Open S3 Buckets: From Bad to Worse

cloud-147710_640.png

Just when you thought that the whole “globally readable Amazon S3 storage buckets” thing couldn’t get any worse, it did.

According to a study by a French cybersecurity firm which looked at 100,000 Amazon S3 buckets…

  • 90% of buckets are private, and therefore not at risk of leaking data or being corrupted by attackers. Of course, that means 10% of buckets are public…

    58% of those public Buckets (in other words, 5.8% of the total number of buckets tested) contained readable files, what might allow data leakage.

    20% of public Buckets (or, if you prefer, 2% of the total buckets) are not write-protected.

    Only a tiny 5% proportion of those public, write-enabled buckets (in other words, a mere 0.1% of the total) don’t contain any files.

This is pretty bad for the companies who own the 2% of buckets which are writeable – this could lead to data corruption, ransomware, etc.

The cloud is a great way to increase efficiency and integrate best of breed solutions into your business, but it requires that administrators be trained for the specific challenges of security in cloud computing.  The information is out there – for example, Amazon has a page chock full of security advice.

Businesses should consider getting their employees trained and certified in the ways of the cloud either via vendor neutral certifications or, if you have chosen your cloud platform, via vendor specific certifications like Amazon’s and Microsoft’s.

The people who are plunging in to the cloud and messing up are making it harder for the rest of us who see the cloud as the future to sell its security to management – let’s get our acts together people!

Open S3 Buckets: From Bad to Worse

The (not paranoid enough) Android

train-wreck-1935

The train wreck that is Android security continues…

A new strain of malware by security firm Wandera found in China has the following charming characteristics, according to a recent blog post.

 

Zero-day threat previously unknown within the mobile security community

Group of at least 50 functioning apps containing the sophisticated RedDrop malware

Apps are distributed from a complex network of 4,000+ domains registered to the same underground group

Once the app is opened, at least seven further APKs are silently downloaded, unlocking new malicious functionality

When the user interacts with the app, each interaction secretly triggers the sending of an SMS to a premium service, which is then instantly deleted before it can be detected

These additional APKs include spyware-like components, harvesting sensitive data, including passively recording the device’s audio, photos, contacts, files and more

RedDrop then exfiltrates this data, uploading it straight into remote file storage systems for use in extortion and blackmailing purposes

This is frightening stuff as it turns the victim’s phone into a bug, compromising phone calls made on the device as well as conversations in the vicinity.

As usual, the key problem here is that the app follows the rules and asks the user to approve a (long) list of permissions which are then used to compromise the device.  Many users don’t bother to read/think about these permission prompts, leading them to basically invite the malware authors to take over their device.

Security pros need to make their users aware of the need to read and think about security prompts EXTRA carefully on their Android devices.

The (not paranoid enough) Android

Beware of mobile number port out scams!

key-benefits-unlocking-mobile-device

I spend a lot of time telling people to use two factor authentication on their important web accounts.  This may explain why I don’t get invited to parties.

While using 2FA is a great idea, there is one issue which you (and your employees) should be aware of.

If your 2FA solution relies on text messages to deliver it’s one time passcodes, it may be vulnerable to “mobile number port out” scams.  This article from the always informative Brian Krebs explains the mechanics of this.

The solution?  If a site offers the choice between using text messages and an authenticator app, choose the app.  If you have to use text based authentication, make sure that your mobile phone account is protected from porting using a PIN or password.

 

Beware of mobile number port out scams!

The ultimate outsider threat?

LUdY8-1491939642-244-show-940x370_ALF
Not so fast there, Alf…

I know I have been blathering on about insider threats lately, so let’s go to the other extreme – the ultimate outsider threat.

A pair of researchers have given some thought to the possibility of aliens hacking us (us being Earth) via interstellar messages.

From their paper:

Our main argument is that a message from ETI cannot be decontaminated with certainty. For anything more complex than easily printable images or plain text, the technical risks are impossible to assess beforehand. We may only choose to destroy such a message, or take the risk. The risk for humanity may be small, but not zero. The probability of encountering malicious ETI first might be very low. Perhaps it is much more likely to receive a message from positive ETI. Also, the potential benefits from joining a galactic network might be considerable.

If the aliens have the ability to create Flash content, we are doomed.

The ultimate outsider threat?

Insiders on the outside

defending-against-insider-threat-landingPageImage-w-67Homeland Security Magazine has a very interesting case study on an insider threat case involving DirecTV.  In this case, the insider was a sort-of third order insider, as they worked for the document management contractor of DirecTV’s law firm.

A few lessons for us infosec professionals from this:

First:  The definition of insiders expands as businesses continue to outsource functions which used to be done in house.

Second: Vendor Risk Management programs need to pay special attention to law firms.  These guys are like companies’ confessors; we tell them all of our deepest secrets and rely on them to keep things secret.

Third:  Trust no one.

Insiders on the outside