Schneier on Security

Ron G • April 21, 2017 4:51 PM

I just thought that I should clarify a couple of important points about the Krebs story. (And yes, I am the guy who brought it to his attention.)

Firstly, this isn’t a “smokescreen” for something more nefarious. I had already been tracking these exact spammers for some time, and they routinely manage to abscond with login credentials of random folks and then use those to send spams out of the (un-blacklisted) mail servers of various/numerous “legitimate” companies. This has been going on for some time now.

Second, focusing on the tedious life of a typical mail server admin in this case misses the point entirely. This guy dan(at)gtacs.com undoubtely clicked on a link (which he shouldn’t have done) in a spam email that he’d recceived, and a few milliseconds later he got a fistfull of exploit JavaScript back and from that point on, he and his personal workstation were, as they say, totally pwned. (This is a pattern of behaviour I have already found to be associated with this particular spammer, i.e. sending down JavaScript exploits to anybody dumb enough to click on their links.) The wisdom, or lack thereof, of allowing your typical ignorant/stupid employees to read their emails on Windoze systems, particularly if your company is claiming to have high level cybersecurity expertise is a rant that I’ll have to complete on some other day. For today however I’d just like to remind everyone that at least one study claims to have shown that even users who have been educated on the risks of clicking on links in spam emails still do so a large percentage of the time. One can only hope that someday, these kinds of megabuck “beltway bandit” companies that charge the taxpayer up the wazoo for their gold-palted “cybersecurity expertise” will take heed and stop allowing their un-watched, un-tested, and possibly also un-educated employees to read their emails on un-patched Windoze systems.

So anyway, Mr. Dan was totally pwned, whereupon the spammer, via an undoubtedly automated process, rummaged around on Dan’s harddrive in search of mail server authentication credentials, and apparently found a set of those and then transmitted those back to the mothership, after which the spammer used them in exactly the same way as I’ve already seen him use many others, specifically to send out yet more spam with yet more links leading to yet more exploits.

But this is not just a mail server issue or an issue that should only be of concern to the company’s mail server admin. If you look at the web site associated with gtacs.com you’ll see hat it is in fact a “portal” system which is undoubtedly used by the various DoD contractors and subcontractors who are working on the DoD’s next-gen battlefield communications system. These contractors and subcontractors, which include Northrop Grumman, Raytheon, Lockeed Martin, General Dynamics, Harris and a raft of others obviously set up this “potral” web site as a facility that would let them all log in and communicate with one another about the project.

Google for “GTACS contract”… and be prepared to be horrified when you realize that the set of credentials that the inept Mr. Dan @ GTACS.com allowed a lowly spammer to make off were in fact, in all probability, also a set of -login- credentials which could have been used to get in and, at the very least, hobnob with all of the technical folks who are working on the DoD’s next-gen battlefile communications system. At worst, of course, those same credentials might possibly have allowed access to plans, designs, schematics, encryption keys (for early-stage GTACS prototypes) and so forth.

And as if all that wasn’t horrifying enough, please note also that it is self-evedent from the known facts in this case that tracesystems.com/gtacs.com are clearly not using something like a two-factor identification system, e.g. ones involving a personal crypto keyfob. Add to this list of boneheaded security faux pas also the fact that the company apparently allows people to log in and use/abuse their servers, apparently without restriction from anywhere in the world. (The Russian spammer in this case exploited the mail server from an anonymous IPv4 address located in Brazil.)

Despite all of the above travesties, I have not yet even mentioned the real and ultimate take-away of this story. That is just this: If a lowly spammer seeking only to send out more spam (without it being blocked) could, almost by accident, so easily get this far in exploiting a DoD contractor company… and one that’s building the DoD’s next-gen battelfield communication system… then how far could a really determined adversary get?
It boggles the mind to think about it.

And it isn’t as if these defense contractor companies have an exactly sterling reputation for maintaining tight security on their networks. Far from it. The problem got so bad, apparently, that congress saw fit to pass a law a few years ago which would force the companies to at least -report- these kinds of security incidents… which by and large they were apparently loath to do.

Ron G • April 24, 2017 2:27 PM

My thanks to Ratio for pointing out that it was actually -me- who made the comment (to Brian Krebs) that, in my opinion, if the spammer had realized that he had managed to make off with a set of credentials for this particular DoD / Homeland Security contractor company, then he almost certainly could have gotten a pretty penny in exchange for those if he had shopped them around. And to my way of thinking, the Russians and the Chinese intelligence services would, in all probability, have been likely bidders in any such hypothetical auction, just as U.S. intelligence and Russian intelligence would be likely bidders for sets of credentials useable to get into Chinese PLA systems.

My comment was not meant to pass any sort of judgement, moral or otherwise, on any party. The intelligence game is what it is, worldwide, and everybody plays it.

In reply to A. Non, let me just say that actually, in a case like this, the topmost -two- Received: headers (and also all other headers -above- that second Received: header) are believable / trustworthy for the simple reason that we have no reason to believe that the tracesystems.com main outbound mail server has been totally compromised -or- that tracesystems.com is itself the kind of company that would have, or that does have any motivation for forging headers… unlike numerous spammers I know.

The topmost Received: header was pre-pended onto the spam message by my own mail server. I trust me not to lie to me, and I likewise trust my own mail server not to lie to me. So from my perspective, at least, that topmost Received: header is very nearly 100% trustworthy. The second Received: header was pre-pended onto the message by tracesystems.com mail server, and as I have just noted, there is no reason… clear or otherwise… at this point to think that tracesystems.com or its mail server had any motivation to fiddle that or to put bogus info into that header. So we can categorize that one also as “most likely trustworthy”.

Of course, in theory, I could have entirely made this whole thing up, and I could have written every bit of the message headers shown in the Krebs article in an ordinary text editor. In theory, it could all just be a big hoax and I could just be having everybody on, including even Brian. But in that case, I think that the PR department at Trace Systems would have been quick to denounce me as a hoaxer. But Brian independently communicated with the company, and it would appear that at no time did they dispute that such a mail message had traveled through their system, or that any such user as dan(at)gtacs.com existed, or that he had some credentials to use their mail system, or that those credentials had in fact been used to perform TLS authentication (as shown in the second Received: header) on or about April 12, 2017. Instead, the essence of the company’s comments on this incident seem to be that the account in question has now been disabled.

In response to Peter A., no I didn’t do any checking on DKIM in this case. There’s didn’t seem to be any need to do for the reasons I’ve just explained. From where I am sitting, the topmost -two- Received: headers appear to be entirely genuine and believable.

{{WARNING: Rant ahead}}

P.S. The pictures of the dedicated soldiers and sailors in the images that Brian swiped from the relevant web sites just reminded me of something. Those are probably real soldiers and sailors… honorable men & women willing to risk life and limb to keep us all safe… to keep me safe. But -their- safety relies on the people back home, like the people at Trace Systems, who one hopes will do their jobs, with meticulous care, and not with their first thoughts every day being about how they can shave a few extra pennies off their security budget so that they can instead put it into their own pockets.

Well, that’s what one hopes anyway. But to quote from my favorite book “Everybody works for Milo.”