Come Join Us, We’re Now Blogging on BeyondTrust!

Yes, we’re still alive and kicking! And yes, I know we haven’t posted on the eEye blog in quite some time. Trust me, we’re still blogging and sharing like mad, we’ve just moved it all to another location. So come share the love and visit the BeyondTrust Blog (be sure to add us to your feed reader, too!) to read the latest in security news, Microsoft Patch Tuesday updates, product releases/information, events, promotions, and awards! We are having a blast over there…it’s about time you joined us.

Visit the BeyondTrust blog now.

See you there!

Batchwiper: How I Learned to Worry Less and Love Least Privilege Security

With news coming from Iran’s CERT of a nasty (but not really nasty) new piece of malware designed to wipe drives and desktop contents on a specific date, we took the straightforward approach of examining what common, easily implemented security best practices could have stopped Batchwiper in its tracks…

As far as malware goes, Batchwiper is very rudimentary in its execution and capabilities, yet it still has the capacity to cause damage – so how might someone defend themselves from Batchwiper? Simple: run with least privileges. Running as non-administrator effectively neutralizes the dropper component of Batchwiper, specifically GrooveMonitor.exe (MD5 – f3dd76477e16e26571f8c64a7fd4a97b). The dropper is a self-extracting archive, which attempts to put files in the \WINDOWS\system32\ folder. If you’re running as non-admin, the dropper has no permissions to write to that location and the malware will simply fail to execute its intended payloads.

Least privilege defeats Batchwiper dropper.

If you are unfortunate enough to have a corporate IT environment that does not properly manage Administrative privileges, then the dropper will continue to execute by spawning a series of processes. This eventually leads to Batchwiper formatting drives D through I, performing a Disk Check on each drive (possibly to mask the cause of the data loss), and then deleting the current user profile’s desktop contents.

Batchwiper processes spawned by dropper.

This malware serves as another example in a long line of threats that are, in most cases, completely (if not severely) mitigated by good security configuration best practices such as practicing Least Privilege.

BeyondTrust has been at the forefront of championing the cause of Least Privilege for quite some time through our BeyondTrust PowerBroker solutions for both Windows and Unix/Linux. Customers leveraging BeyondTrust’s PowerBroker for Windows will mitigate a large majority of malware that affects companies on a day-to-day basis, including this recent Batchwiper malware. You can find out more about our Least Privilege solutions here: http://www.beyondtrust.com/Products/PowerBrokerForWindows/

JRE 6 automatic upgrade to JRE 7, coming soon

Starting this month, Oracle will be automatically replacing Java Runtime Environment (JRE) 6 installations with JRE 7 installations on a small amount of users’ systems (the users are randomly chosen). This will be done to ensure that the automatic upgrading mechanism is working properly. In February 2013, the last public version of JRE 6 (Java SE 6 Update 39) will be made available.

So what does this mean to you? It means attackers will have a harder time exploiting your system. Due to the fact that JRE 6 does not have Address Space Layout Randomization/Data Execution Protection (ASLR/DEP) support, many exploit writers use it to successfully compromise systems through browser-based exploits. Since JRE 7 utilizes ASLR/DEP, it takes away one of the handy tools that attackers use to compromise systems. The end result is that attackers will have fewer resources at their disposal as they attempt to exploit systems.

As always, we recommend using the latest version of software that is available, so this change is in line with our recommendations. If you are currently using JRE 6 and wish to upgrade, you can grab the latest version from Oracle’s Java download page.

12 Days of Giveaways Starts Now! Join Our 12 Twitter Days of Christmas!

Say hello to holiday fun and frolic! Starting TODAY, we’re running our 2nd Annual 12 Twitter Days of Christmas campaign! It’s time to celebrate the season of magic and what a better way to do so than with 12 days of giveaways from BeyondTrust?

How to Participate in BeyondTrust’s 12 Twitter Days of Christmas:

Here’s how it works; each day, for the next 12 days, we’ll post a new Day of Christmas tweet. Throughout that day, you have full reign to tweet, promote and share that Day of Christmas tweet as often as you like. If you miss the tweets in the live feed just go to Twitter.com/BeyondTrust and you can retweet directly from there! At random, we’ll be selecting a winner for each Day of Christmas who will be awarded with an Amazon gift card. On December 21st, the last day of the campaign, we’ll give away a grand prize of an iPad mini! How’s that for Christmas spirit?

One winner will be announced daily through Twitter (Dec 6 – Dec 21)! No purchase necessary and must be a follower of @BeyondTrust to participate.

We’ll also be posting the daily tweets here so check back for updates! So what are you waiting for? Start tweeting our 12 Twitter Days of Christmas and you could be on your way to winning!

Get Tweeting Now!

12/6: On the first day of Christmas BeyondTrust gave to me Context-Aware Security. The winner is @therantinggeek!

12/7: On the second day of Christmas BeyondTrust gave to me two Privilege Managements and some Context-Aware Security. The winner is @ETardieu!

12/10: On the third day of Christmas BeyondTrust gave to me three Server Compliances, two Privilege Managements and some Context-Aware Security. The winner is @Kelly62u!

12/11: On the fourth day of Christmas BeyondTrust gave to me four Databases, three Server Compliances, two Privilege Managements and some Context-Aware Security. The winner is @itsecuritymgr!

12/12: On the fifth day of Christmas BeyondTrust gave to me five Retina Insights, four Databases, three Server Compliances, two Privilege Managements and some Context-Aware Security. The winner is @Xsimpa!

12/13: On the sixth day of Christmas BeyondTrust gave to me six Identity Services, five Retina Insights, four Databases, three Server Compliances, two Privilege Managements and some Context-Aware Security. The winner is @MattLGraves!

12/14: On the seventh day of Christmas BeyondTrust gave to me seven PowerBroker Mobiles, six Identity Services, five Retina Insights, four Databases, three Server Compliances, two Privilege Managements and some Context-Aware Security. The winner is @AFairch!

12/17: On the eighth BeyondTrust gave to me eight Password Safes, seven PowerBroker Mobiles, six Identity Services, five Retina Insights, four Databases, three Server Compliances, two Privilege Managements and some Context-Aware Security. The winner is @LukeDonoho!

12/18: On the ninth BeyondTrust gave to me nine Compliance Reports, eight Password Safes, seven PowerBroker Mobiles, six Identity Services, five Retina Insights, four Databases, three Server Compliances, two Privilege Managements and some Context-Aware Security. The winner is @lubinski!

12/19: On the tenth day of Christmas BeyondTrust gave to me ten Cloud Assets,  nine Compliance Reports, eight Password Safes, seven PowerBroker Mobiles, six Identity Services, five Retina Insights, four Databases, three Server Compliances, two Privilege Managements and some Context-Aware Security. The winner is @jsg1818!

12/20: On the eleventh day of Christmas BeyondTrust gave to me eleven Network Securities, ten Cloud Assets,  nine Compliance Reports, eight Password Safes, seven PowerBroker Mobiles, six Identity Services, five Retina Insights, four Databases, three Server Compliances, two Privilege Managements and some Context-Aware Security. The winner is @HaroldBanks2!

12/21: On the twelfth day of Christmas BeyondTrust gave to me twelve Product Demos, eleven Network Securities, ten Cloud Assets,  nine Compliance Reports, eight Password Safes, seven PowerBroker Mobiles, six Identity Services, five Retina Insights, four Databases, three Server Compliances, two Privilege Managements and some Context-Aware Security. The grand prize winner is @ryansmith298!

Please note, starting January 2013, we are merging our @eEye Twitter account with our @BeyondTrust. Start following @BeyondTrust today for up to date news and security information.

Retina CS 4.0 and Remedy Ticketing Integration

Overview

Retina CS enables teams to centrally manage organization-wide IT security and compliance initiatives from a single, web-based console. It provides discovery, prioritization, and remediation of security risks by delivering what matters the most – context.

Retina CS is the centerpiece of the BeyondTrust vision of Context Aware Security Intelligence which helps organizations answer the most pressing questions in security – what to fix first, what to fix next and how to fix a vulnerability.

Retina CS does this through unmatched security intelligence and analytics for your entire IT landscape and integrates with BMC Remedy to help complete the vulnerability lifecycle management picture.

Benefits of Integrating BMC Remedy Ticketing with Retina CS Threat Management Console

Retina CS offers centralized role based access to both the security and operations teams needed in any enterprise.  Timely information and situational awareness are also tantamount to the Vulnerability Lifecycle Management picture.  Integration with BMC Remedy provides detailed asset and vulnerability information to operational teams to help see the ‘big picture’ and ensures risk reduction across the enterprise.

How it Works

Retina CS facilitates integration with BMC Remedy’s Ticketing system to provide asset and vulnerability data to Remedy web services.  This allows for complete Vulnerability lifecycle management leveraging Remedy’s powerful ticketing engine for vulnerability tracking.  This integration requires ticket generation to be performed within the configuration of the Remedy solution and familiarity with the Remedy product is necessary to fully understand the Retina CS integration.

From Retina CS users simply need to set up the ‘Export Connector’ for BMC Remedy and fill out the appropriate Web Service URL, Field Mappings, Target Namespace, etc. for connectivity.

Using Retina CS’s powerful Smart Rules engine users can determine which asset and which audit data will be sent to the Remedy Web Service(s) for ticket population.

Data is now available in the Remedy ticketing system.

Sample Remedy Ticket – Remedy Administrators would design/customize report fields/layouts.

Microsoft SCCM Integration with Retina CS Threat Management Console

Overview

Retina CS enables teams to centrally manage organization-wide IT security and compliance initiatives from a single, web-based console. It provides discovery, prioritization, and remediation of security risks by delivering what matters the most – context.

Retina CS is the centerpiece of the BeyondTrust vision of Context Aware Security Intelligence which helps organizations answer the most pressing questions in security – what to fix first, what to fix next and how to fix a vulnerability.

Retina CS does this through unmatched security intelligence and analytics for your entire IT landscape and integrates with SCCM to help complete the vulnerability lifecycle management picture.

Download the software for evaluation and testing in your environment.

Benefits of Integrating SCCM with Retina CS Threat Management Console

Third-party client side exploits continue to be a favored attack vector especially in widely deployed tools like Adobe Reader and Internet browsers. Recent studies show that third-party programs are responsible for 69% of the vulnerabilities on a typical endpoint.

Retina CS offers centralized role based access to both the security and operations teams needed in any enterprise vulnerability management solution.  The Patch Management Module provides built-in application patching for Microsoft and non-Microsoft applications by extending Microsoft SCCM functionality which many organizations already use today. Prioritize and deploy patches with integrated, automated patching. Quickly fix weaknesses using common deployment features used within SCCM today and see the big picture with end-to-end reporting on the entire patch management cycle.

 How it Works

Retina CS integrates with SCCM to provide centralized visibility to available Microsoft and various non-Microsoft applications using native SCCM API’s and Beyondtrust’s integration with WSUS (for 3^rd party applications).  The connector pulls back relevant SCCM data including computer groups (which can be used for targeted patch deployment), package deployment status and provides the ability to leverage common package deployment options from a single console. Third Party application deployment is facilitated through the use of Microsoft’s WSUS as a back-end to SCCM.  This feature extends the capabilities of SCCM to provide package deployment of various 3^rd party applications that are commonly exploited.

Next steps: Download the software for evaluation and testing in your environment.