Shearwater Information Security. Past and upcoming events.

A Milestone for Microsoft Australia and Shearwater


We are very excited about Microsoft’s announcement that the Australian Signals Directorate (ASD) has certified a number of Microsoft’s Australian based online services offerings.

The majority of these newly certified services are simply not available from any other cloud service. With these certifications, Australian hospitals, educators and government agencies at federal, state and local level can all take advantage of sophisticated capabilities like machine learning and analytics, internet-of-things, and advanced threat protection – all in the cloud – with the confidence that these services are verified and certified by the Australian government.

We are proud to say that the Shearwater team with their combined expertise have played a key part in enabling this milestone. and in helping Microsoft demonstrate compliance with the Australian Government requirements for ICT systems.

In his LinkedIn article, Microsoft’s Chief Technology Officer, James Kavanagh, wrote “ We chose to engage an Australian company called Shearwater to lead that (IRAP) assessment because of their reputation for rigour and expertise. They performed their work in multiple stages and then presented their reports to Australian Signals Directorate.”

Engagements such as these are incredibly exhaustive. Our Canberra Team has worked tirelessly in Australia and the US to understand each cloud service architecture, review documentation and processes, interview stakeholders, and to validate that the right controls are in place and effective.

Our senior consultants have the necessary ASD IRAP experience and were able to execute on a methodology that successfully addressed Microsoft’s and ASD’s IRAP program requirements. They have handled what was a really complex set of objectives and demonstrated the wealth of experience and expertise that sets us apart from the crowd.

No two engagements are ever the same; the ability to use multiple tools and tailor a solution that delivers the best possible outcome for customers means that we’re always able to inform a strong, successful strategy.

Microsoft’s exciting announcement is just the start of a new and more connected future for government and business. We couldn’t be more delighted to be involved in the journey to guide one of the world’s most influential organisations through Australian Government ICT security requirements.

Well done team for delivering on our values of offering a magical customer experience and owning the outcome.

For more information on Microsoft’s latest offering, please check out these links:

LinkedIn
ARN
Computer World
The Australian
Australian Financial Review

Announcing the winner of the Shearwater Capture the Flag contest at AusCERT2016


…and the winner is… from the Ukraine, Team “dcua”. Shearwater Capture the Flag (CTF) challenge at AusCERT2016.

The 48hrs non-stop contest featured 30 uniquely crafted challenges written by the expert team at Shearwater Solutions. The challenges included Web Exploitation, Reverse Engineering, Forensics, and many others.

The contest was varied, featuring the usual capture the flag games, in addition to real-world scenarios inspired by hundreds of penetration tests and incident responses that we have conducted over the years. The result was a unique and diverse contest with challenges ranging from easy to mind-bending. This allowed players at all skill levels to participate. Contestants included students, amateurs, and seasoned professionals.

A number of participating teams proved surprisingly nimble, advancing swiftly through the competition and solving some of the challenges in ingenious ways. But as expected, Shearwater Capture the Flag team included scenarios that threw participants off-balance and diminished any hopes of a quick win. These challenges included “vmessage”, a forensic challenge, which took 30 hours to solve, and “doggone”, a packet analysis task, which took nearly 42 hours to solve.

All participants deserve acknowledgment, especially those who played solo for the duration of the competition. Other participants made a great effort to balance work commitments with the challenge, many of them enlisting colleagues along the way.

The top 3 teams at the competition were:

  • Team 1: dcua
  • Team 2: Capture the Swag??
  • Team 3: rand0ml0l2

This event was an opportunity for Shearwater to host a free educational initiative to benefit the Information Security Community. The feedback from players tells us that this contest has been a skill validation for some and a baptism of fire for others, but overall it was fun for all.

Event Summary:

  • Challenges were written by Shearwater Ethical Hacking team (SEH). Shearwater Ethical Hacking is a trusted provider of penetration testing services for the private sector and government organisations.
  • 95 teams registered for the contest. The majority of these teams were Australian but others joined from Asia, Europe, Africa, and the United States.
  • The players had diverse skill sets and included amateurs, students, and seasoned professionals.
  • Whilst all the challenges were solved, no single team was able to solve all the challenges.
  • “dcua”, a Ukrainian team, won the competition scoring 3250 out of the 5250 available points.
  • The hardest challenge was “doggone”. It was solved 42hrs into the competition.
  • The 2nd hardest challenge was vmessage. It was solved 30 hours into the competition.

MS15-034 – HTTP.sys Advisory


By Mark Hofman, Terry Darling, and Simon Treadaway


1- Background on Microsoft Security Bulletin MS15-034 (CVE CVE-2015-1635)

Microsoft earlier this week released a patch for both servers and workstations, MS15-034. This patch addresses an issue in the file http.sys. The http.sys file is used by the operating system to accept and process HTTP and HTTPS requests. At the time of release the information provided by Microsoft was that remote code exploitation may have been possible. Since its release on Tuesday Proof Of Concept (PoC) code has been published on the Internet. The initial versions would only check for a particular response from the server. However these have now morphed into simple requests that will cause a Denial of Service (DoS) and cause the Windows system to blue screen.

The vulnerability may result in a complete takeover or disruption of systems and services through a successful DoS attack. Microsoft states it has not received any information to indicate that this vulnerability has yet been publicly used in attacks, however since its release PoC code has emerged, and multiple threat intelligence honeypots are detecting scans for this vulnerability utilising the strings that result in a DoS.

Mass scale exploitation of Internet-facing web-servers having the vulnerability is expected.

As exploitation does not require authentication or an indicator of compromise the most effective response is to implement remediation measures as soon as reasonably possible.


2- How does it work

The vulnerability is in the main component of the Windows HTTP protocol stack known as http.sys and is caused when http.sys improperly parses what Microsoft describes as “specially crafted HTTP requests”. The specially crafted packet is a header request sent to the server with a RANGE parameter and some values.

 

GET / HTTP/1.1 Host: MS15034 Range: bytes=0-18446744073709551615

 

Successful exploitation of the vulnerability could allow an attacker to remotely execute arbitrary code in the context of the IIS account being used (the default IIS user account is SYSTEM) and to thereby gain full remote access to the affected Windows system. It is however more likely that the DoS version of the code will be used to disrupt services.

Further technical details can be found at:


3- Who is affected

Any Microsoft server or workstation that accepts HTTP/HTTPS traffic is likely to be affected by this issue. Whilst most of the information available focuses on IIS, as this is the main application that utilises this particular file, it is not the only product running in Windows environment that will be vulnerable.

Microsoft states the following versions of their operating system is vulnerable:

  • Windows 7 for 32-bit Systems Service Pack 1
  • Windows 7 for x64-based Systems Service Pack 1
  • Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1
  • Windows Server 2008 R2 for x64-based Systems Service Pack 1
  • Windows 8 for 32-bit Systems
  • Windows 8 for x64-based Systems
  • Windows Server 2012
  • Windows Server 2012 R2
  • Windows Server 2012 (Server Core installation option)
  • Windows Server 2012 R2 (Server Core installation option)


4- How can you identify if you are vulnerable

The mainstream testing tools such as Nessus, Nexpose and nmap have updated scripts and signatures to perform checks.

The simplest method to test if your machine is vulnerable is to perform the following check from either a linux system or windows system (that has curl):

$ curl -v [ipaddress]/ -H “Host: test” -H “Range: bytes=0-18446744073709551615”


if the response includes “Requested Header Range Not Satisfiable” the server is likely vulnerable.

 

<!DOCTYPE HTML PUBLIC “-//W3C//DTD HTML
4.01//EN””http://www.w3.org/TR/html4/strict.dtd”>
<HTML><HEAD><TITLE>Requested Range Not Satisfiable</TITLE>
<META HTTP-EQUIV=”Content-Type” Content=”text/html; charset=us-ascii”></HEAD>
<BODY><h2>Requested Range Not Satisfiable</h2>
<hr><p>HTTP Error 416. The requested range is not satisfiable.</p>
</BODY></HTML>


Some PowerShell alternatives are available but testing suggests these scripts may not be reliable.


5- How can you remediate

To fix the issue the only approach at this time is to patch and apply the fix released earlier this week (i.e. MS15-034). Priorities:

  1. Internet facing Microsoft web servers should receive first priority, especially those utilising IIS as the web server.
  2. As a second priority any remaining internet facing Windows systems should be patched.
  3. Internal servers utilising IIS
  4. Remaining internal servers
  5. Workstations (unless these are running IIS in which case they should be treated as a level 3 priority)

Alternate options:

  • Disable IIS caching (IIS 7 upwards) – This will prevent the attack from being successful however will have significant impact on the performance of the server and is not a first choice.
  • Intrusion Prevention Signatures – The main Intrusion Detection vendors as well as those with Next Generation firewalls will already have signatures for this attack. Please be aware that effectiveness depends on the signature.
    • The more effective signatures will target the RANGE request as that means it will identify and drop all requests. It is not a parameter that is regularly passed in a normal application.

Given the criticality of the vulnerability Shearwater’s recommendation is to patch in accordance with the priorities outlined above.


6- How can we help

If required there are several ways in which we can assist. These include:

  • Identifying vulnerable services
  • Prioritising patch deployment
  • Assisting with risk management

Shearwater is dedicated to its customers’ security, and are always happy to provide advice. If any assistance is required please contact us via email to: seh@shearwater.com.au or via phone on: 1300 228 872