The IT Nerd

Cado Security, provider of the first cloud forensics and incident response platform, today announced the availability of Masked-AI. This open-source library enables the usage of Large Language Models (LLM) APIs such as OpenAI/GPT-4 more securely without sending out sensitive information. Available as a download from the GitHub repository, Masked-AI allows developers to use APIs such as OpenAI without worrying about security concerns.

Previously, the company introduced an Interactive Incident Response feature within the Cado Platform utilizing GPT-3 to further streamline forensic investigations and expedite response. Cado noted several potential issues with using GPT-3 in production environments for the incident response use case, including privacy-related concerns. Introducing Masked-AI is Cado Security’s initiative to foster a community around speeding up incident response in the cloud while leveraging LLM APIs securely to increase the efficiency of security teams.

Sharing highly-sensitive data with a third-party API is a massive security and privacy concern. Even with data usage policy changes, there have still been security issues causing concerns amongst the industry including the exploitation of users’ AI conversations. With these types of incidents still at large, the launch of Masked-AI offers users the ability to conceal sensitive data shared via API to ensure confidentiality and greater security, while continuing to take advantage of all of the benefits AI has to offer.

Masked-AI currently masks individuals’ names, credit card numbers, email addresses, phone numbers, web links, and IP addresses. The tool is “masking” or replacing sensitive data with a placeholder and sending the masked request to the API. The solution stores a lookup table locally to then later reconstruct the API output to include the sensitive data for the user to consume.  

The Python SDK and CLI tool is a free, open-source companion to Cado’s enterprise/commercial product for cloud forensics and incident response. The new open-source tool developed by Cado’s software engineering team has also been integrated with the Cado platform to further optimize and expedite the end-to-end incident response process.

For more information on getting started with Masked-AI, please visit https://www.cadosecurity.com/introducing-masked-ai-an-open-source-library-that-enables-the-usage-of-llm-apis-more-securely/.

To learn more about the Cado Platform, visit https://www.cadosecurity.com/platform/.  

Cado Security have revealed a  previously undiscovered TeamTNT malware sample that Cado Labs encountered after Sysdig reported on a sophisticated cloud attack identified in a client environment. 

Without more information, it’s impossible to conclusively link the sample analyzed in this blog to the attack Sysdig reported. Still, it’s interesting that these files surfaced around the same time. 

The new report unearths a previously-undiscovered payload from a threat actor well-known to Cado researchers.

You can read the report here.

Matt Muir, Threat Intelligence Researcher at Cado Security, recently discovered a novel crypto jacking campaign targeting insecure deployments of Redis that leverages transfer.sh, a free, open-source command line file transfer service. 

This research has been published and analyzes initial access achieved by an exploit that’s a favourite of threat actor groups WatchDog & TeamTNT, why this a novel technique through exploring its primary payload (memory configuration, actions on objective, and propagation), and IoCs.

Although reports of this service being used for malware distribution have been rare, Cado Labs telemetry suggests that this is changing as researchers are seeing an uptick since the beginning of this year.

You can read the research here. But I also have a Q&A with Matt Muir, Threat Intelligence Researcher at Cado Security:

1. The attackers compromise Redis insecure instances (do you know how?)

• Redis exposes an API endpoint that allows developers to interact with the data store via the redis-cli command line tool
• In more recent versions, they introduced authentication for this API endpoint (ignoring requests from unauthenticated clients)
• Despite this, Redis’ security documentation states that DBAs should avoid exposing this endpoint to the internet
• If the API endpoint is exposed to the internet, and authentication isn’t configured (or available), it’s possible for an attacker to remotely connect to the data store using redis-cli
• Attackers use tools like pnscan (such as in this campaign) to conduct mass scanning of the internet, looking for nodes with the Redis default port open
• If they find such nodes, they attempt to connect to Redis in an opportunistic manner

2. Write a cron job that will trigger the reading of a file (exploit?) that allows them to execute code

• Once connected to the data store, it’s possible to write values to specific keys
• One such value could be a string representing a cron job
• It’s also possible to use redis-cli to save a version of the database to disk
• Once a string with cron syntax is written to a key, you can then use redis-cli to set the working directory to a cron directory
• Saving the contents of the database to disk saves a binary file (representing the database) with the cron job embedded as a string
• Crond then parses the database file as if it were a plaintext file containing a cronjob and registers the job
• Execution is then determined by the syntax of the job
• In this case, the job can be seen in the ‘command’ section of the first screenshot of the blog
• It retrieves a script (analysis of which forms the bulk of the blog) from transfer.sh, saves it as .cmd and executes it via bash at an interval of every second minute

3. The (same?) cron job executes every second minute and runs a cURL command to retrieve a payload from transfer.sh, which is saved as a .cmd file, which is executed and:

• Correct, see above

4. Prepares the targeted host for cyptomining (how “noisy” are these measures?)

• This depends on the target system and how much monitoring is enabled
• A lot of the host configuration would appear in audit daemon logs but these aren’t enabled by default
• SELinux interaction appears in /var/log/avc.log (for some distros)
• Configuration of drop_caches would be logged to /var/log/messages or /var/log/syslog depending on host settings

5. Finally, the script retrieves the pnscan and XMRig binaries (also from transfer.sh?)

• These tools are open source and are hosted on Github

6. While XMRig starts mining, the script uses pnscan to find vulnerable Redis servers and propagate a copy of the script to them (Only Redis servers on the same network, or? Which weaknesses does it exploit to gain access to them and execute the script? How is the script delivered? Is this whole process automatic? If yes, could this be considered worm-like behavior?)

• Propagation is conducted via the method described above
• Pnscan is used for internet-wide scanning, so distribution is not limited to the local network
• Which weaknesses does it exploit to gain access to them and execute the script?
  • Unauthenticated Redis file write, as mentioned above
• How is the script delivered?
  • using the unauthenticated Redis file write method to write a cron job
• Is this whole process automatic? If yes, could this be considered worm-like behavior?
  • yes and yes

– When you say “Security professionals should be aware of [the trend of criminals using transfer.sh] and implement detections accordingly,” what do you specifically mean?

• If you currently have a network-based detection for traffic to other suspicious file hosting domains (e.g. pastebin.com), supplement this detection with the domain transfer.sh
• transfer.sh wasn’t previously known to host malware, now there’s evidence that it is being used to host malware

With the Super Bowl on Sunday, February 12, cybersecurity experts are not betting on the game itself but whether we will see any operational disruption to the game due to cyber attacks?

James Campbell, CEO & Co-founder, Cado Security has spent his career protecting large scale events, like the Olympics, from potential cyberattack interference. Here’s a Q&A that illustrates his thoughts on this topic.

What motivates threat actors to target large-scale physical events?

Financial gain: If it is a large-scale physical event where everything has to go right at this moment in time, opportunistic cybercrime motivates threat actors who can hold an event for ransom, so it could be a good ransomware situation for criminal actors, albeit they don’t tend to focus on those sorts of things, but it’s certainly something that could occur through disruptive campaigns as an angle for criminals.

Sending a message: Nation-states are sending a message and making a point with operational impact. The second and likely motivator is through high-profile events, particularly in a time of political unrest across the world; if you were to disrupt another nation’s large-scale event, that would be sending a message. While it isn’t a message that has a physical impact, it can be a clear shot, a pretty big deal without actually firing anything real. 

Interestingly at a time like this, threat actors can leverage this. Looking at the current state of affairs, it would make sense for nation-states to capitalize on a campaign against potential enemies across the western world. One of those could be disrupting large-scale events.

If nation-states want to show that they can impact the western world, then high-profile events motivate threat actors. Showing that they can interrupt large-scale with a click of a button sends a powerful message that you can influence and make an impact no matter where you are in the world. An easy way to send a clear message is to disrupt a large-scale physical event like the Super Bowl. The US would not retaliate physically, so it’s a lower risk for nation-states during uncertainty. 

Hacktivism: getting your political message across using the event or disruption activity at the event to raise media awareness of your message. The climate change protests and the like, in general, are against big events, so another thing to consider is that someone might try to aim to disrupt an event which can be as simple as a denial of service on a website or finding a way to discredit an event through cyber means, which hacktivists could do by are utilizing the high-profile space of the event to raise awareness of their own political or general motivated issues. 

What would be the most disruptive to the Super Bowl?

One of the main disruptions to the Super Bowl would be denying the ability for it to be televised, which would probably have the biggest impact other than physically ensuring the Super Bowl doesn’t run itself, which would be a harder task. With millions of people worldwide watching and the advertising and revenue generated from the SuperBowl, if you’re going to get a certain point across, then restricting the ability to broadcast it live would have the most significant impact you could have out of all of it, albeit not the only impact.

How are cybersecurity teams likely approaching this event?

Cybersecurity teams would be trying to understand the big impact events such as media availability, making sure the event, in general, runs smoothly, making sure that ticketing works, and ensuring the general safety of the event are upheld, so they’ll be considering all of those elements. 

The one thing that would be tricky for security teams is that it’s not just one entity or single network they must look after. An event like the Super Bowl involves numerous suppliers, media companies, etc., all of which are responsible for looking out for their networks, collectively making up how the Super Bowl is run. 

From a risk standpoint, security teams want to try to manage the best they can that all of the suppliers and everybody who are essentially helping run the Super Bowl are maintaining a good level of security and also, from an operational perspective, make sure they have appropriate continuity plans in place should something happen they can fall over to a plan B and keep the event going, live, and streaming worldwide.

What are some best practices to ensure operational resilience and sufficient cybersecurity standards?

Understand the risk to your suppliers: the data they have access to, what operational capability they bring to your event, how they operate, and what they do to maintain resiliency. What are the associated risks, types of threats you’re likely to encounter, and avenues they could potentially exploit? 

Focus your resources on hardening those and making them more resilient because trying to secure all the things is only sometimes practical. You need to understand where to start, what’s your highest risk and profile, then tackle that first. 

For an event such as the Super Bowl, this starts with the suppliers, people, networks, and technology that make the event possible, ensuring they are doing it from a risk, security, and resilience perspective. 

From a best practice perspective, they would have prepared for it by engaging the critical suppliers as part of the significant event and exercising various cyberattack scenarios to ensure they have the proper checks and balances to respond accordingly and maintain resilience. 

What are the moving parts when it comes to people organizing these events?

From my experience with events, there are many moving parts – third-party risk – when it comes to people organizing these events.

Some straightforward examples are denial of service and attempts to bring down live feeds or general websites so people can’t buy tickets or get updates. These are pretty simple things to do, but they can be very complicated. There’s a monumental effort to deliver live feeds of the games, commentary, and different languages to the world, a lot of which is physically at the event.

The televised network and server sitting in the data room in the Super Bowl is secure with patches and firewalls, but what happens if you don’t have control of the room itself? The building management system might be separate from that, and you might not directly control or have access to that. Suppose threat actors attack IoT and turn off the air conditioning in the building management system. In that case, all those computers are useless because you must immediately turn off all your servers, or else they melt within 15-20 minutes.