Breach Notification , Data Breach , Data Loss

No Injury: Michaels POS Malware Lawsuit Dismissed Victim Warns of Future Injury, But Judge Sees Otherwise Mathew J. Schwartz (euroinfosec) • January 7, 2016    

A judge has dismissed a class-action lawsuit against U.S.-based arts and crafts retailer Michaels, filed after the retailer warned customers in early 2014 that malware-wielding attackers had successfully stolen an estimated 2.6 million payment card numbers over an eight-month period beginning in May 2013. The lawsuit sought damages in part based on the allegation that the retailer's customers were at increased risk of suffering fraud for an unforeseeable period into the future.

Michaels is just one of a number of organizations in recent years to have suffered a data breach after falling victim to a point-of-sale malware attack. Target and Staples are two other high-profile victims from the retail sector, although a number of other POS-using organizations - including businesses in the restaurant and hotel industries - have also fallen victim to such breaches.

Many of those breaches have triggered class-action lawsuits by consumers whose payment card data was compromised, oftentimes alleging negligence on the part of the breached organization, or else the potential for their suffering financial harm. And many times, it's tough not to argue that breached organizations failed to have robust enough security programs (see Why POS Malware Still Works).

But the vast majority of these data-breach lawsuits get dismissed. That's because judges often find that plaintiffs' attorneys have failed to prove that consumers suffered an actual or threatened injury, under what's known as Article III standing (see Why So Many Data Breach Lawsuits Fail). And at least to date, legal experts say, such "injury" has been defined exclusively in financial terms. In other words, if there were no out-of-pocket losses for consumers whose information was breached, then such cases typically get dismissed.

Establishing standing also became more difficult in 2013, after the U.S. Supreme Court ruled in the case of Clapper v Amnesty Int'l that standing could not be based on the potential for a future injury, according to data breach and privacy attorney Linda Kornfeld, who's the managing partner of the Los Angeles office of law firm Kasowitz, Benson, Torres & Friedman.

Thus it's no surprise that, in the Michaels case, U.S. District Court Judge Joanna Seybert ordered on Dec. 28, 2015, that the lawsuit be dismissed, after finding that plaintiff Mary Jane Whalen, and by extension any other victim of the breach, couldn't prove that they'd suffered any harm.

Alleged Fraud in Ecuador

Whalen's suit had sought class-action status on behalf of herself and other breach victims. She told the court that after she used her American Express card at Michaels in December 2013, it was then used by someone physically located in Ecuador to try and buy a gym membership, and again to try and purchase concert tickets.

Crucially, however, "Whalen does not allege that the attempted charges were approved or that she suffered any financial loss," Seybert wrote. "Rather, she cancelled her credit card and has not experienced any other attempted fraudulent charges," and would not have had to pay any such charges either, given American Express's policy that cardholders "are not liable for fraudulent purchases."

Similarly, she dismissed Whalen's assertion that the lost time and money she incurred by having to purchase identity theft protection services gave her the right to sue Michaels. Referencing Clapper, Seybert said that "highly speculative" injuries do not give plaintiffs Article III standing, and noted that just because a consumer purchased identity theft monitoring did not then give them the right to sue an organization. In the Supreme Court's language: "If the law were otherwise, an enterprising plaintiff would be able to secure a lower standard for Article III standing simply by making an expenditure based on a non-paranoid fear."

What About Future Harm?

But what about Whalen's assertion in court documents that she might suffer future harm from the breach, since "fraudulent use of cards might not be apparent for years"? This is relevant because security experts are warning that so-called "sleeper fraud" - criminals using a consumer's PII to open a new account, and then defaulting on the payment or loan at some future date - is continuing to grow (see What is "Sleeper Fraud," And Why Must Banks Beware?).

A related risk: security experts have been warning that cybercriminals can now monetize almost any form of PII, since it helps attackers to better refine and customize their social engineering and fraud-related schemes for individual victims (see TalkTalk Lesson: Prepare for Breaches). For example, the ringleader of a penny-stock-scheme allegedly paid freelance hackers to steal customer details from 12 organizations - including financial services heavyweights JPMorgan Chase, Fidelity Investments and E*Trade Financial - then used that PII to target the high-net-worth individuals with offers that seemed too good to refuse (see Charges Announced in JPMorgan Chase Hack).

Case Closed?

In the Michaels case, however, no details of stolen PII have ever come to light. Indeed, the judge notes that according to Michaels, beyond the stolen card data, "there was no evidence that the hackers retrieved any other customer information, such as names, addresses, or PIN numbers."

Accordingly, "Whalen has failed to allege an injury that is 'certainly impending' or based on a 'substantial risk that the harm will occur,'" Seybert writes, again citing the Clapper case. She also undercuts Whalen's claim that fraud might not be apparent for years, noting that it's been two years since the breach occurred, and Whalen has seen no more signs of fraud.

Thus Seybert dismissed the suit, albeit without prejudice. That means Whalen is free to file another lawsuit in the future, based on the same claim.

But as far as I'm concerned, this case looks closed. Nearly two years down the line, we haven't seen any new breach-related facts come to light - most notably, signs that more types of data went missing than Michaels has claimed. While I do think that consumers should be able to file breach-related lawsuits against organizations that failed to properly protect their PII, in this case, thankfully it's hard to see that consumers suffered any real harm.

Breach Preparedness , Data Breach

How to Block Ukraine-Style Hacker Attacks Lessons Learned, Based on What's Known About Malware Involved Mathew J. Schwartz (euroinfosec) • January 8, 2016    

Evidence that the December 2015 disruption of multiple Ukrainian electrical substations was conducted by a group allied to Russian government interests continues to mount (see Ukrainian Power Grid: Hacked).

But regardless of who hacked one or more Ukrainian energy suppliers, security experts note that the spear-phishing emails and related malware infections apparently used by attackers would most likely have been blocked if the targets had some basic information security defenses in place.

Don't, however, start playing the blame game. "I'm not going to speculate on how good or bad the defenses were of the Ukrainian energy company," Paul Ducklin, a security analyst for information security firm Sophos, tells me. "In some ways they're only in the limelight because they did get penetrated by malware, and anyone to whom that happens could clearly have done something better."

Instead, Ducklin recommends all organizations study the Ukrainian hacks to determine whether they might fall victim to a copycat attack. "To me the takeaway is not to ask, 'Why don't energy companies do a better security job?'" he says. "The takeaway is, 'Could that happen to me, and if so, what am I going to do about it?'"

Sandworm Team: Suspected Connection

Of course, the Ukrainian hack attack is especially concerning because it appears to be the first time that hackers have disrupted an electrical power substation (see Ukrainian Power Grid Hack: 9 Questions).

But security experts are still waiting for a full report from Ukraine's Computer Emergency Response Team, CERT-UA, which has confirmed to me that it's continuing to investigate the attack. It also confirms a report from security vendor ESET that both BlackEnergy Trojan as well as KillDisk wiper malware were found on systems at the hacked energy supplier, Prykarpattya Regional Energy, that suffered the outage. CERT-UA warned in November 2015 that it had discovered KillDisk after a targeted attack against Ukrainian media organizations.

Now, threat-intelligence firm iSight Partners reports that it believes that the Sandworm advanced persistent threat group, which has previously been tied to attacks that align with Russian government interests, was also responsible for the Ukrainian power supplier hack and disruption (see Espionage Hacks Tied to Russians).

In a Jan. 7 blog post, John Hultquist, director of cyber-espionage analysis for iSight Partners, says that the malware used in the attack - the BlackEnergy 3 variant - was first spotted in early 2015, apparently focusing on targets in both Ukraine and Europe.

Both BlackEnergy 3 and KillDisk were also found on at least one of the hacked power company's systems, Hultquist adds, but he cautions that "we cannot confirm that the KillDisk malware caused the outage." Echoing other researchers, however, he observes that the wiper malware was likely intended to at least prolong the outage, adding that the Ukrainian security service, SBU, has claimed that at the time of the power disruption, "technical support numbers associated with the power authorities were allegedly flooded with calls, which may have been an effort to further overwhelm responders."

Wiper Malware: Nasty

But many experts caution that while attribution is useful for authorities - or diplomats - it's up to enterprise information security professionals to defend their organization against these types of attacks, no matter if cybercriminals, hacktivists or an APT team is at work.

Belgian reverse-engineering expert Dider Stevens, in a video teardown of the Excel spreadsheet that's been linked to the Ukrainian attack - as well as the November attacks against media organizations - reports that it uses malicious macros.

Analysis of the malicious Excel file tied to recent Ukrainian spear-phishing attacks.

But neither Excel nor Word allow macros to execute by default, meaning that the Ukrainian spear-phishing email must have included a request that the recipient activate Office macros, Ducklin says, as has been seen in previous such attacks. If a user complies, the macros then install BlackEnergy, which "phones home" to a command-and-control server and can receive further instructions, exfiltrate data as well as download and install further malicious code. In the Ukrainian power supplier attacks, Ducklin says attackers appeared to install KillDisk on infected systems as well as a hacked copy of the DropBear SSH server, which included hard-coded passwords attackers could use to later remotely access the system.

The KillDisk malware is especially nasty, Ducklin reports, because it gives attackers the ability to wipe the Windows event log, delete all Windows shadow backup files and reinitialize network-connected logical volumes using the "format" command, which is designed to wipe all data on a hard disk, for example when reinstalling the operating system. Finally, the malware can overwrite every physical sector, "including boot sector, operating system files, swap files, applications and data, on up to 10 hard disks," he says.

"The last item really lives up to the name KillDisk," he adds. "But any of the others are likely to cause significant trouble for you and your IT department and would put a very serious dent in your day."

7 Lessons for All Infosec Pros

Anti-virus tools can help detect and eliminate malware such as KillDisk, but they're not foolproof, especially if attackers use malware packers to obfuscate the attack code and try to avoid signature-based scanning tools. Likewise, tricking victims into enabling macros gives attackers the ability to execute arbitrary code on a target's computer and take control.

So it's imperative to prevent spear-phishing emails from ever being viewed - and attachments potentially executed - by would-be victims. Ducklin offers the following advice:

Filter: Use email filtering to help find and eliminate suspicious attachments as soon as possible. Flag: Treat all unsolicited attachments with extreme caution. Ignore: Never enable Excel or Word macros, even if an email - that might pretend to be from someone you know - instructs you to do so. View: Microsoft offers free Word and Excel viewer programs for Windows and Mac OS X, which give users a way to see document content, but which do not support embedded macros, meaning they cannot execute. Upgrade: The most recent versions of Windows help better safeguard users against malicious disk-wiping attempts. Block: IT departments must block unknown software from being able to "phone home" to grab and install applications as well as communicate with botnet networks. Update: Ensure anti-virus software remains updated and active protection enabled - sometimes known as "on-access scanning" or "real-time scanning" - to better detect as well as block any malware from executing.

Those steps won't block or prevent every piece of malware from ever reaching an end user or executing on a targeted system. But they will help ensure that no "cheap and easy" attacks - such as spear-phishing emails that instruct recipients to enable Office macros - succeed.

DDoS , DDoS Attacks

DDoS for Bitcoin Extortion Gang Targeted in 'Operation Pleiades' Mathew J. Schwartz (euroinfosec) • January 12, 2016    

European police have arrested a "main target" as part of a previously undisclosed law enforcement effort, dubbed Operation Pleiades, against the distributed denial-of-service attack gang called DD4BC.

See Also: Stop Fraud, Not Customers: Focus On Good User Experience

The group - its name is short for "DDoS for bitcoin" - has gained notoriety by threatening to disrupt targeted organizations' websites, and carrying through on those threats unless they pay the group off in bitcoins.

Authorities say that while the group initially ran Bitcoin extortion campaigns that primarily targeted the online gambling sector, it's since broadened its activities to focus on numerous high-profile organizations, including businesses in the financial services and entertainment sectors. Individual ransom demands the group has made - at least ones which have come to light - typically demand 100 bitcoins ($45,000), security experts say.

But on Jan. 12, the association of European police agencies, known as Europol, announced that its European Cybercrime Center, EC3, helped coordinate an operation that resulted in the arrest of a main target and another suspect. As part of the operation, which occurred last month - from Dec. 15 to 16 - police also searched multiple properties and seized "an extensive amount of evidence," much of which is no doubt now being subjected to digital forensic analysis.

A Europol spokeswoman tells Information Security Group that both of the arrests were made in Bosnia and Herzegovina. The country - capital: Sarajevo - is located in southeastern Europe on the Balkan Peninsula. Europol says that Britain's Metropolitan Police Cyber Crime Unit helped identify "key members of the organized network" located in Bosnia and Herzegovina, and that law enforcement agents from the country, as well as Austria, Germany and the United Kingdom, ran the operation in coordination with Europol.

Police Appeal to Victims: Work With Us

Authorities say they've been tracking DD4BC since it launched in mid-2014. And Europol says that it believes the DDoS extortion attacks - carried out by the likes of DD4BC, the so-called Armada Collective and others - are on the rise, and driven in part by their ability to use pseudonymous payment mechanisms that make it difficult for investigators to "follow the money" as it flows from victims to crooks (see DDoS: 4 Attack Trends to Watch in 2016).

"This type of extortion attack has become a well-established criminal enterprise and has affected thousands of victims globally, with the number of unreported incidents believed to be much higher," Europol says. "The absence of reporting by private companies and individuals poses particular difficulties in law enforcement's efforts to prosecute these cyber threats."

Wil van Gemert, Europol's deputy director of operations, says the DD4BC crackdown happened in part thanks to targeted organizations working with police, including alerting authorities when they were the victims of an attempted shakedown (see Irish Cybercrime Conference Targets Top Threats). "Police actions such as Operation Pleiades highlight the importance of incident reporting and information sharing between law enforcement agencies and the targets of DDoS and extortion attacks," he says.

Europol notes that this operation was made possible too thanks to extensive cross-border collaboration and information sharing. Notably, the operation was led by police in Austria, backed by EC3 and the EU's Joint Cybercrime Action Taskforce - J-CAT - and also featured assistance from law enforcement agencies from Australia, France, Japan, Romania, Switzerland, as well as the U.S. Secret Service and FBI, and Interpol.

"This arrest and other actions demonstrates how powerful effective intelligence sharing can be," says Dublin-based information security consultant Brian Honan, who advises Europol on cybersecurity matters. "I know many victim companies who will smile as they read the news."

Regarding the @EC3Europol action against DD4BC, big kudos to all those victim organisations who worked with LEA to enable police take action

DDoS Rises Again

Alan Woodward, a computer science professor at the University of Surrey in England who also serves as a cybersecurity adviser to Europol, says he cannot comment on the DD4BC arrests. But speaking more generally, "DDoS is back on the agenda," he tells Information Security Media Group. "What astonishes me is that there are a growing number of services for DDoS. It must be one of the fastest growing areas of crime as a service."

Indeed, some recent DDoS attacks - such as the purported use of a service called BangStresser to disrupt the BBC's Web domain on New Year's Eve 2015 - seem to have been launched simply to advertise the underlying DDoS service. Furthermore, this cybercrime-as-a-service ecosystem often disguises related activities by infecting legitimate PCs with malware, to turn them into botnet nodes from which DDoS disruptions, spam campaigns and other attacks get launched (see How Do We Catch Cybercrime Kingpins?).

"Tracking these guys down is really difficult," Woodward says. "The problem is they effectively get others to do their dirty work for them. And being distributed, they co-opt many into such attacks, often without their knowledge."

Stopping DDoS Attacks

Woodward says one high-level way to try and undercut DDoS attacks is to "prevent, persuade or otherwise stop the bulletproof hosters who are often complicit in these attacks," referring to the services that provide hosting and a promise to look the other way, in exchange for their customers paying premium prices (see Hacker Havens: The Rise of Bulletproof Hosting Environments ). Owners of legitimate systems that have been compromised by attackers also "need to make sure they have mechanisms in place to stop such abuse," he says.

A second potential DDoS defense is to "try to prevent IP spoofing," which DDoS attackers often rely on, he says. "The main form of these massive attacks is amplification attacks, which all rely upon spoofing the address from where a request came from, such that the returns all fire at the same system." While there is an Internet Engineering Task Force standard - BCP38 - that would help, "like many things it hasn't really taken off," he says (see Spamhaus DDoS Attack Called Preventable).

Until the above comes to fruition, "as a business your only other hope is to try to get some form of protection from companies like CloudFlare," Woodward says, referring to the DDoS defense firm. He also recommends organizations craft a DDoS incident-response plan - and line up defenses - before they get targeted.

Victims: Keep Coming Forward

Honan also urges victims to keep coming forward, so that police can target DDoS-wielding criminals (see Hackers Wield Extortion). "Hopefully this action will demonstrate to organizations who may fall victim to cybercriminals - be that via ransomware, DDOS extortion, or other criminal actions - that reporting the issue to law enforcement can generate results," he says. "Even if your individual case does not get resolved, the information shared with law enforcement could be a vital piece in the larger jigsaw puzzle that Europol and other law enforcement agencies are putting together to picture the criminals behind these crimes."

Today's enterprise infrastructure is full of blind spots that can hide malicious threats, and traditional security tools struggle to scale up to meet increased demands. How must security leaders respond? Amrit Williams of CloudPassage shares insight.

In short, because today's infrastructure is virtualized, on-demand and must scale up automatically to meet peak needs - security tools must be prepared to do the same. Otherwise, threats will be missed and performance will be compromised, says Williams, CTO of CloudPassage.

As an example, Williams offers Netflix. "The compute resources required to deliver services to customers on Friday evening are very different from the compute resources needed on Monday at 3 a.m.," he says. And security resources need to be prepared to scale up with that demand - without compromising performance.

The problem is: Traditional security tools are not prepared to meet the demands of the modern infrastructure. And too many organizations are unaware of the security blind spots and performance issues these tools are creating.

In an interview about meeting the security needs of the new infrastructure, Williams discusses:

How traditional security tools hamper business agility; How to gain visibility across the new infrastructure; Technical and cultural hurdles to overcome as organizations transition away from old tools.

Williams has more than 20 years of experience in information technology and is currently the CTO of CloudPassage. Previously he was the Director of Emerging Security Technologies and CTO for mobile computing at IBM. Prior to IBM, he was a research director in the Information Security and Risk Research Practice at Gartner, Inc. where he covered vulnerability and threat management, network security, security information and event management, risk management, and secure application development. Previously, Williams was a director of engineering for nCircle Network Security, and undertook leadership positions at Consilient Inc., Network Associates, and McAfee Associates.

DDoS

Will Takedown Serve as a Deterrent for Copycats? Tracy Kitten (FraudBlogger) • January 12, 2016    

Will this week's arrests of a "main target" and another suspect tied to the distributed denial-of-service extortion group known as DD4BC, or DDoS for Bitcoin, deter copycats from continuing to wage similar schemes?

See Also: 2015 Fraud Mitigation & DDoS Response Study

Tom Kellermann, chief cybersecurity officer at the security firm Trend Micro, is among the experts who don't anticipate a deterrent effect. "Realistically, this a model that is going to be copied," he says. "There has been an explosion in the last six months of extortion and ransomware. And the more notoriety they get for the takedown, the more copycats there will be."

Copycats will thrive, Kellerman contends, because the more extortion attacks that are waged, the more money companies will pay out. "I don't recommend that, but time is money, and companies will pay the extortion to keep their operations up and running," he says.

In contrast, Roland Dobbins of DDoS-mitigation and security firm Arbor Networks argues cyber-extortion is a risky crime, and the arrest of one of DD4BC's apparent leaders might help deter other cyber-extortionists.

"The serial DDoS extortionist model requires that in order to be successful, threat actors must be prolific, must keep a steady stream of attacks and potential targets in the pipeline and must communicate interactively with the victims," he says. "This arrest shows ... that serial DDoS extortionists run a significant risk of being apprehended."

Europol, the European police association, announced this week that law enforcement agencies across the globe, including the U.S. Secret Service, the Federal Bureau of Investigation, Interpol and agencies in Australia and Japan, assisted with the arrests linked to DD4BC (see Europol Announces DD4BC Arrests).

Extortion Attacks Growing

Kellerman believes that a criminal group transitioning from street crime to cybercrime is likely behind DD4BC. And assuming that other members of the group remain at large, it's unlikely that DD4BC - or copycats, for that matter, will not disappear anytime soon, he contends.

"DD4BC has performed attacks against a broad spectrum of organizations, and arresting key operators is obviously an effective way to address that issue for at least the near future," says John Miller, head of the cybercrime intelligence practice at security and analysis firm iSIGHT Partners. "However, we do agree that extortion attacks similar to DD4BC's aren't going to stop just due to this operation. ... DDoS capabilities can be acquired very easily in the e-crime underground, which makes it easy for new participants to become involved in extortive DDoS operations."

Because many extortion attacks are waged from countries that do not have extradition treaties with the U.S., stopping the criminals who wage these attacks will continue to prove challenging, says Al Pascual, head of fraud and security at the consultancy Javelin Strategy & Research.

"This arrest was important from the perspective that it demonstrates to DDoS extortion copycats and other wannabes that they can be gotten," Pascual says. "That said, despite the laudable international cooperation involved here, not every locality is going to play nice. We can expect attacks to continue, unabated, from places typically beyond the reach of law enforcement, such as Russia. This will be the first of many arrests to be sure; but I would caution anyone from believing that the end is in sight, especially with DDoS services so readily available" (see DDoS: 4 Attack Trends to Watch in 2016).

Be Prepared

DD4BC, which emerged in mid-2014, has waged numerous Bitcoin extortion attacks against a wide range of businesses, including banking institutions, the online gaming industry, the entertainment industry and other high-profile companies, Europol notes.

Many large organizations across the world have been targeted by DD4BC, but not all have been adversely affected, says Dobbins of Arbor Networks.

"Organizations which were attacked by DD4BC, and other DDoS extortionists, and were prepared weren't affected," he says. "Preparation is key. Never pay."

Dobbins says banking institutions and other companies that conduct a significant amount of business online need to ensure they are continually reviewing and updating their DDoS mitigation strategies to ensure they are prepared for an extortion attack.

Even though a significant DD4BC leader apparently has been arrested, Dobbins says the threats posed by DD4BC are ongoing. "U.S. banks can't take this as a sign to let their guard down," he says. "We've already seen lots of DD4BC copycats over the last year-and-a-half -those pretending to be the 'original' DD4BC as well as threat actors with their own monikers, such as the Armada Collective."

Authentication , Compliance , FFIEC Authentication Guidance

Fourth Annual List of Financial Services Information Security Leaders Tracy Kitten (FraudBlogger) • January 11, 2016    

BankInfoSecurity announces its fourth annual list of top influencers, recognizing leaders who are playing significant roles in shaping the way banking institutions approach information security.

See Also: Roadmap for Identity Management in the Modern Organization

Each of these influencers for 2016 has made a substantial impact. Their influence ranges from shaping security enhancements and innovations for payments to providing regulations and enforcement to assist breach prevention and data protection. Some influencers have shined a spotlight on growing cyberthreats and information security gaps. Others have helped identify new opportunities for innovation.

Our editors, with input from our editorial advisory boards, made the selections of influencers based on the impression they've made over the past year, as well as the impact they are expected to have in 2016 and beyond.