Not all two factor authentication is created equal

2018-08-02 alberg214Leave a comment

And apparently, not all ambulances are created equal, either

Two factor authentication is an important security tool; by using 2FA, an attacker get ahold of your user name and password still can’t get into your accounts.

But not all two factor authentication is created equal.

Good two factor authentication uses an app on your phone or a hardware key to provide the secret codes needed to complete the login process.

Bad two factor authentication uses SMS (text) messages to send you the login code.

Why is this bad? Attackers have increasingly been using social engineering techniques to get mobile phone companies to switch victims’ phone numbers to phones which the attackers control. Once this is done, the attacker with a user name and password has everything they need to drain your bank account or read your email.

What you need to do to protect yourself:

Make sure that your mobile phone account is protected by a PIN code which must be given in order to port your phone number to a new phone. You can do this on your mobile carrier’s web site or by calling their customer service number.

Some services give you a choice as to whether to use an app on your phone or an SMS message to complete your login. Whenever you have this choice, choose the app.

If you are using services which provide SMS only 2FA, let them know that this is not acceptable in today’s security climate. Hearing a requirement from customers is the only way these companies will make the investment in the improved technology.

If you would like to read more about this scam and how to protect you and your loved ones, here is an article on the topic. And here is an example of a recently announced data breach at Reddit which was the result of this type of attack

While SMS based 2FA is better than no 2FA, it is time to stop using it wherever possible.

Open S3 Buckets: From Bad to Worse

2018-03-072018-03-01 alberg214Leave a comment

Just when you thought that the whole “globally readable Amazon S3 storage buckets” thing couldn’t get any worse, it did.

According to a study by a French cybersecurity firm which looked at 100,000 Amazon S3 buckets…

90% of buckets are private, and therefore not at risk of leaking data or being corrupted by attackers. Of course, that means 10% of buckets are public…

58% of those public Buckets (in other words, 5.8% of the total number of buckets tested) contained readable files, what might allow data leakage.

20% of public Buckets (or, if you prefer, 2% of the total buckets) are not write-protected.

Only a tiny 5% proportion of those public, write-enabled buckets (in other words, a mere 0.1% of the total) don’t contain any files.

This is pretty bad for the companies who own the 2% of buckets which are writeable – this could lead to data corruption, ransomware, etc.

The cloud is a great way to increase efficiency and integrate best of breed solutions into your business, but it requires that administrators be trained for the specific challenges of security in cloud computing. The information is out there – for example, Amazon has a page chock full of security advice.

Businesses should consider getting their employees trained and certified in the ways of the cloud either via vendor neutral certifications or, if you have chosen your cloud platform, via vendor specific certifications like Amazon’s and Microsoft’s.

The people who are plunging in to the cloud and messing up are making it harder for the rest of us who see the cloud as the future to sell its security to management – let’s get our acts together people!

The (not paranoid enough) Android

2018-03-062018-02-28 alberg214Leave a comment

The train wreck that is Android security continues…

A new strain of malware by security firm Wandera found in China has the following charming characteristics, according to a recent blog post.

Zero-day threat previously unknown within the mobile security community

Group of at least 50 functioning apps containing the sophisticated RedDrop malware

Apps are distributed from a complex network of 4,000+ domains registered to the same underground group

Once the app is opened, at least seven further APKs are silently downloaded, unlocking new malicious functionality

When the user interacts with the app, each interaction secretly triggers the sending of an SMS to a premium service, which is then instantly deleted before it can be detected

These additional APKs include spyware-like components, harvesting sensitive data, including passively recording the device’s audio, photos, contacts, files and more

RedDrop then exfiltrates this data, uploading it straight into remote file storage systems for use in extortion and blackmailing purposes

This is frightening stuff as it turns the victim’s phone into a bug, compromising phone calls made on the device as well as conversations in the vicinity.

As usual, the key problem here is that the app follows the rules and asks the user to approve a (long) list of permissions which are then used to compromise the device. Many users don’t bother to read/think about these permission prompts, leading them to basically invite the malware authors to take over their device.

Security pros need to make their users aware of the need to read and think about security prompts EXTRA carefully on their Android devices.

Beware of mobile number port out scams!

2018-03-052018-02-28 alberg214Leave a comment

I spend a lot of time telling people to use two factor authentication on their important web accounts. This may explain why I don’t get invited to parties.

While using 2FA is a great idea, there is one issue which you (and your employees) should be aware of.

If your 2FA solution relies on text messages to deliver it’s one time passcodes, it may be vulnerable to “mobile number port out” scams. This article from the always informative Brian Krebs explains the mechanics of this.

The solution? If a site offers the choice between using text messages and an authenticator app, choose the app. If you have to use text based authentication, make sure that your mobile phone account is protected from porting using a PIN or password.

Insiders on the outside

2018-03-012018-02-28 alberg214Leave a comment

Homeland Security Magazine has a very interesting case study on an insider threat case involving DirecTV. In this case, the insider was a sort-of third order insider, as they worked for the document management contractor of DirecTV’s law firm.

A few lessons for us infosec professionals from this:

First: The definition of insiders expands as businesses continue to outsource functions which used to be done in house.

Second: Vendor Risk Management programs need to pay special attention to law firms. These guys are like companies’ confessors; we tell them all of our deepest secrets and rely on them to keep things secret.

Third: Trust no one.

Jim Jeffries on US airport security

2018-02-222018-02-18 alberg214Leave a comment

The rest of the world tends to look askance at the way that we here in the US handle airport security. Many of the measures we take are pure “security theatre,” reacting to the last terrorist scheme (exploding shoes, bombs in underwear) that we happened to catch. Checking electronics seems to be a good idea, although the lithium ion batteries in non terrorist devices seem to be more likely to bring a plane down than a booby trapped phone or laptop. Even this, though, may be giving us a false sense of security as terrorists are working to better hide explosives in electronics.

Here’s a pretty funny take on all of this from Australian comedian Jim Jeffries. Warning: it is very sweary, so don’t watch if that kind of thing offends you.

Now, I’m not saying that we should do away with the TSA or many of the security checks it performs. One look at their Instagram account of things taken away from people at security checkpoints is enough proof of that.

This looks like something out of a Mad Max movie. It’s as if Mad Max wanted to paint the Thunderdome with the blood of his enemies. It’s a paint roller wrapped in sandpaper and wire with nails protruding. This was discovered earlier in 2017 in a carry-on bag at Chicago O’Hare (ORD), but I just acquired a picture of it today.

A post shared by TSA (@tsa) on Jan 9, 2018 at 2:16pm PST

What is needed is a more people focused type of security – looking for patterns in ticket purchases, travel, and behavior before and during travel to spot people with bad intentions rather than the specific weapons they use – they have all the time in the world to come up with new and better ways to evade the technical security measures, but like in information security, the real detection gold is to be found in human behavior.

Outsourced security program failure leads to $100K regulatory fine

2018-02-212018-02-18 alberg214Leave a comment

Another reminder of the importance of managing third party vendor relationships…

The Commodity Futures Trading Commission fined AMP Global Clearing (an electronic trading firm) $100,000 for a disclosure of 97,000 files containing customer information to an unauthorized third party due to a misconfigured network attached storage device.

AMP had outsourced parts of it information systems security program to a third party provider who had failed to detect the exposed data during three successive vulnerability audits of AMP’s systemes.

Outsourcing can be a really effective tool for augmenting a firm’s infosec program, but business leaders and CSOs need to remember that the ultimate responsibility for protection of corporate and customer data still remains with them. However, when the firm is a regulated entity, the risks of relying on an outsider to perform critical parts of the infosec program without adequate supervision outweigh the (admittedly attractive) cost savings.

Monitoring third party service provider performance is a hard problem. Most firms don’t have the resources to perform in person audits and most providers don’t have the ability to allow every customer to audit them. This is why external independent audits of third party providers’ security practices are so important. These audits need to be performed against generally accepted security standards with objective audit criteria. ISO27001 and SSAE18 SOC2 are two examples of such audit types.

Even if a business partner gets a clean bill of health from an independent auditor, their performance must be monitored by the line of business who engaged them as well as by the infosec department. Recently, I have been seeing more and more inquiries from my firm’s customers coming between their annual due diligence reviews of our services. Most of these inquiries occur when there is a “celebrity vulnerability” like Spectre/Meltdown – what I am hoping to see in the future are more questions confirming “security 101” procedures and practices.

The advent of security ratings firms like Security Scorecard and Bitsight can also be helpful in this area. While their security ratings cover specific aspects of a vendor’s security program (practices that can be seen from the Internet), they can provide an ongoing data point to be used to detect potential problems in between those annual security reviews. I believe that this industry is in its early stages and that the results that they provide must be examined carefully against the specific requirements of your security program.

As companies outsource infrastructure, applications and services to third parties in order to concentrate on their core competencies, the importance of third party vendor management is going to continue to grow.

Leaky buckets and acquisition best practices

2018-02-192018-02-18 alberg214Leave a comment

There are three interesting things for CSOs to think about in this story on a leak of passport and other personal information on tens of thousands of people:

If you are going to use Infrastructure as a Service providers like Amazon, make sure that the people using them take the time to learn about and use the security features. Amazon provides the means to store data securely and has a wealth of documentation on security best practices. Having a breach due to an improperly configured S3 bucket is amateur hour, folks.
When acquiring new companies, especially small ones, security due diligence needs to be job one. Finding out where sensitive information is stored and how it is protected is a must.
Know your third parties (and those of your acquisitions) – FedEx blamed the breach on an un-named third party. Remember – you can outsource the function, but you cannot outsource responsibility for security. When doing an acquisition, look at the list of every vendor that the target company pays and figure out which ones might be holding data.

I have been through the acquisition process a few times in the past ten years – identifying show stopper issues during due diligence is important, but it is vital to keep the process going after the deal is done. The more you dig into the security of the acquired firm, the more “interesting” security issues you will find.

Malicious data leaks and corporate liability – a tale of two countries

2018-02-18 alberg214Leave a comment

Databreaches.net had a link to a very interesting article about corporate liability for an employee’s malicious leaking of employee information. What was most striking to me was the contrast between cases in the UK and the US.

In the UK, a disgruntled employee leaked payroll data for 100,000 employees of a very large supermarket chain to newspapers in order to embarrass the firm after they were disciplined for bad behavior. The courts found that employees have the right to sue the supermarket chain for damages as they were “vicariously responsible” for the acts of their employee.

In contrast, a similar case in the US against Coca Cola had a very different outcome. A Coca Cola employee sold laptops which they were tasked with destroying and these laptops contained personal information of employees. Employees sued, but the courts dismissed all of their claims, saying that Coca Cola could not have known about the rogue employee’s activities.

This case has a few lessons for infosec professionals:

First, if your firm operates in multiple jurisdictions, the laws and norms in these jurisdictions can be very different. When judging risk and formulating policy, work with your legal departments to make sure you understand these differences.

Second, I feel that this case also shows the differences in attitudes to personal information in the US and the rest of the world. It seems like the US does not value individual privacy nearly as much as other countries. Again, if you operate in multiple jurisdictions, you need to keep this in mind.

As the stakes get higher for organizations (for example $20M or 4% of global revenues for each breach of the EU GDPR), these are things we need to worry about. Buy your general counsel a beer and talk it out before you have to deal with a lawsuit.