As additive manufacturing (AM) matures and continues to gain popularity, it becomes an increasingly attractive target for cyberattacks. Therefore, being proactive in preparing for these security threats, particularly for high-value targets, is of paramount importance. A recently published paper [1] identifies the importance of developing and implementing a forensic readiness model to prepare for attacks on 3D printers. According to the paper’s authors, current forensic readiness models “do not consider AM processes and may be ineffective” for crimes that involve 3D printers, which motivated their work in developing a forensic readiness framework for AM.
The framework, which the authors refer to as the Forensic Readiness for Material Extrusion-based Printing Process (FRoMEPP), emphasizes the need to establish a “forensically ready” printing environment before an incident occurs in order to allow for the acquisition and preservation of relevant data as an attack is occurring, not after the attack subsides when data can be lost or overwritten. The different components of the framework are shown in Figure 1.
The authors identify several categories of cyber-domain information that are critical to monitor during an attack, including operating system logs, network logs, and application logs. These three log types cover a wide range of activities, from user account sessions and file access activities, to network traffic (e.g., SSH and HTTP connections), and finally to CAD and slicer software usage. By collecting and analyzing multiple logs, investigators can piece together the events of an attack with the assurance that the results of the investigation can be corroborated using multiple data sources.
Similar to investigations in other domains, the paper emphasizes that preserving and archiving evidence related to AM attacks is imperative. According to NIST IR 8387, “Digital Evidence Preservation” [2], digital evidence retention policies may vary between jurisdictions and organizations. However, in the absence of local statutes or policies, organizations should determine for themselves how long evidence should be preserved, which highlights the need for a flexible retention solution.
The proposed FRoMEPP framework [1] goes into much more detail and includes other critical aspects of the forensic readiness model, including the employment of out-of-band sensors and the selection of a suitable monitoring scheme. For the sake of brevity, we can’t cover the entire paper, but interested readers are encouraged to review the rest of the paper using the link in the footer.
Anticipating the demand for a security-hardened device that protects against cyberattacks on additive manufacturing machines, BreakPoint Labs has developed BISON to provide cutting-edge cyber defense capabilities in a small, convenient form factor. BISON captures critical cybersecurity information in the machine-to-machine communications between the controller and printer, and can ingest Windows security event logs and certain application logs for advanced analysis. This data is archived in the system until manually removed by an operator, ensuring that pertinent information is preserved for any post-incident investigations.
If you are interested in learning more about how BISON can secure your AM environment, please contact us at info@breakpoint-labs.com.
[1] https://www.sciencedirect.com/science/article/pii/S2666281723000112
[2] https://nvlpubs.nist.gov/nistpubs/ir/2022/NIST.IR.8387.pdf
The more things change, the more they stay the same. Ransomware attacks continue to disrupt organizations across all sectors while the results of law enforcement actions are waiting to be seen. We continue to monitor an effective threat group that shows no signs of slowing down.
The following domains were identified and attributed to this threat group:
| azuregroupusa.com | getprintservices.com | twebhost.com |
| chipfirmware.com | itacrobat.com | vip-source.com |
| databasegroupinc.com | mikrotikinside.com | webnofy.com |
| dmaorlando.com | release-app.net | webonlinecompany.com |
| easyupdatepro.com | slim-well.com | windows-upd.com |
| esc-ok.com | softlinesys.com | wmsmicro.com |
| eztechnet.com | sonyblueprint.com | |
| gdbcrew.com | spdevhost.com |
One positive note, we observed a distinct change in adversarial TTPs with this group in the past month. Threat actors have moved away from their preferred domain name registrar, NameCheap, to other providers like NetEarth One and Hosting Concepts B.V. d/b/a Registrar.eu.
The best defense against ransomware continues to be centered on reliable backups, active monitoring of networks and systems for vulnerabilities and weaknesses, and active patch management solutions. An ounce of prevention is worth a pound of cure. If your enterprise is missing one or more best practices, please contact us to help get you on the right track before it is too late.
If you are in need of incident response support or ways to defend against this and other threats, please contact us at https://breakpoint-labs.com/.
Since our last post at the end of August 2021, we have continued to track an effective ransomware group and they have been busy! We are tracking over 120 domains correlated to this threat group. They have been busy in October registering over 20 new domains in the last two weeks.
The following new domains have been linked to this threat group:
| academyads.com | emerictech.com | newseo.org | troncaselink.com |
| accountsupdate.org | escondidoseo.com | novadigitalgroup.com | turbojax.com |
| acronicssolutions.org | gessertmedia.com | ogsbd.com | uniselect.org |
| appinternet.net | get4tech.com | perscitech.org | unrigusa.com |
| av-sat.net | go-instant.com | phpjoblist.com | updatedlinux.com |
| bdeduinfo.com | herosoft.org | radardefence.com | updater-panel.com |
| bestupdate.net | hsncsoft.com | rdadev.com | us-time.org |
| cbdallas.org | ifftools.com | rootmailer.com | us-time.us |
| cloud-dock.net | introwebsites.com | router-manager.net | vpn-updates.net |
| cnetdownloader.net | ircontent.com | rq-technologies.com | wget-upd.com |
| codegemba.com | iweb-tech.com | shopyscripts.com | wiredobserver.com |
| codessional.com | jetkm.com | slot-download.com | wmi-technologies.com |
| competitionsites.com | metasportsystems.com | smlsystem.com | wotsafe.org |
| crmdevnet.com | mkvdb.com | sourangroup.com | zacstech.com |
| database-updater.com | msbackupservice.org | tebo-tech.com | zeoplan.com |
| datasecuritytoday.com | mysafexpress.com | tmdiagnostics.com | zoncat.com |
| devpda.com | new-release.net | top-enter.com | zorandev.com |
As you can see above, they continue to follow technology-related domain schemes. Each domain is hosted on a VPS with similar ports, protocols and services. During our analysis, we identified the actors running “Metasploit 4.20.0 – Update 2021083001” – a recent and likely cracked version of Metasploit.
This threat group is very active and has better tradecraft than other threat groups. The actors utilize non-standard ports, recently expired domains, employ trusted Let’s Encrypt certificates and do not reuse infrastructure to blend in with legitimate traffic that is not easily searchable. By proactively identifying their infrastructure we are able to prevent this threat and others like them from compromising our customers.
If you are in need of incident response support or ways to defend against this and other threats, please contact us at https://breakpoint-labs.com/.
During the course of multiple incident response engagements, we encountered a persistent, unknown ransomware threat group utilizing an obfuscated Golang encryptor
[1]. It is believed that the threat actors gained initial access through one or more SonicWall exploits [2], [3].
We can confirm prior sightings that Cobalt Strike was used by these threat actors to further gain access to exploit victim networks. In this blog, we will highlight previously unreported infrastructure that is managed by this unknown threat group.
Victims are presented with the following ransom note:
Hello dear user! Unfortunately, your files have been encrypted and attackers are taking over 300 GB of your personal data, financial reports and many other documents. Do not try to recover files yourself, you can damage them without special software. We can help you recover your files and prevent your data from leaking or being sold on the darknet. Just contact support using the following methods and we will decrypt one non-important file for free to convince you of our honesty. Contact us method below: Use TOR Browser: http://[redacted].onion/[redacted]
A recent sample of the Golang packed malware was submitted to VirusTotal in mid July 2021 [4]:
| MD5 | 864e4a109565f8d4052b959a12bfa45b |
| SHA-1 | 94388841e65c0962e56bf3e37391006d0af20bf4 |
| SHA-256 | d6f7eed7e8aeffb0683639a2c5b654d216f98a68de1528ef37685103f6e24550 |
The following domains have been attributed to the unknown threat group and have been observed hosting a Cobalt Strike server using TLS/SSL on non-standard ports. It is clear that these threat groups are attempting to blend in with the noise by generating seemingly legitimate domains.
| 3comnet.biz | cisco-network.org | group-policy.org | releases-upgrade.com |
| 3comnet.net | cisco-updates.com | ibgp-cisco.com | repository-buster.com |
| advmicrodevice.com | ciscodev.org | intelfirmware.net | routeros-update.com |
| amibios-updater.com | code-signing.org | juniper-firmware.com | serviceupdate.net |
| amibios.net | dev-repository.com | juniper-vpn.net | software-repository.com |
| apps-update.net | dev-service.org | junipervlan.com | software-updater.net |
| archive-update.com | dev.updatecore.net | mikrotikfirmware.com | ubiquiti-vpn.com |
| archives-firmwares.com | developmentsdata.com | mikrotikvpn.net | unattended-upgrades.net |
| bgp-firmware.com | dlinknetwork.com | nvme-updates.com | updatepayments.net |
| buster-updates.com | dlp-systems.org | poweredge-update.com | veeamdata.com |
| cisco-cloud.net | esxi-update.net | release-update.net | vpn-updater.com |
The following IP addresses are related to the domains listed above and appear to be a single use.
| 104.129.26.226 | 170.130.28.35 | 173.232.146.43 | 23.226.132.245 |
| 104.129.26.28 | 170.130.28.37 | 173.232.98.16 | 23.94.83.123 |
| 104.129.42.67 | 170.130.55.16 | 191.101.172.24 | 45.227.255.15 |
| 104.149.216.58 | 170.130.55.160 | 192.154.213.119 | 46.161.27.19 |
| 104.223.106.239 | 170.130.55.32 | 192.154.213.122 | 64.188.19.20 |
| 107.150.19.211 | 170.130.55.97 | 192.154.224.52 | 64.188.27.154 |
| 107.150.19.72 | 172.245.247.67 | 192.3.31.17 | 66.154.102.222 |
| 162.218.210.152 | 172.245.87.3 | 192.3.99.71 | 66.154.103.212 |
| 162.218.211.139 | 173.232.146.185 | 194.165.16.98 | 66.154.112.36 |
| 162.245.191.153 | 173.232.146.218 | 198.23.141.117 | 66.63.162.170 |
| 167.160.166.12 | 173.232.146.39 | 216.244.83.66 |
This threat group has been very active and if you or your organization utilized a SonicWall SMA VPN device since late 2020 or early 2021 without limited access, there is a likelihood that your organization has been compromised. If you observe any connections to the domains listed above, it is very likely you are compromised.
1. Back up (or start backing up!) all of your critical business data to an offline location. We observed these threat actors identifying backup solutions employed by a victim and removing all backup files from an online 3rd party solution provider.
2. Patch and upgrade your SMA devices immediately. More information can be found here: https://www.sonicwall.com/support/product-notification/urgent-security-notice-critical-risk-to-unpatched-end-of-life-sra-sma-8-x-remote-access-devices/210713105333210/
3. Review all SMA logs looking for suspicious activity – specifically looking for successful authentication attempts from non-US based IP addresses and/or IP addresses that don’t originate from Internet service providers such as home or commercial ISPs.
4. Enforce multi-factor authentication for all VPN accounts.
5. Employ signatures to detect the above mentioned domains and hashes.
If you are in need of incident response support or ways to defend against this and other threats, please contact us at https://breakpoint-labs.com/.
[1] https://www.crowdstrike.com/blog/new-ransomware-variant-uses-golang-packer/
[3] https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0001
There is no single tool that will protect your network from sophisticated actors. The biggest advantage in defending a network starts with staff that understand the terrain – hopefully better than the adversary. The biggest killer of an effective team can be tools that generate volumes of alerts or data that do not provide meaningful insight into what is happening on the network.
Sophisticated attackers may utilize many techniques to evade or avoid detection, and understanding how your network defense tools respond to unexpected inputs is important.
A report from Arbor Networks detailed an implant, Evilgrab/Grabber, that prepended five bytes of data before a legitimate HTTP request. We were interested in understanding how the five leading bytes would be analyzed by Bro IDS, an open source network intrusion detection system. We generated some pcap that mimicked beaconing traffic described in the report and ran it through Bro 2.4.1. Not surprisingly, Bro IDS generated a “bad_HTTP_request” event the weird log.
The weird log captures “unusual or exceptional activity that can indicate malformed connections, traffic that doesn’t conform to a particular protocol, malfunctioning or misconfigured hardware, or even an attacker attempting to avoid/confuse a sensor.” While technically accurate, the “bad_HTTP_request” error message is vague and can be easily overlooked but an overwhelmed staff. A more descriptive error message could mean the difference between successful detection and an ignored event.
BreakPoint Labs recently submitted a patch to Bro IDS, which was accepted, to generate a more descriptive weird event. In the Evilgrab/Grabber scenario, the legitimate HTTP request follows the five leading bytes. Our patch attempts to detect the beginning of the version string – “HTTP/” – at the end of the request method. If found, instead of generating the vanilla “bad_HTTP_request” message, we generate a more descriptive error message: “bad_HTTP_request_with_version_field”.
The additional information within the same error condition can provide the needed context to discern between unusual and exceptional. Although the patch is small, it may be the missing piece to detecting an adversary looking to evade detection.
BreakPoint Labs is in the fight to eradicate cyber pathogens through more descriptive error messages.
A stack based buffer overflow in the “getadrrinfo” function in glibc is currently trending as a critical severity vulnerability. The full scope of affected products are not currently none, but are suspected to include linux binaries such as ssh, sudo, and curl. The vulnerability should be patched across Linux distributions leveraging all versions of glibc after 2.9 which are deemed vulnerable. (Version 2.9 was introduced in May 2008).
Exploitation is non-trivial because you need to bypass ASLR in Linux and other OS defense mechanisms. The PoC that Google released now writes B’s “0x42” to random places in memory. Going from those randomly placed B’s to reliable code execution is a non-trivial, and currently no public PoC exists.
Reflected XSS in Cisco ASA devices:
Cisco ASA devices are currently vulnerable to a reflected XSS vulnerability in the password recovery portion of the application. The vulnerability is caused by the password recovery form failing to properly filter hidden input fields. This vulnerability can be leveraged by an attacker to capture victim login credentials.
OceanLotus Malware posing as Flash update:
Malware targeting OS X operating systems is currently circulating disguised as an Adobe Flash update. Currently the software is not seen as malicious by any of the 55 anti-virus solutions by VirusTotal, and appears to have been targeting Chinese infrastructure at one time.
Apple Opposes Court Order in San Bernardino Case:
Apples CEO Tim Cook has defiantly challenged a U.S federal magistrate judge’s order that would help the FBI break into an iPhone 5c belonging to one of the shooters involved in last December’s attack in San Bernardino, Calif. Cook released a letter expressing his opposition to the court order and called for a public discussion about the implications the decision could have on privacy and security moving forward.
BSOD and Privilege Escalation POC for Windows 7/10 (CVE-2016-0051):
Source code for the BSOD and Privilege Escalation (to SYSTEM) vulnerability has been publicly released. The vulnerability occurs in the WebDAV client and allows users to gain elevated privileges via a crafted application.
Hospital Pays 17k Ransom to Hackers who sealed all its sensitive files:
The cost of the impact and having no clear options to decrypt their files left the Hospital with little option but to pay out the 17k to the attackers. This gives validity to a scary business model for ransomware targeting larger organizations vs. individuals.
CCTV found taking screen shots and sending to a Chinese Email address
Comodo Internet Security installs and enables a VNC server:
When Comodo Internet Security is installed, an application called “GeekBuddy” is also installed which has a lot of shady business tactics to encourage users to pay for online tech support. In addition, it installs a VNC server and enabled it by default.
New tool that packages several open source hacking tools to make for a more user friendly experience.
Interesting read on attacking OWA
