Category: Security

Today marks the final stretch of National Cyber Security Awareness Month (NCSAM), and for the final week, we decided to sit down with Sal Aurigemma, PhD, Associate Professor of Computer Information Systems at the University of Tulsa, to get his take on enterprise security training. 

As with many other things that have been impacted by COVID, enterprise security training is no different. Many organizations are heavily reliant on training and preparedness programs at the moment to help employees navigate the adoption of new technologies and processes, as well as mitigate threats from the rising number of phishing and man-in-the-middle attacks. But just how effective are these programs, and are they actually influencing user behavior? We’ll find out. 

Dr. Aurigemma has more than 20 years of experience in the information technology industry as both an educator and behavioral researcher. Dozens of students come through Dr. Aurigemma’s undergraduate and masters programs each year to learn about proper cyber security hygiene using tools like the YubiKey, and he’s explored topics related to security policy compliance and end-user security practices in his research over the years. 

What is the biggest problem you see with employee training programs today?

Perhaps the most frustrating problem I see in the organizations I have worked for, and those I work with today, is a pervasive “check-box” approach to information security awareness training. By this I mean one of two things, and often both:  

1) It is still somewhat treated as a one-and-done compliance checklist that is completed on an annual or quarterly basis. With the possible exception of anti-phishing testing where organizations use tools and services to run their own phishing campaigns, there is little to no reinforcement of the reason behind why it’s important to safeguard the organization. 

2) A one-size-fits-all training doesn’t work. We know that we have certain sectors of our workforce that are more likely to be targeted by potential adversaries. Yet, in many cases, the training given across the workforce is largely the same, even though the threat and techniques can vary based upon the target. 

What are three things organizations can do to improve the efficacy of their cyber security training programs?

My number one recommendation is the hardest to achieve – make sure that your infosec awareness training is properly resourced. This means that you have enough people running the program and those people are properly trained to create and administer effective training programs. If your organization treats security training as a collateral duty, do not be surprised when it fails to meet expectations.

Secondly, ditch the one-size-fits-all approach, at least when it comes to security training and attention. We know certain groups of employees are targeted more often than others, or targeted in different ways, so we need to prepare them accordingly. For example, senior executives, IT system administrators, and HR team members are the top three target populations, and they are typically targeted using different techniques. Their training should reflect that. The same goes for different employee demographics — the lessons or examples that are most impactful for one group of employees may be very different for others.  

Finally, I would recommend that every organization develops a set of training outcome metrics and then use them to continually assess and improve your training programs. This can be challenging, but it is worth the effort. If you have certain employees or employee groups that keep “failing” some aspect of your training, that is a sign that your training and/or security mitigations are not sufficient. But, you won’t know that unless you measure and monitor.  

How do you foresee the influx of remote work, spurred by COVID, impacting the approach to cyber security training? How should organizations adjust and what should they consider that maybe they haven’t before? 

My primary fear is that the increase in remote work will further distance employees from the security training staff and the messages they bring. What we don’t want is more “watch this video to complete your training” requirements that replace impactful interactions with the organization’s security staff (whether face-to-face or virtual). 

Given that the work-from-home movement is here for a while, or possibly here to stay for some organizations, it is somewhat critical to do a complete review of your security training needs and develop a plan to adjust accordingly. For example, does your current security training plan account for the significantly greater emphasis on remote connectivity and interactions, and the increasing threats — like phishing and man-in-the-middle attacks — that come with that? Do your employees understand which threats are now more prevalent or dangerous than before because of the extension of the workplace to their home office network? 

In an ideal world, this shift to remote work would be the catalyst organizations need to embrace a more tailored security awareness training approach that accounts for an employee’s job role, location, access, experience level, and other demographic characteristics. If and when we return to a more normal workplace life, we will be better positioned to continue to adapt and improve our security awareness programs.

Not all employees will follow through with best practices, even with a perfect training program. What are the primary factors that inhibit users from adopting new security technologies or practices?

A significant portion of my research activities are focused on better understanding inhibitors and facilitators of sound security behaviors, and if I had to narrow it down to three potential reasons why people do not take security actions, even when they know they should, I would say it is due to:  

1) Threat apathy 

2) Response efficacy

3) Inconvenience

Threat apathy occurs when individuals do not pay attention to security because they do not consider the recommended or required security action (and its related threat) to be important. It could be because they don’t feel important enough to be a target of cybercriminals, or that they believe their online accounts aren’t worth stealing. Overcoming threat apathy requires the use of convincing and compelling security messaging that explains why the action is important, on a personal and organizational level, and the potential consequences of failure.  

Response efficacy is an academic way of saying that people may not know enough about, or have confidence in, a particular recommended security action. A great example of this is two-factor authentication (2FA). It is not a secret that we should use 2FA wherever and whenever we can. However, most people don’t know the differences between the various types of 2FA mechanisms, which ones are more secure than others, or how they work. Security training programs should not just articulate the threat and required security actions; they must also make it clear that the requested actions are sufficient to the task and, to some extent, explain how.  

Inconvenience is a real factor that influences our security behaviors.  As humans, we are constantly calculating the costs and benefits of doing things and we generally know what happens when the costs outweigh the benefits. Enterprises have to design and implement security mitigations with this in mind and work to balance maximizing the security benefit while minimizing or eliminating the inconvenience factor. If we don’t design security mitigations with the end-user in mind, the end-user may find ways to avoid or diminish the effectiveness of those mitigations.

On the contrary, what have you observed to be primary motivators for adopting new security technologies or practices?  

One of the latest research trends in behavioral information security that I feel strongly about is a shift from sanction or threat-based compliance to one that adds positive reinforcement and messaging. By this I mean that many security policies and training programs are focused on “compliance-or-else” messaging. In short, employees have something to fear if they don’t follow the rules. Fear-uncertainty-doubt (FUD) is used too much in the cyber security literature and it also lives in our training programs. 

While I do believe that there needs to be some actual consequences for willful and malicious non-compliance with security rules, we also know that fear alone is not a good enough motivator. We see that in many aspects of modern society, not just in cyber security. My fellow researchers and I have conducted numerous experiments that show that building up and emphasizing the positive psychological capabilities of end-users to combat a security threat is significantly more effective than relying on fear and promises of reprisal alone. We have found that end-users are much more likely to adopt new security technologies and practices when they feel: 

1) More capable of taking security actions and working through issues related to the required tasks 

2) More hopeful that their actions are effective

3) More optimistic about their resulting security posture

It’s impossible to eliminate the element of human error, especially when it comes to protection against sophisticated phishing or man-in-the-middle attacks, so what other steps should organizations be taking — outside of training — to ensure they have a comprehensive approach to security?

In my opinion, the best way to minimize the effect of human error (or conscious rebellion) on security practices is to reduce the opportunities to make bad decisions.  This means designing your security mitigations in a way that reduces the cognitive load and choices your end-users have to make.  

A perfect example of this is having your employees use YubiKeys for 2FA or passwordless login. At a time when phishing attacks are virtually undetectable — even to the most well-trained eye — this is exactly the type of technology that you should be using to support your training initiatives. But make sure that the burden of configuring the YubiKeys does not fall all on the end-user and make sure that you are using the right form factor for the employee’s electronic devices.  

Likewise, you don’t want your employees or end-users choosing passwords that are weak or previously compromised. But, don’t put the onus on the end-user to know what that means – do it for them when you are registering accounts or during password changes. Offloading as many volitional security activities as possible from your end-users and limiting the opportunities to deviate from strong security practices should be primary considerations for every security activity.  

—

Learn more about how the YubiKey can complement your organization’s cyber security training endeavors with a fool-proof 2FA solution proven to eliminate account takeovers from phishing and man-in-the-middle attacks. 

Earlier this year, we analyzed the inner workings of LockBit, a ransomware family that emerged a year ago and quickly became another player in the targeted extortion business alongside Maze and REvil. LockBit has been quickly maturing, as we observed in April, using some novel ways to escalate privileges by bypassing Windows User Account Control (UAC).

A series of recent attacks detected by Sophos provided us with the opportunity to dive deeper into LockBit’s tools, techniques and practices. The actors behind the ransomware use a number of methods to evade detection: calling scripts from a remote Google document, using PowerShell in a way that may foil some efforts at monitoring and logging to establish a persistent backdoor—by using renamed copies of PowerShell.exe. The attack scripts also attempt to bypass Windows 10’s built-in anti-malware interface, directly applying patches to it in memory. Internally, we’ve referred to this style of LockBit attack as “PSRename.”

Based on some artifacts, we believe that some components of the attack were based on PowerShell Empire, the PowerShell-based penetration testing post-exploitation tool. Using a series of heavily obfuscated scripts controlled by a remote backend, the PowerShell scripts collect valuable intelligence about targeted networks before unleashing the LockBit ransomware, checking for signs of malware protection, firewalls and forensic sandboxes as well as very specific types of business software—particularly, point-of-sale systems and tax accounting software. The series of attack scripts only deploys ransomware if the fingerprint of the target matches attractive targets.

Aside from the initial point of compromise and registry key entries, these attacks left little in the way of a file footprint for forensic analysis. The ransomware was pulled down by scripts and loaded directly into memory, and then executed. And the attackers did a thorough cleanup of logs and supporting files when the attack was executed.

These highly automated attacks were fast—once the ransomware attack was launched in earnest, LockBit ransomware was executed across the targeted network within 5 minutes, leveraging Windows administrative tools.

Layers of obfuscation

The organizations hit in the eight attacks we analyzed were smaller organizations with only partial malware protection deployed. None of them had public Internet facing systems on their networks, though one had an older firewall with ports open for remote administration by HTTP and HTTPS.

It’s not clear what the initial compromise was across these organizations, as we had no visibility into the event. But it appears all of the activity in the attack we analyzed here were initiated from a single compromised server within the network used as the “mothership” for the LockBit attack.

While analyzing one of the attacks, we found traces of a number of PowerShell scripts that were launched against systems that had malware protection in place. The scripts gave a clear picture of the degree of automation of the attack, and also demonstrated the lengths the LockBit operators had gone to make forensic analysis of their attacks as difficult as possible.

In the first stage of the attack, a PowerShell script connects to a Google Docs spreadsheet, retrieving a PowerShell script encoded in Base64 from the body of the spreadsheet.

The script fetches the contents of cell B1 in the sheet and executes it. The retrieved script makes a copy of PowerShell in the system’s TMP folder, and executes Base64-encoded contents with that copy:

Decoding the script reveals it uses a System.Net.ServicePointManager object to create a session connecting to hxxps://142[.]91.170.6, downloading yet another stream of encoded script. This much larger chunk of code contains a function that creates a persistent backdoor. Using a template, the function selects a new name and path to create copies of PowerShell.exe and the Microsoft Scripting Host mshta.exe, as well as fictional agent descriptions to make them look like other legitimate processes.  It also creates a Task Scheduler manifest file that uses the renamed executables, scheduling a VBscript command to be executed by the scripting host that invokes the backdoor with the renamed PowerShell executable:

We also found the LockBit attackers use another form of persistent backdoor, using an LNK file dropped into Windows’ startup commands folder. The LNK file launches Microsoft Scripting Host, to run a VBScript, which in turn executes a PowerShell script to read data stored in the link file itself encoded in Base64.
The extra LNK bytes decode to yet another encoded chunk of PowerShell, decoded below:

The script connects to the remote server and pulls down the backdoor script as a stream, then executes the downloaded script with the command line interpreter.

Empire building

The backdoor stub downloads more obfuscated code, establishing a proxy connection to the command and control server, and creating a web request to pull down more PowerShell code.  One of the modules downloaded is a collection functions used to perform reconnaissance on the targeted system and to disable some of its anti-malware capabilities.

One of the functions in the module aims to disable Microsoft Windows’ Antimalware  Scan Interface (AMSI) provider by changing its code in memory.  The backdoor uses a script to load a Base64-encoded DLL into memory, and then executes a PowerShell code that invokes C# code calling the DLL’s methods to patch the copy of the AMSI library already in kernel memory. This code is repeated in another module discovered during our analysis:

Another module downloaded by the backdoor checks for anti-malware software and artifacts that indicate it is running on a virtual machine, but also checks for software that may indicate the system is of greater value—using a regular expression to look for tax accounting and point-of-sale software, specific web browsers, and other software:

The regular expression parses the local Windows registry, looking for matches to the following keywords:

Keyword	Target
Opera	Opera browser
Firefox	Mozilla Firefox browser
Chrome	Google Chrome browser
Tax	Search for any tax-related software process
OLT	OLT Pro desktop tax software
LACERTE	Intuit Lacerte tax software for accountants
PROSERIES	Intuit ProSeries tax software
Point of Sale	Search for point-of-sale (retail) software
POS	Search for point-of-sale (retail) software
Virus	Search for anti-malware processes
Defender	Microsoft Windows Defender
Secury
Anti	Search for anti-malware processes
Comodo	Search for Comodo antivirus or firewall
Kasper	Kaspersky anti-malware software
Protect	Search for anti-malware processes
Firewall	Search for firewall processes

 

If and only if the fingerprint generated by these checks indicate the system is what the attackers are looking for, the C2 server sends back commands that execute additional code.

Wrecking crew

Depending on what responses come back from the C2, the backdoor can execute a number of tasks, designated by a numeric value. They include simply forcing a logoff, grabbing hash tables to apparently exfiltrate for password cracking, attempting to configure a VNC connection, and attempting to create an IPSEC VPN tunnel. These tasks are executed using variables and modules pushed down by the C2, obfuscating most of their functionality.

In the attacks we analyzed, the PowerShell backdoor was used to launch the Windows Management Interface Provider Host (WmiPrvSE.exe). Firewall rules were configured to allow WMI commands to be passed to the system from a server—the initially compromised system—by creating a crafted Windows service.

And then, the attackers launched the ransomware via a WMI command, filelessly—without dropping a single file artifact on the disk of the targeted systems. In one case, the WMI commands used port 8530 to reach back to the initially compromised server—the port used for Windows Server Update Service. The server was running Internet Information Server but had never been fully configured to run WSUS. The .ASP file on the server contained a key which was loaded into memory and used to unlock additional operations by the dropper code and trigger the ransomware.

All of the targets were hit within five minutes over WMI. The server-side file used to distribute the ransomware, along with most of the event logs on the targeted systems and the server itself, were wiped in the course of the ransomware deployment. Sophos Intercept X stopped the attack on systems it was installed upon, but other systems did not fare as well.

A moving target

It’s not a surprise to see yet another ransomware operator using repurposed code from the offensive security tools world—we recently saw Ryuk using Cobalt Strike post-exploitation tools to great effect. PowerShell Empire is easily modified and extended, and the LockBit crew appears to have been able to build a whole set of obfuscated tools just by modifying existing Empire modules.

It’s also not a real surprise that ransomware actors would want to target AMSI, the interface used by many anti-malware tools (including Sophos’) to monitor potentially malicious processes running on Windows 10. By combining the use of native tools, logging evasion, and the blinding of AMSI, the LockBit gang has made it increasingly difficult to detect and defeat their attacks once they’ve established a foothold.

The only way to defend against these types of ransomware attackers is to have defense in depth and to have consistent implementation of malware protection across all assets. Not having a handle on what services are exposed on a network makes modeling for threats like these difficult. And if services are misconfigured, they can easily be leveraged by attackers for ill purpose.

Sophos detects these abuses of PowerShell and the LockBit ransomware. A list of IOCs for these attacks is posted on the Sophos GitHub here.

SophosLabs would like to acknowledge the contributions of Vikas Singh, Felix Weyne, Richard Cohen and Anand Ajjan to this report.

We’re pleased to announce the addition of bulk firmware updating to Sophos Central firewall management! This feature is available today, for all grouped firewalls, and allows you to trigger immediate firmware updates in one action, for any number of grouped firewalls that have firmware updates available. We’re also pleased to announce the arrival of Scheduled firmware updates! for firewalls running XG v18 MR3 or newer, the time when firmware updates may be installed, may be scheduled from Central.

What’s New and How to Use it:

• Bulk Firmware Upgrades – On the Group menu, Firmware Upgrades may now be selected. This option will bring up a list of firewalls with pending updates. You may select any or all of the firewalls, then with “immediately” selected for the schedule, click Schedule Upgrade. All selected firewalls will begin upgrading shortly, and you will se a spinning gear icon once the upgrade has started. 
• Scheduled Firmware Upgrades – Requires firewalls to be running at least v18 MR3 or newer. When upgrading the firmware for a single firewall by clicking the upgrade icon, or when bulk updating firmware, you may now choose to install immediately, or schedule the update to occur at a future time and date. The schedule will be run based on the firewalls local time zone. 

Responding to the rising wave of social engineering attacks against remote …

Scroll to top

Working remotely and using VPN has become an important part of everyday life. With XG Firewall it’s extremely easy – and free!

XG Firewall is the only firewall to offer unlimited remote access SSL or IPSec VPN connections at no additional charge.

And we’ve significantly boosted SSL VPN capacity across our entire product range in XG Firewall v18 MR3 through several optimizations.

Our new Sophos Connect v2 remote access VPN client also adds new features that make remote access faster, better and easier.

What’s new in Sophos Connect v2

• SSL VPN support for Windows
• Bulk deployment of SSL VPN configurations (as with IPSec) via an enhanced provisioning file
  • Enhanced DUO token multi-factor authentication support
  • Auto-connect option for SSL
  • Option to execute a logon script when connecting
  • Remote gateway availability probing
• Automatic failover to the next active firewall WAN link if one link fails
• Automatic synchronization of the latest user policy if the SSL policy is updated on the firewall (when using the provisioning file to deploy) as well as a manual re-synchronization of the latest policy
• File extension association for policy files – import a policy file into Sophos Connect just by double-clicking it in Windows Explorer, or opening the file attached in an email

XG Firewall v18 MR3 remote access enhancements:

• Enhanced SSL VPN connection capacity across our entire firewall lineup. The capacity increase depends on your firewall model: desktop models can expect a modest increase, while rack mount units will see a 3-5x improvement in SSL VPN connection capacity.
• Group support for IPSec VPN connections, which now enables group imports from AD/LDAP/etc. for easy setup of group access policy.

Making the most of Sophos Connect remote access

The first decision you will want to make is whether you wish to use SSL, IPSec, or both. Then set up your firewall to accept Sophos Connect VPN connections before deploying the client and connection configuration to your users.

SSL vs IPSec

With Sophos Connect v2 now supporting SSL (on Windows) and with the enhanced SSL VPN capacity available in XG Firewall v18 MR3, we strongly encourage everyone to consider using SSL to get the best experience and performance for your remote access users.

While macOS support for SSL remote access via Sophos Connect is expected soon, we recommend any organizations using macOS take advantage of the new OpenVPN macOS client in the interim.

XG Firewall setup

SSL VPN Setup is very straightforward:

1. Follow these initial setup instructions for creating an IP address range for your clients, user group, SSL access policy, and authentication.

2. SSL VPN requires access to the XG Firewall User Portal. For optimal security, we strongly advise the use of multi-factor authentication. Set up two-factor authentication via Authentication > One-time password > Settings to ensure you’re only allowing MFA access to the user portal.

3. Create a firewall rule that enables traffic from the VPN zone to access your LAN zone (or whatever zones are desired).

Deployment of the client is equally easy:

1. Client installer: The client installer is available by navigating to VPN > Sophos Connect Client on your XG Firewall. Sophos Connect documentation is available here.
2. Connection configuration: The SSL VPN connection configuration (OVPN) file is accessible via the user portal, but we strongly encourage the use of a provisioning file to automatically fetch the configuration from the portal. This requires a bit more up-front effort, but greatly simplifies the deployment process and enables changes to the policy without redeploying the configuration. Review the full instructions on how to create a provisioning file with samples.
3. Group Policy Management: The best way to deploy the remote access client and provisioning file is via Microsoft Group Policy Management. You will need the files mentioned in the steps above and then follow these step-by-step instructions.  You can also use any other software deployment tool you have available – even email.

Monitoring active usage:

You can monitor connected remote users from the XG Firewall Control Center…

And click to drill down to get the details…

Sophos Connect resources and helpful links

Based on a comprehensive survey of 5,000 IT managers across 26 countries, Cybersecurity: The Human Challenge provides brand new insights into the state of cybersecurity skills and resources across the globe.

It reveals the realities facing IT teams when it comes to the human-led delivery of cybersecurity, and explores how organizations are responding to the skills challenges they face.

The study also exposes unique insights into the relationship between an organization falling victim to ransomware and their day-to-day cybersecurity practices.

Key findings

IT teams are showing progress in many battles

• IT teams are on top of patching. Three-quarters of IT teams apply patches to desktops, servers, applications, and internet-facing assets within a week of release. Servers and internet-facing assets are patched most quickly, with 39% of respondents patching them within 24 hours.
• Prevention is prioritized. On average, IT teams dedicate nearly half their time (45%) to prevention. After that, 30% of time is spent on detection and the remaining 25% is spent on response.
• IT managers are keeping up to date with cybersecurity. The majority (72%) say that they and their teams are up to date with or ahead of cybersecurity threats. Just 11% think they are significantly behind.

Improving cybersecurity requires people – who are in short supply

• There is an urgent need for human-led threat hunting. Forty-eight percent of respondents have already incorporated human-led threat hunts in their security procedures and a further 48% plan to implement them within a year.
• The cybersecurity skills shortage is directly implementing protection. Over a quarter (27%) of managers said their ability to find and retain skilled IT security professionals is the single biggest challenge to their ability to deliver IT security, while 54% say it is a major challenge.

Organizations are changing the ways they deliver security

• Improving operational efficiency is a key priority. Four in ten (39%) respondents said that improving operational efficiency and scalability is one of their biggest priorities for the IT team this year.
• Outsourcing IT security is rising fast. Currently, 65% outsource some or all of their IT security efforts. This is set to rise to 72% by 2022. The percentage of organizations that exclusively uses in-house staffing will drop from 34% to 26%.

Ransomware victims display different behaviors and attitudes than those who haven’t been hit

• Ransomware victims are more exposed to infection from third parties. Twenty-nine percent of organizations hit by ransomware in the last year allow five or more suppliers to connect directly to their network – compared to just 13% for those that weren’t hit.
• Ransomware damages professional confidence. IT managers whose organizations were hit by ransomware are nearly three times as likely to feel “significantly behind” on cyberthreats than those that weren’t (17% vs. 6%).
• Being hit accelerates implementation of human-led threat hunting. Forty-three percent of ransomware victims plan to implement human-led hunting within six months, compared to 33% for those that didn’t suffer an attack.

• Victims have learned the importance of skilled security professionals. More than one-third (35%) of ransomware victims said recruiting and retaining skilled IT security professionals is their single biggest challenge when it comes to cybersecurity, compared to just 19% who hadn’t been hit.

 

Download the full PDF report for more findings, including results for each of the 26 countries surveyed.

About the survey

Sophos commissioned specialist research house Vanson Bourne to survey 5,000 IT managers during January and February 2020. Sophos had no role in the selection of respondents and all responses were provided anonymously.

Respondents came from 26 countries across six continents: Australia, Belgium, Brazil, Canada, China, Colombia, Czech Republic, France, Germany, India, Italy, Japan, Malaysia, Mexico, the Netherlands, Nigeria, the Philippines, Poland, Singapore, South Africa, Spain, Sweden, Turkey, UAE, the UK, and the US.

Fifty percent of respondents were from organizations of between 100 and 1,000 employees, and 50% were from organizations of between 1,001 and 5,000 employees. Respondents came from a range of sectors, both public and private.