AI, the risks and opportunities

Artifical Intelligence (AI), especially with the onset of Large Language Models (LLM)s, offers great potential. It can: read and summarize a document. It can write a biography for a person. It can answer questions such as “what is the circumference of the earth” (Spoiler the answer is complicated. Check out the answer.)

Here are some approximate circumferences for different latitudes:
Equatorial circumference: 40,075 km (24,901 miles)
Meridional circumference (from pole to pole): 40,007 km (24,860 miles)
Circumference at 30°N or 30°S latitude: 39,990 km (24,810 miles)

With its ease of use, and ability to handle mundane reading/writing tasks, no wonder people want to use AI! It can be very helpful, but there are risks to manage when using AI. Here are the top 4 risks I see with the potential use of AI.

IssueExample
Exposure of confidential data to the public. Imagine you are looking to fine tune an important document regarding an upcoming potential merger. A staff member on the team uploaded the document to their favorite free AI engine. That uploaded data could now be available to anyone in the public, which would be undesirable.
Getting the wrong answer from AI.Many AI models speak with certainty, but not always with accuracy. These are known as LLM hallucinations.
Storage of AI requests and subsequent responses subject to attackBasically, if a hacker can get access to your AI login, they could see all of your AI history.
Storage of data may be non-compliant with your regulationsFor some industries, there is a requirement to maintain data within a certain physical jurisdiction. Criminal Justice Information System (CJIS) and IRS Pub 1075 are two examples of regulations that require sensitive data to be stored within the United States.
AI Security Issues

The good news is that all of the above risks can be managed/mitigated. How? Well, through a mix of awareness training and the proper use of AI tools. Here is a sample strategy to consider for an organization to maximize AI usage while minimizing associated risks.

  • Set the groundrules. If confidentiality is crucial to your organization, let staff know that freely available AI tools should be off the table, as there is little to no expectation of privacy when using free tools. Go for the paid versions with contractual protections. Put it in a policy and get it out to staff.
  • Train staff on the issues with AI. Stress the issues with potential data leakage, and remind them that they play a critical role in the protection of sensitive information. Also, remind them that AI, though powerful, isn’t always correct. Therefore, staff is ultimately responsible for any communication they author, whether assisted by AI or not. (An excuse of “It wasn’t my fault, AI wrote it.” is never valid.)
  • As an organization, provide options for safe AI usage. Telling staff that they can’t use any form of AI will most likely result in staff using unapproved, possibly free AI on non-work computers. By giving staff valid options, you will be able to drive up compliance.

Artificial Intelligence can really drive efficiencies and improve the work product of staff. However, its use comes with risks. AI use is a risk management issue, after all. As long as you have identified and controlled the risks, you have the ability to allow safe AI usage. And, isn’t that where we want to be?

Rising Threat: Understanding the Advanced Office 365 Email Attack

Oh, the attackers are getting better!

The attack

Recently, I have seen an increase in phishing emails coming from legitimate email accounts. For example, a recent email that I saw came from the legitimate email of a colleague. This email encouraged me to click on a link to listen to a voicemail that was meant for me. Here is what the message looked like. And note, there is NO warning banner that this email came from the outside, showing that this email came from an internally compromised account.

Some users then entered their Office 365 username and password. Once they did that, their phone asked them to verify their login by entering the number displayed on the screen, pretty typical for MFA. The user entered the number, but there was no voicemail. The user was tricked into granting an outsider access to their email account which was protected with MFA. Thus, an outsider could now log into the victims email and could:

  • send emails as that user, including the sending of phishing emails to that user’s contacts.
  • set up forwarding rules to filter email messages, preventing the legitimate user from seeing all emails.
  • perform password resets on accounts linked to that email address.
  • read any and all email messages in the user’s sent folder, inbox folder and other folders.

Once the attacker gains this access, it is difficult for the victim to notice it, especially if the attacker does the email filtering well.

What is going on

Normal MFA

The attack is actually fairly sophisticated. Normally, when you log into an account protected with MFA, you go through these 4 steps. The user is responsible for entering their username/password, and responding to the MFA prompt.

MFA Compromise

If you click on the link in the email we discussed in the beginning, it takes you to a webpage that looks almost exactly like the real Office365 email login page. It even shows up as a validly encrypted website.

However, if you were to look closer, you would notice 2 problems that most users would not notice. First, the URL is not the official Office 365 login webpage, but a fake one set up to collect credentials. And the second warning sign would be controversial for many. It is that the webpage’s certificate is signed by “Let’s Encrypt”. Let’s Encrypt is a root signing authority that allows users to set up websites with https: without having to pay for a certificate. In principle, this sounds great, as it allows more user the ability to set up secure websites.

Https is designed to perform two functions. 1) Establish encrypted communications. 2) Establish the identity of the webserver to the client. Websites using certificates signed with Let’s Encrypt are able to establish encrypted communications very well. However, as there is no payment required, Let’s Encrypt signed certificates have less ability to establish the identity of a website as compared to traditional certificate authorities. Quite simply, in my opinion, payment helps to identify the authenticity of a website owner.

So, in this case, if the user went to look at the website certificate and checked the signature of the certificate, they would have seen this.

To be fair, how many users (other than me…) are going to check the signature of the website’s certificate? I would expect very few.

Back to the attack. So, the victim clicks on the voicemail link and is presented with what appears to be the Office 365 login screen. They enter their credentials, but they are entering them to the “Machine in the middle” (MITM). This MITM immediately forwards the login information to the legitimate Office 365 site, as shown in the image below.

The legitimate Office 365 site thinks that the user is trying to log in from a new computer, the MITM. As this computer is not recognized, Office 365 will challenge the user to enter their second form of authentication and alert their authenticator app. Let’s assume that the user is set up to enter a code that they receive when logging in.

The MITM sends the MFA challenge back to the user and hopes that the user enters the number into their authenticator app. If the user does that, the MITM computer is now logged into the victims email, and the email account is compromised. Made worse by the fact that the attacker can make the MITM a trusted device, exempting that computer from MFA prompts for days or weeks.

What should you do?

This is a sophisticated attack, so it will be difficult for a regular user to protect themselves from this attack. There were some warning signs for a user to look out for.

  • if you click on a link in an email message and it prompts you to enter credentials, DON’T.
  • if you entered your credentials into a website and realize it was a fake site like the one described here, immediately change the password for your account.
  • as an extra precaution, if the website asking you to enter credentials is signed by Let’s Encrypt, be very certain that you are at the correct site. Ask your IT team to verify if you are at all unsure.
  • if possible, filter out emails that have links to sites with certificates signed by Let’s Encrypt.

Conclusion

MFA protection on Office 365 now has become “necessary but not sufficient” for protecting access as the attackers have become more sophisticated. This attack is NOT a security flaw in Office 365. This will be a difficult attack to defend against completely and we need to look into better defenses for this style of attack. In the meantime, the two best options available at the moment to protect against this attack are:

  1. do not enter credentials if prompted if you clicked on a link in an email.
  2. if you enter credentials and realize afterwords it was a fake site, change your password right away, to limit the ability of an attack to use your account.

Let’s Encrypt serves a valuable need for many people, but please be aware that may be easier for attackers to use Let’s Encrypt to set up https websites used for credential stealing. Therefore, use extra care when supplying information to websites with certificates signed by Let’s Encrypt.

For example, I have a site, https://highspeedforensics.com, that has a certificate signed by Let’s Encrypt. Note that this site does not collect user credentials.

Also, please note that these opinion are solely my own.

Comments welcome!

Creating more winners

Happy 2024!

I have always been a fan of thinking “out of the box”. In an effort to create more “winners” we can study why winners won, and there is merit to that. There is another way as well, and that is to study why others did not win. Consider, if you will, survivor bias, which is a cognitive fallacy where you focus only on examples of successful data instead of all of the data. For example, looking only at the winners and not at everyone that entered the contest can lead to survivor bias and potentially incorrect decision making.

What does this mean for us? Why shouldn’t we just look at the winners if what we want is more winners? Because, we want to know why others didn’t win. Consider this story, recapped in a post by Dean Yeoung (here). He relays the story that in WW2, research was performed by the US Navy to look at returning airplanes in an effort to increase success in future missions. The goal was to create more winners, where winning was defined as a plane surviving the whole mission. To do that, the team collected data on returning planes, seeing where they had bullet holes. The natural thought of the team was to re-inforce the areas of the planes that had bullet holes, which should improve the chances of success for future flights. Basically, make the winners even better and this would help planes win more in the future.

It was Abraham Wald (here) that re-framed the analysis. Basically, he noted that looking at the planes that returned was biased. Instead of looking at why the winners won, let’s see why the other planes did not return (aka those that had not won). The planes that did not return most likely had holes in the areas that were not seen in the data. Think of it like this. If a plane was struck in a “bad” area, let’s say the cockpit where the pilot sat, that plane probably didn’t return. Now it should make sense that you would not expect to see planes that had holes in the cockpit when looking only at planes that returned.

Therefore, Wald pushed the idea to protect the areas of the returning plane that didn’t have holes. Here was a specific example. In the planes analyzed, based upon the article by Christian Dobbert (here), Wald noted that the engines didn’t have bullet holes. That makes sense when you step back. Damage to the engines would greatly reduce the success of the flight. As you can’t armor the whole plane because it would be too heavy to fly, you must use the armor strategically. Because returning planes did not have engine damage, the data supported that the engines would benefit from more protection. Reduce the chances of losing, if you will. Strange at first, but when you step back, it now makes sense. They would be much more likely to increase more successful flights versus reinforcing areas with damage on planes that returned.

This thinking lead directly to improvements on the success rate going forward. And, it makes sense. When looking at data, beware of the survivor bias. I hope you have a chance to read the links, where they point out some other great examples of survivor bias and how it might influence how you view information. For this to truly have impact, please note that you need to be able to clearly define what “winning” is for your situation, which is worthy of a later post…

For now, hopefull this thinking can help us create more winners by looking more deeply at the data.

Sources:

ransomware, let’s talk about it

Handling a ransomware event

Just the word ransomware can generate fear in many organizations, and understandably so. We have heard the stories of organizations that have lost data forever and have had their operations disrupted for days or weeks. The impacts of a ransomware attack can be devastating.

The best options for handling ransomware remain in preparation and prevention.

  1. Don’t get it. Improve your protection and monitoring. Easily said, tough in practice.
  2. Ensure that you have backups of critical files in case you do get hit. This way, you can restore the data instead.

If you are able to follow the above, great! The enemy of the above, though, is typically organizational progress. Being able to protect, monitor and backup an unchanging environment is relatively easy. However, when new systems are turned up, they may be turned up without the proper protection, monitoring or backups. And over time, these unprotected system become critical to the organization, and unprotected.

So, even with the best preparation, ransomware can cause fear. Fear is very real, but fear during a crisis may lead to sub-optimal decisions. But, how can we control fear when faced with a ransomware event?

  First, I would like to refer you to this article by

Josh Steimle, from January 4, 2016, posted on Forbes (https://www.forbes.com/sites/joshsteimle/2016/01/04/14-ways-to-conquer-fear/). I personally think it is on target. Allow me to extract 2 key tenants.

“1. Understand fear and embrace it. Fear exists to keep us safe. It is not inherently bad or good but a tool we can use to make better decisions. Fear isn’t designed to keep us inactive, but to help us act in ways that generate the results we need and want. Embrace fear as instruction and let it inform your actions, but not control them.” (bolding is mine)

And this tenant.

“5. Educate yourself. We are afraid of nothing so much as the unknown. If your fear is based on a lack of information, then get the information or knowledge you need to examine the situation based on facts rather than speculation.” (again, bolding mine)

Allow me to walk you through a hypothetical ransomware incident response.

Hypothetical event

One Saturday morning at 6am, I was contacted by the network team for a large retail company, name kept private, based in the northeast. (A typical tactic that I have seen is that ransomware is kicked off on a Friday night or Saturday morning. This is to give the encryption process time to run without people noticing…) This retailer makes their money loading trucks and delivering product. They have sophisticated computer systems to plan driver routes, to ensure the right product gets on the right trucks, and that the product is correctly delivered.

Ah, back to the 6am call. I was told that file encryption was observed on computers in the network. Further, the backups for the organization had been deleted, so no restoration was possible. I was asked to assist on this incident. So, by 7:15am, I was onsite. They wanted to stop the spread, but couldn’t. Every time a computer was turned on and logged into, it would be encrypted.

Important note, by the way. Turning on computers to install a product to deal with the incident at this time could be an AWFUL idea, especially if you aren’t sure how the malware is spreading or activating.

So, the business was concerned with getting operations back on line as soon as possible. Getting the systems on line by Saturday afternoon seemed unrealistic, would Sunday be possible?

In order to get the business back on line, we only needed to do the following:

  1. Stop the spread.
  2. Eliminate the malware or pay the ransom.
  3. Restore the systems.

Pretty simple in theory. Why is stopping the spread the number one task? Well, every system that gets infected is another point where the malware can spread from. This organization had offices in several states. The infection was isolated to the headquarters, it had not yet been observed in other locations. Keeping it that way would reduce the amount of recovery work.

Let’s take a moment to discuss the ransom. In this case, the ransom demand was for 1100 bitcoin. At that time, bitcoin was worth approximate $12,000. The company first thought, oh, $1.3 Million. Not great, but a consideration to get back on line. When I went through the math, explaining that it was actually $13.2 Million, the possibility of paying the ransom was off the table. Personally, I was pleased that the idea of paying was off the table. While I am always against paying, that isn’t my decision in these matters, it is the decision of the leadership of the organization. The reason I was pleased there would be no payment is that there is no guarantee that a payment will yield a working solution. And, the only thing that could make this event worse would be to pay the ransom and still have problems.

To stop the spread, we focused on learning how this ransomware was spreading. Before starting the examination, we shut off all internet connectivity, in case someone was logged into these computers from the Internet. Once the internet access was shut off, we then started to examine infected computers, to learn how were they getting infected. What we found was that the infection was planted in the login scripts. Basically, when a user would log into their computer, they would download and run the ransomware on their computer. Not great, but now we knew how it spread.

To stop the spread, we stood up a new server outside of the administrative domain. We could place the new computers on the same subnet as other systems that were infected, and these new computers did not get infected. This style of ransomware was blind to computers outside of the administrative domain. This was good news, because with this knowledge, the operations team was then able to start restoration activity while we continued to remediate the malware in the rest of the organization.

So, let’s recap.

  1. Turning computers on to install software would have actually caused the malware to spread faster.
  2. Shutting off network access is wise until you can determine how the malware is spreading.
  3. Once the spread of the malware could be controlled, the restoration efforts could begin. The malware did not need to be eliminated to start restoration, but controlled.

So, through this analysis, by Saturday afternoon, we had a plan in place to restore service safely, while working on malware remediation.

The operations systems were moved to a new administrative domain permanently, effectively isolating them from the user and the old infected systems. As for the systems with malware, there were two main options.

  1. Try to eradicate the malware from the systems that had the login scripts, known as the domain controllers.
  2. Turn down the old domain, as re-establish a new one.

In this case, option 2 was the option chosen, The reason why was that, during the analysis, we discovered that privileged accounts with weak passwords that were never changed were used in the attack. One of the accounts had a name similar to corpadmin, with an easy password that hadn’t been changed in at least 3 years.

So, remember, the goals were to get the order processing system back online and to get the internet access reestablished. We were on track to getting the order processing system online. However, restoring internet access was judged to be too risky until we knew that no back door accounts could be used to allow remote desktop connections back into this network. Remote desktop connection is a difficult protocol to secure, because enabling secure logins via remote desktop is very difficult.

The operations team did some heavy lifting through Saturday and Sunday, rebuilding the order processing systems. Remember, there were no valid backups. And, by Sunday, the order processing systems were online, and trucks were rolling. Even better, the nearly 100 warehouse employees were able to show to work, they did not lose wages.

Well, great, operations was back. The users were on track to get back. But, how did this happen? And, how could it be prevented from happening again. After experiencing an event like this, the organization leadership was rightfully concerned about wanting to be sure that it didn’t happen again. So, they wanted monitoring in place, monitoring that had been suggested in the past and discarded because it was too expensive. This reaction is quite understandable. But, monitoring on its own won’t prevent this from happening. Why?

For monitoring to be effective, important systems must be monitored. This can be accomplished after an incident, as it will have the focus of the organization to ensure that all systems have proper monitoring. But, recall, the organization got into this situation in the first place even with anti-virus, firewalls, and other protective technologies. If the protection didn’t work, it most likely did not work because it was not maintained. And the same fate awaits a monitoring solution, even adding a monitoring service. Not that the monitoring service would be bad, but the organization will grow. It will grow around the monitoring controls, making the monitoring less effective. And leaving the organization more exposed. And, starting up a monitoring service requires tuning, to eliminate false positives.

So, what is the right solution? I offer there is no “silver bullet”. The proper solution must include the following:

  1. Protective controls.
    1. Ensure accounts belong to users and aren’t just generic accounts.
    1. Protect account access with multi-factor authentication.
    1. Ensure users only have access to what they need.
    1. Separate the operations network from the user network. Even better, isolation functional networks wherever possible. Doing this will limit the spread of any potential ransomware.
    1. Ensure proxies, firewalls and anti-virus are regularly updated, as well as the operating systems.
  2. Detective controls
    1. Ensure that you have monitoring in place to respond to reports of computers infected with malware. Whenever a computer is infected with malware, it means that a protective control failed. Look into how this happened. It will help identify gaps in protection.
    1. Ensure that you monitor login access. If you see suspicious logins, found out if the accounts were compromised.
  3. Response
    1. Once a report of an incident is received, it is important to determine whether it is a false positive or real. If it is a false positive, log it. If it is real, then it is critical to under what the event was. For example, the discovery of credential stealing malware is a significant concern. It means account passwords are probably compromised, and it is important to reset the passwords of accounts at risk to restore security.
    1. Once an event happens, the response is not complete until normal processing has resumed. The goal of a response is to restore normal operations.

I hope that this helps you better understand what happens during a significant malware event. Please note that this is just a typical example for an encryption style ransomware event. The technique used in this story to isolate the ransomware worked because analysis went into understanding how the ransomware spread. Different ransomware attacks will require different methods of containment.

Cybersecurity lessons from Covid-19

Finding good metrics can be extraordinarily helpful in managing a situation. For cybersecurity, finding a decent security metric is a challenge, which I have written about before. And, the cybersecurity field can always learn from biology. After all, nature has come up with some pretty nasty attacks, such as the Covid-19 virus. As this attack has turned society upside down at the moment, a key question for many is “when can we return to normal?” Certainly, anyone who has dealt with an incident response where malware has infected a network has needed to deal with a similar issue. How do you know when to return to normal after a malware infection. So, what can we learn from this pandemic?

The Covid-19 pandemic has been, and continues to be, a challenge that we have not seen in our lifetime before. As I write this, it is April 8th, 2020. We are still learning about this virus, but by all accounts it is more lethal than the standard flu. For those that are interested in the details (and it is good to know your enemy), this virus is lethal because of the damage it can cause to the small air sacs in the lungs. The damage it causes makes it much more difficult for a person with the virus to get the oxygen he or she needs.

As an aside, I volunteer on a first aid squad, and the past couple of weeks have been pretty busy. We have have quite a few covid or suspected covid calls. While not responding to first aid calls, we are being asked to practice “social distancing”, a fancy way of say “stay away from me.” Restaurants are closed except for take out. Many typical activities are currently suspended. This is done with the hope of keeping the number of people infected down.

At first glance, it did not appear that this social distancing was working, was it? We continued to get a high number of first aid calls. But, perhaps the number of calls was not the right metric. It is true that the number of those that have been taken by this disease is clearly the most heart wrenching number, of that there is no doubt. With that said, how can we tell if the social distancing we are asked to do is actually helping us reduce that number?

Since this virus makes people sick for days, one way to learn if we are “turning the corner” with respect to the spread of this virus would be to look at the number of new cases reported in a day, and compare that number with the prior day. Of course, this assumes that testing is relatively of the same quality day after day. (and, in reality, it might be wise to assume that testing is actually improving day over day.)

Let’s look at a chart for the number of new cases reported in NJ. In this chart, look at what happened on April 3 and April 4, where the red arrow is.

 

nj-covid
NJ new covid cases, per day

After that day, the number of new cases starts to decrease. This means, as long as testing is being performed at the same quality, that the social distancing is resulting in fewer new cases for NJ as of April 4th. Perhaps this means that social distancing is starting to take hold. The next few days will reveal more…

Now, let’s look at the chart for Pennsylvania.

pa-covid

In this case, it does not yet appear that Pennsylvania has “turned the corner”. This could be for a few reasons, including that test results are coming in from a backlog, artificially increasing the day over day change. However, if we consider that the quality of the testing is the same day over day, this would indicate that the growth of new cases has not yet reversed in PA.

Perhaps looking at the change in the number of new cases being reported day over day can be considered a leading indicator. A leading indicator is a metric that can help us predict how good or bad things may be in the future. In the case of both charts presented here, both states appear to still have some tough days ahead. However, perhaps NJ has turned the corner, and PA will soon as well.

Security Metrics

Intro

In a prior article, I discussed the cycle of inaction. With respect to cybersecurity, the cycle results in managers putting too much faith in protection, which can lead to complacency.  To help improve the situation, management needs to get a better understanding of the effectiveness of the cyber defenses. Basically, managers need effective security metrics.

There have been attempts at coming up with security metrics, but they are usually not very useful. Consider, for example, this less than ideal security metric.

Percentage of systems with current anti-virus software.

Why is this a poor security metric?  Because it is actually an operations metric. Consider, if the number is 100% of systems have anti-virus, does that mean that all systems are then immune from malware? The answer is NO, because a zero day virus could get through. That 100% of systems are covered means that, operationally, we are doing a good job.

What if the answer is 0%, does that mean we are in big trouble? Again, the answer is NO, because the systems might be lab systems, in a closed network, immune from any new software. Or, the systems might be running an operating system like plan9, for which there are currently no known malware.

The problem with the above metric is that it does not directly tell us anything about the state of cybersecurity. So, how can we improve that?

The percentage of systems with antivirus should be tracked as an operational issue, or course. However, as for cybersecurity, the real measure will be how effective are the controls that currently exist.

The role of incident response in security metrics

Consider that a single desktop in an organization gets malware. The key metric here will be to determine how that happened, and it will tell you which part of your cyber defense failed. For example, consider the case where an employee receives an email message with an attachment. The attachment contains a virus, and the employee clicks on the attachment, because the attachment looks like a resume and the employee’s job is to look at resumes from strangers, as they work in the Human Resources department.

If the “resume” that the employee opened actually contained a virus, and that virus infected systems in the company, that would be a problem. Once the virus has been detected, an incident response would then tell us which security control failed. Perhaps it was the content filter in this case, along with the desktop antivirus. This is security metric data, how effective are our existing controls. Track this data.

While tracking this data and performing an incident response, it is very important to build an environment where users will report these events. Chastising users for opening an email attachment focuses too much on prevention and could hamper our ability to collect information to perform incident response. Therefore, I encourage security teams to encourage reporting and discourage the statements of “you should not have opened that attachment.”

Over time, with incident response and user reporting, you will have information on the effectiveness of security controls in use in the organization. You will see whether the current network architecture can be secured with existing tools, or whether it needs to be tuned.

Security assessments as a measure of cybersecurity

Many organizations run periodic security assessments, such as a pentest or vulnerability assessment. These are effective tools to help understand the current state of cybersecurity, if they are used correctly.

Consider the vulnerability scan, for example. Vulnerability scans from tools, whether OpenVAS, Nessus, Nexpose or others, may contain false positives or might contain too little data. The scanners offer great options, but if these options are not set correctly, the scanners might look at too little or too much. For the purpose of this discussion, let’s assume that your scanner is properly configured, and it not sitting behind a firewall that blocks all of its requests.

After a vulnerability scan has been completed, the output of a vulnerability scan should be cleansed of false positives. (A reminder, a false positive is a finding reported by the vulnerability scanner that is not a real finding.) Once the false positives have been removed, you have an accurate report on the number and severity of known vulnerabilities existing in a system.

Let’s assume we have scanned a webserver and we find that it is susceptible to the old heartbleed vulnerability. The web server administrator then either knew about this issue, or they were surprised to learn about it. That is a metric worth tracking. So, consider this metric.

How many security issues that were identified during a vulnerability scan were already known about by the application team?

This number should be zero, in an organization that has a good understanding of how to deploy secure applications. And this is much more realistic metric. Rarely are applications deployed with zero defects, zero vulnerabilities, because it is too hard to get there. Instead, applications are generally deployed with known vulnerabilities that we can monitor and control, and where the application owner can accept the risk for the issues.

Security awareness

Organizations generally have security controls in place, such as a firewall and virus scanners. Others have gone a little further and put a proxy in place to screen http traffic (but not https, sadly). As organizations put these tools in place, they are making it more difficult for attacker.

Attackers then respond by changing their tactics. Instead of going for a direct attack, they try to trick a user. This process is typically known as social engineering. And, one popular type of social engineering is a phishing email. A typical phishing email tries to trick a user to give out their username and password to an attacker.

In response, organizations perform a phishing email test. Controlled, safe phishing emails are sent to users, and their responses are tracked. What are good metrics to track with these phishing tests? I suggest that the metrics that we care most about are:

  • How many users have given away valid user credentials?
  • How many users have done this multiple times?
  • How has security awareness training reduced the number that give away credentials?

Conclusion

Cybersecurity metrics should be able tracking the organization’s current efforts  to protect their information, detect cybersecurity related issues, and  respond to cyber security threats. With the right metrics, the cybersecurity program can then focus on driving the metrics in the correct direction. For example, it is not about the number of systems infected by malware that is our primary concern anymore. It is, what existing control failed that allowed the malware in? It isn’t about how many users fall for phishing. It is about, does our awareness program actually show a meaningful change in the number susceptible to phishing attacks.

Take the time to build the right cybersecurity metrics. Once in place, the organization will be positioned to naturally response to changes in the cybersecurity landscape.

wannacry ransomware

A new ransomware outbreak has captured a lot of press over the past couple of days. So much so that the US Department of Homeland Security has put out a statement on this ransomware. While trying to prevent exposure to this type of malware would be great, it will be difficult to do. Antivirus, content filtering, firewalls, proxies and other cybersecurity devices are good, but the only work against threats that they know about. Now that the wannacry malware is known, cyber defenses can be tuned to block it. However, a new version of the malware, with just a small change, might not be recognized as a threat until it is too late.

This again points out that protection against this type of threat can not be done by cyber defense tools alone. Ransomware is an effective attack if you do not have any other way to recover your files. This might sound obvious, but this is the best time to ensure that your backups are up to date, and stored off line. If your cyber defenses fail against the next ransomware and you get hit, at least you can recover at your pace, and without paying.

Here is what I have shared with many that I have been working with on this malware. I hope it helps you.

—-
Recently, there has been a new cyber attack that has been spreading across the Internet. The attack has been named “wannacry” or “wannacrypt”. It encrypts files and demands a ransom in order for users to recover the files. Typically, the ransom is approximately more than $300 per system.

This attack uses a flaw in the Windows operating system to spread from one system to another. Microsoft has recently release an update to fix this problem, and we are working hard to ensure that systems are protected against this attack. However, patching alone won’t be enough to protect us from this attack, we will need your help.

Please make sure that you do the following to maximize your cyber safety.

  • Ensure that your most important files are backed up. Further, make sure that backup is removed from your computer. For example, copy your important files to a USB disk drive and remove the disk once the copy has been completed.
  • Do not open email attachments unless you are absolutely sure you know who sent you the email and what the attachment is. If you have any doubts, call the person that sent you the email to confirm the message.
  • Do not download any freeware or “too good to be true” utilities from the Internet. These tools may be infected with malicious code.
  • Do not visit any suspicious websites, because the ads that play on suspicious websites may be infected with malicious code.

And, if you see anything suspicious, or notice that files have been encrypted on your system, please contact your local IT support team at once.

Stay safe…

Don’t Let the Press be your Intrusion Detection System

All of the highly-publicized breaches last year continue to highlight that organizations are still wrestling with how to get a handle on their cybersecurity[1].  Breaches put the confidentiality and the integrity of your information at risk, as we recently saw with the hack into the Democratic National Committee’s email[2]. A denial of service attack impacts your availability, as we have recently seen with the attacks against the DNS provider Dyn[3].  In cases like these or similar, organizations were not aware of the extent of the issue until they read it in the press.

So, why are organizations usually the last to know?

  1. Protecting confidentiality requires surgically reducing access to information. The information needs to be available and modifiable, just not to everyone. To do this takes an understanding of the workflow. Just opening the data up to all is a fast way to get a system deployed.
  2. Management lacks clear metrics on the state of cyber security in their organization. Few know any real information on how effective their current protection is. For example are all the virus scanners up to date in an organization? Can people bypass the proxies? Currently, management is given useless data like number of attacks blocked at the firewall, number of spam messages stopped, or number of viruses caught by virus scanner. (Why do I call these useless? I’ll be following that up in my next post – and tell you what you should be looking for. But suffice it to say – you have the data – you just aren’t looking at it correctly.)
  3. The perimeter defense just isn’t working. Many organizations have firewalls, web proxies and virus scanners that protect laptops at work. However, those same laptops are then used at home, where they are not behind the web proxy or firewall.
  4. There are very few really good cybersecurity professionals out there, which probably contributes to #2
  5. The bad guys are relentless.

As management is not seeing the right picture, most then are unaware that their cybersecurity defenses are inadequate. They don’t yet see a need to invest in monitoring the technologies they’ve invested in. And, this leads to no monitoring, which re-enforces the strategy of not investing in cybersecurity.

The Cycle of Inaction

cycle-of-inaction

Good management means that you invest efficiently, and investing in something that is not needed is inefficient. Lacking effective information, the perception becomes that there isn’t a problem. This feeds what I call the Cycle of Inaction. This cycle is caused by believing the investment in protection is enough, and lacking additional information, must be working. This leads to complacency, when metrics are actually needed. A complacency that sometimes is broken by a press article.

This cycle of inaction can lead to spectacular failures. Of note over the past couple of years, we have the hack of the NSA toolkit, the recent release of the CIA cyber toolkit, the hack of Yahoo!’s passwords, the hack of Target, the hack of …

We know of these events because the press is the Intrusion Detection System (IDS) of default for many organizations. That IDS, however, is not easy to control, and definitely reports what we call “trailing metrics,” or a metric about a problem AFTER it has happened.

What Is Your Cybersecurity Maturity

I’ve found that the cybersecurity issue that the industry is confronting is very similar to the quality issues that the industry tackled in the 1970s and 1980s. To address and improve quality, the ultimate solution was to install a mature process within an organization. A mature process is defined as a process that is repeatable, with quality-based decisions made using meaningful metrics.

I offer that many organizations are at a maturity level of 1, if the Capability Maturity Model (CMM) metrics are used. Getting to a CMM maturity level of 2 (of which there are 5) appears to be a little bit away for cybersecurity. If the struggle is to get to CMM 2, perhaps it makes sense to sub-divide the maturity level 1 into sub levels, as in the list below.

Level Action You are first to tell the story You can investigate privately You can prevent a large incident
1.1 Organization learns about cybersecurity failures via the press, where the message is uncontrolled and incident needs to be addressed.
1.2 Organization learns about cybersecurity failures via a third party, privately (e.g. law enforcement or a business partner) The message can be controlled, as can the response to the incident. √
1.3 Organization learns about cybersecurity failures internally. This allows the organization to control the message of the incident as well as the response. √ √
1.4 Organization notes indicators that an incident is about to happen. Here, the organization can take steps to mitigate an incident before it happens. √ √ √

To increase your cybersecurity maturity, you need to improve your ability to monitor the cybersecurity of your digital assets, by analyzing the outputs of the technologies you have invested in.

Consider, your organization currently has firewalls to protect against bad things coming from the outside. You have web proxies and even content filters to protect against bad things coming from the outside. And, you have anti-virus scanners on your desktop.

With all of those layers of defense, it seems reasonable to conclude that no virus should ever reach the desktop. Measure that. Any time that any computer’s virus scanner detects a virus, a root cause investigation should be performed to determine which security control failed. For example, if a desktop has recently been infected with ransomware, a forensic analysis should be performed to determine how the virus got on the system. At the highest level, the cause will be one of these two things:

  1. The user violated a security practice, such as plugging in a USB.
  2. An existing cybersecurity technology failed. Did it not work? Was it improperly deployed?

Collect these metrics on the root causes, and soon you will have a clearer picture of the effectiveness of the controls.

Next topic, suggestions for effect metrics, to help you increase your “sense” of cybersecurity within your organization.

References:

[1] Let’s define cybersecurity as the protection of the confidentiality and integrity of information, along with ensuring that the information is available when needed to whomever needs it

[2] Krebs, B. (2017,January). The Download on the DNC Hack. Retrieved from https://krebsonsecurity.com/2017/01/the-download-on-the-dnc-hack/

[3] Newman, L. H. (2016, December). The Botnet That Broke the Internet Isn’t Going Away, retrieved from https://www.wired.com/2016/12/botnet-broke-internet-isnt-going-away/

Speed matters. How to make a forensic image as quickly as possible.

The typical method used to create a forensic image is to connect the source disk to a write-blocker. The write-blocker is then connected to a computer and a forensic image is made. This process needs to be updated to keep up with the capacity and speeds of the newest disk drive. By making the process as efficient as possible, the forensic imaging times can be substantially reduced.

When making a forensic image of a disk drive, it is necessary to copy every byte available from the source disk and to ensure that nothing is written to the source disk. As the capacity of disk drives has increased, the time required to make a forensic image has also increased. For example, a 20GB disk drive would take approximately 8 minutes to image at best. A 200GB could take approximately 50 minutes at best, while a 1TB disk drive would take approximately 2.5 hours.

We can calculate how fast a disk drive can be imaged by dividing the total capacity of the disk by the maximum sustained transfer rate (MSTR) of the disk. The MSTR is the manufacturers information on how fast data can be read off of a disk drive for a very large transfer. The MSTR tells us how fast data comes off of the disk. (Note that the maximum burst transfer rate is not of use to us since it only provides information on how quickly data comes out of the disk cache, and it only applies to a small amount of data.)

Let’s look at a 1.5TB Western Digitial Caviar Green disk drive as an example. The data for this drive is available here.  This disk drive has a capacity of 1,500,301 MB and it has a maximum sustained transfer rate of 110 MB/s. Thus, it would take 227.3 minutes (almost 4 hours) to forensically copy the entire contents of the disk drive. (A transfer rate of 110MB/s is 6.6 GB/minute.) To achieve this speed, all parts of the forensic imaging process must be able to process data at a rate of 6.6GB/minute or greater.

Using a USB 2.0 write-blocker would slow this transfer rate down dramatically, as USB 2.0 has a maximum data transfer rate of approximately 34 MB/s. Using a USB 2.0 write-blocker when imaging the 1.5TB disk drive would require 735.4 minutes (over 12 hours).

Other factors that can alter the efficiency of the disk imaging process include:

  • The buffer size of a data transfer.
  • The filesystem where the data is being written to.
  • Whether compression is used when making the forensic image.

All of the above factors need to be tuned to ensure that forensic images are made as quickly and efficiently as possible.

I have recently published a paper in the Journal of Forensic Sciences entitiled Characteristic of Forensic Imaging. This article discusses the impacts of different factors on the efficiency of forensic imaging. I am also preparing a web page that will provide simple scripts to allow you to evaluate the efficiency of your forensic imaging setup.

the latest on credit card frauds

Recently I worked with Acme (the name has been changed to protect their identify), a retail company that had been contacted by their bank. (Let’s call the company Acme.) During an investigation of some credit card frauds, the bank discovered that many of the fraudulent transactions appeared to have one location in common, Acme.

The analysis works like this. Let’s assume that Joe Smith and Mary Jones used their credit cards at Acme on March 1st. Then, on March 20th, both Joe’s and Mary’s credit cards were involved in fraudulent transactions. Once a credit card is involved in a fraudulent transaction, the banks look to see if this transaction is part of a larger fraud. So, they check the historical transactions of Joe and Mary, looking for the business that they both have in common. The theory is simple, if Joe and Mary visited a company with a security breach, it will be seen in the historical analysis.

This type of fraud analysis is useful for detecting when many credit cards are compromised at a business. If the bank can identify the location where credit card numbers were compromised, it can prevent future fraud from that compromise. In order to do that, the bank will need to cancel all credit cards that were used at the business where the compromised occurred and re-issue new ones.

Back to Acme. So, based upon fraud analysis, the bank had strong reason to believe that somehow Acme was leaking credit card numbers. In fact, the bank suspected that over 70 fraudulent transactions resulted from a problem with Acme. Our review of Acme showed that their network was Payment Card Industry (PCI) compliant. The credit card numbers were protected in Acme’s network. So, the card numbers were not leaking out because a network hacker.

This left only two options. The first is that an employee or employees were stealing the credit card numbers through the use of a skimmer, or that Acme’s card processor was hacked. Based upon the fact that only certain transactions at Acme were reported as compromised, this meant that the skimmer possibility was much more likely.

While there has been a lot of work on securing credit card data over the network, the physical credit card is still vulnerable to the skimming attack.

In order to protect yourself, do not let you credit card out of your sight when you use it. Because when it is out of your sight, it is possible that the person that took your credit card also took a copy of your credit card.

 

 

Why won’t my call go through? Denial of service in the cell phone network.

Recently, some of the major cellular carriers have released “Network Extenders”, also known as femtocell. The network extender is a device that a subscriber purchases to extend the reach of the cell phone network. (In effect, the subscriber is paying for the privilege of increasing the cellular network coverage. What a deal!)

The network extender is conceptually similar to a Wi-Fi access point. Both connect to the Internet via wire, and both provide wireless services. While the Wi-Fi device provides Internet services, the femtocell provides cellular services.

The femtocell basically appears as a new cell tower to cell phones that are within its range. And, the femtocell will process calls for any and all cell phones that successfully register with the cell phone while is it connected to the Internet. Effectively, the femtocell is just a new gateway to the cellular network.

It is not possible for the cell phone owner to choose to connect to the femtocell or to a regular cell tower. The decision on how the cell phone connects to the cell network is made by the cell phone and the “cell tower”. And, this did not used to be a problem, when only the cellular carriers were putting up cell towers. However, the release of the network extender has allowed individuals to deploy cell towers.

Recently, I encountered a denial of service issue with a cell phone that I tracked back to an issue with a femtocell. A cell phone has registered with the femtocell to connect to the wireless network. However, the femtocell lost connectivity to the Internet. (Remember, the femtocell is a gateway that uses the Internet to connect to the cellular network.)

Since the femtocell still had power, the wireless side was still active. This meant that any cell phone that had registered with the femtocell thought that it was still connected to the cellular network. However, the femtocell had no ability to connect to the cellular network, since the Internet was done. It appears that the current cell phones do not have the ability to determine if they are connected to a cell tower that is active.

Thus, the cell phone could not make or receive calls or text messages. And the user had no ability to tell the cell phone to switch to a working cell tower. The only was to get the cell phone working again was to move to a different area, outside of the range of the femtocell. And, the cell phone reported 3 or 4 bars during the entire outage.

Until the carriers improve the algorithm that a cell phone uses to ensure it has an active cell tower, about the only thing the subscriber can do is use a Voice over IP (VoIP) application as a backup to the standard phone. And, this will only work if the VoIP application can use the Wi-Fi network for calls. And, if that is not possible, use email, which should still work via Wi-Fi if the cell tower is not functioning.

 

SCADA and security

A recent article  by Hal Hodson of Information Age reports that the FBI has publicly stated that hackers have successfully targeted SCADA systems in three unnamed US communities. The attacks were reported to have the potential to shut down electricity at a nearby mall as well as the potential to dump sewage. Just weeks earlier came an announcement from the Illinois Statewide Terrorism and Intelligence Center that claimed a water pump failure was caused by a hacker attacking the pump control system. The failure came from the attackers repeatedly turning the pump on and off. (The Illinois hacking attack has been refuted the FBI, so then it must not be one of the three sites reported above, right?)

So, what exactly is SCADA? Supervisory Control and Data Acquisition. SCADA systems control power production and distribution, such as those used for the generation of electricity or the delivery of water to communities. They are basically used to support the infrastructure that we rely upon. Thus, the failure of SCADA systems can impact a large number of people.

In a display of the potential damage that can be caused by an attack on the SCADA network , let’s look back to Stuxnet . This malware was reported to have targeted very specific Siemens based SCADA systems. (The attack was so specific that there was speculation that the purpose of the malware was to damage the nuclear facilities of Iran.) While details are hard to come by, it appears that the Stuxnet attack resulted in damage to centrifuges. (The centrifuge is used to separate different isotopes of uranium.)

Stuxnet caused incorrect data to be reported, which lead to the control systems effectively “mis-operating” the equipment. This “mis-operation” then resulted in damage. Stuxnet further revealed that it is difficult to prevent SCADA systems from malware attack. Theoretically, Stuxnet should not have been able to infect the SCADA systems controlling the centrifuges. However, in practice, it did because somehow the malware was introduced, either through an Internet connection or carried in via a USB. This reveals the risks of taking SCADA systems that are already network capable systems and making them accessible via the Internet.

So, you would think that a malware infection such as Stuxnet could not happen again. Not so fast, as Iran has reported that they are now dealing with another virus, the Duqu virus, that is targeting their civil defense system.

Well, what can we learn from all of this? Certainly, virus scanners are less effective now, especially against a determined adversary. Therefore, it truly is important that SCADA systems be shielded from the introduction of malware, whether it is via the Internet or through a USB device.

As consumers, we all have an interest in the security of the SCADA systems that manage our power, our water, and even our prisons.

How to find hidden passwords (and how to protect them)

While preparing to teach a computer forensic workshop, I discovered a new live Linux distribution entitled C.A.IN.E, (Computer Aided Investigative Environment.) This software is one of a few live Linux distributions that allows a user to boot Linux from a CD or DVD and start a forensic investigation. The distribution includes tools to make forensic and analyze forensic images. Since it is freeware, it is easy to make use of the software as part of the workshop.

In addition to Linux tools, NBCAINE version 2.5 includes WinTaylor, a set of tools that are designed to run on a Windows system.This software can be loaded onto a USB through the “dd” utility. (Once loaded on the USB,  a user can boot the live distro off of the USB and not access the WinTaylor tools or plug the USB into a running Windows system and access the WinTaylor tools.) Included in the WinTaylor section of the software are Windows based tools from NirSoft that allow a user to recover passwords saved in popular web browsers, view recent file activity on the Windows system, view information about USB drives attached to the computer and more.

The NirSoft tools include some noteworthy ones that are designed to uncover passwords stored on Windows systems. For example, when you log into a password protected website, Internet Explorer (and other browsers) give you the option to save the login information so that you don’t need to enter it the next time. A Nirsoft utility, iepv.exe(Internet Explorer Password Viewer), retrieves and displays the userids and passwords. If you use Microsoft Outlook and save your POP3 or IMAP password,  the Nirsoft utility mailpv.exe will retrieve and display the accounts and passwords saved in Outlook. And, WirelessKeyView.exe will display the wireless network names and associated passwords that are stored in your system.

I encourage you to obtain these tools and run them on your system to reveal how many passwords are stored on your system. If you discover sensitive passwords stored on your system and you allow others to use your system, you will want to ensure that you clean out the stored passwords.

While you might not be able to delete all of the saved passwords, at least you will now have a better handle on all of the passwords stored on your system that are recoverable.

Revenge Hacking

Revenge is a powerful motivator for hacking. Take, for example, the case of Barry Ardolf of Minnesota. Trouble started when Mr. Ardolf was accused by a neighbor of kissing their 4-year boy on the lips. When the parents confronted Mr. Ardolf, he confessed that the accusation was true. Naturally, the parents of the 4-year old contacted the police. This made Mr. Ardolf angry and he decided to seek revenge.

As part of his revenge, court documents indicate that Mr. Ardolf used aircrack, a freely available wireless security tool, to discover the Wired Enhanced Privacy (WEP ) password for his neighbor’s network.  With the neighbor’s WEP password, Mr. Ardolf could use his own computer to connect to the neighbor’s wireless network. Once connected to the wireless network, Mr. Ardolf would be able to access the Internet using the  neighbor’s IP address. Thus, any activity performed by Mr. Ardolf on the Internet would be tracked back to his neighbor’s residence. This provided the opportunity for Mr. Ardolf to take revenge by taking actions that would appear to be done by his neighbor.

Meanwhile, the “hacked” neighbor had been getting reports that coworkers were receiving bizarre email messages that could not be explained. The neighbor had taken the step of bringing in a security consultant to monitor activity on his network. During the time that the monitor was active, the Secret Service investigated an email threat that was found to have been sent from Mr. Ardolf through the neighbor’s wireless network. Since it was sent from “hacked” network, the IP address of the email message came back to the neighbor, not Mr. Ardolf. This lead the Secret Service to visit the neighbor, who turnover over the information from the monitor. In the monitor logs was Mr. Ardolf’s POP3 username and password, presumably known only to Mr. Ardolf. This piece of incriminating information cause the government to turn its attention toward Mr. Ardolf.

The username and password found in the monitor log gave the government probable cause to obtain a search warrant for Mr. Ardolf’s residence. Examination of his computers revealed that he had sent the threatening email, as well as created false email addresses and MySpace accounts designed to appear to be the neighbor.

Further, evidence was uncovered  that Mr. Ardolf had in his possession underage illicit images. He appears to have sent these images from the fake accounts that he created, apparently to “frame” his neighbor.

There are a few lessons that show up from this case. One is that revenge is a powerful and dangerous motivation, one that I covered in my book from a few years ago, High Tech Crimes Revealed.  Revenges is a dangerous motivation since the goal is to damage or hurt another.

Another lesson is that security weaknesses can be used to attack home networks as well as business networks. While WEP encryption is better that no encryption, it suffers from security flaws that can be easily exploited using freely available tools.

In this case, the use of improved WiFi Protect Access (WPA) encryption would have made it more difficult for Mr. Ardolf to break into the neighbor’s wireless network.

 

Are Macs immune to virus or malware?

A couple of weeks ago, I was asked to check on a Windows-based computer that had recently been infected with a “virus scanner” malware. In this case, the malware (malicious software) would put up a pop up screen that was kind enough to inform you that your computer was loaded with a bunch of virus infections. Further, it offered a link that would allow you to pay for a virus scanner to clean things up, right away. The malware writers made it very difficult for the average user to ignore their malware, as it disabled the buttons that would allow you to close the pop up boxes. Further, it redirected any attempts to run programs such as regedit back to the malware. Cleaning the malware had to be done through Safe-mode.

But, why would I mention this in a posting about Macs and virii? Well, in this case, I was able to track the source of this Windows malware infection back to an email message which contained a series of links to articles that the author thought people would find useful. When the email author, let’s call him Stan, was notified that his email was linked to a malware attack, his response was, quite simply, “That is impossible, because I have a Mac.”

Of course, this is not true. Macs, as good as they are, are not able to scrub malware out of email messages or links on webpages. But, this comment got me thinking, are Macs actually malware free. Dan Moren of Mac World recently released an article entitled “New Mac Trojan horse masquerades as virus scanner“. This articles describes malware written for the Mac that impersonates a virus scanner. Sound familiar?

This is not the first case of the Mac being susceptible to a malware attack. Back in April of 2006, an article from the AP called “Macs no longer immune to viruses, experts say” was released. So, it appears that the Mac has been susceptible to malware for a while.

What Apple has done, it seems,  is taken steps to protect the user environment from malware, as shown in this explanation from Apple. Noteworthy steps include using a sand-box environment and screening the content of downloaded files. So, how did the virus scanner attack affect Macs? Apparently, the malware writers were able find a way around the Mac security and/or screening defenses. It is quite possible that it will happen more often in the future, as Macs continue to become a more popular, more widely used platform and the malware writers become more adept.

So, it appears that Apple has done a lot to secure their user environment, but that malware is still getting through…

how safe is your digital data?

The recent hack of the Sony network has exposed user information on approximately 77 million accounts.  The attack, according to an article in the The Telegraph, has potentially exposed passwords and credit card numbers.  If this is true, this is “not good”, since it would imply that the passwords and the credit card numbers were not encrypted when they were stored in Sony’s network.

I registered for the Sony network, so apparently my credentials were among the ones stolen during this attack. At the end of this posting is the email message that I received from Sony about the incident. (I have removed some information that is not important for this posting.) The posting recommends changing the account password once the Sony network has been reactivated.

The Sony network required an email address and a password for a user to log into their network. An email address along with a password is used for authentication to other networks, such as LinkedIN or Facebook. Thus, it is possible that some of the accounts compromised in the Sony network attack can be used to hijack non Sony accounts. The below email message from Sony would be better if it recommended that users change all accounts using the same email address and/or the same password used in the Sony network.

What can users do? When registering for networks such as Sony’s, Amazon’s or others, be sure the email adress and password used for authenticiation on one site is not used for authentication on other sites. This means that a user needs to  ensure that the userid/password used to log into Facebook is not the same as the userid/password used to log into the Sony network. This will limit the potential risk if one network is compromised For example, my amazon ID is not at risk from this attack since I user different account information for the Amazon and Sony networks.

Here is the email I recieved.

" Valued PlayStation(R)Network/Qriocity Customer:
 We have discovered that between April 17 and April 19, 2011, certain PlayStation Network 
and Qriocity service user account information was compromised in connection with an illegal
and unauthorized intrusion into our network. In response to this intrusion, we have:
 1) Temporarily turned off PlayStation Network and Qriocity services;
 2) Engaged an outside, recognized security firm to conduct a full and complete investigation
into what happened; and
 3) Quickly taken steps to enhance security and strengthen our network infrastructure by rebuilding our system to provide you with greater protection of your personal information.
 We greatly appreciate your patience, understanding and goodwill as we do whatever it takes 
to resolve these issues as quickly and efficiently as practicable.
 Although we are still investigating the details of this incident, we believe that an 
unauthorized person has obtained the following information that you provided: name, address 
(city, state, zip), country, email address, birthdate, PlayStation Network/Qriocity password
and login, and handle/PSN online ID. It is also possible that your profile data, including 
purchase history and billing address (city, state, zip), and your PlayStation 
Network/Qriocity password security answers may have been obtained. If you have authorized a 

sub-account for your dependent, the same data with respect to your dependent may have been 
obtained. While there is no evidence at this time that credit card data was taken, we 
cannot rule out the possibility. If you have provided your credit card data through 
PlayStation Network or Qriocity, out of an abundance of caution we are advising you that 
your credit card number (excluding security code) and expiration date may have been 
obtained.
... When the PlayStation Network and Qriocity services are fully restored, we strongly 
recommend that you log on and change your password. Additionally, if you use your 
PlayStation Network or Qriocity user name or password for other unrelated services or 
accounts, we strongly recommend that you change them as well.
 To protect against possible identity theft or other financial loss, we encourage you to 
remain vigilant, to review your account statements and to monitor your credit reports. We 
are providing the following information for those who wish to consider it:   
- U.S. residents are entitled under U.S. law to one free credit report annually from each of
 the three major credit bureaus. To order your free credit report, visit 
www.annualcreditreport.com or call toll-free (877) 322-8228.
 - We have also provided names and contact information for the three major U.S. credit 
bureaus below.  At no charge, U.S. residents can have these credit bureaus place a "fraud 
alert" on your file that alerts creditors to take additional steps to verify your identity 
prior to granting credit in your name. This service can make it more difficult for someone 
to get credit in your name. Note, however, that because it tells creditors to follow 
certain procedures to protect you, it also may delay your ability to obtain credit while 
the agency verifies your identity.  As soon as one credit bureau confirms your fraud alert, 
the others are notified to place fraud alerts on your file. Should you wish to place a 
fraud alert, or should you have any questions regarding your credit report, please contact 
any one of the agencies listed below:
  • Experian: 888-397-3742; www.experian.com; P.O. Box 9532, Allen, TX 75013
  • Equifax: 800-525-6285; www.equifax.com; P.O. Box 740241, Atlanta, GA 30374-0241
  • TransUnion: 800-680-7289; www.transunion.com; Fraud Victim Assistance Division, P.O. 
Box 6790, Fullerton, CA 92834-6790
 - You may wish to visit the website of the U.S. Federal Trade Commission at
 www.consumer.gov/idtheft or reach the FTC at 1-877-382-4357 or 600 Pennsylvania Avenue, 
NW, Washington, DC 20580 for further information about how to protect yourself from 
identity theft. Your state Attorney General may also have advice on preventing identity 
theft, and you should report instances of known or suspected identity theft to law 
enforcement, your State Attorney General, and the FTC. For North Carolina residents, the 
Attorney General can be contacted at 9001 Mail Service Center, Raleigh, NC 27699-9001; 
telephone (877) 566-7226; or www.ncdoj.gov. For Maryland residents, the Attorney General 
can be contacted at 200 St. Paul Place, 16th Floor, Baltimore, MD 21202;
telephone: (888) 743-0023; or www.oag.state.md.us.
...
 Sincerely,
 Sony Computer Entertainment and Sony Network Entertainment"

From this message, it appears that the attacker were able to get hold of significant personal information. 

So, what can we do to better protect ourselves? Kkeep in mind that some of the networks that we rely on will be compromised by attackers. Thus, it is the user’s responsibility to ensure that ids are different on each site.

is the day of the virus scanner over?

I have noticed a new trend emerging over the past couple of years… the virus writers are out-pacing the virus detectors. First, consider the clampi/zeus virus which I wrote about in 2009.  This virus was being used to steal banking credentials and was very successful. Of note was that up to date virus scanners were not detecting the clampi virus.

Then, last year, information came to light on the “stuxnet” virus. This virus has recently been “cracked” by Ralph Langner. His presented his findings at TED (see the video here .) The summary of his presentation was that the virus was very advanced and written to attack specific systems involved in the refinement of uranium in Iran. This is the stuff of spy movies.

Note that clampi and stuxnet virii have the following things in common:

  1. they were not detected by virus scanners,
  2. they wanted to be stealth and not damage the host computer,
  3. they were targetted in their attacks.

So, what can we make of this new trend. Virus detection seems to be losing the battle against the truly sophisticated virus writers, and this is not a good trend. As computers contain more sensitive information such as banking records or nuclear secrets, they will become targets of attack. And, since the virus writers are outpacing the virus defenders at the moment, it is difficult to trust any system connected to the Internet, whether it has a virus scanner or not.

One option that might become useful in the future is a computer that runs a virtual operating system, such as VMWare. A virtual operating system loads its operating system from a static image. Though the VMware operating system might get infected with a virus, the virus itself does not infect the static image from which the VMWare is loaded. (At least not yet.) Basically, the virutal operating system is protected from a persistent virus threat since it reloads the operating system with every reboot.

Of course, this means that making real persistent changes to the operating system, such as installing new software, becomes very difficult. So difficult, in fact, that we probably won’t see people using virtual operating systems for a while…

Meanwhile, the search goes on for a better method to protect systems against persistent virus infections.

Ten insecure web applications for your online identity.

Recently, the NY Times published the article New Hacking Tools Pose Bigger Threats to Wi-Fi Users . This article discussed the dangers of a relatively new tool called Firesheep, which allows a third-party to “hijack” active connections to password protected websites. The software, created by Eric Butler, can be downloaded for free. The software is easy to use, as it is an add-on for Mozilla Firefox.

Normally, when we log into a website, we are first directed to a login page protected with SSL. (This appears to the user as “https”, and it encrypts data sent over the network.) When a user successfully logs in, their web browser will get a session cookie, which acts like a digital pass. This session cookie allows a user to access protected webpages without having to continually enter their password. A typical session cookie is composed of a sequence of characters and may look like this:

"SESSION=0009hE0aCdjIp-7kxeQq0kwrvF0"

Keep in mind that anyone presenting a valid session cookie can access protected webpages until the session cookie becomes invalid through a logout. If the session cookie is sent without encryption, it could be read by a third-party using an application such as Firesheep. That stolen session cookie could be used to access protected webpages. Note that while the session cookie might be stolen, the user’s password has not been compromised, since the session id provides no information about the user’s password.

When we log into a website that is secure, we expect that the entire session will be encrypted to protect our information as it is traveling the network. However, in many cases, only the login page is protected, not the accesses to the website after login. For example, when logging into Google, the password entered during the login is protected with encryption, preventing a third-party from stealing the password. Once the user is logged in, a session cookie is set. When the user then accesses an unencrypted Google page, the cookie is still sent, but now in the clear.

The Firesheep application is preconfigured to capture active session information for 26 websites. Below are the ten most interesting of them.

  1. Amazon.com,
  2. Basecamp,
  3. Dropbox,
  4. Facebook,
  5. Google,
  6. Windows Live,
  7. NY Times,
  8. Twitter,
  9. WordPress,
  10. Yahoo

Each one of the above websites transmits the session cookie unencrypted, meaning that a third-party could steal the cookie using Firesheep. If someone can copy your session cookie, they could access your protected webpages. For example, in the case of Facebook, they could access your messages and even post status updates.

The risk of having your session cookie stolen is high on an open (unencrypted) Wi-Fi networks, such as those found at airports, coffee shops and hotels as the communications on these networks can be monitored by a third-party. These Wi-Fi networks often require a user to log in, but this log in does not prevent a third-party from watching all of the network traffic going. And, generally, Wi-Fi networks that require a user to login in via a webpage are generally open wireless networks. The risk of session cookie compromise is lower, but still exists with WEP protected Wi-Fi networks. Wired networks and WPA protected Wi-Fi networks offer the best protection against this type of attack as these networks make it difficult for a third-party to intercept your traffic.

What can a user do? There are only a couple of tips:

#1 – Always be sure to log out from a website when you are done. For example, when you are doing on Facebook, by sure to log out. The logout cancels the session cookie.

#2 – Be aware when using an open Wi-Fi network that your session cookie could be stolen by a third-party. So, be more diligent about logging out when using an open Wi-Fi connection.

Unfortunately, there is not much more that users can do at this time. Application developers will need to upgrade their applications to only transmit session cookies when using “https” and never when using “http”.

Dangers of the “forgot my password” link

This hasn’t been a good month for passwords…

In mid January, George Samuel Bronk plead guilty to a California court computer intrusion charges and possession of contraband images. He searched for women on Facebook, then broke into their email accounts. He didn’t guess the passwords of the email accounts, instead he reset the password for the account using the “forgot my password” link. These links usually ask for personal information such as “what was the name of your first pet?”. Using information from the victim’s Facebook pages, he was able to answer the security questions and reset the passwords for many users. 

Once he broke into the accounts, he searched the sent email folder, looking for photos that the account owner sent to others. In some cases, he found very personal photos, which he downloaded to his computer. And, as a consequence of his attack, the original email owner could not get back into their account.

  As if this was not bad enough, Bronk then threatened to release the compromising photos of the victims unless they sent him more photos to their stolen email account.

  From this attack, we have learned that if a password is too difficult to guess, attackers can try to reset it using publicly available information. Therefore, I strongly suggest that you do not use real information when answering the security questions. Consider answering the question “Mother’s maiden name” as your favorite color, not your mother’s real name. Mix it up in a way that you will remember but an attacker won’t.

Then, the website “Trapster” announced that their site experienced an “incident”. The compromised data possibly included email addresses, account password and phone numbers of customers, but the site was not very specific. Risk of exposure of credit card information from this attack is low since the site did not contain credit card information. If the compromised data included the account password, the  real risk here is that the captured Trapster passwords could be used to log into other sites, such as Facebook. Note that strong, difficult to guess password would be of no help here since the passwords were visible to a third-party.

The lessons to be learned:

  1 – Complex, hard to guess passwords can easily be defeated through the “password reset” link. To protect yourself, make sure that your answers for your account’s security questions are not well-known. For example, don’t say your favorite color is red, say it is your birth month. Don’t give your real birthday, instead change the day, month or year to your favorite number. Be creative with your answers.

  2. Don’t use a single password for all of your Internet access, because if your password is stolen from one site, it can be used for all of sites that you use. For some, maintaining a different password for each account can be too difficult. In that case, make sure that the following passwords are not shared with any other site:

  •  Your online banking password
  •  Your social networking password
  •  Your email password.

  Have I missed any accounts that should have a unique password? Let me know.

Top 10 usernames hackers try

The basics: we use usernames to identity a person to a computer system. A password is commonly required in order to ensure that only the proper person is using the username. Hackers know that at least some passwords for most systems are usually weak or easily guessed, and they will often attempt to access computers using password guessing programs. These attacks are often attempted to my systems on the Internet, which are accessible via ssh. Ssh allows for command line access to a remote system over the network, and is a very useful tool to administer systems remotely. Ssh allows an administrator to copy files up to a remote server and down from a remote server too.

Access to ssh is usually authenticated through a username and password, as is the case with most system access. (While authentication based upon a username and password is not great, it is the most scalable option available today.) Ssh, a widely available tool, is recommended for use since it  encrypts traffic, which reduces the ability for hackers to sniff account passwords. (Password sniffing is a problem with http, ftp and telnet communications.)

As ssh has grown in popularity, hackers have needed to devise new methods for breaking into ssh protected systems. One class of ssh hacking tool is SSHater, a tool that will try to guess valid usernames and passwords via ssh. Back to my systems on the Internet. I have configured my ssh server to log all invalid username/password attempts to the audit log, along with the IP address where the attempt originated. Here is a sample from my audit log.

type=USER_LOGIN msg=audit(1291694386.586:32619): user pid=17683 uid=0 auid=4294967295 ses=4294967295 msg=’op=login acct=”root” exe=”/usr/sbin/sshd” hostname=? addr=94.102.1.248 terminal=sshd res=failed’

I have gone through my last year’s worth of audit logs to summarize the most oftenly guessed usernames and sources of hacking attempts.  The most commonly guessed usernames are:  

  1. root
  2. test
  3. oracle
  4. admin
  5. user
  6. postgres
  7. guest
  8. nagios
  9. mysql
  10. tomcat

Runner-ups were; student, cyrus, mythtv, administrator, temp and apache.

And, here are the top IP addresses that have been trying to get in:

  1. 114.141.196.155 (dedserver.net, a dns name with no website!)
  2. 221.143.48.15 (korea)
  3. 61.55.135.182 (china)
  4. 175.125.21.228 (korea)
  5. 94.102.1.248 (turkey)
  6. 121.88.249.143 (korea)
  7. 111.68.108.6 (pakistan)
  8. 173.244.187.10 (ohio, USA)
  9. 118.217.12.34 (korea)
  10. 212.156.122.94 (turkey)
  11. 218.64.215.239 (china)
  12. 91.209.238.2 (mexico?)
  13. 118.219.234.163 (korea)

What can we learn from this? First, notice that the username “root” is one of the most popular usernames guessed. That is because many UNIX systems are configured with a “root” account, and that account usually has full privileges. It is the account a hacker would most like to obtain for a system. To protect against this, make sure that root logins are disabled via the Internet. It is preferable to have a system administrator log in with their own userid, then “su” to a root level account.

Three of the top 10 are accounts (oracle, postgres and mysql) are database accounts. So, if you have these databases and they need to be admininistered from the Internet, be sure that you have secured your database usernames.

Accounts such as admin and guest are typically generic accounts shared by many people. These accounts usually have weak passwords and should be avoided.

In summary, remember to:

  • disable root level logins via ssh.
  • change default passwords for any and all default accounts.
  • review the audit log for login successes from unknown IP addresses.
  • review the audit log for login failures to keep an eye on the latest accounts that are being guessed against your system.