STE WILLIAMS

Chief information security officers from Dell, RCB Bank and other organizations share what it takes to become a security exec, sit in the C-Suite, and keep the job.

Reports peg the average lifespan of a chief information security officer at just 18 months. Yet a number of Infosec professionals still aspire to be a CISO, and those who have made the grade want more – a seat at the executive table. What follows is sage advice from CISOs who have been there and done that, based on interviews and panel sessions at this week’s at ISC(2) Security Congress in Austin, Texas.

Bits Twiddler or People Person?

One of the first steps in assessing whether a CISO path makes sense is a deep self-analysis, Gordon Rudd, RCB Bank’s CISO, told Dark Reading in an interview at the ISC(2) Congress. “You need a certain personality to be a CISO,” Rudd said. “Do you want to be a bits twiddler, or do you want to be interacting with people? As a CISO, you have to interact with people.”

Additionally, the role not only calls for leading a security team but also working with executives and, potentially, the board of directors to secure their buy-in on security proposals, budget, and other issues, according to Rudd.

Once a decision is made to pursue a CISO path, the next step is finding the right company to join. Rudd divided the landscape into green companies, which are relatively young and growing with little legacy technology, and brown companies that are more mature with a relatively large base of legacy software and hardware. He noted brown companies tend to face greater security challenges, given the technology is older and may no longer be supported with security updates.

Newly minted CISOs should also be prepared to network with other CISOs and CIOs.

“I like to hang out with people who are smarter than me and who I can learn something from,” Rudd said, adding that newbie CISOs should also dress for success: “You need to dress like your boss’ boss,” Rudd advised. “As a company matures, you want to look more Madison Avenue than surfer dude.”

Think like a Business Leader 

CISOs and CEOs often have different backgrounds when it comes to education and career paths, but they are on the same team and have a shared mission: to do what is best for the organization. To be an effective CISO and a greater asset to the CEO, security chiefs need to modify their thinking. 

“It’s a challenge to step outside of the day-to-day of being operational and technical, and to transform yourself to think through the lens of a business leader,” John Scimone, Dell’s CISO, told Dark Reading during an interview at ISC(2).

This lens should takes into account the financials of the businesses that support and overlay areas of the company that face the greatest risk of attack, and also the development of a framework for where the primary concern should lay. “The risk lens can be very different than the revenue lens,” Scimone says. “The area that may generate the smallest revenue may also have the greatest risk.”

MA: the Ticket to the Table

CISOs should be talking to their CEO, general counsel and chief financial officer about the value they bring to the mergers and acquisition process, advised Scimone and Amjed Saffarini, CyberVista CEO, during a panel at the ISC(2)’s convention.

A CISO, for example, can perform security due diligence on a target company during the general due diligence process, and the results should be pointed out to the C-suite, Scimone suggested.  If, for example, the CISO’s security team finds massive vulnerabilities in the target company’s technology, or the target company had a recent breach, the finding could potentially lower the buyout price, which in turn would make the CISO “joined at the hip” with the CEO going forward. In Verizon Communications’ acquisition of Yahoo, the Internet pioneer’s massive breach ultimately resulted in a $350 million reduction in the buyout price to $4.48 billion, according to an announcement by the companies.

“The MA conversation should happen early in the process, so the company does not overpay,” said Saffarini.

Talk the Talk, Walk the Walk

When it comes to communication styles, there is sometimes a disconnect between the way a CISO and C-Suite exec talk. Explained Rudd: “Management wants a simple answer to a question versus a long answer. But since we have come up from the technology ranks, it’s likely we give long answers [making] the CEO look like a deer in headlights.”

CISOs should explain “why” certain actions should be taken before they delve into the “what” and “how” of a situation, advised Mark Adams, Optiv Security’s executive director of consulting services, who spoke on an ISC(2) panel.

Michael Eisenberg, Optiv Security’s vice president of executive consulting, added that it is important to talk to the C-suite about the outcomes of security actions, rather than the technical solutions to be used.

CISOs also need to have the courage to shine a bright light on issues that others are willing to sweep under the rug. If a network operator is not willing to deploy a security patch for fear it will either break the system or require the system to be taken offline, Rudd said CISOs should be prepared to move the issue up the chain of command. Bottom line, according to Rudd: “CISOs have to have the courage to say that our systems aren’t any good.” 

Related Content:

• How To Become A CISO, Part 1
• Dark Reading Radio: A New Job Description For the CISO
• How To Become a CISO: Top Tips

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Dawn Kawamoto is an Associate Editor for Dark Reading, where she covers cybersecurity news and trends. She is an award-winning journalist who has written and edited technology, management, leadership, career, finance, and innovation stories for such publications as CNET’s … View Full Bio

Article source: https://www.darkreading.com/risk/cisos-offer-soup-to-nuts-c-suite-strategy-/d/d-id/1330013?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

A ransomware assault late last month is continuing to affect the operations of Copeland Borough Council in the northwest of England.

The processing of planning applications is still being affected weeks after a major cyberattack hit the council in rural North West England. The planning application for a housing development of around eight homes in the Cleator Moor area has been held up, according to local reports.

The borough council (CBC) was one of a number of councils to be affected by a cyber ransom attack last month. Problems remain ongoing and it’s not clear when they will be resolved.

“Copeland Council has been unable to process planning applications and land searches during the period since the attack,” according to local paper the Carlisle News and Star.

A spokeswoman for the borough council confirmed over the phone that it had been hit by ransomware. She didn’t know the strain of file-encrypting nasty causing the problem. The particular systems affected was a confidential matter that she wasn’t able to disclose, The Register was told.

A statement on the front page of Copeland’s website confirms a problem. Residents were told to be wary of phishing schemes posing as invoices and the like from the council.

We are victims of a major cyberattack, this is currently affecting our systems and our priority is to ensure that our frontline services are operating as far as practicable, and that our most vulnerable residents are supported.

A lengthy statement forwarded to El Reg said it had turned off its network while it rebuilt systems. It confirmed local reports that it was currently “unable to process planning applications and land searches.” The council added that it had been a victim of a “malicious and random professional attack.”

The payment of benefits and waste collection are operating as normal since the technology behind delivering these services is run through off-site servers.

Numerous back office systems have still not been restored at the borough council, according to a tipster who approached El Reg about the disaster.

Our source said that Allerdale and Carlisle councils had a shared service arrangement with Copeland council and might therefore be affected. A representative of Allerdale council in west Cumbria, however, said it had not been affected by the cyberattack at any point. Carlisle city council could not be reached by phone on Thursday afternoon.

Ransomware infections at UK local authorities have happened before. Lincolnshire County Council and North Dorset District Council were both hit last year, for example.

Councils would seem to be a poor target for profit-hungry thieves, however, since most are perennially cash strapped – or so they’d have central government believe. These councils are tasked with providing a wide variety of local services, ranging from housing, refuse collection and social services to policing and education. They are funded by a mixture of local taxes and central (ie, Westminster) government grants. ®

Sponsored:
The Joy and Pain of Buying IT – Have Your Say

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/09/29/english_council_ransomware_calamity/

Reality Winner smuggled a top-secret NSA dossier out of her office at a US government IT contractor by hiding it in her pantyhose, she told special agents.

That’s according to a transcript, released this week, of her interview with investigators who showed up at her house in Georgia, USA, to grill her. If you’ve ever wondered what it must be like being interrogated and coaxed by Uncle Sam’s g-men, wonder no more: it’s all laid out in this court filing, revealing the special agents’ interviewing techniques.

Winner, 25, is accused of printing off NSA files that claim Russian spies hacked at least one maker of voting software used in 2016’s US elections, and then mailed that classified material to journalists, who then published a story using that leaked information. Only a handful of people printed off that document, and Winner became a prime suspect in a subsequent investigation.

She was nabbed by the Feds in June, admitted during questioning at her home that she leaked the files, and was charged with espionage. She pleaded not guilty in a federal court, and on Friday this week hopes to persuade a judge to let her out on bail while awaiting trial.

Cuffed: Govt contractor ‘used work PC to leak’ evidence of Russia’s US election hacking

READ MORE

“Folded in half in my pantyhose,” Winner told Special Agents Justin Garrick and R. Wallace Taylor when asked during her interrogation how she got the documents out of her office at Pluribus International and into the hands of journalists.

The transcript, totaling out at 81 pages, sheds a light not only on Winner’s own motivations for leaking the documents, but also on the tactics the Feds used to get the contractor to admit to the leak. At first, Winner played dumb but then, by page 54, the noose starts to tighten and the agents explain how they narrowed down their search to her. By page 58, she sings like a canary.

“I think what we both think is that maybe you made a mistake,” Garrick said, according to the transcript.

“Maybe you weren’t thinking for a minute. Maybe you got angry, like he said. I mean, that what I’m hoping. If that’s – that’s the case, then that makes us feel a little better knowing that we don’t have a real serious problem here.”

In the interview, Winner recalled how she obtained the document and printed out a copy to send to reporters. “I wanted to read it and I just – I – the way I downloaded it, it just was hard for me to read and I wanted to just look at it because – it looked like a piece of history,” Winner said.

Later in the grilling, Winner denied being a whistleblower but said she believed the public should see the files. Being subjected to Fox News at work all day drove her over the edge, too, it seems.

Mug shot … Winner in custody

“I wasn’t trying to be a Snowden or anything … I guess it’s just been hard at work because. And I’ve filed formal complaints about them having Fox news on, you know?” Winner said. “Just at least, for God’s sake, put Al Jazeera on, or a slideshow with people’s pets. I’ve tried everything to get that changed.”

For what it’s worth, the agents interviewing Winner shared that sentiment. “That would probably be a good thing,” mused Taylor. “Unfortunately, it doesn’t matter [what] side you’re watching, I think they’re all pretty bad.”

“I guess I just didn’t care about myself … I screwed up royally,” Winner sighed at one point, and agreed leaking the file would likely reveal the NSA’s sources and techniques to its enemies.

“I figured that – that it didn’t matter anyway. Umm, honestly, uh, I just figured that whatever we were using had already been compromised, and that this report was just going to be like a — one drop in the bucket,” she said.

“Seeing that [information] that had been contested back and forth in the public domain for so long, trying to figure out, like, with everything else that keeps getting released and keeps getting leaked — why isn’t this getting — why isn’t this out there? Why can’t this be public?”

Winner faces about a decade behind bars if convicted. Her trial is scheduled to start in March next year. ®

Sponsored:
The Joy and Pain of Buying IT – Have Your Say

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/09/28/pantyhosed_reality_winner_snuck_docs_out_in_her_skivvies/

A multi-year effort to update the internet’s overall security has been put on hold just days before it was due to be introduced, over fears that as many as 60 million people could be forced offline.

DNS overseer ICANN announced on Thursday it had postponed the rollout of a new root zone “key signing key” (KSK) used to secure the internet’s foundational servers after it received fresh information that indicated its deployment would be more problematic than expected.

The KSK acts as an anchor for the global internet: it builds a chain of trust from the root zone down through the whole domain name system so that DNS resolvers – software that turns addresses like theregister.com into network addresses like 159.100.131.165 – can verify they’re getting good valid results to their queries.

Internet engineers knew that introducing a longer and hence more secure public-private key pair would cause some old and poorly configured systems to throw out errors, and so have embarked on a slow rollout that started back in May 2016.

In recent weeks, ICANN representatives have been attending conferences to warn ISPs and other internet infrastructure companies about the change and set up an online test for people to check if their systems will work. The change was due to take place on October 11, and just last week ICANN was confident that any problems would be minimal.

However, analysis of data provided by dot-com operator Verisign, via DNS protocol RFC 8145, and then confirmed by ICANN revealed a roadblock on the information superhighway.

Valid concerns

More than half of the internet’s critical root servers have been reporting that a large number of validators on the internet – between five and eight per cent – report only having the 2010 version of the KSK key in their systems, as opposed to reporting both the 2010 version and the new 2017 version. This data also only comes from machines running the most recent versions of DNS software BIND, so the real problem may be even larger.

What this means is that when the internet is “rolled over” to the 2017 version, the validators without that key will not resolve domain names correctly, and people relying on those systems will find themselves effectively kicked off the ‘net, unable to connect to websites and other online services.

How many people? ICANN estimates that the rollover will impact one quarter of all internet users – so roughly 750 million people. And taking the high-end data reports of eight percent failures, that means the rollover could risk effectively kicking no fewer than 60 million people off the internet in a single day.

Unsurprisingly, ICANN has decided that was not a great plan and so has postponed the rollout until the first quarter of next year at the earliest.

“The security, stability and resiliency of the domain name system is our core mission,” said ICANN CEO Göran Marby in a statement, adding:

We would rather proceed cautiously and reasonably, than continue with the roll on the announced date of 11 October. It would be irresponsible to proceed with the roll after we have identified these new issues that could adversely affect its success and could adversely affect the ability of a significant number of end users.

What does ICANN propose to do about the problem? Name and shame.

The organization is planning to publish a full list of resolvers that listed having only the 2010 KSK key, and then ask the internet community to help identify where they are and figure out what the problem is, and how to update them.

There are a number of reasons why systems may not be ready to accept the new KSK key:

• An old configuration with the 2010 key written into the code itself.
• A failure to implement the RFC 5011 protocol that will automatically update the key.
• Flaws or conflicts in software that prevent the automatic rollover from happening, or accepting the change when it does happen.

No matter what the reason, it is an indication of how incredibly difficult it is to update the internet on a network-wide basis. Just look at IPv6. ®

Sponsored:
The Joy and Pain of Buying IT – Have Your Say

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/09/28/internet_update_on_hold/

We are pleased to announce More Briefings selected for presentation at Black Hat Europe 2017!

As our Black Hat Europe Review Board continues review a record number of submissions, we are releasing new selections in batches. Below are the most recently announced Briefings, with links to their abstracts.

For a complete list of ALL Briefings selected to date, and to search by specific tracks, click here.

Attacks Against GSMA’s M2M Remote Provisioning
by Maxime Meyer
    
Automatic Discovery of Evasion Vulnerabilities Using Targeted Protocol Fuzzing
by Olli-Pekka Niemi and Antti Levomäki

BlueBorne – A New Class of Airborne Attacks that can Remotely Compromise Any Linux/IoT Device
by Ben Seri and Gregory Vishnepolsky
    
Enraptured Minds Strategic Gaming of Cognitive Mindhacks
by Fyodor Yarochkin, Lion Gu, and Vladimir Kropotov
    
Exfiltrating Reconnaissance Data from Air-Gapped ICS/SCADA Networks
by David Atch

Fed Up Getting Shattered and Logjamed? A New Generation of Crypto is Coming
by David Wong
    
I Trust my Zombies: A Trust-Enabled Botnet
by Emmanouil Vasilomanolakis, Max Mühlhäuser, Jan Helge Wolf, Leon Böck and Shankar Karuppayah
    
Key Reinstallation Attacks: Breaking the WPA2 Protocol
by Mathy Vanhoef
    
Wi-Fi Direct to Hell: Attacking Wi-Fi Direct Protocol Implementations
by Andrés Blanco
    
Zero Days, Thousands of Nights: The Life and Times of Zero-Day Vulnerabilities and Their Exploits
by Lillian Ablon

Article source: https://www.darkreading.com/black-hat/black-hat-europe-2017---new-briefings-announced/d/d-id/1330012?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Late September attacks highlight the persistent nature of ransomware threats, Comodo says.

The Locky ransomware strain, initially spotted in February 2016, has emerged as one of the most dangerous examples of the highly persistent and pernicious nature of modern cyber extortion campaigns.

The operators of the malware—among the most prolific ransomware samples ever—have shown a tendency to launch brief waves of attacks, go dormant for some time and then come back with a vengeance to torment businesses and consumers.

The most recent of those waves happened in late September and appeared targeted at businesses in multiple regions including North America, Europe and Southeast Asia, security vendor Comodo said in a soon-to-be-published special report.

Comodo described the September Locky campaign as building on two previous attack waves that the vendor reported on last month (here here). As with the earlier attacks, the latest ones too used a botnet of zombie computers distributed around the word to send highly convincing looking phishing emails to potential victims.

One of the emails used in the phishing campaign was designed to appear like a scanned document from a business printer located at the victim’s organization. To lend credibility, the phishing email included a model number for a very popular Konica Minolta scanner/printer widely deployed in businesses around the world.

A second email used in the phishing campaign was spoofed to appear like a query pertaining to the status of a vendor invoice. Recipients, who were lured into opening the attachments in these emails, downloaded Locky on their systems. The average ransom amount for the decryption key tended to range between $2,000 and $4,000.

The social engineering that was used to engage victims was carefully designed to slip past malware detection tools including those using machine-learning algorithms to spot phishing emails, says Fatih Orhan, vice president, threat labs at Comodo.

The attachment in one of the emails for instance was disguised as a printer output, and it contained a script inside an archive file. “This is not enough to make a phishing detection,” Orhan says.

“Machine learning algorithms need to extract the attachment, open the archive, extract the script and understand it has a malicious intent,” he notes. “Usually, these scripts contain just a download component and do not have malicious intent on their own. That’s why even machine learning is not sufficient in making these kinds of detections.”

Additional measures are needed to run the script dynamically and to download the actual payload, and conduct malware analysis to detect phishing, Orhan explains.

Security researchers at Comodo detected and analyzed over 110,000 Locky-related emails at customer endpoints over a three-day period between Sept. 17 and Sept. 20.

The phishing emails that purported to be printer output were sent from a total of nearly 120,000 IP addresses from 139 country code top-level domains, according to Comodo. The other phishing email that was utilized in the September Locky campaign was sent from over 12,350 IP addresses in 142 countries. In total, the IP addresses used in the September attacks were scattered across more than half of all countries in the world.

Many of the IP addresses belonged to infected computers belonging to individual consumers. But there were a fair number of systems belonging to ISPs as well, Orhan says.

Significantly, a considerable number of servers used to spread the phishing email were the same as ones used in previous campaigns. “These are mostly compromised servers as we understand,” Orhan said. “The fact that they are used for multiple attacks shows there is no remediation on these servers.”

Many ISPs also do not appear to have controls for spotting infected systems belonging to their customers that are being used to continuously send phishing emails over weeks.  “It’s possible they don’t have real-time detection capabilities. But the attacks being continuous over weeks, shows they are incompetent in securing the network traffic they are providing,” Orhan says.

Locky was one of the most widely distributed ransomware tools in 2016 and looks set to be among the most widely distributed pieces of malware this year as well. One of its most notable victims—at least publicly disclosed ones—is Hollywood Presbyterian Medical Center, which was forced to pay $17,000 to retrieve a critical database that was encrypted with the malware.

News about the latest Locky attacks comes even as Europol this week warned of ransomware eclipsing all other forms of cyber threat for the second year in a row.

“Ransomware attacks have eclipsed most other global cybercrime threats, with the first half of 2017 witnessing ransomware attacks on a scale previously unseen following the emergence of self-propagating ‘ransomworms,’ ” Europol said citing examples like WannaCry and Petya/NotPetya outbreaks.

Related content:

• Here Comes Locky, A Brand New Ransomware Threat
• Ransomware Authors Break New Ground With Petya
• NotPetya: How to Prep and Respond if You’re Hit
• 10 Ways to Prevent Your Mobile Devices From Becoming Bots

 

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/new-locky-ransomware-phishing-attacks-beat-machine-learning-tools/d/d-id/1330010?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

The New York Cyber Task Force says strategic innovations, not only technical ones, have made the biggest difference.

Members of the New York Cyber Task Force (NYCTF) argue strategic innovations have been as important, if not more so, than technical advancements for improving cybersecurity. The group today released a report following two years of examining ways to improve security defense.

The foundation of the report, which contains recommendations for shaping the future of security, can be summed up in a single quote:

“Providing satisfactory security controls in a computer system is in itself a system design problem. A combination of hardware, software, communications, physical, personnel, and administrative-procedural safeguards is required for comprehensive security. In particular, software safeguards are not sufficient.”

This quote holds true today, yet it was pulled from a report published in 1970, entitled “The Ware Report.” Members of NYCTF found it represented their feelings on the shortcomings of cybersecurity innovation. Nearly 40 years later, security challenges are the same.

“It encapsulated our frustration,” says NYCTF executive director Jason Healey. “Why do we think another device, another widget on our network is going to change this when the stuff we’ve been doing for 40 years hasn’t fundamentally changed?”

Group members shared their concerns and decided they “wanted to be frustrated in the right direction,” he says, so they dug into the history of cybersecurity with four questions in mind:

• Why hasn’t cyberspace been defensible?
• What innovations in technology, operations, and policy have made the biggest difference on the largest scale and at the least cost?
• What common factors contributed to the success of these innovations?
• Based on past successes, what new innovations deserve attention and investment?

The consensus was that history’s highest-impact innovations shared two key commonalities. For starters, they put the defense at an advantage and imposed a far greater cost on attackers. They also easily, or automatically, work across businesses or all of cyberspace.

These innovations include strong encryption, securely designed software, and software that updates automatically or with little to no user intervention. The innovations that made the biggest difference “took the user out of the solution,” Healey explains.

One standout, he says, was Windows Update and Microsoft’s decision to push automatic updates and allow all copies of Windows to be patched with the most secure configuration.

“Microsoft made a single change — and I’m not saying it was cheap to have done that — but think about the defense advantage we’re gotten from Windows Update,” he notes.

Experts determined that transformative innovations have not only come from technology but organizational improvements — for example, the creation of the first Computer Emergency Response Team (CERT) in the 1980s. Other key innovations have related to governance, such as the creation of C-suite security experts in the 1990s.

“Non-technical innovation tends to have a longer shelf life,” says Healey, explaining how people overlook policy when discussing innovation. “It’s not a technology; it’s a new doctrine that has helped drive so many positive changes in our defenses, just by an idea in how we think about it.”

Another example, he continues, is the inclusion of cybersecurity ratings in Consumer Reports rankings of electronic devices. “Think about how much payoff we’re going to get in market incentives,” he emphasizes.

With respect to the future of innovation, members of the task force identified several innovations with potentially large effects. They see potential in a consensus between policymakers and technology leaders to build a defensible cyberspace with more-secure cloud technologies and better authentication by eliminating passwords.

The cloud was a hot topic of conversation, Healey adds. Members believe it will drive new architecture that will prove more beneficial to defenders than attackers. In the cloud, defenders can use scale to reduce complexity. If everything resides on the cloud, there is only one set to keep updated and secure rather than hundreds.

“The consensus was we haven’t yet begun to really see the security payoffs we’re going to get from cloud,” he explains. “If a company can’t have their own dedicated hunting team or incident response, if they can’t do those things like the main players, the cloud will give them added security and resilience.”

The report has a wealth of recommendations for government, IT and security companies, and highly IT-dependent organizations. Here are some of the key takeaways:

• Implement the highest-leverage innovation: Push products that remove entire classes of attacks, and ensure systems are patched. Choose solutions with built-in or automatic security so the system is not dependent on users.
• Start from the board down: Appoint tech-savvy board directors to drive the transition from compliance-based security to risk-driven approaches.
• Emphasize agility and resilience: Develop and practice response playbooks at all organizational levels. Agility and response can apply to a broad range of security incidents.

Related Content:

• 7 SIEM Situations That Can Sack Security Teams
• Cybercrime Costs Each Business $11.7M Per Year
• Microsoft Builds Automation into Windows Defender ATP
• Malware Investigation Leads to Sophisticated Mideast Threat Network

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Kelly Sheridan is Associate Editor at Dark Reading. She started her career in business tech journalism at Insurance Technology and most recently reported for InformationWeek, where she covered Microsoft and business IT. Sheridan earned her BA at Villanova University. View Full Bio

Article source: https://www.darkreading.com/cloud/key-security-innovations-focus-on-policy-and-tech/d/d-id/1330008?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Let’s start with some things we knew already: people are really bad at creating and remembering secure passwords and PINs.

We’re also bad at choosing and answering password recovery questions. Most of us can’t even cook up an unlock pattern for our Androids that’s not crazy easy to predict, be it by shoulder-surfing or the tell-tale streaks we leave with our greasy fingers.

Now, a new report (PDF) from security researchers at the US Naval Academy and the University of Maryland Baltimore County has quantified just how absurdly easy it is to do an over-the-shoulder glance that accurately susses out an Android unlock pattern.

As we explained a few years ago, a lockscreen pattern allows you to lock/unlock your device by swiping your finger on the screen, drawing a pattern that touches at least four and up to nine nodes. Just as with character counts in a passcode, the more nodes you touch in your pattern, the more secure your lock should be.

Unfortunately, while there are 389,112 possible patterns you could draw using four to nine nodes, when researcher Marte Løge analyzed 3400 user-selected patterns, she found that the most commonly selected patterns used just four.

That’s bad enough, but to make it even worse, most people do swipes in predictable patterns: they go from left to right, top to bottom, typically starting in a corner, often create patterns in the shape of a letter, and rarely backtrack over the space their fingers have already traversed.

That’s what we already knew.

What the Naval Academy/U of Baltimore security researchers did this time around was to form a baseline of exactly how easy it is for a snoop to reproduce our unlock patterns, and how much easier it is to glean a pattern vs a PIN.

In a nutshell: it is far easier for an attacker to shoulder surf a pattern than a PIN.

The large-scale study involved showing participants videos of phone users inputting PINs and unlock patterns, and then asking them to act as attackers by replicating what they’d seen.

No surprise here: They found that the longer (6-node) PINs are fairly tough to shoulder surf at first blush. Only about 10% of the “attackers” who took a single look at the video of a 6-character PIN got it right. That went up to about one in four with multiple viewings of the same video.

Compared to that, Android patterns that used 6 nodes were a breeze for the attackers. Their attack success rate was 64% with a single viewing of the video—a success rate that shot up to 80% with multiple views.

Naval Academy Professor Adam Aviv told Wired that it’s easier for humans to detect patterns than PINs because our brains are wired that way:

Patterns are really nice in memorability, but it’s the same as asking people to recall a glyph. Patterns are definitely less secure than PINs.

The researchers accounted for multiple conditions that could affect a shoulder surfing attack, including two common touchscreen sizes; they incorporated 5 different observation angles to simulate various observer vantage points; they considered different hand positions, such as single-handed thumb input vs two-handed index finger input; and they compared varying length PINs and swipe patterns, both with and without the feedback lines.

The researchers noted that disabling Android’s “feedback lines”—those lines that visually trace the pattern in the wake of a swiping finger—cut that attack success rate down to 35% for single viewings and 52% with multiple views. That’s still pretty high, but at least it’s a bit of a bone to throw to those who really, really like their pattern unlocking.

After all, patterns are better than no protection at all. As it is, exhausted users are increasingly just rolling over and playing dead, numbed by alarm fatigue at all the security protocols/security warnings/data getting crowbarred out of companies that can’t seem to figure out how to keep their data safe.

The best approach to securing your device is to use the longest PIN it will allow and the shortest lock out time you can stand.

Aviv, along with his fellow researchers, will present the paper at the Annual Computer Security Applications Conference in Puerto Rico in December.

Follow @LisaVaas
Follow @NakedSecurity

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/BD_XkxfVN0E/

Perhaps if George Orwell were writing today, he’d include an addendum to his iconic line, “Big Brother is watching you.” Because, if you’re a US immigrant, Big Brother is serving notice that he will also be reading you – reading your social media posts and tracking your online activities.

The notice came with the Department of Homeland Security’s (DHS) publication of a new rule to “modify a current DHS system of records.” And the key phrase in a document of nearly 9000 words is that the department intends to:

expand the categories of records to include … social media handles, aliases, associated identifiable information, and search results.

It also vastly expands the number of people to which the new rule would apply, from those seeking immigrant status to include naturalized citizens and legal permanent residents. And, as security guru and IBM Resilient CTO Bruce Schneier put it in a blog post, “it seems to also include US citizens (who) communicate with immigrants.”

The rule is set to take effect in less than a month – 18 October – which leaves a pretty small window for privacy advocates to comment. But there is escalating debate not only about the impending change itself, but whether it is a change at all.

According to DHS itself, it is not a change – it simply restates a policy that has been in effect for more than five years. Gizmodo reported that an email from DHS stated:

The notice did not announce a new policy. The notice simply reiterated existing DHS policy regarding the use of social media. In particular, USCIS (US Citizenship and Immigration Services) follows DHS Directive 110-01 for the Operational Use of Social Media. This policy is available on DHS’s public website and was signed on 6/8/2012.

But privacy advocates contend that while past policy has allowed trained USCIS officers to search publicly available social media to see if a person is eligible for an immigration benefit, it hasn’t applied to legal residents or naturalized citizens, and didn’t demand things like their social media handles and aliases, or to search their internet history.

A former DHS senior official, who declined to be identified because of a current employment situation, agreed that the policy does not go back to 2012. Social media collection by immigration began, she said, after the December 2015 shooting in San Bernardino by a husband and wife who killed 14 and wounded 22 before they were later killed in a shootout.

She noted that the new rule, while it does include social media handles and aliases, does not include passwords. But, she agreed that it is “a significant expansion.”

“It is not a nothing-burger,” she said.

The continuing stance of DHS – and the FBI and other agencies that are part of the US intelligence community – is that they must have access to social media accounts to be able to find people who are becoming radicalized and/or may be planning or involved in terrorist activity.

Former FBI director James Comey, speaking in Boston earlier this year, said while he loves privacy, the “bargain” necessary to protect both privacy and safety is that, “there is no such thing as absolute privacy.”

But privacy advocates counter that this kind of collection is too invasive, discriminates against immigrants and wouldn’t improve national security anyway.

The American Civil Liberties Union (ACLU) issued a statement saying the rule would, “single out a huge group of people to maintain files on what they say (and) have a chilling effect on the free speech that’s expressed every day on social media.” It added that the, “collect-it-all approach is ineffective to protect national security …”

Adam Schwartz, a senior staff attorney at the Electronic Frontier Foundation (EFF), noting that the information collected will be held, probably indefinitely, in so-called “Alien Files” or “A-Files,” called it, “a new form of invasive social media surveillance.”

It is especially troubling, he added, when added to, “all manner of high tech surveillance, including facial recognition and cell site simulators,” used to monitor immigrants.

The former DHS official added that US immigration is not equipped to do this kind of screening effectively. “Now that they’re collecting it, they’re going to be responsible for it,” she said, “and they don’t have the bandwidth to screen and clear every malcontent who tweets something. It’s classic security theater.”

She said DHS should limit itself to collecting social media information, “when they have probable cause or reasonable suspicion. But not everybody from students to green card holders. They’re putting a bigger target on themselves when they miss something – and they will.”

All of which means, as privacy experts have long said, that the best way individuals can limit this collection is to place some limits on themselves. Which would mean modifying the classic political advice from a Boston politico decades ago: “Never write when you can speak, never speak when you can nod, never nod when you can wink.”

Disgraced former New York governor Eliot Spitzer added to that nine years ago, after he had left a trail of online communications implicating himself in a prostitution ring: “Never put it in email.”

To which, he would probably now add: “Never put it on social media.”

Follow @NakedSecurity

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/god4fMPd6zs/

A flaw has been found in the way the Linux kernel loads ELF files.

If a malicious program is built as a Position Independent Executable (PIE), the loader can be exploited to map part of that application’s data segment over the memory area reserved for its stack. This can result in memory corruption and possible local privilege escalation.

Red Hat and Debian are among Linux distros affected by the CVE-2017-1000253 vulnerability, which was discovered by cloud security firm Qualys.

Red Hat’s advisory is here. Debian’s list of affected releases – which have largely already been fixed – can be found here. Just run your usual package management tools to install the patched kernels and reboot.

Red Hat warned: “An unprivileged local user with access to SUID (or otherwise privileged) PIE binary could use this flaw to escalate their privileges on the system.”

This issue affects Linux kernel packages as shipped with Red Hat Enterprise Linux 5 and 6 as well as some older versions of Red Hat Enterprise Linux 7. Embedded systems running Red Hat may also need updating. The Linux distro rates attack complexity as “low” but impact “high” – always a bad combination.

The flaw represents a possible mechanism for a hacker or other malicious party to step up from a normal user to root – e.g. you get a shell as an ordinary user via a compromised web application or another internet-facing service, and then use the above bug to take full control of the box. It can also be abused by logged-in users to gain administrative access over the machine.

Patching is straightforward, in this case, but deployment is the “hard” part as it’ll involve a reboot. The vulnerability is nasty but it’d be a whole lot worse if it were remotely triggered, kinda like ShellShock and its ilk. This flaw does not fall into that category, fortunately.

Sysadmins are nonetheless advised to review the security of their systems and patch or at least mitigate against the vulnerability at their earliest opportunity. ®

Sponsored:
The Joy and Pain of Buying IT – Have Your Say

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/09/28/linux_kernel_vuln/