Indicators of Compromise have a place, don't ignore them.

Security Cycle

Indicators of Compromise are forensically relevant fragments that are left on a computer after compromise. They operate under the assumption that you have already been compromised. IOC's should be shared to create a community of defenders sharing intelligence about what they are seeing and to increase the defensive capabilities of every security group. These fragments can be easily documented and shared using OpenIOC documents, and they have a role in the security cycle of prevent, identify, detect, and respond. 

"First of all, here's what's next in the incident response world: "Indicators of Compromise". And when people say that, they right now mean MD5s, file names, registry addresses, dns addresses, what addresses a trojan hooks, and that sort of thing. All of these things can be changed AT RUN TIME, by your better trojans.  

In other words, we have an industry focused highly on "indicators of compromise", whereas modern high-level attackers have leapfrogged the entire concept. The only true indicator of compromise is "computer is doing something I probably didn't want it to do", and that's not something you can codify in XML" - Dave Aitel  http://seclists.org/dailydave/2013/q2/29

We have to be honest with ourselves, Indicators of Compromise are signatures, they have a place and it is not in stopping an attacker but in detecting post compromise.  In continuing the honesty theme we also have to realize not everyone is facing "high-level attackers" and most do a horrible job at detecting and responding to any type of attack. Most companies are faced with attackers that are not advanced, don’t perform anti-forensic activities but yet we still don't detect them in a timely manner. Indicators of Compromise can bridge the gap and maybe one attack will be found that normally would not be found.  

However, Indicators are flawed in ways and can be bypassed like any other technology in the security layer. It should not replace any specific item or process you already have as it should be added to your toolbox and used to enable your hunters, security intelligence, and incident response group to look for specific forensic artifacts that may have relevance to you. IOC's that are easily consumable and tooled properly can go a long way with helping defenders. 

An Indicator does not have to be tied to a single binary and can describe any unwanted behavior for example: we know that lsass.exe in Windows XP is spawned by winlogin.exe or by wininit.exe in Vista and higher and there is a single instance. What about svchost.exe running from a non standard path? Should we be looking for this type of indicator? Can we write a document in XML that describes this and then detect it? The answer to those questions in my mind is "Yes". 

I believe that Indicators of Compromise and OpenIOC  can be used extensively to increase the defense capabilities, increase the cost of the attacker, define behavior that we want to look at, and create a community of defenders working on the same problems together instead of in the current silos.  

How I got Socially Engineered - BAD OPSEC

In all the research I have been doing around my move I am amazed at the OPSEC that bad guys don’t have. The lack of being able to separate work from play, keep different scams away from each other, and using home addresses and personal cell phone numbers. They really should take the time to learn these skills.  

This is part 4 of a three part saga:

1. Background

2. The Attack

3. Containment

Recently, I began looking into West Coast Movers and Deans Logistics because of my horrible experience with them. There are a lot of complaints on Rip Off Report and you can read them for yourself here, here, here or google for more, all of these complaints are conveniently marked as “Disgruntled Employee”. If you are curious you can find my Resume which will show I am not an ex-employee. I will also be posting my bill of lading soon to this blog which will show the move.

When I read some of these complaints I found names that I was not familiar with like Uzi Malka, Oz Malka, and Ezra Malka. I had already seen Aviv Mordechai so I was not that interested in that name as Aviv is the owner of West Coast Movers according to the Nevada Secretary of State. So I figured I would dig into these names and see if they are actually connected to West Coast Movers, what I found was interesting enough.

I say the first part that surprised me was that I had already linked to all of Doron Vaknin’s youtube videos but missed the information inside them. Doron is the owner of Deans Logistics in Florida,  He has a karaoke video that has Uzi Malka singing. He is not a great singer and most of his pictures on Facebook are very sleezy. Hey Uzi, lock down your privacy settings on Facebook bro, here is how you can do it. But this does not link Uzi to West Coast Movers it just shows that he knows the guy who owns Deans Logistics and was in Florida once. I also looked around and apparently Doron owns a few moving companies as well, Dean’s Logistics, D & E Relocation Group Inc, and Massada Moving & Storage, Inc.

I was curious to know if Uzi ever was in the moving business so I started looking around. I found that Uzi is related as an officer or owner in US1 Movers, LLC, The registered agent of these companies was Danna Malka (There is also a Donna Malka associated with Uzi Malka) and that was interesting just because of a partial name match, so I looked into it and found several other companies including New Destination Moving, Inc. So clearly they had some experience with moving companies but these are both Nevada companies and don’t show Florida as any type of residence or office. So I started looking to see if Uzi was a resident of Florida at any time and found that yes, he was and was married or living with Nirit Assulin. They owned a house together in 2005.  Well Nirit Assulin owned a company called New Way Movers which is still in operation by Nirit Assulin and I am not sure they are still together. Ezra Malka owned Victory Relocations Inc as well, there are more companies than I can shake a stick at.

In looking around I also found that Uzi seemed to have another company in New York that was a moving company called U.M. Moving, Inc. So It appears that Mr Malka gets around and has a lot of moving experience. When I look around at these moving companies I find more bad reviews.  Uzi also owned A One Media Inc in Florida, but not sure what it was used for.

So we now know that Uzi has moving company experience and has been in Florida and is friends with Deans Logistics. What we don’t know is if he is associated with West Coast Movers yet. We can also see from whois information, state filings and such that Uzi’s name is Oz Malka and sometimes goes by Oz Ezra Malka or Uzi Malka. I can tie the names together by pictures. Here is Oz Malka (A One Carpet Cleaning) on Facebook and here is Oz Uzi Malka  Hey Uzi, did you sell that Envoy yet?

Google Street View.

What else is Mr Malka into? Well, we can tell from his address of 10358 Catclaw CT. Las Vegas, NV, 89135 that he is actually related to A One Carpet Cleaning. Just how related is he however? Well looking at Google Street View he works for A One Carpet Cleaning and has a van in front of his house. This company is supposedly owned by Amit Enkava but there are conflicting reports. Some places Uzi claims to own it. I think there is an interesting relationship here. 

I also missed something in one of the videos I posted in Containment. When I posted this video I missed Itamar mentioning who came out to clean his carpets. He said  "Uzi was here by 3:45am thank you A One". Oops, did he just say Uzi was here? Well I know it's the same Uzi as before because here you can see him in an A One Carpet Cleaning shirt.  So now we know for sure that Uzi works for A One carpet cleaning and not a friend who was visiting or something when the Google Car came by. Oh, and also the BBB lists Oz Malka as the president of A One Carpet Cleaning

Is this all Oz/Ezra/Uzi is into? Nope he owned a duct cleaning company called Las Vegas Air Duct but he closed or sold that and the trailer. Which the website of Las Vegas Air Duct now points to A One Carpet Cleaning. Verify for yourself. There are many other companies or sites that point to 10358 Catclaw Ct in Vegas like Mia Bella Cosmetics or MIA Reviews. Funny about that one it is reputation management software essentially and I think the way these guys handle reputation management is spin up a new company. You will find common cell phone numbers on each of these little tidbits as well. I spent a good bit of time Googling using "702-883-0000" or "702-244-0616 ". 

Photo Bucket

Picasa

This guy is extremely busy. But you still have not proven any connection to West Coast Movers, or even made a point yet. Okay I will quickly show my bit of proof that Uzi/Oz Malka at least knows of West Coast Movers and is handling or helping with marketing for them. You can find marketing material that they use to spam craigslist with in Uzi's Picasa or Photobucket  and I am sure they will remove them so here is a couple of screenshots of the mix of images. These images show A One Carpet Cleaning, the Duct work company, and West Cost Movers all together in one happy family. 

One other thing I found interesting is that all of the parties: Aviv, West Coast Movers, Doron Vaknin,  and Oz Uzi Malka are all friends on Facebook, and I know that does not prove anything but it's just more sticks on the fire. 

 I think we can say that Uzi has some business relationship with West Coast Movers even if he is not directly on the companies paperwork, it also to me ties into everything a relationship that shows how my stuff got pushed from one provider to another.

What concerns is me is recently Uzi Malka created a new moving company, he spun everything up in December of 2012 and my opinion is that he will be dumping West Coast Movers because of the negative reviews and start using Executive Moving & Storage. This concerns me because it seems like there is a pattern of making companies and dumping them later, this is just a shell game with the same people controlling the switches. 

Executive Moving and Storage uses the same DOT number as US1 Movers LLC and both are registered to the same address. This means the same service you received with West Coast Movers or US1 you will get with Executive Moving and Storage. When you call them and start asking questions they will say they have 10+ years in the business, what they don't say is it's been under multiple companies that they keep ditching.  I am sure once they start using this company they will start the next one up. There is no real consumer protection on moving, the lawyers that know transportation work for the industry and will eat you alive, the claims departments are not to help you they are to protect the company. You lose in this game. 

ProTip: I was informed by an industry insider that it if a subcontractor is used it costs anywhere from $2 to $2.25 per cubic foot to move your things. This means a sub contractor is more likely to bump the cubic footage so they can make money. That is the going rate and it's an industry rate not a per company rate.

Make your php requests a bit safer

I am not by any means an Application Security expert, or even an expert, so take what I say with a (large) grain of salt, however I needed to solve a problem. I needed to find a solution that for the most part protects all the things from XSS and CSRF. Now, I realize this is impossible so I had to provide a way to opt out of these protections because somewhere someone needs to be able to pass scripts and such into forms.

So I came up with a simple php class that will do the following items.

• CSRF detection of any detections
• CSRF mitigation of any detections
• CSRF logging of any detections
• Detect when a form is not using CSRF protections and log.
• XSS protections on all POST/GET fields
• Ability to not filter for XSS some fields securely (only POST).

You can find the code on github. I am looking for additional ideas and improvements on the filtering and handling of this. 

You will need to modify the secure.requests.php file however to change a few variables 

private $securityKey = "make your own key here";
// valid actions are none, log, block, log_block
private $csrfVolationAction = 'log';
// log file we want to log too. 
private $securityLogFile = 'csrf.log';

Then create the object and call safeRequest before any $_POST, $_GET, or $_REQUEST parameters are used. You will need to have the session started before you utilize this or start the code with a session_start .  To do this use the code below.

$sr = new SecureRequests();
$sr->safeRequest();

This will start the filtering and logging of forms that are submitted without CSRF mitigations. Once you are ready to use the CSRF mitigations you will need to create the object again if it's not available and use protectForm inside the form block

<form method="POST" action="/omgzors">
  <?php $sr->protectForm('YourFormName', ''); ?>
  <input type="text" value="" name="test_field">
  <input type="submit" value="Go">
</form>

This will generate a few fields that get added to the form that will help with your mitigations. If you need to not filter a field in your form you can add the fields you don't want to filter and pass it to the protectForm function. 

<?php $sr->protectForm('YourFormName', 'list,of,form,fields'); ?>

Please let me know all the bugs you find in this or better ways to filter and lets make this better.

How I got Socially Engineered - Containment

If you are new to this series you need to start with the background and move through the attack.

When the movers pulled away from the house I knew this was not going to end well. I fired off a quick email “It was 4400 cubic feet, they raised the price. They are supposed to call you on all the stuff, this company was such a mistake. They did not even label what room boxes came out of. They broke several things before they even finished packing”.  At this point I know that most of what we put in the truck would either not come out of the truck or be broken, but I had to let it go for now and make sure that the family is ready to travel.

We wake up at 4:00am so that we can be ready and at the airport in time for our 6:00am flight. We get the kids up and get off to the airport, just glad that this portion of the move is almost over. When we arrive at the airport we discover that we did not have a reservation for our cat and that the cat was supposed to be taken to the Cargo center if we wanted her to fly. After discussing with the airline employees we decided to change our flight to a different one and take the cat as carry on luggage, this meant we had to go buy a new kennel for $60 bucks and pay $25 bucks to check the old kennel, but anything to get on the plane and get this done. Finally we boarded the plane and had an uneventful flight.

A few days go by and I get a call from “Anthony M.” which seems to actually be “Aviv Mordechai”. You can call 702-330-7777 (cell phone) or 702-210-4400 and ask for Anthony or Aviv or Jeff or Bob, I would bet the one that answers the phone is always the one you ask for. He says they would like to schedule delivery and that they would need the other $15286.29 now. I quickly informed them that they would need to call my company and work it out with them.  

At this point my relocation contact at work is diligently going over what happened and what is going on. When she came over to me she wanted to know how someone could have estimated so poorly and did I have extra things. She wanted to know how I got the estimate done, etc. After explaining everything I started to get really curious about my rights and recourse. So I opened up that pdf that explained my rights as a consumer and was shocked, I really had wish I had read it before because everything in it would have protected me from the attack.

At this point we started to really look at what they did and were doing. This is where I realized just how badly I got taken. The binding estimate they changed after they loaded my things was illegal. They put my stuff in storage and did not let me know where it was, illegal. They charged for 4400 cubic feet but only filled 2 of the 26 foot Penske trucks and about 200 more cubic feet which is a maximum of 3000 cubic feet. (Spoiler: When we finally got our items delivered it was not even 2 of the 26 foot Penske trucks, this means the 2400 cubic feet was probably accurate from the original estimate, yes we have pictures).

When we mentioned the fact that there was no way it was 4400 cubic feet to Aviv he claims that "was the estimate that you agreed to". Our rebut was that that was done illegally after it was loaded. I was also informed it was not an estimate but the actual amount on the truck. Aviv said “He is lying, see the time on the bottom that was initialed? That was when the estimate was done”. Here they use the benign initial next to the time that we started work as the way to timestamp when the estimate was completed. This seems like fraud to me so I wanted to see who I was dealing with.

Aviv Mordechai is a 34 year old Israeli who lives in Las Vegas who owns West Coast Movers. Aviv seems to own a couple of businesses and he also seems to be one of the few left having an active AOL email address am702@aol.com. He owned AM Communications at one point and now seems to run West Coast Movers from an address of 3545 S Fort Apache 135, Las Vegas, Nevada 89147. If you do any research on that you will notice that West Coast Movers (westcoastmovers@gmail.com) must be run out the back door of a company called Vegas Cellular Solutions owned by Itamar Feingold If you hit them up on Facebook you can see they are friends. Here is the inside of Vegas Cellular Solutions and Itamar talking about a flood. You should also look at the amazing accuracy of the prices in reviews. So at this point I know we are dealing with a fraud and scam artist, but they have my stuff what am I supposed to do?

I wanted to just throw my hands up and replace everything, I thought about this seriously but the only thing holding me back on this was the fact that my wedding pictures, and other pictures that are not replaceable are in that truck. I don’t have digital copies of every photo (we are working to fix this) we have so I would have lost a lot. This was not acceptable, we have to get our things back.

During this time work is going back and forth with West Coast Movers trying to get an agreement and pay for the original estimate price. 25 days come and go during these negotiations, all the while my family and I are living in a hotel room. Aviv finally agrees to take the original amount of the estimate and deliver my belongings so work quickly cuts a check to them and overnights it to Las Vegas. That check is cashed right away and I get a call that says they would like to schedule delivery. We agree on a day and I am told please have cash or money order for $7,000 when we deliver. I say “No.” the delivery crew says they will call me back and hang up.

I hear nothing, but I took the day off of work to wait in case it was delivered. About 3:00pm I get a call from Lisa that says “They are requiring the rest of the money before they deliver, we are just going to overnight another check and get this done”. I let out a sigh of relief, but I am not really relieved, I am angry and can’t believe they are holding my stuff hostage. Lisa works a few days trying to get it released without the last check and finally just sends a check. During these negotiations Aviv claims that “You don’t have a contract with me you have a contract with Neighbors, I am just the carrier”. “You have my money, you have my employees things” retorts Lisa.

WTF happened?

Aviv gets the check and decides to wait until it clears to release any of my things, because of all things a reputable business is going to send a bad check to pay for my things. I guess when you’re a scamster you think everyone else is. Aviv finally agrees to release our items but can’t find anyone to deliver it because he claims a dispute with Deans.

A few days later, 37 days after our flight our belongings are delivered. The state of the items is something to be desired and I will leave you with this photo as  you wait for the next installment of How I got Socially Engineered - Remediation