Category Archives: Hacked

cybersecurity, Data Loss, Hacked, Information Security

The value of patching, The cost of not patching

(One) Major cause of data breaches

Over 50% of data breaches are due to published exploits where fixes or patches are available.

The actual percentage varies to which study you refer to. The vulnerabilities may be through the OS, platforms like Java and Flash or applications.

Secure Configuration is essential, one such aspect is patching. Making sure that you’ve employed the most up-to-date software.

The reality is that many organisations do not adequately patch their software and hardware. For many it is an onerous task. They may be worried about introducing issues to their production services or it may be the lack of resources.

The risk is real, whether it is risk to production from using different (updated) software or from crackers exploiting vulnerabilities.

Regression and user-acceptance testing is essential here. There are other mitigation schemes where a staged patching is adopted, where a proportion of servers or instances of the software is patched and then used in production. It could be a test or development units.

I’ve just talked about the value and reasons for patching.

The other considerations are the cost of not patching.

There are many examples, but I’ll just share a couple with you.

Talktalk looses data

Talktalk, a communications company in the UK mobile telephone, TV and broadband market. They lost 157000 customer details in 2015. The vulnerability was on a website that had not been patched for 3.5 years. In the aftermath they lost of more than 150000 customers. Their share price dropped 30%.

Promotions and incentives cost them 35M GBP. Their 2016 profits dropped by 56%. They were also fined 400000 GBP by the ICO. Under GDPR the fine imposed could’ve been more than 70M GBP.

Equifax looses even more data

Moving to a more recent data breach, Equifax. They provide credit scoring services to the public and businesses. Many financial organisations use them to assess the credit-worthiness of individuals and companies.

They hold data on more than 820 million individuals and 91 million businesses.

In 2017, they lost the details of which 145 million people in the USA, at least 400000 in the UK and 100000 in Canada.

Heads Roll

Within Equifax, the chief information officer Susan Mauldin and chief security officer David Webb were retiring and within two weeks Richard Smith, the CEO said he was stepping down after having to explain the breach to a US Congress committee in October.

The market is not impressed

Their share price was trading around 140 USD, then plunged to a low of 94 USD a few days after the disclosure, which is comparable to Talktalk’s share price drop.

The actual financial impact to Equifax is unknown at this time, as it’s still so recent.

The breach was likely to be from a vulnerability that had been publicised and known for months and not mitigated.

The fallout from this incident is yet to settle. There are likely to be class action law suits in the USA and Canada. The respective regulators are likely to be sifting through the post mortem reports and deciding on what punitive measures to take.

Further reading and references

 

Availability, Data Loss, Hacked, Malware, Ransomware

Massive Attack

There have been very public examples of cyber attacks, affecting organisations on a global scale. Despite prominence given to recent outbreaks, such as Wannacry in May 2017 and NotPetya in June 2017, the first recorded global malware outbreaks started much earlier.

Some history

John von Neumann wrote a paper on “Theory of self-reproducing automata” published in 1966 which described self-replicating artificial forms, how they would spread, mutate and be self-deterministic.

The first examples

1981 saw one of the first computer virus designed to infect Apple II PCs by Richard Skrenta. Five years later in 1986 saw one of the first PC virus, known as Brain as well as other monikers, this was written by Basit Alvi.

Why ?

There have been many more malware in the intervening years, the main difference between these and current malware infections is that the earlier instances were programmers showcasing their skill and ingenuity mainly for bragging rights and inter-peer competition. They were often created as proof of concepts and sometimes were released by mistake.

Interconnected

Another aspect worth mentioning is that the world has moved on since the 1970s. Personal computers then were not generally interconnected, they were stand alone and strictly the domain of hobbyists.

The Internet

The origins of the internet started in the 1960s as a USA government project, which was made a commercial prospect in 1983 with few private users. By 1995 there were 16 million users, by the turn of the new century more than 300 million users. A decade later, 2000 million users. We are on course for 4000 million users in 2017. Exponential growth in action, the effective network  proximity means that something that happens on the otherside of the world, can affect you milliseconds later.

There are not many commercial or governmental organisations which are not internet connected. Domestic connectivity has also mirrored this growth, which has been taken into the mobile and IoT space as well.

Ransomware

The first recorded instance of a ransomware was in 1989 written by Dr. Joseph Popp for PCs called the AIDS Info Disk which was a malware that demanded 189USD to be paid for license fees.

Ransomware is now a commercial enterprise, organised crime has seen the potential for great ROI (return on investment) for little risk.

There have also been rumours of nation state involvement in malware, which has been loosely substantiated by leaks, revelations and evidence from whistleblowers. They have been carefully crafted and targeted attacks. One such example is such Stuxnet, designed to damage centrifuges used by Iran in a uranium enrichment programme.

SWIFT

Attacks on the global interbank transfer service, SWIFT netted more than 80M USD in 2016. A similar heist was reported in Ecuador and an attempt at defrauding a bank in India this year.

More recently Wannacry and Petyta in May and June 2017. The last two has leveraged stolen malware, allegedly originating from USA’s National Security Agency (NSA).

So we are beginning to see a muddying of the waters between what is likely to be nation state campaigns and what is used by organised crime for their money raising efforts. Even the lines between nation state and organised crime may be blurred, as the two most recent global ransomware events have been attributed to various countries.

Who did it ?

Be mindful that attribution is not an exact science; this is where clues may be left to confuse and misdirect and definitely an area where

plausible deniability reigns.

So what does this all mean? Apart from plenty of mystery, intrigue, 007 and general dodginess all round.

How does it affect me and you ?

For the population at large and commerce, it means further disruption caused to our digital environment from a myriad of sources, be it an attack to demonstrate technical control for political purposes or for monetary gain, the fallout or collateral damage is likely to affect the rest of us.

What can we do about it ?

Many of these exploits take advantage of poor cyber hygiene. If basic guidelines on the use of internet based services, system maintenance and configuration were followed, the susceptibility to these attacks by organisations would be significantly lower and even if an organisation were to succumb to a cyber attack, recovery would be significantly quicker and be less damaging on operations.

Follow-up – “How to protect yourself from malware”

References

List of viri from Comodo

Wannacry – Symantec

Wannacry – The Independent

Petya or not ???? – Reuters

Destructionware, not ransomware – The Verge

More on NotPetya – TechCrunch

 

Data Loss, Data Protection, Hacked, Personal Information

Another day, another Data Breach – OPM – US government’s Office of Personnel Management

I’m sure you’ve seen this one in the news already. I have resisted commenting immediately, so that we can all take a step back and avoid knee-jerk, reactive comments.

21.5m USA federal employees and associates PI lost

Breach occurred over 12 months

In a nutshell, the personal data of 21.5m US government personnel was pilfered for more than 12 months. This included names, addresses, social security number (similar to the UK National Insurance number), position in the government and biometric data. Foreign contacts were also in the data haul. Background checks for the last 15 years, of friends, associates and information required for security clearance roles were lost. This information may potentially expose federal employee’s to unfavourable actions.

There were either no or insufficient controls in place to protect the data, control access, detect data leakage or detect malware. Apparently it was only due to a security tool demonstration that the breach was discovered at all.

Source :  http://www.prweb.com/releases/2015/06/prweb12787823.htm

The fallout has been severe; Katherine Archuleta, The Director of the US Office of Personnel Management has resigned in the wake of further revelations about the scale of the hacking attack on the agency. She had been in the role for two years. The insecurity of OPM services was already known and documented in an earlier audit by the US Inspector General as unsafe, some as far back as 2007. The Director accepted the risk and kept the servers running without sufficient mitigation. Other findings included using servers that were unable to employ encryption and inadequate authentication.

Audit recommendations not properly mitigated

Although there was an upgrade plan underway, her mitigation strategy was not-fit-for-purpose and did not reflect the risk and vulnerabilities at the OPM.

This has echoes of the 2014 Target Breach, where management were aware of serious issues, but under-played and ignored advice. This neatly highlights the fact that you can have independent audit, but if the risk is not owned by the board, properly interpreted and mitigated, you are leaving your organisation (or indeed country) open to threats.

I have also deliberately avoided the more political aspects of this breach; It is the duty of all countries to spy on another, for gain, for war and for peace. Blaming one country or another for your own failings is disingenuous at best and totally blinkered to the realities of our world.

Further reading

https://www.opm.gov/cybersecurity/

http://www.nytimes.com/2015/07/10/us/office-of-personnel-management-hackers-got-data-of-millions.html?_r=0

http://www.cio.com/article/2947453/data-breach/how-opm-data-breach-could-have-been-prevented.html

http://www.cio.com/article/2945425/data-breach/the-opm-lawsuit-will-only-make-the-lawyers-rich.html

Data Loss, Data Protection, Hacked

2014 – The Year of 1 Billion Data Record Losses

Gemalto the digital security services company and Safenet have released a report titled “2014 – Year of Mega Breaches & Identity Theft”

2014 Data Breaches Gemalto Infographic

The headline numbers make for sober reading. The number of data records loss jumped 78%, from about 575 million in 2013 to more than one billion in 2014.

In terms of time, in 2014 some 2,803,036 data records were lost every day, 116,793 every hour, 1,947 every minute and 32 every second. So figure in about the time it took to read the previous sentence, about 400 data records would have been stolen or lost based on the 2014 data breach statistics.

Despite the widespread availability of commercially and indeed open source encryption solutions as a means for protecting  information and privacy, only 58 of the data breach incidents in 2014, or less than 4% of the total, involved data that was encrypted in part or in full.

In short, companies and organisations are still not taking protection of data seriously. It’s likely to take the commensurate loss of revenue or regulatory fines, up to and including gaol time for things to start improving.

One catalyst for this may well be the EU General Data Protection Regulations, but there’s a lot of lobbying and compromises between the proposals and actual legislation. It may still revert back to being an EU Directive. Meanwhile our Personal Information is being  shared, sold and aggregated ad infinitum, that’s before it’s leaked and stolen !

Gemalto’s 2014 Data Breach Report

Data Loss, Data Protection, Hacked

Significant data theft from Anthem – one of USA largest health insurers

anthemlogo

Anthem, the US’s second biggest health insurer with about 70 million people on its books across the country, admitted late on 4th February 2015, that it was the target of an external cyber attack.

These attackers gained unauthorised access to Anthem’s IT system and have obtained personal information from our current and former members such as their names, birthdays, medical IDs/social security numbers, street addresses, email addresses and employment information, including income data.Tens of millions of records are likely to have been obtained illegally as a result of the hack, Anthem warned.

Health plans branded Anthem Blue Cross; Anthem Blue Cross and Blue Shield; Blue Cross and Blue Shield of Georgia; Empire Blue Cross and Blue Shield; Amerigroup; Caremore; Unicare; Healthlink; or DeCare, are at risk.

It is not clear when the company’s databases were compromised – just that it was discovered some time last week.  Anthem is offering free credit and identity monitoring cover to those affected by the breach.

Up to 80 million Americans (current and ex-insurees), are now being warned that they’re being targeted by scammers who are trying trick the victims into revealing additional personal information. Scammers are running email phishing campaigns, and even placing phone calls to affected customers, Anthem says.

The identity of the perpetrators hasn’t been disclosed yet, the FBI are are investigating the. Mandiant, a well-known cybersecurity firm, to look into vulnerabilities of its computer system.

Anthem’s statement

An interesting viewpoint from Kreb’s 

Chun’s view

It’s way too soon to speculate on the whys and what happened, only that your organisation is neither too big or too small to be vulnerable.

Good policies and good housekeeping are the backbone of any ISMS. Having a comprehensive plan to deal with breaches and data loss will go a long way in containment and minimising the damage.