It goes without saying that the Government even with their many billions of dollars on security have failed to stop the ex-filtration of highly classified material. Just look at Wikileaks and the Bradley Manning (or Chelsea to be correct now) case. While the Government performs background checks on individuals, facilities, etc. these leaks do happen. Think about how companies are being affected today. They have less money invested and the auditors that give them the all clear are not checking the very hacking vectors that are being used to steal peoples information, trade secrets and more.
It really irritates us when we see companies being breached that have hired these large security firms that only concentrate on the infrastructure, malware and viruses. You folks do realize that over85% of the time a successful attack is the result of successful social engineering or bypassing weak security features in products that are not usually checked in an audit.
While we won't give away all of our auditing steps we can tell you that the normal audit only covers about 30% of the areas that should be checked. And while you should be checking other areas before giving a certification we understand that you are there to do only one job. Keep hiring the Mandiants, the Dell SecureWorks and others (oh and by the way Dell's feed data is all out of date and inaccurate in most cases) and wonder why your companies still get breached. Your getting breached folks because your not checking the actual vectors that are being used and your not changing with the times.
Sure your employees may pickup on somebody calling them claiming to be from the help desk, or maybe they won't. And maybe your employees are using secure (truly insecure) corporate messaging products away from the office and leaving a clear way into your network (you are paying attention here right?). Have you checked to make sure what the company claims is in fact the case? Can their encryption be hijacked? I bet it can with the right knowledge and time. Stop taking these large companies at their word just because they are large companies that have been around for awhile.
Good luck folks. If you want a real audit conducted contact us. It will be extensive, concise and complete.
The purpose of this page is to provide awareness to individuals and organizations that are leaking information and the information of their customers. The entities listed on this site are verified to be leaking personal information sometimes without the company even being aware. SLC Security is now owned and operated by Jigsaw Security Enterprise. We are currently in process and as such this blog will eventually be taken offline and merged with Jigsaw Security resources.
Showing posts with label Opinion. Show all posts
Showing posts with label Opinion. Show all posts
Sunday, March 1, 2015
Tuesday, February 10, 2015
Delay in actionable intelligence creating additional risk, additional malware seen
With the recent Anthem incident it goes without saying that organizations need to share information to protect other entities from similar attacks. In the case of Anthem the information has been shared with only 2 organizations and the information being put out by commercial vendors is incomplete and in some cases completely inaccurate. What we are seeing is that many people are making guesses as to what the actual threat is.
It seems like this recent issue and with the Sony issue that in both cases the information coming out of the analysis of these events is being withheld from commercial security vendors. This does nothing to protect others that may face similar attacks. It should be noted however that the attackers in this case have moved on to other attacks.
This is a concerted effort to infiltrate many businesses and Government. As of yet we have not seen any real and meaningful cooperation between Anthem, Sony or the Government. If they really wanted to protect the masses clear and concise information would be put out for everyone.
This leads me to believe that nobody really knows the exact methods. I can tell you that there are zero day attacks being used as well as a known browser flaw that is not being fixed by vendors. If hackers know about it and vendors choose to ignore it there is really nothing the average person can do to protect themselves from the threats that loom.
I have predicted that the educational space will be the next to have issue based on what we have seen. Because of this we will offer educational institutions access to our blocklist in the hope that some will be proactive and save themselves some embarrassment. There have been several attackers on Twitter posting educational information and much of the stolen information is available on Darknet and being shared between hackers.
This open sharing initiative that everybody speaks of is non existent and probably will not come to pass. It's a shame really as there are power in numbers. We need a distributed protection system that can incorporate actual information between vendors in near real time. Until this happens we will continue to see disinformation. In addition the naming conventions between commercial products is horrible and confusing and interoperability between companies is horrible as well.
The additional malware being seen that is NOT being tracked by any of the major vendors was previously posted.
Indicator Information
IP Addresses Involved:
196.203.89.134
194.105.9.85
82.81.128.61
50.56.56.125
Also it goes without saying that certain file extensions should be dropped by your email gateways.
It seems like this recent issue and with the Sony issue that in both cases the information coming out of the analysis of these events is being withheld from commercial security vendors. This does nothing to protect others that may face similar attacks. It should be noted however that the attackers in this case have moved on to other attacks.
This is a concerted effort to infiltrate many businesses and Government. As of yet we have not seen any real and meaningful cooperation between Anthem, Sony or the Government. If they really wanted to protect the masses clear and concise information would be put out for everyone.
This leads me to believe that nobody really knows the exact methods. I can tell you that there are zero day attacks being used as well as a known browser flaw that is not being fixed by vendors. If hackers know about it and vendors choose to ignore it there is really nothing the average person can do to protect themselves from the threats that loom.
I have predicted that the educational space will be the next to have issue based on what we have seen. Because of this we will offer educational institutions access to our blocklist in the hope that some will be proactive and save themselves some embarrassment. There have been several attackers on Twitter posting educational information and much of the stolen information is available on Darknet and being shared between hackers.
This open sharing initiative that everybody speaks of is non existent and probably will not come to pass. It's a shame really as there are power in numbers. We need a distributed protection system that can incorporate actual information between vendors in near real time. Until this happens we will continue to see disinformation. In addition the naming conventions between commercial products is horrible and confusing and interoperability between companies is horrible as well.
The additional malware being seen that is NOT being tracked by any of the major vendors was previously posted.
Indicator Information
IP Addresses Involved:
196.203.89.134
194.105.9.85
82.81.128.61
50.56.56.125
Also it goes without saying that certain file extensions should be dropped by your email gateways.
Thursday, February 5, 2015
How we monitor for problems and detect issues before the attack...
Utilizing our cloud based computing platform we are able to see attack information as it happens in real time. We are able to monitor Dark Net, Usenet and OSINT sources for relevant information concerning the activity of hackers and cyber criminals. We have been warning companies and advising them on what to look for but they don't seem to take our warnings seriously. And months later we read about issues in the news once they finally figure out that we were right in the first place.
It has happened numerous times in the past and will happen in the future unless these entities take our alerts seriously. Companies are too busy looking at their perimeter's to really get an understanding of what is really taking place. All too often the information is available to indicate a problem because once a site is breached typically other attacks are launched from that same infrastructure to other organizations. Using link analysis between companies and attacks that are being reported is a smart way to connect the dots folks. These technologies exist for a reason and as systems evolve they get better and better at predictive analysis based on past activity.
We sincerely hope you start putting the pieces together because the time of breach until there are actual notifications are usually around 12 months out. Anthem just caught the problem in 4 months but that means that they are better than average at detecting the problem but not stopping it.
If any of these companies took their security seriously they would consider utilizing big data to highlight problems before they are nightmares for the companies involved.
Quite honestly our team of volunteers are extremely good at detecting issues but we simply do not have the resources to do our analysis on a large scale. If we had the funding and additional resources we could certainly assist with these investigations but as of now we will continue to do large data analysis and warn the companies that we note as having problems in the hope that at some point a company will notice that we are way ahead of the "average" and help us get to a place where we can really be effective and assist law enforcement in containing these issues and actually finding the entities responsible for these data breaches. Until that happens we will continue to research, blog and watch from the sidelines.
If the Government were to really fund the cyber security initiatives and get private industry to bring technologies that work to market we could be a much bigger help in these cases but until that happens we will sit back and watch.
It's a shame really.
So here's what we suggest to help prevent these large breaches in the future. Stop withholding data when it comes to cyber security. Provide a clearinghouse where we can report issues and use the indicators of compromise that we have developed. I'm sorry but 95% of the technologies in use are reactive. You need analytics that can find trends and identify suspicious activity over the entire Internet connected infrastructure.
Until we have a view of the entire Internet we are confined to our own little LAN connected world and chances are somebody has already infiltrated your infrastructure. If you want to wait 12 months while they steal your data be my guest or hire us to come in a get rid of the badness and save yourselves some major embarrassment.
Later this week we will for the first time every compile a list of all of the organizations that we are more than 80% confident that have issues that need to be addressed. Our system is reporting on real world attacks and since we report on these attacks we are a major target. One good thing about being a target is that it forces attackers to show their infrastructure that they are using to attack us (and many others). Using this data we can quite quickly build out a clear picture of bad activity being directed at us and others.
Have a great week and we look forward to working with the ones that value their security posture.
It has happened numerous times in the past and will happen in the future unless these entities take our alerts seriously. Companies are too busy looking at their perimeter's to really get an understanding of what is really taking place. All too often the information is available to indicate a problem because once a site is breached typically other attacks are launched from that same infrastructure to other organizations. Using link analysis between companies and attacks that are being reported is a smart way to connect the dots folks. These technologies exist for a reason and as systems evolve they get better and better at predictive analysis based on past activity.
We sincerely hope you start putting the pieces together because the time of breach until there are actual notifications are usually around 12 months out. Anthem just caught the problem in 4 months but that means that they are better than average at detecting the problem but not stopping it.
If any of these companies took their security seriously they would consider utilizing big data to highlight problems before they are nightmares for the companies involved.
Quite honestly our team of volunteers are extremely good at detecting issues but we simply do not have the resources to do our analysis on a large scale. If we had the funding and additional resources we could certainly assist with these investigations but as of now we will continue to do large data analysis and warn the companies that we note as having problems in the hope that at some point a company will notice that we are way ahead of the "average" and help us get to a place where we can really be effective and assist law enforcement in containing these issues and actually finding the entities responsible for these data breaches. Until that happens we will continue to research, blog and watch from the sidelines.
If the Government were to really fund the cyber security initiatives and get private industry to bring technologies that work to market we could be a much bigger help in these cases but until that happens we will sit back and watch.
It's a shame really.
So here's what we suggest to help prevent these large breaches in the future. Stop withholding data when it comes to cyber security. Provide a clearinghouse where we can report issues and use the indicators of compromise that we have developed. I'm sorry but 95% of the technologies in use are reactive. You need analytics that can find trends and identify suspicious activity over the entire Internet connected infrastructure.
Until we have a view of the entire Internet we are confined to our own little LAN connected world and chances are somebody has already infiltrated your infrastructure. If you want to wait 12 months while they steal your data be my guest or hire us to come in a get rid of the badness and save yourselves some major embarrassment.
Later this week we will for the first time every compile a list of all of the organizations that we are more than 80% confident that have issues that need to be addressed. Our system is reporting on real world attacks and since we report on these attacks we are a major target. One good thing about being a target is that it forces attackers to show their infrastructure that they are using to attack us (and many others). Using this data we can quite quickly build out a clear picture of bad activity being directed at us and others.
Have a great week and we look forward to working with the ones that value their security posture.
Monday, January 12, 2015
OUR OPINION: National Breach Notification Standard
We have been reading articles and watching interviews concerning a national breach notification standard and several people in our office and clients have stated some things that really have us thinking about this proposal.
Part of the proposal states that Americans have a right to know what information is being collected about them and how it is being used. This is interesting with the recent things that have come to light out of the Snowden debacle. In fact if that's the case I would think that the Government should play by the same rules that they are dishing out on the Corporate world.
Of course we all know they will exempt themselves from having to meet the same guidelines.
One other interesting aspect is that it will give businesses 30 days to disclose if information has been lost or stolen. Well that's fine but what about the businesses that never acknowledge having had a breach and the security researchers that have the information and are afraid to release it for fear of reprisal?
We get submissions every single day and while we cannot validate each and every one some businesses do the right thing and deal with the notifications and take care of their customers, but many don't. Many of the organizations including colleges and universities simply ignore it because they know we can't release their information. It's a catch 22 that the Government and laws are not keeping up with. They should have a program (within the Government) where these submissions can be presented without threat of legal action from the affected party. This would eliminate the general liabilities of security researchers that are privy to more information than even the Government.
Thought our comments are greatly appreciated on this topic!
Part of the proposal states that Americans have a right to know what information is being collected about them and how it is being used. This is interesting with the recent things that have come to light out of the Snowden debacle. In fact if that's the case I would think that the Government should play by the same rules that they are dishing out on the Corporate world.
Of course we all know they will exempt themselves from having to meet the same guidelines.
One other interesting aspect is that it will give businesses 30 days to disclose if information has been lost or stolen. Well that's fine but what about the businesses that never acknowledge having had a breach and the security researchers that have the information and are afraid to release it for fear of reprisal?
We get submissions every single day and while we cannot validate each and every one some businesses do the right thing and deal with the notifications and take care of their customers, but many don't. Many of the organizations including colleges and universities simply ignore it because they know we can't release their information. It's a catch 22 that the Government and laws are not keeping up with. They should have a program (within the Government) where these submissions can be presented without threat of legal action from the affected party. This would eliminate the general liabilities of security researchers that are privy to more information than even the Government.
Thought our comments are greatly appreciated on this topic!
Thursday, November 6, 2014
Leveraging Hadoop for Security Analysis in Networks
I have been trying to stay active on the blog but as you all can tell we have become somewhat busy over the past few weeks. This is to be expected when we are in a predictive mode instead of a reactive one. Earlier tonight I was showing another security engineer how we can pull various data points into our hadoop cluster and analyze things quicker and more efficiently than we can on a single computer. Over the past 5 years I have built cloud environments for many purposes some of which ended up being long term solutions and some of which went away when administrators realized that operating a cloud requires a specific set of skills and the right people in the right places. A single person can maintain a cloud computing environment with the right software management in place but the work can be consuming until you automate everything.
As part of our business model the cloud is an integral part of what we do. From collecting news and intelligence information for analysis, to running batch jobs to do task that would take a security engineer hour upon hour to complete manually, the cloud makes life easier. There are some tradeoffs when utilizing the cloud as you have to fully understand what each piece of software does and how they interact with one another to get a job to a completed state.
So why this article? Because as security engineers you can't possibly look at all the data in an enterprise. You can however build watch list in a cloud to notify you when certain content is being ingested into the system. This saves the engineers time. Here's an example. Say a new malware variant comes on the scene and you want to analyze how many machines are infected with the malware. You will need a few things to get the task done in a reasonable time frame. Doing task manually make take weeks or even months but leveraging hadoop, solr, cassandra, hive, pig, etc, etc. you can do these same task in under a day. I like to let the cloud work while I sleep. I wake up feeling somewhat productive if the task are completed when I start my work day. But let's get back to our example. In order to find that elusive new malware variant you need some things. Let me list them out.
Computing Power (CPU's) - Processing Gigabytes or Petabytes of data requires heavy usage of CPU's. By leveraging multicore CPU's in a cluster of machines you eliminate this problem.
Memory (RAM) - You have to have memory. Things are read and written much quicker in memory than on disc drives (think solid state drives here). If you can afford them put SSD's in your cloud. Your batch jobs will thank you.
Disc Space - You have to have the space to store things. If you can't store the Petabytes of data you can't analyze it either. You need a place to store your vectors, configurations, investigative files, etc.
Vectors - You have to have points of data to work with. In our malware example let's say we will use the MD5 hashes of the malware to detect it. That's a vector of identification. Once we identify it we need to process it.
Scripts, Parsers, Libraries and such - You have to have a consistent, and standardized way of doing things so your jobs are repeatable. You want predictable results without error. You will use a multitude of scripts, mapreduce jobs, indexes (to speed searches and queries), and parsers to find what your looking for.
Now that we have found the malware on the network what do we do with it. One of the most likely things you will do with a cloud is build statistics. In this case we want to build a list of infected IP addresses and domain names so we know what entity is infected so we can report on it (probably on a blog such as this one). However we don't want to sit and sift through Petabytes of data so we write our process out in mapreduce or some other language and let it work while we sleep.
Live Streaming Data - In order to find malware infections in near real time we need to have near real time data. Products such as sqoop and flume help in this regard. So we pull in things such as network pcaps, honeypot logs, malware submission reports, etc, etc.
So using all these various tools and data points we begin collecting statistics but that's not all we have to do. We want to identify the IP address or domain owners so we can notify them (just like we do when a patients information get's released to the public). We have to know whom to notify so it's imperative to identify.
Tracking - Once you have the information in hand you now need a way to track the outcome of your notifications. This is where old technology such as a pen and paper, an electronic notebook or hell maybe even one of those fancy trouble ticketing systems would work.
In order to make it in this fast moving world you have to do things quicker, more accurate and get the information out there before your competition. This is what a cloud does for us and what it could do for your organization.
Happy Hadooping!
About the author: Kevin Wetzel has been a leading researcher and cloud engineer since 2006. He has worked for various organizations to include the Department of Defense, Department of Homeland Security, various Health Care and Insurance organizations, business owners and politicians as well as private parties. Mr. Wetzel is a fan of cloud computing to make business processes run more efficiently. SLC Security Services LLC relies heavily on this type of technology in many of our services and products. Cloud computing can mean the difference between just getting the job done and getting the job done efficiently and before your competition. Kevin is a CCHA (yeah I got the certification before they changed it to CCAH), a licensed Investigator and Counterintelligence Specialist with SLC Security Services LLC. For more information on SLC Security you can visit the company website at www.slcsecurity.com.
As part of our business model the cloud is an integral part of what we do. From collecting news and intelligence information for analysis, to running batch jobs to do task that would take a security engineer hour upon hour to complete manually, the cloud makes life easier. There are some tradeoffs when utilizing the cloud as you have to fully understand what each piece of software does and how they interact with one another to get a job to a completed state.
So why this article? Because as security engineers you can't possibly look at all the data in an enterprise. You can however build watch list in a cloud to notify you when certain content is being ingested into the system. This saves the engineers time. Here's an example. Say a new malware variant comes on the scene and you want to analyze how many machines are infected with the malware. You will need a few things to get the task done in a reasonable time frame. Doing task manually make take weeks or even months but leveraging hadoop, solr, cassandra, hive, pig, etc, etc. you can do these same task in under a day. I like to let the cloud work while I sleep. I wake up feeling somewhat productive if the task are completed when I start my work day. But let's get back to our example. In order to find that elusive new malware variant you need some things. Let me list them out.
Computing Power (CPU's) - Processing Gigabytes or Petabytes of data requires heavy usage of CPU's. By leveraging multicore CPU's in a cluster of machines you eliminate this problem.
Memory (RAM) - You have to have memory. Things are read and written much quicker in memory than on disc drives (think solid state drives here). If you can afford them put SSD's in your cloud. Your batch jobs will thank you.
Disc Space - You have to have the space to store things. If you can't store the Petabytes of data you can't analyze it either. You need a place to store your vectors, configurations, investigative files, etc.
Vectors - You have to have points of data to work with. In our malware example let's say we will use the MD5 hashes of the malware to detect it. That's a vector of identification. Once we identify it we need to process it.
Scripts, Parsers, Libraries and such - You have to have a consistent, and standardized way of doing things so your jobs are repeatable. You want predictable results without error. You will use a multitude of scripts, mapreduce jobs, indexes (to speed searches and queries), and parsers to find what your looking for.
Now that we have found the malware on the network what do we do with it. One of the most likely things you will do with a cloud is build statistics. In this case we want to build a list of infected IP addresses and domain names so we know what entity is infected so we can report on it (probably on a blog such as this one). However we don't want to sit and sift through Petabytes of data so we write our process out in mapreduce or some other language and let it work while we sleep.
Live Streaming Data - In order to find malware infections in near real time we need to have near real time data. Products such as sqoop and flume help in this regard. So we pull in things such as network pcaps, honeypot logs, malware submission reports, etc, etc.
So using all these various tools and data points we begin collecting statistics but that's not all we have to do. We want to identify the IP address or domain owners so we can notify them (just like we do when a patients information get's released to the public). We have to know whom to notify so it's imperative to identify.
Tracking - Once you have the information in hand you now need a way to track the outcome of your notifications. This is where old technology such as a pen and paper, an electronic notebook or hell maybe even one of those fancy trouble ticketing systems would work.
In order to make it in this fast moving world you have to do things quicker, more accurate and get the information out there before your competition. This is what a cloud does for us and what it could do for your organization.
Happy Hadooping!
About the author: Kevin Wetzel has been a leading researcher and cloud engineer since 2006. He has worked for various organizations to include the Department of Defense, Department of Homeland Security, various Health Care and Insurance organizations, business owners and politicians as well as private parties. Mr. Wetzel is a fan of cloud computing to make business processes run more efficiently. SLC Security Services LLC relies heavily on this type of technology in many of our services and products. Cloud computing can mean the difference between just getting the job done and getting the job done efficiently and before your competition. Kevin is a CCHA (yeah I got the certification before they changed it to CCAH), a licensed Investigator and Counterintelligence Specialist with SLC Security Services LLC. For more information on SLC Security you can visit the company website at www.slcsecurity.com.
Wednesday, October 29, 2014
OPINION: PCI-DSS Pretty Much Useless...
Quote:
Merchants must meet more than 400 requirements, like installing firewalls, updating antivirus software, and ensuring that credit card readers haven't been tampered with.
We hate to break it to you but having a firewall, antivirus and checking your credit card readers for tampering will not protect you from a data breach. We were reading an article on PCI-DSS and nearly choked.
It looks to us like anybody can pass one of these retailers audits. They better be thankful it's not us doing the audits or these folks would be in trouble.
The news item we were reading is here.
This is exactly why the industry will continue to get hacked and breached frequently. The people making the rules don't understand real security, and the rules and regulations don't address real issues.
The audits are conducted only once a year, so they may not provide a full picture of a retailer’s security.
That's true. Security administrators make changes nearly every day, or at least they should. Without safeguards in place they can change items that would make them non-compliant and if they are not audited for a full year that's a great big open invitation for problems.
“To most security guys, it’s just a box you check to protect the CEO. It’s not real security.”
Yeah we agree with that statement. That is why we fail 80-90% of all first time audit clients. The difference is we see the work through until we are confident that they have real security in place and we assist our client's in securing their network, not just giving them the findings and suggestions. Most clients we deal with need assistance and assurance to ensure that the changes made are effective.
It's a sad state in the security world. There are companies that do it write but unfortunately there are many that fail at security as well.
Merchants must meet more than 400 requirements, like installing firewalls, updating antivirus software, and ensuring that credit card readers haven't been tampered with.
We hate to break it to you but having a firewall, antivirus and checking your credit card readers for tampering will not protect you from a data breach. We were reading an article on PCI-DSS and nearly choked.
It looks to us like anybody can pass one of these retailers audits. They better be thankful it's not us doing the audits or these folks would be in trouble.
The news item we were reading is here.
This is exactly why the industry will continue to get hacked and breached frequently. The people making the rules don't understand real security, and the rules and regulations don't address real issues.
The audits are conducted only once a year, so they may not provide a full picture of a retailer’s security.
That's true. Security administrators make changes nearly every day, or at least they should. Without safeguards in place they can change items that would make them non-compliant and if they are not audited for a full year that's a great big open invitation for problems.
“To most security guys, it’s just a box you check to protect the CEO. It’s not real security.”
Yeah we agree with that statement. That is why we fail 80-90% of all first time audit clients. The difference is we see the work through until we are confident that they have real security in place and we assist our client's in securing their network, not just giving them the findings and suggestions. Most clients we deal with need assistance and assurance to ensure that the changes made are effective.
It's a sad state in the security world. There are companies that do it write but unfortunately there are many that fail at security as well.
The Learning Series: Lesson 1 Access Control List - Be specific, Be precise!
As many of you know this blog is staffed by volunteers and various individuals that have experience in computer forensics, network forensics, malware deconstruction, operating systems and other areas of expertise. SLC Security Services LLC (the sponsor of this blog) has been working to really define some of the goals of this project and one of the main items on the to do list was to provide some tutorials and write ups for network administrators and security staff to assist them with various items that may be of help when securing their networks and infrastructure.
One of the first things we notice during audits is that many corporates fail to use ACL's (access control list) effectively. When properly used and ACL may mean the difference between simply having a single machine compromised and have customer data stolen. I think we all can agree that rebuilding a single system is a better use of company resources than rebuilding an entire site or multiple sites and ACL's are one way to ensure that a simple exploited system does not result in a much larger disclosure or compromise of PHI/PII or credit card data.
When we audit most companies one of the first things we usually notice in about 90% of our audits is that administrators rarely if ever setup the correct ACL's on their systems. ACL's are a last line of defense in ensuring that even if a box is compromised that the data residing on that system cannot leave your infrastructure without you knowing about it. In about 70% of audits we have performed over the last year we have identified either incorrectly implemented ACL's, no ACL's in place at all or a major lack of understanding of the corporate network layout so ACL's are implemented only to block specific items.
Let's take a POS example of one place that ACL's should ALWAYS be implemented. POS systems by their design only have to communicate over the network to a few different servers. You would want to allow only the communication from the POS system to only the system and services required for operation and everything else should be blocked. One recent remediation after a compromise indicated that the traffic leaving the network was being sent out over the HTTPS protocol to the Internet through a proxy server that was setup externally. There were several places in which an ACL would have stopped an automated or hacker dead in their tracks had the proper ACL's been implemented on the network switch and router that was sitting between the POS system network and the Internet. The POS system in this case had a VPN client enabled on it that was an SSL VPN so blocking HTTPS entirely would not have worked but restricting HTTPS traffic with an ACL to the single host that the POS system needed to talk to would have closed those ports and not allowed the credit card data to leave the POS network. The POS system needed only to talk to 3 other IP addresses on 2 other services for proper operation. The first question we ask was why there were no ACL's on the network switches and the customers response was we didn't feel it was neccesary.
After the audit I can tell you that every location is not secured with the proper ACL's. Had the ACL's been implemented from the start this client would not have had to notify their customers of the breach and we would not have had to go in a reverse engineer a pretty nasty attack.
Some general rules:
1. Only allow these systems to talk to known systems required for proper operation. Block everything else.
2. Use multiple layers of ACL's on switches, routers and firewalls. This will ensure that if one device is compromised that there are backups to prevent traffic from leaving the network that is not authorized.
3. Know what traffic is going where. Open up services one at a time and only for the required network destinations. There should be no blanket rules allowing HTTP for example. Why would a POS system need to access the Internet? It doesn't and if it does it would only access a vendor site for updates so only allow that single system to get to the vendor sites for updates and block HTTP access to everything else.
4. Block anything not being used. Deny should be the default rule with all ACL's. Sure it takes time to build complicated ACL's in your network but it helps to keep your network secure and your machines from talking to machines that are not authorized.
We hope you have gotten something useful out of this article. Feel free to comment or ask questions and we will try and help individuals and answer any questions you may have.
This article was written by Kevin Wetzel lead investigator for SLC Security Services LLC. Mr. Wetzel has been an investigator for over 20 years and has specialized in computer forensics, private fraud investigations and computer security services for corporations, government and individual clients. Mr. Wetzel is a member of SLC Security Services LLC and is a contributor to this blog.
One of the first things we notice during audits is that many corporates fail to use ACL's (access control list) effectively. When properly used and ACL may mean the difference between simply having a single machine compromised and have customer data stolen. I think we all can agree that rebuilding a single system is a better use of company resources than rebuilding an entire site or multiple sites and ACL's are one way to ensure that a simple exploited system does not result in a much larger disclosure or compromise of PHI/PII or credit card data.
When we audit most companies one of the first things we usually notice in about 90% of our audits is that administrators rarely if ever setup the correct ACL's on their systems. ACL's are a last line of defense in ensuring that even if a box is compromised that the data residing on that system cannot leave your infrastructure without you knowing about it. In about 70% of audits we have performed over the last year we have identified either incorrectly implemented ACL's, no ACL's in place at all or a major lack of understanding of the corporate network layout so ACL's are implemented only to block specific items.
Let's take a POS example of one place that ACL's should ALWAYS be implemented. POS systems by their design only have to communicate over the network to a few different servers. You would want to allow only the communication from the POS system to only the system and services required for operation and everything else should be blocked. One recent remediation after a compromise indicated that the traffic leaving the network was being sent out over the HTTPS protocol to the Internet through a proxy server that was setup externally. There were several places in which an ACL would have stopped an automated or hacker dead in their tracks had the proper ACL's been implemented on the network switch and router that was sitting between the POS system network and the Internet. The POS system in this case had a VPN client enabled on it that was an SSL VPN so blocking HTTPS entirely would not have worked but restricting HTTPS traffic with an ACL to the single host that the POS system needed to talk to would have closed those ports and not allowed the credit card data to leave the POS network. The POS system needed only to talk to 3 other IP addresses on 2 other services for proper operation. The first question we ask was why there were no ACL's on the network switches and the customers response was we didn't feel it was neccesary.
After the audit I can tell you that every location is not secured with the proper ACL's. Had the ACL's been implemented from the start this client would not have had to notify their customers of the breach and we would not have had to go in a reverse engineer a pretty nasty attack.
Some general rules:
1. Only allow these systems to talk to known systems required for proper operation. Block everything else.
2. Use multiple layers of ACL's on switches, routers and firewalls. This will ensure that if one device is compromised that there are backups to prevent traffic from leaving the network that is not authorized.
3. Know what traffic is going where. Open up services one at a time and only for the required network destinations. There should be no blanket rules allowing HTTP for example. Why would a POS system need to access the Internet? It doesn't and if it does it would only access a vendor site for updates so only allow that single system to get to the vendor sites for updates and block HTTP access to everything else.
4. Block anything not being used. Deny should be the default rule with all ACL's. Sure it takes time to build complicated ACL's in your network but it helps to keep your network secure and your machines from talking to machines that are not authorized.
We hope you have gotten something useful out of this article. Feel free to comment or ask questions and we will try and help individuals and answer any questions you may have.
This article was written by Kevin Wetzel lead investigator for SLC Security Services LLC. Mr. Wetzel has been an investigator for over 20 years and has specialized in computer forensics, private fraud investigations and computer security services for corporations, government and individual clients. Mr. Wetzel is a member of SLC Security Services LLC and is a contributor to this blog.
Saturday, October 18, 2014
HEADLINE: Health data thefts a continuing problem
We saw this headline today and we could not agree more. It appears through our research and the research of other firms that health related data is selling for a premium over credit card and other PII. It's no surprise the healthcare, insurance and medical establishments are large targets for hackers and malicious actors.
While we continue to see more breach data and news every day the good news is that people are starting to become aware. There are several data breach mandatory notification bills pending in congress and the number of businesses asking for audits is increasing. We remind clients that audits alone won't stop you from being attacked. What is required is proper training for your personnel, the correct security configurations in software and hardware devices, monitoring software, highly trained security monitoring staff and continued training and upgrades to security infrastructure.
While this headline caught our attention we should remind people that intellectual data theft occurs more often than actual data breaches yet companies fail to protect themselves against this threat. A company needs good people, a good security plan and procedures, auditing, training, monitoring and the right hardware and software to assist them in securing their valued data. And don't think that networks are the only place hackers attack. Don't forget to secure PBX systems, Personnel from social network attacks through verification procedures, cell phone and mobile devices through software and proper policy and anything else that could possibly be used to move data out of your organization. You do have a policy on thumb drives right? We know of one company that will fire on the spot any employee that is caught with any type of device capable of storing data (that includes cell phones, thumb drives, recordable media and cameras).
Maybe it's time the rest of us started protecting our data as this company does. What do you think?
While we continue to see more breach data and news every day the good news is that people are starting to become aware. There are several data breach mandatory notification bills pending in congress and the number of businesses asking for audits is increasing. We remind clients that audits alone won't stop you from being attacked. What is required is proper training for your personnel, the correct security configurations in software and hardware devices, monitoring software, highly trained security monitoring staff and continued training and upgrades to security infrastructure.
While this headline caught our attention we should remind people that intellectual data theft occurs more often than actual data breaches yet companies fail to protect themselves against this threat. A company needs good people, a good security plan and procedures, auditing, training, monitoring and the right hardware and software to assist them in securing their valued data. And don't think that networks are the only place hackers attack. Don't forget to secure PBX systems, Personnel from social network attacks through verification procedures, cell phone and mobile devices through software and proper policy and anything else that could possibly be used to move data out of your organization. You do have a policy on thumb drives right? We know of one company that will fire on the spot any employee that is caught with any type of device capable of storing data (that includes cell phones, thumb drives, recordable media and cameras).
Maybe it's time the rest of us started protecting our data as this company does. What do you think?
Thursday, October 16, 2014
HIPAA and Communications Methods
So we were doing some research in the office today and we stumbled upon this chart. Being that we deal with this every single day we thought we would expound a bit on what this chart means to us.
HIPAA Chart from Answer Excellence (www.answerexcellence.com)
After reading through the chart we realized that this must be dated. Faxes are NOT secure even though they show up in the green zone in the chart. Faxes after all are sound and carriers route faxes over VOIP (networks) these days that are very insecure. The traditional telephone system is not much better. Voice phone calls also are not secure. It doesn't matter how many times we tell clients this they still think that if they are talking on a landline that the communications is secure end to end.
Rather than waste time going through this chart I will just say that ALL of the listed items in this chart should be red. As a TSCM professional for over 20 years none of the methods identified are in any way considered secure.
When we created a transcription service for a client we realized right up front that we had to make the system secure but easy to use. This required us to write our very own encryption for the customer. In our opinion everything should be encrypted whether you value the data or not. Too often these days we are seeing lax security controls in many systems including everything from misdirected text message and emails to plain out HIPAA violations in which companies don't care. The only time they seem to care is when it hits their bottom line. Instead of taking recommendations they take on the stance that if they don't know about it that it must not be happening. Keep thinking like that and hackers are sure to find a way to make you pucker.
This is why 95% of our clients fail their initial audit and 85% fail their second audit. Even when we spell out the procedures, policies, threats, mitigation and remediation to prevent issues it seems that as soon as we leave they typically go right back to their old habits unless we have followed up with policies and training. I can't even tell you the number of times I have found passwords written on sticky notes at a desk or keys to safes stored in unlocked drawers during an audit.
If you want your business audited right and want to pass your compliance audits with regulators we are definitely the firm you should hire. We perform the audit, compliance checks, documentation, training and follow up to ensure a long lasting compliance program that will work for your organization. We identify the threats and minimize them. We look at your people assets and train as well as check them to ensure they are not the source of liabilities. If they don't know what the correct procedures are they will continue to make mistakes that could cost your business. If you don't have written polities you have no way to enforce the use of the correct procedures and no way to ensure that controls that are in use are working effectively if your people are not trained in proper monitoring, reporting and remediation of issues. The goal is to get your staff to be able to effectively protect your organization instead of relying on software, network controls, auditing and logging (all of which can and will fail you).
It's a game plan that needs to happen in many of these companies. Too often management says to us "it's the way we have always done it" even if our suggestions are cheaper more secure alternatives. Let's get out there and secure the vulnerabilities today before you have another incident tomorrow.
If we all followed the chart this site provided we would definitely be in grave danger. The threat from foreign intelligence agencies, spies, hackers and organized crime is increasing and it's not going away. In the end the people that suffer are the consumers that have to pay higher fee's for cheaper products due to knock offs, illegally duplicated products (counterfeit), higher prices due to the cost of conducting secure transactions for the business, unneeded regulation imposed due to data theft and other issues that arise out of plain old fashioned laziness or ignorance of a topic. If you are unsure about something find somebody that is sure.
HIPAA Chart from Answer Excellence (www.answerexcellence.com)
| Method | Security Level | Primary vulnerability |
| FAX | Generally considered secure | FAX being picked up from recipient machine by unauthorized party (physical security) |
| Voice phone call | Generally considered secure | Eavesdropping (especially in a wireless or cordless environment) |
| Text messaging via secure mobile option | Generally considered secure | Access to recipient’s device by unauthorized individual |
| Alpha Pager (TAP modem protocol) | Generally considered reasonably secure | Interception by specialized radio equipment during the broadcast from tower to pager. |
| E-mail message to secure server & client combination | Generally considered reasonably secure | Hacking of e-mail account |
| SMS Text Message to cell phone | Generally considered insecure | Exposure of clear-text message on the internet or wireless network, loss or theft of phone |
| E-mail message to public server / client combination (Hotmail, Yahoo, etc.) | Generally considered insecure | Exposure of clear-text message on the public internet, hacking of e-mail account |
After reading through the chart we realized that this must be dated. Faxes are NOT secure even though they show up in the green zone in the chart. Faxes after all are sound and carriers route faxes over VOIP (networks) these days that are very insecure. The traditional telephone system is not much better. Voice phone calls also are not secure. It doesn't matter how many times we tell clients this they still think that if they are talking on a landline that the communications is secure end to end.
Rather than waste time going through this chart I will just say that ALL of the listed items in this chart should be red. As a TSCM professional for over 20 years none of the methods identified are in any way considered secure.
When we created a transcription service for a client we realized right up front that we had to make the system secure but easy to use. This required us to write our very own encryption for the customer. In our opinion everything should be encrypted whether you value the data or not. Too often these days we are seeing lax security controls in many systems including everything from misdirected text message and emails to plain out HIPAA violations in which companies don't care. The only time they seem to care is when it hits their bottom line. Instead of taking recommendations they take on the stance that if they don't know about it that it must not be happening. Keep thinking like that and hackers are sure to find a way to make you pucker.
This is why 95% of our clients fail their initial audit and 85% fail their second audit. Even when we spell out the procedures, policies, threats, mitigation and remediation to prevent issues it seems that as soon as we leave they typically go right back to their old habits unless we have followed up with policies and training. I can't even tell you the number of times I have found passwords written on sticky notes at a desk or keys to safes stored in unlocked drawers during an audit.
If you want your business audited right and want to pass your compliance audits with regulators we are definitely the firm you should hire. We perform the audit, compliance checks, documentation, training and follow up to ensure a long lasting compliance program that will work for your organization. We identify the threats and minimize them. We look at your people assets and train as well as check them to ensure they are not the source of liabilities. If they don't know what the correct procedures are they will continue to make mistakes that could cost your business. If you don't have written polities you have no way to enforce the use of the correct procedures and no way to ensure that controls that are in use are working effectively if your people are not trained in proper monitoring, reporting and remediation of issues. The goal is to get your staff to be able to effectively protect your organization instead of relying on software, network controls, auditing and logging (all of which can and will fail you).
It's a game plan that needs to happen in many of these companies. Too often management says to us "it's the way we have always done it" even if our suggestions are cheaper more secure alternatives. Let's get out there and secure the vulnerabilities today before you have another incident tomorrow.
If we all followed the chart this site provided we would definitely be in grave danger. The threat from foreign intelligence agencies, spies, hackers and organized crime is increasing and it's not going away. In the end the people that suffer are the consumers that have to pay higher fee's for cheaper products due to knock offs, illegally duplicated products (counterfeit), higher prices due to the cost of conducting secure transactions for the business, unneeded regulation imposed due to data theft and other issues that arise out of plain old fashioned laziness or ignorance of a topic. If you are unsure about something find somebody that is sure.
Wednesday, October 8, 2014
It's all about the vectors baby! Oh and a healthy does of metadata...
When we first started building intelligence systems for this program over two years ago we started with several goals in mind. Some of those goals are listed below:
Today we have landed somewhere in the middle. While we utilize Hadoop to search content for keywords and build relational data most of what we do it based on our category tagging. Only one of our products is proprietary. 95% of the software we use is either open source or commercial software that we have purchased or licensed for a particular purpose. All of our intelligence software is open source. How we process that is the proprietary portion of the equation. Utilizing a string library that we wrote in house we are able to do some really interesting things such as archiving chat logs, following users on IRC and finding relevant terms from a manually generated hit list in several sources of data to include Facebook, RSS and other Internet locations. You see most of the information required in building an intelligence system is out there you just have to list out your requirements and find open source libraries that provide that functionality and make a process flow that utilizes the products to their potential. Most of the software that we use was not originally developed to do what we are using it for, and that's OK. We will modify the software to do what we want it to do.
It doesn't matter where the information comes from at all. What matters is how you analyze that data for information and connect it to other information in your data store. If you can't connect the dots the data is nothing more than a checkpoint in time. If you can't pull out keywords and terms you don't know how to classify the artifact. If you can't build links through matching terms you can't figure out what artifacts are related to other artifacts. This is data science at it's best. What about the metadata in files. I can't tell you the number of times that we were able to get a computer name out of dumped password disclosures or to actually find similarities in different leaks due to dialect and other specific detail that allowed us to connect the data to a group or individual.
Honestly in the security analysis field the research is all about the vectors and metadata. Use these clues to connect the dots. You may be surprised at what you find.
- Read RSS content and store the full text and images from the RSS feeds long term
- Same goes with Facebook and Twitter, users can delete it but we want an artifact copy
- Using strings and keywords we want to search data to find relevant information as fast as possible
- Customized dashboards for our security analyst
- The ability to tag data and feeds so be able to create categories that would be of interest to analyst
- Take user suggestions and make them a reality
Today we have landed somewhere in the middle. While we utilize Hadoop to search content for keywords and build relational data most of what we do it based on our category tagging. Only one of our products is proprietary. 95% of the software we use is either open source or commercial software that we have purchased or licensed for a particular purpose. All of our intelligence software is open source. How we process that is the proprietary portion of the equation. Utilizing a string library that we wrote in house we are able to do some really interesting things such as archiving chat logs, following users on IRC and finding relevant terms from a manually generated hit list in several sources of data to include Facebook, RSS and other Internet locations. You see most of the information required in building an intelligence system is out there you just have to list out your requirements and find open source libraries that provide that functionality and make a process flow that utilizes the products to their potential. Most of the software that we use was not originally developed to do what we are using it for, and that's OK. We will modify the software to do what we want it to do.
It doesn't matter where the information comes from at all. What matters is how you analyze that data for information and connect it to other information in your data store. If you can't connect the dots the data is nothing more than a checkpoint in time. If you can't pull out keywords and terms you don't know how to classify the artifact. If you can't build links through matching terms you can't figure out what artifacts are related to other artifacts. This is data science at it's best. What about the metadata in files. I can't tell you the number of times that we were able to get a computer name out of dumped password disclosures or to actually find similarities in different leaks due to dialect and other specific detail that allowed us to connect the data to a group or individual.
Honestly in the security analysis field the research is all about the vectors and metadata. Use these clues to connect the dots. You may be surprised at what you find.
Subscribe to:
Posts (Atom)