Another Word For It Patrick Durusau on Topic Maps and Semantic Diversity

October 1, 2016

Government Contractor Persistence

Filed under: Cybersecurity,Government,Security — Patrick Durusau @ 12:59 pm

Persistence of data is a hot topic in computer science but did you know government contractors exhibit persistence as well?

Remember the 22,000,000+ record leak from the US Office of Personnel Management?

Leaks don’t happen on their own and it turns out that Keypoint Government Solutions was weak link in the chain that resulted in that loss.

Cory Doctorow reports in Company suspected of blame in Office of Personnel Management breach will help run new clearance agency:

…
It’s still not clear how OPM got hacked, but signs point to a failure at one of its contractors, Keypoint Government Solutions, who appear to have lost control of their logins/passwords for sensitive OPM services.

In the wake of the hacks, the job of giving out security clearances has been given to a new government agency, the National Background Investigations Bureau.

NBIB is about to get started, and they’ve announced that they’re contracting out significant operations to Keypoint. Neither Keypoint nor the NBIB would comment on this arrangement.
…

The loss of 22,000,000 records?, well, that could happen to anybody.

WRONG!

Initiatives, sprints, proclamations, collaborations with industry, academia, etc., are unlikely to change the practice of cybersecurity in the U.S. government.

Changing cybersecurity practices in government requires:

  • Elimination of contractor persistence. One failure is enough.
  • Immediate and permanent separation of management and staff who fail to implement and follow standard security practices.
  • Separated staff and management barred from employment with any contractor with the government, permanently.
  • Staff of prior failed contractors barred from employment at present contractors. (An incentive for contractor staff to report shortfalls in current contracts.)
  • Multi-year funded contracts that include funding for independent red team testing of security.

A no consequences for failure of security policy defeats all known security policies.

September 30, 2016

ORWL – Downside of a Physically Secure Computer

Filed under: Cryptography,Cybersecurity,Security — Patrick Durusau @ 1:57 pm

Meet ORWL. The first open source, physically secure computer

orwl-460

If someone has physical access to your computer with secure documents present, it’s game over! ORWL is designed to solve this as the first open source physically secure computer. ORWL (pronounced or-well) is the combination of the physical security from the banking industry (used in ATMs and Point of Sale terminals) and a modern Intel-based personal computer. We’ve designed a stylish glass case which contains the latest processor from Intel – exactly the same processor as you would find in the latest ultrabooks and we added WiFi and Bluetooth wireless connectivity for your accessories. It also has two USB Type C connectors for any accessories you prefer to connect via cables. We then use the built-in Intel 515 HD Video which can output up to 4K video with audio.

The physical security enhancements we’ve added start with a second authentication factor (wireless keyfob) which is processed before the main processor is even powered up. This ensures we are able to check the system’s software for authenticity and security before we start to run it. We then monitor how far your keyfob is from your PC – when you leave the room, your PC will be locked automatically, requiring the keyfob to unlock it again. We’ve also ensured that all information on the system drive is encrypted via the hardware on which it runs. The encryption key for this information is managed by the secure microcontroller which also handles the pre-boot authentication and other security features of the system. And finally, we protect everything with a high security enclosure (inside the glass) that prevents working around our security by physically accessing hardware components.

Any attempt to get physical access to the internals of your PC will delete the cryptographic key, rendering all your data permanently inaccessible!
…

The ORWL is a good illustration that good security policies can lead to unforeseen difficulties.

Or as the blog post brags:

Any attempt to get physical access to the internals of your PC will delete the cryptographic key, rendering all your data permanently inaccessible!

All I need do to deprive you of your data (think ransomware), is to physically tamper with your ORWL.

Of interest to journalists who need the ability to deprive others of data on very short notice.

Perhaps a fragile version for journalists and a more resistance to abuse version for the average user.

Enjoy!

September 29, 2016

Multiple Backdoors found in D-Link DWR-932 B LTE Router [There is an upside.]

Filed under: Cybersecurity,Security — Patrick Durusau @ 9:58 pm

Multiple Backdoors found in D-Link DWR-932 B LTE Router by Swati Khandelwal.

From the post:

If you own a D-Link wireless router, especially DWR-932 B LTE router, you should get rid of it, rather than wait for a firmware upgrade that never lands soon.

D-Link DWR-932B LTE router is allegedly vulnerable to over 20 issues, including backdoor accounts, default credentials, leaky credentials, firmware upgrade vulnerabilities and insecure UPnP (Universal Plug-and-Play) configuration.

If successfully exploited, these vulnerabilities could allow attackers to remotely hijack and control your router, as well as network, leaving all connected devices vulnerable to man-in-the-middle and DNS poisoning attacks.

Moreover, your hacked router can be easily abused by cybercriminals to launch massive Distributed Denial of Service (DDoS) attacks, as the Internet has recently witnessed record-breaking 1 Tbps DDoS attack that was launched using more than 150,000 hacked Internet-connected smart devices.

Security researcher Pierre Kim has discovered multiple vulnerabilities in the D-Link DWR-932B router that’s available in several countries to provide the Internet with an LTE network.
…

The current list on this cyber-horror at Amazon.uk is £95.97. Wow!

Once word spreads about its swiss-cheese like security characteristics, one hopes its used price will fall rapidly.

Swati’s post makes the start of a great checklist for grading penetration of the router for exam purposes.

Enjoy!

PS: I’m willing to pay $10.00 plus shipping for one. (Contact me for details.)

September 28, 2016

Meet Apache Spot… [Additional Malware Requirement: Appear Benign]

Filed under: Cybersecurity,Log Analysis,Security — Patrick Durusau @ 7:52 pm

Meet Apache Spot, a new open source project for cybersecurity by Katherine Noyes.

From the post:

Hard on the heels of the discovery of the largest known data breach in history, Cloudera and Intel on Wednesday announced that they’ve donated a new open source project to the Apache Software Foundation with a focus on using big data analytics and machine learning for cybersecurity.

Originally created by Intel and launched as the Open Network Insight (ONI) project in February, the effort is now called Apache Spot and has been accepted into the ASF Incubator.

“The idea is, let’s create a common data model that any application developer can take advantage of to bring new analytic capabilities to bear on cybersecurity problems,” Mike Olson, Cloudera co-founder and chief strategy officer, told an audience at the Strata+Hadoop World show in New York. “This is a big deal, and could have a huge impact around the world.”

…

Essentially, it uses machine learning as a filter to separate bad traffic from benign and to characterize network traffic behavior. It also uses a process including context enrichment, noise filtering, whitelisting and heuristics to produce a shortlist of most likely security threats.
…

Given the long tail for patch application, Prioritizing Patch Management Critical to Security, which reads in part:

…
Patch management – two words that are vital to cybersecurity, but that rarely generate enough attention.

That lack of attention can cost. Recent stats from the Verizon Data Breach report showed that many of the most exploited vulnerabilities in 2014 were nearly a decade old, and some were even more ancient than that. Additional numbers from the NTT Group 2015 Global Threat Intelligence Report revealed that 76 percent of vulnerabilities they observed on enterprise networks in 2014 were two years old or more.
…

Apache Spot is not an immediate threat to hacking success, but that’s no reason to delay sharpening your malware skills.

Beyond making malware seem benign, have you considered making normal application traffic seem rogue?

When security becomes “too burdensome,” uninformed decision makers may do more damage than hackers.

I know machine learning has improved but I find the use case:

decision-maker-460

at the very best, implausible. 😉

Thoughts on a test environment to mimic target networks?

Enjoy!

Bank Being Held Hostage (or rather its data)

Filed under: Cybersecurity,Security — Patrick Durusau @ 1:49 pm

DarkNet Hackers ‘DarkOverlord’ Hack WestPark Capital Bank for Ransom tells a tale of secret/sensitive bank information being stolen and then the bank is threatened with its release, unless ransom is paid.

The hackers have dropped a “sample” of sensitive information, one assumes to prove the hack but also as incentive for WestPark Capital Bank to make payment.

I mention the story because the strategy of the hackers in releasing information to the public about the hack seems like an odd strategy.

Contrast “holding” a copy of data with the recent spate of ransomware hacks, were victims are denied access to their data at all. The absence of being able to conduct their regular business provides a powerful incentive for payment of a ransom.

“Holding” a copy of a bank’s data in no way impairs their day to day operations. Considering the “normal” activities of banks, shaming for poor security, or anything else, is an unlikely lever to use against a bank.

Clearly a direct payment from WestPark Capital Bank is the preferred solution of ‘DarkOverLord.’

But you have to ask yourself, does WestPark Capital Bank or its customers have greater incentives to prevent release of the data?

Customers of WestPark Capital Bank need to assess their risk of civil and criminal liability from documents held by WestPark and act in their own best interests.

September 27, 2016

Collaboration Tools and smart use of Google (ask Pippa Middleton)

Filed under: Collaboration,Google Docs,Security — Patrick Durusau @ 7:54 pm

Collaboration Tools and smart use of Google by Kaas & Mulvad.

As Kaas & Mulvad illustrate, collaboration with Google tools can be quite effective.

However, my attention was caught by the last sentence of their first paragraph:

Google Drive makes sharing your files simple. It also allows multiple people to edit the same file, allowing for real-time collaboration. But be aware – don’t share anything in Google, you want to keep secret. (emphasis added)

Pippa Middleton would tell you the same advice applies to the iCloud.

September 22, 2016

Cisco Hunting Report – ISAKMP – 859,233 Vulnerable IPs

Filed under: Cybersecurity,Security — Patrick Durusau @ 8:15 pm

The Vulnerable ISAKMP Scanning Project, courtesy of ShadowServer reports:

This scan is looking for devices that contain a vulnerability in their IKEv1 packet processing code that could allow an unauthenticated, remote attacker to retrieve memory contents, which could lead to the disclosure of confidential information. More information on this issue can be found on Cisco’s site at: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160916-ikev1.

The goal of this project is to identify the vulnerable systems and report them back to the network owners for remediation.

…

Statistics on current run

859,233 distinct IPs have responded as vulnerable to our ISAKMP probe.
…
(emphasis in the original)

If visuals help:

isakmp_north_america_current-460

isakmp_europe_current-460

I trust your map reading skills are sufficient to conclude that ISAKMP vulnerabilities aren’t common in Iceland and northern Finland. There are more fertile areas for exploration.

iceland-finland-460

You can see other land masses or all vulnerable devices.

Is anyone selling ISAKMP scan data?

That would be valuable intell.

Imagine converting it into domain names so c-suite types could cross-check reassurances from their IT departments.

Google Allo – Goodbye!

Filed under: Cybersecurity,Privacy,Security — Patrick Durusau @ 10:39 am

Google Allo: Don’t use it, says Edward Snowden by Liam Tung.

From the post:

Google’s Allo messaging app and its Assistant bot have finally arrived, but Allo has been slammed for reneging on a promise that it would, by default, make it more difficult to spy on.

Because of the missing privacy feature, NSA-contractor-turned-whistleblower Edward Snowden’s first take of Allo after yesterday’s US launch is that it’s just a honeypot for surveillance.
…

The main complaints are that security is off by default and that chat logs are stored until deleted by users.

Google made a conscious choice on both of those features.

Now is your opportunity to make a conscious choice about Allo. Goodbye!

Don’t be mis-led into thinking end-to-end encryption ends the danger from preserving chat logs.

Intelligence agencies have long argued knowing who calls who is more important than the content of phone calls. Same is true for chats.

Google has chosen a side other than consumers, that’s enough to avoid it whenever possible.

September 21, 2016

Reducing Your “Competition”

Filed under: Cybersecurity,Security — Patrick Durusau @ 10:54 am

Good security practices are a must, whether you live in the Cisco universe or the more mundane realm of drug pushing.

Case in point: Photos On Dark Web Reveal Geo-locations Of 229 Drug Dealers — Here’s How by Swati Khandelwal.

From the post:

It’s a Fact! No matter how smart the criminals are, they always leave some trace behind.

Two Harvard students have unmasked around 229 drug and weapon dealers with the help of pictures taken by criminals and used in advertisements placed on dark web markets.

Do you know each image contains a range of additional hidden data stored within it that can be a treasure to the investigators fighting criminals?
…

Whatever services you are offering on the Dark Web, here’s an opportunity to reduce the amount of competition you are facing.

Perhaps even a reward from CrimeStoppers, although you need to price shop against your local organization for the better deal.

Failure to scrub Exchangeable Image File Format (EXIF) data lies at the heart of this technique.

See Swati’s post for more details on this “hack.”

Do your civic duty to reduce crime (your competitors) and be rewarded in the process.

Who says cybersecurity can’t be a profit center? 😉

September 19, 2016

Stopping Terrorism: Thieves 2, Security Forces 0

Filed under: Government,Security — Patrick Durusau @ 4:44 pm

Murray Weiss, Nicholas Rizzi, Trevor Kapp and Aidan Gardiner document in Thieves Helped Crack the Chelsea Bombing Case, Sources Say how common street thieves thwarted terrorist attacks in New York City and New Jersey.

Albeit inadvertently, thieves prevented a second explosion in Chelsea and multiple explosion in New Jersey.

See Thieves Helped Crack the Chelsea Bombing Case, Sources Say for the full story.

Great illustration the surveillance state can track people down, after they have committed a crime. Not good at stopping people before they commit a crime.

So why are we spending $billions on a surveillance state, that is out performed by street thieves?

Reward any thief discovering a terrorist bomb and turning it in with:

get-out-jail-2-460

Good for life, non-violent crimes only.

Given the track record of security forces in the United States, a far better investment.

September 16, 2016

Android Hacking – $200K First Prize – Other Offers?

Filed under: Cybersecurity,Security — Patrick Durusau @ 10:46 am

Announcing the Project Zero Prize by Natalie Silvanovich.

Before reading the “official” post, consider this Dilbert cartoon.

Same logic applies here:

How to compare alternatives? ($200K sets a minimum bid.)

Potential for repeat business?

For a pwn of any Android phone, $200K sounds a bit “lite.”

Watch the Android issue tracker. A third-party bidder won’t insist on you using only your reported bugs in an exploit chain.

Before anyone gets indignant, the NSA, CIA, the “Russians,” Chinese, Mossad, etc., will all be watching as well. Think of it as having “governmental” ethics.

From the post:

Despite the existence of vulnerability rewards programs at Google and other companies, many unique, high-quality security bugs have been discovered as a result of hacking contests. Hoping to continue the stream of great bugs, we’ve decided to start our own contest: The Project Zero Prize.

The goal of this contest is to find a vulnerability or bug chain that achieves remote code execution on multiple Android devices knowing only the devices’ phone number and email address. Successful submissions will be eligible for the following prizes.

First Prize

$200,000 USD, awarded to the first winning entry.

Second Prize

$100,000 USD, awarded to the second winning entry.

Third Prize

At least $50,000 USD awarded by Android Security Rewards, awarded to additional winning entries.

In addition, participants who submit a winning entry will be invited to write a short technical report on their entry, which will be posted on the Project Zero Blog.

Contest Structure

This contest will be structured a bit differently than other contests. Instead of saving up bugs until there’s an entire bug chain, and then submitting it to the Project Zero Prize, participants are asked to report the bugs in the Android issue tracker. They can then be used as a part of submission by the participant any time during the six month contest period. Only the first person to file a bug can use it as a part of their submission, so file early and file often! Of course, any bugs that don’t end up being used in a submission will be considered for Android Security Rewards and any other rewards program at Google they might be eligible for after the contest has ended.

In addition, unlike other contests, the public sharing of vulnerabilities and exploits submitted is paramount. Participants will submit a full description of how their exploit works with their submission, which will eventually be published on the Project Zero blog. Every vulnerability and exploit technique used in each winning submission will be made public.

Full contest rules

Frequently asked questions

Contest period:

The Contest begins at 12:00:00 A.M. Pacific Time (PT) Zone in the United States on September 13, 2016 and ends at 11:59:59 P.M. PT on March 14, 2017 (“Contest Period”).

Good hunting!

PS: If possible, post the paid price for your exploit to help set the market price for future such exploits.

If It’s Good Enough For Colin Powell…

Filed under: Cybersecurity,Security — Patrick Durusau @ 8:20 am

Some security advice for Colin Powell to better protect his Gmail account by Graham Cluley.

Graham posted webmail security advice for Colin Powell after 26 months worth of his private emails were leaked by DC Leaks.

Nothing surprising for my readers but pass it on to the c-suite types.

You can search and view Powell’s emails at DC Leaks / Colin Luther Powell.

Graham omits any link to DC Leaks and says:

…
Of course, the emails aren’t just embarrassing and damaging for the privacy of Colin Powell – they are also potentially humiliating for the people he was corresponding with, who have had their own private conversations exposed to the world.
…

Oh, the horror! Invasions of privacy!

You mean like the millions of ordinary people who aren’t secure in their phone calls, emails, web browsing, banking, credit histories, etc., all the time?

The extremely privileged getting nicked every now and again doesn’t trouble me.

“Oversight” hasn’t protected our freedoms, perhaps constant and detailed exposure of the privileged will. Worth a shot!

September 12, 2016

Invite Government Into The Cellphone Fish Bowl

Filed under: Cybersecurity,Privacy,Security — Patrick Durusau @ 4:25 pm

Long-Secret Stingray Manuals Detail How Police Can Spy On Phones by Sam Biddle.

Sam summarizes the high points from around 200 pages of current but never seen before Harris instruction manuals. Good show!

From the post:

…
Harris declined to comment. In a 2014 letter to the Federal Communications Commission, the company argued that if the owner’s manuals were released under the Freedom of Information Act, this would “harm Harris’s competitive interests” and “criminals and terrorist[s] would have access to information that would allow them to build countermeasures.”
…

Creating countermeasures?

Better, treat these documents as a basis for reverse-engineering Harris Stingrays into DIY kits.

False promises from known liars on use of “Stingray”s or “IMSI catchers are not going to combat government abuse of this technology.

Inviting governments to join the general public in the cellphone fish bowl might.

Can you imagine the reaction of your local sheriff, district attorney, judge, etc. when they are being silently tracked?

Not just in their routine duties but to mistresses, drug dens, prostitutes, porn parlors and the like?

We won’t have to wait long for the arrival of verifiable, secure cellphones.

September 11, 2016

projectSlam [Public self-protection. Think Trojans.]

Filed under: Cybersecurity,Security — Patrick Durusau @ 7:39 pm

projectSlam by Michael Banks.

From the webpage:

Project Slam is an initiative to utilize open source programs, operating systems and tools to aid in defending against nefarious adversaries. The overall focus is to research adversary’s behavior and utilize the data that can be captured to generate wordlists, blacklists, and expose methodologies of various threat actors that can be provided back to the public in a meaningful and useful way…

Partial data for 2016 includes:

A medium interaction honeypot was deployed with a focus on usernames and passwords. While attackers were attacking the honeypot, projectSlam was sucking up the attempts to generate a wordlist of what NOT to make your passwords.

Imagine that! Instead of hoarding information from a vulnerable public, or revealing only the top 10/20 worst passwords, Michael is posting the passwords hackers are looking for online!

Looking forward to more results from projectSlam and cybersecurity projects that enable the public to protect themselves!

Contrast a national network of Trojan dispensers versus Trojan representatives catching couples in need of a condom.

Which one is more effective?

Promote cyberself-protection today!

September 7, 2016

New Plea: Charges Don’t Reflect Who I Am Today

Filed under: Cybersecurity,Government,Government Data,Security — Patrick Durusau @ 3:20 pm

Traditionally, pleas have been guilty, not guilty, not guilty by reason of insanity and nolo contendere (no contest).

Beth Cobert, acting director at the OPM, has added a fifth plea:

Charges Don’t Reflect Who I Am Today

Greg Masters captures the new plea in Congressional report faults OPM over breach preparedness and response:

…
While welcoming the committee’s acknowledgement of the OPM’s progress, Beth Cobert, acting director at the OPM, disagreed with the committee’s findings in a blog post published on the OPM site on Wednesday, responding that the report does “not fully reflect where this agency stands today.”
… (emphasis added)

Any claims about “…where this agency stands today…” are a distraction from the question of responsibility for a system wide failure of security.

If you know any criminal defense lawyers, suggest they quote Beth Cobert as setting a precedent for responding to allegations of prior misconduct with:

Charges Don’t Reflect Who I Am Today

Please forward links to news reports of successful use of that plea to my attention.

September 6, 2016

Why No Wild Wild West? Parity Between Large/Small Governments? Citizens?

Filed under: Cybersecurity,Government,Politics,Security — Patrick Durusau @ 3:01 pm

Jordyn Phelps reports in Obama Tells Putin Hackers Shouldn’t Create Cyber ‘Wild Wild West’:

…
“What we cannot do is have a situation where this becomes the wild, wild West, where countries that have significant cyber capacity start engaging in unhealthy competition or conflict through these means,” the president said. He added that nations have enough to worry about in the realm of cyber attacks from non-state actors without nation-states engaging in hacking against one another.
…

Interesting that weapons that don’t require a major industrial base, like poison gas, biological, computer hacking, are such a pressing concern.

Weapons that small governments, small groups of people or even single individuals can produce and use effectively, well, those need to be severely policed if not prohibited outright.

If anything, there is too much hacking of private email accounts, celebrity nude pics, and rasomware with too little hacking of government emails, databases and document troves.

For example, there was a coup in Egypt (the most recent one 2013) but did you see vast quantities of diplomatic correspondence being leaked?

I am always disappointed when governments change and a bright spotlight isn’t shown on its predecessors. Especially if those predecessors had dealings with the United States and its minions. It’s not possible to tell what might be unearthed.

Hacking maybe the great leveler between governments and between governments and their peoples.

What’s there not to like about that?

PS: Unless, like Obama, you are loathe to share any of the wealth and power in the world.

September 4, 2016

Keystroke Recognition Using WiFi Signals [Identifying Users With WiFi?]

Filed under: Cybersecurity,Security — Patrick Durusau @ 8:42 pm

Keystroke Recognition Using WiFi Signals by Kamran Ali, Alex X. Liu, Wei Wang, and Muhammad Shahzad.

Abstract:

Keystroke privacy is critical for ensuring the security of computer systems and the privacy of human users as what being typed could be passwords or privacy sensitive information. In this paper, we show for the first time that WiFi signals can also be exploited to recognize keystrokes. The intuition is that while typing a certain key, the hands and fingers of a user move in a unique formation and direction and thus generate a unique pattern in the time-series of Channel State Information (CSI) values, which we call CSI-waveform for that key. In this paper, we propose a WiFi signal based keystroke recognition system called WiKey. WiKey consists of two Commercial Off-The-Shelf (COTS) WiFi devices, a sender (such as a router) and a receiver (such as a laptop). The sender continuously emits signals and the receiver continuously receives signals. When a human subject types on a keyboard, WiKey recognizes the typed keys based on how the CSI values at the WiFi signal receiver end. We implemented the WiKey system using a TP-Link TL-WR1043ND WiFi router and a Lenovo X200 laptop. WiKey achieves more than 97.5% detection rate for detecting the keystroke and 96.4% recognition accuracy for classifying single keys. In real-world experiments, WiKey can recognize keystrokes in a continuously typed sentence with an accuracy of 93.5%.

In discussing the limitations of their technique the authors mention:

…
User Specific Training. In our current implementation of WiKey, we train the classifiers using one user and test the classifier using the test samples from the same user. However, we hypothesize that if we train our classifier using a large number of users, the trained classifier will be able to capture commonalities between users and will then be able to recognize the keystrokes of any unknown user. At the same time, we also acknowledge that it is extremely challenging to build such a universal classifier that works for almost every user because WiFi signals are susceptible to various factors such as finger length/width, typing styles, and environmental noise.
…

The more interesting case would be identifying users in surveillance mode by their keystrokes, assuming persistent digital capture of their keystrokes wasn’t possible.

Subject (as in human) identification by WiFi signals?

August 31, 2016

Next Gen Tor?

Filed under: Cybersecurity,Security — Patrick Durusau @ 8:43 pm

Building a new Tor that can resist next-generation state surveillance by J.M. Porup.

A great survey of both the current status of Tor as well as projects that wish they could replace it.

Highly recommended except for the “Tor is not perfect” and some unknown solution will be stronger tone.

Perhaps, perhaps not, the key insight should be no security solution is perfect. Not now, not ever.

The Snowden leak, which is mentioned in the post, is evidence that even practically unlimited budgets are no guarantee of security.

Upgrade or I’ll Tell! [SWIFT To Banks (Where the money is)]

Filed under: Cybersecurity,Security — Patrick Durusau @ 4:32 pm

SWIFT Discloses New Cyber-Heists, Urges Banks to Boost Security Measures by Maritza Santillan.

From the post:

SWIFT, the messaging network used by financial institutions to complete transactions, announced on Tuesday it has discovered new cyber-theft attempts against its member banks.

According to a report by Reuters, the company sent out a private letter to global clients, warning that new cyber-heists have occurred since June this year.

“Customers’ environments have been compromised, and subsequent attempts (were) made to send fraudulent payment instructions,” read a copy of the letter, which was obtained by Reuters.

…

Furthermore, SWIFT announced it plans to suspend banks with poor security practices. In the letter, the firm notified banks they must install the latest version of its software by November 19, or they could be reported to regulators and banking partners.
…

The source for the “suspend banks,” said SWIFT was considering all its options so I would not take that threat very seriously.

One doubts a majority of its members could survive a garden variety SQLi attack on one or more of their locations. That won’t get you to SWIFT but its a good gauge of how serious security is, or rather isn’t, taken by your local bank.

Start hacking on the current version of the SWIFT software as some banks will upgrade by the November 19, 2016 target date.

Like the man says, it’s where the money is.

August 30, 2016

Security Lessons Learned from Harry Potter

Filed under: Cybersecurity,Security — Patrick Durusau @ 6:20 pm

POPsec Part 1: Security Lessons Learned from Harry Potter by Elle Armageddon.

From the post:

There are a lot of security lessons we can learn by examining popular media, analyzing mistakes which are made, and striving not to repeat them. The Harry Potter series is rich with such lessons, and while the following contains all kinds of spoilers (for every one of the books/movies), it’s also full of important life lessons we can take away by scrutinizing the mishaps which take place in the Wizarding World.
…

Being a Harry Potter fan increased my enjoyment but the lessons are valuable to everyone.

Looking forward to more installments of PopSec!

PS: Where do you learn your security lessons?

August 29, 2016

Looking For Your Next Cyber Jedi

Filed under: Cybersecurity,Government,Military,Security — Patrick Durusau @ 4:49 pm

DoD Taps DEF CON Hacker Traits For Cybersecurity Training Program by Kelly Jackson Higgins.

The Department of Defense sends Frank DiGiovanni, director of force training in DoD’s Office of the Assistant Secretary of Defense for Readiness, to DEF CON 24.

His mission?

…
“My purpose was to really learn from people who come to DEF CON … Who are they? How do I understand who they are? What motivates them? What sort of attributes” are valuable to the field, the former Air Force officer and pilot who heads overall training policy for the military, says.

DiGiovanni interviewed more than 20 different security industry experts and executives during DEF CON. His main question: “If you’re going to hire someone to either replace you or eventually be your next cyber Jedi, what are you looking for?”

…

The big takeaway from DiGiovanni’s DEF CON research: STEM, aka science, technology, engineering, and mathematics, was not one of the top skills organizations look for in their cyber-Jedis. “Almost no one talked about technical capabilities or technical chops,” he says. “That was the biggest revelation for me.”

DiGiovanni compiled a list of attributes for the cyber-Jedi archetype based on his interviews. The ultimate hacker/security expert, he found, has skillsets such as creativity and curiosity, resourcefulness, persistence, and teamwork, for example.
… (emphasis added)

The DoD has $millions to throw at creating cyber-Jedis.

If you plan to stay ahead, now would be a good time to start.

PS: If you attend the next DEF CON, keep an eye out for Frank:

DiGiovanni_Frank

Wifi Fishing

Filed under: Cybersecurity,Security — Patrick Durusau @ 1:50 pm

4th grader’s project on cyber security proves people will click on anything by Erin Cargile.

Evan Robertson programmed a mobile hot spot with this pop-up to connect:

…You allow any and all data you transmit to be received, reused, modified and/or redistributed in any way we deem fit. You agree to allow your connecting device to be accessed and/or modified by us in any way, including but not limited to harvesting personal information, reading and responding to your emails…If you are still reading this you should definitely not connect to this network. It’s not radical, dude. Also, we love cats. Have a good day!”

More than half of the people who connected, accepted the terms!

Sounds like a great group project for the holidays! Especially if you will be at the shopping mall anyway.

Come to think of it, use a bank logo, with more reasonable terms and you will attract unwary hackers as well.

For an extra webpage or two, you may collect some logins and passwords as well.

Enjoy!

August 26, 2016

New Virus Breaks The Rules Of Infection – Cyber Analogies?

Filed under: Biomedical,Cybersecurity,Security — Patrick Durusau @ 3:20 pm

New Virus Breaks The Rules Of Infection by Michaeleen Doucleff.

From the post:

Human viruses are like a fine chocolate truffle: It takes only one to get the full experience.

At least, that’s what scientists thought a few days ago. Now a new study published Thursday is making researchers rethink how some viruses could infect animals.

A team at the U.S. Army Medical Research Institute of Infectious Diseases has found a mosquito virus that’s broken up into pieces. And the mosquito needs to catch several of the pieces to get an infection.

“It’s the most bizarre thing,” says Edward Holmes, a virologist at the University of Sydney, who wasn’t involved in the study. It’s like the virus is dismembered, he says.

“If you compare it to the human body, it’s like a person would have their legs, trunk and arms all in different places,” Holmes says. “Then all the pieces come together in some way to work as one single virus. I don’t think anything else in nature moves this way.”
…

Also from the post:

These are insect cells infected with the Guaico Culex virus. The different colors denote cells infected with different pieces of the virus. Only the brown-colored cells are infectious, because they contain the complete virus. Michael Lindquist/Cell Press

new-virus-pieces-460

The full scale image.

How very cool!

Any known analogies in computer viruses?

Apple/NSO Trident 0days – Emergency or Another Day of 0days?

Filed under: Cybersecurity,Government,Security — Patrick Durusau @ 10:31 am

For an emergency view of the Apple/NSO Trident 0days issues, you can read Apple tackles iPhone one-tap spyware flaws (BBC), Apple issues security update to prevent iPhone spyware (USATODAY), or IPhone Users Urged to Update Software After Security Flaws Are Found (NYT).

On the other hand, Robert Graham, @ErrataRob, says its just another day of 0days:

…
Press: it’s news to you, it’s not news to us

I’m seeing breathless news articles appear. I dread the next time that I talk to my mom that she’s going to ask about it (including “were you involved”). I suppose it is new to those outside the cybersec community, but for those of us insiders, it’s not particularly newsworthy. It’s just more government malware going after activists. It’s just one more set of 0days.

I point this out in case press wants to contact for some awesome sounding quote about how exciting/important this is. I’ll have the opposite quote.

Don’t panic: all patches fix 0days

We should pay attention to context: all patches (for iPhone, Windows, etc.) fix 0days that hackers can use to break into devices. Normally these 0days are discovered by the company itself or by outside researchers intending to fix (and not exploit) the problem. What’s different here is that where most 0days are just a theoretical danger, these 0days are an actual danger — currently being exploited by the NSO Group’s products. Thus, there’s maybe a bit more urgency in this patch compared to other patches.

Don’t panic: NSA/Chinese/Russians using secret 0days anyway

It’s almost certain the NSA, the Chinese, and the Russian have similar 0days. That means applying this patch makes you safe from the NSO Group (for a while, until they find new 0days), but it’s unlikely this patch makes you safe from the others.
… (Notes on the Apple/NSO Trident 0days)

Taking all communication systems as insecure, digital ones in particular, ErrataRob’s position has merit.

However, the consequences of a lapse of security for someone like Ahmed Mansoor, are far from trivial.

Consider this passage from the executive summary in The Million Dollar Dissident: NSO Group’s iPhone Zero-Days used against a UAE Human Rights Defender:

Ahmed Mansoor is an internationally recognized human rights defender, based in the United Arab Emirates (UAE), and recipient of the Martin Ennals Award (sometimes referred to as a “Nobel Prize for human rights”). On August 10 and 11, 2016, Mansoor received SMS text messages on his iPhone promising “new secrets” about detainees tortured in UAE jails if he clicked on an included link. Instead of clicking, Mansoor sent the messages to Citizen Lab researchers. We recognized the links as belonging to an exploit infrastructure connected to NSO Group, an Israel-based “cyber war” company that sells Pegasus, a government-exclusive “lawful intercept” spyware product. NSO Group is reportedly owned by an American venture capital firm, Francisco Partners Management.

The ensuing investigation, a collaboration between researchers from Citizen Lab and from Lookout Security, determined that the links led to a chain of zero-day exploits (“zero-days”) that would have remotely jailbroken Mansoor’s stock iPhone 6 and installed sophisticated spyware. We are calling this exploit chain Trident. Once infected, Mansoor’s phone would have become a digital spy in his pocket, capable of employing his iPhone’s camera and microphone to snoop on activity in the vicinity of the device, recording his WhatsApp and Viber calls, logging messages sent in mobile chat apps, and tracking his movements.

We are not aware of any previous instance of an iPhone remote jailbreak used in the wild as part of a targeted attack campaign, making this a rare find.
…

ErrataBob’s point that 0days are everywhere and all governments have them, doesn’t diminish the importance of the patch for iPhone users or provide a sense of direction for what’s next?

Here’s a 0day policy question:

Does disclosure of 0days to vendors disarm citizens while allowing governments to retain more esoteric 0days?

Governments are not going to dis-arm themselves of 0days so I see no reason for “responsible disclosure” to continue to disarm the average citizen.

Technical analysis of the NSO Trident 0days: The Million Dollar Dissident: NSO Group’s iPhone Zero-Days used against a UAE Human Rights Defender, and Technical Analysis of Pegasus Spyware.

Both of those reports will give you insight into this attack and hopefully spur ideas for analysis and attack.

BTW, the Apple software update.

August 25, 2016

Terrorism “Lite?”

Filed under: Government,Security — Patrick Durusau @ 3:54 pm

A cricket and worm attack caused delay and confusion on the D train, Wednesday evening in New York.

Not as much disruption as a suicide bomber but the reaction reported by Danielle Furfaro and Melkorka Licea in Straphangers go berserk after woman tosses bugs in subway car was quite impressive.

From the post:

…
A group of teenagers pushed her, prompting her to freak out and toss the box of pests into the air, said witnesses. Straphangers then started screaming and crying, and all ran down to one end of the car.

“It was pandemonium,” said Chris Calabrese, 29, who was on the train with his girlfriend. “It was the craziest thing I’ve ever seen on a train.”

Someone then pulled the emergency brake and the train skidded to a stop on the Manhattan Bridge.

The air conditioning shut off and the screaming passengers were all stuck inside the sweltering car with the woman, who then treated them to antics for half an hour as the crickets jumped on passengers. The worms just wriggled on the floor.
…

The story doesn’t say if DHS has been notified of this new attack vector.

You laugh.

What if instead of crickets and worms the woman had a suitcase full of “killer bees” or angry hornets?

Laughing now?

Developer Liability For Egregiously Poor Software

Filed under: Cybersecurity,NIST,Security — Patrick Durusau @ 3:37 pm

Earlier today, Cryptome tweeted:

cryptome-nist-460

I’m assuming that Cryptome added the highlighting to:

Software developers should be liable for egregiously poor software…

I don’t consider that suggestion to be, as Cryptome puts it:

NIST BS

Presently, there is no liability for software developers.

How’s that working out for you?

One indication of the “success” of the no liability model is Hackmageddon which relies on reported hacks and has hack timelines back to 2011.

A summary of the “success” of the no liability model is the Internet Security Threat Report, April 2016, by Symantec.

Both of those reviews rely on “reported” hacks, which omits those yet to be discovered (thinking NSA or Sony hacks).

By any reasonable measure of “success,” the no liability model is an absolute disaster.

We can debate how “egregious” software has to be for liability, but consider SQL injection attacks.

Here are five SQL injection “cheat sheets” and a listing of SQL injection scanners:

SQL Injection Cheat Sheet

MySQL SQL Injection Cheat Sheet

SQL Injection Prevention Cheat Sheet

Full SQL Injections Cheatsheet

SQL Injection Cheat Sheet & Tutorial: Vulnerabilities & How to Prevent SQL Injection Attacks

SQL Injection Scanner List

How difficult was that?

You have to be able to type “sql injection cheatsheet” and “sql injection scanner” into an internet search engine. (Rating: Easy)

Curious, is there a show of hands by developers who don’t think they can avoid SQL injection attacks?

FYI, if all developers avoided SQL injection attacks, it would kill the #1 cybersecurity hack on the top #10 list maintained by the Open Web Application Security Project.

We aren’t talking about obscure 0-day bugs that no one has ever seen. SQL injection was first noticed in 1998.

Liability for an 18 year old vulnerability isn’t too much to ask.

Yes?

PS: The NIST quote is from the Information Technology Laboratory Newsletter, September—October 2016, page 1.

August 23, 2016

[Free] Cyber Security Courses for Officials and Veterans [And Contractors, But Not Citizens]

Filed under: Cybersecurity,Security — Patrick Durusau @ 3:56 pm

Cryptome posted Cyber Security Courses for Officials and Veterans

When you visit the Federal Virtual Training Environment (FedVTE) homepage, the FAQ for Spring 2016 (PDF) advises:

Who can take FedVTE training?
FedVTE courses are offered at no cost to government personnel, including contractors, and to U.S. veterans.

…

Can the general public register on this site and take courses?
No, these courses are not available to the general public.

Cybersecurity is in the news on a daily basis, citizens being victimized right and left, yet the National Initiative for Cybersecurity Careers and Studies denies those same citizens the ability to develop the skills necessary to protect themselves.

While at the same time offering free training to government personnel and contractors, who operated the Office of Personnel Management like a sieve (21.5 million victims). Not to mention the NSA, which seems to have a recurrent case of USB-disease.

For reasons known only to the U.S. government, it lacks the ability or interest in protecting its citizens from repeated cyber-attacks.

The least it can do is open up the Federal Virtual Training Environment (FedVTE) to all citizens.

Or as Randy Newman almost said:

…if you won’t take care of us
Won’t you please, please let us do [it ourselves]?”

From “God’s Song (That’s Why I Love Mankind)”

Enough freebies for contractors at the federal teat. How about a benefit or two for ordinary citizens?

August 22, 2016

Marketing Vulnerabilities (The Shadow Brokers)

Filed under: Cybersecurity,Security — Patrick Durusau @ 3:41 pm

Auction File: Only Worth What Someone Is Willing To Pay (August 22)

Another update on the Shadow Brokers saga and following auction. For hackers who aren’t also MBA’s, some insight into auction markets for vulnerabilities.

From the post:

There are so many facets to the recent Shadow Brokers’ leak it can be a bit overwhelming. But the Shadow Brokers’ mess does highlight front and center the importance of the perceived value of exploits and vulnerabilities. It is impossible to ignore the value of the exploits when this whole situation is potentially about an auction of high-end vulnerabilities.

In each RBS blog update covering the leak, we have provided a quick update on the auction status, and the reality is that the auction itself isn’t going very well. The leaked data auction recently showed an increase to 1.74847373 BTC (about US$1017.47), jumping from 41 to 56 bids:
…

You may find all the marketing data gathered here useful but as far as this auction, I suspect this captures the reality of the situation:

…
If this auction really contains valuable 0-day exploits, then one would expect that this would be worth bidding on for sure. But the parameters of the auction are far from standard, and may be one of the many reasons that the auction isn’t proceeding quickly. Rather than a traditional auction where a losing bid means your bid is returned and you lose no money, any bid on this data is not refunded if you do not win. It is also important to note that many believe that this really isn’t about an auction at all, rather to make a statement.
…

There may be valuable 0-day exploits but it isn’t possible to value them sight unseen.

Noting that reassurances from someone who allegedly stole from the NSA, don’t fill me with a sense of confidence.

If there are 0-days the NSA concealed, that the Shadow Brokers reveal, that open up the banking industry like a gumball machine:

gumball-smash-460

do you know the name for the agent for service of process at the NSA?

😉

September 1, 2016 – Increase Tor’s Bandwidth

Filed under: Cybersecurity,Security,Tor — Patrick Durusau @ 12:26 pm

Reports of government surveillance and loss of privacy are so common it’s hard to sustain moral outrage over them.

Tor offers involvement to treat impotent moral outrage!

You can donate $$, bandwidth, or volunteer to help the Tor project!

Lose that moral outrage ED! Make a difference at the Tor project!

September 1, 2016 is important because of a call for a 24-hour boycott of Tor on that day.

The use of innocent Tor users as hostages speaks volumes about any boycott of Tor and its supporters.

August 18, 2016

Why “We” Get Hacked

Filed under: Cybersecurity,Security — Patrick Durusau @ 10:52 am

Whether these are “authentic” tweets or not, I cannot say. However, I thought the rather pinched definition of “we” needed to be pointed out.

snowden-nsa-hack-460

Say rather:

#NSA left catastrophic flaws in all networks for 3+ years to aid offense, rather than fixing them

If any of us are insecure, then all of us are insecure.

When it comes to cybersecurity, check your nationalism at the door, or we will all be insecure.

« Newer Posts — Older Posts »

Powered by WordPress