Research

Twitter is worried about all the media company accounts being hacked, and has released some guidance. These aren’t exploits of Twitter itself, but of media companies, typically through phishing. Twitter suggests that companies employ a pretty standard set of password security practices in response: changing current passwords, using new ones that are at least 20 characters long and are made up of either randomly-generated characters or random words, and to never email said passwords, even internally … Given that email accounts are used to reset passwords, Twitter also suggests users change those passwords and implement two-factor authentication on their email accounts if available Here is what I suggest on top of Twitter’s suggestions: Use a dedicated email account for your Twitter account, and don’t make it public. Disable all Twitter email updates to that account, and rely on in-app notifications. Use strong authentication for that email account, and limit access. If you need to authorize a new app or employee for Twitter, change the Twitter account password to a new random password after every time you use it to authorize an app. Check your app authorizations daily. You are a media company, and this is one of your biggest channels. I don’t make this recommendation for everyone, but if you are the AP you need to take super extra precautions. Have an incident response process for suspicious tweets or account access, and make sure you pre-contact Twitter with the right contact info for those authorized to check on the account. Again, if you are a big media company, use a designated device for tweeting that isn’t used for other things. Notice I said “device”. An iPad is great because you don’t need to worry about background malware. I’m sure people have other good ideas to add in the comments… Share:

Courtesy of Forbes: Freeman, who goes by the hacker handle “Saurik” and created the widely-used app store for jailbroken iOS devices known as Cydia, told me in a phone interview that he discovered yesterday that Glass runs Android 4.0.4, and immediately began testing previously-known exploits that worked on that version of Google’s mobile operating system. Within hours, he found that he could use an exploit released by a hacker who goes by the name B1nary last year to gain full control of Glass’s operating system. As David Mortman said in our internal chat room: Love that it’s a slightly modified year old exploit. Google couldn’t even bother to release an up to date version of android with the device. Here is why it matters – Glass will be open to most, if not all Android exploits unless Google takes extra precautions. Glass is always on, with a persistent video camera that isn’t blacked out when you drop it in your pocket. This offers malware opportunities beyond even the risks of a phone. Since every jailbreak is a security exploit, this is a problem. Share:

This is too good not to share, albeit only tangentially related to our usual SMB and enterprise focus: A software development company posted a cracked version of their new game to pirate sites, but with a twist: However, in the pirated version, the in-game developers begin to run into crippling piracy that eventually drives them into bankruptcy. In-game CEO’s receive this message: “Boss, it seems that while many players play our new game, they steal it by downloading a cracked version rather than buying it legally.” If players don’t buy the games they like, we will sooner or later go bankrupt. Players who downloaded the game illegally then began posting questions in the game’s support forums asking how to better fight the pirates. After the first weekend, the company had 3100 gamers playing the cracked version, with 214 playing the genuine edition. Pay for your f-ing software, people, that’s all I have to say. Heck, I have even started paying for things I can get free review licenses for, when they are something I use on a regular basis and want to support. Share:

Folks struggling to get funding to implement security programs are a hot button of mine. I know it’s hard. I know we are expected to protect stuff with tighter budgets and fewer resources. A cornerstone of our research is effective prioritization so you can focus on the things most important to your organization. I get all that. But most folks aren’t a lot more sophisticated than passing around a tin cup during the budgeting process and hoping they get sufficient funding. If you want any chance of success in security, you need to be able to get funding for your key projects. And passing a virtual tin cup doesn’t cut it. I recently saw an article on NetworkWorld that hits on these topics, 10 tips to secure funding for a security program, and figured it was another one of these lightweight slide shows meant to drive a bunch of page views. But when I started reading and almost immediately saw a discussion of ROI for getting security funding I was a bit chagrined. If you talk ROI you have very little chance of success. Although the author (Dominic Nessi) makes a good point: However, cyber security budget requests are more difficult to quantify. Security ROI is typically expressed by comparing security investments with the potential liability caused by security breaches. This is similar to calculating the financial benefit of insurance for physical assets, such as buildings and equipment. Insurance. Awesome. But it is what it is. It’s about risk – either minimizing or transferring your risk. Don’t even waste time thinking about eliminating risk. Dominic talks about putting a program framework in place and relating the goals of the security framework to the goals of the business. Yup. So read these 10 tips, and understand they aren’t really 10 tips – these are all basic things that go along with having a strong security program. But I’m not sure why getting a CISSP is important for getting funding. If you are looking at a certification to prove competence to your senior management you’re doing it wrong. But railing on certifications is another topic for another day. Photo credit: “Beggar girl” originally uploaded by Taifighta Share:

It probably went unnoticed by most of the security community, but yet another Twitter hack this week exposed more flaws with high frequency trading systems. When someone took control of the Associated Press twitter account and injected a fake news announcement that bombs had exploded in the White House, many people (unsurprisingly) believed the tweet without attempting to verify. That a 140-character message sent the stock market down in a “flash crash” – 140 points in a matter of minutes. From CNN Money: One scary – and false – tweet, and the Dow quickly plunged 140 points, or roughly 1%. Many are pointing fingers at high speed trading by computers for the swift decline. The Dow quickly bounced back. The sharp sell-off highlights just how disruptive computer-driven high-frequency trading can be. The S&P 500 lost $121 billion of its value within minutes. High-speed computer trading accounts for roughly 50% of all trading. That’s down slightly from a few years ago, but traders on the ground say it feels more dominant. And mini flash crashes have become an all too familiar daily occurrence. Those of you who set limit orders on stocks at below-market prices, have been the unintended beneficiaries of some briefly well-priced stocks. A simple compromise of an outdated identity management system was leveraged for social engineering, which in turn triggered a domino effect across automated trading systems, which moved the whole stock market twice – the drop and the rebound. The perpetrators have not been identified so it is not clear whether it was just for the lulz but they certainly had an impact. The BATS exchange spokesperson who called this a non-issue is way off the mark – it is clear that both Twitter’s identity management and trading bot logic need serious reworking. Share:

On March 13th I received a birthday card. It was from my Dad. It was a nice card, it was clear he had put some thought into the card selection, and I was genuinely swayed by his thoughtful memento. On the Ides of March I received a birthday card from my grandmother. Another nice card and it was thoughtful that she remembered my birthday. Two weeks later a birthday gift arrived from my mother. Not for me, mind you, but for my wife. It was a beautiful gift, obviously expensive, and again a superbly wonderful gesture. We don’t get to keep in close contact, so I was both surprised and appreciative. April 1st a gift card arrived, this time for me, again from my mom. There is not much to this story unless you know a couple additional facts. First, all three of the aforementioned blood relatives live under the same roof. Second, my birthday is in April; this week, in fact. My wife’s is another month away. And they have not sent my wife a birthday gift in, well, at least 20 years. As it is with human nature, gifts and cards arriving on seemingly random dates makes you wonder what’s up. You question motivation. Are they OK? And for the first time I started to worry about my parents’ health and well-being. Were they forgetting the date? Did they know what date it was? Jokingly my wife has said ‘Happy Birthday’ to me each day since March 13th. To make a long story short, a phone call cleared up the situation and all is well. I think that my parents just happened to find gifts they liked and sent them, dates be damned. Which is what you do when you think the person will really like the gift and you can’t wait to give it to them. Given my profession – it’s certainly not a job – where segregation between work and … well, that’s the point. My life and my work are not separate. The two are fully merged. There is no such thing as a work day, and there is no such thing as a day off. I work weekends, I don’t really do vacations, but on the plus side I do try to make the best of every day. When I want to do something I do it, and adjust work/life accordingly. All of which makes me realize that the gifts and cards from my relatives were nice, but I was ambivalent. But the idea that a specific date did not matter struck me as profound. Why limit your ability to celebrate? In that spirit I decided, what the heck, my birthday would not be a single day. I decided I would declare the entire week birthday week, and decide to do one fun birthday related event every day. Birthday cake each and every day. Over-the-top dinner each night. One outing every day. One thing I have wanted to accomplish every day this week. And because work/life does not go away, each day I have averaged 4-5 hours of work, as evidenced by my writing this post, and why a couple of you got wine-infused replies to various email and phone calls last night (you know who you are). The experiment is thus far a success, and each day offered extra time away from the computer to have some fun. This is working so well that I will do it every year going forward. Happy Birthweek! On to the Summary: Webcasts, Podcasts, Outside Writing, and Conferences Adrian’s Dark Reading post on Database Blocking. Favorite Securosis Posts Adrian Lane: How to Use the 2013 Verizon Data Breach Investigations Report. Rich has put a lot of thought into his analysis and offers a unique perspective. David Mortman: Big Data Security Jazz. Mike Rothman: CipherCloud Loses Argument with Internet. Rich: Teaching Updated Cloud Security Class at Black Hat USA. Jamie and I are working on added material to make the class truly worthy of Black Hat. Other Securosis Posts Incite 4/24/2013: F Perfect. Question everything, including the data. The CISO’s Guide to Advanced Attackers: Verify the Alert. Security Analytics with Big Data [New Series]. The CISO’s Guide to Advanced Attackers: Mining for Indicators. Token Vaults and Token Storage Tradeoffs. No news is just plain good: Friday Summary, April 18, 2013. Favorite Outside Posts David Mortman: Cryptography is a systems problem (or) ‘Should we deploy TLS’. Adrian Lane: Why You Should Overload WebSite Errors. Are you paying attention, developers? This is not security through obscurity – it’s about not handing data to adversaries so they can hack your site. James Arlen: How I Got Here: Chris Hoff. Mike Rothman: Sriacha hot sauce purveyor turns up the heat. Rich: Just How Did Apple “Journalism” Get This Bad? While Ian writes this specifically about Apple, it also applies to a lot of security writing. Project Quant Posts Email-based Threat Intelligence: To Catch a Phish. Network-based Threat Intelligence: Searching for the Smoking Gun. Understanding and Selecting a Key Management Solution. Building an Early Warning System. Implementing and Managing Patch and Configuration Management. Defending Against Denial of Service (DoS) Attacks. Securing Big Data: Security Recommendations for Hadoop and NoSQL Environments. Tokenization vs. Encryption: Options for Compliance. Top News and Posts PC owners have to watch 24 sources for fixes CISPA cybersecurity bill Privacy advocates warn about coming tsunami of surveillance cameras London already knows the result – cameras don’t deliver. Silicon Valley companies quietly try to kill Internet privacy bill Twitter has 2-factor authentication. Brad Arkin promoted to CSO of Adobe. Brad is as good as they get, this is great news for all of us. Blog Comment of the Week This week’s best comment goes to @VZDBIR, in response to How to Use the 2013 Verizon Data Breach Investigations Report. I am breaking with tradition this week to favorite a tweet: @VZDBIR: Sometimes it’s scary how @securosis gets all up in my brain. Those guys are smart. #Dbir https://t.co/kV995yrxUX I would bet that Twitter account, like the Associate Press, was hacked. Share:

Perfect is my least favorite word in the English language. Nothing is perfect. There are always things that can be improved upon, no matter how good they are. And striving for perfection is an express train to disappointment and unhappiness. I’m a card-carrying disciple of “good enough”. It doesn’t need to be perfect to add value. So I don’t obsess about typos, misplaced pixels, or any other such nonsense. Which can irritate certain business partners [and editors] at times. But I’m not going to change it. If I do work (or anything else), I get it to a point where I’m happy with it and move on. That doesn’t mean I strive to be mediocre. Or that I accept subpar effort from myself or anyone else. I do my best. I focus on consistent effort, not super-human perfection. Some folks believe you need to push beyond your self-imposed mental limits to achieve truly great things. I get that. I have tried that. It made me unhappy because I found I had a high bar for what I expected to achieve. I have the hyper self-motivation gene. I didn’t need an external party to push me. What I needed was to get comfortable with good enough. In hindsight, it’s sad that I felt failure even in the face of significant accomplishment. That’s no way to go through life. At least not for me – you can do what you want. This is a hard lesson to teach your kids, especially when the bar is set by someone else. The Boss and I expect our kids to work hard and achieve to their level of ability. XX2 has a large personality. She is passionate and talented and has tremendous potential. We see that potential and so do her teachers. Unfortunately her teacher this year is a perfectionist who thinks all the kids should be perfect. A few months ago her teacher had beaten her down and we saw it. She stopped trying because she knew she couldn’t achieve the perfection her teacher expected. Her behavior and grades went down a little because she didn’t care anymore. It was time to intervene. So the Boss sat down with the teacher and they worked out a set of criteria that represents a good day for XX2. We thought some of the criteria were stupid but they were based on stuff that irritates the teacher. She gets check marks every day based on the criteria and we sign off daily. She gets a prize from the teacher at the end of the week if she got all positive check marks. Right, she needs to be perfect to get her prize from the teacher. Back to Square 1. Clearly we weren’t going to move the teacher off her perfection fixation. So we went around the teacher. We made it clear to XX2 that we don’t expect perfection. F Perfect. F that teacher too. We put an alternative incentive plan in place. If XX2 gets 5 of 6 checks every day for the week, she gets something from us. And her success criteria is now how she did in our eyes, not the teacher’s. Win! Of course we also talk about what she did that day and what she can do better the next day. We push her to be her best. But not to be perfect. To be human – perfectly imperfect – and we want her to be comfortable with that. –Mike Photo credits: 19. originally uploaded by silangel Heavy Research We are back at work on a variety of blog series, so here is a list of the research currently underway. Remember you can get our Heavy Feed via RSS, where you can get all our content in its unabridged glory. And you can get all our research papers too. Security Analytics with Big Data Introduction The CISO’s Guide to Advanced Attackers Verify the Alert Mining for Indicators Intelligence, the Crystal Ball of Security Sizing up the Adversary Newly Published Papers Email-based Threat Intelligence: To Catch a Phish Network-based Threat Intelligence: Searching for the Smoking Gun Understanding and Selecting a Key Management Solution Building an Early Warning System Implementing and Managing Patch and Configuration Management Incite 4 U You! Yes, you! You’re a target: Most folks who are compromised spend their days blissfully unaware. They figure who would be interested what they have? As this post on DealBook shows, every company with any kind of intellectual property is a target for these cyber attacks. DRINK! Yeah, the article gets a 15-yard penalty for excessive use of ‘cyber’. But their point is reasonable: start-up tech companies, who may think they know everything, have no specific mandate or requirement to do security. The authors put the impetus on investors to make sure the management team is challenged to ensure proper intellectual property protections are in place. But good luck with that. That’s like the blind asking the blind whether the moon is out. – MR Break the abuse cycle: It is well known that human behavior favors certainty over novelty. It varies based on our genes, but in general we like things to stay the same – it’s an inertia thing. That makes sense, considering that for many years changes signified impending death, so you might as well sprinkle a few red shirts with the explorer gene, but keep the rest of us safe at home (and no, I promise I didn’t learn all this watching The Croods with my kids). So it comes as no surprise that, almost 13 years on, Windows XP is still used in many organizations. To be honest, I think Gartner’s 10% estimate is low, especially if you count the entire retail and hospitality industry that runs their point of sale systems on XP. Really. Not only is it time to get off XP, because security support ends next year, but it is time to break the abuse cycle. We can’t afford to lock ourselves into 10+-year-old operating systems in today’s threat environment. We need to architect systems and operational processes (such as user training) to allow more frequent upgrades.

The good news about being in security is that you don’t have to look too far for criticism of your work. Most of the time it’s constructive criticism, so overall interaction with the security community makes your work markedly better. Which is why we live by the Totally Transparent Research process. It makes our work better. But when our pals at Verizon clogged up my Twitter timeline this morning with their annual DBIR masterpiece (you can also check out our guidance on the DBIR), they dragged my attention back to a post by Jericho from Attrition: “Threat Intelligence”, not always that intelligent, prompted by Symantec’s most recent security trends report. Jericho summed up the value of security trend reports as only he can, and explained why folks tend not to challenge them often. The reason? Security companies, professionals, and journalists are complacent. They are happy to get the numbers that help them. For some, it sells copy. For others, it gets security budget. Since it helps them, their motivation to question or challenge the data goes away. They never realize that their “threat intelligence” source is stale and serving up bad data. It’s not in the machine’s best interest to question the data. That’s why most folks (besides, me I guess) don’t poke at the vendor-sponsored survey data or other similar nonsense put forth as gospel in the security business. Anything that helps sell security is good, right? Well, no. Decisions based on faulty data tend to be faulty decisions. So Jericho presents a number of inconsistencies between Symantec’s vulnerability data and the OSVDB dataset he contributes to. It’s pretty compelling stuff. But we shouldn’t minimize either the effort involved in building these reports or the value they do provide. There is a lot of value in these threat and data breach reports, if the data is reasonably accurate. We’re security people. We question everything, so it’s reasonable to question the data you use to make the case for your existence. Photo credit: “Question” originally uploaded by ACU Library Share:

This summer James Arlen and I are teaching the recently updated cloud security class we developed for the Cloud Security Alliance (CCSK Plus). We are pretty excited to teach this at Black Hat, and will be bringing a few extra tricks to handle the more advanced audience we expect. The class runs two days and covers a huge amount of material. The first day is mostly lecture, covering: Introduction to cloud computing and cloud architectures. Securing cloud infrastructure (public and private). Governing and managing risk in cloud computing (yep, we have to cover compliance, but we also include incident response). Securing cloud data. Application security and identity management for cloud. Selecting and managing cloud providers. This gives you everything you need to take the CCSK test if you want. The second day is where the real fun starts – we spend pretty much the entire time in labs. Including: Assessing cloud risk. This is a tabletop risk management exercise focused on practical scenarios. Launching and securing public cloud instances. You’ll learn the ins and outs of Amazon EC2 as you launch and secure your first instance. This includes a deep dive into security groups, picking AMIs, and using initialization scripts to auto-update and configure instances. Encrypting cloud data. We encrypt a storage volume using dm-crypt and dig into different key management scenarios and encryption options. We may have some new demos here of products just hitting the market. Building secure cloud applications. We expand on what we have created to build a multi-tier secure application, focusing on proper use of hypersegregation by splitting application components. Federated identity and using IAM to harden the management plane. We add a little OpenID to our application. Up to this point everything builds out into a complete stack and all the exercises tie together. We also work with AWS IAM and how to use different kinds of credentials and templates to segregate things at the management plane. Securing a private cloud. Using your laptops and our virtual machines we build a running OpenStack cloud in the classroom and run through the security essentials. But here is the trick for Black Hat. Aside from teaching a very recently updated version of the class, we are preparing for a more technical audience. We will be bringing more advanced exercise options (on top of the basics so people with less experience can still get something out of the class), and even a demo attack tool PoC. We will feel the audience out but we already have some advanced (self-guided) exercises together. If you’re interested you can sign up now. Also, although this isn’t an instructor class, anyone who takes this (and contacts us ahead of time) will be eligible to complete additional, web-based instructor training free of charge after Black Hat. We aren’t a training organization, and we care more about getting more teachers out there than keeping it all to ourselves. Hope to see you in Vegas! Share:

There are two ways to respond to criticism of your security product, especially when encryption is involved. Respond cautiously, openly, and positively as demonstrated last week by AgileBits, the folks behind 1Password. Do what CipherCloud did. The TL;DR is that some people over on StackExchange were trying to figure out how CipherCloud works (specifically its homomorphic encryption, which CipherCloud states isn’t actually part of the product). Some public materials were posted, and then the CipherCloud legal team smacked StackExchange with a DMCA takedown notice over screenshots of the product as people tried to figure out how it works. They also issued a takedown request based on “false and misleading statements”, which does little more than fully engage the Streisand effect. CipherCloud has since issued a kinda-sorta apology and an update that, judging from the few comments doesn’t satisfy anyone. They apologize for the takedown requests and blame their legal department, but barely address the actual issue. First of all from what I have seen they have a good product which does what they claim it does. I have been briefed and know some large organizations evaluating or using it. The problem here isn’t the product – it’s their approach. When someone posts potentially unfavorable information about you on the Internet, trying to squash it always backfires. Also, if the posts are mostly trying to cut through your marketing material to see how the product works, that means people are interested in your product and you should treat them with respect. CipherCloud’s response to the DMCA takedown criticism is to state that the conclusions coming out of StackExchange were wrong and based on an older video demo. That’s totally fine, but they fail to actually fill the information gap with accurate information. There is a little about what they don’t do, the usual platitudes about FIPS-140, and that’s about it. They say they will provide this information to customers, prospects, and partners, but want to keep their IP otherwise out of the public eye: I understand and appreciate the interest in the market to better understand our technology, and I am happy to discuss additional details around our encryption implementation with our customers, prospects and partners. If you are interested in learning more, please contact CipherCloud directly via our website at info@ciphercloud.com This isn’t how to respond. I know their competitors, and trust me, they all have a good idea of how CipherCloud works. The ones who care set up straw buyers/prospects to get their hands on demos, however unethical that is. I don’t think they need to reveal everything, but this was a great opportunity to get some additional attention, explain why they feel they are better than the competition, and generate some goodwill among those interested in the product. Instead they look like they are hiding something. 1Password nailed it with their reasoned response to a security concern, and the industry is well trained to be skeptical of security vendors – especially in encryption – who aren’t transparent about their technology. Also, when you make a mistake like letting loose the legal dogs, you need to sound truly apologetic, not defensive. Anyway, big companies can get away from this, but now CipherCloud has to deal with negative coverage as the second result on their Google search. I am not a marketing exec, but that coverage is not good, and they will have to live with it for a while. Share: