Category: Information Security

12
Oct
2020

Microsoft Linux: Maybe Someday

Jack Wallen over at TechRepublic has a new though provoking article out about why Microsoft should replace it’s Windows core with Linux. Basically, the argument goes that if Microsoft is intent on making open source a priority and investing in Windows Subsystem for Linux (WSL), why not go all in and move Windows over to the Linux Kernel? After all, that would unify their cloud strategy, desktop strategy, development strategy, and server strategy around one software stack.

While I think this makes a lot of sense from a IT and infrastructure perspective, it may not be all that easy in practicality. The investment Microsoft has in the Windows Kernel, between desktop and servers, is significant and runs deep. To simply throw that investment away and move to the Linux kernel requires there to be a serious ROI to overcome the decades of sunk cost if that were to happen.

There is an issue of control and the fact that Microsoft likely finds it nice to have complete control over the operating environment. Control allows Microsoft to build complimentary software that is essentially guaranteed to work exactly they way they want it to when running on their OS. Moving to the Linux kernel along with an open source desktop environment on top of it means now Microsoft has to play in the sandbox with many others. Some changes may not be in their best interest as development on these projects continue. Since Microsoft would not have direct control of the project, it won’t be up to them whether or not changes are approved.

Lastly, I continue to take issue with this notion that Linux is somehow the magic security pill that all end-users and organizations need running on their desktops. The reality is that Linux is really no more secure than Windows and an article on Tech Radar by Darren Allan pointed out earlier in 2020. Linux is perceived to be more secure because it is still not widely used outside of IT departments, academic institutions, and software developers. Find me a significant number of people that work outside of a technical field that are running Linux on their desktop then maybe I will change my tune.

Imagine of an additional billion plus devices all started running the Linux kernel. Do you think malware and ransomware authors might take more interest in attacking the operating system? If Microsoft were to create “Microsoft Linux” this is exactly what would happen and the notion of Linux is so secure would start to fall out of favor. All it would prove is that the idea of Linux being more secure was born in a bygone era. An era before Windows had a fully developed file system permissions structure and the ability to restrict certain operations to privileged users.

So while I love the idea of Microsoft moving all of their software and servers to Linux, it just doesn’t seem likely. I think they are very happy developing and integrating the WSL into their current Windows software stack. This let’s them and their customers do whatever they would like in Linux while Microsoft retains control of the core components of the OS. Microsoft can say they love open source software and contribute to the projects they like while not ceding any control of their OS to other developers.

Maybe some day there we will complete harmony among all operating systems. So long as there is a financial incentive to maintain the separately it won’t happen. I also don’t think Microsoft is at a point where they are willing to give control of the kernel and desktop environment to anyone. At that point they might as well keep developing what they have now. Forking the projects means Microsoft will be doing just as much work to maintain the functionality as they are now.

03
Aug
2020

Credit Card Fraud: It’s a Thing

Brian Krebs has a great piece over at his Krebs on Security blog about “…Why Credit Card Fraud is Still a Thing.” The answer is can be summed up is just a few words. Because the United States lags behind the adoption of security standards the rest of the world has long since adopted.

The article is an analysis of the recent paper issued by Maxwell Aliapoulios, Cameron Ballard, Rasika Bhalerao, Tobias Lauinger, and Damon McCoyover at New York University that delves into the seedy underground of dark web data markets. Based on the data analyzed, the researchers found that

Around 97% of the inventory was stolen magnetic stripe data, commonly used to produce counterfeit cards for in-person payments.

Source: NYU

The authors then go further to state

Even multiple years into the U.S. EMV chip deployment, the supply of stolen magnetic stripe data continued to increase sharply.

Source: NYU

This suggests that in the US, there are still far too many merchants either not requiring the use of chip and PIN or simply have not bothered to implement the capability to use it at all.

As the paper goes on, it is clear that the buyers value magnetic stripe data significantly more so long as the data is fresh. However, after the first six weeks of the data being available, its value drops well below that of chip and PIN card data. In contrast, the chip and PIN card data does not fetch a premium early on as magnetic stripe data does, but retains a more consistent value for the long term. International account data are also valued more highly than US account data, especially from Spain, Germany, and France. This suggests that the illicit data buyers see issuing financial institutions in these countries as less likely to disable the cards in the short term than FIs in other countries.

Further on on the analysis, the crucial conclusion is reached about US card issuers by the authors:

From 2016 to 2018, however, the median remaining lifespan of non-EMV accounts increased by about 100 days; the non-EMV population was getting younger, whereas EMV accounts aged by the same amount. This suggests that new non-EMV cards continued to be issued after the liability shift.

Source: NYU

Which then leads me to believe that there is a major issue with how the card networks, like VISA, MasterCard, and others have structured their penalties for non-compliance. there have been too many exemptions and extensions for merchants that don’t need to comply with the EMV mandates. This then disincentivizes financial institutions to disallow fall back to mag stripe for transactions. This then makes more mag stripe data available via skimmers, where if people were using chip and PIN they would not have been compromised.

It’s a vicious cycle and we need to put an end to it. The industry needs to enforce compliance across all merchant categories, and financial institutions need to disable fallback to mag stripe. If this doesn’t happen soon, there is no end in sight for these types of data black markets.

If you want to read the article you can download a copy here.

02
Jul
2020

123456 – I bet I Just Guessed Someone’s Password

A GitHub user going by the name FlameOfIgnis has published a very interesting repository that holds a lot of statistical data for more than 1 billion passwords. These passwords were found in data dumps from any number of the hundreds of data breaches over the past several years and analyzed for a number of different patterns. The most striking results to me are the following:

  • 1 in 142 passwords is 123456
  • 763,000 of the passwords match a pattern that suggests a random password generator is creating passwords with high complexity but low entropy. Meaning there are duplicates occurring far more often than there should be.
  • 34.4% of passwords end with digits but only 4.5% start with a digit.

The rest of the statistics are interesting but I see the above statistics as particularly impactful. If I were a bad actor looking to write a password cracking script either using dictionary attacks or brute force attacks, I would always start with 123456, then I would move in to dictionary attacks with a digit at the end, and then I would start generating passwords with the pattern found in the 763,000. Essentially, statistical analysis like these create a cookbook for deigning attack patterns against web applications protected by a login.

What does this all mean? It means that despite years of being told to do things differently to secure our digital lives, people haven’t taken the guidance to heart. We are still stuck in our old insecure ways, allowing criminals to easily steal our credentials and hijack our digital lives. It amazes me that we have yet to collectively realize just how vulnerable our inability to adapt and change our ways has made us. The threat is obvious and has been exposed for all to see, yet we put our blinders on. Those that are very unlucky only realize the error of their ways when they find their bank accounts drained because someone took over their accounts online.

Take Action

If this scares you like it scares me, take action to secure your information now. Here are some very easy suggestions that will make large positive difference in your online security if you start following them today:

  1. Use a well regarded password manager – I would suggest 1Password, LastPass, or Dashlane if you need a place to start looking.
  2. Never reuse passwords. This is why you have a password manager.
  3. Always generate random passwords that are long and complex. Again, you have a password manager now. Go crazy with that 20 character password containing lowercase letters, uppercase letters, numbers, and special characters.
  4. Always use two-factor authentication when available.
  5. If time-based one-time passcode support is available for two-factor authentication with a specific application, use it. Normally for this type of authentication you would use an app like Authy or Google Authenticator.
  6. Check if your user names and/or email addresses have been found in any data breach data dumps. I highly suggest using Have I Been Pwned for this.
  7. If you know one of your logins is compromised, change your password immediately. If you reused this password in other locations, change all of those too and use unique passwords everywhere.

Stay safe, protect yourself, and make sure your friends and family do the same.

05
May
2020

EventBot Android Malware and Why I Won’t Leave the iPhone

The Hacker News reports that there is a new Android based malware called “EventBot” that is making the rounds in rogue app stores and APK download sites that are not part of the official Google Play ecosystem. In reading The Hacker News article, this sounds pretty nasty but it begs the question, why are users of Android devices are so bent on using app stores and websites that they have no way of know are providing legitimate apps or not? It makes no sense to me.

  • Is it because they don’t know any better?
  • Is it because their phone manufacturer pushes some junk alternative app store to their customers?
  • Is it because they want to use apps they can’t in the Google Play store?
  • Is it because they want to feel rebellious?
  • Is it because they don’t want to be kept down by the “man?”

I have no idea, and I don’t know why these phone users expose themselves to these risks with such a valuable trove of information sitting on their device.

Full disclosure, I am an Apple iPhone user, and probably will be forever. It’s not because I love everything Apple and must have everything Apple. Clearly that isn’t the case given my professional background. It is a combination of economic factors, security factors, and usability factors.. I am bought into the Apple mobile device app ecosystem and it is too costly to leave.

Apple Strengths

There are some things that Apple does do better than the Android community can do, primarily because it is a closed ecosystem.

  1. They keep their users safer because bad actors have a much harder time getting truly malicious software past the app store guardians. Sure there are people that jail break their iPhones, but let’s face it, they are few and far between and most users don’t care to spend the time doing so only to void their Apple Care plan.
  2. I don’t care what kind of Snapdragon processor you have in your Android phone or many milliamp-hours your battery is rated for, they just cannot outlast and out perform an iPhone. You may be able to outperform an iPhone at certain tasks and drain your battery in an hour, or you may be able to make your battery last all day but not get any performance but you won’t be able to do both easily. I have yet to see an Android phone (you can throw any Samsung SXX model out there at this) hold up against any serious comparison to the iPhone processors and battery life combination. I attribute this to the closed Apple ecosystem as well. The software written for apple devices is always highly optimized for just that platform. There is no need to trade off compatibility for performance or battery life. Android’s open ecosystem approach just can’t do this effectively when you have hundreds or thousands of device models you have to play nicely with.
  3. The phones are reliable and they don’t crash*. I can’t count the number of times I have had Android OS phones just restart on me in the past or crash outright. Maybe it was a bad app, or maybe my specific manufacturer’s device model wasn’t tested with the app. Or maybe it was a combination of the app and some random launcher I am using on my Android phone that caused it. Needless to say, my iPhone 11 pro just doesn’t crash, at all. It reboots when I want it to or when it does an update.

*assuming you aren’t running a beta version of their iOS software or trying to us a really old device with a new iOS version. If you want to be bleeding edge or never buy new hardware, you are going to have issues on any platform.

Android Strengths

On the flip side, you can do some really cool things with Android devices that you can’t do with Apple devices.

  1. You can interact with your device at the hardware level and as long as you give an app permission to do it, they can do a whole lot. Want to record phone calls? No problem. Want to quickly and easily side load an app? No problem. Want to completely change how your phone keys work? No problem. Android is all about letting people do what they want when they want. For better or worse.
  2. You can make the phone look and feel exactly how you want. Don’t like that app launcher? Change it. Don’t like the app manager and user interface? Change it. Want the light to flash purple when you get a slack message? Go for it. Again, Android is all about the ability to make the phone do anything you want, regardless of the performance and security impacts it may have.
  3. You can find a model of phone with just the features you want at the price you want. There is no “Apple tax” when buying an Android device. Just pick the model from the thousands out there that fits your needs and budget.

What is Best For Me

The nerd in me loves these things about Android, but the practical user side of me does not. When I pick up my phone I want to know that it is going to work without any issues – every time. I don’t want to worry about a new app launcher eating up my battery and destroying the CPU usage. I don’t want to worry if that app I just downloaded has malware in it it. I don’t want to have to manage app permissions at such a granular level that I have to worry about every little thing it has access to in the OS.

At the end of the day, I just want a device that works. That means iPhone with iOS will consistently be more capable and secure for my use case. I am willing to live with the lack of customization in some respects in order to have a better overall user experience with performance and security. An experience that doesn’t require my constant attention to achieve. I have enough other things to worry about each day, my phone should not have to be one of them.

23
Mar
2020

Information Security in the Age of COVID-19

The Hacker News is running several interesting articles related to information security and COVID-19 as they relate to emerging threats. Specifically, the threats that a newly mobilized remote workforce faces when many of them have little on detecting threats outside of their normal work environment. While the article referenced specifically touts Cynet’s service offering, the guidance offered is applicable across the board.

Take for example, all of your new remote workers who are receiving all or some of their direction via personal communication channels whether they be phone, SMS, or email. How many of these staff are capable of discerning phishing messages on their personal devices? It is one thing when they have a corporate suite of products assisting them to make these judgement calls, but when they don’t have those can they still be trusted to determine who the bad actors are? In all likelihood the answer is going to be that remote workers are going to be less capable of protecting themselves without new training programs and time to become acclimated to their new reality. COVID-19, however, has made it so there is no time to do so in the face of mandates to have 100% of your workforce out of the office. Introducing new training for these workers about how to protect themselves in this chaotic time is going to be crucial not only for them but also for the well being of the organization as a whole. In addition to training, all information security teams should be looking at how to best to detect unauthorized data loss as well as unauthorized access into corporate networks. It also goes without saying that any remote access solutions should also be protected by two-factor authentication.

Be well, be safe, and secure your networks.

23
Jan
2020

Microsoft Exposes Elasticsearch Database to the World

Security Week reports that Microsoft has suffered a mishap with a handful of its Elasticsearch databases causing approximately 250 million customer support records to be exposed. While financial information for these clients was not exposed, it does appear that the data could be used for phishing attacks and tech support scams.

Of course the kicker is that Microsoft runs one of the largest cloud services on earth where users must take great pains to secure these systems that they setup. Now it turns out the company running these types of services can’t secure their own systems. While I know that these Elasticsearch databases were not really part of the Azure cloud service, it does beg the question that if Microsoft can’t secure their own systems, how can their clients ever hope to completely secure their own systems in the Azure cloud. If nothing else, this should serve as a reminder that no company, person, organization, etc. is immune to security lapses and great care should always be taken to secure both internal and cloud systems.

03
Dec
2019

VNC Client and Server Software Vulnerabilities Found

The Hacker News reports that dozens of new VNC client and server vulnerabilities have been found in the open source versions of the tools used by IT departments all over the world. If you are like me and think “VNC, who uses that any more?” then you should go check out a YouTube video by Tobias M├Ądel where he connects to open VNC servers all over the internet. Sure, the video is from 2015, but when you think about how quickly industrial plant management software and device firmware is updated you can bet money that there are still plenty of open VNC servers still running and accessible.

The moral of the story? Don’t expose critical systems and services (like RDP and VNC) over the internet unless it is absolutely essential. If it is essential, and you can’t put them behind a VPN, then you had better use a very strong and complex password to secure the access. Even with a VPN you should do that. Lastly, you need to makes sure you and any vendor you are purchasing software and devices from have a strong policy of pushing out updates anytime a vulnerability is found. You can’t afford to wait five years for an update when your chemical plan control system is left completely exposed on the internet through remote access software flaws.

13
Nov
2019

The End is Nigh! Time to Ditch Windows 7 Now

ITWorld has a very interesting long running series of articles chronicling the slow but steady demise of Windows 7 and the slow but stead rise of Windows 10 in terms of market share. Come January 14th 2020, Windows 7 support will officially end (unless you want to keep paying Microsoft for security updates on a per PC basis) and you will no longer get all of those critical updates needed to keep your organization secure.

What amazes me about the whole process is the prediction by Net Applications that Windows 7 may retain 10+ percent market share well into 2022, long after support has ended and almost every known flaw will be easily exploitable. Don’t get me wrong, I know first hand how painful it can be to update and replace thousands of physical PCs to get rid of an old OS but as hard as that may be, it is well worth it. In my own experience, the reduction in vulnerabilities just from going to a fully patched version of Windows 7 to a fully patched version of Windows 10 will make a world of difference on your audit scorecards.

Please do you and your organization a favor and move to Windows 10 now. You will be happy you did and it will allow you to sleep better at night.

11
Nov
2019

Your People Are Your Biggest Threat

The Hacker News has an article posted from November 7th about a rogue TrendMicro employee stealing customer data and selling it to a tech support scammer. This goes to show, once again, that your people are always your biggest threat. Whether they are clicking on malicious links in from that prince who sent them an email or actively stealing data to sell on the black market, they are likely going to do something to cause you serious pain. Many companies don’t know how to combat these threats or are completely oblivious to what their people may be doing. Here are some ideas to help protect your organization:

  1. Invest in training – Train, train, train, and then train your staff again to be vigilant and know how to recognize a malicious email, phone call, or text message before they divulge any information. If they fall for one, deliver on-the-spot training to help them learn from their mistake.
  2. Invest in more than your average anti-virus software – Advanced Persistent Threats (APTs) are the buzzword of the decade. While you don’t need to listen to all the marketing hype, you should have a host based security solution on your PCs and servers that does more than just look for known signatures. It needs to identify unknown threats as well as known threats, block ransomware, stop data being transferred to removable storage, and more.
  3. Adopt a policy of least privilege – Does that receptionist really need local administrative privileges on their PC? Does that staff trainer really need access to the marketing database? I don’t think so. If people don’t need access to data, make sure they can’t get to it.
  4. Classify your data – What is in that random word document on the accounting shared drive? Is it something that shouldn’t leave the building? If it is, make sure you are tagging the document and putting restrictions in place on your firewalls to stop it from leaving. Do this for all of your data and put rules in place to protect it where it is stored.
  5. Invest in Data Loss Prevention (DLP) tools – Make sure data isn’t leaving your organization. Have tools that can observe data movement, alert, and stop it from happening if needed.
  6. Protect your data from and in the Cloud – Invest in Cloud Access Security Brokers (CASBs) if you allow your staff to store data and work in the cloud. You don’t want data stored improperly in services like Slack, Office 365, Dropbox, Gmail, or somewhere else.

There are many other things you could do as well, but I would argue if you have these tools in place and configured properly, you just might avoid ending up like TrendMicro.

10
Nov
2019

The Best Defense is a Good Offense

Krebs on Security has an article published on October 16th from this year (I know I am behind) detailing the attack of a known black market card fraud site BriansClub. What is interesting about this whole hack is that it is not some vigilante group going after the site to save consumers, but rather it is a rival black market operation trying to sabotage the operations of one of their competitors. In essence, this was a business decision made by one of BriansClub’s competitors to try and take them out of business. It’s similar two warring cartels attacking each other until the other doesn’t have the resources or the people to continue operations.

This does beg the question though, why not make offensive operations against these kinds of sites the norm, not the outlier? In the financial services industry we have a number of cybersecurity information sharing organizations, maybe it is time to establish an offensive cyber operations organization that doesn’t just share information about known threats but actively seeks them out and attempts to disrupt illegal operations. Of course there are potential pitfalls with this type of setup. The efforts of this type of group would have to be carefully watched by both the industry and law enforcement to ensure the operations were focused solely against illegal operations in the dark web. The last thing you would want would be to have a group that was supposed to protect consumers decide to go rogue.

Risks aside, it seems like it is time to open up and publicly establish more direct industry operations against these criminal elements. Sharing information will never prevent fraud, these sites have to be shown it isn’t worth operating because they will be taken down before they can ever make any money.