STE WILLIAMS

Four years. That’s how long an attacker was in Starwood Hotels’ databases. While “dwell time” — the delay between when a breach begins and when it’s discovered — is an issue across cybersecurity, the unusually long dwell time in the Starwood breach has implications for both Marriott International and the companies watching to learn from.

According to Mandiant, the average dwell time for an attack is 101 days. Though there are few details about the Starwood/Marriott breach, experts say several factors might have contributed to the longer-than-usual dwell time.

According to Avivah Litan, a vice president and distinguished analyst at Gartner who has researched many large-scale breaches, the long dwell time is an indicator that the attackers were nation-state threat actors. “These guys are really good at what they do,” she says. “You know, they’re very stealthy — they hide in places you can’t find.”

In support, Litan points to details contained in the indictments for the Democratic National Convention’s email server breach, which show that the DNC hired a forensic security specialist (“Company 1” in the indictment) to clean up the breach when it was discovered. Despite their efforts, the attackers maintained persistence on the servers and took files for months following the remediation efforts.

And Stephen Moore, chief security strategist at Exabeam, was part of the Anthem Healthcare security team that followed up on the insurance company’s 2015 breach. He says that Starwood’s 2016 purchase by Marriott could easily have increased the time the attackers had inside the network. “That’s a prime moment to attack, and then it would absolutely make things more difficult,” Moore explains. “I could say it would be at least twice as difficult to identify an adversary in the network because there are so many other things going on politically and otherwise.”

For some professionals, the activity going on around the IT department is no excuse. “In my opinion as somebody who works in the field, a month is too long, a week is too long. You should be catching that data is being actively sent from your system to another location that you didn’t authorize in a couple of days tops,” says Jessica Ortega, security research analyst at Sitelock.

The Impact Spreads
Though some have focused on the financial fraud possible with stolen payment card information, Moore says other, more serious consequences are possible from this breach, or any breach in the hospitality industry. “In the past there have been travel-related incidents tied to hospitality that were for intelligence-gathering and espionage,” he says. “There are at least two very heavy-handed adversaries looking to either prosper from us financially or utilize us much like a lamprey attaches to a shark to draw information about who is staying where, who is going where, and which passport numbers were included.”

Moore also points out that a four-year breach isn’t the result of an opportunistic hack. Litan agrees. “Nation-states are interested in hotel data because it gives them really good information on where their targets are,” she says. “If they’re targeting people, there are many different uses for the data, ranging from stealing money to targeting individuals to national cybersecurity implications where they want to manipulate populations for political purposes.”

A Stream Of Breaches
Public response to the Starwood breach has been muted, perhaps because it’s merely the latest in a long line of large data breaches. Breaches continue for a simple reason, Ortega says. “There’s no accountability for these businesses that have data breaches as of right now in the US,” she says. And any possible accountability is merely passed off to others, Litan adds.

“The problem is the CEOs don’t really want to spend extra money on security,” she says. “They want to buy cyber insurance. If you look at Equifax, like they got a $95 million payout from their insurance company. And that’s the way a lot of these CEOs think.” In fact, she explains, “in general, CEOs would rather spend money on cyber insurance than on security.”

There is a regulatory framework that carries the possibility of serious penalty, though no one knows what impact it will have on Marriott.

“There are accountability measures built into the GDPR regulations in the European Union, but those regulations are still relatively new, and we haven’t really seen a large scale or a large enterprise business like this,” Ortega says. “This, if nothing else, will be an interesting test for what actually happens with a large-scale data breach under GDPR. And we’ll get an idea more of future penalties from this experience than we will be able to predict what will happen to Marriott in particular.”

Related Content:

• Dell Forces Password Reset for Online Customers Following Data Breach
• Federal Indictments in SamSam Ransomware Campaign
• Buckle Up: A Closer Look at Airline Security Breaches
• 5 Things the Most Secure Software Companies Do (and How You Can Be Like Them)

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and … View Full Bio

Article source: https://www.darkreading.com/network-and-perimeter-security/starwood-breach-reaction-focuses-on-4-year-dwell/d/d-id/1333411?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Since federal agencies have been connected to the Internet, government cyber activities have focused on protecting government information, operations, and assets against intrusions from cyber threats.

Although this security-driven focus has had beneficial effects, the cyber-threat landscape is moving at a far greater velocity, with a far larger threat landscape, and is growing more complex than federal agencies — or any other organization — can keep pace with. We must now admit that absolute cybersecurity is absolutely impossible. The issue is not whether our defenses will be breached but when they will be.

This is why we must shift from a reactive approach to a more proactive stance. We must place far more attention toward making federal systems and networks resilient — that is, being able to continuously deliver the intended outcome despite adverse cyber events.

There is some good news. Agencies have made progress in their cybersecurity preparedness, which they can continue to build upon. In Accenture’s recent 2018 State of Cyber Resilience survey, federal cybersecurity professionals report that they can now stop 87% of cyberattacks aimed at our systems. In Accenture Federal’s Nature of Effective Defense research, federal respondents also rated themselves as competent or highly competent in 21 out of 33 foundational cybersecurity capabilities that are defined as essential to cyber preparedness. The top five areas respondents feel most confident about are: risk analysis, cybersecurity architecture approach, cyber-incident escalation paths, peer monitoring, and cyber-incident recovery.

There has been legislative progress as well: Last year, President Trump issued an executive order to strengthen the cybersecurity of federal networks and critical infrastructure, and Congress passed into law the Modernizing Government Technology (MGT) Act, which will expand federal IT modernization efforts. In May, the Department of Homeland Security (DHS) released a new cybersecurity strategy that places greater emphasis on building resilience into federal networks. In July, DHS announced the new National Risk Management Center to better coordinate responses to attacks and remediate their impact. And this September, the White House unveiled a new National Cyber Strategy that aims to improve the resilience of federal and critical infrastructures.

While these are all welcome developments, far more progress must be made. In May, a report by the Office of Management and Budget and DHS found that 71 of 96 agencies (74%) have cybersecurity programs that are either at risk or high risk. A Government Accountability Office (GAO) report in September found that agencies have not implemented roughly a thousand recommendations it has made to improve federal cybersecurity. In addition, in the Accenture State of Cyber Resilience survey, federal respondents ranked themselves least competent in several key capabilities, such as: identifying high-value assets and business, designing for the protection of key assets to improve resilience readiness, and cybersecurity investments for key assets.

Getting to cyber resilience requires that agencies think differently about how they build and implement their systems, particularly as they modernize their IT infrastructures. The following six steps, when embedded in agencies’ modernization efforts and done in conjunction with the business process improvements identified by the State of Cyber Resilience survey, will help federal agencies transition to a cyber-resilience posture:

1. Be brilliant at the basics. That includes routine maintenance tasks, such as patches, updates, and access permissions.
2. Embrace the cloud for security. With the cloud, agencies can take advantage of elastic workloads, multizone computing, and multicloud strategies that make it exponentially more difficult for adversaries to find and harm them
3. Implement data-centric security. Techniques such as encryption, tokenization, segmentation, throttle access, marking, tagging, strong identity and access management, and automated access decisions help ensure data security is embedded in day-to-day operations.
4. Demand application security by design. Adopt DevSecOps practices and use automated scanning and testing to continually identify potential vulnerabilities. Consider applying polymorphic coding techniques to constantly shape-shift the application attack surface to frustrate and raise the cost for the adversary.
5. Leverage software-defined networking. Adversaries can’t attack what they can’t find. Software-defined networking enables agencies to constantly shape-shift their networks, sending adversaries on wild goose chases.
6. Engage in proactive defense. Apply artificial intelligence and security automation and orchestration tools to detect and act at machine speed. Constantly probe and pressure test the IT environment to find vulnerabilities before attackers do. Fully leverage threat intelligence to better know the adversary and focus on the most important threats.

Knowing that federal agencies will continue to be under increasingly sophisticated attacks demands a shift in focus toward cyber resilience. It’s also important to remember we got here one system, one application at a time, and that’s the same way we will get out of this problem. These six steps, adopted in any order, will help get us to a state of cyber resilience. 

Related Content:

• 7 Real-Life Dangers That Threaten Cybersecurity
• Congress Passes Bill to Create New Federal Cybersecurity Agency
• US Government Cybersecurity at a Crossroads
• DHS Establishes Center For Defense of Critical Infrastructure

Gus Hunt is Managing Director and Cyber Strategy Lead for Accenture Federal Services. He is responsible for developing differentiated approaches to dealing with the cyber threat environment and growing AFS’s cyber practice. Before joining AFS, Hunt was chief architect and the … View Full Bio

Article source: https://www.darkreading.com/threat-intelligence/a-shift-from-cybersecurity-to-cyber-resilience-6-steps/a/d-id/1333378?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

BLACK HAT EUROPE 2018 – London – A Toyota security researcher on his flight from Japan here to London carried on-board a portable steel attaché case that houses the carmaker’s new vehicle cybersecurity testing tool.

Takuya Yoshida, a member of Toyota’s InfoTechnology Center, along with his Toyota colleague Tsuyoshi Toyama, are part of the team that developed the new tool, called PASTA (Portable Automotive Security Testbed), an open-source testing platform for researchers and budding car hacking experts. The researchers here today demonstrated the tool, and said Toyota plans to share the specifications on Github, as well as sell the fully built system in Japan initially.

What makes the tool so intriguing – besides its 8 kg portable briefcase size – is that automobile manufacturers long had either ignored or dismissed cybersecurity research exposing holes in the automated and networked features in their vehicles. Toyota’s building this tool and sharing its specifications via open source is a major shift by an automaker.

“There was a delay in the development of cybersecurity in the automobile industry; [it’s] late,” Toyama said in the pair’s talk here today. Now automakers including Toyota are preparing for next-generation attacks, he said, but there remains a lack of security engineers that understand auto technology.

That was a driver for the tool: to help researchers explore how the car’s engine control units (ECUs) operate, as well as the CAN protocol used for communicating among elements of the vehicle, and to test out vulnerabilities and exploits.

Toyama said the tool isn’t meant for the live, moving-car hacking that Charlie Miller and Chris Valasek performed: the goal was to offer a safe platform for researchers who may not have the expertise of Miller and Valasek, for example. It simulates remote operation of wheels, brakes, windows, and other car features rather than “the real thing,” for safety reasons. “It’s small and portable so users can study, research, and hack with it anywhere.”

The PASTA platform holds four ECUs inside, as well as LED panels that are controllable by the researcher to run any tests of the car system operation, or attacks such as injecting CAN messages. It includes ODBII and RS232C ports, as well as a port for debugging or binary hacking, he said.

“You can modify the programming of ECUs in C” as well, he said.

The researchers integrated the tool with a driving simulator program, as well as with a model car to demonstrate some ways it can be used. PASTA also can be used for RD purposes with real vehicles: that would allow a carmaker to test how a third party feature would affect the vehicle and its security, or reprogram firmware, for example.

Toyota plans to later add to PASTA Ethernet, LIN, and CAN FD, as well as Wi-Fi, Bluetooth, and cellular communications features for testing. 

PASTA soon will be available on Github.

Related Content:

• Miller Valasek: Security Stakes Higher for Autonomous Vehicles 
• This Time, Miller Valasek Hack The Jeep At Speed 
• State Trooper Vehicles Hacked
• 7 Real-Life Dangers That Threaten Cybersecurity

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/toyota-builds-open-source-car-hacking-tool/d/d-id/1333415?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

USB-borne malware continues to present a major threat to industrial control systems (ICS) nearly a decade after the Stuxnet attacks on Iran’s nuclear infrastructure first highlighted the danger.

This week Symantec unveiled a new product it says is designed to help organizations in critical infrastructure sectors better manage the threat.

The security vendor’s new Industrial Control System Protection Neural (ICSP Neural) is a rugged USB scanning station that ICS operators can install in their environments for vetting the security of USB devices before the devices are inserted into a critical control system.

The scanner uses data from Symantec’s threat intelligence network to look for malware and risky files on USB memory sticks. It features a light sandbox for running scripts, files, and other executables on USB devices to check for malware.

ICSP supports file reputation scans and a self-learning capability that Symantec says allows the scanner to identify, with a high degree of precision, not just known malware threats but also ones that are previously unknown. Devices with malware are cleaned and electronically “watermarked” as safe with a small, signed file.

ICSP includes an optional enforcement driver that organizations can install on workstations and other OT systems if they choose. The relatively lightweight driver — with less than a 5 MB footprint — ensures only USBs that have been scanned and watermarked as safe are allowed to mount on a target system.

The driver can currently be installed on OT systems running Windows XP to Windows 10. It works with workstations and human machine interface (HMI) systems from a variety of vendors, including Emerson and Rockwell. Symantec plans to introduce support for Linux systems sometime next year.

Symantec’s new technology is similar to a tool that ICS vendor Honeywell introduced in 2017 called Secure Media Exchange (SMX). Like ICSP, Honeywell’s SMX is designed to help operations and plant managers protect control systems against USB-borne malware threats, especially those targeted at OT environments and therefore not easily detected by standard antivirus tools.

Employees in industrial settings simply insert their removable media into SMX while checking in and checking out, so any malware on them can be detected and removed. As with ICSP Neural, plant managers can use the Honeywell appliance to prevent unchecked USB devices from using USB ports on critical systems.

ICSP addresses an important need for ICS operators, says Kunal Agarwal, general manager of IoT at Symantec.

Because of how critical they are, many ICS environments are typically air-gapped — inaccessible via network from the outside. In these situations, USB devices are critical to delivering software updates, files, patches, configuration changes, and other data to ICSes, Agarwal says. Often these devices represent the only way to provide ongoing updates and maintenance to critical systems, even though a high percentage of them contain malware and other threats, he says.

Honeywell recently analyzed data collected from 50 organizations in four sectors — oil and gas, energy, chemical, and paper and pulp — that are using SMX. The data showed 44% of the organizations had detected and blocked at least one suspicious file on a USB device.

Of the threats that were blocked, 26% had the potential to create a major disruption — such as loss of visibility or control — in an ICS environment, Honeywell said in the report. Sixteen percent of the threats were specifically targeted at ICSes, and 15% contained known malware, including Stuxnet, Mirai, WannaCry and Triton. In addition to Trojans, other threats that were blocked included bots, hacking tools, and potentially unwanted applications.

Significantly, malware is not the only threat that USB devices pose.

“Malicious USB devices crafted specifically to attack computers via the USB interface have become readily available for purchase online,” Honeywell noted in its report. “BadUSB — a technique that turns USB devices such as fans and charging cables into potential attack vectors — has increasingly been weaponized.”

Related Content:

• USB Drives Remain Critical Cyberthreat
• 8 Out of 10 Employees Use Unencrypted USB Devices
• ICS Networks Continue to be Soft Targets For Cyberattacks
• 7 Real-Life Dangers That Threaten Cybersecurity

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/symantec-intros-usb-scanning-tool-for-ics-operators/d/d-id/1333417?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Image Source: Pixabay

We’ve now hit the six-month mark with GDPR, and all indications show companies are taking the data protection and privacy regulation seriously. In fact, a study by TrustArc published in the summer found that 74% of those surveyed in the US, UK, and throughout the EU expected to be compliant by the end of 2018 and 93% by the end of 2019.

All good news, but there’s always dirt under the rug. Companies are making some serious oversights that could hurt them down the road.

“Keep in mind that the required implementation takes time, money, resources, and energy, but organizations need to realize that the $1 million spent to enact stronger security measures may be necessary to avoid a $10 million fine,” says Matt Radolec, head of security architecture and incident response at Varonis.

Another important point: Many companies think that GDPR applies mainly to customer data, but its protections also apply to their own employee data and data about their customers’ customers.

“Many think that if they are a B2B company, GDPR is not for them, but that’s not the case,” says Enza Iannopollo, a senior analyst on Forrester’s Security Risk team.

What other points should your company keep in mind? Read on for six tips on how improve your GDPR program.

Steve Zurier has more than 30 years of journalism and publishing experience, most of the last 24 of which were spent covering networking and security technology. Steve is based in Columbia, Md. View Full Bio

Article source: https://www.darkreading.com/risk/compliance/6-ways-to-strengthen-your-gdpr-compliance-efforts/d/d-id/1333383?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

It is clear that end users are a major, if not the primary, attack vector for most significant attacks. Whether using phishing, traditional social engineering, or physical compromise, sophisticated attackers know that it is easier for them to find a successful entry point into an organization by targeting users instead of by probing for technology weaknesses. As important, well-meaning users cause more damage in aggregate than malicious parties ever could. In response, there is a focus on trying to make users more resilient through awareness.

The reality is that this works to an extent, but more is required.

Technology is in place to stop user actions in advance, as it should be. In the safety field, it is believed that around 90% of workplace accidents are avoided by creating an environment that prevents employees from being exposed to situations where they can be injured. For example, in one factory where employees were frequently struck by forklifts, they painted a line down aisles, creating distinct walkways. This one change alone reduced almost all accidents involving forklifts. The remainder of the incidents were the result of walkers who were looking at their cellphones and drifted into the forklift because they weren’t paying attention.

In the cybersecurity world, one equivalent of creating a secure environment is anti-malware software, spam filters, and PC protections that prevent users from installing software. Creating a secure environment filters out more than 99.9% of potential attacks before they can reach the user, or stops the user from causing damage. But clearly, attacks still make it through, which means awareness is still necessary to reduce the risk.

The truth is that awareness programs should focus on how users should do their jobs properly and not on what they should be afraid of. This requires a definition of proper governance. You cannot expect users to detect every possible trick, but they should at least be able to follow proper procedures in how to act appropriately.

Focus on the User
While in general most companies have some form of software to defend against attacks reaching users, some form of awareness, and something that resembles policies and procedures, these efforts are uncoordinated and haphazard. There is no focused effort to stop specific attacks or user actions.

To address this concern, what is required is a position that I call the human security officer (HSO), who is responsible for specifically identifying the different attack vectors and vulnerabilities involving people. The HSO examines where problems may arise and identifies the optimal ways to prevent, detect, and respond to the attacks or user actions.

Some people may contend that this is the job of the CISO or perhaps an awareness manager. The reality is that awareness people have a very specific role and focus on providing information to people in an attempt to get them to improve their security-related behaviors. The awareness team does not have the responsibility — and especially not the authority — to account for all aspects of preventing and mitigating vulnerabilities. The awareness team should report to the HSO.

The HSO would be responsible for determining where human-related vulnerabilities exist and focus on a coordinated method for mitigating the vulnerabilities. This would involve an examination of underlying business processes and the determination of the best combination of technology operational processes that most effectively mitigate vulnerabilities. The HSO would then ensure that the awareness team focuses on ensuring that the awareness program primarily addresses how people should perform their jobs correctly.

While it would be good for a CISO to take on the role of an HSO, in any company of reasonable size, the CISO has a team of people to whom she can delegate responsibilities. Much like there are individuals reporting to the CISO responsible for network security, incident response, and governance, there should be an HSO specifically responsible for all aspects dealing with human-related vulnerabilities. The role should be treated distinctly and go well beyond the traditional awareness roles.

Related Content:

• 6 Reasons Why Employees Violate Security Policies
• The Fundamental Flaw in Security Awareness Programs
• How Data Security Improves When You Engage Employees in the Process

Ira Winkler is president of Secure Mentem and author of Advanced Persistent Security. View Full Bio

Article source: https://www.darkreading.com/endpoint/the-case-for-a-human-security-officer/a/d-id/1333393?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

BLACK HAT EUROPE 2018 – London – As nation-state cyberattacks continue to evolve into more complex and disruptive campaigns, the pressure is on for countries to set specific cybernorms and support one another in the attribution of nation-state hacks, according to Marina Kaljurand, chair of the Global Commission on the Stability of Cyberspace (GCSC) and Member of the UN Secretary General’s High Level Panel on Digital Cooperation.

The former Estonian Foreign Minister, who was serving as the ambassador to Russia in 2007 when her country was hit with historic distributed denial-of-service (DDoS) attacks by Russia, said in an interview with Dark Reading that without “a clear understanding” of attack attribution, bad actors continue to operate in the “gray zone.”

“Russia attacked Estonia, and nothing really happened. The next year it was the war and cyberattacks on Georgia, and nothing really happened. Then the attack on the Ukraine power grid, and nothing happened,” Kaljurand said of Russia’s increasingly aggressive cyberattack campaigns. It wasn’t until the US, under President Barack Obama, called out Russian actors in the hack of the Democratic National Committee (DNC) that nations began to name the culprits behind state-sponsored hacking, she said. 

Kaljurand, who delivered the keynote address here today, was serving as the Estonian ambassador to Russia when Russian hackers took down her country’s government and bank websites with a weeks-long DDoS attack wave. “We were the first country to fall victim to politically motivated attacks. Those DDoS attacks were primitive by today’s standards. … They didn’t [destroy] anything; they were humiliating and disturbing,” she said.

As the ambassador to Russia, she then “had to learn in 15 minutes what does DDoS mean and explain it to others,” she said. “My second task was to find cooperation with Russia. I failed: It takes two to tango.”

Kaljurand said one of the main lessons from the Estonia attacks was that international cooperation is the key to thwarting malicious nation-state attacks. This new normal of nation-state cyberattacks requires educating nations that are not as up to speed on the issues, as well as fostering cooperation among like-minded nations to set and support cybernorms. “States alone can’t be efficient,” she said. “We need responsible laws, regulations, authority, and thinking out of the box.”

The multination naming of Russia as the actor behind the NotPetya data-destruction attacks in 2013 was the first time multiple countries issued attribution statements at the same time, as well as sanctions in some cases. “To get a state to make [such a] statement wasn’t easy,” Kaljurand told Dark Reading.   

Offensive cyber operations are another area that must be addressed, she said. “Whatever measures that are taken must be in correspondence with international law,” Kaljurand stated in the keynote. “It’s important to consider the necessity, specificity, proportionality, and harm in case offensive capabilities are used. To have an open discussion on this is better than not having it or having it behind closed doors.”

While some 60 to 70 countries today are talking about cybersecurity, hundreds in the developing world are not and need to be reached out to, she said.  

The GCSC so far has issued its set of recommended cybernorms for the protection of the public core of the Internet, but is still working on other security issues.  

How can cyberspace norms be enforced if not all nations comply? “Start with a political statement supporting it and then introduce it as practice, with clear rules of what is allowed and what is not,” Kaljurand said in the interview. Ultimately, that will require some sort of international watchdog organization, she added.

Meanwhile, Estonia, like other nations, continues to be targeted by nation-state hackers. “I can’t be specific” about the threats, Kaljurand told Dark Reading, but Russia remains active as well as other nations. 

Related Content:

• ‘London Blue’ BEC Cybercrime Gang Unmasked
• 6 Ways to Strengthen Your GDPR Compliance Efforts
• 74 Arrested in International Email Scam Schemes
• 20 Cybersecurity Firms to Watch

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise … View Full Bio

Article source: https://www.darkreading.com/threat-intelligence/former-estonian-foreign-minister-urges-cooperation-in-cyberattack-attribution-policy/d/d-id/1333407?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Attackers targeting Windows are typically after domain admin privileges. Once they have it, researchers say, the security questions feature built into Windows can help them keep it.

In a presentation at this week’s Black Hat Europe, security researchers from Illusive Networks demonstrated a new method for maintaining domain persistence by exploiting Windows 10 security questions. Despite good intentions, the feature, introduced in April, has the potential to turn into a durable, low-profile backdoor for attackers who know how to exploit it.

Windows admins are prompted to set up security questions as part of the Windows 10 account setup process. Tom Sela, head of security research at Illusive Networks, said the addition reflects a broader effort by Microsoft to build security into Windows 10. However, it also shows the delicate balance companies must strike in maintaining usability while improving protection.

“I think Microsoft also wants to introduce new usability features,” Sela explained in an interview with Dark Reading. “There is a fine line with advancing security but also adding new usability features that may compromise security.”

Magal Baz, security researcher at Illusive Networks, said the questions are more of a usability feature, designed for convenience, than a security mechanism. Today, if you forget your Windows login password, you’re locked out of your machine and have to reinstall the operating system to regain access, he said. The questions feature lets users log back into their accounts by providing the name of their first pet, for example, in lieu of their password.

“Now in terms of security … I don’t think that it is well-protected,” he explained. Because those questions and answers have the same power as a password, you’d think they would be as secure. However, unlike passwords, answers to security questions are not long and complex, they don’t expire, and most of the time they don’t change. “All the limitations that make passwords safer are not applied on the security questions,” Baz pointed out.

In addition to having answers that can be found on social networks, the security questions “are not monitored. There are no policies around it – it’s just there,” he continued. “It allows you to regain access to the local administrative account.” There’s a reason why companies including Facebook and Google have stopped using security questions to secure accounts, Baz added.

Unlocking Admins’ Answers
Before describing how this approach works, it’s important to add context first. In recent years, attackers have not only sought domain access but a means of maintaining a reliable and low profile on the domain. The process of becoming a domain admin has become much easier, Baz added. “A couple of years ago, it was thought this could take months … it has shrunk into hours,” he says.

To turn the questions feature into a backdoor, an attacker must first find a way to enable and edit security questions and answers remotely, without the need to execute code on the target machine. The attacker must also find a way to use preset QA to gain access to a machine while leaving as few traces as possible, Baz and Sela explained in their presentation.

Windows 10 security questions and answers are stored as LSA Secrets, where Windows stores passwords and other data for everyday operations. With administrative access to the registry, one can read and write LSA Secrets. One can change a user’s security questions and answers, installing a backdoor to access the same system in the future.

An attacker could remotely use this feature, for any and all of the Windows 10 machines in the domain, to control security questions and answers to be something he chooses, Baz said. The implications for someone abusing this without the account holder’s knowledge are huge. Unlike passwords, which eventually expire and can be edited any time, security questions are static. The name of your first pet or mother’s maiden name, for example, don’t change, Baz pointed out.

Sela and Baz described use cases in which this tactic can be useful for an attacker. Someone could “spray” security questions across all Windows 10 machines and ensure a persistent hold in the network by ensuring everyone’s dog is named Fluffy – and Fluffy is the name of everybody’s birthplace, place where their parents met, model of their first car, etc.

What’s more, security questions and answers aren’t carefully protected. “The questions today are not monitored, are not changed. Probably most of IT admins are not even aware of their existence at the time being,” Baz continued. “The implications … for now [are] permanent access to all Windows 10 machines in the network quite easily and in low-profile manner.”

The security questions also don’t come with auditing capabilities, Sela added. “Even [for] IT administrators that would like to be aware of that, out of the box, Windows doesn’t give them a way to monitor the status of those security questions.”

Best Practices and Deleting Security Questions
Admins should constantly monitor security questions to make sure they are unique, or disable them by periodically changing them to random values, Baz and Sela said.

“Even before the question of security questions, it’s a good practice to have as few local admins as possible on the network,” Baz said.

Security admins don’t feel good about the tool, the researchers said, noting how many people are looking for ways to get rid of it. As part of their presentation, Baz and Sela also shared an open-source tool they developed that can control or disable the security questions feature and mitigate the risk of questions being used as a backdoor into a Windows 10 machine.

Related Content:

• Backdoors Up 44%, Ransomware Up 43% from 2017
• DHS, FBI Issue SamSam Advisory
• Holiday Hacks: 6 Cyberthreats to Watch Right Now
• MITRE Changes the Game in Security Product Testing

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance Technology, where she covered financial … View Full Bio

Article source: https://www.darkreading.com/endpoint/windows-10-security-questions-prove-easy-for-attackers-to-exploit/d/d-id/1333404?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple