Cyber War Against North Korea

I’ve heard people calling for retaliation against North Korea for the latest cyber attacks on the US and South Korean Internet sites. That idea is worse than bad, it’s nearly insane. The best that could be hoped for in such a move would be to saturate the attacker’s bandwidth and thus cancel out the attacks. The worst that could happen would be a virtual Armageddon of factions fighting each other on the Internet, with most of the damage being done to innocent bystanders.

The first mistake that proponents of retaliation make is that they assume that North Korea’s government was behind the attack. But they don’t ask for any evidence of this other than one of the possible beneficiaries of the attacks would be the Kim Jong Il’s regime. In fact, conflicting evidence has been pointing toward the UK as one major source of the attack, and the botnet controller may reside in Florida – yet no calls have been made to attack the British or US governments.

In fact, it's unlikely that there is a North Korea-UK-US connection in these cyber attacks. It’s very difficult to determine accurately and quickly who may be behind an attack. It is too easy to hide the real source behind several layers of obfuscation and the perpetrator may only be discovered after the attack has ended, if at all. The bottom line is that we just don't know who executed the attacks.

Even if you have the right country as the source of attacks, that doesn’t guarantee that the government had any involvement. Looking at a different cyber-conflict, there’s no doubt that Russians were behind the Estonian cyber attacks. But much of this activity was likely individuals within the country acting on nationalist sympathy, not a government-sponsored network of attackers. As Marcus Ranum has pointed out, cyber war is unlikely (PDF link).

Even if you assume that you have the right target, retaliating against them will simply escalate the level of hostilities, not calm it. The attackers will raise their level of attack and may practice asymmetric warfare, taking out not just government sites but commercial ones, as well. One of the best ways to change a government’s behavior is to hurt them financially or to turn the people against them.

Now consider a different scenario: someone tries to get two other countries to fight each other. One individual can buy access to 10,000 infected computers inside one of the countries. He then uses these to launch an attack against another country’s Internet sites. The second country then retaliates against the first. Voila! Cyber-war has erupted. In the current botnet economy, this would cost $500-$1000 (according to a presentation by Lenny Zeltser I can no longer find online).

Some people have questioned why North Korea has Internet connectivity at all. It would seem to be easy to find the choke points – ISPs providing service – and get them to disconnect Pyongyang. With the McColo situation, the bad guys just jumped on other ISPs and diversified. With North Korea, the people themselves are isolated from the rest of the world. But I would suspect that the benefits from a connected country outweigh the potential bad sides. It is much easier to get information out of the country via the Internet than physically. So there is a vested interest in us having an Internet connection out of North Korea – we can find out what goes on inside.

So the next time one of these cyber attacks happens and is hailed as the next step in cyber warfare, take a step back and really look at the players and the landscape. Consider what would be the best course of action. And remember that it is very difficult to determine who the attackers are, where they are located and what their motives are. Hopefully our policy makers will do the same.

Blog Comment Spammer Strikes

There's a comment spammer hitting my blog. Some anti-virus company I've never heard of, possibly some rogue anti-malware. Lame. So I've turned on moderation for my old posts.

Wordlist Manipulation

Today I wanted to append and/or prefix a brute force wordlist with some numbers, to generate some likely passwords. I couldn't find a good program to do this, so I tried my hand at some shell scripting. I got too ambitious and tried to add functions to remove duplicates (using the 'uniq' Unix command), sort the list (using the 'sort' Unix command) and do replacement (using the 'sed' Unix command). But all of these proved too time consuming to do right. I didn't want to force the list to be sorted alphabetically in case it was already sorted in a different way (likelihood of use, for example), so the 'uniq' command was useless. And the 'sort' command is so easy you might as well just use it alone. I didn't feel like putting the time into developing the "replace" function since I don't use it all that often (except for capitalizing the first letter, but Brutus has a tool to do that). So here's my script. Don't laugh, it's the first coding I've done since Dr. Scheme, about 5 years ago.

#!/bin/sh

##  listperm.sh - Takes a wordlist and performs permutations on it
##  Copyright (C) 2008 Beau Woods (beauwoods.com)
##
##  This program is free software: you can redistribute it and/or modify
##  it under the terms of the GNU General Public License as published by
##  the Free Software Foundation, either version 3 of the License, or
##  (at your option) any later version.
##
##  This program is distributed in the hope that it will be useful,
##  but WITHOUT ANY WARRANTY; without even the implied warranty of
##  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
##  GNU General Public License for more details.
##
##  You should have received a copy of the GNU General Public License
##  along with this program.  If not, see http://www.gnu.org/licenses/.

##  This script will take a wordlist and either prefix (-p) or append (-P)
##  each line with each line of the file it is to be combined with. For
##  modularity, it will generate new lists rather than overwriting the
##  old ones.

##  Command line options:
##  -in [filename] - This is the wordlist you want to permutate.
##  -out [filename] - This is the list of characters to add.
##  -p [filename] - This will prefix the wordlist with another list.
##  -P [filename] - This will append the wordlist with another list.

vflag=on
ops=0
while [ $# -gt 0 ]
do
 case "$1" in
  -in) infile=$2; shift;;
  -out) outfile=$2; shift;;
  -p) prefile=$2; shift;;
  -P) postfile=$2; shift;;
  *) echo "Error: Unexpected Argument: "$1; error=1; break;;
 esac
 shift
done
 
##  This if block will check to see if the input file is given and will
##  throw an error if not.
if [ -z $infile ]; then
 echo "Error: No input file specified."
 error=1;
fi

##  This if block will check to see if the output file is given and will
##  throw an error if not.
if [ -z $outfile ]; then
 echo "Error: No output file specified."
 error=1;
 else
 ##  This checks to see if the output file exists and if it does, throws
 ##  an error and exits the program. I don't want to clobber the file.
 if [ -f $outfile ]; then
  echo "Error: The output file already exists. Please delete it"
  echo "       and rerun the script."
  error=1;
 fi
 ##  OK, now that we know the file doesn't exist, let's create it!
 touch $outfile
fi

##  This if block checks to see if more than one permeutation operation
##  is called and if so, throws an error message.
if [ $ops -gt 1 ]; then
 echo "Error: Only one permeutation option may be run at once."
 error=1;
fi

if [ $error ]; then
 echo >&2
 echo "Options: -in [filename] -out [filename] -p [filename] -P [filename]"
 echo ""
 echo "  This script will take a wordlist and either prefix (-p) or append (-P)"
 echo "  each line with each line of the file it is to be combined with. For"
 echo "  modularity, it will generate new lists rather than overwriting the"
 echo "  old ones."
 echo ""
 echo "  Command line options:"
 echo "  -in [filename] - This is the wordlist you want to permutate."
 echo "  -out [filename] - This is the output file."
 echo "  -p [filename] - This will prefix the wordlist with another list."
 echo "  -P [filename] - This will append the wordlist with another list."
 echo ""
 exit 1;
fi

##  This will determine if we are doing a prefix or append operation and will
##  set the input file correctly. We could do this at the beginning, but if
##  the arguments are out of order then something might get clobbered.
if [ $prefile ]; then
 postfile=$infile;
 else
 if [ $postfile ]; then
  prefile=$infile;
 fi
fi

#####
##  OK, time to start doing work!
#####

##  This checks to see if the operation is a concatenation and combines the files.
for word in $(cat $prefile); do
 for i in $(cat $postfile); do
  echo "$word""$i" >> $outfile
 done
done

Shmoocon

I'll be at Shmoocon in Washington, DC on the weekend after Valentine's Day. If anybody wants to meet up or something, get in touch with me.

Mac OS X Trojan Horse - Wolf in Sheep's Clothing?

Recently, a Mac OS X Trojan Horse was spotted in the wild. Pretty much everyone reported on it. But the best analysis I've seen is at SecuriTeam.

This is not a new type of attack. There is no new vulnerability exploited. This is not a novel attack, such as a driver exploit. This does not use some new social engineering technique or distribution method. This is not the first instance of organized crime (presumably) attempting to make money from exploiting systems. So why is everybody making a big deal about the new malware? People are making a big deal about this one because of what it is not: a Microsoft attack.

This new Trojan Horse is the first one to take an established commercial malware framework to the Apple platform. For years, these fake codecs have troubled the Windows platform, making untold amounts of money for their creators. They hijack the user's Internet experience and target people inexperienced with computers. But until now, the relatively simple task of adapting these programs for the decade old operating system has been left undone. I believe that there are two reasons for this shift.

The number of people using Apple computers (and therefore OS X) has exploded over the last year and a half. I am currently sitting at a coffee shop and an informal survey shows that there are 12 Macs and only 6 PCs (including, unfortunately, mine). While this is an atypical distribution of hardware, it underscores the point. I know that most of these have been purchased within the last year and a half because they are almost all running on the Intel platform.

As the proportion of Mac users increases, the community is bound to decrease in computer experience. For the last few years, Apple has had a loyal core of customers who are technologically savvy and educated about proper use and maintenance of their machines. However, the recent adopters are typically more casual computer users. This statistic is based on anecdotal evidence, but it seems that most other observers have drawn the same conclusion.

These two trends, increased install base and decreased expertise, will continue upward as computer activities become increasingly platform independent. As more and more services are moved to a Web based format, the importance of a single operating system will diminish. However, malware will continue to exploit the underlying system resources because this is a viable source of income.

Criminal organizations' involvement in computer based crime has drastically risen in prevalence and sophistication over the last few years and there is no reason to believe that this will change. Just like with any money-making organization, these enterprises wish to maximize their revenue streams by exploiting new markets. In order to grow, new resources must be acquired. It appears that Apple computers have been firmly identified as a new resource for criminals.

And like any other emerging market, what is pioneered by one group will quickly be followed by other players. In other words, other criminal organizations will follow suit and develop their software for the OS X operating system to compete with this group's product offering. Eventually, this market segment will become more mature with a high percentage of organized criminals developing for both Windows and OS X platforms the way that other software makers do. What used to be a hobbiest market will be filled by mature product offerings.

If there is nothing new about a piece of malware, it should not be a big deal. But this one is a big deal that many people will only recognize too late. This Trojan Horse is something new precisely because it's just business as usual.