NIT5140 Information Security

Prepare a report focusing on the following questions:
What was the problem
Who were affected and how
How was the attack carried out
What could have been done to prevent the attack.

A security breach is an event where data, information, systems and digital devices such as mobile phones and computers are accessed without authorization or malware that secretly sends data to a remote location installed without the user’s knowledge.

This report outlines the security breach that involved a malware called XcodeGhost (Wehner, Mills, & Smith, 2015) being sneaked into the iOS App Store, how and why it occurred and what are the possible solutions and also a hacking incident involving Saudi Arabian Oil Company (Saudi Aramco) by an activist group calling itself ‘Cutting Sword of Justice’. 

Computer security breach during September-December 2015 

Chinese iOS developers reported a new malware in a social media application called Sina Weibo. An analysis report was done on the suspected malware and ended up being christened XcodeGhost.

The XcodeGhost is claimed to be the first compiler malware whose malicious code was packaged into certain releases of Xcode installation files. These files were then uploaded to the cloud commonly used by Chinese iOS developers and thus ended up being downloaded by the developers.

The iOS developers used the infected IDE to create applications with some of them successfully passing the security checks and code review at Apple and hence being available for download by users of the App Store (Xiao, 2015).

  Why the attack occurred

The essence of the attack was to steal information from the iPhone mobile devices of unsuspecting users who downloaded the infected applications (Fox-Brewster, 2015). The malware would gather information from these devices including the present time, the name of the application that was infected, the name of the device and type, its network and its Universal Unique Identifier (UUID), the language being used by the device and the country and the iCloud username and password (Cluley, 2015). 

Considering the proliferation of financial services and online transactions on mobile applications, unknown vulnerabilities may occur thereby exposing the users to the risk of being compromised through malicious applications which in many of the cases are legitimate and have been developed by legitimate developers (Zibreg, 2015).

Due to advanced and modern security measures adopted by applications development companies, there have been increased difficulty in planting malware by cyber attackers and where they succeed, the malwares are easily detected and the necessary actions are quickly taken to mitigate on the effects of the malware attack.

This have contributed to advanced security breach methods that are hard to detect and the target victims of the malware attack are the legitimate developers. This is because the malwares are compiler based and hence they get packaged together with the code meant for a legitimate application (Cluley, 2015).

 The possible solutions 

Considering that the security breach is hard to detect due to it being compiler based as well as targeting developers of legitimate applications, the following are the possible solutions that can be adopted to protect both the developers and the users of the developed applications.

• Downloading or obtaining the IDE (Integrated Development Environment) directly from the mother company or its rightful owners. Considering that the targets are legitimate developers, it is possible for hackers to develop and drop a malicious file into a legitimate IDE installation that is hosted on a third party cloud account not related to the owners of the IDE. In the process, unsuspecting developers download the IDE and start developing their applications without realizing that something strange is afoot since the malicious file which gets compiled is deeply hidden.

Therefore, it is of utmost importance to the developers to ensure that for the sake of safety, they should always download and update their IDE installations directly from the rightful owners of the IDE. Majority of the companies that develop the Integrated Development Environments have a subscription service where during downloading, one is expected to sign up and provide an email so that when there are new updates, one can get easily notified.

• Code signing integrity (Xiao, 2015). This involves using a digital signature to verify an author’s identity by signing their executables and scripts and thus it ensures that the author’s code haven’t been corrupted or interfered with. Using this technique, the developers should always check their installed IDEs to ensure that they have not been interfered with by third party malware.
• On the side of users, upon learning they have been using infected applications, they should promptly remove them to prevent further damage and install latest versions if they have been declared as safe.
• Users should change usernames and passwords that they have been using before and during the period they had installed the affected applications. This ensures that there is no unauthorized remote access to online applications and accounts belonging to that user (Mertens, 2015). 

The Saudi Arabian Oil Company (Saudi Aramco) hacking incident 

Saudi Aramco is a Saudi Arabian national petroleum and natural gas company and was hacked on the August of 2012 by an activist group calling itself Cutting Sword of Justice. 

The problem 

On August 15, 2012 at 11:08 AM, a malware was unleashed on an estimated 35,000 computers belonging to Saudi Aramco. The computers’ data was totally or partially wiped out and replaced with a burning American flag (Perlroth, 2012). The wiped data was said to include emails, documents and files as well as spreadsheets.

Who got affected 

The attack affected Saudi Aramco entirely to a point where the IT personnel had to physically unplug the computers from the Internet connection and also disable remote access to the networks belong to the company. 

How Saudi Aramco was affected 

The malware used in the attack was designed to overwrite and replace the data such as emails, documents and files as well as spreadsheets in the hard drives with an image of a burning flag belonging to the United States of America after which it would send a report containing the addresses of the affected computers back to a computer within Saudi Aramco’s network (Perlroth, 2012). 

 Due to the fear and threat of a follow up attack, Saudi Aramco was forced to upload to Pastebin router and admin passwords and names as well as emails belonging to the chief executive of the company (Leyden, 2012). 

The company was forced to disconnect all the data centers and thereby rendering it offline. It resorted to using typewriters and faxes. All the work such as supplies management, shipment tracking and handling contracts between the company and entities such as partners and governments was done manually on paper. Also due to the shutdown of the information technology systems, payments were delayed as they couldn’t be processed contributing to stranded gasoline trucks that needed to be refilled (Rashid, 2015). 

 How the attack was carried out 

The company’s computer networks got accessed into after an employee opened and clicked on a link from an email that had been spear phished though it was unknown when the email was sent (Pagliery, 2015).  

Spear phishing is the act of fraudulently sending emails particularly from a sender who is known to the recipient in order to purposely induce the recipient to reveal classified or confidential data and information. 

On 15th august, 2012, employees noticed abnormal activities on their computers such as flickers on the screens, files missing or disappearing and computers shutting down suddenly. The attack involved a virus called Shamoon. It had a timer set to 1108 hours and worked by replacing the data on the hard drives with the image of a burning flag. The timer was supposed to trigger the virus into action. 

How the attack could have been prevented 

• Education - this involves regularly conducting training on various emerging threats to security of data and computers in an organization. It appears that by an employee having clicked a phished link on an email, he/she had little background if any of the various security risks that come with usage of emails.
• Examining links on emails - there is a high likelihood of organizations receiving bogus emails from potential attackers. Before clicking on a link, the recipient should first examine it to ensure that it does not come from a hacker. If one is not sure, he/she should consult the information security department where one can receive various security tips on how to examine links.
• Avoid responding to emails asking for personal information such as passwords and usernames no matter how familiar they look. This is until the sender has been verified as genuine.
• Invest in email security technology -  this involves having a solution that checks how safe is a link that is contained in a email.
• Usage of gateways - this involves using a gateway to stop emails with URLs that may be malicious from getting into the inbox of a recipient within an organization and thus the organization needs to invest in a solution that does a real-time analysis of online traffic.
• Encourage good behavior among employees. This involves advising them to avoid putting their phone number, emails and locations on the social media. Cyber attackers are becoming sophisticated and may use the details and pose as an acquaintance with the intention of gathering secret data from the targeted individual (Clark, 2012). 

Conclusion

Based on this report, it is apparent that cyber criminals have become sophisticated and will continue doing so. It is the responsibility of an individual to ensure that they update themselves with emerging security problems in order to best handle new threats. Organizations should at least invest in a information security department in order to be always secure from attacks. 

References 

Clark, J. (2012). 11 tips to stop spear-phishing. CSO Online. Retrieved 1 April 2017, from http://www.csoonline.com/article/2132618/social-engineering/11-tips-to-stop-spear-phishing.html 

Cluley, G. (2015). XcodeGhost FAQ: Malware sneaks into the iOS App Store. Graham Cluley. Retrieved 31 March 2017, from https://www.grahamcluley.com/ios-app-xcodeghost-malware/ 

Fox-Brewster, T. (2015). Hackers Sneak Malware Into Apple App Store 'To Steal iCloud Passwords'. Forbes.com. Retrieved 31 March 2017, from https://www.forbes.com/sites/thomasbrewster/2015/09/18/xcodeghost-malware-wants-your-icloud/#12e471933977 

Leyden, J. (2012). Hack on Saudi Aramco hit 30,000 workstations, oil firm admits. Theregister.co.uk. Retrieved 1 April 2017, from https://www.theregister.co.uk/2012/08/29/saudi_aramco_malware_attack_analysis/ 

Mertens, X. (2015). Detecting XCodeGhost Activity - SANS Internet Storm Center. SANS Internet Storm Center. Retrieved 1 April 2017, from https://isc.sans.edu/forums/diary/Detecting+XCodeGhost+Activity/20171. 

Morgan, L. (2015). List of data breaches and cyber attacks in September 2015. IT Governance Blog. Retrieved 1 April 2017, from https://www.itgovernance.co.uk/blog/list-of-data-breaches-and-cyber-attacks-in-september-2015/. 

Pagliery, J. (2015). The inside story of the biggest hack in history. CNNMoney. Retrieved 1 April 2017, from http://money.cnn.com/2015/08/05/technology/aramco-hack/ 

Perlroth, N. (2012). Cyberattack on Saudi Oil Firm Disquiets U.S.. Nytimes.com. Retrieved 1 April 2017, from http://www.nytimes.com/2012/10/24/business/global/cyberattack-on-saudi-oil-firm-disquiets-us.html. 

Rashid, F. (2015). Inside The Aftermath Of The Saudi Aramco Breach. Dark Reading. Retrieved 1 April 2017, from http://www.darkreading.com/attacks-breaches/inside-the-aftermath-of-the-saudi-aramco-breach/d/d-id/1321676

 Wehner, M., Mills, C., & Smith, C. (2015). Nobody is safe: Major App Store malware breach may affect millions of iPhone users. BGR. Retrieved 31 March 2017, from http://bgr.com/2015/09/21/ios-app-store-xcodeghost-malware/

 What is Code Signing?. (2009). Sslshopper.com. Retrieved 1 April 2017, from https://www.sslshopper.com/what-is-code-signing.html

 Xiao, C. (2015). Novel Malware XcodeGhost Modifies Xcode, Infects Apple iOS Apps and Hits App Store - Palo Alto Networks Blog. Palo Alto Networks Blog. Retrieved 31 March 2017, from http://researchcenter.paloaltonetworks.com/2015/09/novel-malware-xcodeghost-modifies-xcode-infects-apple-ios-apps-and-hits-app-store/

 Zibreg, C. (2015). XcodeGhost: a new malware infecting many popular iOS apps. Idownloadblog.com. Retrieved 31 March 2017, from http://www.idownloadblog.com/2015/09/19/xcodeghost-malware/.