Insider Threats: Yep, a Problem for Cyber Security Systems
August 20, 2020
The number of cyber threat, security, alerting, and pentesting services is interesting. Cyber security investments have helped cultivate an amazing number of companies. DarkCyber’s research team has a difficult time keeping up with startups, new studies about threats, and systems which are allegedly one step ahead of bad actors. Against this context, two news stories caught our attention. It is too soon to determine if these reports are spot on, but each is interesting.
The first report appeared in Time Magazine’s story “Former CIA Officer Charged With Giving China Classified Information.” China is in the news, and this article reveals that China is or was inside two US government agencies. The story is about what insiders can do when they gather information and pass it to hostile third parties. The problem with insiders is that detecting improper behavior is difficult. There are cyber security firms which assert that their systems can detect these individuals’ actions. If the Time article is accurate, perhaps the US government should avail itself of such a system. Oh, right. The US government has invested in such systems. Time Magazine, at least in my opinion, did not explore what cyber security steps were in place. Maybe a follow up article will address this topic?
The second news item concerns a loss of health related personally identifiable information. The data breach is described in “Medical Data of Auto Accident Victims Exposed Online.” The security misstep allowed a bad actor to abscond with 2.5 million health records. The company responsible for the data loss is a firm engaged in artificial intelligence. The article explains that a PII health record can fetch hundreds of dollars when sold on “the Dark Web.” There is scant information about the security systems in place at this firm. That information strikes me as important.
Several questions come to mind:
- What cyber security systems were in place and operating when these breaches took place?
- Why did these systems fail?
- Are security procedures out of step with what bad actors are actually doing?
- What systemic issues exist to create what appear to be quite serious lapses?
DarkCyber does not have answers to these questions. DarkCyber is becoming increasingly less confident in richly funded, over-hyped, and ever fancier smart security systems. Maybe these whizzy new solutions just don’t work?
Stephen E Arnold, August 20, 2020
The Old and Not-So-Bold Dieblold?
August 16, 2020
Robbing ATMs with specialized hardware is not new. What is new is using the manufacturer’s own software to facilitate the attacks. Ars Technica reports, “Crooks Have Acquired Proprietary Diebold Software to ‘Jackpot’ ATMs.” Say, doesn’t Diebold also make voting machines? Perhaps there are some things that should not be automated.
Jackpotting is a technique in which thieves convince an ATM to spit out cash, sometimes as quickly as 1.7 bills per second. One way to achieve this is to attach a hacking device, or “black box,” to the machine, either by physically breaking into the machine’s face or connecting to its network cables. Not surprisingly, these attacks usually occur on outdoor ATMs. (Another way is by breaking in and swapping out the machine’s hard drive. Then there is the email route: malware is unwittingly installed by a network admin after a successful phishing attempt.) Black boxes mimic the machine’s internal software with a laptop or using Raspberry Pi or Arduino hardware. Now, some thieves are leveraging Diebold’s own proprietary code against it. An advisory from the manufacturer states:
“Some of the successful attacks show a new adapted Modus Operandi on how the attack is performed. Although the fraudster is still connecting an external device, at this stage of our investigations it appears that this device also contains parts of the software stack of the attacked ATM. … The investigation into how these parts were obtained by the fraudster is ongoing. One possibility could be via an offline attack against an unencrypted hard disc.”
For now, most of these attacks appear to be occurring in Europe, particularly on the ProCash 2050xs USB model. It could be worse. Reporter Dan Goodin observes:
“The new attack variation described by Diebold is both good and bad news for consumers. On the one hand, there’s no indication thieves are using their recently acquired software stack to steal card data. The bad news is that attackers appear to have their hands on proprietary software that makes attacks more effective. The recent increase in successful jackpotting ultimately results in higher fees, as financial institutions pass on the costs caused by the losses.”
The write-up concludes with Diebold’s advice to avoid falling victim to a hacked ATM—stick to ATMs at major banks, shield the keypad while entering your PIN, and review each bank statement for suspicious activity. And Diebold “security”? Well.
Cynthia Murrell, August 16, 2020
Spearphishing: The Pursuit of an Elusive Dorsey?
August 5, 2020
I read “Twitter Says Hack Targeted Employees Using Spearphishing.” Yep, spearphishing. That’s jargon for sending a person email and using words to obtain access. Here’s what a digital spear gun looks like:
Click away.
The write up states:
Twitter said in a security update late Thursday that the July 15 incident by bitcoin scammers stemmed from a “spear phishing” attack which deceived employees about the origin of the messages.
A bad actor, allegedly a teen, jumped in the digital ocean, carrying a mobile phone and a digital spear fishing device:
Once the target was in sight, the teen released the pointy digital stream.
The result?
The remarkable Dorsey fish appears to have been targeted by the teen.
High-tech? The write up reports:
John Dickson of the security firm Denim Group said the latest disclosure does not necessarily suggest a sophisticated attack from a nation-state. “They conned people over the phone,” Dickson said, saying it may have been possible to find targets through research on LinkedIn or Google. “This is like the original hackers from the 1980s and 1990s; they were very good at conning people and getting them to give their credentials.”
Has the Dorsey fish been beached? Did the Dorsey fish swim away? Did the Dorsey fish notice the digital attack?
No answers which satisfy DarkCyber have been forthcoming. There’s no visual evidence of the succulent Dorsey fish being steamed and served to the Twitter Board of Directors:
Looks tasty. Speared phish steamed for two minutes and then sautéed with cyber veggies.
Stephen E Arnold, August 5, 2020
European Union Tries Panenka to Score Against Encrypted Data
July 31, 2020
Let’s assume this write up is accurate: “EU Plans to Use Supercomputers to Break Encryption But Also Wants Platforms to Create Opportunities to Snoop on End-to-End Communications.”
The “going dark” argument is not moving fast enough for European Union regulators. The fix is a “decryption platform.” The idea is to decrypt certain messages. The interesting part of the tactic is summarized in this passage:
Internet service providers such as Google, Facebook and Microsoft are to create opportunities to read end-to-end encrypted communications. If criminal content is found, it should be reported to the relevant law enforcement authorities. To this end, the Commission has initiated an “expert process” with the companies in the framework of the EU Internet Forum, which is to make proposals in a study. This process could later result in a regulation or directive that would force companies to cooperate.
The article points out:
There’s no way to “create opportunities” to read end-to-end encrypted communications without weakening the latter.
Worth monitoring the idea and its implementation and its opportunities.
Stephen E Arnold, July 31, 2020
The Cloud Becomes the New PC, So the Cloud Becomes the Go To Attack Vector
July 24, 2020
Cloud providers are not Chatty Cathies when it comes to some of their customers’ more interesting activities. Take malware, for example. Bad actors can use cloud services for a number of activities, including a temporary way station when deploying malware, delivering bogus or spoofed Web sites as part of a social engineering play, or just launching phishing emails. Major cloud providers are sprawling operations, and management tools are still in their infancy. In fact, management software for cloud operators are in a cat-and-mouse race. Something happens, and the cloud provider responds.
“Hackers Found Using Google Cloud to Hide Phishing Attacks” provides some information about the Google and its struggles to put on a happy face for prospects and regulators while some Googlers are reading books about dealing with stressful work.
The article reports:
Researchers at cybersecurity firm Check Point on Tuesday cited an instance when hackers used advanced features on Google Cloud Platform to host phishing pages and hide them. Some of the warning signs that users generally look out for in a phishing attack include suspicious-looking domains, or websites without a HTTPS certificate. However, by using well-known public cloud services such as Google Cloud or Microsoft Azure to host their phishing pages, the attackers can overcome this obstacle and disguise their malicious intent, improving their chances of ensnaring even security-savvy victims…
What’s the fix?
Obviously vendors of cloud management software, hawkers of smart cyber security systems, and bright young PhD track cyber specialists have ideas.
The reality may be that for now, there is no solution. Exposed Amazon S3 buckets, Google based endeavors, and Microsoft (no, we cannot update Windows 10 without crashing some machines) Azure vectors are here to stay.
Perhaps one should tweet this message? Oh, right, Twitter was compromised. Yeah.
Stephen E Arnold, July 24, 2020
Insider Security Risks
July 23, 2020
Let’s assume the Twitter security story is true. Insiders were engineered. Right. Insider security risks exist, and they are a potential sink hole. Fancy Dan cyber security systems can do some things well; most fail when it comes to handling the crazy stuff employees do, either intentionally or unintentionally.
“43 Percent of Employees Make Mistakes That Have Cybersecurity Implications” reports:
A quarter of employees confess to clicking on links in a phishing email at work, with distraction cited as a top reason for falling for a phishing scam by 47 percent of employees. This is closely followed by the fact that the email ‘looked legitimate’ (43 percent), with 41 percent saying the phishing email looked like it came from a senior executive or a well-known brand.
Other findings:
include 58 percent of employees admitting to sending a work email to the wrong person, with 17 percent of those emails going to the wrong external party. This simple error can lead to serious consequences for both the individual and the company, who must report the incident to regulators as well as their customers. In fact, a fifth of respondents say their company had lost customers as a result of sending a misdirected email, while one in 10 employees (12 percent) lost their jobs.
How valid are these data? Tough to say, but the Twitter slip up flashes a yellow caution light. And errant USB drives, snatched mobile phones, and stolen laptops? There are a number of human-centric risks and the consequences in our fractious times can be unpleasant.
Stephen E Arnold, July 23, 2020
Twitter: Remediation or Yoga Babble?
July 20, 2020
I read “An Update on Our Security Incident.” The author is someone at Twitter. That’s reassuring to Mr. Obama, some bitcoin users, and maybe a friend from high school.
The “cause” was:
attackers targeted certain Twitter employees through a social engineering scheme.
Now remember this is an outfit which makes it possible to output information that can have an immediate and direct impact of individuals, organizations, and institutions. This is not a disgruntled student passing out mimeographed pages in the lunch room about the upcoming school dance in the aforementioned high school auditorium.
The cause was an organizational structure similar to a prom fund raising event at the Governor Dummer Academy. Hence:
The attackers successfully manipulated a small number of employees and used their credentials to access Twitter’s internal systems, including getting through our two-factor protections.
And not to worry. Only 130 Twitter accounts were “accessed.” No problem, mom, Mr. Obama’s account was not improperly used by “the attackers.” Really, Mom. Honest.
Let’s stop.
What was the cause?
The cause was a large and influential company failed to recruit, train, and monitor employees. That company did not have in place sufficient safeguards for its core administrative tools. That company does not have a full time chief executive officer. That company does not have a mechanism to know what is going on when the core administrative tools are used in an anomalous manner by an outsider.
That’s why the company was attacked and there are a few other reasons which seem highly probable to the DarkCyber research team:
- The alleged individual attacker or his shadow supporters wanted to demonstrate how one of the more influential social media companies could be successfully compromised
- The alleged individual attacker was testing systems and methods which could be used against or again to obtain access to an important channel of unmonitored real time data
- The alleged individual attacker was just one of those lone wolf hackers who sit up at night and decide which barn to set on fire.
Once again we have a good example of high school science club management.
The explanation is not going to reassure some people, maybe the former president of the United States? The explanation dances around the core issue: Mismanagement and a failure of governance.
High tech “cuteness” has become a pink Hello, Kitty line of polyester hipster T shirts.
Hey, Twitter. A “dog ate my homework” explanation misses what the breach reveals about management expertise.
Stephen E Arnold, July 20, 2020
Arnold and Steele: Twitter Incident
July 17, 2020
Robert Steele, a former CIA professional, and I discuss the Twitter breach. Mr. Steele takes a broader view; I focus on specific operational actions by regulatory and enforcement entities. We disagreed on some points, but at the end of the 20 minute conversation, we agreed on a broad principle. Action is needed.
You can view the program which has been viewed more than 7,000 times since July 16, 2020.
Stephen E Arnold, July 17, 2020
And Microsoft Wants Its Partners to Support Government Entities?
July 16, 2020
The article “Hack of 251 Law Enforcement Web Sites Exposes Personal Data of 700,000 Cops” troubles me for two reasons.
First, the loss of the data increases risk for the professionals listed in the data files. Not good.
Second, the write up asserts as “real” news:
All of the hacked websites were hosted and built by the Texas web development firm Netsential on Windows servers located in Houston. They were all running the same custom (and insecure) content management system, developed using Microsoft’s ASP.NET framework in the programming language VBScript, using Microsoft Access databases. Because they all run the same software, if a hacker could find a vulnerability in one of the websites that allowed them to download all the data from it, they could use that vulnerability to hack the rest of the websites without much additional effort.
DarkCyber believes that much of the 21st century cyber software jabber is marketing speak.
If the statement about Microsoft’s infrastructure and software is accurate, there are some questions to answer:
- How did the Microsoft partner program allow “experts” certified by Microsoft to create a system with some interesting security issues?
- Where did the Netsential Web site go? Why did its content disappear?
- What does this incident mean in the context of the Department of Defense JEDI contract?
DarkCyber is concerned when a giant corporation cannot update its own Windows 10 operating system and fail to ensure that its partners are qualified to perform sensitive work in a careful manner.
Is there some useful code on Microsoft Github? Snap. Github fell over again just as I was looking.
Another troubling US technology lapse it seems for a company wanting to provide cloud services to the US government and law enforcement.
Stephen E Arnold, July 16, 2020
What Is the Work Around When a Huawei Ban Gets Traction?
July 16, 2020
DarkCyber noticed a news item in IT Online. “Counterfeit Cisco Devices Open Backdoors into Organizations’ Systems” states:
The counterfeits were discovered by an IT company after a software update stopped them from working, which is a common reaction of forged/modified hardware to new software.
Years ago, I learned that a Chinese manufacturer of telecommunications devices was running two lines. One line handled the US product. The other line generated “special” versions of the US product? I was unable to verify this interesting comment.
Some manufacturers in countries what was quaintly called “the Far East” may have decided to produce the equivalent of knock off watches.
If the IT Online report is accurate, these devices may be good enough to capture data from an organization of interest.
Supply chain security? Some US companies may say, “Yep, we will jump on that… right away.”
Stephen E Arnold, July 16, 2020
-
- Subscribe to Beyond Search
Feature archive
News archive
-
