Posts by: Tom F

NotPetya – does society need to start thinking differently?

Talking to a well-respected and hitherto successful businessman at an event recently, he mentioned the NotPetya malware attack and then dismissed it as  “another one of these spotty teenagers misbehaving – something I leave to my technical boys”.  It was very clear from his comments that his perception of cyber risk is that it is, at most, peripheral.  I will not identify his business out of courtesy, but I would have said he is likely to be a pretty high value target, and is probably custodian of a huge amount of valuable information belonging to 3rd parties.

One of the most striking things about the recent series of global cyber attacks is what appears to be a subtle shift in motivation for some of these events…. Whilst the analysis continues and our understanding will continue to develop, there is a clear shift in some of these attacks from cyber banditry to strategic attack. Whilst this is not necessarily a new phenomenon, it is now something that should be understood as mainstream operational risk by those running organisations.

Even if we set aside many of the practical and technical implications (which are widely covered elsewhere), the moment we become part of a strategic target, valuable for our collective value, rather than as an individual target, valuable for our own intrinsic value, then we can expect to see a very different attack tempo. Where attacks are motivated by anarchy rather than theft, the rules change significantly. When the rules change, our response may need to change too.

This shift is analogous to the evolution of the doctrine of asymmetric warfare over the past two decades where it has become clear that the fundamental differentiator is not the way that protagonists behave, but the fundamental value set and drivers that shape their strategy, behaviours and decisions. If, for example, our security strategy is based on the assumption that we can remain safe by creating conditions which are too unsafe for a potential attacker, we become vulnerable to attackers who either care little for safety, or perhaps define it differently to us. This, of course, is the paradigm that underpins suicide bombing as an attack strategy in the physical and space.

Where does this leave us?

As individuals and organisations, we need to think a little about those who might seek to compromise us and what drives them. It is no longer viable to dismiss these attackers as vandals those who behave badly; just as it is no longer sensible to repeatedly hit the “update later” button when our machines ask us whether we would like to update them. Senior decision makers dismiss cyber security as something purely for the technicians to manage at their peril.

Wherever we sit in society or in the workplace, we all need to make a little effort to understand a little about the digital environment and how to stay safe in it. Specifically, we need to think a little about those who may be using this environment to exploit us or do us harm. Whether we read e-books, tablets, hardbacks or red tops – there is material out there to suit most tastes. If that fails there are increasing numbers of people and companies who are able to advise.

Whilst we are not all expected to be experts, we should all have an informed view that is consistent with our role!

The environment we live and survive in is changing, and we either embrace that changing environment, and take responsibility for our own safety, or we should expect to be exploited as a a commodity.

Managing Director of SRM, Tom F is a regular contributor to the SRM blog.

Emerging Trend: Persistent JavaScript Ecommerce Malware

Our analysts report another trend that Administrators should be aware of.  This is a JavaScript-based eCommerce malware that enables the malware to re-infect websites automatically upon incomplete removal.  It has been identified as a new technique being used by cyber criminals.

This type of malware obtains its persistence by modifying databases to force the injection of a malicious JavaScript file into an eCommerce webpage. By targeting databases, the malware therefore becomes resilient to normal removal attempts. Cyber criminals have recently used this technique to target eCommerce merchants by successfully injecting the JavaScript code into a database field of a merchants website and compromising payment card data.

This malware reinfection method can be used on any eCommerce platform that uses database fields to populate content on the shopping cart webpage. Reinfection of websites can be done with the following processes:
1. A database trigger is added to the order table, which injects the malicious JavaScript link into the website template fields.
2. The trigger is executed every time a new order is made.

Scanning for malicious code in HTML files is not sufficient enough to detect this malware alone. Analysis of the database is required to ensure a proper clean-up of JavaScript eCommerce malware is conducted.
Regular scanning of webservers for malware is one recommended mitigation measure eCommerce websites can take to identify security vulnerabilities. Another recommended best practice is to check for malicious database triggers on eCommerce websites and subsequently remove these.

If you are in doubt, contact the SRM  team who can arrange to run a check for you!

Managing Director of SRM, Tom F is a regular contributor to the SRM blog.

Ransomware – Could it be you?….

Complacency has always been the enemy of safety; in today’s world, we are all vulnerable!

The digital (cyber) environment may sometimes be opaque and difficult to understand, but it is a contested environment. If we seek to operate within it, and exploit its advantages, we must actively engage or expect to become a victim.

As I write a number of organisations worldwide, are reeling under the hammer of what appears to be a thoroughly industrialised Cyber Attack. Many of these affected organisations have (or claim) a reputation for strong governance. There is no-one, reading this, who doesn’t have actions that they should have taken or should be taking now.

Whilst it is tempting to view this sort of event as spectators, anyone reading this is unlikely to be invulnerable, whether we are part of an organisation or an individual. There are steps we should all be taking to reduce risk to ourselves or our organisations. We ignore these responsibilities at our peril.

Those who are responsible for the safety of organisations will have already taken actions to ensure that they are as safe as possible. This is part of baseline governance needed in today’s world and no organisation can claim to be competently run if it doesn’t have an effective Information or Cyber Security Management System. If you have one – you will probably know about it!

If you haven’t – then now is a good time to start – and if necessary get in touch with someone who can help you. (if you can’t think of anyone specific or are worried, is a good place to start!) There are a number of excellent schemes and established practices that you can use to raise the bar for attackers. If you have done nothing else yet – at least look at the Cyber Essentials Scheme as a first step.

If you don’t know who is responsible in your company – check – it could be you!

As individuals, however, we are still potential victims of attacks like this, but if we practice basic Cyber Hygiene we dramatically reduce the risks to ourselves and those around us.

Make sure our defences are strong:

Ensure our Anti Virus (even on a mac!), firewalls and software are all up to date and switched on.
Scan our systems with Anti Virus, and do this regularly when attacks are going on.
Stay alert to any suspicious emails, messages and don’t open anything suspicious. If someone sends you something suspicious. Contact them separately to check it is legitimate.
Check that we are using difficult to guess passwords, and that we are not exposing the password protecting our “crown jewels” on untrusted internet sites or unprotected devices.
Check our bank and card statements – Regularly!
Think it through from an attacker’s perspective.

Make sure we are resilient:

Ensure our information is backed and kept somewhere where it isn’t connected to the internet or our main system (e.g. a CD or a Backpack Drive).
Ensure we keep all backup data safe – and if possible encrypted. Ideally under lock and key.
Ensure that any critical information is held safely so that it will be available in the event that our main system is unavailable.

Make sure we know what to do if we are compromised:

Write down a simple plan – stick it on the fridge or the filing cabinet – somewhere we can find it!
Don’t pay ransoms – we shouldn’t need to!
Know who we are going to contact for further advice in emergency.

Don’t Assume – Check that you are as safe as you think you are. Do this periodically and when the risk rises:

Check our Backups are being taken (and that your drive is not full). Check that we can restore them and that they are not corrupted.
Check that you can access your critical data and files if your main system is down.
If you don’t know how to do any of this – learn now – these are basic survival skills! If you have friends or family members who may not be able to do this – it may be worth contacting them to check they are not exposing themselves inadvertently.

Whether we are acting as individuals or are responsible for the safety of an organisation, this is no longer something for someone else to do – we all have a part to play, and must play it to the best of our ability.

Managing Director of SRM, Tom F is a regular contributor to the SRM blog.

Lessons in War Series – The Role of Computer Forensics


Traditionally, computer forensic investigations are seen as reacting to historic incidents and understanding what went wrong retrospectively. But in the cyber world, forensic investigation is a critical weapon which allows us to look forward as well as back.

Cyberspace is a contested environment in which effective situational awareness is vital if we are to gain and maintain control of a particular environment (such as our corporate networks).  In this respect the cyber environment is like any traditional warfighting or security environment.

Cyber is, however, characterised by one significant difference; those senses that humans have evolved to make them so successful (and possibly dangerous) from an evolutionary point of view, don’t work in the cyber environment.  We can’t see, taste, feel or hear what is going on in the cyber environment unaided.  This sensory dislocation is one of the reasons why we often make (or see) so many of the silly mistakes and decisions which provide the basis for most of the successful attacks on our systems.

Cyber operations do have parallels with the kinetic battlespace; ranging from set piece offensive operations to covert, surveillance and persistent insurgency operations.  There are significant differences, however, not least with respect to Geographical Boundaries, Tempo and the way that we can apply force.  Whilst this post is not the place for a detailed analysis of these differences, an awareness of these areas can provide practical insights into how we operate more safely in the cyber environment.

Stripped to its basics, the purpose of the computer forensics (now a multi threaded discipline) is to gain information and understanding about a particular situation in a particular context.  This makes it a valuable proactive tool in delivering the situational awareness which can be so elusive.  Sun Tsu (506BC) advised “Know your enemy and know yourself”. I would argue that this principal is as relevant now as ever.  Forensic Tools and techniques can form the basis of proactive preparation and architecture hardening within a system often conducted as part of forensics readiness planning.

The environment can be designed, from the outset, to favour the defender. In the past, this might have been advantageous – now it is a fundamental requirement for system designers.  Elegantly designed architectures, based on a sound knowledge of the operational environment will make it harder for an attacker to gain the initiative.   Similarly, if accessing the system compels the attacker to leave footprints, it is not only a deterrent but also a helpful tool for later investigation.

In the eleventh chapter Sun Tzu states that a leader must be capable of comprehending “unfathomable plans”. At SRM we have many years’ experience in dealing with cyber criminals so can more readily see patterns in behaviour and predict future actions. We see all forensic investigations as part of the preventative process through which organisations gain visibility of their own, as well as their attacker’s capability.

Managing Director of SRM, Tom F is a regular contributor to the SRM blog.

Doctrine or Dogma – will the Government hold its nerve?

Government hates a policy vacuum. So, while CESG, the UK government’s National Technical Authority for Information Assurance, has brought about changes to the management of Internet Security within government offices, many still rely on the legacy IS1 frameworks to manage their information risk.

No longer legally bound by the cumbersome process of IS 1/2, the new focus is on balance risk management, resilience and incident response. The old process was criticised for being un-wieldy, inevitably leaving system protection behind the curve. By putting the emphasis on guidelines and outcomes, rather than policy and dogma, the new system hopes to keep one step ahead of threats and attackers.

With this shift in focus, there is the potential for public sector risk management doctrine to become dramatically more dynamic. But, while this is ultimately a good thing because it will mean a more agile and responsive framework to operate within the increasingly dynamic risk environment, it will also be increasingly difficult for traditional risk managers (in all sectors) as the process becomes dependent on decision making under conditions of uncertainty as well as the tacit acceptance that mistakes can and will be made.

Protection of systems, particularly relating to the use of social media within the workplace, now relies on an individual practitioner’s capacity to respond effectively to a wide range of different events without recourse to a standardised process within which they can operate.  Significantly, individual practitioners must balance this new freedom with the need to ensure that risks can be managed across organisational and technical boundaries.

Where, in the past, considerable weight was given to process (sometimes 300 page documents were produced in support of IS 1 & 2), now the emphasis is on timely effect. Compliance has become about behaviour not policy.  For highly skilled practitioners this will not present a problem but for those with less experience and confidence, it can be a heavy burden of individual responsibility.

We now need to focus on doctrine rather than dogma.  (I see doctrine as the process by which we write down what we do so that we can do it better; where dogma is when we write things down for the sake of it)!  Policy is a reflection of management intent and in today’s world, our doctrine must be judged by its effect.

Regardless, there are many who feel uncomfortable taking responsibility for their own judgement without dogmatic policy to fall back on.  The question in the long term is whether the CESG will hold its nerve, producing proportional doctrine or whether it and the practitioner community will feel compelled to generate another generation of dogma.

Tom F

Managing Director of SRM, Tom F is a regular contributor to the SRM blog.