ZeroAccess

This one is dedicated to one of my peers, who recently left the Higher Ed Infosec world for the private sector.  Keep on fighting the good fight, Gabe.

Meanwhile, along with Cryptolocker, we've been seeing lots of ZeroAccess infections.  ZeroAccess is a downloader itself, but it can bring down all sorts of nastiness, from Zeus to Bitcoin miners to clickfraud runners.  It even does fun filesystem tricks to hide itself from antivirus software.  It's a one-stop-shop for badness.

And in the spirit of my Cryptolocker Rap, here's a rap featuring ZeroAccess.

---

ZeroAccess

ZeroAcess:
Worse than taxes!
It's a danger! Don't relaxes.
It's a trojan that harasses.
It infectses all the masses.

Through the I-net,
It's a safe bet,
Through a website when Java abets,
Like a program suid set,
It will take all the things it can get.

ZeroAcess:
Worse than taxes!
It's a danger! Don't relaxes.
It's a trojan that harasses.
It infectses all the masses.

Once it installs,
It has a ball.
Slips by AV and your firewall.
It then makes a little phone call
And downloads friends; makes your jaw fall.

ZeroAcess:
Worse than taxes!
It's a danger! Don't relaxes.
It's a trojan that harasses.
It infectses all the masses.

It does Bitcoin!
IRC joins!
It does click fraud, tries to purloin.
"All your data, it's now all moin!"
Says the malware. It kicks your groin.

ZeroAcess:
Worse than taxes!
It's a danger! Don't relaxes.
It's a trojan that harasses.
It infectses all the masses.

Cryptolocker

The current news is full of reports of a nasty ransomware trojan making the rounds called Cryptolocker.  It shows up as an email attachment, and if the user runs the attachment, the malware will encrypt files and demand payment to decrypt them.  The only way to clean this mess up is to revert to any backups you might have, and if you don't have backups, you will probably lose your data.

This sort of malware makes me angry.  And when I get angry, I want to rap!

---

Cryptolocker

If you see and click a link that's sittin' in your mailbox
The love for your computer will be dashin' on the rocks
You never gonna get all of your data stuff back
'Cause you have fallen victim to a phishing attack!

Cryptolocker gonna get ya', Cryptolocker gonna play.
Cryptolocker got your files, and it won't give them away.
Cryptolocker done encryptin', Cryptolocker walkin' tall.
Cryptolocker want your money, gonna make you take the fall.

Like runnin' ancient Java: you got scissors in your hand,
You're running down a hallway like you late for somethin' grand,
But bullies gonna see you, and they gonna trip you up.
Things will get all stabby when there's Java in your cup.

Cryptolocker gonna get ya', Cryptolocker gonna play.
Cryptolocker got your files, and it won't give them away.
Cryptolocker done encryptin', Cryptolocker walkin' tall.
Cryptolocker want your money, gonna make you take the fall.

Or if you running Flashy or Adobe Acrobat:
It's gonna get all mashy when see what's up with dat.
If your compy still be runnin' wit' the cycles that they hog
You'll end up hacked and broken, and you'll be a botnet's cog.

Cryptolocker gonna get ya', Cryptolocker gonna play.
Cryptolocker got your files, and it won't give them away.
Cryptolocker done encryptin', Cryptolocker walkin' tall.
Cryptolocker want your money, gonna make you take the fall.

You need to look for it...

... to know what it's about.

---

Can you image a world
Ready to accept
All the risks and dangers
Perpetrated against our
Systems, computers, and
Infrastructure?
Can you deal with the
Interminable, relentless
Loss of trust and dark
Emotions that come with a lack of
Security?

Data Steward's Prayer

Our Data, which art in my email attachments folder, vulnerable be thy bits. A hacker comes, some stealing be done online as it is in meatspace. Give us this firewall and daily virus scan and resist any urge to click on email attachments, as those are the source of trespasses against us. And encrypt we must into unreadable hexcode to deliver us from lawsuit.

Amen.

SPC 2013 - Risk Management Haiku

We cannot eliminate risks.  We can only manage them.

We can also dazzle them with 5, 7, 5.

---

Risk Management Haiku

Identify risks:
Boulders cling to mountain sides.
Gravity calls them.

Entropy calls us,
Daring the brave to forget
To run the backups.

Like the beaver's dams,
The change control processes
Keep torrents at bay.

SPC 2013 - Man In The Middle

This is a similar idea to the Shoulder Surf Sonnet, taking the perspective of the Bad Guy(tm).  Both are versions of social engineering attacks, though this one uses a bit more tech to steal the goodies.

---

Man In The Middle

Words and pictures are on the wind,
Secrets are floating by.
A confession to you that I have sinned
While waiting to get to the sky:

My flight, it was late, the crew they just shrugged.
They said it would take a few hours.
So I opened the laptop all day I had lugged
And searched for wifi net towers.

Once I had signal, I smiled a grin,
And I started a small packet capture,
Which let me sit in on chats between kin,
Someone stealing a cover of Rapture.

Another was there surfing websites for some porn.
(I looked around, wondered who did it!)
But then I saw something that tooted my horn!
When I put out some bait, someone bit!

For I stole the gateway and whatever connections
That traveled by SSL tunnel,
And I sent all their passwords in wrong new directions,
Down the spout of an account-stealing funnel.

I gathered them all, all the ones that I could,
Before it was our time to board.
I hugged my PC, I hugged it right good
For it held all my ill-gotten hoard.

The time passed so quickly, I was so entertained
At the expense of all those around me.
I saw what they did, what their small lives contained
And how easy it was did astound me.

And when I get home from my time in the air
Where the words and the secrets do fly,
I look forward to using all the logins I dare
And draining every bank account dry!

SPC 2013 - Firewall

One of the tools in the infosec arsenal is the firewall.  Like any other tool, they can be used well and they can be used poorly.  When they are implemented incorrectly, they are an impediment for the good guys.  When they are implemented correctly, they act as a trusted sentinel for the good guys.

Here, I sing a song of praise for the well-designed and utilized firewall.

---

Firewall

Each packet tells a story,
A single thread in the vast woven tapestry
Of ports and protocols and payloads.

Each handshake, each broadcast, each multicast shout
Race by my eyes and ears.

I stand alone as judge and executioner,
Making no decision without guidance from my Maker,
But once I'm told right from wrong,
You cannot pass if I deny,
You only pass if I allow.

I've gotten smarter after years of tricks and feints,
Endless shadowboxing, jabbing probes and roundhouse floods,
But I don't tire any more quickly
Than the caffeine-fueled demons that drive the engines
Of DoS and phish and drive-by blasts.

I stand and watch them fall.
I guard and shepherd the bits of this world
That hope only to speak freely with their partners
On the other side of the wall.

SPC 2013 - Shoulder Surf Sonnet

It's that time of year again.  It's time for another EDUCAUSE Security Professionals Conference.  We begin with a poem composed while in flight from home to St. Louis, the arch of my plane ride matching that of the great St. Louis Gateway.

I think I succeeded in writing this in iambic octameter.

---

Shoulder Surf Sonnet

I shoulder surfed to watch you type
Your passwords, logins to web sites.
You did not hide secrets from me,
And all you are is what I'll be.

But I don't like just what you are,
The boring texts, pics from the bar.
I think instead I'll change your fate.
You can't deny; it is too late.

Your Facebook's now a shrine to cats.
Your Twitter tweets only 'bout bats.
Your Tumblr posts are all just spam.
Your email's linked to naughty cams.

Next time you type, you must take care
And watch for snooping meanies there.

Come At Me, Bro

BRO is a popular network analysis and monitoring platform among many higher education Security Offices.  Those who use it think very highly of it.  I dedicate this two minute play to them.

---

"Come At Me, Bro"

STAGE CENTER, BRO (MID-30S IT SECURITY PROFESSIONAL, BUSINESS CASUAL DRESS) SITTING AT A SIMPLE DESK WITH A LAPTOP HOOKED UP TO A MONITOR ON TOP.  BRO IS SEATED IN PROFILE, SO WE'RE LOOKING AT THE SIDE OF THE DESK AND BRO IS FACING STAGE LEFT.  SINGLE SPOTLIGHT SHINES FROM BACK OF THE HOUSE ON BRO AND DESK.

BRO (typing on laptop):

I see you.  (TYPING)  And I see you.  (MORE TYPING)  And you.  And you too.  I see what you are trying to do.

You there, the TCP packet with no state flags set.
You there, the spammer, sending with no regret.
From China from Russia from IPs in Bombay,
From Jersey, Seattle, San Francisco Way.
Your traffic flies by me, each bit hits my eye.
The gusts hit me hard, and I try not to cry.

BRO STANDS, CIRCLES THE DESK AND POINTS AT THE SCREEN

But I swallow my tears, my upper lip stiff.
I log it all down, then I start with a diff.
Then I pull out a regex and load my DB,
And the patterns that form are something to see.

BRO GETS PROGRESSIVELY LOUDER AND MANIC, YELLING AT THE SCREEN NOW

You think you can hide as you pop out of TOR?
You think you can 'sploit some hidden backdoor?
You think I won't notice when your DoSes ignite?
You think I will cower and run from this fight?

BRO GRABS THE MONITOR, YANKS IT FROM THE DESK, THE LAPTOP SCATTERS, HE'S NOW SCREAMING INTO THE FACE OF THE MONITOR AND SHAKING IT.

My name is Bro, and I'm on to you!
And I will be watching, whatever you do!
Go ahead, bring it.  I dare you to say,
"Come at me, Bro!" Oh, yeah.  Let's play!

I don't think I posted these before. I created them for a haiku contest that EDUCAUSE has sponsored a while back.

---

Mobile Device Haiku

Any time or place,
The world at our fingertips.
Data on the wind.

Message sent through air,
Dodging wind and rain and snow.
"Remember the milk."

"Secure mobile phone".
Truly an oxymoron
Like "gentle winter".