STE WILLIAMS

Ride-hailing service Careem lost 14 million users’ data… in January

Careem, a ride-hailing startup based in Dubai and operating in 13 countries, announced on Monday that it discovered a breach in January that affected 14 million users’ data.

The intruder(s) got at customers’ and drivers’ names, email addresses, phone numbers and trip data. So far, Careem hasn’t seen any evidence that passwords or credit card data were involved in the breach.

Careem said that it keeps customers’ credit card information on an external, third-party, Payment Card Industry (PCI) -compliant server that uses “highly secure protocols and is employed by international banks around the globe to protect financial information.”

Should customers and drivers be reassured? As we’ve noted in the past, PCI’s own Data Security Standard (DSS) has been a compliance headache for companies around the world, setting a “check the box” mentality for firms who don’t take their security seriously enough.

Well, is that so bad? Some say that PCI DSS and other regulations of its ilk – SOX and HIPAA, for example – make for a good cattle prod to get companies to take security seriously.

At any rate, Careem says it discovered the breach on 14 January but didn’t notify customers right away because an investigation was under way. From its announcement:

Cybercrime investigations are immensely complicated and take time. We wanted to make sure we had the most accurate information before notifying people.

That might seem like an important delay but hey, at least it was doing something positive rather than taking a leaf out of the Uber playbook.

Uber’s response to the theft of 57 million driver and customer records was a deafening silence lasting longer than a year as it hoped its attempt to pay the hackers $100,000 to “delete the data [and] keep quiet”, would stop anyone from finding out.

Careem said it’s been working to figure out what happened, determine who was affected and figure out how to boost its network defenses. It says it’s enhanced monitoring so it can detect and respond quickly to security threats, for example, and will continue to bolster defenses over coming months.

The usual post-breach precautions apply:

  • Update your Careem passcode, and then update your password on any other accounts using the same or similar details. Make your new one good and strong. Here’s how. And if we’ve said it once, we’ve said it a million times: reusing passwords is really, truly a terrible idea. So don’t!
  • Watch out for spearphishers. Unsolicited communications that try to get personal information out of you, or send you to a site that wants your account credentials, should be greeted with your hairiest of eyeballs. Don’t click on links or download attachments from unfamiliar emails.
  • Keep an eye on your bank account and credit card statements for suspicious activity. See something weird? Call your bank.


Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/r0nOBuOyyNs/

One month to GDPR. Are you ready?

Regardless of where your company is located, if you control, collect or share any personal data belonging to EU citizens, you need to be compliant with General Data Protection Regulation (GDPR).

GDPR goes into effect officially on 25 May, and any business found not in compliance after that date could find itself hit with big fines (up to €20m or 4% of an organization’s annual global turnover).

The idea behind GDPR is to protect EU citizens’ privacy by giving them greater control over how their personal data is obtained, processed, and shared, as well as visibility into how and where that data is used.

The regulation enforces real consequences for data gatherers that don’t take care of the data they obtain. It also builds in greater accountability for those organizations to ensure they’re conscious of the data they gather, how it is stored, and how it is protected.

For many organizations that handle data, this means a shift in their data collection processes from beginning to end, and a hard look at what kind of data they’re obtaining, how well it is being secured, and an honest assessment on whether or not that data needs to be obtained in the first place.

It’s no longer enough to just want to collect user data, GDPR requires organizations to only collect user data where there is a ‘lawful basis’ to do so, and that basis must be documented.

As Sophos CISO, Ross McKerchar, told Naked Security in October, GDPR shifts the balance of power by turning data from an asset into a potential liability. Ensuring that data is deleted as soon as it’s no longer necessary becomes “a defence in depth measure – the less you store the less you have to lose.”

Data handlers may need to implement more informed consent processes when obtaining customer or user data, so EU citizens are fully aware of what they are opting into when an organization is entrusted with their PII (Personally Identifiable Information).

EU citizens can request information on data held, via a subject access request – a written report that must be sent upon request that explains what data is held about them, why it is being used and who it has been shared with. Citizens can also request that any data held on them is deleted.

Another goal of GDPR is to make organizations much more proactive in disclosing a data breach, should one occur. This is why GDPR mandates that any person affected by a data breach be notified within 72 hours of the breach’s discovery.

GDPR implementation isn’t a technological box to check, it’s largely a matter of creating and formalizing processes to handle the new requirements that it introduces.

If GDPR is a concern for your business, it’s likely you’ve been getting your house in order for a while now. But with a month to go until the final deadline, it can’t hurt to check that your organization is on the path to readiness: Try out the Sophos GDPR compliance check for peace of mind – it’s only six questions!


Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/7DvGNdtF2hE/

Apple debugs debugger, plugs big holes in iOS and WebKit

Apple has issued a trio of updates to patch security vulnerabilities in Safari, macOS, and iOS.

For iOS, the update addresses a total of four CVE-listed vulnerabilities, including one that is present in the debugging tool used across both iOS and the macOS.

That vulnerability, CVE-2018-4206, was spotted in Crash Reporter by researcher Ian Beer of Google’s Project Zero. According to Apple, a vulnerability in Crash Reporter’s error handling would have allowed an application to trigger a memory corruption error that would have enabled elevation of privilege.

In summary; the debugger had a bug, and a buggy app could have triggered the debugger bug to bugger up everything. To get the patch you’ll want to install iOS 11.3.1 or Security Update 2018-001.

It’s 2018 and your Macs, iPhones can be pwned by playing evil music

READ MORE

Also patched in iOS was CVE-2018-4187, a UI spoofing vulnerability discovered by Tencent researcher Zhiyang Zeng and Roman Mueller. As explained by Mueller, the vulnerability actually lies in a recently-introduced QR-reading feature Apple added to iOS. Because the camera fails to properly scan and redirect URLs from QR codes, users could be sent to spoof or phishing sites.

Finally, the iOS update addresses two memory corruption flaws in WebKit-; CVE-2018-4200, reported by Ivan Frantic by Project Zero, and CVE-2018-4200, found by Richard Zhu of Trend Micro’s Zero Day Initiative. Both would allow a specially-crafted webpage to achieve remote code execution.

Those two WebKit bugs will also be addressed in Safari 11.1, as the Apple web browser shares its engine- and many of the resulting vulnerabilities- with iOS. Users running El Capitan, Sierra, and High Sierra will be getting the Safari update.

Finally, Mac users running High Sierra (macOS 10.13.4) will want to install Security Update 2018-001. That update addresses the macOS occurrences of both CVE-2018-4187 (the QR reader bug), and CVE-2018-4206 (the Crash Reporter vulnerability).

No other security updates were released by Apple, so those running an Apple Watch or AppleTV won’t have to look for patches right now. ®

Sponsored:
Minds Mastering Machines – Call for papers now open

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/04/25/apple_debugs_debugger_plugs_holes_in_ios_and_webkit/

Mysterious “double kill” IE zero-day allegedly in the wild

“Double kill” is a bragging term from the world of violent video gaming – it means you finished off two assailants with a single shot.

In the world of cybercrime, it’s the name given by Chinese computer security compay Qihoo to what it claims is an Internet Explorer zero-day hole that’s being actively exploited in the wild.

As you probably know, zero-day exploits get their name because they show up in the hands of attackers before an official fix is available, thus giving zero days during which even a keen and well-informed sysadmin could have applied a patch.

If there isn’t a patch you can use, the next best thing is some sort of workaround that minimises or eliminates the side-effects of the bug in your environment.

Unfortunately, in this case, Qihoo isn’t giving much away: we’ve seen only very sketchy details of how the “double kill” exploit works, or what you could look out for if an attacker tried to use the exploit against you.

All we know so far is that a “double kill” attack starts with a Word document, presumably sent as an email attachment.

If you open the booby-trapped document, which is denoted by Qihoo as containing some unspecified sort of shellcode, Internet Explorer is apparently activated in the background, ultimately leading to an executable program being downloaded and executed without any visible warning.

According to Qihoo, this is:

…the first Office Document based exploit that uses a browser zero-day vulnerability to carry out the attack. Opening a malicious Office document may cause infection with a Trojan horse that can take full control of the victim’s computer […] Hackers carried out the APT attack by delivering Office documents containing malicious webpages. When affected users opened the documents, malicious scripts and payloads using the vulnerability were downloaded from a remote host and executed.

What we don’t yet know is:

  • Which document file formats (e.g. RTF, DOC, DOCX, XLS, XLSX, PPT, PPTX) can be used to trigger this vulnerability.
  • Whether the booby-trapped Office files contain macros or other active scripting that could be detected and blocked generically to reduce the risk of attack, at least until specific details are available.
  • Whether Office is required to make the exploit work, or whether other applications might be able to trigger it too, such as PDF readers or video players.
  • How Internet Explorer comes into the attack.

Qihoo’s diagram shows a document containing shellcode, plua various DLLs (executable files) that are apparently written to disk after the document is opened, but Internet Explorer is not depicted in the diagram at all.

Numerous secondary aspects of the attack are mentioned by Qihoo, including a trick used to bypass User Access Control (UAC), the download of an image file with executable code hidden inside it, and the execution of that code by poking it directly into memory without first saving it to disk.

However, these seem to been details of one specific malware payload unleashed by the “double kill” vulnerability, rather than part of the zero-day itself:

At a later stage of the attack, it uses a publicly available UAC bypass technique, file steganography [executable content buried inside an image file] and reflective DLL injection [poking a program directly into memory] to avoid file detection.

What to do?

At this time [2018-04-24T23:30Z] , we don’t have any sample files from an actual attack; we don’t know whether booby-trapped documents have any telltale signs that you can look out for; we don’t know how Internet Explorer comes into the attack; and we don’t know whether Office is the only applciation that can be used to trigger a “double kill”.

All we can do it to reiterate the general security advice we have given many times before: don’t open documents you weren’t expecting, even if they seem to be urgent or interesting.

Apparently, Qihoo has disclosed details of this attack to Microsoft – when we’ve got something useful to add to the little that Qihoo has revealed so far, we’ll pass it on…


Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/fSsy3BM05W0/

AWS DNS network hijack turns MyEtherWallet into ThievesEtherWallet

Updated Crooks today hijacked internet connections to Amazon Web Services systems to ultimately steal a chunk of alt-coins from online cryptocurrency website MyEtherWallet.com.

The Ethereum wallet developer confirmed on Tuesday morning that thieves redirected DNS lookups for its dot-com to a malicious website masquerading as the real thing. That meant some people logging in to MyEtherWallet.com were really connecting to a bogus site and handing over their details to criminals, who promptly drained ETH from their marks’ wallets.

Victims had to click through a HTTPS error message, as the fake MyEtherWallet.com was using an untrusted TLS/SSL certificate. The bandits have amassed $17m in Ethereum in their own wallet over time.

Crucially, this DNS hijacking was possible after miscreants pulled off a classic BGP hijacking attack on AWS. MyEtherWallet.com uses Amazon’s Route 53 DNS service so that when people try to visit the dot-com, AWS looks up and returns to web browsers the IP addresses of the wallet website’s web servers.

Between 11am and 1pm UTC today, someone was able to send BGP – Border Gateway Protocol – messages to the internet’s core routers to convince them to send traffic destined for some of AWS’s servers to a renegade box in the US.

That rogue machine then acted as AWS’s DNS service, and gave out the wrong IP addresses for MyEtherWallet.com, pointing some unlucky visitors to the dot-com at a phishing site that stole their money.

Specifically, the following 1,300-odd AWS-owned IP addresses were hijacked via BGP meddling:

BGP is the glue of the internet. The ‘net breaks and fixes itself over and over, throughout the day, every day, as physical routes between machines and networks open up and close, or are altered. The routing equipment at the core of the internet exchanges BGP messages to maintain their tables of active routes. These routes ensure that if you’re using the public IP address of, say, 1.2.3.4 to connect to a system at 5.6.7.8, your packets are sent through the appropriate networks and physical links to reach the right box.

If these table entries are maliciously altered to point traffic away from the intended target, connections to websites and services can be hijacked. It’s sometimes a little too easy to pull this off, and it almost invariably ends in fraud.

Emptied

“As soon as I logged in [to myetherwallet.com], there was a countdown for about 10 seconds and a transfer was made sending the available money I had on the wallet to another wallet,” wrote one victim of today’s crypto-cash heist.

“I have no idea what happened. I barely download things and thought I was careful enough at least to avoid problems.”

BGP hijacking is, sadly, decades old, and has proven a reliable technique for criminals and other scumbags over the years.

In this case, it is thought the thieves used a compromised Equinix-hosted server in Chicago to capture traffic rerouted from AWS’s Route 53 DNS service. Technically, the miscreants behind the hijacking could have snatched control of all sites using Route 53 for DNS. The impact of the hijacking could have been a lot worse than a raid on ETH money stores.

The malicious phishing site was hosted in Russia. The only indication something was amiss was the self-signed certificate the phishing page presented, when people tried to connect to MyEtherWallet.com.

It is claimed the network block AS10297, belonging to Ohio-based website hosting biz eNet, announced it could take over traffic destined for some of AWS’s IP addresses. eNet peers with big-name carriers Level 3, Hurricane Electric, Cogent, NTT and others, and is therefore plugged into the internet’s backbone. eNet was well placed to alter part of the world’s internet plumbing to redirect connections to Route 53’s DNS service, in other words.

It’s highly likely someone took eNet’s systems on a joyride – ie: without permission – to make this routing adjustment announcement.

The attack is now believed to have been addressed, with the routes restored, although some DNS caches may still hold the wrong IP addresses for Myetherwallet.com for a while. The site is advising customers to use caution and, if possible, keep their wallets offline. The website is also advising punters to switch their DNS settings from Google’s DNS servers to those of Cloudflare, which seemed to have ignored today’s switcheroo.

“Users, PLEASE ENSURE there is a green bar SSL certificate that says ‘MyEtherWallet Inc’ before using MEW,” MyEtherWallet’s admins pleaded within the past few hours.

“We advise users to run a local (offline) copy of the MEW (MyEtherwallet). We urge users to use hardware wallets to store their cryptocurrencies.”

MyEtherWallet is also advising customers to be on the lookout for “refund” scams, where thieves ask users to hand over payment in order to receive a return for their stolen funds. This has become a common scam on Twitter and cryptocurrency message boards.

The attack is also, as you’d expect, causing a stir outside of the Ethereum community. The hijack underscores the need to address fundamental vulnerabilities in BGP, which was designed in the early days of the internet when trust between networks was implied. These days, DNSSEC and HSTS would be a nice start.

UK-based infosec pro Kevin Beaumont reckons other sites may have been targeted, noting that the Myetherwallet attack was only spotted after the DNS redirects had stopped on their own.

“Mounting an attack of this scale requires access to BGP routers at major ISPs and real computing resource to deal with so much DNS traffic,” Beaumont said. “It seems unlikely Myetherwallet.com was the only target, when they had such levels of access.”

A spokesperson for AWS was not available for immediate comment. An eNet rep declined to comment: “We’re not interested, thank you.” ®

Updated to add

An Equinix spokesperson just sent El Reg the following statement:

The server used in this incident was not an Equinix server but rather customer equipment deployed at one of our Chicago IBX data centers. Equinix is in the primary business of providing space, power and a secure interconnected environment for our more than 9,800 customers inside 200 data centers around the world.”

We generally do not have visibility or control over what our customers – or customers of our customers – do with their equipment. Our role is to provide the best environment possible for our customers to transform their business.

And a spokesperson for AWS has been in touch to tell us:

Neither AWS nor Amazon Route 53 were hacked or compromised. An upstream Internet Service Provider (ISP) was compromised by a malicious actor who then used that provider to announce a subset of Route 53 IP addresses to other networks with whom this ISP was peered. These peered networks, unaware of this issue, accepted these announcements and incorrectly directed a small percentage of traffic for a single customer’s domain to the malicious copy of that domain.

So in short, eNet was commandeered by miscreants to persuade its peers – potentially Hurricane Electric, Level 3, and others – to reroute the internet’s traffic from some Route 53 DNS servers to a malicious DNS server that then misdirected visitors to MyEtherWallet.com to a phishing website, all to steal approximately $150,000 in Ethereum.

Sponsored:
Minds Mastering Machines – Call for papers now open

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/04/24/myetherwallet_dns_hijack/

MyEtherWallet.com turns into Someone Else’s EtherWallet amid AWS DNS network hijack

Updated Crooks today hijacked internet connections to Amazon Web Services systems to ultimately steal millions of dollars in alt-coins from online cryptocurrency website MyEtherWallet.com.

The Ethereum wallet developer confirmed on Tuesday morning that thieves redirected DNS lookups for its dot-com to a malicious website masquerading as the real thing. That meant some people logging in to MyEtherWallet.com were really connecting to a bogus site and handing over their details to criminals, who promptly drained ETH from their marks’ wallets.

Victims had to click through a HTTPS error message, as the fake MyEtherWallet.com was using an untrusted TLS/SSL certificate.

Crucially, this DNS hijacking was possible after miscreants pulled off a classic BGP hijacking attack on AWS. MyEtherWallet.com uses Amazon’s Route53 DNS service so that when people try to visit the dot-com, AWS looks up and returns to web browsers the IP addresses of the wallet website’s web servers.

Between 11am and 1pm UTC today, someone was able to send BGP – Border Gateway Protocol – messages to the internet’s core routers to convince them to send traffic destined for AWS’s servers to a renegade box in the US.

That rogue machine then acted as AWS’s DNS service, and gave out the wrong IP addresses for MyEtherWallet.com, pointing visitors to the dot-com at a phishing site that stole their money.

Specifically, the following AWS-owned IP addresses were hijacked via BGP meddling:

BGP is the glue of the internet. The ‘net breaks and fixes itself over and over, throughout the day, every day, as physical routes between machines and networks open up and close, or are altered. The routing equipment at the core of the internet exchanges BGP messages to maintain their tables of active routes. These routes ensure that if you’re using the public IP address of, say, 1.2.3.4 to connect to a system at 5.6.7.8, your packets are sent through the appropriate networks and physical links to reach the right box.

If these table entries are maliciously altered to point traffic away from the intended target, connections to websites and services can be hijacked. It’s sometimes a little too easy to pull this off, and it almost invariably ends in fraud.

Emptied

“As soon as I logged in [to myetherwallet.com], there was a countdown for about 10 seconds and a transfer was made sending the available money I had on the wallet to another wallet,” wrote one victim of today’s crypto-cash heist.

“I have no idea what happened. I barely download things and thought I was careful enough at least to avoid problems.”

BGP hijacking is, sadly, decades old, and has proven a reliable technique for criminals and other scumbags over the years.

In this case, it is thought the thieves used a compromised Equinix-hosted server in Chicago to capture traffic rerouted from AWS’s Route53 DNS service. Technically, the miscreants behind the hijacking could have snatched control of all sites using Route53 for DNS. The impact of the hijacking could have been a lot worse than a raid on ETH money stores.

The malicious phishing site was hosted in Russia. The only indication something was amiss was the self-signed certificate the phishing page presented, when people tried to connect to MyEtherWallet.com. It is claimed the network block AS10297, belonging to Ohio-based website hosting biz eNet, announced it could take over traffic destined for AWS’s IP addresses. eNet peers with Level 3, Hurricane Electric, Cogent, NTT and others, and is therefore plugged into the internet’s backbone. It’s highly likely someone took eNet’s systems on a joyride – ie: without permission – to make this routing announcement.

The attack is now believed to have been addressed, with the routes restored, although some DNS caches may still hold the wrong IP addresses for Myetherwallet.com for a while. The site is advising customers to use caution and, if possible, keep their wallets offline. The website is also advising punters to switch their DNS settings from Google’s DNS servers to those of Cloudflare, which seemed to have ignored today’s switcheroo.

“Users, PLEASE ENSURE there is a green bar SSL certificate that says ‘MyEtherWallet Inc’ before using MEW,” MyEtherWallet’s admins pleaded within the past few hours.

“We advise users to run a local (offline) copy of the MEW (MyEtherwallet). We urge users to use hardware wallets to store their cryptocurrencies.”

MyEtherWallet is also advising customers to be on the lookout for “refund” scams, where thieves ask users to hand over payment in order to receive a return for their stolen funds. This has become a common scam on Twitter and cryptocurrency message boards.

The attack is also, as you’d expect, causing a stir outside of the Ethereum community. The hijack underscores the need to address fundamental vulnerabilities in BGP, which was designed in the early days of the internet when trust between networks was implied. These days, DNSSEC and HSTS would be a nice start.

UK-based infosec pro Kevin Beaumont reckons other sites may have been targeted, noting that the Myetherwallet attack was only spotted after the DNS redirects had stopped on their own.

“Mounting an attack of this scale requires access to BGP routers at major ISPs and real computing resource to deal with so much DNS traffic,” Beaumont said. “It seems unlikely Myetherwallet.com was the only target, when they had such levels of access.”

A spokesperson for AWS was not available for immediate comment. An eNet rep declined to comment: “We’re not interested, thank you.” ®

Updated to add

An Equinix spokesperson just sent El Reg the following statement:

The server used in this incident was not an Equinix server but rather customer equipment deployed at one of our Chicago IBX data centers. Equinix is in the primary business of providing space, power and a secure interconnected environment for our more than 9,800 customers inside 200 data centers around the world.”

We generally do not have visibility or control over what our customers – or customers of our customers – do with their equipment. Our role is to provide the best environment possible for our customers to transform their business.

Sponsored:
Minds Mastering Machines – Call for papers now open

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/04/24/myetherwallet_dns_hijack/

Yahoo! fined! $35m! for! covering! up! massive! IT! security! screwup!

The Disaster Formerly Known as Yahoo! has been fined $35m by US financial watchdog, the SEC, for failing to tell anyone about one of the world’s largest ever computer security breaches.

Now known as Altaba following its long, slow and painful descent in irrelevance, Yahoo! knew that its entire user database – including billions of usernames, email addresses, phone numbers, birthdates, passwords, security questions – had been grabbed by Russian hackers back in December 2014 – just days after the break-in occurred.

Security staff informed senior Yahoo! management and its legal department, who then demonstrated the same kind of business and strategic nous that saw the company fold into itself when they decided to, um, not tell anyone.

baratov

Yahoo! webmail! hacker! faces! nearly! eight! years! in! the! cooler!

READ MORE

It wasn’t until two years later when telco giant Verizon said it wanted to buy the troubled company that Yahoo! finally revealed the massive breach.

The SEC is, understandably, not overly impressed. “Yahoo! failed to properly investigate the circumstances of the breach and to adequately consider whether the breach needed to be disclosed to investors,” it said Tuesday, before the co-director of its enforcement division, Steven Peikin, gave what amounts to a vicious burn in the regulatory world.

“We do not second-guess good faith exercises of judgment about cyber-incident disclosure,” said Peikin. “But we have also cautioned that a company’s response to such an event could be so lacking that an enforcement action would be warranted. This is clearly such a case.”

Another SEC staffer – director of its San Francisco office, Jina Choi, also piled in, noting that: “Yahoo!’s failure to have controls and procedures in place to assess its cyber-disclosure obligations ended up leaving its investors totally in the dark about a massive data breach. Public companies should have controls and procedures in place to properly evaluate cyber incidents and disclose material information to investors.”

So, about that…

Yahoo! should have let investors know about the massive breach in its quarterly and annual reports because of the huge business and legal implications to its business, the SEC said.

But it didn’t of course – probably because it was already desperate to get someone to buy it following years of abortive efforts by CEO Marissa Meyer to turnaround what was once the internet’s poster child.

The SEC also found that Yahoo! did not share information on the breach with either auditors or its outside lawyers. The Canadian who helped the Russians gain access to the data faces eight years in jail.

Yahoo! has “neither admitted nor denied the findings in the SEC’s order” – which is so Yahoo!.

For some reason Verizon still bought the dried out husk of the company in June 2017, although it extracted a significant reduction in the share price. It paid $350m less than its initial offer but it is estimated that it will cost Verzion $500m to clean up the mess Yahoo! left behind.

Showing just how far the company had fallen in people’s good graces, it then changed its names to Altaba. That’s Altaba. No, try again, Altaba. Whatever.

Well, Altaba is still on the hook for the hack, with a judge last month refusing to thrown out a lawsuit brought by users against the company.

Pat of the final bill may be covered by the sale this week of once-lauded photo site Flickr, which Yahoo! bought for around $25m in 2005 and also managed to screw up. It was bought for an undisclosed amount by popular photo site SmugMug.

Oh, and earlier this month, Yahoo! Mail relaunched and revamped itself. Will anyone care? ®

Sponsored:
Minds Mastering Machines – Call for papers now open

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/04/24/yahoo_fined_35m/

Deconstructing the Possibilities and Realities of Enterprise IoT Security

Organizations are rushing to leverage Internet of Things solutions but struggle to design the information technology architectures that will lock down the data these devices create.

When we think of the Internet of Things, most people usually fall back to the kinds of devices they’re familiar with, such as a Nest thermostat or a Philips Hue smart light. However, today IoT components are finding their way, at lightning speed, into places such as healthcare, the enterprise, and certainly the data center.

Let me give you a specific example. Raritan recently came out with a line of “smart racks” that take environmental monitoring to the next level. These data center–ready IoT technologies are tested to withstand billions of hours of runtime in the world’s most data-intensive environments. One of those IoT components are environmental sensors located throughout the rack. From there, they help isolate hot spots, optimize cooling, prevent downtime, and even maintain security through integration with smart locks. Furthermore, these IoT devices gather data, which then feeds into a data center infrastructure management platform, allowing data center and business leaders to make better decisions.

At UPS, IoT sensors help protect the environment by monitoring delivery truck mileage, speed, and overall engine health. Coupled with big data solutions, UPS is also able to effectively monitor packages and optimize entire routes. And, fairly recently, Microsoft and Rolls-Royce collaborated on advanced operational intelligence to airlines. This is similar to what GE is doing with its jet engines. The benefit? Ground crew technicians can identify wear and tear on specific components before the airplane even lands. From there, they can have repair and parts teams ready to cut maintenance windows down dramatically.

[Hear Bill Kleyman speak about The 6 Core Components of IoT — And How to Secure It All at Interop ITX on May 2 in Las Vegas. Register with Promo Code DR200 and save $200.]

By the numbers, according to IDC, the IoT market is showing absolutely no signs of slowing down, with an expected size of $1.4 trillion in 2021. However, when it comes to enterprise adoption of IoT devices, there are concerns. How do you design the right IoT use case? Can it mesh with your existing network and data center systems? Most of all, what about security: How do you process and protect data such as personal identifiable information or personal healthcare information? Organizations want to leverage IoT solutions but are struggling to understand how to design the right architectures and, most importantly, how to leverage and quantify the data that these devices create.

IoT Meet Edge Computing
There is no doubt that data center and business leaders are actively investing in IoT solutions. In the latest AFCOM (Association for Computer Operations Management) State of the Data Center Industry study, a report I helped co-author, we found that 81% of respondents view the primary purpose for expanding edge compute capacity is to support and enable IoT; four in 10 respondents already have either deployed or plan to deploy edge computing. Why this is important is because the goal of edge computing is to process data and services as close to the end user or source as possible. IoT pretty much fits this use case exactly.

In the modern enterprise organization, it’s critical for leaders and IT professionals to both conceptualize IoT components and how they can apply these concepts to their own organization. This is an architectural and business exploratory process to really understand where connected devices can bring value to the business. Whether it’s connected trucks or enhanced engines, your approach to connecting a part of your organization into the digital realm will be unique.

A lot of times, enterprises think that a connecting device has to be something new. However, in many situations, we’re digitally transforming analog systems. For example, by fitting their massive cranes with IoT sensors, a construction company would be able find faults in seconds rather than troubleshooting for hours. To that extent, which analog systems do you have in your IT infrastructure that could be digitized? Where are the data points that you’d like to gather or learn more about? For many organizations, these are potentially big benefits and all part of the IoT revolution. But to really understand the possibilities of enterprise IoT, you will need to take a multifaceted approach:

  • Evolution of the edge. It’s critical to understand that edge solutions help deliver and process data much close to the user. And, when it comes to IoT, edge is a major enabler.
  • IoT security based on context. IoT security is never linear. The best security models will always take a contextual approach to device access and interrogation.
  • The “smart” data center. Your data center is becoming much smarter. From bots to intelligent racks, these are all IoT devices that need security and efficiency.
  • Hacking as an economy. The bad guys have made an industry out of hacking and have economized the process. It’s critical to know how much your data is worth on the Dark Web and why considerations around IoT are key to good security best practices.
  • Key factors in designing and IoT security strategy. Combining edge, the components of IoT, business use cases, and a good overall security strategy are the keys to designing a secure IoT architecture. Beyond that, ensuring data security will be a top priority.

Not only must we continue to educate around IoT, it will be up to the leaders and innovators to find good use cases and proper designs.

Related Content:

 

Bill is an enthusiastic technologist with experience in datacenter design, management, and deployment. His architecture work includes large virtualization and cloud deployments as well as business network design and implementation. Bill enjoys writing, blogging, and educating … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/deconstructing-the-possibilities-and-realities-of-enterprise-iot-security/a/d-id/1331625?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Coviello: Modern Security Threats are ‘Less About the Techniques’

Today’s attack surface is broader, more open, and demands a proactive approach to security, according to former RSA chairman Art Coviello.

As the threat landscape changes, so too do demands on cybersecurity leaders and their teams. Art Coviello, executive chairman (ret.) of RSA, says today’s defenders should be more concerned about vulnerabilities in the attack surface than on threat actors’ specific techniques.

“What people don’t get about the threat landscape is, it’s less about the techniques and more about the attack surface, and the number of openings that have been created,” Coviello said in an interview with Dark Reading during last week’s RSA Conference in San Francisco.

He explained how security concerns have shifted since the time of the dot-com crash, when there were maybe 20- to 30 computer viruses. “Now, there are hundreds of millions,” he pointed out. The tipping point came in 2007, a “watershed year” in which mainstream applications went online and the iPhone launch kickstarted the “age of mobility.”

From that point, the attack surfaced continued to expand and has ever since, he said. Now we’re at a point when employees are going straight from their devices to the cloud. The priority is no longer solely attack prevention, said Coviello, who serves on the Board of Directors at EnerNOC, AtHoc, and Tenable. It’s about a resilient, holistic approach, he said.

One of the places where organizations leave themselves vulnerable is Web applications. With the onset of agile development, Web apps are no longer a curiosity, he said. They’re expected. The waterfall method, in which apps were delivered annually or every six months, has been replaced with agile methodology. Now, developers are creating and updating apps in real-time.

Today’s dev teams are under increasing pressure to make applications safe from the start. “If you don’t build secure code in the first place, you’re in big trouble in an age of agile development,” said Coviello. If they don’t get it right, security teams face the consequences.

With a larger attack surface, companies also have to do a better job of incident detection, response, and recovery. As security operation centers (SOCs) have become overwhelmed with alerts from their growing collection of intelligence systems, prevention is again top of mind. If they have enough information, security teams can spot when attackers are taking action.

“The best place to stop an attack is before it starts,” Coviello noted.

Art Coviello

The influx of threat intelligence tools has driven a change in mindset from reactive to proactive security. Previously, “all of the tools were siloed,” he explained. “They only did one specific things; they didn’t add any value to each other.” Reactive security meant “plugging in the holes” between tools that left information and assets exposed.

Today’s intelligence-driven security model makes it easier to identify and prioritize critical assets, applications, and infrastructure. Security controls need to add value to one another; for example, data loss prevention tools can help pinpoint critical assets. “We can’t defend everything,” said Coviello. “We have to understand what’s most important.” This means determining where valuable data lies and how an attacker might try to get it from the outside.

Proactive security may be the way to go, but many businesses have struggled to adopt it. “There’s a critical shortage of people to implement that model,” said Coviello, pointing to a key trend heard throughout the RSA Conference. “The cost of acquiring talent is skyrocketing.”

It’s also tough to convince business leaders to adopt new technologies when they don’t understand the threats and risk. Most senior management employees don’t understand technology, he explained, and neither do executive boards.

Finally, there is a need for more advanced technology to defend the rapidly expanding attack surface. “The attack surface has been growing faster than the industry has been able to develop the tools,” Coviello noted.

Related Content:

Interop ITX 2018

Join Dark Reading LIVE for a two-day Cybersecurity Crash Course at Interop ITX. Learn from the industry’s most knowledgeable IT security experts. Check out the agenda here. Register with Promo Code DR200 and save $200.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance Technology, where she covered financial … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/coviello-modern-security-threats-are-less-about-the-techniques/d/d-id/1331635?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Ex-Reddit mogul apologizes for making the world ‘a worse place’

Well, this was late in coming: a former Reddit mogul has joined the internet’s walk of shame.

Dan McComas, the former senior vice-president for product of Reddit and the founder and CEO of Imzy, a community-focused platform, is not feeling very good about his tenure at the platform where people go to share their fondness for everything from “Things that make you go AWW!” and “made me smile” to Nazism and “hurting animals” …among so many other fondnesses, in both the witty flow and the feculent spillage of subreddits on so, so many subjects.

New York Magazine recently interviewed McComas for a project called “The Internet Apologizes.” That project has involved interviews with more than a dozen prominent technology figures about “what has gone wrong with the contemporary internet.”

Wrong, as in, this ain’t exactly the “networked utopia” envisioned by Silicon Valley’s starry-eyed founders. Rather, as NY Mag puts it, we’ve got an advertising-dollar-craving, eyeballs-frantic beast, “a globalized strip-mall casino overrun by pop-up ads and cyberbullies and Vladimir Putin.”

Reddit is a corner store in that strip-mall. Along with 4chan, it’s the breeding ground for fake news. But no matter what new outrage drags Reddit into the headlines – be it r/jailbait, a subreddit featuring sexualized images of underage girls; the illegal sharing of nude photos stolen from celebrities; the various incarnations of the racist subreddit r/Coontown; or the more recent Deep Fakes, featuring artificial-intelligence generated fake porn that stitched people’s likenesses onto porn stars’ bodies – Reddit has had a myopic drive to amass growth, McComas says.

A drive has pushed aside nearly all concern for what actually happens within Reddit’s many communities:

From the inside, I can tell you that the board is never asking about revenue. They honestly don’t care, and they said as much. They’re only asking about growth. They believe that if they have a billion unique visitors a month, that they have a property that is going to be worth a ton of money in some way eventually. They really do look at it in that abstract way.

Anybody who’s followed Reddit’s growth will know that its rationale for permitting stomach-churning content – content that’s often veered into encouraging violence – is based on its policies about free speech.

Reddit admins say that they don’t ban communities solely for featuring controversial content. Reddit general manager Erik Martin, as quoted by the Daily Dot in 2015:

Having to stomach occasional troll [sub]reddits like /r/picsofdeadkids or morally questionable [sub]reddits like /r/jailbait are part of the price of free speech on a site like this.

Similarly, former CEO Yishan Wong has said that “distasteful” subreddits won’t be banned because Reddit as a platform should serve the ideals of free speech. The BBC quoted Wong in 2012:

If someday, in the far future, we do become a universal platform for human discourse, it would not do if in our youth, we decided to censor things simply because they were distasteful.

In internet years, we’ve arguably reached Wong’s “far future.” In the 5.5 years since he said those words, Reddit has angered some users with what they perceive as its hypocritical betrayal of its commitment to free expression – particularly with perceived censorship in the GamerGate controversy.

McComas says that behind the scenes, Reddit has refrained from banning subreddits not so much because of its commitment to free expression, but because they don’t want to freak out “volatile” users – a leeriness melted by headlines blowing up:

There are a bunch of animal-cruelty subreddits, specifically with a sexual nature, that they would always refuse to ban. The arguments were usually, ‘We don’t want to touch this because these are our most volatile users and they’ll just make things a nightmare,’ and then, ultimately, these things will bubble up, make it into the press, and then we would make a decision to change things. We would deal with the immediate impact, which was painful, would last a week or two, and then it would go away.

McComas worked at Reddit until 2015. He says that “for the most part,” Reddit is still following this pattern.

McComas says that he was privy to the discussions that made Reddit what it is today, but he was in no position to affect any of the decisions that went into that evolution.

I fundamentally believe that my time at Reddit made the world a worse place. And that sucks, and it sucks to have to say that about myself.

With that, we can put McComas into the category of the remorseful when it comes to those who’ve been instrumental in forming today’s internet. It’s getting to be quite a lengthy parade.

Facebook CEO Mark Zuckerberg, while testifying for Congress, recently listed everything his company has screwed up, from fake news, foreign meddling in the 2016 US presidential election, hate speech and data privacy.

We’ve seen ex-president of Facebook Sean Parker admit that from the get-go, the main goal has been to get and keep people’s attention, by hook, by crook or by dopamine addiction. Former vice president of Facebook user growth Chamath Palihapitiya has expressed remorse for his part.

Facebook has admitted that social media can be bad for you, Zuckerberg has said that his platform needs fixing, Apple’s Tim Cook is keeping his nephew off social media, and in February, a group of “what kind of mind-gobbling social media monster have we created?” repentants came together to form the nonprofit Center for Humane Technology (CHT). It launched a campaign to protect young minds from what they said is “the potential of digital manipulation and addiction.”

Members include former employees and advisors to Google, Facebook, and Mozilla.

McComas says that all these platforms, whose problems are causing soul-searching in the hearts of all these Silicon Valley billionaires, are in the same boat.

I think that the biggest problem that Reddit had and continues to have, and that all of the platforms, Facebook and Twitter, and Discord, now continue to have is that they’re not making decisions, is that there is absolutely no active thought going into their problems – problems that are going to exist in coming months or years – and what they can do to combat them.

Perhaps surprisingly, McComas suggests that Facebook is doing a better job of prioritizing user safety, and putting processes in place for managing content, than its peers. Twitter, however, is a mess, he says:

I think, ultimately, the problem that Reddit has is the same as Twitter and Discord. By focusing on growth and growth only and ignoring the problems, they amassed a large set of cultural norms on their platforms. Their cultural norms are different for every community, but they tend to stem from harassment or abuse or bad behavior, and they have worked themselves into a position where they’re completely defensive and they can just never catch up on the problem.

In fact, McComas doesn’t see how Twitter, or Reddit, can fix themselves. The best they can do, he said, is to “figure out how to hide this behavior from an average user.” The problems are just too ingrained, he said, both on the site, in its communities, in its users, and the public’s expectations.

I think that if you ask pretty much anybody about Reddit, they’re either not going to know what Reddit is, which is the large majority of people, or they’re going to be like, “Oh, it’s that place where there’s jailbait or something like that.” I don’t think that they’re going to be able to turn these things around.

There’s no hope for existing platforms, to McComas’s mind. As far as new platforms go, they could create better infrastructure and platforms for the public at large, but that’s not going to happen until venture capitalists rethink how companies should look as they start up and grow.

Startups have to think about the monetization, he said, as in, how can it work with users, instead of against them? They’ll need to have a product team, or community, or service team, in place that focuses on users from day one. And it’s not something that can be created in the typical 12- to 18-month horizon, McComas said. Creating a platform like Reddit, or Twitter, takes a ton of engineering, human power, marketing, PR, money and time.

It’s really hard to get a network effect going. It would take years. It’s just a really hard process that somebody needs to be in for that ride… I tried, and it just totally didn’t work… I would love to take a crack at it, but it’s ****ing hard to put these resources together.

If he could sit down with startup people right now, this is what he’d tell them, McComas said:

These things can be foreseen. Don’t be idiots about it. You’re people, you see what’s going on, you see trends that are forming, just ****ing do something. It’s not that hard. That’s my advice to founders of start-ups, just be mindful of it. Or put somebody in charge of being mindful of it.


Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/lZyF7Yp9SeE/