Bit9 Says 32 Malicious Programs Whitelisted In Recent Hack

chicksdaddy writes "The security firm Bit9 released a more detailed analysis of the hack of its corporate network was part of a larger operation that was aimed a firms in a 'very narrow market space' and intended to gather information from the firms. The analysis, posted on Monday on Bit9's blog is the most detailed to date of a hack that was first reported on February 8 by the blog Krebsonsecurity.com, but that began in July, 2012. In the analysis, by Bit9 Chief Technology Officer Harry Sverdlove said 32 separate malware files and malicious scripts were whitelisted in the hack. Bit9 declined to name the three customers affected by the breach, or the industry segment that was targeted, but denied that it was a government agency or a provider of critical infrastructure such as energy, utilities or banking. The small list of targets — just three — and the fact that one malware program was communicating with a system involved in a recent 'sinkholing operation' raises the specter that the hack of Bit9 may have played a part in the recent attacks on Facebook, Twitter and Apple, though Bit9 declined to name the firms or the market they serve."

Viral horde

[smittyoneeach]

The viral horde
On internet stored
Like facial stubble
Must be deplored
Burma Shave

Re:

[wonkey_monkey]

You have now. Advertising works, bitches!

"Whitelisted"

[coldmist]

They were whitelisted? Meaning they are 'ok' and aren't infected? Or do you mean 'specifically named'?

The use of a 'whitelist' is usually a list of 'ok' or unaffected things, not just a specific list.

Incorrect use of the term here.

Re:"Whitelisted"

[whyloginwhysubscribe]

I understood this as the hack whitelisting malware which should have been blacklisted... So it was used correctly.

Re:

[quannah]

Yes, they were incorrectly whitelisted:

the hack of Bit9, which sells application “whitelisting” technology

Re:"Whitelisted"

[hAckz0r]

Yes, Bit9 software is a default deny paradigm, and so anything that is allowed to run on your system needs to be explicitly allowed, so malware can't get onto your system so easily (buffer overflows are still possible). That being said, Bit9 did not protect one of their all important signing keys, so the hacker used it and signed a whole lot of bad stuff they had in their tool bag. The hacker thereby added all his malware to the permitted white-list because they were signed by an authority that is trusted by the software protecting the systems. Who could be more trusted than the software company who protects your computer?

Whitelist/blacklist

[concealment]

I don't see these methods as being as effective as profiling programs based on their behavior and then negating them by dangerous behaviors, not by prior encounter.

Lists are too easily subverted, not only by hacks like this, but by misidentification and other errors. As someone who recently had to re-send a large number of emails because an "anti-spam" agency mistakenly categorized my mailhost as a spam attacker, I find the many false categorizations to be as damaging as the original fear.

Re:

[tlhIngan]

I don't see these methods as being as effective as profiling programs based on their behavior and then negating them by dangerous behaviors, not by prior encounter.

Lists are too easily subverted, not only by hacks like this, but by misidentification and other errors. As someone who recently had to re-send a large number of emails because an "anti-spam" agency mistakenly categorized my mailhost as a spam attacker, I find the many false categorizations to be as damaging as the original fear.

Well, this company

Re:

[hAckz0r]

Normally it is just the signed binaries that are permitted to run on the system, but an organization can add rules that permit unsigned code to run in certain circumstances. In that sense there is no published white-list, only cryptographic data that is being validated. To fix the problem Bit9 merely had to revoke a single signing key, but then all kinds of programs would stop running all at once. I have not heard yet what else exactly had been signed by that same key.

.
The trusted keys are distributed b

Re:

[dkf]

I don't see these methods as being as effective as profiling programs based on their behavior and then negating them by dangerous behaviors, not by prior encounter.

On systems where it is known what they should be doing, a lot of corporate desktops for example, whitelisting just those things required is far more effective: there's no need to try to figure out what is actually dangerous. It's following the principle that it is far easier to enumerate good behaviors than bad ones. Yes, that doesn't cover everything for all users but then it isn't a tool for everyone. On systems where it is applicable, it's a very good security measure.

Or would be if it wasn't for the pub

Really?

[Subgenius]

Wait a second. You mean that despite this company's security and operational protocols and supposed firewalls, they found that they had a server compromised by a SQL injection in 2012, took it offline, and then BROUGHT IT BACK ONLINE in 2013 w/o wiping it???

OR

They had a SQL injection on a server in 2012, never saw it but turned off the system anyway, and then brought the SAME system back up in 2013?

wow.

Side Effect

[ThatsNotPudding]

The sad side effect of endless war, warrantless wiretapping, blatant disregard of the Rule of Law, is that I'm left to wonder if any of this is true, instead of just a False Flag operation to justify the final destruction of privacy and the true Internet.

Re:

[Fnord666]

The sad side effect of endless war, warrantless wiretapping, blatant disregard of the Rule of Law, is that I'm left to wonder if any of this is true, instead of just a False Flag operation to justify the final destruction of privacy and the true Internet.

You have officially earned your tinfoil hat. Welcome to the club.