SANS Open-Source Intelligence (OSINT) Summit & Training offers immersive cyber security courses and a free Summit!

Newsletters: NewsBites

Subscribe to SANS Newsletters

Join the SANS Community to receive the latest curated cyber security news, vulnerabilities and mitigations, training opportunities, and our webcast schedule.

SANS NewsBites
@Risk: Security Alert
OUCH! Security Awareness
Case Leads DFIR Digest
Industrial Control Systems
Industrials & Infrastructure

SANS NewsBites is a semiweekly high-level executive summary of the most important news articles that have been published on computer security during the last week. Each news item is very briefly summarized and includes a reference on the web for detailed information, if possible.

Spend five minutes per week to keep up with the high-level perspective of all the latest security news. New issues are delivered free every Tuesday and Friday.

Volume XVI - Issue #100

December 20, 2014


FBI Accuses North Korea of Sony Pictures Attack
US Points Finger at North Korea in Sony Pictures Attack
Breach Attribution is No Easy Task
Sony Hack Code Not Sophisticated


US Government Personnel Data May Have Been Compromised in Breach
New York Financial Institutions Will be Evaluated on Cyber Security
Misfortune Cookie Affects Millions of Routers
Backdoor in Coolpad Android Devices
ICANN Accounts Hijacked Through Phishing Attack
Google Tightens Security for Gmail Extensions
Google Plans to Warn Chrome Users on All HTTP Connections
Indications of Breach at Park-n-Fly
Dutch Privacy Watchdog Hounds Google and Facebook



*********************** Sponsored By Symantec ****************************
Report Highlights: Over 41 percent of email-borne malware contained a link to a malicious or compromised website. Kelihos and Gamut are the top two most active botnets in November. Crypto- ransomware made up 38 percent of all ransomware seen in the month of November.


--Cyber Defense Initiative 2014 | Washington, DC | Dec 10-19, 2014 | 30 courses. Bonus evening presentations include Gone in 60 Minutes: Have You Patched Your System Today? A Night of Crypto; and NetWars Tournament of Champions.

--SANS Security East 2015 | New Orleans, LA | January 16-21, 2015 11 courses. Bonus evening sessions include Stop Giving the Offense an Unfair Advantage; and Client Access is the Achilles' Heel of the Cloud.

--Cyber Threat Intelligence Summit | Washington, DC | Feb 2-9, 2015 | Brian Krebs, renowned Data Breach and Cybersecurity journalist who first reported on the malware that later become known as Stuxnet and also broke the story on the Target and will keynote the CTI Summit. Adversaries leverage more knowledge about your organization than you have, learn how to flip those odds at the CTI Summit combined with 4 intensive DFIR courses.

--10th Annual ICS Security Summit | Orlando, FL | Feb 23 - March 2, 2015 | At the ICS summit you will learn what is the nature of ICS-focused threats & implications of targeted attacks, what is not working and what are the paths (options) to build your program around. In addition Kim Zetter, Author, Countdown to Zero Day: Stuxnet and the Launch of the World's First Digital Weapon, to keynote. Come prepared to learn about the recent onset of ICS-focused attacks and how you need to hone your skills to defend our critical infrastructure systems. Plus 6 top-rated ICS courses.

--SANS Munich 2015 | Munich, Germany | February 23-March 7, 2015 6 courses.

--Can't travel? SANS offers LIVE online instruction. Day ( and Evening ( courses available!

--Multi-week Live SANS training

--Looking for training in your own community?

- - --Save on OnDemand training (30 full courses) - See samples at

Plus Brussels, Dubai, and Bangalore all in the next 90 days.

For a list of all upcoming events, on-line and live:



FBI Accuses North Korea of Sony Pictures Attack (December 19, 2014)

Citing "similarities in specific lines of code, encryption algorithms, data deletion methods, and compromised networks" as well as classified pieces of evidence, the FBI today issued a statement saying that it "now has enough information to conclude that the North Korean government is responsible for" the attack.


US Points Finger at North Korea in Sony Pictures Attack (December 17, 2014)

US officials say that law enforcement and intelligence agencies have gathered sufficient evidence to indicate that North Korea is behind the attack on Sony Pictures. The officials are not providing details, as doing so might reveal how the US was able to penetrate North Korean networks to find the source of the attack. Sony has cancelled the release of the movie that the attackers have been protesting after the group claiming responsibility for the attack threatened violence at theaters if the film was released.


[Editor's Note (Murray): Whether or not North Korea conducted or simply paid for this attack, they have scored a huge victory. They have humiliated both the World's remaining "superpower" and Japan, their ancient enemy and recent occupier. They have won what may be the first and only battle in this "cyberwar." They have demonstrated not only that Sony's security was weak but that Sony had documented the weakness without a budget or schedule for mitigation. They have reinforced the fear that our national infrastructure is vulnerable to crippling attack from the Internet. They have demonstrated that they need only whisper the magic words "nine one one" to get the risk averse, not to say fearful and feckless, American people to compromise the First Amendment and betray all those who have sacrificed life and limb to defend it. Not bad for a starving country that numbers its Internet users in the low thousands. ]

Breach Attribution is No Easy Task (December 17 & 18, 2014)

Not everyone agrees that the Sony Pictures attack emanated from North Korea. Attribution for cyber attacks is difficult. Attackers can use proxies and phony IP addresses, and they can plant false clues inside the code of their malware. The initial attack on Sony Pictures appears to have been financially motivated. The film was not mentioned until later in the chain of events.


Sony Hack Code Not Sophisticated (December 17, 2014)

The malware used in the attack that erased data from hard drives at Sony Pictures was unsophisticated and riddled with bugs. However, it did what it was supposed to do; the malware's purpose did not require complex code. However, the malware's construction indicates a familiarity with the Sony Pictures network.

[Editor's Note (Pescatore): The mainstream press tends to focus on giving the attackers "superpowers," which leads to the "don't blame me, it was an APT" syndrome and failure to address basic cybersecurity weaknesses that enable the attacks. It seems popular to say "don't blame the victims" and it is true that if I leave the keys in my car's ignitions with the doors unlocked and my wallet on the front seat, someone stealing my car or wallet is committing a crime. But, it does *not* mean that my insurance company has to pay off, since I did *not* live up to basic security hygiene. ]

**************************** SPONSORED LINKS ******************************
1) In Case you missed it: Analyst Webcast: Advanced Network Protection with McAfee Next Generation Firewall with Dave Shackleford and Steve Smith.

2) Another chance to win $400 Amazon Card - Take New Survey on Insider Threats:

3) In case you missed it: Tis the Season for Data Breaches and Stolen Identity with Chester Wisniewski:


US Government Personnel Data May Have Been Compromised in Breach (December 18, 2014)

A breach at KeyPoint Government Solutions may have left personally identifiable information about nearly 50,000 US government employees exposed to possible theft. KeyPoint conducts federal employee background checks for security clearances. The Office of Personnel Management has notified people whose information may have been compromised. This is not the first time that a company providing background checks for government employees has suffered a breach. Earlier this year, a breach at USIS exposed personally identifiable information of 25,000 people.

[Editor's Note (Murray): One would expect the remedy for the victims here to be a class action suit. However, in similar breaches in the past, it has been difficult to link the damage to the breach. The courts have accepted the defense argument that the plaintiffs do not have standing to sue. The government needs to write the contracts in such a way as to give the victims just compensation and the contractors sufficient motivation. ]

New York Financial Institutions Will be Evaluated on Cyber Security (December 18, 2014)

The Superintendent of New York's Department of Financial Services has asked member organizations to consider cyber security "an integral aspect of their overall risk management strategy" instead of an issue for just information technology. Banks and other financial institutions in New York will be evaluated on their cyber security, including their use of multi-factor authentication and identity and access management. The requirements affect all financial institutions operating with a New York state charter or license.

[Editor's Note (Pescatore): Saying "just information technology" to most businesses today is like saying "just oxygen" to most Earth-based life forms. Honestly, I really do *not* want cybersecurity assessment blended into the financial industry "risk management" programs that seem to give us constant streams of failed investments, financial meltdowns, insider trading, etc. That said, NY State put together a pretty sensible list of questions - I'd like to see reduction in use of reusable passwords move up in priority.
(Murray): New York State only regulates banks that operate with state, rather than national, charters, i.e., many small institutions rather than the few "too big to fail" institutions that dominate its market. The state regulators have indicated that they will expect "multi-factor authentication," a requirement which federal regulators, under the "Guidance" of the FFIEC, have artfully avoided. ]

Misfortune Cookie Affects Millions of Routers (December 18, 2014)

A critical flaw in more than 200 models of residential gateway devices and small office home routers could be exploited to gain administrative privileges. The issue lies in an embedded web server that the routers use. Attackers could potentially sniff traffic and launch attacks against other systems. The vulnerability has been called Misfortune Cookie because it resides in a problem within the HTTP cookie management mechanism.



Backdoor in Coolpad Android Devices (December 18, 2014)

A backdoor in certain Android devices made by Chinese smartphone manufacturer Coolpad could be exploited to download, install, and activate applications without user interaction; disable other applications; remove data from the device; and receive updates that install applications. Known as CoolReaper, the backdoor appears to be deliberately installed on the devices by the manufacturer.

ICANN Accounts Hijacked Through Phishing Attack (December 17 & 18, 2014)

The ICANN was the target of a data breach following a phishing campaign. The organization's root zone administration system was compromised. The attack occurred late last month and was detected a week later. The compromised data include personal information of people who do business with the organization.


Google Tightens Security for Gmail Extensions (December 16 & 17, 2014)

Google has implemented the W3C's Content Security Policy (CSP) standard for Gmail extensions. CSP provides a layer of protection against cross-site scripting attacks. Those extensions that do not comply with the standard will no longer be functional.


Google Plans to Warn Chrome Users on All HTTP Connections (December 16, 2014)

Google plans to flag all HTTP traffic as unsecure in its Chrome browser. Chrome users will see alerts when they attempt to visit HTTP sites. Google plans to implement the change in 2015.


[Editor's Note (Pescatore): I think Google is actually trying to kick off a debate about how to warn browser users of good/questionable/lack of SSL connections. However, today all browsers already give red/yellow/green indications when SSL is in use but the browser/CA industry has never made any investment in educating users/consumers what it means! More colors and beeps and popups without such education is a waste of time. The "questionable use of SSL" is critical for education, just pushing "SSL in use will make everything secure" philosophy just sends us back to the eyewash days of "as long as you see the little solid key, no worries". ]

Indications of Breach at Park-n-Fly (December 16, 2014)

Financial institutions are noting a pattern of fraud suggesting that Park-n-Fly, a company operates parking lots near airports, experienced a security breach, exposing customers' payment card data, according to KrebsOnSecurity. The company said it has employed third-party security companies to investigate claims of breaches. The breach could also be in the chain of the company's online payment card processing system.

Dutch Privacy Watchdog Hounds Google and Facebook (December 16 & 17, 2014)

The Dutch data protection authority College Bescherming Persoonsgegevens (CBP) has ordered Google to abide by that country's privacy rules or be subject to penalties of as much as 15 million euros (US $18.4 million). Google has been using user data to offer targeted advertising. The watchdog group has also turned its attention to Facebook, launching an investigation into that company's new privacy policy, which is scheduled to take effect on January 1, 2015.


[Editor's Note (Murray): Google and Facebook users have struck a bargain with the devil. Nation states will find that undoing that bargain will be somewhere between very difficult and impossible. ]


Evolution of the Nuclear Exploit Kit

phpBB Compromised

Checkpoint Misfortune Cookie

Git Vulnerability

Microsoft Releases Fixed IE Patch

Coolpad Adds ROM Backdoor to Smartphones

Delta Mobile Boarding Pass Hackable

Linux x86_64 Kernel Priv. Escalation Vulnerabilities

Ettercap Vulnerabilities

Memory Forensics with "Forensic Suite" and Volatility

"Grinch" Polkit Vulnerability

The Editorial Board of SANS NewsBites

John Pescatore was Vice President at Gartner Inc. for fourteen years. He became a director of the SANS Institute in 2013. He has worked in computer and network security since 1978 including time at the NSA and the U.S. Secret Service.

Shawn Henry recently retired as FBI Executive Assistant Director responsible for all criminal and cyber programs and investigations worldwide, as well as international operations and the FBI's critical incident response. He is now president of CrowdStrike Services.

Stephen Northcutt teaches advanced courses in cyber security management; he founded the GIAC certification and was the founding President of STI, the premier skills-based cyber security graduate school,

Dr. Johannes Ullrich is Chief Technology Officer of the Internet Storm Center and Dean of the Faculty of the graduate school at the SANS Technology Institute.

Ed Skoudis is co-founder of CounterHack, the nation's top producer of cyber ranges, simulations, and competitive challenges, now used from high schools to the Air Force. He is also author and lead instructor of the SANS Hacker Exploits and Incident Handling course, and Penetration Testing course.

Michael Assante was Vice President and Chief Security Officer at NERC, led a key control systems group at Idaho National Labs, and was American Electric Power's CSO. He now leads the global cyber skills development program at SANS for power, oil & gas and other critical infrastructure industries.

Mark Weatherford is a Principal at The Chertoff Group and the former Deputy Under Secretary of Cybersecurity at the US Department of Homeland Security.

William Hugh Murray is an executive consultant and trainer in Information Assurance and Associate Professor at the Naval Postgraduate School.

Sean McBride is Director of Analysis and co-founder of Critical Intelligence, and, while at Idaho National Laboratory, he initiated the situational awareness effort that became the ICS-CERT.

Rob Lee is the SANS Institute's top forensics instructor and director of the digital forensics and incident response research and education program at SANS (

Tom Liston is a Senior Security Consultant and Malware Analyst for InGuardians, a handler for the SANS Institute's Internet Storm Center, and co-author of the book Counter Hack Reloaded.

Dr. Eric Cole is an instructor, author and fellow with The SANS Institute. He has written five books, including Insider Threat and he is a founder with Secure Anchor Consulting.

Mason Brown is one of a very small number of people in the information security field who have held a top management position in a Fortune 50 company (Alcoa). He leads SANS' efforts to raise the bar in cybersecurity education around the world.

David Hoelzer is the director of research & principal examiner for Enclave Forensics and a senior fellow with the SANS Technology Institute.

Gal Shpantzer is a trusted advisor to CSOs of large corporations, technology startups, Ivy League universities and non-profits specializing in critical infrastructure protection. Gal created the Security Outliers project in 2009, focusing on the role of culture in risk management outcomes and contributes to the Infosec Burnout project.

Alan Paller is director of research at the SANS Institute.

Brian Honan is an independent security consultant based in Dublin, Ireland.

David Turley is SANS operations manager and serves as production manager and final editor on SANS NewsBites.