The Security Skeptic

APWG Global Phishing Survey 2H2011: Trends both encouraging and disturbing

Colleagues Greg Aaron and Rod Rasmussen have published the 2H2011 APWG study on global phishing trends. Some of the major findings from the report are encouraging. The average up time for phishing attacks has noticeably decreased, down from 73 hours in 2H2010 to a much improved 46 hours in 2H2011, with a median uptime of 11 hours. Most of the damage a phish inflicts occurs in the first two days of a campaign so the dramatic improvement in the average uptime is welcomed. While the median uptime for 2H2011 is roughly the same as 2H2011 and more improvement would be welcome (the 11 hours is a larger window than a suggested 4 hours, see Clayton2009, Moore2008) .

Also encouraging finding is that the number of brands targeted by phishers decreased. Well, this is at least encouraging to those brands that fell off the phishers' radars.  Those that remained targeted, however, are weathering a storm. Greg and Rod comment that "phishers launched fewer attacks on such targets through 2011, concentrating on larger, more prominent targets. We believe they did so because:

1. "There is less money to be made off the smaller targets. It is easier for phishers to sell stolen credentials associated with more popular institutions.
2. "Phishers advertise via spam. It is less efficient for them to spam out lures related to smaller targets, unless the phishers possesses a qualified list of e-mail addresses.
3. "There is a growing emphasis on gaining access to e-mail accounts, which enable phishers to spam from whitelisted services such as Gmail, Hotmail, and so on."

CNNIC, APAC Join the Hunt

The staff at China Internet Network Information Center (CNNIC) and the Anti-Phishing Alliance of Chine (APAC) provided more information about Chinese phishing than was available for prior surveys. These data allowed Greg and Rod to call attention to behaviors unique to Chinese phishers, who prefer to use malicious registrations to host phishing attacks, for example, than to host phishing URLs on compromised servers. The data also show Taobao.com as second only to PayPal as the most targeted brand.

Whois from Domain Tools

The 2H2011 Survey is the first in this series to analyze where phishers register domain names. This kind of analysis relies on acquiring the Whois records that reflect the registration data that was used by the phisher at the time of registration. This analysis was made possible via WHOIS data captured byDomainTools.com. Domain Tools attempts to maintain histories of registration records from the time of domain name creation, so their contribution was critical to this analysis. The scores for registrars with more than 25 phishing domains and 1000 domains (from the Report):

Subdomain registrations: 'told you so...

In November 2008, Rod Rasmussen and I published an APWG report, Making Waves in the Phisher’ Safest Harbors: Exposing the Dark Side of Subdomain Registries, where we observed that phishers were beginning to use what subdomain registrations to host phish sites. We discussed measures individuals and organizations can consider if they opt to make these harbors less attractive and effective to phishers. Apparently, few people paid attention, because phishers registered more subdomains in 2H2012 than domain names.

As with all the bi-annual reports of this series, Global Phishing Survey: Domain Name Use and Trends in 2H2011 analyzes data from multiple phish reporting and monitoring resources to assess phishing and e-criminal activity. Greg and Rod are also able to use past survey results to illustrate trends that reports from anti-malware companies often do not include.

The report is always worth reading in its entirety. It's always done professionally, with great attention to detail and a disciplined approach to intepreting data that is hard to find and easy to admire.

Domain Name Seizures Prominent in Dismantling the ZeuS botnet

On 19 March 2012 Microsoft, FS-ISAC , and NACHA filed a Complaint with the US District Court, Eastern District of New York, against thirty nine John Doe defendants who allegedly participated in a criminal enterprise, the Zeus botnet.

Microsoft alleges that ZeuS botnets have purportedly infected an estimated 13 million PCs and have been used to steal over $100M during the past five years. The official Microsoft blog post provides a summary of Operation b71, which involved seizures by US Marshalls of command and control servers in Scranton, PA and Lombard, IL., sinkholing of traffic for subsequent analysis, and the seizure of Harmful Domains and IP addresses used to manage and operate the criminal botnet infrastructure.

Photo by ElDave

Gary Warner and Brian Krebs have again posted excellent analyses of the ZeuS botnet takedown.  Rather than duplicate their efforts,  I’ll instead highlight what I thought to be aspects of the ZeuS Complaint that went beyond actions from earlier takedowns (see Coreflood). I’ll then focus on the seizure of Harmful Domains and comment on the value of providing complete and accurate DNS, Whois, and registry information in legal orders. 

The Complaint and the xTRO 

Microsoft, FC-ISAC, and NACHA identify the 39 John Doe Defendants by their fictitious names: the user IDs of email addresses of the defendants found in Whois records for the thousands of domains enumerated in the Complaint. The claims for relief include the usual suspects Microsoft has included in prior complaints against Rustock, Coreflood or Kelihos: computer fraud or abuse, spam, electronic communications privacy violations, trademark or Lanham Act violations, trespass, unjust enrichment...

New among the claims for relief is the allegation that the 39 defendants acted in concert and conspiracy and thus violated the RICO (Racketeer Influenced and Corrupt Organizations) Act.

John Does 1-3 are alleged to have organized the racketeering enterprise and John Does 4-39 to have contributed various skills to the enterprise: botnet, exploit, and web software development, mule recruiting, botnet and hosting administration, domain and IP registrations.  Botnet customers and "cash out" operators who sold credit card and credentials obtained via infected PCs were also listed.

The Complaint thus alleges that certain defendants conspired as a group to construct the botnet, others used (“leased”) to commit criminal acts, and still others turned stolen properties into cash.

The Temporary Restraining Order is ex parte because the fraudulently composed Whois records are the only identification available to the plaintiffs.The Court accepted the plaintiffs' claims that harms cited in the Complaint will continue unless the defendants are restrained, and ordered simultaneous actions at hosting companies (Continuum Data Center LLC and Burstnet Technologies, Inc.) 'to disable and seize servers and associated stored data' at hosting centers and to monitor and collect traffic for analysis.

Photo by xfordy

John Doe Defendants

The Court also ordered domain registries with US presence to assist in discovering the true identities of John Does 1-39, redirect traffic to servers at a Microsoft secured IP address and to disable Defendants' IP addresses.

It's noteworthy that the order sought to minimize collateral damage to parties that are not named as defendants but are affected by the seizure of equipment and disconnects.

Seizing Harmful Domains

Domain names and name servers play a prominent roles in the ZeuS criminal enterprises. "eCrime" name servers operated by criminals are used to resolve host names for command and control servers and for servers that host ZeuS files.  In Guidance for Preparing Domain Name Orders, Seizures & Takedowns, I explain that providing complete and unambiguous information to domain name registration providers can prevent confusion or delay, and may help prevent or minimize collateral damage. The ZeuS xTRO is a good case study for why I believe this guidance paper is important. 

In my thought paper, I point out that seizures typically instruct registries or registrars to modify the TLD zone file, the domain name registration record (and what is displayed by Whois), and the registry database (of domain names). In the ZeuS botnet xTRO, the Plaintiffs instruct the TLD registry operators to take the following action:

"2. For currently registered domains, the domain name registrant information and point of contact shall not be changed and associated WHOIS information shall not be changed;

"3. Domain names shall not be deleted or otherwise made available for registration by any party, but rather should remain active and redirected to IP address 199.2.137.141;

"4. Domain names shall not be transfered to any other person or registrar, pending further notice from the court.

"5. The Registries shall assume authority for name resolution of domain names to IP address 199.2.137.141 using the name servers of the Registries;

"6. Name resolution services shall not be suspended"

Instruction (2) is clear with respect to preserving registrant and point of contact information, but a consequence of saying only that "associated WHOIS information shall not be changed" is that some of the Whois returned is exactly what was in the registration data "pre-seizure",some of the Whois returned has the registrant/contact information the same as "pre-seizure" but the name server information is changed to NS1.MICROSOFTINTERNETSAFETY.NET, and Whois for some (try FILMV.NET) returns conflicting NS data from the the "thin" .NET registry and the sponsoring registrar. These inconsistencies might have been prevented if specific instructions for how name server information associated with the domain name had been provided.

(3) and (4) instruct registries or registrars to set domain status codes. These are adequately clear, but to eliminate any ambiguity, the order might have specified the exact EPP Status Codes for both registrar (client) and registry (server).

(3) further instructs the registries to keep the domain names "active and redirected to IP address 199.2.137.141." Neither instructions (3) nor (5) make clear whether the Plaintiffs are asking for changes to TLD name server configuration, name service for each domain name listed in the Complaint, or hosting, so they could be interpreted to mean that the registries are supposed to modify the name server configuration information ("glue") in the TLD zone file. They could also mean that Registries should provide name resolution for the Harmful Domains (which would be well out of scope).

A DNS lookup using the dig command shows that 199.2.137.141 is asssociated with a name server, NS1.MICROSOFTINTERNETSAFETY.NET.  In this case it was easy to deduce that the Plaintiffs' intention was that Microsoft was to act as the authority for the nameservers and would provide authoritative name resolution for the domains from a name server operating at IP address 199.2.137.141. In other (future) cases, orders could more accurately say "we want TLD name servers to be configured so that the authoritative name server for all the Harmful Domains listed in the Complaint is NS1.MICROSOFTINTERNETSAFETY.NET/199.2.137.141". The Plaintiffs are then in a position to decide whether to host zone data for the Harmful Domains or to return NXDOMAIN for hosts in the Harmful Domains".

(6) instructs that "name resolution services shall not be suspended". A random sample of the names in the xTRO shows that some return non-existent domain (NXDOMAIN) and some timeout without a response. So by some definition, either (6) was not executed properly by some parties subject to the order but the instruction did not make clear whether "name resolution services" applied to the TLD, which is responsible for identfying the name server(s) associated with the Harmful Domains listed in the Complaint, or resolution of host names associated with the Harmful Domains.

Closing remarks

Inaccuracies and ambiguities are not uncommon in legal orders, in part because the courts or plaintiffs are unfamiliar with the DNS or domain registrations, are imprecise when using domain name-related technology, operations, and terminology, or pressed for time. Checklists like those provided in Guidance for Preparing Domain Name Orders, Seizures & Takedowns may be beneficial in minimizing omissions and inaccuracies. 

David Dittrich has written a brilliant post on the Zeus botnet civil action entitled Thoughts on the Microsoft "Operation b71". One of the points he makes dovetails nicely with what I've discussed here:

"The act of writing up a complaint, backing it up with declarations in support of the plaintiff's motions, and having a federal judge review and grant plaintiff's motions is a very clear, very thorough, and very public justification for taking bold action. This process explains of who is being harmed, how they are being harmed, what can be done to stop the harm, and why the court should grant the plaintiff's motions. If this were a federally funded research study on developing a treatment for a disease, it is this level of detail that must be provided in order to get approval from ethics review boards. If we require such justification of doctors doing risky medical research that can harm us, why should we not have to similarly justify risky actions we take to resolve infected computers? This is the kind of standard that is warranted in order to show defensible justification for taking risky and aggressive action, before such action is initiated."

A late, final word

A recent analysis of operation b71 by Michael Sandee calls attention to the easily overlooked issue that collateral damage is not limited to suspending or making legitimate domains or web sites unreachable. A criminal enterprise the size of ZeuS will no doubt be the target for numerous investigations. Absent sufficient information sharing, cooperation, coordination and trust among investigating parties, there is too much room for error or interference, and one party's success can hamper the erstwhile and equally important efforts of others. Looking ahead, providing clear instructions for domain registries or registrars can be an important part of the level of detail that Dittrich insists must be provided.  Coupling this with the kinds of reasonable efforts Sandee encourages to verify that domains listed in complaints are "harmful" when the legal orders are executed is equally important to minimize collateral damage.

Do spam and piracy problems have a common solution?

A statistic offered during recent conference session stimulated a (then) spontaneous and somewhat provocative stream of thought. Using a very, very large sampling of spam, the presenter and his colleagues had determined that over 70% of spam targeted consumers of "life-style" drugs (non-scheduled prescription medications such as male performance enhancing drugs). This is such a staggering proportion of overall volume of spam that I immediately tried to think of another market where similarly astonishing statistics existed, to see whether there were similarities in demand-supply that made criminal activity attractive.

The answer was obvious: digital copyrights abuse. The RIAA and MPAA attribute losses to piracy that approximate or exceed spam volumes associated with life-style drugs.

RIAA/MPAA piracy "statistics"

For the record, I don't question the validity of the spam statistic because the sources in this case are academians at a reputable university conducting research under the direction of a highly respected professor. The RIAA/MPAA stats are much less trustworthy (see Cato@Liberty), but they will serve my purposes for this post.

 I began to think, "These are both problems of supply and demand, where criminals satisfy the demand in excess of supply. Is there a common way to solve the problem?". 

Some experts argue that the RIAA and MPAA make it hard and expensive to for consumers to get the entertainment they want, at the time they want it, in the forms they want, at what consumers believe is an acceptable cost.  The content suppliers  don't satisfy consumer demand and certain customers resort to "piracy".

Can one argue that the US healthcare system and the US FDA make it similarly hard and expensive for consumers to obtain life-style drugs? Like Big Content, aren't they failing to satisfy consumer demand?Are certain customers responding to spam and resorting to counterfeit life-style drugs obtained through illegal pharm sites for essentially the same reasons that people "pirate" music?

A common solution for piracy and spam?

One suggested solution to piracy is that Big Content evolve their business models and make music and movies cheaper, faster, and readily accessible in all popular mediums. Could we apply this solution to mitigate spam? Specifically, would spam volume and spam-derived revenue be affected if the US FDA allowed life-style drugs to be sold as over the counter products¹?

I discussed this notion with a few experts in the spam field. One expert observed that if life-style drugs *were* OTC, then efficient, high volume online merchants could undercut the businesses that currently market these drugs "illegally". Another agreed, stating that if these products were to be offered over the counter (or perhaps even as generics), the market for the spamvertised product would collapse due to insufficient margins.

Remember, we're talking about what represents 70% of spamvertising here. And there's no obvious candidate to supplant life-style drugs. The next most spamvertised pharmaceuticals are scheduled controlled substances. The markets are much smaller and the risks dramatically higher for both consumer and supplier.

"Increase supply. Satisfy demand. Eliminate the market for counterfeit product."

Admit it. It's as interesting a ten word sound bite as any you've heard this year. And no more provocative than many you've heard from Rick Santorum:-)

¹ In case it is not obvious, nowhere in this "What if?" scenario am I advocating that any drug be made over the counter without considering public health and safety.  

 

A Behavioral Analysis Unit assessment of a APT unsub

The US Federal Bureau of Investigation's National Center for Analysis of Violent Crime (NCAVC) has four Behavioral Analysis Units:

• Unit 1 deals with counterterrorism, threat assessment;
• Unit 2 handles crimes against adults; 
• Unit 3 investigates crimes against children; and 
• Unit 4 manages the Violent Criminal Apprehension Program-ViCAP.

An APT Unsub Profile

If the FBI were to create an APT behavior analysis Unit (5) dedicated to assessing APT actors, and on the extraordinarily small chance that the writers of Criminal Minds were to run out of horrible, real world crimes to base scripts on, the story writers just might profile "the APT unsub" as follows:

The APT unsub is a sponsored actor. We believe his sponsor is a nation state. He has ample funding and technology at his disposal. While not necessarily the author of malicious software, we believe he has knowledge of and access to executable code that exploits common vulnerabilities. 

He combines or modifies malicious software to penetrate network defenses, compromise hosts, monitor activity or exfiltrate information. The APT unsub's activities can persist without detection for long periods of time. He targets military, commercial, government, or critical infrastructure facilities and networks. The APT unsub deliberately seeks out and collects information that can offer a military, commercial, or similarly highly valued advantage for his sponsor.

Photo by PopCultureGeek

He is patient and meticulous, willing to sift through and correlate information fromsurveillance conducted across many hosts over long periods of time.

 The APT unsub studies targets carefully before acting. He is skilled at disguising his intent. Through social engineering initiated via electronic mail, the unsub manipulates individuals within a targeted organization or agency by instilling such fear or uncertainty that the individual acts in haste and in so doing, introduces an infection that is designe to spread across the infected indvidual's network. Malicious code operating on the infected computers are remotely controlled and directed by the unsub to look for information of interest to the unsub's sponsors. This is not a single attack but an occupation.

Unit 5 would next explain what the investigating parties should look for as they pursue the unsub.

Photo by Christophe Verdier

Look for unusual traffic patterns on your networks. Client computers that usually generate "request traffic" outbound may begin to generate "response traffic", typically of much larger volume and most likely encrypted. Devices on your network may receive login requests from unauthorized systems. New application traffic and executing processes associated with remote control protocols may appear in event logs on your client computers. Your client computers may begin to resolve domain names using resolvers that are unfamiliar or unauthorized. Remember. You're looking for new or different activity: any network or host operating behavior that is "never before seen" should be carefully examined for possible malicious intent.

Lastly, Unit 5 might act in the interest of public safety by attempting to inform the public.

While we are taking measures to identify and apprehend the perpetrators, we advise the public to become familiar with the APT unsub and the threat he poses. Most importantly be vigilant in monitoring for signs of this threat. We are circulating a handout that summarizes what we've discussed here. The handout recommends measures you should implement to mitigate the threat this unsub poses.

The handout would look remarkably similar to Mitigation Guidelines for Advanced Persistent Threats.

A practical resource for managing advanced persistent threats (APTs)

You don't have to search very hard to find some Chicken Little fluff piece heralding sky-falling doom in the form of an advanced persistent threat (APT). If your experience is like mine, however, fewer than one in ten of the resources you find do more than tell you what an APT is, warn you that you are already a victim or a victim in waiting, or promise you that you'll be better protected if you buy *this* product.

Photo by Lori

Kudos to the folks at Public Safety Canada for compiling a concise report entitled Mitigation Techniques for Advanced Persistent Threats. They helpfully deconstruct APT by offering a practical, consumable interpretation of each term. 

Advanced

The context for Advanced, for example, is further broken down into sub-contexts. The Report explains that malicious software is not always advanced in the sense that it is "sophisticated" but that it is often readily available exploit code that is simply better leveraged than earlier attacks. Advanced applies more to the growing body of evidence that indicates that state actors and sponsors "select their targets and refine the attack such that selected individuals in targeted organizations become the conduit to the organization's information assets".

Persistent

The context for Persistent is also broken into aspects. The reconaissance aspects is a panoply of P's: the attackers are patient, painstaking, precise, purposeful, and persevering. The execution aspect of a APTs is very "spy" oriented: clandestine and credibly socially engineered.

Threat

The threat is simple: exfiltration of information of a sensitive or secret nature that provides an APT sponsor with "a strategic, diplomatic, military, competitive, technological or economic advantage." 

Most online resources I've found stop here (feel free to recommend any in a comment). This Report goes on to explain the chronology of an APT attack, describing each stage - reconaissance, social engineering, establishing backdoor and C&C, achieving the objective, and maintaining presence. This chronology is a great segue to the remainder of the Report because it gives context for the strategies Public Safety Canada recommends that potential target organizations should take, how to monitor for and detect potential APT activity, and mitigation measures.

The information Public Safety Canada shares in these sections is not radically new; in fact, there isn't a single monitoring, detection, mitigation or remediation measure that hasn't been recommended before. The value of these sections, however, is twofold: first, Public Safety Canada's taken the initiative to gather this information from reputable sources (Aus DSD, McAfee, RSA, GAIC...), consider the growing body of work, and then condense the information into a single reference. More importantly, by creating a single reference, it allows us to realize that defending against APTs is as much a matter of doing better what we do today, with existing instrumentation, as it is introducing new techniques or technology.  

I'm always excited to share when I find a resource that is FUD free and full of useful information. This Report doesn't contain a silver bullet, but it will lend clarity to APT discussions and it may help you define a better strategy for defending against APTs than you have today.

In search of... Foreign Language Spam Filter for Apple Mail (Mail.app)

Foreign language spam is a problem everyone shares, not just folks who read English. If you don't understand a language, and can't read the characters of the script used, you probably won't get much value from messages you receive. Worse, you won't understand the "text" of the links embedded in the message.

Common sense would dictate that you don't click on something you can't read but decades of evidence proves otherwise.  A practical solution to foreign language spam is to prevent it from appearing in your In Box.

If you are an Apple Mail (Mail.app) user, and your organization isn't filtering foreign languages at a mail server or antispam gateway, you'll find that filtering foreign spam is problematic for several reasons. First, there are thousands of languages. Many of these can be written using characters from one or more scripts and many of these can be encoded using  one of (again) many character sets. I receive mail daily composed using Arabic, Chinese, Russian, Japanese, and Korean. Examining the raw source email  From: and Subject: headers of these messages reveals they are encoded using UTF-8, windows-1251, GB18030 iso-2022-jp, KOI8-R, respectively. Filtering based on  these encodings alone is a messy Mail Rule.  

Filtering based on the "language" found in email messages has similar scaling and messiness issues. The problem is compounded by the fact that email messages encoded to support languages that are not represented using 7 bit ASCII can also have multiple body "parts" (as well as attachments) . Body parts are typically distinguished and bounded by the use of Content-Type: headers. Apple's Mail.app seems to examine only the first encountered of this header type, which is often (perhaps intentionally by spammers) multipart/alternative or multipart/mixed so a rule that is supposed to filter  text/plain; charset="windows-1251" as junk will fail to match.

I found a solution at Buzzdroid that works on the principle that certain words (of, the, and, is, a) are found in nearly any rationally composed English message body. Buzzdroi'ds logic is straightforward: if these words are not present, the message is probably not "readable English". A Mail Rule of this kind looks like this:

My variation to this theme (below) is working well, as the Junk folder illustrates:

This is an imperfect solution to be sure. For example, Exchange Calendar invitations match the rule. Tempting...  I created an exception rule "Calendar" and made certain the rule preceded the Foreign Language Spam rule.  Occasionally I receive email composed as if it were a text or Tweet and for these, I may whitelist the sender. After 10 days of testing, I'm happier with a 1 in 10 false positive in my Junk folder than the distraction of messages I cannot read in my In Box. 

As the Buzzdroid folks say, "Any Apple Mail Rule should only be the last line of defense against spam." This problem can be handled at mail servers or antispam gateways but there is an administrative cost for organizations with language diversity: while it might serve me to block all languages that do not use characters from Latin alphabets, many of my colleagues would be inconvenienced. 

I'm curious to hear from others whether a similar approach would work for other languages. If you come up with an Arabic, Chinese, Japanese, Korean, or Russian "only" Rule for Mail.app, let me know.

Cyber Monday safety advice from a late 1960s Rhythm and Brass Band

I love jazz fusion, rhythm and brass bands.  Big horns and powerful, soulful female vocalists were root causes for frequent speaker replacements in my youth. It's no surprise that my iTunes includes albums by Big Brother and the Holding Company with Janice Joplin and  Ten Wheel Drive with Genya Ravan. 

Familiar as I am with this music, I was surprised to discover some sage online shopping advice buried among the lyrics from a 1971 song, The Pickpocket (Album: Peculiar Friends Polydor Records)

Click to play clip of The Pickpocket  Someone's got your wallet You ain't seen his face Someone's got your papers You ain't getting no place  Someone's got your number Pawn ticket on your stuff Someone you've never noticed Knows everything about who you are  You're a fool fool fool and you know that's true he's made a stoned damn fool out of you

Buy the album!

APWG Global Phishing Survey: Phishers like it cheap or free

Colleagues Greg Aaron and Rod Rasmussen have released the 1H2011 APWG Global Phishing Survey which again provides a wealth of statistics and insights into phishing behavior and methodology. One very positive bit of news is that the average duration of a phishing "uptime" (the amount of time phishers can inflict loss or harm) dropped over 25% from 2H2010 and the median of 10 hours 44 minutes is the lowest the authors have reported in four years. On the down side, phishers continue to prefer  to

exploit compromised hosts over malicious registrations and have recycled an old attack tomake this even more confounding to interveners and profitable for themselves. The Report explains that phishers have been very successful in exploiting virtual hosting services: by compromising a single server that supports virtual hosting, phishers can host the same phishing content in dozens of subdirectories.

The Report notes that phishers are also registering fewer domain names. Fewer than one in five phishing URLs included in the study were malicious registrations. However, there's a dark lining in this seemingly silver cloud.

Phishers are Bargain Hunters

When phishers do register malicious domains, they are definitively bargain shoppers. They look for free or cheap registrations, or opportunities to buy in bulk, and they aren't picky about the TLD. Of course, given the choice, phishers are happy to choose free over for fee. But free registrations are costly to everyone but phishers.

Free domain name registrations are offered by registries seeking to grow their market share but according to the Report, phishers flocked to the Tokelau registry. Malicious registrations in TK accounted for a staggering 88% of attacks against Chinese companies. TK's operators have since increased measures to eliminate this attack vector through the unique approach of giving direct access to the registry so that their trusted partners can "automatically cancel any domain name registrations which they find are abused for spam, phishing, or malware". This program will no doubt be exposed to considerable scrutiny but for the moment, it's effectively reducing abuse.

Free domain name registrations by TLDs are not the only source of pain. Hosting companies that offer free "vanity names" to customers who host email or web sites of the form <customer_term>.<service_provider_sld>.TLD also cause considerable pain. According to the Report, subdomain registrations used for phishing now account for the bulk of phishing activity in certain TLDs. 

Subdomain Registrations on the Rise

Subdomain registrations are problematic for brand and trademark protection: while measures taken to detect confusingly similar strings in domain name registrations have proven effective, the same is not so for subdomain "names". The Report confirms that phishers routinely include brand names "somewhere in the URL, where potential victims may see it and be fooled. Internet users are rarely knowledgeable enough to be able to pick out the 'base' or true domain name being used in a URL."

The subdomain registry CO.CC (the Cocos/Keeling Islands), the top offender in 1H2011, is taking measures to reduce abuse. Other operators in the Top 20 may voluntarily do so as well in 2H2011. If they don't, the operators may find themselves in the company of CZ.CC at the receiving end of criminal complaints and restraining orders if other major brands follow Microsoft in aggressively seeking relief.

There's much more in the Report. I find it worthwhile to compare past reports to present, to compare methodologies, observe trends and flocking behavior. I hope you find it as valuable as I have.

Kudos to Gary Warner and his Operation Ghost-Click coverage

By now, many of you have heard about a landmark law-enforcement and private sector action against a click fraud criminal group dubbed Operation Ghost-Click.

I've read numerous articles about Operation Ghost-Click but among these, I cannot recommend any more strongly than Gary Warner's blog at

http://garwarner.blogspot.com/2011/11/operation-ghost-click-dnschanger.html

Gary presents all the elements of the operation in very plain language so that even the most non-technical Internet user can understand the nature of the crimes, how users where affected, how the criminals were tracked down and apprehended, and what charges the individuals in custody face. Ever gracious and professional, Gary includes his own list of additional articles you must read.

If you are old enough to remember serious, investigative reporting, you'll read this article with no small dose of melancholy. It's a shame that this kind of work is rarely produced by today's Fourth Estate.

 

Five reasons to welcome Windows 8 AV, five reasons to worry

Microsoft announces that they intend to incorporate antivirus into Windows 8 OS and creates a flurry of interest. My first reaction was, "finally, a top security story that doesn't involve APT, hacktivism, or $leaks".  The announcement is a significant event and will no doubt change antivirus in several ways.  Embedding antivirus measures in the Windows OS deserves a bit more scrutiny than speculating when the litigation will begin. Here are some reasons to welcome - or worry about - Windows 8 AV.

Five reasons to worry about Windows 8 AV

A monoculture will emerge.  The worry that all third party antivirus will disappear, leaving us only with what Microsoft delivers is rather silly. Malware, whether zero-day or known, relies on communication among infected machines or to command and control. AV vendors will continue a shift from a host-centric approach to malware detection and mitigation to an approach that incorporates and increasingly relies on network traffic analysis. Rather than disappear, third party AV may get better. Transparency and reporting could become issues. We'll have to wait to see.

A monoculture antivirus defense is more easily targeted. While it is true that a common AV is also a common target, Microsoft should be able to better insulate embedded OS functionality attacks in general as well as against attacks that seek to disable AV. A related worry is whether we'll see a resurgence of malware that is destructive when it is detected or when attempts are made to remove malware components. A "Parasite kills the host" strategy seems counter to the revenue model for online crime, which relies on victims using their PCs for banking, buying, etc. It's more likely that criminals will shift even faster to mobile devices than cannibalize their user base.

The quality and feature set of an embedded AV will prove to be sub-par. Some will argue that Windows Firewall is ample evidence that Windows 8 AV will be less than is needed or ineffective. The same argument was made when Microsoft incorporated a TCP/IP kernel. A bad AV is a disaster scenario for Microsoft and Windows users but one that the company ought to be able to avoid if it successfully leverages - and improves - Windows Defender and Microsoft Security Essentials.

The embedded OS will cause conflicts with COTS AV. This outcome is easily avoided. Microsoft can manage the conflicts issue by exposing an API to third party security developers who can then develop products that leverage rather than compete or conflict with embedded functionality. Utilizing a baseline of antivirus functionality as a building block for better AV and avoiding duplication of this functionality can be win scenario for AV vendors and users.  We may end up with a better overall security profile with a "baseline plus complementary" approach.

Will Microsoft stay the course? Providing what could evolve to the accepted baseline for AV and managing market expectations of that baseline could become a bigger investment and responsibility than MSFT is willing to bear in the future. Microsoft's malware research and its recent aggressive tactics against botnets suggests they are in the fight for the long haul and that they intend to stay competitive. If they change gears with future versions of Windows, the world wont end. We'd very likely return to what we have today.

Five reasons to welcome  Windows 8 AV

Windows 8 AV sets a new baseline for host resident AV. Monoculture or not, having AV on every Windows 8 host ought to improve the current situation. 8AV wont alter the zero-attack problem space but surely it would be A Good Thing if all Windows 8 (and future Windows) hosts were able to detect known infections, would offer protection against bootable removable media infected with malware, etc.? It's not clear whether (or when) Microsoft would move AV "to the cloud" but this, too, would seem to be a good thing.

Windows 8 AV will stimulate for innovation in AV. The AV community is beseiged with criticism regarding the efficacy of host resident AV. Building on the Windows OS resident AV should allow AV vendors to avoid duplication and focus on adding new value. Diverting funding to R&D that would otherwise be spent across the industry, by each vendor, to develop detection and mitigation for mostly the same malware and variants sounds pretty good to me.

The move will stimulate greater collaboration - and scrutiny. Collaboration among AV vendors and MSFT will be a necessary condition for success and it will be essential if we are to manage the global malware threat. The AV community will surely watchdog Microsoft to ensure that its embedded AV meets expectation. Features that Microsoft fails to include will be fair game for innovative and agile AV vendors.

The move will thin the herd. AV vendors who cannot adapt will disappear. The AV vendors who survive will  have developed complementary security measures that security-minded users or enterprises will be willing and eager to purchase. This is no different from the situation TCP/IP stack vendors faced when Microsoft incorporated a TCP/IP kernel into the OS.

AV vendors will be forced to look at the network. Host resident AV is no longer sufficient in and of itself to detect malware. Network traffic analysis reveals complementary (there's that word again) and critically important insights into what miscreants are doing, where the infected hosts are, and how they are being commanded and coordinated. Many attacks are detected through network traffic analysis today. Traffic is scoped back to source hosts and processes and AV engineers use this to analyze and deconstruct malware. This analysis will become more prominent and effective.

Much ado over AV

Windows 8 AV won't kill or even corner the antivirus industry. The malware threat reaches well beyond Windows PCs. When I shared these thoughts with my partner, Lisa Phifer, she offered the following comment, a great conclusion for this column:

"Expect antimalware to continue to be applied at multiple points - endpoint, network, server, cloud - for layered defense. At the same time, virtualization and mobility are turning endpoints back into dumb terminals that run virtual apps and house secure vaults. At least on those endpoints, this trend is already deemphasizing resident AV and pushing AV scanning into the cloud. Host OS's don't fall into this bucket yet. But you can see demand growing for  endpoint OS's that are inherently secure and manageable, but relatively simple above that. Embedded AV - if streamlined and focused on low-level threats - kind of fits into that evolution."