Tagged: infosec

02
Jul
2020

123456 – I bet I Just Guessed Someone’s Password

A GitHub user going by the name FlameOfIgnis has published a very interesting repository that holds a lot of statistical data for more than 1 billion passwords. These passwords were found in data dumps from any number of the hundreds of data breaches over the past several years and analyzed for a number of different patterns. The most striking results to me are the following:

  • 1 in 142 passwords is 123456
  • 763,000 of the passwords match a pattern that suggests a random password generator is creating passwords with high complexity but low entropy. Meaning there are duplicates occurring far more often than there should be.
  • 34.4% of passwords end with digits but only 4.5% start with a digit.

The rest of the statistics are interesting but I see the above statistics as particularly impactful. If I were a bad actor looking to write a password cracking script either using dictionary attacks or brute force attacks, I would always start with 123456, then I would move in to dictionary attacks with a digit at the end, and then I would start generating passwords with the pattern found in the 763,000. Essentially, statistical analysis like these create a cookbook for deigning attack patterns against web applications protected by a login.

What does this all mean? It means that despite years of being told to do things differently to secure our digital lives, people haven’t taken the guidance to heart. We are still stuck in our old insecure ways, allowing criminals to easily steal our credentials and hijack our digital lives. It amazes me that we have yet to collectively realize just how vulnerable our inability to adapt and change our ways has made us. The threat is obvious and has been exposed for all to see, yet we put our blinders on. Those that are very unlucky only realize the error of their ways when they find their bank accounts drained because someone took over their accounts online.

Take Action

If this scares you like it scares me, take action to secure your information now. Here are some very easy suggestions that will make large positive difference in your online security if you start following them today:

  1. Use a well regarded password manager – I would suggest 1Password, LastPass, or Dashlane if you need a place to start looking.
  2. Never reuse passwords. This is why you have a password manager.
  3. Always generate random passwords that are long and complex. Again, you have a password manager now. Go crazy with that 20 character password containing lowercase letters, uppercase letters, numbers, and special characters.
  4. Always use two-factor authentication when available.
  5. If time-based one-time passcode support is available for two-factor authentication with a specific application, use it. Normally for this type of authentication you would use an app like Authy or Google Authenticator.
  6. Check if your user names and/or email addresses have been found in any data breach data dumps. I highly suggest using Have I Been Pwned for this.
  7. If you know one of your logins is compromised, change your password immediately. If you reused this password in other locations, change all of those too and use unique passwords everywhere.

Stay safe, protect yourself, and make sure your friends and family do the same.

23
Mar
2020

Information Security in the Age of COVID-19

The Hacker News is running several interesting articles related to information security and COVID-19 as they relate to emerging threats. Specifically, the threats that a newly mobilized remote workforce faces when many of them have little on detecting threats outside of their normal work environment. While the article referenced specifically touts Cynet’s service offering, the guidance offered is applicable across the board.

Take for example, all of your new remote workers who are receiving all or some of their direction via personal communication channels whether they be phone, SMS, or email. How many of these staff are capable of discerning phishing messages on their personal devices? It is one thing when they have a corporate suite of products assisting them to make these judgement calls, but when they don’t have those can they still be trusted to determine who the bad actors are? In all likelihood the answer is going to be that remote workers are going to be less capable of protecting themselves without new training programs and time to become acclimated to their new reality. COVID-19, however, has made it so there is no time to do so in the face of mandates to have 100% of your workforce out of the office. Introducing new training for these workers about how to protect themselves in this chaotic time is going to be crucial not only for them but also for the well being of the organization as a whole. In addition to training, all information security teams should be looking at how to best to detect unauthorized data loss as well as unauthorized access into corporate networks. It also goes without saying that any remote access solutions should also be protected by two-factor authentication.

Be well, be safe, and secure your networks.

03
Dec
2019

VNC Client and Server Software Vulnerabilities Found

The Hacker News reports that dozens of new VNC client and server vulnerabilities have been found in the open source versions of the tools used by IT departments all over the world. If you are like me and think “VNC, who uses that any more?” then you should go check out a YouTube video by Tobias M├Ądel where he connects to open VNC servers all over the internet. Sure, the video is from 2015, but when you think about how quickly industrial plant management software and device firmware is updated you can bet money that there are still plenty of open VNC servers still running and accessible.

The moral of the story? Don’t expose critical systems and services (like RDP and VNC) over the internet unless it is absolutely essential. If it is essential, and you can’t put them behind a VPN, then you had better use a very strong and complex password to secure the access. Even with a VPN you should do that. Lastly, you need to makes sure you and any vendor you are purchasing software and devices from have a strong policy of pushing out updates anytime a vulnerability is found. You can’t afford to wait five years for an update when your chemical plan control system is left completely exposed on the internet through remote access software flaws.

10
Nov
2019

The Best Defense is a Good Offense

Krebs on Security has an article published on October 16th from this year (I know I am behind) detailing the attack of a known black market card fraud site BriansClub. What is interesting about this whole hack is that it is not some vigilante group going after the site to save consumers, but rather it is a rival black market operation trying to sabotage the operations of one of their competitors. In essence, this was a business decision made by one of BriansClub’s competitors to try and take them out of business. It’s similar two warring cartels attacking each other until the other doesn’t have the resources or the people to continue operations.

This does beg the question though, why not make offensive operations against these kinds of sites the norm, not the outlier? In the financial services industry we have a number of cybersecurity information sharing organizations, maybe it is time to establish an offensive cyber operations organization that doesn’t just share information about known threats but actively seeks them out and attempts to disrupt illegal operations. Of course there are potential pitfalls with this type of setup. The efforts of this type of group would have to be carefully watched by both the industry and law enforcement to ensure the operations were focused solely against illegal operations in the dark web. The last thing you would want would be to have a group that was supposed to protect consumers decide to go rogue.

Risks aside, it seems like it is time to open up and publicly establish more direct industry operations against these criminal elements. Sharing information will never prevent fraud, these sites have to be shown it isn’t worth operating because they will be taken down before they can ever make any money.

26
Aug
2019

Time To Unplug Your Smart Ovens

The Verge reports that owners of the June smart oven have been experiencing some seriously concerning incidents recently involving the oven’s preheating without their owner’s knowing. This continues to raise questions about just how much control you want to give smart devices over your house and its critical systems. While I am not sure what the true cause of the issue is, it should make everyone re-think connecting so called “smart” devices that can cause serious physical damage if something goes wrong. An oven is a perfect example of this kind of device.

Smart ovens, locks, etc. all sound great until they are hacked, poorly programmed, designed poorly, etc. When your smart device can let a malicious person into your home, cause your food to go bad, burn down your home, track your movements, etc. then it is time to rethink just how smart you want your home to be. I know smart devices are the way of the future, I have many of them myself, but I never hook them up to anything that could physically damage my home. There is too much risk to take given that the health of you and your family are at stake.

I urge anyone considering these devices to evaluate why they are needed and if you can live without them. After all, preheating your oven is great, but not burning down your house is even better.