QUIC Best Practice

As we all know, Google has a habit of updating their code frequently.  From a Feature Perspective that is obviously good.  From a Security Perspective this can create a problem.  For example, if you have a DLP Endpoint Agent installed to identify/block confidential posts... you may have issues if Chrome gets too far out in front of your agent.  Another example is QUIC.

https://en.wikipedia.org/wiki/QUIC

This UDP Based Protocol will render your proxies useless as we setup redirection for outbound connections destined to TCP:80 & 443.  ESPO Best Practices are as follows:

Option 1: Disable Experimental QUIC protocol on individual Google Chrome browsers. - This can be done by opening Google Chrome, in the URL type "chrome://flags". Look for Experimental QUIC protocol and disable it.

Option 2: Block QUIC using firewall policy - Create a custom firewall service for UDP port 80 and port 443. Configure a firewall policy with the custom service created and set the action to Deny. Make sure this policy on top of all (inside/trusted to outside/untrusted)

Option 3:  Similar to Option 1, you can utilize a GPO to turn off QUIC protocol.  Download the latest chrome adm/admx templates from https://support.google.com/chrome/a/answer/187202?hl=en#windows and find it in Administrative templates > Google Chrome > Allows QUIC protocol.  Set to disable.

In summary, the Easy Button answer might be Option 2.  Block outbound connections destined to UDP:80 & 443 and the browser will have to fail back to TCP.

 

New Malware on the Loose

Heads up!  The following site is actively hosting malware as of the writing of this Blog Post:

What exactly is the malware doing?  Forcepoint indicates nothing good:

Well... I have Cisco you may say... I will be fine:  Ummmm no:

OK, Ok, ok... I have a web security solution from 1 of the other 68 solutions available on the market. Oops!

You may then say, I have defense-in-depth... I have a top notch AV solution.  Unfortunately, only 2 of 54 AV Engines are actively protecting against this executable:

What can I do to protect against this active threat?  Call ESPO Systems for a free consultation.

Water-Cooler Talk

When McAfee acquired Secure Computing, we pretty much all suspected Dave DeWalt was putting lipstick on his pig in an attempt to create a liquidity event for himself.  You could see a lack of integration and R&D investment from the start... much less an understanding of Network Security.  Poor Intel is now stuck holding the goods.  Case in point:

- Current MS Word Document making it's way around the Internet as of 1 hour ago and phoning home to Mother Russia per this Forcepoint Sandbox Report.

- As you'll note in the above report, the outbound call is detected in real-time by Forcepoint as a generic threat:

- What is the threat?  The Forcepoint ACE Engine identifies it as a Dropper File:

- What does Intel/McAfee think about the site?  It's a Shopping site with Minimal Risk from their perspective:

Need help in ripping out your McAfee solution for a true single pane of glass?  Connect w/ESPO Systems and request a free consultation. 

Own Your Network Security?

Cisco has recently changed their Marketing to correspond with their change of leadership/CEO.  Lets test out their current "own your network security" mantra:

1. Microsoft Word documents are propagating across the Internet with malicious macros.  If your users have opened it, they would have seen this:

2. If your users enabled editing (the macro), unbeknownst to them, they would have initiated an outbound HTTP connection to this site in Germany:

3. Question - Would Cisco have enabled you to own your security... or been owned?  Based on what we see below, it looks like you are owned:

In summary, our work can be double checked via this Forcepoint File Sandbox Report.  If you agree with our conclusions, it's likely time to discuss how you can improve your Security Controls.  Learn more about our Forcepoint Services here.

To Russia with Love

Yes... we know it was "From Russia with Love", however, in this case it's a Post not a Get.  Say what?  Well... there is a malicious M$ Word document/macro that is on the loose currently.  As usual, the AV vendors are asleep at the wheel with only 2 of 57 solutions currently protecting our IT Assets:

Why are we so confident that McAfee and others are wrong?  This Forcepoint Sandbox Report proves that rather conclusively. 

OK, Ok, ok... why "To Russia..."?  Per below, the Dropper file performs an HTTP Post to a WWW site in Mother Russia.  This is an obvious outlier as most HTTP/S traffic is Get based rather than Post. 

Why would a Post occur rather than a Get?  Likely to send out your confidential information.  Question - do you have a Data Loss Prevention (DLP) solution monitoring those outbound Posts?  What if it was HTTPS vs HTTP?  Connect w/ESPO Systems for a free consultation.

Macro Malware on the Loose

Heads Up!  Another malicious MS Word file is on the loose with a very low detection rate.  Forcepoint File Sandbox Report here.

Note that only 3 of 57 Anti Virus Companies are properly detecting this malware:

Importantly, per below, note that a number of outbound HTTP Gets occur in which additional malware is downloaded:

Are you safe with old fashion URL Filtering?  Ummmm...nope.  Per below, this Russian Site is new (Uncategorized).  As such, you'll need a sophisticated anti-malware engine on your web proxy, ala Forcepoint's ACE Engine, to stop the 2nd stage of this attack:

Need more info about the Dridex Crew, who's targets have evolved from online banking credentials to this latest round of Locky Ransomware?  See the ESPO Systems Multimedia Portal here.

Symantec Misses on Dropper

A malicious Microsoft Word File w/associated macro is making its way across the Internet this morning.  How do we know?  Our Forcepoint Sandbox detected it... report here.

Unfortunately, and as is the case all too often, Symantec is not detecting this malware as proven by VirusTotal:

What makes us so certain that this file is indeed malicious?  Per below, it's pulling another file down via HTTP:

What does that prove you may ask?  Per below, that file is detected as another Dropper by our Forcepoint ACE Engine which is resident on our proxies:

In summary, AntiVirus is a commodity.  Do not buy into the pitch that it will solve your security problems.  Reduce your security spend on AV and insert Next Gen Security Solutions.  Call ESPO Systems for a free consultation/demonstration.