supposition that the other half of the total samples affect just as many people as the half we can see.
This would mean that this operation may affect about 30 million people worldwide.
In terms of who’s been affected by this operation, again, we can only see half of those who have been affected.
But what we do see shows that this is a truly global operation.
This operation affected countries around the globe, but it appears that southeast Asia, northern Africa, and countries in South America were hit the most as shown below.  Malicious downloads by country  The specific breakout of countries affected, and their download counts are as follows:  Taking all those points together, this is operation is very large and clearly very effective.
It shows how attackers are aggressively focusing their operations and campaigns on generating and acquiring cryptocurrency.
From a threat point of view, there are two things that are notable.
First is the fact that from an attack technique point of view, there is nothing new here.
The tactics and techniques are not new or sophisticated.
Second is the fact that this operation is clearly very successful based on its size, scope, and age.
Looking at this latest operation on the continuum of evolving cryptocurrency-focused threats, it’s clear that this is an early-stage threat given its lack of sophistication and reuse of established techniques and tactics.
But given how quickly and broadly successful it is, combined with the continued high value of cryptocurrencies, we can also conclude that attackers will continue to focus on cryptocurrency and likely will evolve their techniques and tactics quickly.
Cryptocurrency-focused threats is a key area that all defenders should focus their intelligence and prevention efforts around in 2018.
Meanwhile, see our full research blog for full details on how attackers are distributing and using XMRig to generate Monero.  Sign up to receive the latest news, cyber threat intelligence and research from us  Please enter your email address!
Today, Microsoft patched 59 Internet Explorer vulnerabilities, 21 of them discovered by Palo Alto Networks researchers.
Palo Alto Networks is committed not only to detecting attacks, but preventing them as well.
Our internal research team discovered each of these 21 vulnerabilities and reported them to Microsoft so they could begin building and testing patches.
Microsoft has already credited our team with 14 previous IE vulnerabilities in 2014, bringing our total for the year up to 35.
We want to acknowledge Palo Alto Networks researchers Bo Qu, Hui Gao, Royce Lu, Xin Ouyang and the entire IPS team for all of the hard work they’ve put into discovering and validating these vulnerabilities.
The table below provides a summary of the vulnerabilities and which versions of Internet Explorer they impact.
Internet Explorer is used in many of the networks Palo Alto Networks protects around the world and we’re doing our part to make it as secure as possible.
Last week we released a series of IPS signatures to detect an advanced exploitation technique that takes advantage of ActiveX. In May, we linked a recent IE 0-day (CVE-2014-1776) to exploit code used against two other IE vulnerabilities exploited in the last 12 months.
Microsoft patched 129 IE vulnerabilities in all of 2013 and today’s release brings the 2014 total to 116.
The faster the good guys track these down and get them patched, the harder we make the lives of the criminals looking to exploit them.
This time every year, people all over the world get new devices.
Regardless of what holiday(s) you may (or may not) celebrate, the end of the year is a time for people to give and receive some of the latest devices to come on to the market.
Nothing spoils a new gadget more than having some kind of security or privacy problem related to it.
After that, nothing spoils the fun and excitement of unboxing and playing with an exciting new device than trying to figure out what you need to do to use it with reasonable safety and privacy.
To that end, we’re providing some very basic, but critical steps that you, your family, your loved ones, and friends can take to ensure some basic security and privacy for new devices quickly and easily that can help you be safer and not spoil your unboxing fun.  In the vein of the holiday spirit, we’re providing a list of twelve short, simple recommendations that can help you have a happy, safe, and private holiday season.
1. Use a Password Manager:
Even though not all devices can use password managers directly, it’s still one of the best things you can set up.
PCs and Macs as well as smartphones and tablets increasingly support the use of password managers directly.
But even for devices that don’t, you can and should use a password manager to generate and store strong passwords for use on all devices in its vault.
Preferably, find a password manager that requires two-factor authentication.  2. Protect Your Home Routers and Wi-Fi:
In a home of computers, phones, tablets and IoT devices, nearly always the common point is the home router and Wi-Fi.
For most, it’s something they set up once and forget about.
But if you want to keep your home devices more secure, you need to make sure the underlying router and Wi-Fi are more secure.
Take time to ensure you have a good, complex, unguessable password.
This is where a password manager can help.
You may consider configuring it to not broadcast the SSID as well: that can make adding devices a little harder, but that means it’s even harder for people to try and join your home network.  3. Set up More Secure Accounts on Your PCs and Macs: PCs and Macs (both desktop and laptop) are still around and as important as ever in the home.
Take time to set up an account for everyone with their own username and password.
Also, all modern operating systems allow you to make accounts “regular user” accounts rather than admin accounts.
Set everyone up as a “regular user” and set up a separate administrative account to use for maintenance.
If you have kids, avoid the temptation to let them all use one account or accounts without passwords: this is a chance for them to start to learn the right way to handle passwords by giving them their own and teaching them to never share that password.
You can generate the password for them and retain it as the “administrator” if you want for monitoring.
This also is an important lesson for kids to understand that privacy on computers isn’t absolute: the admin can always look at what they’re doing.