Centennial Man: 2014-08-24

Saturday, August 30, 2014

How many of these will we see? Does JPMorgan know what happened to it?

JPMorgan Chase alerts Louisiana that data breach possibly affects state-issued debit cards

Julia O’Donoghue reports:

The personal information of Louisiana residents could be at risk because of another data breach involving state-issued debit cards.

JPMorgan Chase has notified Louisiana’s government that someone had broken through the company’s security system and the personal information of residents using debit cards provided by three state agencies could be exposed. People who may be affected include those who receive their tax refunds, child support or unemployment benefits on a prepaid debit card issued by the state.

Friday, August 29, 2014

It has been a few years (Okay, decades) since I worked the “Russian Problem” but this seems very familiar. Think of this as a military strategy and ask yourself how significant sanctions can be.

http://www.bbc.com/news/world-africa-28971901

Ukraine: Vladimir Putin's military action reveals a wider plan

Alarm is growing in Kiev and the West over Russia's role in eastern Ukraine. But what is Russian President Vladimir Putin trying to achieve? [Annexation of the Ukraine. Bob]

The indications are clear that Russia is being more confident and less discreet about the presence of its troops and equipment in eastern Ukraine.

As well as sightings of Russian tanks, and reports of Russian paratroopers not only captured by Ukraine but also killed "while carrying out their duties", statements by separatist leaders have changed too.

After months of calling for assistance from Russia, separatist leaders now say that they can "do without outside help".

All this could indicate that Russian planners felt the military situation of Russian-backed separatists was severe enough to need more direct assistance.

Equally, it could be that Russia is simply less concerned at this stage about discretion and deniability.

(Related) Is retaliation for sanctions an act of war? Perhaps JPMorgan should conduct their “routine checks” more frequently?

http://www.bloomberg.com/news/2014-08-29/jpmorgan-hack-said-to-span-months-via-multiple-flaws.html

JPMorgan Hack Said to Span Months Via Multiple Flaws

Hackers burrowed into the databanks of JPMorgan Chase & Co. (JPM) and deftly dodged one of the world’s largest arrays of sophisticated detection systems for months.

The attack, an outline of which was provided by two people familiar with the firm’s investigation, started in June at the digital equivalent of JPMorgan’s front door, an overlooked flaw in one of the bank’s websites. From there, it quickly developed into any security team’s worst nightmare.

The hackers unleashed malicious programs that had been designed specifically to penetrate JPMorgan’s corporate network. Using these sophisticated tools, the intruders reached deep into the bank’s infrastructure, silently siphoning off gigabytes of information, including customer-account data -- uninterrupted until mid-August.

Only then did a JPMorgan team conducting a routine scan trigger an alarm. They discovered a breach, now being traced and evaluated, which investigators believe originated in Russia.

Evidence of advanced planning and the access to elaborate resources, as well as information provided by the FBI, led some members of the bank’s security team to tell outside consultants that they believed the hackers had been aided by the hidden hand of the Russ ian government, possibly as retribution for U.S.- imposed sanctions.

A case study for my Computer Security students.

http://www.securityweek.com/report-examines-unanswered-questions-around-target-attack

Report Examines Unanswered Questions Around Target Attack

Cybersecurity startup Aorato has published a report around the data breach suffered in 2013 by Target, which investigates some of the techniques used by the attackers to gain access to the company's networks.

… based on publicly available information, Aorato has reviewed the steps taken by the attackers, from the HVAC (heating, ventilation, and air conditioning) contractor breach up to the theft of sensitive information from the retailer's networks.

… The report.

… Researchers highlight the fact that in such credit card-oriented attacks, cybercriminals don't invest too much in infrastructure and automation. As in the case of Target, many operations are carried out manually with the aid of various tools; the only automated tasks are performed by the piece of malware used in the attack. In this particular attack, unlike many other APT attacks, the cybercrooks had not created a command and control (C&C) infrastructure, and instead operated everything manually from within the network.

This should be part of your security budget calculation.

http://www.bespacific.com/2014-cost-data-breach-global-analysis/?utm_source=rss&utm_medium=rss&utm_campaign=2014-cost-data-breach-global-analysis

2014 Cost of Data Breach: Global Analysis

by Sabrina I. Pacifici on Aug 28, 2014

News release: “Throughout the world, companies are finding that data breaches have become as common as a cold but far more expensive to treat. With the exception of Germany, companies had to spend more on their investigations, notification and response when their sensitive and confidential information was lost or stolen. As revealed in the 2014 Cost of Data Breach Study: Global Analysis, sponsored by IBM, the average cost to a company was $3.5 million in US dollars and 15 percent more than what it cost last year. Will these costs continue to escalate? Are there preventive measures and controls that will make a company more resilient and effective in reducing the costs? Nine years of research about data breaches has made us smarter about solutions. Critical to controlling costs is keeping customers from leaving. The research reveals that reputation and the loss of customer loyalty does the most damage to the bottom line. In the aftermath of a breach, companies find they must spend heavily to regain their brand image and acquire new customers. Our report also shows that certain industries, such as pharmaceutical companies, financial services and healthcare, experience a high customer turnover. In the aftermath of a data breach, these companies need to be especially focused on the concerns of their customers. As a preventive measure, companies should consider having an incident response and crisis management plan in place. Efficient response to the breach and containment of the damage has been shown to reduce the cost of breach significantly. Other measures include having a CISO in charge and involving the company’s business continuity management team in dealing with the breach. In most countries, the primary root cause of the data breach is a malicious insider or criminal attack. It is also the most costly. In this year’s study, we asked companies represented in this research what worries them most about security incidents, what investments they are making in security and the existence of a security strategy.”

As long as your “Thing” only monitors your vitals, you are safe from hackers. If your pacemaker is connected to the Internet, hackers could turn you off.

http://www.theinquirer.net/inquirer/feature/2362158/doctors-and-nurses-need-to-take-their-internet-of-things-pills

Doctors and nurses need to take their Internet of Things pills

THE INTERNET OF THINGS (IoT) has the potential to reshape a number of industries, none more so than the healthcare sector.

According to the results of a recent survey we ran, questioning IT professionals on their attitudes to the IoT, healthcare is the biggest potential market for connected devices and technology. Fifty-four percent of readers said that tools like heart-rate monitors were a top benefit of the Internet of Things.

The results show a clear interest among users in how their health, and healthcare in general can be improved by the IoT. This is reflected in recent research, which has indicated that remote patient monitoring is predicted to save an average of $12,000 per patient in the US and significantly reduce hospital-acquired diseases, a figure likely to be achievable in the UK and across Europe too.

Reasonable? Doesn't leave me warm and fuzzy.

FISC OKs Section 215 Investigations of Americans, Despite First Amendment

The Foreign Intelligence Surveillance Court declassified an opinion today which, although highly redacted, illuminates the way at least one Judge is interpreting his mandate to protect the First Amendment activities of Americans who the FBI seeks to investigate under USA PATRIOT Act Section 215, codified at 50 USC 1861.

Essentially, the question the judge, John D. Bates, confronts is when are international terrorism investigations involving Americans based “solely upon activities protected by the first amendment to the Constitution.” Judge Bates concludes that so long as a international terrorism investigation is premised on some unprotected activity, the FBI can nevertheless investigate law-abiding US persons.

Worthy of a quick read.

UK: Supreme Court president: UK privacy law “may have to be reconsidered” due to rise of social media

From Out-Law.com:

The pace of technological change and rise of social media “may make it inevitable” that UK privacy laws need to be revised and updated, the country’s most senior judge has said.

In a speech at the Hong Kong Foreign Correspondents’ Club (9-page / 157KB PDF), Supreme Court president Lord Neuberger said that “astonishing developments” in technology had created “enormous challenges for people involved in the law and people involved in the media”.

Thursday, August 28, 2014

Can we tell the intentions of hackers? CyberWar or Cyber-Fooling-Around? Isn't it rather important to know where the hacking is coming from (after a month?)

http://www.nytimes.com/2014/08/28/technology/hackers-target-banks-including-jpmorgan.html

JPMorgan and Other Banks Struck by Cyberattack

A number of United States banks, including JPMorgan Chase and at least four others, were struck by hackers in a series of coordinated attacks this month, according to four people briefed on a continuing investigation into the crimes.

The hackers infiltrated the networks of the banks, siphoning off gigabytes of data, including checking and savings account information, in what security experts described as a sophisticated cyberattack.

… It was not clear whether the attacks were financially motivated, or if they were collecting intelligence as part of an espionage effort.

JPMorgan has not seen any increased fraud levels, one person familiar with the situation said.

… The intrusions were first reported by Bloomberg, which indicated that they were the work of Russian hackers. But security experts and government officials said they had not yet made that conclusion.

Earlier this year, iSight Partners, a security firm in Dallas that provides intelligence on online threats, warned companies that they should be prepared for cyberattacks from Russia in retaliation for Western economic sanctions.

Are we seeing a random rise in the number of DDoS attacks, or are these more coordinated?

http://www.tomsguide.com/us/twitch-ddos-attack,news-19395.html

Twitch Knocked Offline in Latest Online-Gaming Attack

The Twitch videogame-streaming service went offline for several hours last night (Aug. 26), possibly as a result of a distributed denial-of-service (DDoS) attack, which would make it the latest in a series of attacks on online gaming services.

A hacker group called Lizard Squad claimed credit for last night's disruption via its Twitter feed. On Sunday (Aug. 24), the same crew said it was behind outages of Sony's PlayStation Network and Sony Online Entertainment services, as well as connectivity problems with Blizzard's Battle.net and Microsoft's Xbox Live.

Government health care: Like a roach motel, once the data enters it never leaves. Perhaps this lady should sue for “fraudulent amputation?”

http://www.abajournal.com/magazine/article/federal_medical-privacy_law_frustrates_id_theft_victims/

Federal medical-privacy law frustrates ID theft victims

Linda Weaver had two good feet when she opened her mailbox one day in 2005. So she was surprised to find a bill for the amputation of her right foot.

Weaver, who runs a horse farm in Florida, soon discovered that it wasn't just a mix-up. According to the Los Angeles Times, her stolen identity and insurance information had been used to get surgery. She was stuck with the bill—and with a medical record full of incorrect, potentially dangerous information.

Weaver was one of a growing number of medical identity theft victims whose identity was stolen to make false health care claims. A 2013 study from the Ponemon Institute, an independent research organization in Traverse City, Michigan, that focuses on privacy and security, found the crime grew by 19 percent between 2012 and 2013. The Identity Theft Resource Center, a nonprofit working on prevention and victim assistance, said in March that medical records breaches made up 43.8 percent of all breaches reported to the federal government last year.

Medical identity theft creates some of the same financial complications as identity fraud. After Weaver convinced her insurance company that an imposter had the amputation, the insurer wouldn't cover it. So the hospital socked Weaver with the whole bill, even after she sent a notarized photo of her feet. Collection agencies weren't interested in Weaver's story, so the debt kept getting resold, creating multiple false entries on her credit report. Clearing this up became a 40-hour-a-week job, Weaver told the newspaper.

Is it so surprising that the country that invented Big Brother finds itself forced to live in his world?

British Cars To Be Tracked Under New EU Rules

Manchester Gazette reports:

UKIP Deputy Leader, Paul Nuttall, has warned that all new cars are set to be fitted with tracking devices under new EU Rules.

Since the EU passed plant to fit new cars with tracking devices that work similar to mobile phone technology, the UK Government has admitted it cannot do anything to stop British drivers having to comply.

The EU claim the devices can be set to send out an SOS to the emergency services should the car’s airbag be deployed, potentially saving 2,500 lives a year across the continent.

“This is an absolute disgrace,” said Mr Nuttall, UKIP deputy leader.

Wednesday, August 27, 2014

Interesting hacker strategy. Delay reporting, increase the number of cards stolen?

http://krebsonsecurity.com/2014/08/dq-breach-hq-says-no-but-would-it-know/

DQ Breach? HQ Says No, But Would it Know?

Sources in the financial industry say they’re seeing signs that Dairy Queen may be the latest retail chain to be victimized by cybercrooks bent on stealing credit and debit card data. Dairy Queen says it has no indication of a card breach at any of its thousands of locations, but the company also acknowledges that nearly all stores are franchises and that there is no established company process or requirement that franchisees communicate security issues or card breaches to Dairy Queen headquarters.

… The situation apparently developing with Dairy Queen is reminiscent of similar reports last month from multiple banks about card fraud traced back to dozens of locations of Jimmy John’s, a nationwide sandwich shop chain that also is almost entirely franchisee-owned. Jimmy John’s has said it is investigating the breach claims, but so far it has not confirmed reports of card breaches at any of its 1,900+ stores nationwide.

Might be fun (i.e. Cruel and usual) to have my Computer Security students create a US version of this guide.

AU data breach notification guide: A guide to handling personal information security breaches

The Office of the Australian Information Commissioner has released Data breach notification guide: A guide to handling personal information security breaches. Some excerpts:

Preventing data breaches — obligations under the Privacy Act

Security is a basic element of information privacy.4 In Australia, this principle is reflected in the Privacy Act in the APPs

Agencies and organisations are required to take reasonable steps to protect the personal information they hold from misuse, interference and loss, and from unauthorised access, modification or disclosure. This requirement is set out in APP 115 (see Appendix A for APP 11).

Sections 20Q and 21S of the Privacy Act imposes equivalent obligations on credit reporting agencies and all credit providers. Similarly, guideline 6.1 of the statutory TFN guidelines6 requires TFN recipients to protect TFN information by such security safeguards as are reasonable in the circumstances.

Depending on the circumstances, those reasonable steps may include the preparation and implementation of a data breach policy and response plan. Notification of the individuals who are or may be affected by a data breach, and the OAIC, may also be a reasonable step (see page 9).

[…]

Responding to data breaches: four key steps

Data breaches can be caused or exacerbated by a variety of factors, affect different types of personal information and give rise to a range of actual or potential harms to individuals, agencies and organisations.

As such, there is no single way of responding to a data breach. Each breach will need to be dealt with on a case-by-case basis, undertaking an assessment of the risks involved, and using that risk assessment as the basis for deciding what actions to take in the circumstances.

There are four key steps to consider when responding to a breach or suspected breach:

Step 1: Contain the breach and do a preliminary assessment
Step 2: Evaluate the risks associated with the breach
Step 3: Notification
Step 4: Prevent future breaches

Each of the steps is set out in further detail below.

You can access the guide (49 pp, pdf) here.

Is it possible to write evidence gathering guidelines in the form: “You need a warrant or subpoena for all evidence except: … ” Seems to me that would be simpler.

http://www.bespacific.com/drones-home-domestic-drone-legislation-survey-analysis-framework/?utm_source=rss&utm_medium=rss&utm_campaign=drones-home-domestic-drone-legislation-survey-analysis-framework

Drones at Home: Domestic Drone Legislation – A Survey, Analysis and Framework

by Sabrina I. Pacifici on Aug 26, 2014

Zoldi, Dawn M. K., Drones at Home: Domestic Drone Legislation — A Survey, Analysis and Framework (July 9, 2014). Available at for download SSRN: http://ssrn.com/abstract=2486259

“Can the government employ drones domestically without running roughshod over personal privacy? In an effort to preemptively rein in potential government overreach, most states have proposed legislation that restricts or forbids government drone use. The intent is to prevent drone use for warrantless information and evidence collection. Ironically, many of these proposals will have the opposite affect intended. State-by-state drone legislation may lead to consequences such as the erosion of Fourth Amendment jurisprudential principles, losses of life and property, procedural windfalls to criminals, and deleterious effects on the military. Lawmakers should take a nuanced approach to government drone use rather than selectively revising constitutional protections. A nuanced approach would allow the federal government to use drones to their full potential while also protecting personal privacies. There are four principles that should guide drone legislation:

(1) apply the Fourth Amendment agnostically;

(2) ensure operational purpose language distinguishes between law enforcement and non-law enforcement professionals;

(3) focus new regulations focus on information collection, dissemination, and retention;

(4) develop narrowly tailored remedies that deter specific behavior consistent with their historical purpose.

Drone legislation drafted with these principles in mind will protect our national security and our civil liberties.”

Is there anything here we really didn't expect? Details are “secret” only to avoid public backlash.

AU: Secret data retention discussion paper leaked

Ben Grubb reports:

It’s the secret industry consultation paper the federal government didn’t want you to see.

Produced by the Attorney-General’s Department and distributed to telecommunications industry members on Friday, the nine-page document attempts to clarify what customer internet and phone records the government wants companies such as Telstra, Optus and iiNet to store for the purpose of law enforcement and counterterrorism.

The requirement is part of a proposed data retention regime, which has been given “in principle” approval by the Abbott government. It seeks to continue to allow law enforcement and spy agencies to access customer identifiable data without a warrant as prescribed by law, but would ensure the data is not deleted for a mandated period of two years.

The paper, stamped “confidential” and marked for “preliminary consultation only” raises more questions than it solves.

Tuesday, August 26, 2014

Lesson to learn: If you are going to rely on your Security procedures, make certain they are reliable. (How would anyone gain access to your offsite backups without your knowledge? They write blank “backups” and over time older backups are deleted.)

http://www.securitybistro.com/?p=8909

Victim Company Refuses to Pay DDoS Extortion Fee and Is Permanently Forced Out of Business

… Code Spaces experienced a DDoS attack accompanied by a ransom demand. Code Spaces assumed it could handle the attack on its systems, which were hosted on Amazon Web Services (AWS). When the attackers didn’t get their payoff to end the DDoS attack, it is presumed they directed their vengeance toward gaining access to Code Spaces’s Amazon EC2 control panel and then deleting most of the company’s data, backups, machine configurations and offsite backups.

That's 100,000 won more than US breach victims typically get. I wonder how they did it?

KR: KT ordered to pay 100,000 won each to data-leak victims

Yonhap News reports:

South Korea’s No. 2 mobile carrier KT Corp. was ordered by a local district court Friday to pay 100,000 won (US$97) in compensation to each customer who had personal data leaked in 2012.

The Seoul Central District Court’s ruling came after some 28,000 KT users filed a lawsuit against the mobile carrier for the leak of sensitive personal information, demanding compensation of 500,000 won per person.

Centennial Man

Saturday, August 30, 2014

Friday, August 29, 2014

Thursday, August 28, 2014

Wednesday, August 27, 2014

Tuesday, August 26, 2014

Search This Blog

Followers

Blog Archive

Links

About Me