Information Security: Hacker Groups Claims to Hit 5,500 IS Accounts

The hacker group Anonymous claimed Tuesday to have taken out 5,500 Twitter accounts linked to the Islamic State group, which claimed responsibility for the Paris attacks.

The loosely organized hacking collective made the claim in a tweet one day after launching#OpParis campaign, which stepped up an earlier effort to shut down social media accounts of the organization.

"We report that more than 5500 Twitter account of #ISIS are now #down! #OpParis #Anonymous #ExpectUs," said a tweet posted on Tuesday which followed a video message posted Monday.

It was not immediately clear how the accounts would have been disabled. But the hacker group said it posted the accounts to an online forum labeling them as #daeshbags, a reference to Daesh, an Arabic acronym for the Islamic State group.

In an apparent riposte, a message posted via the messaging service Telegram calls on Islamic State affiliates to secure their Internet communications.

"The #Anonymous hackers threatened... that they will carry out a major hack operation on the Islamic state (idiots)," the message said.

Anonymous has waged a long-running campaign against the Islamic State group but stepped up the effort following the attacks last Friday in the French capital.

Read More

Information Security: New Types of Reflection DDoS Attacks Spotted

A new threat advisory published this week by Akamai’s Security Intelligence Response Team warns organizations about three new types of reflection distributed denial-of-service (DDoS) attacks observed in recent months.

There are well over a dozen UDP protocols that can be abused for the reflection and amplification of DDoS attacks, including DNS, NTP, SSDP, BitTorrent, RIPv1, mDNS, CharGEN, QOTD, NetBIOS, and Portmap. While some of these services have been abused for a long time, others are not as popular among attackers.

According to Akamai, attackers have recently started abusing the RPC portmap service, NetBIOS name servers, and Sentinel licensing servers.

The content delivery network (CDN) service provider reported spotting attacks leveraging NetBIOS, a service used by applications on separate computers to communicate over a LAN, sporadically between March and July 2015. In the attacks observed by the company, the attackers obtained amplification rates ranging between 2.56 and 3.85. Of the four attacks seen by Akamai, the largest peaked at 15.7 Gbps.

Another uncommon type of reflection attack spotted over the past period by the CDN company abused RPC Portmap (Portmapper), an Open Network Computing Remote Procedure Call (ONC RPC) service designed to map RPC service numbers to network port numbers.

These types of attacks are much more powerful than the ones leveraging NetBIOS, with the largest attack exceeding 100 Gbps. While the most common amplification factor observed by Akamai was approximately 10, experts noticed one instance where the traffic sent to the targeted server was multiplied more than 50 times.

Akamai said it had observed such attacks almost every day in September. In August, when the company noticed the first RPC Portmap reflection attacks, telecoms firm Level 3 Communications also warned organizations about such threats.

Another type of attack abuses Sentinel license servers, which are used to enforce and manage licensing in multi-user environments. The first such attack was observed by Akamai in June 2015 and it leveraged a vulnerable Sentinel server used by Stockholm University in Sweden. In September, Akamai mitigated a couple of Sentinel reflection DDoS attacks aimed at a gaming company and a financial firm, with a peak bandwidth of 11.7 Gbps detected for one of these attacks. DDoS protection company Nexusguard also warned about such attacks last month.

While the amplification factor for such attacks can exceed 40, attackers are limited by the fact that there aren’t many Sentinel servers that can be abused. Only 745 unique sources of attack traffic have been identified, Akamai said in its report. 

"Although reflection DDoS attacks are common, these three attack vectors abuse different services than we've seen before, and as such they demonstrate that attackers are probing the Internet relentlessly to discover new resources to leverage," said Stuart Scholly, senior vice president and general manager at Akamai’s Security Business Unit. "It looks like no UDP service is safe from abuse by DDoS attackers, so server admins need to shut down unnecessary services or protect them from malicious reflection. The sheer volume of UDP services open to the Internet for reflection DDoS attacks is staggering."

Earlier this week, Symantec warned that attackers had started abusing MySQL serversinfected with a piece of malware dubbed “Chikdos” for DDoS attacks.

Read More

Information Security: US, South Korea Defense Chiefs Discuss North Korea Threats

US Defense Secretary Ashton Carter and his South Korean counterpart discussed Monday their concerns over a growing list of threats from North Korea, including nuclear tests and computer hacking.

Carter met with Han Min-Koo in Seoul during an annual security meeting for the two allies to assess their ongoing military cooperation.

We "spoke candidly about North Korean threats," Carter told reporters.

"Nuclear weapons, ballistic missiles, cyber, and conventional military threats. Those threats continue to put at risk the peace and security of the peninsula, the region, and the United States."

In a widely expected move, the defense chiefs signed an important agreement that defines conditions for a transfer of control of the South Korean military from the United States to Seoul in a time of war.

South Korea had been scheduled to take wartime control, known as OPCON, by the end of next year, but now the transfer is based on conditions being met and not a particular timeline.

North Korea's hostile rhetoric, rocket tests and unpredictable behavior in recent years has prompted calls to put off the transfer. The two nations agreed in principle to this "conditions-based" approach last year.

Carter said the main conditions Seoul needs to meet are the further development of its intelligence capabilities and its counter-artillery powers.

"If we look at global trends in terms of national security, many countries in the world conduct self-defense in the form of cooperation with regional and local partners," Han said when asked why South Korea -- despite its enormous economic and political clout -- still wasn't ready to take control of its own military.

Cyber Threats

The defense chiefs also agreed to strengthen their capacity for dealing with cyber attacks -- another challenge posed by Pyongyang.

South Korea, one of the world's most wired nations, has blamed North Korean hackers for a series of cyber-attacks on military institutions, banks, government agencies, TV broadcasters and media websites in recent years.

Carter's visit to South Korea was his first international stop on an eight-day trip to the Asia-Pacific region.

He will meet leaders from more than a dozen nations across East and South Asia. Officially, his mission is intended to help push the next phase of America's foreign policy "rebalance" to the strategically important region.

The United States wants to boost relationships and security cooperation with countries in the Asia-Pacific region and has called the "rebalance" a priority for its 21st century security interests.

A central theme of the trip is likely to be China's construction of artificial islands in the South China Sea and its claims of sovereignty over almost the entire waterway.

The defense chiefs were asked about the issue during an hour-long news conference, with Han stressing that any conflict should be resolved "in the framework of International law."

After the meeting in Seoul, Carter left for an Association of Southeast Asian Nations defense ministers' meeting in Kuala Lumpur.

Read More

Information Security: TalkTalk: Details of Over 1 Million Users Accessed by Hackers

British telecoms company TalkTalk has published information regarding the details accessed by hackers in the recent data breach, and law enforcement has announced the arrest of a third suspect in the case.

Shortly after launching an investigation into the incident, TalkTalk attempted to downplay the incident saying that the attackers only breached its website and not its core systems, and that the amount of data exposed is significantly smaller than initially believed.

The company has now revealed that the hackers gained access to less than 21,000 bank account numbers and sort codes, less than 28,000 credit and debit cards, and less than 15,000 dates of birth. As it stated earlier in the investigation, the payment card numbers compromised in the breach are incomplete (i.e. six middle digits are blanked out), which means fraudsters cannot use the information directly to steal money from bank accounts.

TalkTalk also reported that the attackers accessed the names, email addresses and phone numbers of less than 1.2 million customers. The data, allegedly obtained by hackers after exploiting a SQL injection vulnerability, has been reportedly sold on cybercrime forums.

All affected individuals will be contacted and informed about the type of information that has been compromised.

“As we have previously confirmed, the credit and debit card details cannot be used for financial transactions. In addition, we have shared the affected bank details with the major UK banks so they can take their usual actions to protect customers’ accounts in the highly unlikely event that a criminal attempts to defraud them,” TalkTalk said on Friday. “We also encourage you to take up the free 12 months of credit monitoring alerts with Noddle, one of the leading credit reference agencies.”

While the compromised data cannot be used directly to steal money from accounts, it can be highly useful for social engineering attacks, and now that TalkTalk told customers to expect to be contacted, such schemes could become even more successful. TalkTalk users have been warned that scammers and cybercriminals might leverage the recent incident to trick them into handing over bank details and passwords (TalkTalk says it will only ask for two digits), and installing malicious software.

The Metropolitan Police announced over the weekend the arrest of a third suspect in this case, a 20-year-old man from Staffordshire. Investigators had previously arrested a 15-year-old boy from Northern Ireland, and a 16-year-old from Feltham.

The teens were arrested on suspicion of committing offences covered by the Computer MIsuse Act, and were later released on bail.

Read More

Information Security: vBulletin Website Offline After Hacker Attack

The developers of the vBulletin forum software have taken down their official website and forum following a hacker attack that may have resulted in user data getting stolen.

Users who attempted to access the vBulletin forum on Sunday were greeted by a message that read “Hacked by Coldzer0.” The website and forum currently display a “down for maintenance” message.

The extent of the damage is unclear, but the hacker has published screenshots apparently showing that he managed to upload a shell to the vBulletin website and obtain user data, including user IDs, names, email addresses, security questions and answers, and password salts, DataBreaches.net reported.

Internet Brands-owned vBulletin Solutions has yet to release a statement on the incident and the company could not immediately be reached for comment.

Users should change their passwords as a precaution as soon as the website comes back online. If the same password is used on other websites, it should be changed there as well.

The attacker claims to have used a zero-day vulnerability in vBulletin to hack this and other websites powered by the popular forum software.

DataBreaches.net has connected the online moniker “Coldzer0” to Mohamed Osama, a malware analyst and security researcher based in Egypt. Osama has removed all references to the vBulletin attack from his social media accounts, and deleted the content of his personal website after his name was linked to the breach.

Vulnerabilities in unpatched versions of vBulletin are often leveraged to breach websites using the forum software. In 2013, thousands of websites were hacked via a security hole in vBulletin.

Australian security expert Troy Hunt, owner of the Have I Been Pwned service, which allows users to learn if and where their personal data has been compromised, noted that Have I Been Pwned includes data leaked as a result of several vBulletin-powered website breaches.

Read More

Information Security: Serious Flaws Found in ATMs of German Bank

Researcher Finds Information Disclosure and Hardware Misconfiguration Flaws in ATMs Used by German Bank

German savings bank Sparkasse has started patching its ATMs and self-service terminals after a researcher discovered that the machines can be tricked into revealing a lot of sensitive information during software updates.

The issue was discovered by Benjamin Kunz-Mejri, CEO and founder of Germany-based security firm Vulnerability Lab. The researcher was using a Sparkasse terminal when the machine suddenly ejected his card, and changed its status to “temporarily not available.”

Interacting with the device caused a Windows command prompt showing details of an update process to appear on the screen. That’s when the researcher realized that the terminal had become temporarily unavailable because it was performing a software update.

Software updates are normally conducted in the background, but as Kunz-Mejri discovered, the progress and details of the update process can be made visible by interacting with the device. The researcher described his interaction with the machine as a “timing attack,” but he did not want to disclose additional details in order to prevent abuse.

When he discovered the vulnerability, Kunz-Mejri recorded a video of the information displayed on the terminal’s command prompt screen. After reviewing the recording, he determined that the update process exposed a lot of sensitive information, including the bank’s main system branch usernames, serial numbers, firewall settings, network information, device IDs, ATM settings, and two system passwords.

The researcher also found that the self-service terminal’s keyboard was not disabled while the update was performed. Since these devices have a full keyboard, an attacker can execute system commands via the available command prompt on the underlying Windows operating system. The expert also noted that his interaction with the machine had caused the card reader to remain available and usable for other operations.

The tested devices are manufactured by Wincor Nixdorf, a German company that manufactures, sells, installs and services retail and banking hardware and software. The affected ATMs and self-service terminals are running Windows 7 and Windows XP operating systems, Vulnerability Lab said.

In an advisory provided to SecurityWeek, Vulnerability Lab described several possible attack scenarios. In one scenario, the attacker records the information displayed on the screen during the update process and uses it to perform a man-in-the-middle (MitM) attack on the targeted bank’s local network. It’s worth noting that the attacker would require access to the local network in the bank’s building to conduct such an attack.

An attacker who can gain access to the local network can also use the exposed information to reconfigure the ATM with a rogue update that is made to look like it’s coming from the service provider’s servers, the security firm said.

Researchers also believe an attacker could conduct fraudulent transactions by tampering with the ATM in an effort to crash it and corrupt its logging or debugging mechanism.

If fraudsters can determine the time and date of update schedules, they can conduct a larger, coordinated attack targeting multiple ATMs and self-service terminals, and use the obtained information in future operations, Vulnerability Lab has warned.

According to Vulnerability Lab, it takes 17 minutes to record all the information displayed on the screen.

While only machines used by Sparkasse have been tested, the security firm believes other banks that use Wincor Nixdorf ATMs and self-service terminals might be affected as well.

Sparkasse and Wincor Nixdorf have not responded to SecurityWeek’s request for comment.

The information disclosure and hardware misconfiguration flaws were first reported to Sparkasse’s Security and Data Protection team in May, and the existence of the issues was confirmed shortly after the vulnerability report reached the bank’s Finance Security Center in Frankfurt, Vulnerability Lab said.

The organization has already rolled out updates that address the vulnerabilities to some of its ATMs in the German city of Kassel (Hessen) as part of a pilot program. The update will be installed in other regions after the new configuration is tested properly, Vulnerability Lab said.

Sparkasse has thanked Kunz-Mejri for his effort and awarded him an undisclosed amount of money, documents seen by SecurityWeek show. Kunz-Mejri says this is the first time a German bank acknowledges a security researcher for finding vulnerabilities in self-service terminals and ATMs.

Incidents involving hacked ATMs are not unheard of in Germany. Last week, Berlin Police announced that they have been looking for a man who illegally withdrew cash from two ATMs using a USB stick that he connected to the devices after unscrewing their front panel. Thistechnique has been known for several years. 

Read More

Information Security: Hacker Group Plans to 'Unhood' KKK Members

Hacker group Anonymous is planning to reveal the identities of up to 1,000 Ku Klux Klan members, the latest twist in an ongoing cyber-war on the white supremacist group.

In Twitter messages and a YouTube video, the "hacktivist" collective said it had obtained the list of names from the Twitter account of a clan member.

"All will be revealed next month around the one year anniversary of #OpKKK," it tweeted, under the handle @Operation_KKK.

Anonymous took action against the Klan in November last year after members of the group threatened violence against peaceful protesters in Ferguson, Missouri.

The Midwestern town has become a symbol for racial tensions in America since the police shooting of an unarmed 18-year-old black man, Michael Brown, in August 2014.

In a statement earlier this week, Anonymous said it felt justified in "applying transparency" to the KKK.

"You are more than extremists. You are more than a hate group," the statement released online said.

"You operate much more like terrorists and you should be recognized as such. You are terrorists that hide your identities beneath sheets and infiltrate society on every level.

"The privacy of the Ku Klux Klan no longer exists in cyberspace. You've had blood on your hands for nearly 200 years."

The statement said: "We will release, to the global public, the identities of up to 1,000 Klan members, Ghoul Squad affiliates and other close associates of various factions of the Ku Klux Klan across the United States."

The Ghoul Squad is believed to be an auxiliary organization for KKK supporters.

Anonymous claimed to have taken down a KKK-linked Twitter account in November last year, and released the identities of a number of clan members.

Read More

Information Security: Group Behind CryptoWall 3.0 Made $325 Million: Report

Researchers representing security companies that are part of the Cyber Threat Alliance have conducted an in-depth investigation into the cybercriminal operations leveraging CryptoWall 3.0 ransomware.
CryptoWall 3.0, which first emerged in January 2015, is designed to encrypt important files on infected computers and hold them for ransom until victims agree to pay a certain amount of money in Bitcoin, usually ranging between a few hundred dollars and more than a thousand dollars.
Experts from Intel Security, Fortinet, Symantec, Palo Alto Networks and other companies in the Cyber Threat Alliance discovered during their investigation a total of more than 4,000 malware samples, 839 command and control (C&C) URLs, five second-tier C&C IP addresses, and over 400,000 infection attempts across 49 CryptoWall 3.0 campaigns.
Experts estimate that the group behind these attacks caused $325 million in damages after infecting hundreds of thousands of computers across the world. The region most affected by these attacks was North America, particularly the United States.
The damage estimate is based on the analysis of the financial infrastructure behind CryptoWall 3.0. According to researchers, the attackers used hundreds of Bitcoin addresses, including ones where victims had been instructed to deposit the ransom and “primary wallets” where the cybercrooks gathered their profit.
“A majority of these BTC addresses are used to launder the money into legal channels or to pay for services related to the campaigns, such as exploit kits and/or botnets used to send spam email,” experts said in their report.
Since a number of primary wallets were shared between different CryptoWall 3.0 campaigns, researchers believe that all of the identified campaigns are operated by the same entity.
Researchers discovered that the cybercriminals did not transfer the Bitcoins from the initial wallets to the final wallets directly. Instead, they broke up the transactions among multiple wallets distributed across several layers designed to protect the primary wallet.
“Many of the final wallets that were shared among multiple campaigns held a significant amount of unspent money. These wallets have received millions of bitcoins valued at hundreds of thousands of dollars (USD). This money was sent in small amounts through a vast complicated network of wallets,” experts said.
The extra layers make it difficult to identify the primary wallets, but it can be done if enough effort is put into it, researchers noted. In one of the campaigns, investigators identified more than 15,000 victims infected with a single CryptoWall variant. They estimate that the group behind CryptoWall 3.0 made at least $5 million from these users.
While experts haven’t found a way to decrypt files encrypted by CryptoWall 3.0, not all ransomware is as efficient when it comes to holding files for ransom. Kaspersky announced this week that it has obtained all the decryption keys, roughly 14,000, needed to recover files encrypted by CoinVault and Bitcryptor ransomware.
Kaspersky’s initiative was launched in April in collaboration with law enforcement authorities in the Netherlands. Victims of CoinVault and Bitcryptor are provided a free tool that they can use to decrypt their files.

The announcement that all CoinVault encryption keys have been obtained comes after last month Dutch police reported arresting two individuals suspected of using this piece of ransomware to infect computers around the world.

Read More

Information Security: Industry Reactions to CISA Approval by Senate: Feedback Friday

The United States Senate this week passed a controversial cybersecurity bill designed to facilitate sharing of threat data between private companies and the government in an effort to prevent data breaches.

If the Cybersecurity Information Sharing Act (CISA) becomes law, it will be easy for private sector companies to share threat data with the Department of Homeland Security and other agencies. The information will be used to fend off cyberattacks aimed at American companies.

However, privacy and civil liberties groups claim CISA can have serious privacy implications as it gives companies free rein to share their customers’ personal information with the NSA and the FBI.

CISA in its current form is opposed by many, including whistleblower Edward Snowden. Experts contacted by SecurityWeek pointed out that while the bill is good in theory, there are some serious issues that need to be addressed.

And the feedback begins… 

Tom Bain, VP Security Strategy, CounterTack:

"This is yet another key example of how politicians pretend to understand an issue and attempt to enact policy that follows.

Without any real enforcement capability in sharing intelligence, it's a waste of time. There's already enough sharing in place in some respects, but it's really all about the type of threat a given organization or agency is dealing with that will determine what type of intelligence is worth sharing.

No doubt there's a need to share information, but how that information is shared is what also should be weighed, almost as a transaction, because attackers will pounce if they know some mildly secure process is put in place for this, or if it's leaked or just available for the repository this intelligence is stored."

Ryan Trost, CTO and Co-Founder, ThreatQuotient:

“The problem with the bill is deeply rooted in the core of the government culture where information sharing is difficult given either the data classification levels to share (government to private industry) or the lack of analytical trust amongst each other (government to government).

I spent years working in secure government operations centers and have seen this firsthand. I also think the government is heavily pushing the CISA bill to maintain a line of communication into ex-government analysts working in the industry sector. Over the past 5-6 years as the commercial industry has embraced the need for threat intelligence skills, they have done so at the mercy of the government workforce. Analysts that have been trained and groomed by 3-letter agencies have been enticed over to industry by companies that simply have a larger budget spend – more analysts, more tools, more information, etc. As a result, industry is getting more innovative with threat intelligence platforms that manage and correlate both external and internal security and analytics solutions.

The reality is that government will continue to share classified more relevant cyber threat intelligence amongst themselves and distribute unclassified likely aged threat data with industry; but time will tell if my skepticism is justified.” 

Danelle Au, VP of Marketing, SafeBreach:

"The premise of real-time sharing of threat information between the private and public sectors makes sense. Shared security data can help us all be better prepared against the bad guys. In fact, coalitions formed to do this already exists -- CyberThreat Alliance, FS-ISAC etc. The challenge with the Cybersecurity Information Security Sharing Act (CISA) is it was created, written and passed by legislators without proper understanding of security. With vague, overly broad definitions of what constitutes cyber threat indicators, or how the information will be shared among other government agencies (like the NSA), large parts of this bill need to be rewritten in order to be effective. We need to go back to the drawing board on this. This is too important to fail."

Elad Yoran, Executive Chairman, KoolSpan:

"The goals of CISA are laudable. However, while good in its intent, the reconciliation effort between the House and the Senate should address the privacy concerns of the private sector. Failure to correct these deficiencies may undermine the goal of the legislation, as companies would be reluctant to share information with the government. The Snowden revelations gave U.S. tech companies a black eye in the marketplace because people perceived that these companies were compromising their users’ privacy. The technology industry learned this lesson painfully and is still feeling the impact. A current example is the recent EU Court of Justice’s decision to torpedo Safe Harbor, a direct result of its view that data collection mechanisms of the U.S. Government violated EU privacy laws.

Companies in other industries observed what happened to the technology companies and may therefore be reluctant to share data with the government, if people perceive this as infringing on their privacy. Congress should realize that strengthening the privacy elements of CISA, does not weaken the bill. In fact it does the opposite, it strengthens the resulting legislation and increases the probability that companies will share information.”

Jon Heimerl, Senior Security Strategist, Solutionary:

“The CISA bill sounds good in theory, but it may have difficulties in practice.

1. CISA relies on voluntary cooperation. No one knows how many breaches go unreported because the victim does not want people to know they are a victim. This will hold true in the future as well, and even companies which do share, are likely to withhold information about their vulnerabilities or environment which could potentially reveal trade secrets to their competitors. That information would probably be the same information which is most likely to help those competitors avoid being victims.

2. CISA relies on the effective cooperation and communication between Homeland Security, the FBI, the NSA, and other government agencies. Does anyone really believe that the bureaucracy behind a conglomeration of government agencies can get out of its own way and let the communication process flow cleanly and efficiently? Because in a breach, time is of the essence. If company A is under attack now, company B needs to know, right now, not three weeks from now after the information has been “shared’ through the red tape of a series of interagency communications.

The most significant issue is that CISA trumps other laws which protect the privacy of your information, like PCI, HIPAA and HITECH. If push comes to shove, and the government wants the data, CISA trumps everything else. And intended or not, do we want to put that trump card in the hands of the federal government?”

Anup Ghosh, Founder and CEO, Invincea:

"Privacy and security are not and should not be mutually exclusive; one cannot exist without the other. Helping foster the industry’s ability to thwart cyber attacks by sharing that information in real time helps to stop threats from spreading, but it is important to do this without exposing private citizens' data to potential government abuse. We need a balanced solution that can empower companies to share the latest attempts at cyber intrusions and unauthorized access, while at the same time protecting user privacy, civil rights and civil liberties. Congress should support industry in finding a solution that is fair and allows industry and private citizens to protect themselves while helping cyber companies to grow to fill the need.

The limits of information sharing are mostly attributable to the expectations of its value. Today, the expectations of its tactical value are often too high. For instance, most advocates of information sharing are focused on the tactical capture and distribution of attack signatures. In most cases, however, exploits and malware are not re-used, thus making sharing of signatures not terribly useful in its current form. If the threat intelligence is captured by software and automatically shared machine-to-machine, then efficiency gains by automation can make this effort more worthwhile."

John Dickson, Principal, Denim Group:

“I have deeply mixed emotions about CISA because I feel like information panacea, in general, is not a panacea, but I’m encouraged the government knows we have a problem. Nearly 2/3 of organizations that are breached hear from 3-parties according to the annual Verizon Data Breach Report. That happens not because they lacked timely threat intelligence – many times their own systems already had indicators of a breach – but because they usually don’t have the deeply talented people or repeatable intrusion detection processes to identify anomalies. I’d add that defining some of the liability protections was a step in the right direction, and certainly something the government can do to provide clarity in the marketplace.”

Bill Anderson, ‎Chief Product Officer, Optio Labs:

“The security world equivalent of “If a tree falls in a forest and no one hears it, does it make a sound?" would be “If you have no idea your data has been leaked, is it still a violation?” (hint: of course it is). The Cyber Information Sharing Act brings privacy rights into the spotlight, and in theory, the government is hoping to make us more secure. But with so much of our personal and business lives existing online in today’s digital world, there’s a fine line between defining consumer privacy rights and defining meta-data collection parameters that know a little bit about all of us.

CISA may enable an expanded program of quiet government collection on individual’s data, but while the legislation states that data being shared can be stripped of PII, we have to wonder how easy it would be to put it together again to identify individuals and all of their activity. How do we know the new CISA repositories are going to be any better protected than the data lost in enormous breaches over the last five years? There is huge potential for sharing best practices and threat information within the industry, but let’s be realistic and admit that no-one is immune to any threats. Placing consumer information in a giant CISA repository is as much an invitation to attackers, as a tool for defenders. Let’s hope the next tree we hear falling is not an announcement that the CISA system has been breached.”

Andrea Limbago, Principal Social Scientist at Endgame:

"CISA is a good example of legislation that addresses the wrong problem. Public interest in digital security ebbs and flows with the news cycle, pressuring Congress to do something, but providing the opening to avoid the tough, technical and social decisions required to truly provide substantive change. After attempting to pass cybersecurity legislation for years, information sharing was in many regards the 'low hanging fruit' that could get passed despite its redundancy with many ongoing efforts. There currently are numerous outlets for information sharing – ranging from formal organizations like the ISACs to informal peer networks – and so this is unlikely to have significant impact.

In fact, even if information sharing does increase between the public and private sector, it will create a massive big data challenge for the government that requires a range of technical and personnel requirements for proper analysis. These are the same kind of challenges with connecting the dots of extant data that only become obvious post-incident.

CISA’s greatest long-term impact may instead be deepening the divide between government and the tech sector and civil liberties groups.”

Joseph Pizzo, field engineer at Norse:

“The general appearance of CISA looks to be a simple sharing of breach and exploit information with the government. When we move in closer and take a deeper look, that sharing of information becomes a little fuzzy. Based on the information that is intended to be shared (and shared and shared and shared) with potentially multiple government agencies, CISA lacks a few provisions that would offer protection. First, the proposed Amendments to CISA that were stricken appear to leave CISA a back door to potentially private information.

The information that could be shared covers various formats. This “back door” is potentially dangerous when looking at the volume of data and length of breach that occurred with the OPM breach several months back. I think the concern is that if data is shared among multiple agencies and the proof exists that this data is difficult to protect, the question remains, how can this be solid legislature?

Additionally, CISA does nothing to address the underlying issues of data, network and resource protection. It leaves the black hole of another breach open. This black hole can occur at any agency where the data has been shared. Ideally, personally identifiable information for citizens and network security would be addressed with a variety of solutions to protect this valuable data. CISA needs additional requirements to enforce a higher level of security and to provide enhanced privacy of data that is delivered.”

Mitchell Bezzina, Security Evangelist at Guidance Software:

“The CISA Bill opens the doors between government and private entities - rarely seen in intelligence gathering - to share cybersecurity threat indicators. This provides the community at large with the ability to better fend off threats unknown to their organizations. For example, if the forensic artifacts gathered from one attack could have been used to identify a breach in another similar organization prior to data exfiltration, it’s possible that over 50 million PII records this year alone could have been kept safe.

Private entities have been monitoring networks and endpoints for threat prevention, detection and defense for years and this will only heighten their ability to prevent the exfiltration of personally identifiable information of US and international consumers.

I hope that the CISA bill will be the first step in a string of related standards that allow and define the sharing of threat indicators.”

John Morello, Chief Technology Officer at Twistlock:

“It’s a sad day for citizens' privacy. The CISA bill has noble intentions to strengthen the nation’s security through information sharing, but to do so without any regard for the privacy of citizens is a mistake. It’s particularly surprising because you can easily argue that such unfiltered sharing actually increases our overall risk. When PII is shared so broadly and without control, it makes it more likely that it will be compromised downstream of the original spill, worsening future breaches.”

Dan Lohrmann, CSO and Chief Strategist at Security Mentor:

“Recently, there has been a rare bipartisan unity in Congress on legislative efforts regarding cybersecurity, as well as general support from the White House, which has been missing in previous years. Previously, the trouble has been that until you get the final version that both the house and senate both agree on, it is hard to know what will truly emerge and be signed by the President. As it currently stands, CISA ensures that organizations that share or receive information will not be sued for trying to improve their own, or others, cybersecurity. For now, this is a good step, but let’s wait and see what happens.”

Steve Durbin, Managing Director, Information Security Forum:

“Unfortunately this kind of lawmaking is exactly what we do not need since it fails to address the issues of transparency and of encouraging organizations to openly collaborate.

I’m not overly concerned about the spying component in all of this – that will happen regardless – what frustrates me more is that the real focus on addressing the issue of cyber security should be in education and support to deliver robust cyber resilience in our systems and enterprises. No one is better suited to securing our data than the enterprise that holds it and individuals themselves; I see nothing in this bill that reinforces the responsibility of the C-suite to protect data, nothing to encourage open and collaborative sharing for the common good and nothing to promote education on the issues of being safe in cyber.”

Todd Helfrich, director of federal sales, ThreatStream:

“Cyber sharing is already happening, but all too infrequently. It’s time to institutionalize voluntary cyber sharing that shields personal privacy, and CISA can do that.

CISA formalizes the voluntary exchange of information with the government. It would allow the private and public sector to share the digital ones and zeroes behind the back wall of computer networks, where cyber traffic is tracked. It’s the technical data IT professionals have access to and use to assess the threats on systems while learning the adversaries’ methods and tactics. These valuable data points are called cyber threat indicators (CTIs). Sharing CTIs is the key to stopping, and even preventing, hack attacks.
[...]
CISA would encourage more companies to collaborate by providing liability protection for organizations sharing CTIs. It’s already standard procedure in the cyber world to scrub data, so only what is necessary is shared. CISA does not extend protection to a company that knowingly shares PII. CISA will help move national cyber defenses from a reactive to proactive stance, so we can catch the 21st century crook.”

Alastair Paterson, CEO and Co-Founder, Digital Shadows:

“Fundamentally, you cannot legislate away blind spots and other protection gaps that are caused by lax security measures in organizations that need to improve. The enactment of CISA, itself, will not resolve many issues, and we are definitely trading some privacy for what is very little in return.

Companies share data already through schemes like the ISACs. Unfortunately, the sharing often only includes high-volume, more available data that often floods security teams already overloaded with irrelevant information they have to sift through. In general, sharing is often still limited in favor of competitive advantage, and CISA is unlikely to change that.”

Andrew Conway, research analyst, Cloudmark:

“Many American Internet companies have customers all over the world. Social networks, security companies, hosting companies, ISPs, webmail providers, and many other American businesses all have access to sensitive personal and corporate data worldwide. Their customers rely on them to keep that data private. In most cases that is backed up by non-disclosure agreements (NDAs) or privacy policies. CISA says that American companies can't be sued for breaching those NDAs or privacy policies if they share information with the US Government. That would make it hard for those American companies to attract and keep customers in countries with strong privacy laws.

If law enforcement is investigating a particular criminal, they can get a search warrant or subpoena to request information, so long as they can meet the legal requirements for doing so. American companies are happy to comply with legal requests. They will also provide evidence of third party criminal activity to law enforcement unsolicited whenever there is a reasonable chance that the criminals can be brought to justice. However, having the US government decide that NDAs and privacy policies are not legally binding will not help with that, and it will limit our ability to do business outside the US."

Ryan Stolte, Co-Founder and CTO, Bay Dynamics:

“The Cybersecurity Information Sharing Act (CISA) is a positive step in opening the channel of communication about indicators of compromise and other threat intelligence related to attacks coming in from the outside.
[...]
However, the Act is lacking in two areas which could make it counterproductive. First, as we have seen from the attack against the Office of Personnel Management, it’s tough to put our 100% trust in the government when it comes to how they are preventing our most valuable information from getting into the wrong hands. Under CISA, we will be sharing information with them and how are we supposed to know that information is being protected? Second, CISA is missing the boat on one of the core reasons why we keep seeing more breaches – security surrounding third party vendors. The lack of communication and visibility between organizations and the third party vendors they hire has led to numerous breaches and a government-backed framework may help close that gap.”

Read More

Information Security: Second Suspect Arrested in Connection With TalkTalk Breach

Police in the United Kingdom have arrested a second individual as part of the investigation into the recent data breach suffered by telecoms company TalkTalk.

According to the Metropolitan Police, the second suspect is a 16-year-old boy from Feltham, a town near London. The teen was arrested on Thursday by detectives of the Cyber Crime Unit on suspicion of Computer Misuse Act offences, and was later bailed.

Investigators searched his residence, along with another location in Liverpool.

Earlier this week, British police announced the arrest of a 15-year-old boy from Northern Ireland in connection to the TalkTalk breach. It’s unclear at this point what role these teenagers might have had in the hacker attack aimed at TalkTalk.

In the meantime, the ISP informed customers that the data possibly obtained by the attackers is not enough to steal money from bank accounts. However, as many experts have warned, the exposed information can be highly useful for social engineering attacks.

That is why TalkTalk told customers that the company will never call or email them asking to hand over sensitive personal and financial information, and it will not ask them to install any software on their computers.

“The number of customers who may have been affected and the amount of data potentially accessed is also smaller than we originally thought,” TalkTalk said on Wednesday.

The attackers might have accessed names, addresses, dates of birth, email addresses, phone numbers, TalkTalk account information, payment card data, and bank details. TalkTalk says account passwords are not at risk, and the credit and debit card numbers stored on its systems are incomplete. According to some reports, the hack was carried out with the aid of a SQL injection vulnerability.

Cybercrime blogger Brian Krebs reported that the stolen data might be up for sale on hacker forums.

Affected TalkTalk customers have been offered free credit reporting services with Noddle and more than 50,000 individuals have already taken the offer, according to the ISP.

Read More

Information Security: XSS Flaw in YouTube Gaming Earns Researcher $3,000

Google has paid out a $3,133.7 bounty to a researcher who identified a cross-site scripting (XSS) vulnerability on the recently launched YouTube Gaming website.

YouTube Gaming, quietly launched by YouTube in late August, provides both live-streamed and on-demand gaming videos. The new service competes with Amazon-owned video game streaming website Twitch.

Ashar Javed, a penetration tester with Hyundai AutoEver Europe whose name is in the security hall of fame of several major companies, claims it only took him two minutes to find a reflected XSS vulnerability in YouTube Gaming’s main search bar.

According to the researcher, the website validates user input to prevent injection of potentially malicious code, but developers failed to escape the “</” string, allowing an attacker to use a payload like </script><script>confirm(document.domain)</script>.

As with all reflected XSS flaws, the attacker needed to trick the victim into clicking on a specially crafted link in order for the attack to work. If successful, the exploit could have been used to access cookies, session tokens and other sensitive information stored in the victim’s browser, and inject arbitrary content into the web page, which can be highly useful for phishing attacks.

The vulnerability was reported to Google on October 22 and it was fixed within a week, Javed told SecurityWeek. The Internet giant awarded the expert $3,133.7 for his work.

According to Javed, it’s common for developers to omit the “</” string when sanitizing user input. The bug bounty hunter says he has identified similar XSS vulnerabilities in Netflix, the Russian search engine Yandex, and at least ten other popular websites.

Additional technical details on how Javed identified the XSS vulnerability in YouTube Gaming are available on the researcher’s blog.

Read More