Trend Micro Facebook TrendLabs Twitter Malware Blog RSS Feed You Tube - Trend Micro
Search our blog:

  • Mobile Vulnerabilities

  • Zero-Day Alerts

  • Recent Posts

  • Calendar

    September 2015
    S M T W T F S
    « Aug    
  • Email Subscription

  • About Us

    Author Archive - Martin Roesler

    Is it time to hop off the endless cycle of Flash vulnerabilities and updates?

    Last week has not been great for Adobe Flash. The 440GB of leaked Hacking Team emails has become a treasure trove for vulnerability hunters. Over the past 7 days, Flash was hit by three separate vulnerabilities:

    At this time, only the first vulnerability has been patched. Adobe has already promised to fix the two remaining issues sometime this week, but this does not guarantee the extinction of future vulnerabilities for the platform. It is then only fair to ask: Is it time to stop using Adobe Flash?

    Flash has been something of a security house of horrors for some time. For many years, this blog has been documenting various Flash vulnerabilities. Each time, consumers have had little recourse except to be careful about what sites they visit, disable Flash if they felt particularly concerned, and wait for Adobe to release an update.

    The disclosure of the three Hacking Team zero-days has exposed just how vulnerable Flash is to vulnerabilities. If a relatively small company like Hacking Team (with all of 40 employees) can spot vulnerabilities this potent, imagine the tools available to other parties (such as nation-states)? Previously we only had suspicions of how bad this problem was; now we have a more precise idea of the risk.

    In an ideal world, we’d say that Flash, in its current form, needs to go away. Either it is replaced by new web technologies (like HTML5), or Adobe finds a way to make Flash secure. However, neither is likely to happen.

    Using Flash is much like smoking: we know it’s bad for us, but we can’t quit anyway. Despite the risks, people will continue to use it because security by itself is not a solid-enough incentive to do otherwise. Site owners will continue to use Adobe Flash for their websites since it entails less cost and good user experience. Users, on the other hand, will still use Flash because the sites they frequently visit require it. With both developers and users dependent on Flash, it’s safe to say that we won’t the see the end of Adobe Flash anytime soon.

    So what can be done now?

    For end users, the advice is simple: uninstall Adobe Flash if you are certain that you do not need it. Another option is to use a browser that has a click-to-run mode (available for Chrome and Firefox users) when running Adobe Flash.  This reduces its attack profile significantly.

    Will uninstalling Adobe Flash be a difficult experience?

    A few years ago, it would have been unthinkable. Flash was too handy in providing multimedia to users, whether it be in the form of animation, videos, etc. However, things have changed. Flash substitutes now exist. The notable absence of Flash on iOS and Android has meant that alternatives have been developed. These said alternatives also work just fine on desktops. These will not guarantee 100% security, but they will be less of a problem compared to sticking with Flash.

    For businesses, if you’re building a new web site, please consider not using Flash. Not only is it a security nightmare, it’s also an incredible resource hog for your users. And for your mobile customers, it’s pretty much useless. Google is already saying that a site’s mobile-friendliness may be cued as a score for its search ranking. Google is “encouraging” sites to become more mobile-friendly, and not using Flash is a good step in that direction.

    To summarize: the zero-days Hacking Team revealed are only the latest in a long and continuing series of Adobe Flash zero-days. While Flash is a security risk that rightly deserves to go away, it will hang around in the foreseeable future. What we can do as end users and companies is to mitigate these issues moving forward.

    Related Posts

    Posted in Vulnerabilities |

    9:10 am (UTC-7)   |    by

    For the past couple of days the security industry has been discussing claims that the systems of a commercial aircraft was “hacked” via the on-board inflight entertainment system (IFE). This became public after a search warrant was obtained by media outlets which revealed that the Federal Bureau of Investigation had applied for a search warrant targeting Chris Roberts, a researcher looking into airplane security. The warrant alleged that Roberts could “hack” the IFE systems of various commercial planes and issued what he called the “CLB” or climb command. At the time of this warrant, Robert had made the following tweet:

    This led to Roberts being escorted off his flight and various electronic items (including his iPad, his laptop, and various USB keys) being seized.

    Reaction from both the security and aviation communities was swift. Some viewed Roberts’s actions as unethical. Many were upset that Roberts had chosen to perform his “attack” on a plane during an actual commercial flight. The veracity of his claims was doubted by many as well, and this was a reaction shared by many in the aviation community.

    What do I think happened? I don’t think he hacked into the airplane’s critical systems. Other technical factors aside, he was on the plane. Unless we’re supposed to believe he was some sort of suicide hacker, he would probably not want to cause any actual harm.

    Security research should be carried out in a controlled environment. We’ve carried out research into AIS systems, and we are currently carrying out research into in-car systems. We did not start out right away with real-life boats. For our car research, we rented cars and started out in parking lots, gradually making the environment more closely resemble real-world environments. (We are now working with the car manufacturer in question.) Doing any actual “tests” in a scenario without the consent of the parties concerned (such as the airline or other passengers) is not the way to go about this.)

    Of course, sometimes vendors do not respond well to researchers who want to work with them. When we were conducting our own AIS research, we were rebuffed because Trend Micro is not a country, and the organization in question only dealt with member-countries. We went ahead and publicized our research anyway, and now the first organizations took action and switched to encrypted AIS to protect themselves against the threats we talked about.

    The reaction to this incident reminds me of earlier days in software security, when companies were reluctant to admit that their products could contain vulnerabilities, when security through obscurity was viewed as a proper defense. The response of the FBI (to shut down the research) and by airplane/IFE manufacturers (refuse to disclose details) are natural responses. Adding security costs real money, and vendors are reluctant to spend resources that they do not have to.

    Whatever you think of Roberts and what he did or didn’t do, the fact is that the topic of airplane security is now out in the open. Like any other system, there are bugs somewhere in this system; no human-built system is 100% error-free. It will be up to governments and regulators to force vendors (both of airplanes and IFE systems) to move beyond simple security-through-obscurity and demonstrate that existing systems are secure, and to fix any vulnerabilities that do come to light. Who knows, perhaps the systems that are in place have been designed in a robust and secure manner and do a good job of keeping attackers out. Until the mindset changes, though, we can’t be 100% sure.

    If you think this is only relevant to aviation, you’re wrong. It just happens to be one of the most visible aspects of the computerization of everything, what others would call the Internet of Things. Other sectors will have to deal with their own challenges soon enough, and the quicker we learn how to do just that, the better it turns out for everybody.

    Posted in Malware | Comments Off on Mile-High Hacking: Should You Worry?

    In the past couple of weeks, the effectiveness of PGP as a way to encrypt the emails of users has been a subject of much debate. This latest round was kicked off by Matthew Green, a professor of cryptography at Johns Hopkins University, who criticized PGP primarily for flaws in key management and for its lack of forward secrecy.

    It’s very important for the industry, as a whole, to get encryption right. It’s fundamental to securing online lives in the 21st century. PGP has been a key part of securing email for many years, so suggestions that it needs to be revised because it’s broken need to be taken seriously.

    While the encryption of PGP itself is regarded as sound, it has always been regarded as not particularly user-friendly. However, it has never really been considered to be aimed at ordinary users. Before, it was always more technically capable users who found themselves relying on PGP. These users were capable of using the PGP clients available at the time, despite their lack of polish.

    Now, things are different; it is conceivable that people might be interested in using PGP, but not have the technical capability to use the existing clients. These users want software that is “click and forget”. There is a fundamental disconnect between “what is secure” and “what is easy” that is not easily bridged.

    One particular aspect of PGP that does deserve criticism is how it manages keys. Simply put, PGP puts all the burden of managing keys on the user. This is in contrast to other encryption solutions like SSL/TLS, where this process is essentially invisible to the end user.

    There’s a fundamental tradeoff between convenience and security, and here PGP was designed with security as the highest priority: key exchange was handled directly by the users. This meant that users could decide whose keys they could trust. That’s the most basic decision in security, and PGP put it directly in the hands of users. That may have been fine for tech-savvy individuals, but for ordinary users, that’s far more difficult.

    Other email encryption solutions (like those we offer) rely on some sort of Trusted Authority (TA) to manage the keys. The TA has to authenticate users, but this takes the burden of key management away from end users. Of course, this means that the end users have to trust the TA server – this is fine for corporate environments, but for individuals this is probably not acceptable.

    There is nothing stopping a vendor from implementing PGP in a way that is more palatable to an ordinary user. This is exactly what Google and Yahoo are trying to do, and it will be interesting to see just how they meet the challenges of making PGP acceptable to the ordinary user.

    One more thing to say about PGP. Whatever its flaws, it has been proven to be reliable – and trusted – since it was introduced. Yes, it has its own problems, but to a large degree those are because it is being used by markets that it was never aimed at. In addition, as computing power increases, key length will have to be increased as needed – but this is an understood problem.

    However, the core of PGP is still sound. Saying it needs to “die” is counterproductive, as all that might do is push users towards other “solutions” that may promise security, but are actually insecure. What needs to happen is for PGP to be improved and built on in order to serve the evolving needs of users. Done properly, these can mean PGP will continue to be a strong security standard for a long time to come.

    Posted in Vulnerabilities | Comments Off on PGP: Not Perfect, But Something To Build On

    Last December, I spoke at a cybersecurity summit sponsored by the International Telecommunications Union (ITU) in Baku, Azerbaijan. I was there to discuss one thing that Trend Micro will focus on in 2014 and beyond: how we can we work together with law enforcement to stop cybercrime.

    One may ask, why does law enforcement and the security community need to work together to stop cybercrime? It’s because neither group, working alone, can protect users and stop cybercrime.

    For various reasons, police agencies don’t always deal well with cybercrime. For one, the scale of cybercrime is larger than physical crime. A gang of pickpockets stealing wallets can only target so many people in a day; a cybercriminal can victimize thousands of users in a matter of seconds.

    In addition, many police agencies don’t have the skills to effectively track down and investigate cybercrime. Tracking down cybercriminals requires a very different skill set from traditional policing, which limits the abilities of law enforcement to go after cybercriminals. It also takes resources and trained personnel, which are, in many cases, in very short supply.

    Trend Micro has spent considerable energy in building excellent working ties with law enforcement agencies such as Interpol. This allows us to work in direct partnership with these agencies and become a key part of investigations. Our role in these investigations is beyond just passively handing over information to police; instead we work actively with investigators to figure out what information they need as part of their investigation.

    In some ways, it’s as if our researchers have been deputized to work side by side with police. The investigations are no longer the responsibility of police themselves; to combat cybercrime effectively requires the private industry and police to work side by side. For that to happen, there has to be large amount of trust between us and agencies, and I am proud to say that in many cases we have built up that trust and effectively conduct investigations together.

    Both our researchers and police have to be on the same page when it comes to the objective. Our goal is the same: to put cybercriminals behind bars. We do not focus on “technical” solutions such as shutting down servers, or taking down botnets, or seizing domains. One might even argue this is counterproductive in the long term, as it means that cybercriminals will be pushed to use more sophisticated tactics and more concealed infrastructure, making investigations more difficult. This is something we noted in our 2014 predictions.

    We believe that in order to fully protect our customers, efforts have to be focused on arresting cybercriminals. Taking down their infrastructure is, at best, a short-term solution: cybercriminals can easily rebuild their infrastructure and recover from any “takedown” relatively easily. To really stop cybercrime, the “threat actors” – cybercriminals – have to be the ultimate target.

    This is not always an activity which makes the headlines or spawns press releases. However, we do believe that moving forward, this is the best way to protect our customers and the Internet as a whole.

    Posted in Malware | Comments Off on Working With Law Enforcement In 2014 And Beyond

    6:49 am (UTC-7)   |    by

    Recently, Trend Micro and INTERPOL announced that Trend Micro will help train law enforcement personnel from participating countries all over the world to help them cope with today’s cybercrime threats. We are honored to help INTERPOL in its fight against cybercrime; this is completely in line with our vision of creating “A World Safe for Exchanging Digital Information.”

    The details of our collaboration are in our press releases, but I want to use this topic to discuss, more broadly, how and why Trend Micro works with law enforcement agencies around the world to stop cybercrime.

    Why is it so important that law enforcement and security companies like Trend Micro work closely together to deal with today’s threats? The answer is: each group brings very different skillsets – and mindsets – to the table. By working together, they are able to work best to become effective against cybercrime.

    Security researchers have a wide variety of information at their disposal. They have threat information from their company’s operations, as well as underground information – frequently from the “social networks” they form while visiting underground forums undercover.

    In addition, researchers typically work as teams which are multinational, have a wide reach of knowledge and specialties available to them, and used to making decisions quickly. All these traits are quite helpful in keeping up with cybercriminals.

    However, security researchers can only go so far. Law enforcement has access to powers that are needed to truly identify those responsible for attacks. Servers can be seized, communications (electronic or otherwise) can be monitored, as provided for by courts. This in-depth information allows for the identification of the actual persons behind online crimes, who can then be arrested and brought to trial.

    In the absence of cooperation, a wide variety of problems can occur. Researchers may release information into the public, which may interfere with in-progress investigations by police. The released information may not even result in anything of significance, as the researchers cannot enforce laws. Meanwhile, law enforcement can’t deal with cybercrime: it moves fast, it’s not clear “where” it actually takes place, and depending on local laws it may not be “crime” in the first place.

    While it is essential for law enforcement to partner with security companies to catch cybercriminals, they also need to be careful in choosing their partners. Some companies are perceived (rightly or wrongly) to be close to certain governments. The partners also need to be discreet in releasing information to the public; prematurely released information can seriously damage long-running investigations and cause promising leads to go cold. Picking the wrong partner can also hurt, not help, the fight against cybercrime.

    As a company, we work very hard to ensure that we have good relationships with law enforcement agencies from all over the world. We meet at conferences, internal meetings, and other events on a regular basis that serve as a way for us to exchange information. An example of the fruits of our cooperation was the recent arrest of a key figure in ransomware gangs. By working closely with Spanish law enforcement, Trend Micro was able to gather actionable information that led to arrests in this case.

    We strongly believe that by working with law enforcement, we are able to go after cybercriminals directly. Instead of targeting their hosting infrastructure – both infected machines and malicious servers can be replaced easily enough – we go after the true suspects, the persons responsible for various attacks. Going after these perpetrators, we believe, is the best way to ensure a safer Internet for everyone.

    Posted in Malware | Comments Off on Law Enforcement Cooperation And Trend Micro


    © Copyright 2013 Trend Micro Inc. All rights reserved. Legal Notice