Research

The Economist used a tool on their site to block collect stats and serve ads to visitors using ad blockers. I will avoid diving into the ad-blocking debate, but I will note that my quick check showed 16 ad trackers and beacons on the page. I don’t mind ads, but I do mind tracking. It turns out that tool, called PageFair, was compromised by attackers to serve malware to Economist readers. The Economist is one of the few publications I still respect, so this made me more than a little sad. This one is a good learning case. Ryan Naraine and I discussed it on Twitter. Both of us were critical of The Economist’s hack response, Ryan a bit more than me. I see the seeds of good intent here, but flawed execution. Let’s use this as a learning opportunity. Good: They detected the situation (or, more likely, someone else did and told them) and responded within 6 days. Good: They put up a dedicated page with information on the attack and what people should do. Good: They didn’t say “we care very deeply about the security and privacy of our customers”. I hate that crap. Good: The response page pops up when you visit the home page. Bad: The response page only pops up when you visit the home page from certain browsers (probably the ones they think are affected), and could be stopped if you use certain blockers. That’s a real problem if people use multiple systems, or if the attackers decide to block the popup. Bad: They don’t specify the malware to look for. They mention it was packaged as a fake Adobe update, but that’s it. No specificity, so you cannot know if you cleaned up the right badness. Bad: They recommend you change passwords before you clean the malware. VERY BAD. Thanks to @hacks4pancakes and @malwrhunterteam for finding that and letting me know. Bad: They recommend Antivirus, without confirm recommended tools would really find and remove this particular malware. That should be explicitly called out. It looks like an even split, but I’d give this response a C-. Right intention, poor execution. They should have used an in-page banner (not a popup) and a popup to grab attention. They should have identified the malware and advised people to clean it up before changing banking passwords. There is one issue of contention between myself and Ryan. Ryan said, “No one should ever rely on free anti-malware for any kind of protection”. I often recommend free AV, especially to consumers (usually Microsoft). It’s been many years since I used AV myself. Yes, Ryan works for an AV vendor, but he’s also someone I trust, who actually cares about doing the right thing and providing good advice. I don’t want to turn this into an AV debate, and Ryan and I both seem to agree that the real questions are: Would the AV they recommend have stopped this particular attack? Would the AV they recommend clean an infection? But they don’t provide enough detail, so we cannot know. Even just a line like, “we have tested these products against the malware and confirm it will completely remove the infection” would be enough. I’m not a fan of blaming the victim, but this is the risk you always face when embedding someone else’s code in your page. Hell, I talked about that when I was at Gartner over 10 years ago. You have a responsibility to your customers. The Economist seems to have tried to make the right moves, but made some pretty critical mistakes. Let’s not lambaste them, but we should certainly use this as a learning opportunity. Share:

Today I was sitting in my office, window open, enjoying the cold front that finally shoved the summer heat out of Phoenix. I had an ice pack on my leg because my achilles tendon has been a little twitchy as I go into the last 8 weeks of marathon training. My wife was going through the mail, walked in, and dropped a nice little form letter from the United States Office or Personnel Management onto my desk. It’s no secret I’m still an active disaster responder on a federal team. And, as previously mentioned, my data was lost in the OPM hack. However, my previous notification was for the part where they hacked the employment information database. This notification is for the loss of all security investigation records. Which is cool, because I don’t even have a security clearance. What was on there? Aside from my SSN, every address I’ve lived at (once going back to childhood, but I think the most recent form was only 7 years), most of my jobs, all my relatives, and (I think) my wife’s SSN. I’m not sure about that because I can’t remember exactly what year I most recently filled out that form, but I’m pretty sure it was after we were married. Here’s the fun part. The OPM just offered me 3 years of identity theft protection. Three. Years. Which I can only assume means my SSN will expire in that time and I’ll be safe afterwards. And it must mean China wasn’t responsible, because they would go after me as espionage, not identity theft. Right? RIGHT?!? It’s just another example of the old distract and deceive strategy to placate. No one involved in intelligence or security thinks for half a second that ID theft protection for three years is meaningful when an SSN is lost – never mind when it (and all my personal info) is lost to a foreign intelligence adversary. But it sounds good in the press and distracts the many millions of federal workers who don’t work in security and understand the implications. People who trust the government, their employer. This isn’t limited to the OPM hack – it’s really a shitty playbook for the security industry overall. Been hacked? Call it “advanced and persistent” and then announce you hired a top-tier incident response firm. It doesn’t matter that you used default admin passwords, it’s all about looking like you take security seriously, when you don’t. Well, didn’t. Really. Look at all the breach announcements from the past couple of years. Cut and paste. And then there are our security tools. Various point technologies, each designed to stop one particular type of attack during a particular time window. Some of them really work. But we don’t acknowledge that security is really about stopping adversaries (Gunnar Peterson constantly hammers on this), and then the window for that particular tech closes. This throws the vendors into a spin cycle because, let’s be honest, their entire livelihood is on the line. Distract. Deceive. Lather. Rinse. Repeat. Admitting failure is hard. Addressing root causes is hard. Realizing something you built is no longer as valuable as it once was is even harder. Hell, we here at Securosis once spent two years and a couple hundred thousand dollars building something that we had to walk away from because the market shifted. That was cash out of my personal pocket – I get it. This isn’t a security industry problem, it’s basic human behavior. I don’t have an issue with someone covering their ass, but when you deceive and distract to protect yourself, and put others at greater risk? Not cool. On to the Summary: Webcasts, Podcasts, Outside Writing, and Conferences Rich wrote an article at TidBITS on the million dollar iOS exploit. Rich quoted at Wired on using AI to stop malware. Favorite Securosis Posts Rich: Incite 11/4/2015 – The Taper. I’m training for my first marathon right now. Well, second time training, because I got stomach flu the week of my planned first and had to miss it. My entire life right now is focused on starting my taper on December 6th. Other Securosis Posts CSA Guidance V4 content on GitHub. DevOps’ed To Death. Why I design for one cloud at a time. Million Dollar iOS Exploit? Maybe. Get Your Marshmallows. Summary: Edumacation. Favorite Outside Posts Rich: Fast, flexible and free, Linux is taking over the online world. But there is growing unease about security weaknesses. A big WaPo piece on the security state of Linux? I sh*t you not. This is an important article that highlights some of the fundamental tensions at the heart of information security. Adrian: How Carders Use eBay as Virtual ATM. A very clever way to launder money through PayPal. This shouldn’t work – the various merchants should match the Zip code of the recipient to the Zip code associated with the credit card. Gas stations and automated kiosks ask for Zip codes for this reason. But I guess some merchants aren’t checking. Research Reports and Presentations Pragmatic Security for Cloud and Hybrid Networks. EMV Migration and the Changing Payments Landscape. Network-based Threat Detection. Applied Threat Intelligence. Endpoint Defense: Essential Practices. Cracking the Confusion: Encryption and Tokenization for Data Centers, Servers, and Applications. Security and Privacy on the Encrypted Network. Monitoring the Hybrid Cloud: Evolving to the CloudSOC. Security Best Practices for Amazon Web Services. Securing Enterprise Applications. Top News and Posts If the UK government collects browsing data, one day it will be public. How long until you need to register to use the Internet like they do in cybercafes in China? What an astoundingly bad idea. Pentagon Farmed Out Its Coding to Russia. That’s cool. Maybe they outsourced by identity protection to Russia because China supposedly hacked it, and we can let those two fight it out. Chinese Mobile Ad Library Backdoored to Spy on iOS Devices. Xen Patches ‘Worst’-Ever Virtual Machine Escape Vulnerability. I wonder which cloud providers this affects? Mozilla Embraces Private Browsing with Tracking Protection in Firefox 42. Safari? Chrome? Not-IE-but-can’t-remember-the-name? Blog Comment of the Week This week’s best comment