“Truth is the cry of all, but the game of the few.”

-George Berkeley

Gameover Zeus, CryptoLocker Hit in Massive Takedown Operation http://www.securityweek.com/gameover-zeus-cryptolocker-hit-massive-takedown-operation

http://www.infosecurity-magazine.com/view/38670/international-law-enforcement-sinkhole-gameover-zeus-and-cryptolocker-botnets/

http://www.csoonline.com/article/2358623/data-protection/businesses-can-do-more-in-battle-against-gameover-zeus-like-botnets.html

C-IT Recommendation

  1. Ensure your organization has Firewalls/Intrusion Prevention Solutions in place that will block incoming attempts to infect PCs
  2. Ensure your organization has a solid anti-malware solution at the end point and that all endpoints including POS terminals are covered.
  3. Enforce a patch management standard in your organization which requires security patches to be deployed in the production environment within a reasonable time after they are tested within your test environment.
  4. Test business functionality of each type of device and record any issues impacting any business functions on the devices.
  5. If no issues result in the testing, deploy the security updates to the production systems. If functionality impacting issues occur on the test devices, engage vendor support if specific applications are negatively impacted.
  6. Consult with your Vulnerability and Threat Management Team (VTM) to verify all production systems are patched with the latest updates.
  7. Implement an advanced malware solution such as Invincea Freespace, FireEye Web Security (NX Series), Source Fire FireAmp to keep remote connections from initiating from your internal network.

Article Resources

The U.S. Department of Justice Briefing on the Case

http://www.justice.gov/opa/gameover-zeus.html

US-CERT Advisory: GameOver Zeus P2P Malware

https://www.us-cert.gov/ncas/alerts/TA14-150A

New Heartbleed Attack Vectors Impact Enterprise Wireless, Android Devices http://www.securityweek.com/new-heartbleed-attack-vectors-impact-enterprise-wireless-android-devices

C-IT Recommendation

  1. Ensure your organization has a strong asset inventory with an accurate configuration management database.
    1. Android device running 4.1.0 or 4.1.1
      1. Avoid connecting to unknown wireless networks unless you upgrade your ROM.
    2. Linux system/device
      1. Make sure to upgrade your OpenSSL libraries to non vulnerable versions
    3. Corporate wireless solutions
      1. Examine your EAP based authentication mechanisms. Having equipment tested and contacting your device vendor and ask for more information.

Article Resources

Heartbleed and Wireless Presentation

http://www.slideshare.net/lgrangeia/heartbleed-35236317

Patches for the Cupid Vulnerability

https://github.com/lgrangeia/cupid/

SysValue Detail Description of Cupid

http://www.sysvalue.com/en/heartbleed-cupid-wireless/

Heartbleed Details

http://heartbleed.com/

Microsoft Launches Cybersecurity Startup Accelerator Program in Israel http://www.securityweek.com/microsoft-launches-cybersecurity-startup-accelerator-program-israel

Palo Alto and Fortinet Team Up on Cyber Threat-sharing http://www.infosecurity-magazine.com/view/38668/palo-alto-and-fortinet-team-up-on-cyber-threatsharing/

See All 50 Episodes of "C-IT Security Podcast "