Data Breach , Data Loss

Dumped Document on Donald Trump Allegedly Stolen from Organization Jeremy Kirk (jeremy_kirk) • June 16, 2016     An alleged DNC background document dumped by Guccifer 2.0 (source: Gawker)

There's never any lack of lust for fame in the hacking world. Now one hacker, "Guccifer 2.0," has claimed sole responsibility for the breach of the Democratic National Committee's systems, posting a cache of documents on a public website.

See Also: Unite & Disrupt: Mitigate Attacks by Uniting Security Operations

It's a weighty, but as of yet unverified, claim following the DNC's disclosure on June 14 that its networks were breached (see Report: Russia's 'Best' Hackers Access DNC's Trump Research).

The DNC took the fairly unheralded step of allowing the computer forensics firm Crowdstrike to release public details of the intrusions just days after the hackers were booted from the network. Forensic clues point to two known groups nicknamed Cozy Bear and Fancy Bear, both of which may be linked to the Russian government, Crowdstrike believes.

Guccifer 2.0 claims on a newly-created WordPress blog to have hacked the DNC alone, extracting thousands of documents and emails that are now being transferred to the secrets-spilling website Wikileaks.

The alleged hacker took a dig at Crowdstrike, contesting the company's competency: "I'm very pleased the company appreciated my skills so highly. But in fact, it was easy, very easy." Efforts to reach the hacker were unsuccessful.

Crowdstrike is keeping Guccifer 2.0's claims at arm's length, saying it is confident in its conclusion of the source of the attacks.

"Whether or not this posting is part of a Russian intelligence disinformation campaign, we are exploring the documents' authenticity and origin," it said. "Regardless, these claims do nothing to lessen our findings relating to the Russian government's involvement, portions of which we have documented for the public and the greater security community."

Guccifer Legacy

The original Guccifer is Marcel Lazar Lehel of Romania. He accessed the email accounts of close to 100 prominent people, including former Secretary of State Colin Powell and the sister of former President George W. Bush. Lehel pleaded guilty in late May in U.S. federal court to aggravated identity theft and unauthorized access to a computer.

In the blog post, Guccifer 2.0 mentioned his namesake: "Guccifer may have been the first one who penetrated Hillary Clinton's and other Democrats' mail servers. But he certainly wasn't the last. No wonder any other hacker could easily get access to the DNC's servers."

More than One Hack?

The published documents include a meaty, 237-page Word document marked confidential and titled the "Donald Trump Report." It's a comprehensive background briefing on the presumptive Republican presidential nominee. The date on the document is Dec. 19, 2015.

The hacker contested the DNC's assertion no financial data was compromised in its breach. Also released was an Excel file that purports to be a list of high dollar Democratic party donors. According to one screenshot, actor Morgan Freeman of Los Angeles donated $1 million, and film producer Jeffrey Katzenberg $3 million.

Officials with the DNC couldn't immediately be reached. Gawker reported that the DNC is aware that the documents are circulating.

If the documents are genuine, it would indicate perhaps more than even two groups had access to the DNC's systems. This is not unusual. Security audits often find many pieces of malware on vulnerable systems, and it is possible that many actors or groups saw exploitable holes.

The development also doesn't mean that Guccifer 2.0 is necessarily affiliated with either Cozy Bear or Fancy Bear. In fact, state-sponsored cyberespionage groups have no interest publishing their stolen data publicly, as it's intended for internal consumption.

For years, organizations have been threatened by DDoS attacks on several fronts, ranging from volumetric attacks to application-level and DNS strikes. Now come ransom-based attacks. Trey Guinn of CloudFlare discusses how to respond to each type of attack.

Ransom-based attacks are in the spotlight now, but Guinn - head of solution engineering at CloudFlare - has discovered an interesting disconnect.

"There are more attackers sending out ransom notes than are actually doing attacks," Guinn says. "We have seen many of these ransom notes go out, but it's clear in how [the attackers] receive payment that they have no way to determine who actually has paid the ransom. There is no expectation that there is ... going to be an attack."

The message to security leaders, then, is crystal clear, he says: "Never pay the ransom."

In a discussion about matching DDoS defenses to DDoS attacks, Guinn talks about:

Types of DDoS attacks most predominant today; How mitigation techniques must match the types of attacks; How to respond specifically to ransom-based attacks.

Guinn leads the enterprise solution engineering group at CloudFlare, where he works with large customers to help them manage their network edge. His work focuses on TLS, DDoS mitigation, web application firewalls, HTTP and DNS.

He has worked in internet application delivery for over 15 years in small and large companies in several countries - from multinationals like KPMG to one room startups. Security is a continual focus of his career (as it should be for every engineer) with work ranging from network security to identity management.

Encryption , Endpoint Security , Privacy

Apple Promises 'Differential Privacy' Security, Privacy Upgrades Follow FBI's Attempted Crypto Smackdown Mathew J. Schwartz (euroinfosec) • June 16, 2016     Apple CEO Tim Cook addresses WWDC 2016. (Source: Apple)

Apple wants to sell you on "differential privacy."

See Also: How to Mitigate Credential Theft by Securing Active Directory

That's one of the security and privacy-related announcements made by Apple at its Worldwide Developer Conference this week.

Apple uses the annual event to preview forthcoming software and hardware for developers, and this year's event included a number of interesting-looking announcements, ranging from building Siri into Apple's desktop operating system and extending Apple Pay to websites, to an upgraded Home app to control your personal Internet of Things and better facial recognition for photos.

On the crypto front, with OS X 10.12 - code-named Sierra - that's due out next year, Apple's all-new Apple File System, a.k.a. APFS, will feature native encryption capabilities. AFPS will run on everything from Apple's watches and televisions to laptops and desktops, and allow developers to use single-key or multi-key encryption to protect data, even if devices' physical security gets compromised.

But amongst all of the announcements, one of the most puzzling is surely the promise of incorporating "differential privacy" into iOS 10, which Apple watchers expect to be released in September.

Promise: Privacy at Scale

Craig Federighi, Apple's senior vice president of software engineering, told the WWDC audience that on the iOS privacy front, Apple already attempts to do as many computations as possible on the device, and also uses end-to-end encryption for all iMessage and FaceTime messages.

Going forward, however, Apple says it wants to offer what amounts to privacy at scale, for example to spot patterns in how users are searching online, make better suggestions via the 'QuickType' keyboard or offer related links.

Craig Federighi, Apple's senior vice president of software engineering, talks differential privacy at WWDC 2016.

"We believe you should have great features and great privacy," Federighi told the WWDC crowd. "Differential privacy is a research topic in the areas of statistics and data analytics that uses hashing, subsampling and noise injection to enable this kind of crowdsourced learning while keeping the information of each individual user completely private."

Differential privacy essentially means collecting two different sets of data - one that includes your personal information, and one that has it stripped out - and ensuring that the latter data set is good enough to work with, says Johns Hopkins University cryptography professor Matthew Green in a blog post (see Top 10 Data Breach Influencers). He adds that differential privacy can be improved if random noise gets added to the mix.

The Usual Secret Sauce

What's unclear so far, however, is how Apple will be implementing this system, and whether it will stand up to security researchers' scrutiny, although Apple says it's vetted its approach with Aaron Roth, a professor at the University of Pennsylvania computer science department, who's literally written a book on differential privacy.

"With a large dataset that consists of records of individuals, you might like to run a machine learning algorithm to derive statistical insights from the database as a whole, but you want to prevent some outside observer or attacker from learning anything specific about some [individual] in the data set," Roth tells Wired. "Differential privacy lets you gain insights from large datasets, but with a mathematical proof that no one can learn about a single individual."

Some other researchers say they are waiting to see full details relating to how Apple has implemented its system before pronouncing it effective or not. "Unfortunately Apple isn't known for being terribly open when it comes to sharing the secret sauce that drives their platform, so we'll just have to hope that at some point they decide to publish more," Johns Hopkins' Green says.

On the upside, however, Apple didn't have to do this, Green says, adding that any moves in this direction offer reason for cautious optimism. "It sure looks like Apple is honestly trying to do something to improve user privacy, and given the alternatives, maybe that's more important than anything else," he says.

Life After the Apple-FBI Crypto Fight

Of course, it's impossible to view Apple's differential privacy move without making reference to one of the potential catalysts: the Snowden revelations. Those began three years ago, and have revealed mass surveillance campaigns being conducted by U.S. and U.K. intelligence agencies, programs designed to crack or suborn Apple operating systems - both OS X and iOS - as well as attempts by intelligence agencies to exploit even minor weaknesses to track or spy on targets.

Earlier this year, meanwhile, the U.S. Justice Department attempted to force Apple to create a version of iOS that would allow the FBI to access the contents of an iPhone that had been issued to San Bernardino shooter Syed Rizwan Farook. Apple CEO Tim Cook vowed that Apple would fight the "dangerous" move, and the FBI ultimately backed off, although experts say related legal battles have only been temporarily deferred (see Silicon Valley: Crypto Debate Continues). In the interim, the world's largest technology company shows no signs of slowing down on its promise to deliver devices that provide greater levels of privacy and security for users.

This edition of the ISMG Security Report kicks off with thoughts on how the Watergate break-in of the Democratic Party headquarters by operatives of President Nixon's reelection campaign 44 years ago today would have played out if current technology existed then. We might never had heard the word Watergate.

The Watergate anniversary comes the same week news surfaced of another breach - this one virtual - of the Democratic National Committee, in which Russian hackers allegedly accessed emails, chat conversations and opposition research on Donald Trump, the presumptive Republican presidential nominee.

You'll hear in this report (click on player beneath image to listen):

ISMG Managing Editor for Security and Technology Jeremy Kirk explain why the DNC and its security contractor CrowdStrike did something highly unusual: provide details about the breach. In my conversation with Jeremy, I explain why Russians hackers are so good at their job. DataBreachToday Executive Editor Mathew J. Schwartz points out that old internet protocols - including telnet and FTP - continue to be in widespread use, and used insecurely. BankInfoSecurity Executive Editor Tracy Kitten evaluates the war of words between bankers and retailers over national data breach notification legislation before the U.S. Congress.

The ISMG Security Report appears on this and other ISMG websites on Tuesdays and Fridays. Please check out our June 10 and June 14 reports, which respectively examine the concerns expressed by security practitioners at the Infosecurity Europe conference in London earlier this month and analyzes Symantec's purchase of Blue Coat. The next ISMG Security Report will be posted Tuesday, June 21.

Theme music for the ISMG Security Report is by Ithaca Audio under a Creative Commons license.

Events , InfoSecurity Europe 2016

12 Sights: Infosec Europe 2016 Visual Highlights from Europe's Biggest Cybersecurity Event Mathew J. Schwartz (euroinfosec) • June 17, 2016     London's Olympia exhibition center hosted this year's conference.

The recent Infosecurity Europe 2016 conference in London drew attendees from more than 70 different countries. The free conference, which is Europe's largest cybersecurity event, spanned three days, and featured a variety of well-known information security luminaries delivering keynote presentations and participating in panel discussions.

See Also: Vulnerability Management with Analytics and Intelligence

Here are 12 visual highlights from the event:

Opened as the National Agricultural Hall in 1886 - three years before the Eiffel Tower - the Olympia, located in London's Kensington district, features a wrought iron and glass shell.

The Olympia spans two levels, with the upper level hosting more than 100 exhibitors as well as the keynote presentations.

Mikko Hypponen, chief research officer of F-Secure, delivered an opening keynote presentation on top cybercrime trends.

Nearly 350 organizations - from security vendors and consultancies to governmental organizations and professional associations - exhibited at this year's conference.

Hot topics at this year's conference ranged from ransomware, cybercrime, breach avoidance, supercomputers, the latest research, as well as discussions about why so many simple security problems just can't seem to get solved.

The conference drew what organizers estimated to be more than 15,000 attendees, offering ample opportunities for not just free swag, but also networking.

Vendors deployed the usual array of booth enticements to attract visitors, ranging from free lightsabers and notepads to the chance to win a drone or beat an opponent at a modified form of whack-a-mole (pictured).

With outside temperatures soaring in London, and the glass-roofed Olympia not offering state-of-the-art air conditioning, attendees snapped up cool freebies, ranging from beer at daily happy hours to ice cream and sorbet.

More than 260 speakers presented this year in keynote presentations, panel discussions as well as smaller technology talks.

Keynote presentations occasionally turned personal, for example, when Hypponen revealed that he too had been pwned in the LinkedIn 2012 breach.

Familiar symbology - as in this demonstration of an attack/defense training program offered by U.K. security firm Satisnet - featured heavily, if at times unsubtly, at the the conference.

Only a handful of hoodie-wearing hackers, sadly forced to stand facelessly in the London rain, appeared at this year's event.

Audit , Governance , Risk Assessments

Watchdog Urges Four Agencies to Improve Implementation of Access Controls Eric Chabrow (GovInfoSecurity) • June 21, 2016     GAO's Greg Wilshusen calls on U.S. agencies to toughen access controls.

A government watchdog warned four federal agencies that they must be more diligent in implementing their cybersecurity programs. Otherwise, some of the government's most sensitive information is at risk of being disclosed to unauthorized individuals.

See Also: 2016 State of Threat Intelligence Study

Although NASA, the Nuclear Regulatory Commission, the Office of Personnel Management and the Department of Veterans Affairs developed risk assessments for their high-risk systems, they have all been inconsistent in their implementation of access controls, according to report released June 21 by the Government Accountability Office, the investigative arm of Congress.

GAO also says the four agencies have weaknesses in patching software vulnerabilities and planning for contingencies because they didn't fully implement key parts of their information security programs.

Gregory Wilshusen discusses the findings of the GAO audit of four federal agencies.

"Until the selected agencies address weaknesses in access and other controls, including fully implementing elements of their information security programs, the sensitive data maintained on selected systems will be at increased risk of unauthorized access, modification and disclosure, and the systems at risk of disruption," Gregory Wilshusen, GAO director of information security issues, says in the report.

Audit Sought by Congressional Overseers

GAO surveyed 18 federal agencies that store and process high-impact information, which the National Institute of Standards and Technology defines as having a severe or catastrophic adverse effect on operations, assets and individuals if compromised.

The leaders of the Senate Homeland Security and Government Affairs Committee, which provides government IT security oversight, requested GAO study how federal agencies protect high-impact data. The request came after the breach of Office of Personnel Management computers that exposed the personal information of at least 21.5 million individuals, many of them holding security clearances (see Nominee Explains OPM's Recovery from Massive Breach).

During the fiscal year that ended Sept. 30, 2014, 11 of the 18 agencies GAO surveyed reported 2,267 incidents affecting their high-impact systems, with nearly 500 of the incidents involving the installation of malware. Of the federal government's 9,714 information systems in the 24 agencies covered by the Chief Financial Officers Act, 912 of them - or 9 percent - are deemed high impact.

The audit also revealed that the attacks delivered through email were deemed the most serious and frequent.

Most Serious, Frequently Identified Cyber Threat Vectors

Source: GAO

GAO also recommended that the Office of Management and Budget, the White House organization that oversees federal agencies IT security, complete its plans and practices for securing federal systems, known as the Cybersecurity Implementation Plan (see Federal Cybersecurity Strategy Revised).

The auditors called on NASA, NRC, OPM and VA to fully implement key elements of their information security programs. The agencies generally concurred with GAO's recommendations, with the exception of OPM.

Pushback from OPM

OPM did not concur with the recommendation regarding evaluating security control assessments. David Vargas, OPM's associate CIO, says GAO failed to provide enough information to fully respond to the recommendation. But GAO contends it briefed OPM staff on its technical findings nearly two months before OPM was required to respond to a draft of the audit.

GAO also recommended that OPM provide and track specialized training for all individuals, including contractors, who have significant security responsibilities. Vargas says OPM concurs with the intent of that recommendation, but disagrees on the approach GAO suggests. He says the OPM system audited by GAO was owned and operated by a contractor, which he considers a crucial point.

"It is more appropriate and efficient for OPM to monitor IT training requirements for contractors without access to OPM's network through contractor audits and oversight, as opposed to directly providing and tracking those individuals' training," Vargas says in his response to the GAO recommendation. "OPM's IT security office currently conducts annual site visits on a sample of contractors each year and is working to improve the site assessment process to better align it to verify compliance with all the standard IT contract clauses, including those regarding contractor employee training."

The GAO study reveals how cyber threats affects the 18 agencies with high-impact systems. It shows that threats from nations and malicious insiders were the most serious. Threats posed by nations, unknown malicious outsiders and hackers/hacktivists occurred most often, as indicated, for example, by alerts or notifications.

Most Serious, Frequently Identified Adversarial Cyber Threat Sources

Source: GAO

The agencies also reported that phishing and spear phishing proved to be the most serious and most frequently identified method of waging cyberattacks.

Most Serious, Frequently Identified Cyberattack Methods

Source: GAO

The 18 agencies with high-impact systems reported that they considered infrastructure failure or outage, failure in IT equipment and unintentional user errors to be the most serious non-adversarial threat sources that affect their high-impact systems.