The Ashimmy Blog

Interpreting Silence Is Never A Formula For Success

Have been watching the unfolding RSA hack story since the beginning. Frankly I was very sympathetic to RSA. This kind of stuff can happen to anyone, any company at any time. 

I also understand that with everything at stake including their customers security, their financial well being and all, a full disclosure of everything they know to this point would probably not be wise.

So even giving them the benefit of the doubt I have to call out their continued silence on specifics. They are committing a cardinal sin by allowing the industry and more importantly their customers to interpret their silence.

My experience in business and life that interpreting silence, one always assumes the worse. The longer you let the silence linger, the worse people assume it is. That is exactly what is happening in this case.

What could be worse? Acting on silence, that’s what.  Now we are starting to get to the point where the pundits and experts are advising people to act on silence. Based on rumor, innuendo and silence, decisions like these are often costly and wrong.

So RSA should put a stop to it right now. End the silence, come out with a definitive statement of what their customers should do. Otherwise the mob/herd mentality kicks in and RSA may not ever be able to head off the momentum their silence is allowing to build.

Related articles

• "TSUNAMI OF SILENCE" to Support Japan (prweb.com)
• Eckhart Tolle, on silence (visaisahero.wordpress.com)

Still The Weakest Link

I was reading an article today about a breach at a New Jersey school district. The attackers were able to infiltrate the system and basically wreak havoc with it. What personal information was stolen is up for debate.

It seemed very much like the typical kiddie script kind of stuff. They defaced the web site, changed the prices for the school lunches, stuff like that. Even if the intruders did try to tamper with any of the students school records, the district said those changes would be temporary and fixed shortly. I guess they had other copies of the records to go by.

But we shouldn’t just pass this off as some harmless school kids prank.  Who knows what other information was on this system that could have been compromised? Who knows if anything was planted on the system so that when other users accessed it, they might be infected too. What information is on those secondary systems that could be infected?

On top of this one thing the hackers did do was use the school systems emergency notification system to send out again a apparently harmless treatise on Linux.  Whether that message actually got out is up for debate. These emergency notification systems are supposed to be used, well in cases of emergency obviously.

So what devious 0day exploit did the hackers use? Was it APT or some new type of attack? Did the school not have latest anti-malware suite installed? Have they been patching? Probably none of the above. The user name (admin – how original) and the password (poopnugget – I kid you not) were posted on a bulletin board for anyone to use. 

From the password being poopnugget I can only assume a juvenile was involved. But whether a kid picked this gem of a password or an adult did is not really the issue. The issue is that once again this is not a technology issue. The weakest link in the chain is still the human sitting behind the computer. Someone did not practice safe password and so the password was exposed and this is what happens.

Yes maybe if they used tokens instead of  or in addition to passwords this doesn’t happen. But technology is only going to go so far. People need to be educated and trained on practicing security, not just relying on technology to secure you.

Don’t tell me Facebook is serious about security

Image via Wikipedia

Yeah, Yeah I know they signed a deal with McAfee. BFD. Facebook is not serious about security. If they were, they would do something about all of the phishing, spam and misleading questionable ads they are getting paid to run.

How many of you have clicked on ads on the right margin of your wall? How many of those have wanted you to install a “toolbar”? How many are scams? Facebook will take money from anyone regardless of what they are trying to foster on their precious members.

But here is why I really know Facebook doesn’t give a rat’s ass about the security of their members. I have a childhood friend of mine whose account was compromised months ago.  Since then my friend has changed his password lots of times, he has opened and closed his account several times. In spite of this, everyone who is friends with this person is still receiving messages and wall to wall posts several times day with links to malware infested sites purporting to be You Tube or something else. You know the type with the word LOL or “you have got to see this”.

Of course I know better than to click on these links, but I know several other mutual friends who have and have had to spend money and time cleaning their machines out as a result.

I have reported this to Facebook 6 times or more. I have reported the messages as spam probably 50 times or more. I have walked my friend through reporting it to Facebook numerous times.

What has Facebook done? Not a frigging thing. They refer you to some canned FAQ with things you might be able to do. The result is that probably half of my friend’s friends have dropped him as a friend. Its easier than dealing with the spam, phishing BS.

Facebook won’t get serious about security until it hits them in the pocketbook. What they don’t realize is it all ready has. They may just be killing the goose that lays the golden eggs.

Twitter on the other hand seems to be really starting to crack down on the twitter spam and rogue accounts.  Good for them, #FAIL on facebook.

Related articles by Zemanta

• New Phishing Scam Making Its Way Around Facebook (allfacebook.com)
• Facebook Fights Social Spam with "Mark You Don't Know" Response to Friend Requests (insidefacebook.com)
• WARNING: New Facebook Chat Phishing Scam in Progress (mashable.com)
• Facebook and McAfee Want to Protect You From Malware (mashable.com)
• Twitter Rolls Out Brilliant Spam Protection For DM Scams (techie-buzz.com)

Passwords are a losing battle

Hey I know this is a case of the pot calling the kettle black, but at least I learned from my mistakes. There was an interesting article in the NY Times the other day based on a report from Imperva. It seems despite all of the publicity around ID theft and hacking, a sizable number of people still use ridiculously easy passwords to protect their most valuable information. You know the kind I am talking about. You need a 6 character password and you pick 123456. Is your password – password? Does every single person need to get hacked into before they will change? I am afraid so.

The information for the Imperva report came from a posted list of 32 million passwords hacked from a site called RockYou. This is believed to be one of the largest list of passwords made available to both hackers and researchers outside of the FBI or Homeland Security. It is a fascinating look across a wide swatch of what people are doing for passwords.

So if no amount of education is going to change this, what should we do? When will we move to keys, tokens or smart cards. It is painfully obvious that there is something about humans and strong passwords that just doesn’t compute. I say stop beating the dead horse here and lets put our efforts into something that has a chance of success.

Related articles by Zemanta

• Genetic Flaw Identified in Humans! (Password Required) (pindebit.blogspot.com)
• Depressing Analysis Of RockYou Hacked Passwords (techcrunch.com)
• Top ten internet passwords to be avoided (telegraph.co.uk)
• If Your Password's Still 123456, It Might as Well Be HackMe (nytimes.com)

Where is TJX hacker ring member going to get 171.5m?

One of Albert Gonzalez, the TJX hacker’s cohorts was sentenced last week in court in Boston for his part in the big hack according to this article in Wired and Dan Kaplan’s report in SC Magazine.

Stephan Watt, 25 years old, was allegedly a close personal friend and confidant of ring leader Albert Gonzalez who is awaiting sentencing while undergoing psychiatric evaluation to determine if he is competent.  Poor Watt was supposedly just a bit player in the scheme, though he did write the sniffer program that was used to get the credit card information.  He supposedly did not receive any money directly from the crime. I don’t really believe that BTW.

Watt was sentenced to two years in prison and 3 years of supervised release. Plus he was ordered by the court to pay back $171.5 million dollars in restitution for his part in the hacking scheme of the decade, if not the century.

Watt’s lawyer had asked for a no-jail time sentence, claiming there client was just a minor accomplice in the grand scheme (pun intended) of things. He was motivated by friendship and intellectual curiosity, not greed according to his attorney. He had a bright future working at Morgan Stanley, Qualys and some other companies.

In the meantime he was living in an apartment that his Mom paid for. Isn’t that just grand. The big time member of the most notorious hacker ring ever living in a place his mommy bought him. 

So I was thinking if Watt has to stay in the place his mom bought him and he did not make real money out of this scheme, where is he coming up with $171.5m?  That ain’t exactly chicken scratch. 

In reading more about Watt it seems he is in great physical shape and is 7 feet tall. There is the answer! Who else besides hackers have access to that kind of money?  Professional ballplayers. A 7 foot white guy. He should be able to get a gig as a basketball player pretty easily.  He probably can’t jump, but hey he is 7ft. With what they pay pro basketball players, he actually has a shot at paying that court ordered restitution off.

His Mom should pack him off with some basketball sneakers when he goes to serve his sentence. He should practice everyday for the next two years. When he comes out he can join some of the other delinquents who currently play in the NBA. He might even teach them how to hack into each others twitter accounts and stuff.

Related articles by Zemanta

• Document Details Help TJX Hacker Gave Prosecutors (wired.com)
• Inmate gets 18 months for hacking prison computer (computerworld.com)
• Bank Card Hacker 'Will Never Commit Any Crime Again' (wired.com)

A stroll through my junk mail folder

I like to go through my junk mail folder every few days to make sure nothing that I needed to see was spam canned.  I just finished looking over the last two days of junk mail (about 50 mails only). The good news is there was nothing in there that didn’t belong there and I didn’t have to move anything out or set up to always mail from the sender.  But what was in there was just ridiculous.  Let me share some of the highlights:

1. First of all, Mr. J Uddin, of the British Airways Authority wanted to let me know that a box had been received at Heathrow Airport with my name on it. Mr. Uddin was nice enough to inspect the box and discover that it contains 5.5 million dollars (US) in cash! Before handing it over to the customs officials he wanted to reach out to me. The box and cash are in safekeeping with the UK Treasury Insurance Authority (that makes sense) and I need to reach out to Uddin at his private email (juddinn@sify.com) for instructions to contact the clearance/releasing officer.

Mr. Uddin is very worried that I receive this notice, so he sent it to me 4 times in the last two days.  Thanks Mr. Uddin!

2. Next Mr Maxwell Brooks from the Chartered Finance & Securities wanted to let me know that the “UNITED NATIONS in Central Bank in conjuction with the WORLD BANK GROUP OF THE UNITED STATE OF AMERICA” has set aside $500,00.00 to pay scam victims like me. I just need to contact Scott Williams with the scam victims code they sent me with my contact info to receive the money. Oh yeah he wanted to tell me up front that it would cost me $155 to process my payment. If I am not interested in doing this to get the 500k don’t contact Mr Williams. 

Mr Brooks, of course I would lay out the 155 bucks to get the half a million dollars, thanks!

3. Then, Mr Scott Williams himself sent me this note,

“Attn: Beneficiary , This is to acknowledge the receipt of this email honourable office and the contents there in were well noted. How are you today? I hope you are doing fine healthwise and as well as your beloved ones and as well as your job and business. Be informed that we have received your details of your winning claims of $500,000 USD Thousand and has been Well confirmed all you just have to do is to come up with the sum of $155 to ensure your funds deliver to your deliver located address you are requested to send the sum of $155 to the address below: HERE IS THE PAYMENT INFORMATION OF THE SUM OF ($155) You are requested to send the fee VIA WESTERN UNION or MONEY GRAM by today Sender Name: sender Address: Reciever Name: Dele Charles Reciever Address: Abuja Nigeria Text Question: In God Text Answer: We Trust Amount to be sent: $155 Mtcn (Western Union): ............. Refrence Number (Money Gram): ..................”

H’mm the same $155.I guess Scott likes that amount. Maybe that is what it will cost him for English writing lessons.

4. Now, Mr Karim Ahmed the manager Audit & Accounts dept. in the African Development Bank of Burkina faso (A.D.B) wants my help in getting 25 million, two hundred thousand (nice touch adding the two hundred thousand, so it is not just an unbelievable round number) out of the bank.The money belonged to some poor Jordanian person who died in a plane crash.  Mr Ahmed will split the money 60-40 with me if I can get him my personal contact info.

Now that is the kind of phishing I am used to! Mr Ahmed you are going to have to be more creative than that.

5.  Following that were about a half dozen penile enlargements and Viagra stuff (how did they know), lets skip them.

6. Mr John Simmons wrote me next. He must work with Mr Brooks. He also represents a fund for scam victims and they have one million dollars for me! Not to worry Mr Simmons informs me, the Federal Bureau of Investigation is involved in this, so everything is on the up and up.

Whew, that makes me feel better. I just need to send over to Mr Simmons personal Yahoo email all of my contact information and bank info. Well since the FBI is guaranteeing it?

I do give this one extra points though. Taking the usual I have money for you to the next level, acknowledging that perhaps you were already a victim.

7. The last ones I want to tell you about is a group of 3 I received, all from nice ladies over in Africa. Two were young daughters of wealthy men who died and one was a widow.  They would all like my help in transferring their fathers monies out of the country.  They all call me dear and ask that I not be shocked that they contacted me.

They just want my phone number and will give me further instructions.Sounds innocent enough.

Geez, not one porn spam in the there, I am disappointed.

Happy Friday and Happy Chanukah to those celebrating!

SE-ishing

Once again I am grudgingly admiring the ingenuity of the bad guys.  If it is not one thing, it is another.  Just when I think people are on the look out for phishing and spear phishing, here comes Search Engine phishing. Security researcher Jim Stickley details how its done in this article about a recent report he wrote.

What the bad guys do is make fake sites that purport to be legitimate from well known institutions. By manipulating key words and other search engine optimization techniques, the fake sites rise in searches to be the top choices.  So for instance if someone searches First City Bank of Boca Raton, Google, Yahoo, Bing or whichever will actually show the fake site for, perhaps even before the real site. An unsuspecting web surfer, not suspecting that Google would be serving up scams goes to the site, enters their info and downloads a trojan and the rest is history.  How frigging sneaky!

So just because a site comes up high in a search, does not mean it is dirty and a scam.  Like everything else you see on the Internet a healthy dose of caution and common sense is required.  But can you imagine how many senior citizens or kids would go to a fake look alike site that comes up high in a search engine and enter their info without thinking twice?

To be fair according to the article, Google was much less susceptible to this kind of scam then some of the other search engines. But none of them are immune.

Related articles by Zemanta

• Phishing attacks costing millions (robbiz1978.blogspot.com)
• How fake sites trick search engines to hit the top (sfgate.com)

Albert Gonzalez: Dr. Evil or Lee Harvey Oswald?

Like many of you, I was somewhat amazed today to learn that according to the “authorities” the same person and his group was behind not only the notorious TJX and Dave & Buster credit card rip offs, but it was the same group that also pulled the Heartland heist and Hannaford, DSW and Barnes & Nobles, BJs Wholesale and Boston Market!  Can you believe this one man crime wave? Are there any other major breaches that he and his two unnamed Russian conspirators were not responsible for? Plus in his spare time he was an informant to the US Secret Service on other cybercrime activities. All of this from a high school graduate, self-taught hacker who has been in custody since May 2008.

Hey, I don’t have any knowledge that you couldn’t read in the 938 news articles on this available on Google as I wrote this, but call me doubting Thomas.  I just don’t think Gonzalez single handedly is responsible for all of the data security breaches that have happened over the last 5 years.  If he is, he is truly worthy of the Dr Evil title as a criminal mastermind.  But to me it sounds like the government has a patsy/scapegoat to blame this on and is wasting no time doing so.  Sort of like how Lee Harvey Oswald, a supposed CIA anti-Castro agent was “blamed” for the JFK assassination.  The two unnamed Russian helpers are positively right out of central casting. I am thinking Boris and Natasha, having escaped from Rocky and Bowinkle.  Come on guys this is just too much to be true. If I wrote this up as a book or movie you would think it ridiculous.  Well sometimes truth is stranger than fiction.  Lets see about this one.

Heartland CEO thought QSA’s would make him compliant and secure

Bill Brenner (one of my favorite real media types) has a great interview up on CSO online with the CEO of Heartland. Robert Carr, Heartland Payment Systems CEO blames his QSA’s for not investigating the already known “common attack vector” that allowed the malware to be planted on his systems. In reading the article it was pretty apparent to me that he made a common mistake. He thought the QSA’s where there to make him both secure and compliant.  They are not the same and the QSA job is tomake him compliant. I guess they did, but that didn’t help him be secure.

Of course after the fact everyone gets religion.  Carr says that PCI is just a minimum set of standards and does not make you secure.  Mr Carr that does not make your QSA audits fraudulent as you call them though. It just means you were only compliant. But PCI was not the only thing Carr was compliant about. He was compliant with not taking security seriously.  Doing the minimum and spending the minimum to do what he had to. Now of course he is creating industry groups to share security info. He is spending millions on security products to protect and encrypt.

Isn’t that the real travesty of our industry though?  Only after the cows have run out and the barn has burned down does anyone really give a crap.  Even by his own admission with what happened to him and his company, when he goes to talk to others in his industry the feeling is still it can’t happen to them. What will it take? Does every single one need to to have a security incident?

I am sorry to say that this just proves what many of us already knew. People don’t take security seriously until it is too late!

Related articles by Zemanta

• Data Sniffing Costs Heartland Bigtime (pindebit.blogspot.com)
• Data-sniffing attack costs Heartland $12.6m (theregister.co.uk)
• PCI security standard gets ripped at House hearing (computerworld.com)
• Gartner: No need for companies to drop Heartland, RBS WorldPay over PCI delistings (computerworld.com)
• In Legal First, Data-Breach Suit Targets Auditor (wired.com)
• Heartland Reinstated to Visa's List of PCI DSS Providers (pindebit.blogspot.com)
• Heartland CEO says data breach was 'devastating' (computerworld.com)

Lexis Nexis allowed cybercriminals to use its information for 3 years. I am shocked!

From the classic movie Casablanca:

Rick: How can you close me up? On what grounds?
Captain Renault: I'm shocked, shocked to find that gambling is going on in here!
[a croupier hands Renault a pile of money]
Croupier: Your winnings, sir.
Captain Renault: [sotto voce] Oh, thank you very much.
[aloud]
Captain Renault: Everybody out at once!

The latest winner of the Captain Renault award is Lexis Nexis and its corporate sister, Choicepoint. It seems that cybercriminals were using their service for 3 years to obtain information that was used to obtain fraudulent credit cards. Then to make matters worse Lexis Nexis apparently asked for and received permission to wait for 18 months to notify people whose information may have been compromised.  This is of course not the first time that Choicepoint has been duped into giving out confidential data.

When are we going to put enough bite into the penalties so that these companies will take protecting this data seriously. How do they dare sit on this for 18 months to two years before notifying victims?  This is the kind of stuff that makes politicians want to do something, its about time they did!

 

 

Related articles by Zemanta

• Breach Notification Laws (schneier.com)