Malware/Meeting Notes 2017-06-12

Malware

Date

Monday, 12 June 2017 from 7:00pm to 9:00pm

Event Announcement

https://www.meetup.com/NetSquared-Kitchener-Waterloo/events/239940239/

Location

Communitech Jelly Bean Room 1st Floor, 151 Charles Street West, Kitchener, Ontario Map

Breaking News: Dozens of countries affected by ransomware cyberattack (CBC News, 12 May 2017)

Are you protected from malware? On your desktop computers? On your servers? Does your staff have malware protection at home? Is anti-virus software enough? What's "ransomware"? What's the difference between a virus, a trojan, and a phishing attack? Does it matter? How do you protect yourself from malware? What's the best way to react to a malware outbreak? How do you recover from a malware attack?

We'll share our experiences in a round table discussion, and perhaps have a guest from the industry to provide some of the answers.

--Marc Paré and Bob Jonkman

• Malware/Meeting Notes 2017-06-12

---

Video

Malware discussion at NetSquared KW meetup (courtesy of Gheorghe Curelet)

Guest: Scott Smith

• Tekkshare demonstration by guest Scott Smith
  • A Goods-and-Services marketplace for technical stuff based on Sharetribe
  • Invitation for KWNPSA members to sign up, will waive commission for first year

Meeting Notes

Malware experiences

• from the days of floppy drives

• WannaCry ransomware
  • seemed to be more prevalent on Win7, not so much WinXP
  • Video on encryption in WannaCrypt ransomware: How WanaCrypt Encrypts Your Files - Computerphile

• Malware vulnerability assessments
  • https://www.spacelabshealthcare.com/wp-content/uploads/2017/05/WannaCry-Malware-Assessment-and-Compatibility-Statement_23_May_2017.pdf
  • https://www.sans.org/ has vulnerability reports

• SSL Certificates and PKI
  • Anyone who pays enough money to browser vendors can be included as a Certificate Authority
  • Some CAs have issued invalid certs for well-known domains, eg. DigiNotar and google.com
  • Certificate Authority Authentication is designed to protect against that threat: An Introduction to Certification Authority Authorization (CAA) - SSL.com

Platforms

• Apple malware, adware
  • Nothing super malicious, but affects the browser, user libraries inc. user preferences
  • Backup with TimeMachine, but that takes malware with it
  • Free TV websites and proxy sites seem to be sources of malware
  • Manual restore (not Time Machine) to restore each file individually
  • AdAware bought by Malwareytes, good for Apple platform, free for home use: Malwarebytes | Malwarebytes Anti-Malware for Mac

• Android
  • Large platform, biggest vulnerability
  • Old, refurbished phones may be vulnerable, they don't get updates
  • Same for routers, security cams
  • Fragmentation in market, but providers (Samsung, Verizon) don't provide updates after a year or two
  • Reluctance to update phones because it takes too long (10 minutes!)
  • People are more likely to replace a device than upgrade it
    • Both on desktop and mobile devices
  • Change is scary, some people can't even deal with a moved icon on the desktop
  • SysAdmins are not able to meet the expectations of clients
  • Google is taking heat for lack of Android updates
    • Thought it might have been like GNU/Linux distros (stable, testing, Sid), didn't work out that way
    • Proprietary applications contribute to this, only Google can upgrade their apps
    • CopperheadOS tried to address this with a secure Android OS, but constantly battles Google and vendors

People believe things are secure because they've paid the vendor lots of money, they don't pay the vendor lots of money because the products are secure.

Best defence: Make our purchasing decisions based on public data of vulnerabilities

• More security resources:
  • https://www.cisco.com/c/en/us/products/security/threat-grid/index.html
  • https://www.entrust.com/certification-authority-authorization/

Mitigation

• Software for Non-profit organizations available from TechSoup: Server & Security Software | TechSoup Canada

• Treat the end-user as an adversary
  • Focus on recovery instead of avoidance
  • But should we treat people as adversaries? Technical solutions are not a panacea
• Backups!!!
• Risk management -- given enough time, the probability of being affected approaches one
• Training is necessary, but not sufficient

Defence in Depth

• Backups, backup rotation, offsite backup
• Training
• Updates
• Offsite storage (Cloud), store deleted files for 90 days (version control)
  • But privacy issues with out-of-country routing and storage
• Buy-in from management to provide enough resources (money)
• Honeypot, canary - let SysAdmin know when certain files are being touched

Staff needs to know this Defence-in-Depth is being done, and when

Recovery

• Some people don't care about their data, just re-image the computer
• Shadowcopy in Window -- only Administrator has access, can't be encrypted by ransomware
  • But malware knows Shadowcopy is a good idea, and will try to bypass

• How can you tell your files are encrypted?
  • Applications can't open their data files
  • Some malware leaves messages "This folder is encrypted"

• Stiller software (c. 1995) to identify modified files with checksum appended to all files; won't open or execute compromised files

Meeting Administration

• Time limits? 8:30pm
  • Stay on topic
  • May start at 6:30pm? Consensus, not...