STE WILLIAMS

Timehop, the company that specializes in “digital nostalgia,” is releasing more information on the July 4 breach that compromised millions of users’ personally identifiable information (PII). New details include the timeline of the attack, the information affected, and the steps the company has taken to remediate the issue and prevent its recurrence.

When Timehop first announced the breach, it revealed that the names and email addresses belonging to some 21 million users were illegally accessed, along with phone numbers belonging to about 22%, or 4.7 million of them. Now Timehop has released the total numbers of accounts that provided some combination of name, email address, date of birth, phone number, and gender designation to the attacker or attackers.

The company has also provided details of the authentication issue that led to the breach: It says that the account used to access the data did not have two-factor authentication enabled. Timehop now says it has required multifactor authentication on all such accounts.

Timehop has provided great transparency into the attack, its effects, and the steps being taken in its aftermath. While all customers will have to reauthenticate the service to their social media accounts (a result of authentication tokens being compromised), customers are also encouraged to learn about what happened to understand how they might be affected.

Read more here.

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/timehop-releases-new-details-about-july-4-breach/d/d-id/1332285?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

“The enemy is in the wire.” During the Vietnam War, this call would ring out to alert everyone that the enemy was in the perimeter of fortifications. In our cyber world, we’ve known this for years; however, the call rang frighteningly true in May of this year.

This particular enemy was first discovered in August 2017, as a new piece of malware, now known as Trisis. A Middle Eastern oil and gas company found the malware when its industrial equipment started shutting down. 

This company, which to date has not been named, called Saudi Aramco to help investigate software found on some of its computer systems. Together with experts from Mandiant, they discovered a new cyber weapon with echoes of Stuxnet, which was used to attack and disable Iran’s uranium enrichment plant by making centrifuges spin at self-destructive speeds.

This new cyber weapon, however, was not designed to directly destroy a piece of equipment. It was designed to degrade what is known as a safety instrumented system, commonly used to monitor systems in nuclear power plants and oil and gas refineries. If Trisis had worked, the equipment would have gone past redline, creating catastrophic damage and potential loss of life. However, the creators of Trisis made a mistake, and the safety systems worked to shut down the equipment.

Now fast forward to May 2018. Researchers at startup Dragos announce that Trisis has been modified, infecting other safety instrumented systems. The shocking part is that this version of Trisis wasn’t found in Middle East industrial systems, but in industrial systems inside the United States. The enemy is now truly in the wire.

What would happen if an industrial control system (ICS) were attacked and destroyed? We don’t have to speculate. In December 2015, the Ukrainian power grid was disabled by malware called Crash Override. The Ukrainian grid was compromised by a phishing attack that originated in the IT system and jumped into the operational technology (OT) system. Researchers believe it was part of the Russian campaign to annex the Crimean Peninsula. That’s a real-world example. But long-term outages will lead to consequences that the civilian population of a modernized country can’t handle well, according to the Defense Science Board Task Force on Resilient Military Systems and the Advanced Cyber Threat report.

Taking out the grid would be painful, but the grid can be brought back online. To really cripple large parts of the US, enemies could target our massive electricity-producing generators, which are made in China and India. Electric companies don’t keep spares on hand, and it can take a year to build one. In World War II, we started bombing the factories instead of going after the finished planes on runways. If you take out the means of production, the rest goes downhill rapidly. If the generators are destroyed by compromising safety instrumented systems, it would indeed go badly for the population.

For example, in the many months it would take to get replacements from China or India, food and medicine distribution systems would become ineffective. Grocery stores typically only keep enough food on hand for three days. Without power, air conditioning and heat will not work, which can be deadly to the young and elderly. Traffic systems would be disabled, causing gridlock and preventing needed supplies and help from reaching those in need. Law enforcement and emergency personnel capabilities would be barely functional in the short term and become dysfunctional over sustained periods. Our military would have to be diverted to help the homeland civilian population. If timed right, a nation-state would be able to take advantage of allies that depend on US military support for their defense. The end results are truly dire. 

Because of this scenario, the US government is taking strategic steps to help counter the threats to the nation’s critical infrastructure. The Department of Homeland Security has a program called the Apex Next Generation Cyber Infrastructure, which according to its website, “addresses the challenges facing our nation’s critical infrastructure sectors, enabling infrastructure to operate effectively, even in the face of sophisticated, targeted cyberattacks.” Similarly, the Department of Energy (DOE) in March 2018 released its Multiyear Plan for Energy Sector Cybersecurity, detailing its own cyber strategies. Both are long-term efforts; the DOE plans will be fully in place in four years. 

Meanwhile, there are near-term things that can be done to improve the security of industrial systems:

• A full accounting of what is on OT and IT systems should be done first, to identify what is present, how the identified systems are configured, and how they can pass data throughout the network.
• Then organizations can identify ICS and network devices that should be decommissioned and replaced with new and more secure devices.
• Next, organizations should implement network segmentation, where possible.

Obviously, this is not foolproof, but it does add more complexity that attackers must overcome in order to compromise an ICS. More time could lead to them being caught before they can compromise anything. 

This is intensive work, but it is work that must be done in order to determine what is most at risk. Companies can and should take steps to make their OT and IT systems resilient. What is a resilient system from a cybersecurity perspective? It is a system that is hard to hit, can detect incidents immediately, and can respond rapidly. The foundation for resilience is first knowing your environment completely.

Related Content:

• 8 Ways Hackers Can Game Air Gap Protections
• Anatomy of an Attack on the Industrial IoT
• Industrial Safety Systems in the Bullseye
• Schneider Electric: TRITON/TRISIS Attack Used 0-Day Flaw in its Safety Controller System, and a RAT

Learn from the industry’s most knowledgeable CISOs and IT security experts in a setting that is conducive to interaction and conversation. Register before July 27 and save $700! Click for more info. 

Wayne Lloyd has over 25 years of field experience in information technology, with the last 15 years directly focusing in cybersecurity, including computer and network security, advanced threat analysis, intrusion detection and operations, vulnerability risk assessment, and … View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/ics-security-the-enemy-is-in-the-wire/a/d-id/1332247?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

The plague that is Spectre continues to evolve and adapt, showing up in two new variants this week dubbed Spectre 1.1 and Spectre 1.2 that follow the original Spectre’s playbook while expanding on the ways they can do damage.

Researchers Vladimir Kiriansky of MIT and Carl Waldspurger of Carl Waldspurger Consulting discovered the new variants of the vulnerabilities in Intel microprocessors. The pair earned a $100,000 bug bounty from Intel for their responsible reporting of the new exploits, which was paid through HackerOne.

It’s no surprise there are new variants on Spectre: Because of the fundamental nature of the flaw, it has been assumed that there will be a long stream of variations on the theme. The only good news on the new discoveries, says Eric Maurice, director of security assurance at Oracle in a blog post: “Fortunately, the conditions of exploitation for these issues remain similar: malicious exploitation requires the attackers to first obtain the privileges required to install and execute malicious code against the targeted systems.”

Spectre 1.1

In the paper announcing the variants, Kiriansky and Waldspurger write that Spectre 1.1, “…leverages speculative stores to create speculative buffer over- flows.” Unlike many of the Spectre variants that allow for threat actors to read protected memory, this buffer overflow presents the opportunity for arbitrary code execution on the affected system.

There are limits on the code execution, and the general concern is that attackers will be able to execute code that extracts data from secure memory, giving an attacker access to passwords, crypto keys, and other user authentication or data protection information.

Interestingly, the authors point out that defenses against Spectre 1.0 that use a brute-force and relatively inefficient method (a speculation barrier or lfence) would be effective against Spectre 1.1, while more efficient defenses would not.

Spectre 1.2

The second variant allows an attacker to bypass the Read/Write PTE flags if the enforcement on those flags is lax. The outcome of an exploit of this variant could ultimately allow malware to get out of a sandbox established for system security.

In many ways, Spectre 1.2 is related to Spectre 3, which is generally called Meltdown. Unfortunately, the hardware mitigations that are effective against Meltdown are not effective against Spectre 1.2.

At this time, companies including Microsoft and Red Hat say that they’re looking into the new exploits to determine whether or not their products are affected. The researchers presented confirmation that both variants are effective against Intel and ARM processors.

Kiriansky and Waldspurger suggest hardware mitigations in their paper; none of the mitigations are steps that either software developers or end user organizations can take. As with the rest of the Spectre family, full mitigation is going to have to wait for a new generation of re-architected processors to emerge from vendors such as Intel and AMD.

A browser fix for a different Spectre

While the new variants were being announced, Google released a new version of the Chrome browser that mitigates some of the avenues for exploiting side-channel vulnerabilities. The Google mitigation implements what the company calls site isolation, preventing JavaScript code loaded from one website from executing on the edge device and accessing data associated with another site.

The new Chrome browser is available for Windows, Mac, Linux, and Chrome OS and makes site isolation, which had been experimental and optional, the default setting for all browsers.

Related Content:

• Side-Channel Attacks the Importance of Hardware-Based Security
• New Spectre Variants Add to Vulnerability Worries 
• 9 of the Biggest Bug Bounty Programs
• Spectre Returns with 8 New Variants

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/newly-found-spectre-variants-bring-new-concerns/d/d-id/1332280?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Sensitive US military documents, including training materials for the MQ-9A Reaper drone and an operations manual for the M1 Abrams tank, were recently available for sale on the Dark Web.

A single hacker with apparently moderate technical skills accessed one set of the leaked documents from the computer of a captain at 432d Aircraft Maintenance Squadron Reaper AMU OIC, at the Creech AFB in Nevada, says intelligence firm Recorded Future. The data that was stolen included Reaper maintenance books and the list of airmen assigned to the military drone program at the base.

The source of the other document — pertaining to the M1 Abrams tank — is not clear. But it appears to be part of a larger set of military documents that the same hacker obtained from a separate computer belonging to a US Army official.  The second dataset included information on a training course for a tank platoon, documentation on mitigation tactics for an improvised explosive device, and a crew survival course. The documents, while not classified, contained sensitive, export-controlled data, according to Recorded Future in a report detailing its findings.

In both instances of data theft, the threat actor exploited a previously known issue with Netgear routers that allows remote attackers to access data on storage devices connected to the router if the default FTP authentication credentials are not updated. Recorded Future says its research shows more than 4,000 routers worldwide continued to be exposed to the issue — more than 1,430 of them in the US.

Researchers from Insikt Group, Recorded Future’s threat intelligence team, established contact with the threat actor after coming across advertisements for the stolen data in underground forums in early June.  The individual — a newly registered, English-speaking member of a hacking forum — claimed he had used the Shodan search engine to search for and find Netgear routers that use a standard port 21 from which he could steal data.

“According to the actor, the data was stolen from two separate computers, and it was released within a week of each other,” says Andrei Barysevich, director of advanced collection at Recorded Future. “In the case of the US Army captain, the hacker had access for a somewhat prolonged period. He lost access to the second computer within a day.”

On days when the actor was not looking for victims, he watched live video footage from border surveillance cameras, airplanes, and a M1-1 Predator drone over Choctawhatchee Bay in the Gulf of Mexico, Recorded Future says. He used the same Shodan engine to search for unprotected Full Motion Video (FMV) streams as he did to find the vulnerable Netgear routers.

But unlike the case with the stolen data, the hacker shared access to the full-motion video streams for free, Barysevich says. “Not only was the actor able to access surveillance footage from drones but also from southern border checkpoints,” he says. “Access to such streams could be invaluable for drug cartels and human traffickers.”

The full ramifications of the data breaches are still unclear. But the fact that a hacker with average skills was able to identify military computers and steal sensitive information from them in a week’s time is concerning, Recorded Future says. “[It] is a disturbing preview of what a more determined and organized group with superior technical and financial resources could achieve,” the vendor said.

That the threat actor exploited a 2-year-old vulnerability in Netgear routers suggests the sensitive military data was stored on a system connected to an unpatched or unmanaged wireless access point, says Sherban Naum, senior vice president of corporate strategy and technology at Bromium.

For the military, the question now is whether the documents were on a personal device or a government-issued computer. If the data was stored on a personal device, the question would be why the data was there in the first place. If the data was accessed from a government-issued computer, the question would be why it was connected to an unprotected network, Naum says.

Related Content:

• FBI Warns Users to Reboot All SOHO Routers
• Dozens of Vulnerabilities Discovered in DoD’s Enterprise Travel System
• DOD Looks to the Cloud for Browser Security
• 5 Tips for Protecting SOHO Routers Against the VPNFilter Malware

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/hacker-exploits-2-year-old-router-issue-to-steal-sensitive-us-military-data/d/d-id/1332281?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

How enthusiastic would you be to ride on a spacecraft if you knew that the scientists and engineers who designed it and planned the mission couldn’t agree on the definition of mass, weight, and velocity?

A quick look at the word “risk” in Wikipedia provides a clue regarding the variety of definitions that exist for a foundational term in our profession. But inconsistent formal definitions are really just the tip of the iceberg. For example, I like to ask audiences, “Which of these are risks?”:

• Vulnerabilities
• Disgruntled employees
• Reputation
• Untested recovery plans
• Sensitive consumer information
• Weak passwords
• Cybercriminals

Almost without exception, the answer I hear is “All of them!” The truth, however, is that none of them are risks. Vulnerabilities are not risks and we need to stop acting like they are. Disgruntled employees and cybercriminals are threat communities; reputation and sensitive consumer information are assets; and weak passwords and an untested recovery plan are (deficient) controls. In other words, although these are all parts of the risk landscape, they are importantly different from one another.

Furthermore, when I asked an audience of seasoned infosec professionals to list the top three risks their organizations faced, the following word cloud resulted:

I find “unknown” to be particularly ironic.

Why does it matter? Can’t we usually glean the meaning of a term through the context in which it’s being used? Although that’s often true in conversation with colleagues in our profession, clarity is crucial when we’re speaking with people outside of our profession — such as executives — and when we’re trying to measure something. I’ll touch on measurement in a minute. For now, let’s focus on communication.

As a profession, we’ve been saying for a long time that we need to speak the language of business in order to get and maintain the support we need to be effective. That being the case, it’s only logical that our use of the word “risk” be driven by how executives think about it.

What senior executives and boards want from us is to help their organizations manage the frequency and magnitude of infosec-related loss events. These loss events are the “risks” we’re supposed to manage. This is aligned with the rest of their risk world, and it also enables far more effective measurement and communication. A couple of example infosec risks are:

• Cybercriminal compromise of consumer personal data
• Disgruntled employee crashing a system that supports a critical business process

The same executive stakeholders whose eyes glaze over when we talk about vulnerabilities and threat vectors suddenly take interest when the risks we talk about are loss events. These risks also provide the context in which we can measure and express the significance of problems in the risk landscape like changes in threat vectors or the vulnerabilities we’re trying to resolve.

Imagine, for example, being able to explain to an executive how a change in threat activity increases the likelihood of the compromise of personally identifiable information by somewhere between 20% and 30%, with a resulting increase in loss exposure of between $500,000 and $1 million. No executive in the world is going to have difficulty wrapping their mind around that.

Of course, that raises the question, “Can we measure infosec risk?” The short answer, despite what you may have heard or believe, is yes. In fact, we do it all the time.

Measurement is a prerequisite to prioritization, and you and I both know that we prioritize all the time. Unfortunately, given the inconsistency and ambiguity with which we approach infosec risk, we’re horrible at it. Here’s some bad news: 70% to 90% of the “high risks” I’ve examined in organizations over the past several years do not, in fact, represent high risk. This means that those organizations have a significant signal-to-noise problem and aren’t able to focus on the things that matter most. And if you think about it, the inability to prioritize effectively is a gift to the bad actors (as if they didn’t already have enough advantages) and a failure on our part as stewards of the resources we’re given.

The good news is that measuring infosec risk is not that hard once you’ve gotten your terms straight and when you leverage well-established methods and principles from other risk disciplines. Good sources of information on this include:

• How to Measure Anything in Cybersecurity Risk by Douglas W. Hubbard and Richard Seiersen
• Measuring and Managing Information Risk: A FAIR Approach by Jack Jones and Jack Freund

Every discipline we think of as mature today — math, medicine, physics, etc. — all went through an early phase in which nobody could agree on fundamental terms or principles. In that sense, we’re in good company. But given today’s imperatives surrounding cyber and technology risk management, we do not have the luxury of decades to get our act together.

Related Content:

• Insider Threats: Red Flags and Best Practices
• Secure by Default Is Not What You Think
• White House Email Security Faux Pas?
• Insider Dangers Are Hiding in Collaboration Tools

Learn from the industry’s most knowledgeable CISOs and IT security experts in a setting that is conducive to interaction and conversation. Register before July 27 and save $700! Click for more info. 

Jack Jones is one of the foremost authorities in the field of information risk management. As the Chairman of the FAIR Institute and Executive VP of Research and Development for RiskLens, he continues to lead the way in developing effective and pragmatic ways to manage and … View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/what-we-talk-about-when-we-talk-about-risk/a/d-id/1332192?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple