hacking – Page 506 – STE WILLIAMS

What’s Farsi for ‘as subtle as a nuke through a window’? Foreign diplomats in Iran hit by renewed Remexi nasty

library
crime | hacking | security

A newly uncovered spyware-slinging operation appears to have been targeting foreign diplomats in Iran for more than three years.

Researchers at Kaspersky Lab said this week that a new build of the Remexi software nasty, first seen in 2015, has been spotted lurking on multiple machines within Iran, mostly those located within what we assume are foreign embassy buildings. The Windows-targeting surveillance-ware was previously associated with a hacking group known as Chafer, and an examination of the latest strain suggests it is of Iranian origin.

“The malware can exfiltrate keystrokes, screenshots, browser-related data like cookies and history, decrypted when possible,” Kaspersky’s Denis Legezo said of the infection.

“The attackers rely heavily on Microsoft technologies on both the client and server sides: the Trojan uses standard Windows utilities like Microsoft Background Intelligent Transfer Service (BITS) bitsadmin.exe to receive commands and exfiltrate data.”

Curiously, Legezo said he does not yet know how the malware is spreading in the wild, just that it is targeting “foreign diplomatic entities” based within Iran.

“So far, our telemetry hasn’t provided any concrete evidence that shows us how the Remexi malware spread,” we’re told.

“However, we think it’s worth mentioning that for one victim we found a correlation between the execution of Remexi’s main module and the execution of an AutoIt script compiled as PE, which we believe may have dropped the malware.”

Baddies linked to Iran fingered for DNS hijacking’ emails

Once on a victim’s machine, the spyware is very persistent, hiding out in scheduled tasks, Userinit and Run registry keys in the HKLM hive, depending on the version of Windows it has infected. Data is exfiltrated to command and control servers using Microsoft’s bitsadmin.exe transfer utility.

According to timestamps in the malware, its development appears to have been completed in March 2018, though there are a few sections of the code that appear to be much older.

While the exact aim of the malware operation is unknown, Kaspersky researchers believe the attack is part of a domestic espionage campaign that seeks to keep an eye on the activity of foreign diplomats in the renegade Mid-East nation. In addition to targeting foreign embassies, researchers pointed to clues such as the use of Farsi language in encryption keys that suggest Iranian operatives are behind the attack.

Iran has been listed as one of the countries that has been particularly active in its online espionage operations of late. While the regime uses its malware for such things as espionage and surveillance, Iranian groups have gained a reputation for largely focusing on social media campaigns that aim to advance the country’s political interests. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/01/31/iran_embassies_malware/

Team America tries to crash Little Rocket Man’s Joanap botnet from within, warns owners of infected boxes

library
crime | hacking | security

Analysis Uncle Sam has infiltrated and somewhat knackered what it claims is a North Korea-operated botnet of hijacked Microsoft Windows computers.

US prosecutors reckon Park Jin Hyok – a suspected Sony Pictures and WannaCry hacker living in Kim Jong Un’s hermit nation – built and managed the Joanap botnet, a globe-spanning network of commandeered systems, and used it to launch further cyber-attacks on various targets.

Here’s how systems were infected and press-ganged into the botnet, which has been running since 2009, as alleged: first, the Brambul malware, which is a Server Message Block (SMB) worm, infects public-facing boxes, and those on internal networks, via their Windows file-sharing services. It typically brute-forces its way into systems by guessing the necessary password from a list of common passphrases.

Once Brambul is in, it runs the Joanap software nasty, which press-gang the computer into joining the botnet run by its operators, we’re told. Joanap effectively opens a backdoor, allowing the infected computer to be remotely controlled by its masterminds.

Hadoop coop thrown for loop by malware snoop n’ scoop troop? Oh poop

In October last year, the FBI and the US Air Force Office of Special Investigations (AFOSI) obtained a search warrant [PDF] from a California court to infiltrate the botnet, allowing the g-men to analyze and potentially disrupt its operations from within. This also meant the Feds can alert people who have been infected, by monitoring the IP addresses of the systems joining the network. Folks were, or will be, tipped off via their ISPs, or governments, depending on where they are in the world, it is claimed.

This approach is necessary, we’re told, due to the peer-to-peer nature of the Joanap botnet’s communications channels. Devices infected by the malware exchange between themselves so-called peer lists of IP addresses of other infected machines, allowing an ad-hoc network to form. Rather than seizing one or two central command-and-control servers, agents had to therefore add their own systems, masquerading as hijacked devices, to the network, allowing them to observe it by requesting peer lists from hijacked nodes.

A search warrant was needed because it involved scanning people’s computers for network ports opened by Joanap – 80, 110, or 443 – and sending commands to those boxes on an open port requesting their peer lists. The judge allowed the agents to “seize” the following “property,” as a result of that warrant:

The IP addresses of infected machines; the network ports used in their encrypted communications; the commands used to talk to the bot; the pseudo-random string of text used to authenticate one bot to another; the peer lists; system time on the infected machines; and where or not the machines are individually accessible.

Other information, such as system details and configurations, were not allowed to be recorded and kept on file.

Bugs bugged

Interestingly, the g-men had to extend a previous 30-day warrant, granted earlier in 2018, by an extra 30 days due to a bug in their code: the FBI’s machines accidentally told other nodes in the botnet that they were behind a firewall and should be ignored as inaccessible, when really they were accessible. That hampered the Feds’ operation, forcing agents to fix the bug in September and go back to the court to ask for an extension in October.

Essentially, their code that pretended to act as the botnet malware would, as well as request lists, send its own peer list to infected nodes that would contain the IP addresses of the FBI’s servers. These lists would propagate through the peer-to-peer network, causing more infected machines to contact the FBI’s boxes, and thus help agents build up a bigger picture of the scale of the botnet. The aforementioned bug prevented other nodes from accepting the FBI’s list.

The Feds claim they were able to disrupt the botnet, but did not specifically explain how. Presumably, they used the IP addresses in the exchanged peer lists to locate the owners of infected machines and tell them they had been pwned, so the malware could be scrubbed off the boxes, thus reducing the size of the network.

“Computers around the world remain infected by a botnet associated with the North Korean Regime,” Assistant Attorney General John Demers said in announcing progress in the case on Wednesday. “Through this operation, we are working to eradicate the threat that North Korea state hackers pose to the confidentiality, integrity, and availability of data.”

Here’s how US prosecutors explained it in more detail:

The search warrant allowed the FBI and AFOSI to operate servers that mimicked peers in the botnet. By pretending to be infected peers, the computers operated by the FBI and AFOSI under the authority of the search warrant and order collected limited identifying and technical information about other peers infected with Joanap (i.e., IP addresses, port numbers, and connection timestamps). This allowed the FBI and AFOSI to build a map of the current Joanap botnet of infected computers.

Using the information obtained from the warrant, the government is notifying victims in the United States of the presence of Joanap on an infected computer. The FBI is both notifying victims through their Internet Service Providers and providing personal notification to victims whose computers are not behind a router or a firewall. The U.S. government will coordinate the notification of foreign victims by contacting the host country’s government, including by utilizing the FBI’s Legal Attachés.

According to the Feds, Windows Defender Antivirus and third-party anti-malware tools will detect and kill Joanap. Using strong SMB credentials will keep Brambul at bay.

“Our efforts have disrupted state-sponsored cybercriminals who used malware to establish a computer network that gave them the ability to hack into other computer systems,” said US Attorney Nicola Hanna.

“While the Joanap botnet was identified years ago and can be defeated with antivirus software, we identified numerous unprotected computers that hosted the malware underlying the botnet. The search warrants and court orders announced today as part of our efforts to eradicate this botnet are just one of the many tools we will use to prevent cybercriminals from using botnets to stage damaging computer intrusions.”

News of the covert operation comes just one day after America’s head of national intelligence warned that North Korea was among the nations looking to target US government and private sector companies with cyberattacks.

Unlike other nations that seek primarily to gather government and corporate intelligence information, North Korea has sought to use malware and cyber-attacks as a fundraising effort, focusing its efforts on banks and other targets that can be used to fill the isolated authoritarian regime’s coffers. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/01/31/north_korea_joanap_botnet_fbi_warrant/

Massive DDoS Attack Generates 500 Million Packets per Second

library
crime | hacking | security

January 10 torrent involved nearly four times as many packets as last year’s huge attack on GitHub, says Imperva.

Distributed denial-of-service (DDoS) attacks do not have to be bandwidth-intensive to be disruptive and hard to mitigate.

Earlier this month, Imperva mitigated an attack against one of its clients that exceeded 500 million packets per second, making it possibly the largest DDoS attack by packet volume ever recorded.

The January 10 attack was a so-called SYN flood, in which an attacker attempts to overwhelm a target computer by sending it TCP connection requests faster than the machine can process them. In this case, the attacker sent both a flood of normal SYN packets and a large SYN flood, involving packets of between 800 and 900 bytes, at the target using a highly randomized and likely spoofed set of source ports and addresses, according to Imperva.

Attackers often combine these attacks so regular SYN packets exhaust server resources like the CPU, while the larger packets saturate the network, the vendor has previously noted.

Imperva’s investigation of the January attack showed it was launched using two previously known tools — one for the flood of regular SYN traffic and the other for the large SYN attack. The tools appear to have been written by two different individuals and then used in a combined fashion to “launch the most intensive DDoS attack against network infrastructure in the history of the Internet,” Imperva said in a report this week.

Businesses and the media often tend to focus on the size of DDoS attacks, says Tomer Shani, a security researcher at Imperva. “In reality, size isn’t the best reflection of how difficult attacks are to mitigate or how damaging they can be,” he says. “Packets per second (PPS) is actually a better indicator.”

An attack directed at GitHub last year that generated peak traffic of some 1.35 terabits per second is considered one of the largest bandwidth-intensive DDoS attacks ever. The attack garnered a lot of attention at the time and has often been used as an example of the enormous challenges posed by large DDoS attacks.

Mitigation Challenges
But from a mitigation standpoint, provisioning enough network bandwidth can blunt such attacks. DDoS mitigation and protection services these days tend to provision network bandwidth that is far greater than the largest observed DDoS attacks, Imperva said. This has made the sheer volume of an attack less of an issue, according to the vendor.

Dealing with attacks involving very high PPS, on the other hand, is harder because of the compute processing power required to evaluate every packet. Often the limiting factor for the network routers, switches, and mitigation appliances that service providers use to mitigate DDoS attacks is the packet rate and not the packet size, Imperva said in its report. Mitigating high PPS attacks require significantly more processing capabilities than available on most of the network appliances that are used to route or switch a packet, the vendor noted.

“Organizations provision for capacity, so that’s why size is the standard metric when measuring DDoS attacks, but organizations should be more concerned about attacks with high PPS,” Shani says.

In the GitHub attack, for instance, the DDoS traffic consisted mainly of large packets sent from the same port from different servers at a relatively low PPS rate of around 129.6 million. In comparison, the attack that Imperva encountered this month involved nearly four times the volume of packets being sent from random sources.

“High PPS attacks are harder to generate because they require more compute resources, in the same way they take more compute resources to mitigate,” Shani says. “Organizations should be more concerned about attacks with high PPS.”

Ashley Stephenson, CEO of Corero Network Security, says the impact of a DDoS attack ultimately depends on the vector and the vulnerability of the targeted organization. In the right circumstances, both high bandwidth and high PPS DDoS attacks can be equally devastating. “It is not possible to predict in advance how a multivector DDoS attack will evolve,” he says. Different vectors deliver different mitigation challenges.

For instance, “high PPS attacks do not saturate links as frequently as high [bandwidth] attacks,” Stephenson says. “High [bandwidth] attacks often cause more collateral damage to innocent bystanders as they are crowded out by the resulting congestion.”

Related Content:

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/massive-ddos-attack-generates-500-million-packets-per-second/d/d-id/1333766?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Rubrik Data Leak is Another Cloud Misconfiguration Horror Story

library
crime | hacking | security

A server security mishap exposed vast stores of data belonging to clients of Rubrik, a security and cloud management firm.

Rubrik, an enterprise software company focused on cloud data management, has been exposing data related to major customers, due to a misconfigured AWS Elasticsearch server.

Security researcher Oliver Hough discovered the data, according to TechCrunch, which first reported the news. Rubrik was alerted to the issue on Jan. 29 and took the server offline. Because the server lacked password protection, anyone who knew its location could access it.

The exposed information reportedly dates back to Oct. 2018, timestamps indicate. Rubrik officials report that other than Hough, no external parties accessed the environment. However, the server was indexed on Shodan, a search engine for the exposed devices and databases.

Data leaks due to misconfigured servers are common and the industry has seen many in recent years. Yet it’s ironic to see this happen at Rubrik, an enterprise company providing data services.

California-based Rubrik recently raised $261 million in Series E funding at a $3.3 billion valuation, Forbes reported earlier this month. This more than doubled its last raise in April 2017, when it was valued at $1.3 billion. It has thousands of major clients; among them the US Department of Defense, UK National Health Service and Homeland Security, Deloitte, and Shell.

Rubrik’s full roster of corporate clients, and some federal government departments, was in the database. In a disclosure on the incident, cofounder and CTO Arvind Nithrakashyap says the data repository included customer names, business contact information, and support requests, in addition to customer support chats. He confirmed no customer-owned data was exposed.

“While building a new solution for customer support, a sandbox environment containing a subset of our customer corporate contact information and support interaction data was potentially accessible for a brief period of time,” a Rubrik spokesperson said.

An investigation found that the cause was developer error, Nithrakashyap said. The sandbox development data repository defaulted to a lower security access level; Rubrik failed to follow its security procedure to correctly set the access control. It has since rectified the issue and rolled out multiple levels of approvals and security reviews to ensure it doesn’t happen again.

A Trend Poised to Continue

If it doesn’t happen at Rubrik, it’s likely to happen somewhere else, says Terry Ray, senior vice president and Imperva fellow, who predicted these incidents would continue. In the day since the Rubrik discovery went public, the State Bank of India was found to have made a similar error. An unprotected server left millions of customers’ balances and transactions exposed.

“What we’ve seen — and continue to see — is companies are accelerating their use of technologies more than they’re enabling their teams or hiring effective people,” he says. This isn’t a breach, he points out. It’s a simple misconfiguration that should have been properly set.

This should be the first thing you do; an obvious step, says Ray. The first question admins should ask is “How am I preventing anybody else from connecting to this system?” Shodan scours the Web for public information, most of which tend to be Internet-accessible data lakes. The problem of misconfiguration is generally more common at large companies than smaller ones, where “everyone can look at everything.”

“The bigger the company, the harder it is to maintain process,” Ray adds.

So why do these incidents keep happening? Part of the problem is the complexity of multi-cloud environments, says Ratinder Ahuja, cofounder and CEO at ShieldX. Businesses have traditionally depended on a set of boundary controls for data centers. Now they’re embracing public and private clouds, making the boundary protecting their data increasingly more elastic.

“You need to have visibility inside these environments,” he continues, and the key is understanding your risks and implementing controls to mitigate them. He recommends a layered approach: starting with a set of operating principles and backing them up with compensating controls in case they’re not followed. In the Rubrik case, a database was created and customer information was stored, but no controls protected it from public access.

Without question, Ray says, the environments in which employees and admins operate is significantly more complex than it was five years ago. The evolution of IT is creating a high-risk environment for organizations with limited expertise on their tech staff, he notes.

Ray also points to a lack of education in organizations, where not everybody who works with data understands its value. When you’re in a bank, you understand the value of cash when you see it. People who work with diamonds know value when they see it. But oftentimes it’s hard to grasp the value of sensitive data or the consequences that could occur if it were exposed.

“[They] need education to understand the criticality of handling data,” he says. Help employees understand where the data is and the type of data they’re responsible for protecting.

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance Technology, where she covered financial … View Full Bio

Article source: https://www.darkreading.com/cloud/rubrik-data-leak-is-another-cloud-misconfiguration-horror-story/d/d-id/1333767?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Justice Dept. Alerting Victims of North Korean Botnet Infections

library
crime | hacking | security

US officials disrupt North Korea’s Joanap attack infrastructure.

The US Department of Justice today announced that it is notifying US victims whose computers are infected with malware used by North Korea to build out its massive Joanap botnet.

Joanap is a major attack infrastructure used by North Korea for cyberattack campaigns. The botnet is made up of Windows-based machines worldwide.

“The search warrants and court orders announced today as part of our efforts to eradicate this botnet are just one of the many tools we will use to prevent cybercriminals from using botnets to stage damaging computer intrusions,” said United States Attorney Nick Hanna.

The search warrant gave the FBI and Air Force permission to sinkhole infected machines and map the botnet’s scope. The FBI also is working with foreign governments to alert victims in their countries.

Ep. 017 – DNS hijacking, a weird breach and a cybersecurity confession [PODCAST]

library
crime | hacking | security

In this episode, we dig into a US Emergency Directive to stop government sites getting hijacked, examine a data breach with a difference, and hear a cybersecurity expert’s confession of how his Instagram got hacked.

With Anna Brading. Paul Ducklin, Mark Stockley and Matthew Boddy.

This week’s stories:

The social network advice we refer to in the podcast:

If you enjoy the podcast, please share it with other people interested in cybersecurity, and give us a vote on iTunes and other podcasting directories.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/It8AjXUqsuY/

Furious Apple revokes Facebook’s enty app cert after Zuck’s crew abused it to slurp private data

library
crime | hacking | security

Facebook has yet again vowed to “do better” after it was caught secretly bypassing Apple’s privacy rules to pay adults and teenagers to install a data-slurping iOS app on their phones.

The increasingly worthless promises of the social media giant have fallen on deaf ears however: on Wednesday, Apple revoked the company’s enterprise certificate for its internal non-public apps, and one lawmaker vowed to reintroduce legislation that would make it illegal for Facebook to carry out such “research” in future.

The enterprise cert allows Facebook to sign iOS applications so they can be installed for internal use only, without having to go through the official App Store. It’s useful for intranet applications and in-house software development work.

Facebook, though, used the certificate to sign a market research iPhone application that folks could install it on their devices. The app was previously kicked out of the official App Store for breaking Apple’s rules on privacy: Facebook had to use the cert to skirt Cupertino’s ban.

“We designed our Enterprise Developer Program solely for the internal distribution of apps within an organization,” said Apple in a statement.

“Facebook has been using their membership to distribute a data-collecting app to consumers, which is a clear breach of their agreement with Apple. Any developer using their enterprise certificates to distribute apps to consumers will have their certificates revoked, which is what we did in this case to protect our users and their data.”

With its certificate revoked, Facebook employees are reporting that their legitimate internal apps, also signed by the cert, have stopped working. The consumer iOS Facebook app is unaffected.

Trust us, we’re Facebook!

At the heart of the issue is an app for iPhones called “Facebook Research” that the company advertised through third parties. The app is downloaded outside of the normal Apple App Store, and gives Facebook extraordinary access to a user’s phone, allowing the company to see pretty much everything that person does on their device. For that trove of personal data, Facebook paid an unknown number of users aged between 13 and 35 up to $20 a month in e-gifts.

Europe taps Facebook, Google, Twitter on the shoulder. So about those promises to stamp out lies, bots, dodgy ads?

The VPN-based app is similar to one Facebook used to offer called Onavo Protect, which also logged and forward user activity to Facebook, but that app was specifically banned by Apple last year over privacy concerns.

Facebook wasn’t able to get a similar app approved due to changes in Apple’s rules, and so it used the aforementioned enterprise certificate program, run by Apple, that is only for internal-use apps to get around the restrictions, an investigation by TechCrunch this week revealed.

In Facebook’s case, it knowingly broke those rules by encouraging third parties – including children – to download the app and use it. And it paid them to do so. And then, as its activity was exposed, embarked – yet again – on a series of half-truths and lies rather than acknowledge what it was really doing.

Here are just a few of them:

Facebook said it was pulling its app in response to criticism. Whereas in fact Apple revoked its certificate due to breaking the terms of the program, and so Facebook had no choice but to end it.
Facebook claimed that parental consent was received by every user under the age of 18 that had downloaded and installed the app. Whereas in fact there was no check on whether that parental consent was real: two kids with two phones would be able to confirm an account. It was literally a check-box exercise.
Facebook claimed that it was open about its app, that it was obviously monitoring the users’ online activity from the description of the software, and pointed to the fact it was called “Facebook Research” as evidence. Whereas in fact users were approached through third parties, and Facebook’s involvement was hidden until after users started the sign-up process.

Here come the regulators

Meanwhile, the news has caught the attention of a US lawmaker. Senator Ed Markey (D-MA) is furious that Facebook “has been offering teens financial compensation for access to vast amount of those minors’ personal information, including personal messages, web history, and photos.”

He vowed on Tuesday to reintroduce legislation – which was termed the Do Not Track Kids Act – in order to update privacy laws and make it illegal for companies to pay children to hand over their private data.

“It is inherently manipulative to offer teens money in exchange for their personal information when younger users don’t have a clear understanding of how much data they’re handing over and how sensitive it is,” he said in a statement.

The news that Facebook knowingly bypassed privacy rules to grab teenagers’ person data follow on the heels of revelations that the company knowingly manipulated children into spending their parents’ money without permission while playing games on Facebook.

And following recent changes in its code that were designed to stop independent reviewers from keeping an eye on the company’s controversial political ad service that has been used repeatedly in recent years to spread misinformation during election campaigns.

Facebook has promised in each case to do better. ®

PS: Looks like Google has a similar iOS app to Facebook’s research application, which has also been shut down by Apple.

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/01/30/facebook_apple_enterprise_certificate_revocation/

Access Control Lists: 6 Key Principles to Keep in Mind

library
crime | hacking | security

Build them carefully and maintain them rigorously, and ACLs will remain a productive piece of your security infrastructure for generations of hardware to come.

In an industry of constant, rapid change, an old-school security tool remains an effective piece of an overall security. Access Control Lists (ACLs) that specify precise rules for destinations and protocols allowed or forbidden, are the foundation of firewalls. And while firewalls have advanced to use analysis of packet contents and behavior, ACLs have not gone away.

There are a number of reasons why ACLs endure. The first, and most important, is that they work. ACLs are straight-forward, conceptually simple ways to limit traffic to and from known (or suspected) malicious addresses and to clear traffic to and from addresses known to be acceptable. Next, they play well with others. As Twitter user Frank Barton (@fbarton) wrote in response to a question about ACLs, “…much less cpu intensive than stateful and deep-packet. But…like Ogres, and onions…use layers. If you can block traffic at ACL, then pass remaining to “NGFW” [next-generation firewall] the fw [firewall] has less traffic to inspect.”

As with all security measures, though, how an ACL is deployed will have a major impact on its effectiveness. Of course, precisely how the ACL is programmed will vary from manufacturer to manufacturer, and component to component, but there are key considerations that are true regardless of which device is hosting the ACL. Let’s take a look at the principles to keep in mind to make ACLs an effective (and efficient) part of the overall security infrastructure.

(Image: photon_photo — stock.adobe.com)

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and … View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/access-control-lists-6-key-principles-to-keep-in-mind/d/d-id/1333757?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Discover Issues New Cards Following Data Breach

library
crime | hacking | security

The credit card company reports Discover’s card systems were not involved in the breach, discovered in August 2018.

Discover Financial Services has alerted cardholders to a data breach but has not disclosed the extent of personal information compromised or the number of individuals affected.

The incident was detected by Discover on August 13, 2018, when the company learned user accounts may have been affected in a data breach. It reports the breach did not involve any Discover systems but the company is aware of a possible merchant data breach.

Financial firms are common targets for cybercrime, but this marks the second time in 2018 that Discover reported a security incident affecting users’ credit cards to the California Attorney General, BleepingComputer points out. State law mandates that businesses working with residents must inform the attorney general if a data breach affects users’ information.

In this case, the report states, there were two separate sample breach notifications filed with the attorney general’s office, indicating there could be two collections of credit card data discovered, or two types of cards affected in the attack. Not all affected cardholders were issued a new card and account number.

Yes, You Can Patch Stupid

library
crime | hacking | security

Before you start calling users stupid, remember that behind every stupid user is a stupider security professional.

There are many catchy phrases in the security community referring to users in both grandiose and condescending terms. They are often treated like the gospel, yet they’re often based on a rather myopic view of the subject. This view is typically naive and dangerous when actions are based on those catchy phrases. I will deal with others in future columns, but I want to start with this one: “You can’t patch stupid.” I often hear this phrase during conference presentations, when speakers are trying to be clever about how their technical countermeasures will always be ruined by some stupid user.

There are many things wrong with that phrase. The most important aspect is the actual meaning of “stupid.” “Stupid” is generally defined as showing a great lack of intelligence or common sense. Breaking that down, let’s understand that if you are assuming a fundamental level of intelligence in the use of a computer, you either have to knowingly enforce a minimum level of intelligence or assume there is a barely functional level of intelligence on the part of the users. It is impractical for the average security team to assume that all users have any base level of intelligence.

Regarding “common sense,” you cannot have it without common knowledge. I have found that computer personnel tend to assume everyone has the same base of common knowledge that they have regarding security matters. Unless there is a rather thorough, comprehensive security awareness program in place, no assumption of common knowledge — and therefore common sense — can be assumed.

For these reasons, I say, “Behind every stupid user is a stupider security professional.”

That being said, you do have to assume that users will potentially cause damage, either due to naivete or a mistaken action. You therefore must “patch” your systems and network to account for such potential damage. Awareness and training can help to address the naivete by informing users how to make better decisions. At the same time, you should also implement technology and process that reduce the opportunities for users to be presented with choices where they may make mistakes or to mitigate when they do make mistakes.

For example, you can educate users about phishing attacks and safe web browsing. At the same time, anti-malware software should be implemented to filter out ransomware attacks before they reach the user. Setting system permissions to not provide users with administrator privileges will stop malware from loading on the system, while anti-malware loaded on the clients will stop the damage of the malware should it actually load on the system.

All of this will not completely prevent the possibility of successful malware attacks because there is no such thing as perfect security. However, you are essentially patching potentially damaging user actions by putting an environment around users that prevents the actions from being taken or mitigates the action after they are taken.

I won’t contend that there are no “stupid users.” I am certain that about 3% of users will click on a phishing message that says, “This is a phishing message, and if you click on this message, it will ruin your company.” There are also studies that indicate that around 5% of users cause 90% of damage to organizations, and organizations must deal those users.

However, we know these people exist and there are known ways to proactively mitigate the inevitable actions of these people. That is how you patch “stupid,” and if you’re not doing it, you are stupider than the users.

Related Content:

Ira Winkler is president of Secure Mentem and author of Advanced Persistent Security. View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/yes-you-can-patch-stupid/a/d-id/1333736?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple