Within the next 20 years, quantum computing could be applied to easily crack current approaches to cryptography, according to the National Institute of Standards and Technology, which already is beginning work on new approaches to encryption that can withstand the power of quantum computing.

Quantum computers will make use of the quantum states of subatomic particles to process information at speeds exponentially greater than what exists today. Such processing speeds, in theory, could easily break the massively long strings of numbers used in today's encryption software.

Work on refining cryptography so it's effective in the era of quantum computing must start now because "it will take 10 to 20 years to get new algorithms selected, standardized and implemented out into the field," says NIST mathematician Dustin Moody, who co-authored the recently released NIST Internal Report 8105: Report on Post-Quantum Cryptography.

In an interview with Information Security Media Group (click on audio player below image), Moody discusses:

Three categories of cryptography that could help build quantum-resistant encryption: lattice-based, error-correcting and multivariate polynomial cryptography; Initiatives from NIST to get stakeholders to collaborate on developing new cryptographic approaches to meet the quantum computing challenge; and The likelihood that new approaches will succeed.

NIST plans to launch a collaborative effort in the next few months, including competitions similar to those that were used for developing the SHA-3 hash algorithm, used in part for authenticating digital messages. The upcoming competitions could have multiple winners because there likely will need to be a variety of approaches to build strong cryptographic methods to defend against the power of quantum computers. "There are several systems in use that could be broken by a quantum computer - public-key encryption and digital signatures, to take two examples - and we will need different solutions for each of those systems."

Moody is the point of contact for the NIST post-quantum cryptography project. His main area of research deals with elliptic curves and their applications in cryptography. He received his Ph.D. in mathematics from the University of Washington in 2009.

Fraud

DOJ Requests Lighter Sentence for 'Substantial Assistance' Tracy Kitten (FraudBlogger) • May 4, 2016    

Because of his "substantial assistance" to federal prosecutors and law enforcement, the mastermind behind the Gozi banking Trojan will not serve additional prison time, but must pay nearly $7 million for forfeiture and restitution, according to the U.S. Attorney's Office for the Southern District of New York.

See Also: Proactive Malware Hunting

On May 2, Nikita Kuzmin was sentenced by a Manhattan federal court only to time served, and ordered to pay $6.9 million, at the request of the Department of Justice, to cover a portion of the funds he stole from consumers, businesses and banks throughout the world.

Kuzmin, who was indicted and arrested in 2010, in May 2011 pleaded guilty to various computer intrusion and fraud charges for the role he played in stealing tens of thousands of bank account details and other information from victims throughout the world between 2007 and 2010.

Cybersecurity attorney Chris Pierson, general counsel and CISO at invoicing and payments provider Viewpost, says lighter sentencing in exchange for cooperation is common in cybercrime cases. In fact, government cooperation has led to lighter sentences in other notable cybercrime and criminal arrests, such as the 2005 takedown of the carding group Shadowcrew and the 2010 sentencing of notorious TJX hacker Albert Gonzalez.

Still, given the severity of global financial losses linked to Gozi, Kuzmin must have provided a great deal of worthwhile information for authorities to recommend his jail time be reduced, he adds.

"Based on the sentence of time served, it is more likely than not that the level of cooperation in this case and other ongoing investigations was instrumental to further arrests, information, or other turned informants," Pierson says.

The DOJ's Request for Leniency

In an April 28 letter to Judge Kimba M. Wood, the DOJ notes that because Kuzmin provided "substantial assistance" in the investigation and prosecution of others, and shared previously unknown details about criminal schemes linked to Gozi and other attacks with which he was involved, he fulfilled the obligations of his "cooperation agreement" and should be credited for time served.

As a result, Kuzmin's jail time was limited to the 37 months he already served.

"Kuzmin admitted that he engaged in uncharged criminal conduct, most of which predated his development of Gozi," the DOJ's letter notes. "The government would not have known about this conduct but for his admissions."

The DOJ also points out: "Kuzmin provided substantial assistance to the government, as set forth in a separate letter, which the government has submitted and respectfully requests to file under seal."

Even though Kuzmin's punishment is light, relative to the damage he caused, and that Gozi continues to cause, his assistance was worth rewarding, says John Buzzard, director of product management for security firm Rippleshot Fraud Analytics. "To me it's bittersweet to reward a criminal for being honest after the fact; but that's sadly the only way to get traction on the cases, especially any criminal case where an expert informant is required," Buzzard says.

Crimeware-as-a-Service Pioneer

One issue that prosecutors note in their sentencing-recommendation letter to Judge Wood is that Kuzmin's creation and distribution of Gozi not only enabled Gozi infections to become widespread, but also made the malware impossible to contain.

"The seriousness of Kuzmin's crime, and the need for general deterrence, are heightened in this case by the difficulty of eradicating Gozi and other types of destructive malware once they are disseminated," the government notes. "Kuzmin's offense is particularly significant for another reason, namely, that in perpetrating this crime, Kuzmin developed the model of cybercrime-as-a-service," which enabled other criminals to use Gozi for a fee.

Kuzmin's so-called 76 Service pioneered the crimeware-as-a-service model (see Crimeware-as-a-Service Threatens Banks).

"Unlike many cybercriminals at the time, who profited from malware solely by using it to steal money, Kuzmin rented out Gozi to other criminals," the U.S. Attorney's Office notes. "For a fee of $500 a week paid in WebMoney, a digital currency widely used by cybercriminals, Kuzmin rented the Gozi 'executable,' the file that could be used to infect victims with Gozi malware, to other criminals. Kuzmin designed Gozi to work with customized 'web injects' created by other criminals that could be used to enable the malware to target information from specific banks."

In the government's letter to Judge Wood, it notes that Kuzmin's innovation - to lease out Gozi - has been copied by other cybercriminals, fueling the spread of Gozi variants such as Vawtrak and other banking malware strains. "In renting the malware to others, Kuzmin made it widely accessible to criminals, in other words, to criminals who do not or need not have sophisticated computer science skills like Kuzmin and his Gozi co-creators," prosecutors state (see How Do We Catch Cybercrime Kingpins?).

At Least $7 Million in Losses

While authorities had been unable to determine the exact amount of money that has been stolen from bank accounts via Gozi, they now say that two small banks in the United States and one in Europe have collectively reported nearly $7 million in Gozi-related losses. As a result, the global losses due to Gozi are likely to be much higher.

What's more, authorities now say that during their investigation into Gozi, security experts identified a server that contained stolen data, including 10,000 account records belonging to more 5,200 personal computers. "The records included login information for accounts at over 300 companies, including leading global banks and financial services firms," the U.S. Attorney's Office points out. "In the course of the investigation, Gozi was found to have infected over 1 million computers across the United States, Germany, Great Britain, Poland, France, Finland, Italy, Turkey and other countries. U.S. victims include individuals, companies and others, including the National Aeronautics and Space Administration. Gozi caused at least tens of millions of dollars in losses to victims."

Anti-Malware , Data Loss , Encryption

Please Don't Pay Ransoms, FBI Urges Bureau Tracks 'Ransomware Actors,' But Says Preparation Remains Essential Mathew J. Schwartz (euroinfosec) • May 4, 2016    

Memo from the FBI: Please don't pay ransoms.

See Also: Proactive Malware Hunting

"The FBI does not condone payment of ransom, as payment of extortion monies may encourage continued criminal activity, lead to other victimizations, or be used to facilitate serious crimes," Christopher Stangl, section chief of the FBI's Cyber Division, tells me.

But despite repeated warnings since 2014, many individuals and organizations continue to suffer ransomware infections.

As a result, victims are faced with the question of whether they should remediate and restore systems - if up-to-date backups have been maintained and stored offline - or take a chance on paying a ransom - which at least in the United States isn't illegal - and potentially being able to immediately restore affected systems. Neither scenario is a zero-sum game, since even restoring from backups will take time and thus potentially impact productivity or profitability (see Ransomware: Is It Ever OK to Pay?).

The number of ransomware infections surged in 2015, and that trend has continued this year, Laurance Dine, managing principal of the investigative response team at Verizon Enterprise Solutions, recently told me (see Ransomware Epidemic Prompts FBI Guidance).

Given that reality, I reached out to the FBI to ask how it's organizing to better battle this surge. In response, officials tell me that the FBI's Cyber Division actively identifies, pursues and attempts to disrupt all known "ransomware actors," and that it tracks all related crime. "The FBI reviews reported ransomware threats regardless of the loss amount," officials at its Cyber Division say. "The vast majority of current ransomware threats originate from a handful of variants. The FBI has dedicated resources to investigate these top ransomware threats. As new threats materialize, the FBI will continue to evolve to address them."

No Magic Bullets

Could the FBI be doing more to battle crypto-locker builders and users? That was the subtext of a letter Sen. Ron Wyden (D-Ore.) wrote in December 2015 to FBI Director James Comey, asking how the bureau was addressing ransomware, and questioning the veracity of a press report suggesting that the bureau sometimes advised victims to "just pay the ransom."

Donald J. Good, the deputy assistant director of the FBI's Cyber Division, responded to Wyden's letter on Feb. 8, 2016, in the form of an unclassified intelligence memo. Good repeated the bureau's admonition to never pay ransoms. He also noted while the FBI wouldn't comment on ongoing investigations, "most of the top cybercriminal actors that we are aware of are located outside of the United States," which obviously makes arresting many of them much more difficult. Regardless, "the FBI is committed to following the money in investigating all crimes with a financial component; ransomware is no exception," he wrote.

Cybercriminals are Lazy Too

Of course, it would help if fewer people suffered a ransomware infection and chose to pay, as numerous victims - and at least one major hospital, to the tune of $17,000 - have been doing (see Hollywood Hospital Pays Ransom to Unlock Data). As Sen. Barbara Boxer (D-Calif.) noted in an April letter to the FBI: "I am concerned that by hospitals paying these ransoms, we are creating a perverse incentive for hackers to continue these dangerous attacks."

Indeed, as Verizon's Dine recently told me, cybercriminals are "just as lazy as the rest of us," and when they find an inexpensive, safe - for them - and easy to execute attack that's also profitable, why would they stop?

The success of ransomware as a cybercrime business model continues to attract more developers - to create new types of ransomware - as well as users with criminal leanings, and has driven many of them to pursue bigger targets and payoffs. "Although the majority of these attacks are based upon phishing at the primary infection vector, the sophistication of these attacks is increasing to include the exploitation of vulnerabilities on a given server," the FBI says, as demonstrated by some recent ransomware infections at hospitals.

Prepare Now, or Pay Later

Meanwhile, organizations and individuals continue to become ransomware victims. On April 29, accordingly, the FBI issued yet another ransomware alert, recommending:

Prevention: Prepare using both "awareness training for employees and robust technical prevention controls," including access controls, updated anti-malware tools and ensuring admin-level accounts remain locked down. Backup/restoration: Create "a solid business continuity plan" for dealing with a ransomware attack, including backup up data, verifying backups' integrity as well as ensuring backups aren't connected to systems or networks that they're backing up.

"Companies can prevent and mitigate malware infection by utilizing appropriate backup and malware detection and prevention systems, and training employees to be skeptical of emails, attachments, and websites they don't recognize," the FBI's Stangl tells me.

The FBI continues to urge all ransomware victims to continue to come forward, to help law enforcement officials identify malware variants being used, budget appropriately, and coordinate with public and private partners around the world to better track and disrupt the gangs behind such attacks. "If you think you or your organization have been the victim of ransomware, contact your local FBI field office and report the incident to the Bureau's Internet Crime Complaint Center," the FBI says.

Better still, prepare now, so you don't have to face potentially having to pay - one way or another - later. Because once you're a ransomware victim, the FBI can't help you.

Data Breach , Privacy , Technology

Important Information Security Questions Remain Unanswered Varun Haran (APACinfosec) • May 4, 2016    

Following a massive data leak, Qatar National Bank has confirmed that its systems may have been hacked. A group with Turkish ties has claimed credit for the attack and reportedly threatened to release information from a second bank hack.

See Also: 2016 State of Threat Intelligence Study

In a statement provided to Information Security Media Group May 1 confirming that its systems may have been breached, the bank also commented on compromised data that was posted online. "While some of the data recently released in the public domain may be accurate, much of it was constructed and contains a mixture of information from the attack as well as other non-QNB sources, such as personal data from social media channels."

The bank also says it believes that the leak wasn't targeted at its customers, but instead designed only to damage the bank's reputation - although it offered no evidence to back up that assertion.

QNB says it's hired a third-party expert to review its systems.

The QNB leak involves a massive collection of documents that were posted April 26 to the online whistleblower site Cryptome. The leaked information, which totals 1.4 GB, includes internal corporate files and sensitive financial and personal data for QNB's customers, including Qatar's Al Thani royal family and the family-funded media organization Al Jazeera. The leak also revealed apparent intelligence dossiers.

A group with Turkish ties calling itself Bozkurtlar - or Grey Wolves - has claimed credit for the hack in a video first circulated April 25 via Twitter, one day before the QNB leak was publicly revealed.

Turkish far right group Bozkurtlar - "Grey Wolves" - has claimed responsibility for the breach in the Qatar National Bank. (Source: YouTube video reposted by Omar Benbouazza.)

The group claimed on its Twitter account, before it was taken down, to also have breached a second, unnamed bank, and obtained records that date back to 2001, which it plans to soon release.

QNB Attempts to Downplay Leak

Following the breach, QNB continued to characterize the incident as being an "alleged hack," until its statement on May 1. But multiple customers named in the leak, as well as one researcher, had already confirmed to ISMG that leaked usernames and passwords appeared to work.

Security engineer and RootedCON organizer Omar Benbouazza tells ISMG - and documents further in a blog post - that the QNB attacker used a SQL injection attack. Security researchers at Trend Micro have also published similar conclusions.

QNB Bank has continued to insist that the leak will have no financial impact on it, or its customers. Multiple attempts to exploit the leaked credentials, however, have been reported by the bank's customers in the week following the breach, as noted in multiple media reports.

The bank also noted in its statement that the attack targeted a portion of its Qatar-based customers.

Trend Micro's blog suggests that the attackers may have been after more than just easily monetizable payment card and personal data. The presence of sensitive data apart from banking data, such as individual profiles and what appear to be intelligence dossiers, has led some to speculate that attackers may have had other, as yet unknown motives.

@nitinbhatnagaar @Cryptomeorg yeah it smells very heavily. Seems real but curated and targeted.

Unanswered Security Questions

The details in the hacked data raise questions about QNB's information security practices, experts say, including why the sensitive data appeared to not be encrypted, and why the exfiltration of 1.4 GB of data was not detected. An analysis published by Trend Micro suggests that the QNB Bank breach began in July 2015.

Qatar Bank did not immediately respond to a request for comment about whether the leaked customer information was being encrypted both at rest and in transit.

Information expert Nitin Bhatnagar, a cybersecurity researcher and business development head for cybersecurity firm SISA Information Security, says his analysis of the data dump reveals that all data tables were in plain text, suggesting a lack of encryption. But it remains unclear whether QNB had neglected to encrypt primary account data or if attackers were able to decrypt the data.

In a blog post, Abhay Bhargav, CTO at Sunnyvale, Calif.-based security firm we45, says that the breach appeared to be an application-driven pivot attack involving attackers compromising one application, then taking advantage of poor network-based and application-based security controls to pivot gain access to more internal systems.

"In this case, the attackers seemed to have attacked QNB's internet banking application and gained access to their payment switch and possibly their core banking application," he says.

Security expert - and former banking CISO - Onkar Nath also questions why so much of the sensitive data in the leak is in plain text. "Either the bank stored primary account data in plain text or the encryption was broken. If it is the latter, this would make it a clear violation of the bank's Payment Card Industry's Data Security Standard compliance, which most entities handling card data usually follow," he says.

Nath also cites multiple researchers reporting that they used leaked data to initiate a successful login attempt, after which the online banking system interface told the researcher that a secure one-time PIN - or OTP - had been sent to the mobile phone number on file for that account. Nath says that providing a confirmation that a login attempt has been successful - or not - should always be avoided by banks.

Because the dump contains bank customers' mobile phone numbers, that puts them at risk of fraud, he says, because many services in Asia and the Middle East now use secure OTPs via SMS for two-factor authentication, he says. But mobile phone providers in India have previously been fooled into issuing SIM cards for stolen phone numbers to fraudsters, who can then begin logging into targets' online bank accounts, receive the OTP, and then empty victims' bank accounts.

Security engineer Benbouazza says that the leak of customers' personal information now leaves them exposed. "While most of the data is old, thousands of credit cards still work," he says. Together with the leaked personally identifiable information, including mobile phone numbers, email addresses and mailing addresses, the bank is now at risk for more targeted attacks, he warns.

×Close

Request to Republish Content

Cybersecurity , Risk Management

7 'Star Wars Day' Cybersecurity Lessons May the Information Security Force Be With You Mathew J. Schwartz (euroinfosec) • May 4, 2016     (Source: StarWars.com)

"May the Fourth be with you."

See Also: The Inconvenient Truth About API Security

Star Wars Day happens every year, celebrating the iconic science-fiction film franchise. It's the perfect time to celebrate these cybersecurity essentials, as received from "Star Wars" canon wisdom.

1. Too Good To Be True?

Received an email or communication that sounds too good to be true When in doubt, throw it out! #StarWarsDay pic.twitter.com/qS4nj6N6BE

Have you ever come out of hyperspace in an attack against a Death Star, only to be caught out by a hidden Imperial fleet? Or have you ever been emailed by a Nigerian prince, asking if he can keep his $20 million tucked in your bank account indefinitely?

In the words of Admiral Ackbar: "It's a trap!"

2. Recruit Who You Must

In "Star Wars," the future of the universe relies on a whiny kid who takes a lucky shot, blows up a doomsday machine, but then can't stick the long-term training, gets his hand cut off by his father, watches his friends get captured by the opposition, and only then manages to come back dressed in all black - sporting a new, robotic hand - and save the day.

Takeaway: Don't be afraid to look for help in the most unlikely of places.

On the security front, one ongoing challenge is keeping users keyed in to emerging attacks, including phishing and malware. And where security awareness training is concerned, always remember the fun factor. In short: Never underestimate the power of kittens.

3. Test Things Before They Break

Photograph: Sam Howzit, Flickr/CC.

Ever needed to escape a blockade, only to find that your "bucket of bolts" can't make the jump to light speed, because you failed to keep your ship tuned up?

The same goes for information security defenses, and ensuring that, unlike Target, you're paying attention to alarms before the situation becomes critical.

4. Don't Fear the Dark Side

One recurring problem in information security circles is the proclivity by practitioners - and especially vendors - to trade on fear, uncertainty and doubt. But FUD doesn't help anyone get their cybersecurity shop in order. As Yoda tells Luke Skywalker: "Fear is the path to the dark side. Fear leads to anger. Anger leads to hate. Hate leads to suffering." And who wants to suffer?

5. Scum Will Congregate

The scum of the universe will always find ways to congregate. As Obi-Wan Kenobi noted of a certain less-than-desirable piece of intergalactic real estate: "Mos Eisley spaceport: You will never find a more wretched hive of scum and villainy."

Security experts say the same paradigm is at work in cybercrime circles, as revealed by the prevalence of underground forums - many apparently hosted in Russia - that sell products and services to other cybercriminals.

6. Learn From Repeat Attacks

"That's no moon." (Photograph: Windell Oskay, Flickr/CC.)

Why do villains create the plans for a major new weapons system once, then keep redeploying it? In that respect, the developers behind malware, ransomware and remote-access Trojans are a lot like the folks who keep building Death Stars, or their planet-based "Force Awakens" alternative. Except cybercriminals, of course, have enjoyed much greater success.

7. Don't Try, Do

Never wait to be attacked, especially if there are defenses that you can put in place - in advance - that will help blunt or block the impact of those attacks, be they phishing, ransomware or attacks launched via supply-chain partners.

The important thing is to get started, follow through and keep following through. In the words of Yoda: "Do. Or do not. There is no try."