STE WILLIAMS

The foundation of good cybersecurity is knowing your network. But as organizations embrace new technologies, that simple task has gotten incredibly difficult.

Security pros today feel overwhelmed by the current cyberthreat environment and the deluge of security solutions on the market. Given the rapid adoption of cloud, BYOD, IoT and DevOps, many lack confidence in their ability to accurately assess exposure and risk. What the world needs is a modern approach to understanding threats and exposures across the entire enterprise, based on visibility and driving understanding. I call that the “elastic attack surface.”

Dynamic and borderless
The modern enterprise environment is dynamic and borderless with virtually unlimited connectivity. Employees bring personal devices to work, contractors use their tools on the corporate network, IoT devices and infrastructure abound, people connect to new cloud instances daily, IT teams spin up containers and manage on-site and legacy architectures. The result is an elastic attack surface, and it is constantly changing in consequential ways, creating gaps in security coverage and creating exposure.

There are six major components of today’s elastic attack surface:

1. Traditional assets: The tried and true assets within the corporate enterprise – such as servers and desktops – still exist but with a dynamic interconnectedness within the environment that results in an abundance of software changes and updates.

2. Cloud instances: Between commercial offerings and organizations’ own software, the idea of a traditional network perimeter is gone forever. Most enterprises are connected to dozens of off-site server environments, making it harder to accurately assess exposure and risk.

3. Mobile/BYOD: It is now expected that employees, contractors, partners and others have access to your network when they bring their personal devices to work. Laptops, tablets, smartphones, wearables, and other devices demand connectivity, and even help employees do their jobs more efficiently.

4. IoT devices: Devices such as consumer appliances, conference room utilities, cars parked in office lots, green-building technologies, and physical security systems are all connected to your network. These devices are growing in popularity and add scale and complexity to the corporate network.

5. DevOps/Containers: As organizations adopt DevOps practices to deliver applications and services faster, ownership of IT assets changes and security teams must work directly with developers. The shift in how we build software and the use of short-lived assets, like containers, help organizations increase agility, but they also create significant new exposure along the way.

6. Web applications: Vulnerabilities have become more common in self-supported code like web applications as enterprises look for new and innovative ways to improve business operations. Delivering custom applications to employees, customers, and partners can increase revenue, strengthen customer relationships, and improve efficiency, but it also forces the organization to take responsibility for finding flaws in its own code.

Securing Elastic IT
Security teams who want to see and protect the assets in their elastic attack surface need a modern approach to understanding their asset base, an approach that gives them visibility into what exists and how it is exposed, and insight to address the risks that matters most. Without this modern approach, businesses will never be able to answer the two most fundamental questions in security: How exposed am I? And what can I do today to reduce risk?

The process starts with a deep knowledge of all of your systems and their exposures. This knowledge is critical for security teams that are trying to stay ahead of evolving threats.

Next, organizations need to understand how each of these assets maps to the business, and which ones are most critical. Security is not an island. Smart CISOs must understand how their decisions affect the overall mission of the organizations, and adjust their plans accordingly.

This in-depth understanding of the environment is the foundation on which you can prioritize improvements to security hygiene and develop a security program based on risk. The basic blocking and tackling of security might not be sexy or flashy, but at a time when more than 85% of all successful data breaches are the result of an attacker exploiting a known, unpatched vulnerability, it is critical to your security program and mission success.

Related Content:

• Fortune 1000 Companies See Security Ratings Drop
• Trust, Cloud the Quest for a Glass Wall around Security
• Why Identity Has Become A Top Concern For CSOs

Amit Yoran is chairman and CEO of Tenable, overseeing the company’s strategic vision and direction. As the threat landscape expands, Amit is leading Tenable into a new era of security solutions, empowering organizations to meet the challenges of evolving threats with … View Full Bio

Article source: http://www.darkreading.com/perimeter/securing-todays-elastic-attack-surface/a/d-id/1328355?_mc=RSS_DR_EDT

Infosec researchers have found a “dire” zero-day in Apache Struts 2, and it’s under active attack.

If you’re a sysadmin using the Jakarta-based file upload Multipart parser under Apache Struts 2, Nick Biasini of Cisco’s Talos advises applying the latest upgrade immediately.

CVE-2017-5638 is documented at Rapid7’s Metasploit Framework GitHub site.

Talos’s input adds urgency to getting the upgrade, because the organisation “found a high number of exploitation events. The majority of the exploitation attempts seem to be leveraging a publicly released proof of concept that is being used to run various commands”.

It was Amol Sarwate, Qualys’ director of engineering, who told El Reg the bug is dire because it’s a “complete control” vuln. The company has dropped a tester admins can run against their own systems, described here.

First reported by Chinese developer Nike Zheng, the attack sends an invalid Content-Type value to the uploader, which throws an exception providing remote code execution.

Here’s Talos’ grab of a probe it’s seen against a vulnerable system:

Black hats a-knocking at the door

To see if the system is vulnerable, the probe runs whoami.

The researchers have also seen malicious attacks which turn off firewall processes on the target and drop payloads: “The payloads have varied but include an IRC bouncer, a DoS bot, and a sample related to the bill gates botnet”.

Talos says it’s also seen attempts to drop persistent attacks into targets: “The adversary attempts to copy the file to a benign directory and then ensure that both the executable runs and that the firewall service will be disabled when the system boots.” ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/03/09/apache_under_attack_patch_for_zero_day_available/

Get ready for the next camera-botnet: a Chinese generic wireless webcam sold under more than 1,200 brands from 354 vendors has a buggy and exploitable embedded web server.

According to this advisory by Pierre Kim at Full Disclosure, the problems are in the camera’s GoAhead administrator’s interface and in a weak cloud connection protocol.

Kim posts a Shodan link that lists around 185,000 vulnerable Wi-Fi-connected cameras exposed to the internet, ready and waiting to be hijacked. The cameras’ CGI script for configuring FTP has a remote code execution hole known since 2015, Kim writes, and this can be used to run commands as root or start a password-less Telnet server.

There’s a folder in the file system, /system/www/pem/ck.pem, that includes an Apple developer certificate with a private RSA key, and credentials for the Web server leak to an unauthenticated attacker via the system.ini and system-b.ini symbolic links.

There’s an unauthenticated real-time streaming protocol (RTSP) server, so if you can see the camera’s TCP port 10554, you can watch what it streams.

The camera’s cloud capability is on by default, with pre-configured connections to AWS, Alibaba and Baidu. All an attacker needs is a suitable smartphone application (Kim tried P2PWificam and Netcam360), and the serial number of the target.

“If the camera is online, a UDP tunnel is automatically established between the application and the camera, using the cloud server as a relay,” he writes.

That UDP tunnel is an attack vector, which Kim demonstrates by retrieving configuration in plain text, and: “the tunnel bypasses NAT and firewall, allowing the attacker to reach internal cameras (if they are connected to the Internet) and to bruteforce credentials.”

Kim notes that such easily attacked cameras could effortlessly be recruited into a botnet.

Kim’s post at GitHub includes proof-of-concept code and the sensible advice that cameras should not connect to the Internet.

The vulnerabilities clearly go back a long way, since 3Com’s name is in the list. Other big names include D-Link, Akai, Axis, Kogan, Logitech, Mediatech, Panasonic, Polaroid, and Secam.

Australian readers might want to check out cameras bought from Jaycar, particularly under the QC-38nn model range. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/03/09/185000_wifi_cameras_naked_on_net/

FBI director James Comey has told a cybersecurity conference that any communications – be it with your spouse, your priest, or your lawyer – and any of your memories are up for grabs should a court order it.

Speaking at the Boston Cyber Security Summit, Comey said that America’s founding fathers had set down that there is a right to privacy but that the government has a right to intrude in the name of security. It was part of a 200-year old “bargain of ordered liberty,” he opined.

“Even our memories are not absolutely private in America,” he said.

“Any of us can be compelled – in appropriate circumstances – to say what we remember, what we saw. Even our communications with our spouses, with our clergy members, with our attorneys are not absolutely private in America. In appropriate circumstances a judge can compel any one of us to testify in court about those very private communications.”

Comey made this argument as part of a discussion about the FBI’s relationship with encryption. He said that encryption had always been part of computer technology, but after Edward Snowden’s whistleblowing we had seen a huge rise in the use of encryption, and this was making life difficult for the FBI.

Between October and November last year, the FBI had taken 2,800 devices that it had the lawful right to search. But because of their encryption the FBI wasn’t able to break into 1,200 of them. Technology firms have taken strong encryption and given it to everyone, even drug dealers and pedophiles, he complained.

Youtube Video

Given the leak of the CIA’s exploit list on Tuesday, that seems difficult to understand. Several of the zero-day attacks on mobile operating systems were listed as coming from the FBI, and the agency can call on the resources of the NSA and private companies as needed.

Comey professed himself a fan of both privacy and strong encryption. On the privacy side of things he has an Instagram account, he said, but it only has nine followers because he blocks everyone but family members. He said he likes that privacy, but would open up the account if compelled to do so under the law.

Similarly with encryption, Comey said the FBI protects its own data with strong encryption and issues encrypted devices to its agents. But if necessary, it can still get around the encryption on those devices and companies need to have a similar approach, he argued.

Presumably this means some kind of shared key exchange, with the government holding one of the keys. We suggest he ask the NSA, CIA, and OPM how well their secrets were protected.

Comey denied that Apple and the FBI had been in conflict over encryption, despite the extensive legal proceedings the agency went through to try to force Cook Co to do its bidding. He asked again for an adult conversation about the encryption debate.

“We need to stop bumper stickering each other, and tweeting at each other,” he said. “There are no evil people in this debate.”

Hacktivists more dangerous than terrorists

In his talk, Comey outlined the FBI’s top five cybersecurity threats and his ordering might cause some surprise.

Top of the list was nation state hackers, he said, followed closely by international professional hacking groups that worked for money. The next most dangerous threat was employees and staff carrying out insider attacks, he said, followed by hacktivists seeking to use computer crime to advance political aims.

But at the bottom of the FBI’s list were terrorists. While terrorist groups have proved adept at using the internet to spread propaganda and recruit new members, they are relatively unskilled and haven’t turned to online crime to carry out attacks, Comey said.

To beat these threats the FBI is trying to get better skills by recruiting from the outside. The Feds are looking for people with the right skills, physical fitness, and integrity. There’s no point hiring someone who’s a whiz at computing and fit enough to pack heat if they “smoke weed on the way to the interview,” he joked.

The FBI can’t match private industry when it comes to salaries, Comey said, but the FBI is trying to make the organization more tech-friendly. That doesn’t mean beanbags and whiteboards he said, but the agency wanted to attract talent and so would have to loosen up a little.

The FBI has also introduced internal competition, he said, so that now an online investigation will be carried out by whoever is most skilled, not by whoever is at the scene of the crime. All field offices will have a cyber specialist and Comey expects the competitive aspect to lead to improvements in skills and conviction rates.

He also appealed for companies to work with the FBI more, saying that if you are a chief security officer and don’t know your local FBI officer then you’re failing at your job. But he issued a stern warning against companies hacking back against attackers.

“Don’t do it, it’s a crime,” Comey pronounced. “It also runs the risk of creating confusion in a crowded space.” ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/03/08/fbi_boss_says_memories_not_private_in_america/

Infosec researchers have found a “dire” zero-day in Apache Struts2, and it’s under active attack.

If you’re a sysadmin using the Jakarta-based file upload Multipart parser under Apache Struts2, Nick Biasini of Cisco’s Talos advises applying the latest upgrade immediately.

CVE-2017-5638 is documented at Rapid7’s Metasploit Framework GitHub site.

Talos’s input adds urgency to getting the upgrade, because the organisation “found a high number of exploitation events. The majority of the exploitation attempts seem to be leveraging a publicly released proof of concept that is being used to run various commands”.

It was Amol Sarwate, Qualys’ director of engineering, who told El Reg the bug is dire because it’s a “complete control” vuln. The company has dropped a tester admins can run against their own systems, described here.

First reported by Chinese developer Nike Zheng, the attack sends an invalid Content-Type value to the uploader, which throws an exception providing remote code execution.

Here’s Talos’ grab of a probe it’s seen against a vulnerable system:

Black hats a-knocking at the door

To see if the system is vulnerable, the probe runs whoami.

The researchers have also seen malicious attacks which turn off firewall processes on the target and drop payloads: “The payloads have varied but include an IRC bouncer, a DoS bot, and a sample related to the bill gates botnet”.

Talos says it’s also seen attempts to drop persistent attacks into targets: “The adversary attempts to copy the file to a benign directory and then ensure that both the executable runs and that the firewall service will be disabled when the system boots.” ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/03/09/apache_under_attack_patch_for_zero_day_available/

Researchers at Palo Alto Networks discovered 132 Android apps on Google Play tainted with hidden IFrames linking to malicious domains in their local HTML pages. Interestingly, the malware is Windows-based.

The researchers believe developers have been inadvertently grabbing the same sinister code, saying in their report:

Our investigation indicates that the developers of these infected apps are not to blame, but are more likely victims themselves. We believe it is most likely that the app developers’ development platforms were infected with malware that searches for HTML pages and injects malicious content at the end of the HTML pages it finds. If this is this case, this is another situation where mobile malware originated from infected development platforms without developers’ awareness.

But researchers from SophosLabs believe there’s more to the story.

Rowland Yu, a SophosLabs researcher specializing in Android malware, reviewed Palo Alto’s report and confirmed the lab has seen and reported the same malware to Google. Rather than being a case of many innocent developers scooping from the same poisoned well, Yu believes this is the work of one developer in particular.

More developers may be involved, but all roads seem to lead back to a developer who goes by the name Nandarok.

What happened, exactly?

Palo Alto said the infected apps included those used for design ideas for everything from cheesecake to gardening and coffee tables. All use Android WebView to display static HTML pages:

At the first glance, each page does nothing more than loading locally stored pictures and show hard-coded text.  However, a deep analysis of the actual HTML code reveals a tiny hidden IFrame that links to well-known malicious domains. Although the linked domains were down at the time of investigation, the fact that so many apps on Google Play are infected is notable.

Also significant is that one of the infected pages attempts to download a malware-laced Windows file when the page loads. It’s a curious development, since the devices don’t run Windows and therefore won’t execute.

SophosLabs has identified the malicious iFrame payloads as Troj/Fujif-Gen – an ID first published in 2015, Yu said. On February 20, the Android samples were detected as App/Adload-H.

Sophos puts App/Adload-H in the category of Potentially Unwanted Applications (PUA): items such as adware that are not necessarily malicious but are usually considered a nuisance.

Enter Nandarok

App/Adload-H can be traced back to dozens of apps from the developer who goes by the name Nandarok. Yu said:

One of interesting apps is for “girls’ phone numbers”. Incredibly, between 100,000 and  500,000 users believed it and downloaded these apps.

Here is just a sample of the apps that appeared under Nandarok’s name:

Yu agreed with Palo Alto that the samples are very small and have no real function. But he disagrees with this statement from its researchers:

Our investigation indicates that the developers of these infected apps are not to blame, but are more likely victims themselves.

It’s true that others have probably spread it without realizing it. But this started as a deliberate action on the part of Nandarok and a few fellow developers. Yu said:

I believe the malware samples are from a same developer, or from a few developers who have a relationship with him. They intentionally release a bulk of junk samples. They use a framework to generate these samples, and that framework is accidentally loaded with the infected IFrame along the way.

The good news is that Google does appear to be eliminating these apps as they are reported. The key now is for researchers to keep scouring Google Play to ensure that if these or new variations surface, they can be dealt with.

Follow @NakedSecurity
Follow @BillBrenner70

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/ikzBHrZMqxQ/

A father was fined €956 after a German judge said that warning his 11-year-old son not to download anything online wasn’t explicit enough about online piracy. In fact, it was “negligent”, the court said.

According to Torrent Freak, the 11-year-old boy downloaded an audio book.

His father was away from home at the time of the copyright infringement. But his wife and son were at home, and as the case wound its way through a Leipzig court, it became clear that the boy was the pirate. But in a verdict that Torrent Freak dubbed “rather unique,” the court opted to hold the kid’s dad responsible.

It’s not that courts don’t hold parents responsible for their children’s misdeeds.

In the US, most states have “parental liability” or “parental responsibility” laws on the books, according to Eric Menhart, who’s on a list of piracy defense attorneys maintained by the Electronic Frontier Foundation (EFF).

The EFF offers this memo to help parents in the US to figure out whether they might be held liable when their children engage in filesharing:

In 2003, the Recording Industry Association of America (RIAA) sued 261 people over copyright infringement in connection with downloading protected music.

Among the defendants: several surprised parents who had no idea that their children were pirates. And they’re not alone: In Thrifty-Tel v. Bezenek, the California Court of Appeals upheld a verdict against the parents of teen cybercrooks who accessed the phone company’s network in order to make long-distance calls for free.

Germany in particular has a reputation for being a leader in file-sharing settlement demands. In 2013, lawyers sent 109,000 piracy threats, seeking a cool €90.3m, according to Torrent Freak.

Holding the German dad responsible for his son’s piracy isn’t the noteworthy part of this recent court finding. Rather, it’s the fact that the court dubbed him “negligent” for failing to explicitly warn his son about the perils of online piracy.

The man told the court that he’d asked his son to stick to schoolwork on the computer. His partner confirmed that. The man also warned the child not to download random stuff or to do anything dangerous.

That’s not good enough, the court ruled, saying the warning was not specific enough, given that the dad didn’t explicitly explain to his kid what constitutes an illegal download.

In her order (PDF), the judge wrote that proper parental supervision consists of instructing a child “on the illegality of participating in illegal file-sharing exchanges, and to explicitly prohibit this behavior”.

The court repeatedly characterized the father’s behavior as “negligent” and suggested that he might not have warned the boy at all; rather, he may have just made up the warning to avoid punishment.

The man can still appeal the decision to a higher court.

Menhart isn’t familiar with the specifics of German law but he said that in general, parental warnings to kids aren’t necessarily enough to get parents out of hot water. If their child’s found liable, well, tough luck:

…under a fact pattern like that, I don’t know if the parent’s instruction would necessarily be enough to preclude liability, if the child was still found to be liable. Obviously, that would be a “bummer” for the father, but, by operation of law, it would not surprise me if that were the result.

Follow @NakedSecurity
Follow @LisaVaas

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/MmUBwIaciU4/

Your daily round-up of some of the other stories in the news

Firefox drops support for Windows Vista, XP

If for some reason you’re still running Windows Vista or even XP and you’re a Firefox fan, be warned: the latest version of Mozilla’s open-source browser is the last that will work on those two versions of Windows.

Windows Vista, released in 2006, comes to the end of its support lifecycle on April 11 this year, which means it will no longer get security or feature updates. It was superseded by Windows 7, which has the biggest share of the desktop OS ecosystem at just over 48%, according to Netmarketshare. Vista fans, you are among the 0.78% of people using that OS on the desktop.

Windows XP, which came to the end of its support lifecycle in April 2014, still commands 8.45% of the desktop market, but hopefully with the ending of Firefox support, users of both versions of Windows will finally look to upgrade.

The latest version of Firefox also removes support for insecure legacy plugins such as Java, Silverlight and Acrobat. Flash support hangs on, but it’s switched off by default, and it will warn users when navigating to a page that isn’t encrypted with HTTPS.

Senator presses CloudPets boss over breach

A US senator has written to Spiral Toys, the maker of the insecure CloudPets toys whose database was revealed to have been breached not once but several times, demanding answers to some questions raised by security researchers.

Bill Nelson, Democrat senator for Florida and a member of the Senate’s Committee on Commerce, Science and Transportation, wrote to Mark Meyers, the chairman and CEO of Spiral Toys on Tuesday reiterating the questions raised by Troy Hunt and others as the scale of the breach became clear.

Among the questions Nelson put to Meyers in his letter are when the company first learned of the breach, whether and how customers were notified of the breach and what user information was compromised in the breach.

Troy Hunt, who broke news of the breach at the end of last month, shared the letter from Nelson to Meyers on Tuesday. Let’s hope the senator can get answers where researchers and users haven’t been able to.

Judge clamps down on IPTV football streaming

Football fans in the UK will find it harder to find to watch English Premier League games on Kodi boxes and other IPTV devices after a judge ruled on Wednesday that ISPs can cut off streaming of matches involving Arsenal, Chelsea and other Premier League teams.

The judge, Richard Arnold, approved an application from the Premier League, Bloomberg reported on Wednesday.

However, as Naked Security reported yesterday, local authorities, relying on a ruling from the Court of Justice of the European Union, have said that “accessing premium paid-for content without a subscription is considered by the industry as unlawful access, although streaming something online, rather than downloading a file, is likely to be exempt from copyright law”. Watch this space.

Catch up with all of today’s stories on Naked Security

Follow @NakedSecurity
Follow @katebevan

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/semdHJ1-0Pw/

Here we go again.

In 2010, WikiLeaks published a disturbing heads-up video of US helicopters strafing “insurgents” who turned out to be Reuters journalists. Weeks later came Cablegate, a leak by Bradley (now Chelsea) Manning of 251,000 US diplomatic cables.

By the time Edward Snowden’s name became famous in 2013, the mystique around US intelligence agencies was disappearing faster than the movie assassins who fancied a crack at killing Jason Bourne.

Yesterday, WikiLeaks returned with a further instalment dubbed “Vault 7/Year Zero” that exposes the first cache of 7,818 partly redacted web pages and 943 attachments that make up some of the CIA’s most precious software riddles.

What’s inside Vault 7? Let’s start with an interesting sentence from WikiLeaks’ intro:

Year Zero introduces the scope and direction of the CIA’s global covert hacking program, its malware arsenal and dozens of zero day weaponized exploits against a wide range of US and European company products, include Apple’s iPhone, Google’s Android and Microsoft’s Windows and even Samsung TVs, which are turned into covert microphones.

Which tells us several things.

The CIA hacks stuff

Of course it does, and doubtless other nation states have been crawling all over TVs and smartphones too. The significance of Samsung TV hacking is not that the CIA will do this to the average citizen – CIA target lists are tiny – but that they can do that at all. As we know from numerous IoT vulnerability stories, these devices have a security problem.

Secure messaging apps are still secure

Apparently, the CIA has been infecting Android and iOS devices to bypass secure messaging software encryption. Except this technique goes back donkey’s years and is even openly used by some police forces. No matter how secure its encryption, no app can stop a compromise of the platform on which the app is running, but using encryption raises the bar for an attacker.

Lots of old zero-days

WikiLeaks documents a pile of zero-days affecting Android and iOS that have been used by the CIA but these all appear to either be old or (in the case of Android) affect very old versions of the OS. As far as we can tell, most will either have been patched or will affect only obsolete devices.

This is mild stuff beside the four completely new zero-days the famous Stuxnet cyberweapon deployed to disrupt Iran’s nuclear program – still a record number for any malware.

Leaks are everybody’s problem

Losing control of spying tools is a disaster, but these are only one piece of a larger US arsenal that includes potent programmes run by the NSA. The bigger menace is that nation states or cybercriminals might get hold of the CIA tools and use them against civilian targets.

False flags

On that topic, Vault 7 reveals that the CIA has started doing precisely the same thing by borrowing dastardly techniques from other malware, including other nation state malware. This muddies attribution because it makes an operation look like someone else’s.

And yet the CIA can’t secure itself

The intriguing issue is how WikiLeaks obtained this cache. A sequence of US intelligence leaks is starting to look less like a trend than the symptom of a deeper reality that nothing can be kept secret by anyone. It’s as if rogue insiders (who may well be the source of this data) have become the ultimate cyberweapon.

Reports suggest that hundreds of thousands people might have had access to highly sensitive US intelligence data at the time of Snowden in 2013. That is not insecure so much as unsecurable. After operating quietly in the shadows for decades, the world of intelligence service secrecy is starting to look like a golden era that has gone for good.

Follow @NakedSecurity
Follow @JohnEDunn

 

 

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/yzFch5pKj7M/

Updated The “1.4 billion identity leak” that was hyped up before the weekend involved, no, not a database ransacking at Facebook, YouTube, or anything like that.

No, instead, a US-based spam-slinging operation accidentally spilled its treasure chest of email and postal addresses used to deluge people with special offers, marketing crap, and the like.

On Friday, Twitter user Chris Vickery teased world plus dog that he was going public on Monday with news of a massive data breach of 1.37 billion records. And that turned out to be as many as 1.37 billion contact details amassed by River City Media (RCM) – an internet marketing biz apparently based in Jackson, Wyoming, that claims to emit up to a billion emails a day.

The 200GB table includes real names, email addresses, IP addresses, and “often” physical addresses, it is claimed. Vickery said he “stumbled upon a suspicious, yet publicly exposed, collection of files,” and discovered the database and documents related to RCM. Among the millions and millions of contact details were chat logs and files exposing the sprawling RCM empire. It turns out the spamming, er, marketing biz has many tentacles and affiliates, mostly dressed up as web service providers and advertising operations.

“Someone had forgotten to put a password on this repository,” Vickery said. The data was, basically, a backup held in a poorly secured rsync-accessible system. It is alleged that chat logs and internal files in the repository show RCM staff discussing Slowloris-like techniques to overload mail servers and persuade the machines to accept hundreds of millions of messages.

It is understood RCM gathers information from people applying for free gifts and online accounts, requesting credit checks, entering prize giveaways, and such things on the internet, or the information is bought from similar info-slurping outfits. Vickery said he managed to confirm that at least a few records were real, although the addresses tended to be out of date. He added that there are a “ton” of combinations of names, military email addresses, and IP addresses.

“I’m still struggling with the best software solution to handle such a voluminous collection, but I have looked up several people that I know and the entries are accurate,” wrote Vickery. “The only saving grace is that some are outdated by a few years and the subject no longer lives at the same location.”

It’s not yet clear how much of the information in the backup is duplicated or accurate. It would be a convincing blow to people’s online privacy if this data turns out to be valid and managed to fall into the wrong hands via the insecure rsync system.

RCM did not respond to a request for comment on Vickery’s findings. Meanwhile, anti-spam clearing house Spamhaus has blacklisted the organization’s entire infrastructure. ®

Updated to add

Vickery has been in touch to clarify a few things. He said that each database row included an email address, a first and last name, the public IP address used to signup for whatever got the person onto RCM’s spam list, and the public IP address used to confirm the email address, which is almost always the signup IP address. A physical address is “included in large sections depending on the source, but not 100 per cent of entries.”

He also answered our questions, thus:

The Reg: How many of these records are duplicated?

“Each row is unique, but a row consists of all fields: email address, full name, IP address, and sometimes physical address. If any of the fields are different, it is a unique row. Meaning that if someone was logged while on an IP at their home, but with the same email address, they may be logged a second time while on an IP at work with that email address. Ultimately the question of how many unique email addresses alone will be answered shortly as I hand over a limited copy of the database to Troy Hunt [of Have I Been Pwned] for notification purposes.”

For what it’s worth, Hunt reckons there are more like 393m unique email addresses in the database.

How many of rows are accurate and/or up to date?

“It would take immense resources to get a really accurate number on that. I can tell you that the data spans 2009 to 2017, and the more recent data appears to represent the more verifiable data (as one would expect). But having knowledge of an IP that was used at a given point in time for a given email address or person’s name is still a powerful thing to consider from an operational security perspective.”

How many of the physical addresses are simply GeoIP lookups?

“I have seen zero examples of the physical addresses simply being GeoIP lookup addresses. It appears that if the spammers were not given real addresses in a particular web form, they simply did not include them in the database. There does not appear to be ‘guesswork’ done when physical addresses are present.”

How much of this is publicly accessible information that just goes to show that pretty every corp knows, from your public IP and email addresses, your name and where you live?

“Tying an IP address to a name or a name to an email address is, at least here in the US, highly protected. The subpoena process must be carried out and a judge must order such information to be handed over. While true that some very large corporations have likely built their own IP-to-email-to-identity mappings, it is certainly not even close to public record or even available to the general public.”

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/03/07/rcm_email_megaleak/