STE WILLIAMS

Companies on Watch After US, Iran Claim Cyberattacks

With the cyber conflict between the United States and Iran ramping up, companies traditionally targeted by the countries – such as those in the oil and gas and financial industries – need to bolster their security efforts, experts say.

With tensions ratcheting up in the Middle East — and both the US and Iran claiming to have begun offensive cyber operations — critical infrastructure companies and firms with links to the region need to take a heightened security posture, cyberattack and cyber espionage experts say.

In the past, Iran’s cyber operators and proxies have attacked companies with wiper software that deleted data and, more recently, targeted safety systems at critical infrastructure firms, such as oil and gas providers and electric utilities. The country has also conducted wide-ranging cyber espionage attacks against other countries and organizations in the region, as well as deployed surveillance software against dissidents and political targets.

Companies, government agencies, and other organizations should look at those capabilities and targets and determine whether they might be in any of those categories, says Ben Read, senior manager of cyber espionage analysis at FireEye.

“Companies need to ask: Has my sector been targeted before?” he says. “They don’t see these activities in a vacuum, so companies that have done business in the region should, perhaps, have more concern — the oil and gas and financial industries, for example.”

On June 20, the US Cyber Command attacked Iranian computer systems used to control air defense systems and missile launchers, targeting an Iranian intelligence group that the Trump administration claims took part in previous attacks on oil tankers, US officials told multiple news organizations. For its part, Iranian proxies reportedly launched attacks against the US on the same day.

Given the history of cyber operations, and the general lack of repercussions for the attacking nations, the option of launching cyberattacks is seen as an option that minimizes the chance of escalation, said Mike Rogers, former director of the National Security Agency and former head of the US Cyber Command, at the Cyberweek conference in Israel. 

“The US and Iran both view cybersecurity as a potential response option that offers lower risk than a kinetic or military strike,” he said. “So we will continue to see more of this because it doesn’t necessarily trigger an escalatory response from the other side.”

The latest spate of attacks followed the downing of a US drone by Iran’s military. The US government claims that the drone was in international airspace, while Iran claims the drone was in its territory.

An Escalation for US Firms
For companies, however, the increase in cyber operations between the two countries could result in increased attack activity. 

The US Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) warned companies and industries in the United States to shore up their basic defenses, deploying hardening technologies such as multifactor authentication to ward off increased attacks.

“Iranian regime actors and proxies are increasingly using destructive ‘wiper’ attacks, looking to do much more than just steal data and money,” said CISA director Christopher Krebs in a statement. “These efforts are often enabled through common tactics like spear phishing, password spraying, and credential stuffing. What might start as an account compromise, where you think you might just lose data, can quickly become a situation where you’ve lost your whole network.”

In many cases, US companies are not up for the challenge. In a recent study, real-time monitoring firm Endace found that almost 90% of surveyed firms did not have good visibility into network activity. 

Iran’s Skilled Attackers
Iran’s cyber capability is significant. Its 2012 attack against Saudi Arabia’s state-owned oil company Saudi Aramco resulted in the destruction of data on tens of thousands of hard drives. More recently, attacks against oil and gas companies and electric utilities that targeted a specific type of safety system has also been linked to Iranian actors.  

FireEye has attributed multiple attacks against large companies to Iranian cyberattackers, including one it has been tracking for more than four years. The group — labeled “APT39” by FireEye, Helix Kitten by CrowdStrike, and Chafer by Symantec — has targeted telecommunications, travel, and technology firms.

“Iran certainly has gotten into lots of US companies,” FireEye’s Read says. “I know because we have responded to incidents and had to kick them out.”

In the “Worldwide Threat Assessment of the U.S. Intelligence Community,” an annual report delivered to the US Congress, director of national intelligence Daniel Coats warned that Iran’s cyber capabilities pose an increasing threat to US companies.

“Iran uses increasingly sophisticated cyber techniques to conduct espionage,” he stated. “It is also attempting to deploy cyberattack capabilities that would enable attacks against critical infrastructure in the United States and allied countries.”

He added: “[Iran] is capable of causing localized, temporary disruptive effects — such as disrupting a large company’s corporate networks for days to weeks — similar to its data deletion attacks against dozens of Saudi governmental and private-sector networks in late 2016 and early 2017.”

Back to Basics
Security experts stress that companies need to do the basics well. The US Department of Homeland Security prodded firms to deploy multifactor authentication to stymie account takeovers and urged firms to work on speeding up their incident response.

FireEye’s Read also recommends that companies make sure they are doing the basics consistently.

“Doing the basics right is the most important thing for security,” he says. “If you already are doing that, take it to the next level — look at the tactics of specific adversaries and make sure you can spot those in your own network.”

In the end, while the US and Iran gear up for cyber operations, businesses will find themselves at the front lines.

Related Content

 

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT’s Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline … View Full Bio

Article source: https://www.darkreading.com/companies-on-watch-after-us-iran-claim-cyberattacks/d/d-id/1335045?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

  • 25/06/2019
  • adm

How to Avoid Becoming the Next Riviera Beach

Be prepared by following these five steps so you don’t have to pay a ransom to get your data back.

On May 30, Dark Reading posted my column, “The Ransomware Dilemma: What if Your Local Government Is Next?” The article came on the heels of the ransomware attack on Baltimore’s government and that city’s decision not to pay the ransom. The article discussed the moral-versus-practical dilemma of paying ransoms. In short, the moral view is to not pay because it reinforces bad behavior. The practical view is that paying the ransom is the right move because this ultimately dwarfs the costs of not paying and is often the quickest path to restoring access to your data.

We get to revisit this debate again with the news that the city council for Riviera Beach, Florida, voted unanimously to pay the ransom of $600,000, or 65 bitcoin. In this case, it appears there was little debate about what to do because the city board voted unanimously to authorize its insurer to pay the ransom. According to The Palm Beach Post, “Without discussion on the merits, the board tackled the agenda item in two minutes, voted and moved on.” Multiple media reports also indicated the city council believed it had no choice if it wanted to regain access to lost data.The city’s outside security consultants recommended they pay the ransom and the city’s insurance provider negotiated with the attackers.

In this case, it doesn’t appear it’s worth debating whether to pay or not to pay because the conclusion the city council and their advisers made was there wasn’t a choice if they wanted to regain access to their data. So, let’s shift the focus to what local government organizations can do to make sure they are in a position to have a choice.

Step 1: Ensure a Proper Cyber Mindset
If it’s not clear by now, it should be: Attackers are focused on local governments as attractive ransomware targets. Local governments are viewed as soft targets because of constrained IT budgets and staff. This results in many government organizations operating on antiquated IT infrastructure, which has a higher risk profile than current technologies. Therefore, local government organizations must adopt a mindset of “it’s not if, it’s when” and to think in terms of cyber resilience. That is, “When I get attacked, how can I recover rapidly and with minimal disruption?”

Step 2: Do the Basics
We hear a lot about how local government organizations don’t have the resources they need or want, and that’s true. However, that isn’t an excuse for not doing the basics. Patching your systems on a timely basis can reduce your attack surface. Please, please, please back up your data. There is no excuse for not backing up your data, and it’s the only 100% effective mitigator against ransomware risk. In the case of Riviera Beach, if the city had no choice but to pay the ransom to get its data back, this suggests it didn’t have a proper data backup strategy in place. An effective backup strategy includes identifying what data needs to be backed up and setting a backup frequency that makes sense based on the criticality of the data. Patching and backing up data should be at the top of your priority list.

Step 3: Use and Share Threat Intelligence
Today’s threat landscape requires a broad view of threat actor activity. The days of relying on the intelligence in your exiting security controls are in the rearview mirror. There is a perception that threat intelligence is beyond the scope of local government organizations; however, this isn’t the case anymore. An easy first step is to become part your industry threat sharing community, which in the case of local governments is the Multi-State Information Sharing Analysis Center (MS-ISAC) and the Elections Infrastructure ISAC.

Step 4: If You Don’t Have Cyber Insurance, Get It
Cyberattacks are going to happen. Given that, there’s no excuse not to have cyber insurance as a way to mitigate the financial costs of recovering from a cyberattack. Also, when you buy cyber insurance or if you already have it, make sure you take advantage of all the benefits you get with your policy. For example, many cyber insurance providers provide a range of complimentary cyber protection technologies and services as a component of their cyber insurance policies.

Step 5: Accelerate Your Move to the Cloud
In the private sector, there is no longer debate about the security of the cloud. Organizations are accelerating their move to the cloud, shifting IT infrastructure to cloud providers like Amazon Web Services, Microsoft Azure and Google, and increasing their use of software-as-a-service. Cloud-based backup services are also heavily used today (hint, hint). Increasing the use of cloud computing is an excellent way for resource constrained government organizations to reduce cyber-risk, ensure your IT is operating on a modern infrastructure, and reduce costs. With the cloud, the cybersecurity responsibility for the infrastructure shifts to the cloud provider. I don’t think it’s a leap to suggest that cloud providers like Amazon, Microsoft, and Google have more security resources than local government organizations do. It’s important to note that moving to the cloud does not shift all of the security burden to the cloud providers. Security in the cloud is a shared model, so while infrastructure security is handled by the provider, it’s still your responsibility to secure your applications and data.

Related Content:

Todd Weller, Chief Strategy Officer at Bandura, works with large organizations in acting on their threat intelligence to prevent future attacks. He brings over 20 years of cybersecurity industry experience with a unique blend of operational and hands-on proficiency. He … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/how-to-avoid-becoming-the-next-riviera-beach/a/d-id/1335033?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

  • 25/06/2019
  • adm

AWS Makes Control Tower & Security Hub Generally Available

Security Hub aims to manage security across an AWS environment; Control Tower handles security and compliance for multi-account environments.

AWS re:Inforce – BOSTON – At its first AWS re:Inforce conference, Amazon Web Services announced general availability for AWS Security Hub and AWS Control Tower. The services are intended to handle security and compliance across a single AWS environment and multi-account environments, respectively.

AWS Security Hub, first debuted in November 2018, is a platform built to help companies monitor and prioritize security issues across an AWS environment. The platform aggregates and categorizes alerts from several AWS services (GuardDuty, Inspector, Macie) along with a network of products from AWS partners: Alert Logic, Check Point, CrowdStrike, Palo Alto Networks, Rapid7, IBM, McAfee, and others.

Security Hub clients can run automated compliance checks according to their industry standards and practices to identify accounts and resources that need to be investigated. The idea behind this is to give users a single place to view their AWS security and compliance state, AWS says in a release on the news.

Control Tower is intended to help customers set up and govern secure and compliant multi-account AWS environments. Customers have an automated “landing zone,” or preconfigured setup with predefined rules for security, operations, and compliance. Organizations moving to AWS often need to manage several accounts across distributed teams; Control Tower helps cloud teams automatically deploy a single environment where teams can provision accounts.

Learn more about Security Hub here and Control Tower here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/cloud/aws-makes-control-tower-and-security-hub-generally-available/d/d-id/1335048?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

  • 25/06/2019
  • adm

Microsoft Adds New Secure Storage Area to OneDrive

PersonalVault locks down files with MFA and encryption.

Microsoft has added a new feature to OneDrive for storing sensitive files in a folder that uses two-factor authentication and encryption both at rest and in transit. 

The new PersonalVault folder in OneDrive is geared for storing personal files such as passport, tax, insurance, and financial information. It will be available by the end of the year, according to Microsoft.

“For further protection on mobile devices, we recommend that you enable encryption on your iOS or Android device. Together these measures help keep your files protected even if your Windows 10 PC or mobile device is lost, stolen, or someone gains access to it,” Microsoft said in its blog announcing PersonalVault.

Read more here.

 

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/cloud/microsoft-adds-new-secure-storage-area-to-onedrive/d/d-id/1335051?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

  • 25/06/2019
  • adm

Global Cyberattack Campaign Hit Mobile Carrier Networks

A nation-state group possibly out of China has attacked cell carrier networks in search of data on high-value individuals.

A global cyberattack campaign believed to be the work of a nation-state group has hit telcos and mobile carriers around the world in an effort to gather intelligence on specific individuals.

The attackers stole files that show the communication history and travel patterns of a targeted individual, according to a new report by Cybereason. The attack campaign has been active since at least 2017, with some evidence going back as far as 2012, and has been incredibly effective in giving the attackers control of the victim’s networks.

Some hundreds of millions of telecommunications customers and thousands of the providers’ employees have been affected by the attack campaign.

“They had complete control of the network and were, in effect, the shadow IT group for the [victim] company,” says Amit Serper, senior director, head of security research for Cybereason Nocturnus, which today published a report on the attacks by Serper, Mor Levi, and Assaf Dahan, called “Operation Soft Cell — A Worldwide Campaign Against Telecommunications Providers.”

The attack began with a malicious Web shell sitting on a Web page. When a targeted employee visited that page, reconnaissance began. “They would compromise the network, do a credential dump, scan the network, and hop from server to server,” Server says of the attack. “Finally they were able to get domain admin credentials. They were then able to create their own accounts, some of which were domain admins themselves.”

Once the attackers had control of the company’s servers, they went after call detail records (CDRs). With data in a CDR, the attacker could get information on the source, destination, and duration of calls; device details; physical location of the caller (because of the cell tower they were communicating with); and the device vendor and version they were using.

The attackers weren’t looking for the call data for everyone — just for a few, very specific individuals. “When I when I think about how espionage has been carried out in the past, it makes perfect sense that a well-funded nation state would undertake what would seem like a very extensive campaign for a relatively narrow set of targets,” says Tim Erlin, vice president of product management and strategy at Tripwire.

That strategy of using the supply chain to perform espionage on companies and individuals isn’t new. But it is likely to grow in importance and frequency, says, Lavi Lazarovitz, cyber research group manager at CyberArk. He says that advanced persistent threat (APT) groups, like the one presumed to be behind this attack, have the skills and patience to pursue a target indirectly rather than being forced to be direct with their efforts.

That patience came into play in this campaign when the attackers were discovered in the telco networks. They simply changed tools and techniques, and resumed their work of gaining records for targeted individuals.

Serper says that his worries go beyond the espionage aspects of the attacks. “If they have ability to do this, they have the access level to perform sabotage on the network,” he says. “The cell network is critical infrastructure, so that really worries me.”

As for identifying the “they” involved, the report is careful to point out that attribution can be difficult. But the researchers say the threat actor here is likely affiliated with China, and Serper says the APT10 group is the most likely actor. Even so, “The tools used were not brand new tools; they were exposed by other companies or even open source, so if another group wanted to use them and make it look like APT10 was doing something, they could.”

His take: “It’s either APT10 or someone trying to make it look like APT10.”

There’s nothing the average consumer or organization can do to defend themselves short of making drastic changes to their mobile use patterns, he says.

For the mobile providers, defense comes down to visibility into the network and greater network control and segmentation. “I was surprised at the extent and the length of the campaign as reported,” says Erlin. “I mean, it’s a long time for this type of activity go undiscovered or un-analyzed.”

Lazarovitz points to the lateral movement that allowed the attackers to get from desktop computers to servers holding personal information. “There should be another hop here into a more sensitive and secure network,” he points out.

Related Content:

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and … View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/global-cyberattack-campaign-hit-mobile-carrier-networks-/d/d-id/1335052?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

  • 25/06/2019
  • adm

AWS CISO Talks Risk Reduction, Development, Recruitment

Steve Schmidt says limiting access to data has dramatically changed the security posture across Amazon Web Services.

AWS re:Inforce – BOSTON – Enterprise cloud adoption has ramped up in the 12 years Steve Schmidt has worked with Amazon Web Services (AWS), but he says the threat landscape hasn’t changed much. Businesses have simply become more aware of the many risks they face.

“The biggest risk to most organizations, large or small, still tends to be people,” he said in an interview at AWS re:Inforce, its inaugural cloud security conference, held this week in Boston.

To mitigate this risk, Schmidt launched an initiative within AWS to radically reduce employees’ access to data by 80%. This was a large number, he noted, and one he partly chose to raise eyebrows – and partly because of its effectiveness. Reducing data access by 10 or 20 percent wouldn’t have had the same effect; an 80% cut forced investment in security tools.

“Reduction in human access to data is probably the single biggest lever we have as a company to reducing overall risk profile,” he said. This “dramatically changed” its security posture and had the unexpected benefit of improving job satisfaction for engineers who disliked maintaining machines and doing the same daily tasks. Less data access prompted a shift to automation, which freed time to build projects they cared about and boosted recruitment and retention.

Employees’ level of data access should be a key security concern for any company, but Schmidt also pointed out how cloud concerns often vary depending on the size and age of an organization. Startups, for example, are most interested in fast and secure growth. They want to know, “how do I build this quickly, inexpensively, and securely from the beginning?” he said. They’re more willing to rapidly adopt new things than larger firms, with less retrofitting later.

Larger enterprises are different in the sense they can afford security teams and are more willing to customize, he explained. There’s an acceleration curve here: The first system they deploy to the cloud may take a while, but from there they can quickly pick up the pace of adoption.

Middle-tier companies need the most direction to effectively achieve their cloud security goals, Schmidt continued. While they want to securely transition from on-prem systems to the cloud, they often lack resources and security engineers. “There’s not a lot of IT staff, but they want to get rid of on-prem,” he said. “They need prescriptive guidance on how to implement security.”

On Building Secure Code
Schmidt’s team does an application security review on every service AWS launches – no small feat considering new projects roll out daily. Application security is the place to enforce good security practices in alignment with service and design, he explained. The industry needs it.

Security pros who understand the problem of secure development realize it’s better to get dev teams thinking about security and preventing crummy code than trying to unravel the mess they made afterward, he explained. AWS uses an internal automated code analysis platform in lieu of peer-to-peer code reviews, which involve security teams hunting code errors after the engineers had developed it. The code reviews were a frustrating process, he explained, as they required the engineers to learn all the errors at the same time, and then go back and correct them.

AWS’ tool builds “natural peer feedback processes” into the software development life cycle, Schmidt said. It provides a code review while engineers are developing, so they view mistakes as they happen and receive immediate feedback. The result is a smoother dev process.

Security: Not Just for the CISO
As Schmidt put it in his morning keynote: “Security is everyone’s job. It’s not just the job of every security pro in this room today.” At the end of each week, a group of AWS executives, including CEO Andy Jassy, sit down and review the week’s security issues.

“That’s his opportunity to reinforce to everyone that security is job zero,” Schmidt said. What’s more, the heads of each individual AWS service are responsible for that service’s security. The AWS board is also involved in security, he added, with conversations at least every quarter.

But finding people to staff the security team is tough. Recruitment is the most challenging part of the CISO role for Schmidt, who joined AWS from the FBI in 2008. Right now, referrals are the most efficient means of recruitment. AWS employees are often the first-level filter for candidates. “They know if this person will fit in the team,” he said. AWS has also been successful with military recruiting, which has brought skilled pros into its environment.

“There are not enough qualified security engineers out there,” he said, pointing to a lack of university graduates. Modern curricula are outdated and needs to be updated with current technologies and methodologies, Schmidt added, and people should have the opportunity to learn security in the way they learn best if cybersecurity is going to fill the talent gap.

“People have different learning styles,” he said. “Some excel in a university environment; some people improve by hands-on doing.”

Related Content:

 

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance Technology, where she covered financial … View Full Bio

Article source: https://www.darkreading.com/cloud/aws-ciso-talks-risk-reduction-development-recruitment/d/d-id/1335053?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

  • 25/06/2019
  • adm

Cop awarded $585K after colleagues snooped on her via license database

Human Rights Watch estimates that since 2009, there have been at least 14 federal lawsuits filed over cops’ misuse of their access to personal data – think state driver’s license databases – to snoop on fellow officers, public safety personnel, and justice professionals.

Others put the number far higher: in Minnesota alone, there have been dozens of these suits.

On Wednesday, a rare win in one of those cases happened when a jury awarded Minnesota police officer Amy Krekelberg $585,000, including $300,000 in punitive damages from two defendants who pawed through her personal data to ogle her photograph, address, age, height, and weight after she allegedly rejected their romantic advances, according to court documents.

According to Wired, two of Krekelberg’s lawyers, Sonia Miller-Van Oort and Jonathan Strauss, say that their client suffered…

…harassment from her colleagues for years as the case proceeded, and that in at least one instance, other cops refused to provide Krekelberg with backup support. She now works a desk job.

Not her first win

This isn’t Krekelberg’s first court win. In 2017, the city of St. Paul, Minnesota, awarded her $29,500 over charges of snooping. In fact, Krekelberg’s federal lawsuit initially named officers and employees from more than 40 law enforcement agencies and entities in Minnesota, saying they accessed her private information nearly 1,000 times from 2003 to 2013.

Krekelberg alleged that 58 fellow officers from the Minneapolis Police Department broke a federal privacy law by searching for her driver’s license data without any reason. She had never been under investigation for any crime. According to Human Rights Watch, Krekelberg’s attorneys “portrayed the searches for her data as a failure by officers to respect a female colleague and part of a broader climate of hostility and harassment toward female officers.”

As Human Rights Watch notes, the federal Civil Rights Act prohibits sex discrimination, however, the relevant law in Krekelberg’s case is Minnesota’s Driver Privacy Protection Act, which, according to Minnesota Lawyer, has resulted in a “staggering” number of privacy lawsuits filed against Minnesota cities, counties, agencies, named police officers and John Does for abusing the state’s driver’s license database to snoop on people, allegedly without legitimate reason.

In a statement issued on Friday, Sarah St. Vincent, a researcher at Human Rights Watch who observed the trial, said that this is why we need strong rules and procedures in place to keep police from abusing their data access:

The Minnesota case shows that without strong protections, police officers may abuse their data access – even by invading the privacy of their fellow officers, particularly women. As Congress and the states consider adopting stronger data protections, they should limit what police can do with personal information.

The snooping – coming mostly from over-curious cops who looked at photographs, addresses and driving records of dozens of Minnesotans, many of them local celebrities – first erupted into scandal in 2012, when another policewoman, former St. Paul police officer Anne Marie Rasmusson, received $1,057,000 in settlements, including $392,500 from the city of Minneapolis.

As we reported at the time, internal audits and investigations revealed that officers had taken to treating the state’s driver license database as a kind of Facebook, using it to look up colleague Rasmusson hundreds of times.

There have been dozens of similar lawsuits against Minnesota cities in recent years, according to Wired. There are good reasons for that: the state has a rare accountability measure – it keeps a log of department of motor vehicle (DMV) searches – and it grants citizens the right to request the data the government collects on them. So that’s what Krekelberg did: following in Rasmusson’s footsteps, she dug into the trail of evidence that enabled her to build a case.

Minneapolis: It takes data privacy “seriously”

Wired talked to Susan L. Segal, the Minneapolis city attorney, who said that while the verdict is disappointing, the city takes data privacy “very seriously.” She said that the police department’s policies have changed in recent years, in that Minneapolis employees are now required to enter a reason when they search DMV records.

Previously, officers learning how to use the database were encouraged to “go back to work and look up some of [their] friends and family members,” Segal said.

Segal told the Associated Press that the city is exploring its options for challenging the verdict.

This is the last of this series of Driver Privacy Protection Act cases involving the city. The allegations in these cases involve lookups that happened many years ago, and the city and the police department in particular have taken many measures since then to make sure that we are protecting data privacy.

Your wallet, please, citizen

While policies may have evolved to reflect a growing realization that data access can be, and has been, abused, it remains to be seen how officers who break the law will be held accountable.

In the Rasmusson case, Eden Prairie Sergeant Carter Staaf reportedly accounted for 13 direct look-ups over the years, admitting in an investigation that he looked her up to compare photos to see how Rasmusson looked in before-and-after driver’s license photos.

His penalty, a demotion and five-day suspension, was the harshest to result from the inquiry. Others had letters of warning placed in their files and were sent to retraining.

Are those strong enough penalties to help curb the prurient side of human nature?

You’d certainly hope so, if not for the sake of people’s privacy, then for the sake of everybody’s wallets. After all, as taxpayers point out when these verdicts are passed down, these fines aren’t coming out of the pockets of the police or other government employees who break the law.

Taxpayers not only pay those fines; we also pay the salaries of the city employees while they do all this ogling.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/fGCU_0rhQdM/

  • 25/06/2019
  • adm

Government agencies still send sensitive files via hackable .zips

We – as in, both the public and private sectors – are under the delusion that emailing content as password-protected .zip files is a secure way to share files, Senator Ron Wyden said in a letter sent to the National Institute of Standards and Technology (NIST) on Wednesday.

That’s just one of the non-secure ways that government agencies are sharing sensitive data, he said, because they don’t know how else to do it.

Government agencies routinely share and receive sensitive data through insecure methods – such as emailing .zip files – because employees are not provided the tools and training to do so safely.

That’s where you come in, Wyden said in the letter to NIST Director Walter G. Copan, asking that NIST come up with guidance on how to safely share sensitive documents with others over the internet. We need some help, Wyden said, given that it’s commonly thought that passwords protect .zip files… which they don’t.

Wyden noted that off-the-shelf hacking tools can be used to easily break into password-protected .zip files, since…

… many of the software programs used to create .zip files use a weak encryption algorithm by default.

But it’s password protected!

Wyden’s absolutely right, concurred Matthew D. Green, a cryptography associate professor at Johns Hopkins University. As he said in a Twitter thread, on many old versions of Windows, when you password-protect/”encrypt” a Zip file with the operating system’s default utility, it’s done with the crusty, old, broken legacy scheme.

Green referred to a known plaintext attack on the PKZIP stream cipher. That scheme is the default Zip encryption algorithm on Windows XP and current versions of MacOS, Green said. Microsoft removed it on more recent versions of Windows Home.

Even if you use a modern Zip utility, “you’re still dealing with modestly crummy crypto,” he said. And that’s the dusty, fusty old junk with which government employees are emailing sensitive data with:

We cryptographers are arguing over PGP key sizes. Meanwhile government employees are emailing each other documents encrypted with a cipher that was handily broken in the 90s.

It’s proposal time

Green welcomed Wyden’s request, saying that it presents a…

… huge opportunity for smart people in this field to come up with something much better.

Adam Langley, a senior staff software engineer for Google who works on its HTTPS serving infrastructure and Chrome’s network stack, agreed. He said this could be a fine chance for NIST to get some new thinking with regards to secure file sharing:

I hope they ask for proposals. There are a number of valuable ideas in this space (Firefox Send, minilock, probably Filippo has something).

We’re at risk if we don’t do something

It’s bad enough that the government has to contend with hostile states cyber-stalking the government and cyber-targeting US infrastructure.

We shouldn’t also be using broken encryption schemes and leaving sensitive data vulnerable by insecure file-sharing workflows. It leaves us open to yet more data breaches and cyber attacks. From Wyden’s letter:

The government must ensure that federal workers have the tools and training they need to safely share sensitive data.

To address this problem, I ask that NIST create and publish an easy-to-understand guide describing the best way for individuals and organizations to securely share sensitive data over the internet.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/GUVefxhuBvg/

  • 25/06/2019
  • adm

Presidential text alerts are open to spoofing attacks, warn researchers

Researchers have shown that it’s technically possible for hackers to target the US presidential alerts system to send fake messages on a localised basis.

For anyone who can’t remember what these are, the Federal Emergency Management Agency (FEMA), which manages the system, sent a message to US 200 million mobile users designed to test the Wireless Emergency Alerts (WEA) system at 2:18 pm (ET) on 3 October 2018. It read:

Presidential Alert. THIS IS A TEST of the National Wireless Emergency Alert System. No action is needed.

Judging from Twitter responses and a legal challenge, not all Americans were pleased at the idea of being sent a text message of up to a 90-characters by the US President that they can’t opt out of or block, but it did achieve its purpose of publicising an unfamiliar element of the system.

Launched in 2006, there are in fact three types of Integrated Public Alert and Warnings System (IPAWS) alerts, the other two being Imminent Threat Alerts (usually weather or fire-related) and Amber Alerts used to tell people about missing or abducted children.

Emergency alerts also have the potential to go badly wrong, as millions of Hawaii residents discovered on 13 January 2018, when they received the following terrifying message at 8:07 am:

Emergency alert. Ballistic missile inbound to Hawaii. Seek immediate shelter. This is not a drill.

As people crawled under café tables in fear, it took 38 minutes for the authorities to confirm that the message was a false alarm caused by human error.

Cascades of panic

Intrigued by such events, researchers at the University of Boulder wondered to themselves whether it might be possible for hackers to sow chaos by generating similar entirely fake alerts.

Worryingly, in their paper, This is Your President Speaking: Spoofing Alerts in 4G LTE Networks, they have demonstrated that it is, at least for specific locales.

The fundamental weakness is that with a bit of effort it’s eminently possible to set up rogue cell towers (from 3G onwards called Evolved Node Bs or ‘eNodeB’ for short) which can be used to send spoof messages.

The authentication weaknesses that make this possible are complex but can be abused either by allowing mobile users to connect to the rogue tower, or by routing messages from a rogue tower through a genuine base station.

The researchers were able to build their hack using a software-defined radio, a modified version of some open source libraries, and four malicious bases with only 1Watt of transmit power each.

This would be good enough to target a stadium of 50,000 people with a 90% success rate across any one of the US’s largest four mobile networks.

The effect would, therefore, be limited to relatively small areas but would be simple to pull off in key locations:

Fake alerts in crowded cities or stadiums could potentially result in cascades of panic.

How might this be countered?

One solution would be to replace or upgrade cell base stations but that would be expensive and complex and take years to complete.

Another possibility for presidential alerts specifically would be to add digital signatures to messages although creating an interoperable system based on such an idea would require fiddly key management.

The researchers reason that the simplest patch might be to implement base station authentication by the devices themselves.

It’s not hard to imagine how enemies of the US might abuse presidential alerts to alarm or confuse its citizens at important moments. It’s also possible that debunked fake spoofing might cause many Americans to stop paying attention to genuine alerts.

In fact, at least one hacking attack has already happened in the US, the absurd ‘zombie apocalypse’ incident that happened in Montana in 2013. That used the medium of TV rather than mobile/wireless, but the warning was clear – the alerting system makes an inviting and vulnerable target.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/VBUscg3H4yw/

  • 25/06/2019
  • adm

WeTransfer sends user file links to wrong people

Popular file transfer service WeTransfer faces embarrassment this week after admitting that it has mailed file links to the wrong users.

Founded in 2009, WeTransfer enables users to transfer large files between each other for free. It’s an alternative to email services, which typically place limitations on file size. It has 50 million users sending a billion files each month, amounting to a Petabyte (1,000 Terabytes) of data.

The service, which became profitable in 2013, provides its free version through an advertising model. It also offers a paid ‘Plus’ service that lets users password protect their files.

On 21 June 2019 WeTransfer posted a security notice warning of an incident it had discovered five days earlier on Monday 17 June 2019.

The issue began on 16 June 2019, the notice said, adding:

e-mails supporting our services were sent to unintended e-mail addresses. We are currently informing potentially affected users and have informed the relevant authorities.

WeTransfer had blocked the links and logged users out of their accounts, it said.

The same day that the security notice appeared, Jamie Brown, CEO of fashion site Chicmi, tweeted a direct notification that WeTransfer had sent him:

The scary part:

We have learned that a transfer you sent or received was also delivered to some people it was not meant to go to. Our records show that these files have been accessed, but almost certainly by the intended recipient.

“Almost certainly” won’t exactly fill people with confidence.

Brown told Naked Security that the incident affected a batch of photos that a client had sent him on 16 June 2019. He added:

Thankfully we mostly use WeTransfer for sending and receiving brand photos for use on Chicmi.com – so they’re mostly heading into the public domain anyway, and the worst that might happen is an embargo being broken for an upcoming event.

However I’m sure others are not so relaxed about it, bearing in mind the way the service is used!

Rival service Tresorit was quick to jump on the incident:

While it’s obviously trying to promote its own service, it has a point. End-to-end encryption would stop anyone other than the sender and recipient of a file from seeing it. It would need to be done correctly, though.

The problem with password protecting files is that it’s a form of symmetric encryption, where the sender and recipient of a file use the same secret to access the file. The sender can’t securely send the secret and the file via the same channel because an eavesdropper could intercept both the file and the secret. Instead, they either need to meet in person to share the secret, or share it through an alternative channel like a text message or phone call. This creates its own security and usability issues.

Asymmetric (public key) cryptography is more complex but also more secure because it uses two digital keys for each user – a private (secret) one that is never sent via any channel, and a public (non-secret) one.

The sender of a file uses the recipient’s public key (viewable by anyone) to encrypt it. Only the recipient’s private key can decrypt it. As long as the recipient keeps their private key safe, they can read a message encoded with their public key while keeping it away from eavesdroppers.

As a bonus, the sender can also prove their own identity by encoding the file with their private key as well. Then, the recipient must go through an extra step, decrypting the message with the sender’s public key. That proves that only the sender could have sent the message, rather than an imposter.

The challenge with asymmetric encryption is creating a product that is easy enough to use and hides all that complexity from the user. The upside is that even if the file transfer service messes up and sends your files to the wrong person, they won’t be readable.

As it stands, the free version of WeTransfer doesn’t protect its files with any secrets at all, which is why the email misfire is so problematic.

There are alternative free services offering end-to-end encryption, such as Mozilla’s Firefox Send, officially launched in March 2019 after a two-year test period. This uses the Web Crypto API, which employs asymmetric encryption. It allows you to send files 2.5Gb in size if you have a Firefox account, or 1Gb if you don’t.

WeTransfer declined to answer our questions about the incident yesterday, referring us instead to the security notice on its site.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/X-mszF--whY/

  • 25/06/2019
  • adm