Anti-Malware , Breach Preparedness , Data Breach

A decade or more ago, this would have been unthinkable: Microsoft developing an anti-malware platform for macOS.

See Also: Live Webinar | Passwords: Here Today, Gone Tomorrow? Be Careful What You Wish For.

But that's exactly what Microsoft announced on Thursday. The company launched a limited preview of Microsoft Defender Advanced Threat Protection for macOS, a move it says will help protect customers running non-Windows machines.

With that move comes a name change as well to deemphasize Windows. The software will now be known as Microsoft Defender ATP. The software will be compatible with the last three releases of macOS: Mojave, High Sierra and Sierra. Microsoft says it plans to expand Defender ATP to work on other platforms too.

For businesses, one of the main advantages of the move is that it enables IT administrators to see security alerts for employees' Mac machines within Defender's portal, which can show alert process trees and contextual information about a threat.

"We've been working closely with industry partners to enable Windows Defender Advanced Threat Protection (ATP) customers to protect their non-Windows devices while keeping a centralized 'single pane of glass' experience," Microsoft says in a blog post.

Microsoft's Expanded Security Tools

The macOS software includes what Microsoft calls "next-generation anti-malware protection," which is a broad term used by many security vendors that typically refers to machine learning techniques that can flag files as likely being malicious, even if they don't match a known-bad sample that's been previously seen.

Microsoft's macOS security move comes as it has increasingly been refining its tools to both prevent breaches and make it easier for run post-breach investigations.

In February, Microsoft expanded Defender's endpoint detection and response capabilities, by making it work not just on Windows 10 but also Windows 7 and 8.1.

Although Microsoft strongly recommends that all customers use Windows 10, it says it wanted customers to "achieve the best security possible while transitioning." Mainstream support for Windows 7 is scheduled to end in January 2020.

Endpoint detection and response - EDR - functions like a flight recorder for endpoints. If a breach occurs, EDR capabilities enable security teams to review, step by step, how an infection occurred. Such insight can aid both remediating the outbreak as well as strengthening defenses (see The Lowdown on EDR Security Software: Do You Need It?).

From a detection standpoint, Defender is a great anti-virus product, says Jake Williams, a former operator with the National Security Agency's Tailored Access Operations unit and founder of Rendition Infosec, a security consultancy in Atlanta.

"My only issue with it is that it lacks some enterprise management features (particularly reporting)," Williams says. "ATP is starting to fix that though, so in a few years it could be a major player."

Apple: Not Immune to Malware

In the early 2000s, Apple used security as a marketing advantage, particularly when Windows was suffering tough times in an era of seemingly nonstop worm outbreaks, drive-by exploits and aggressive adware. But the gap has largely closed: Microsoft's Trustworthy Computing initiative and dramatic improvements in later versions of Windows have made the operating system much harder to hack.

And while malware writers tend to still focus on Windows, perhaps because of its market share, some strains of malware, including ransomware, have been designed to target macOS. But in many cases, including many pestering adware programs, macOS users must be tricked into installing such software, rather than attackers being able to do so automatically via operating system exploits.

Still, there's much more malware for Mac than people realize, writes Thomas Reed, director of Mac and Mobile at the security vendor Malwarebytes.

"Since I have access to the threat telemetry we're collecting from Malwarebytes for Mac detections, I can say lots," Reed writes on Twitter. "I can only speak about numbers of files detected, because the telemetry's anonymized very heavily, but there are a lot ... like, tens of thousands per month."

Mac AV: A Good Idea

Two built-in security tools ship with macOS: Gatekeeper and XProtect. XProtect is its anti-virus engine, which relies on signature updates to detect malware.

Gatekeeper checks if an application has a digital signature that indicates it comes from Apple's Store or if it has an approved developer's certificate. If it doesn't have one, Gatekeeper can block the installation, although users can override such blocks.

A variety of security vendors, including Symantec, AVG, Bitdefender, Kaspersky Lab, Malwarebytes and Trend Micro, among many others, offer security suites for Mac.

Using a third-party security tool to protect your macOS is a good idea, says Patrick Wardle, a Mac security expert and founder of Digita Security, which develops advanced security tools for Mac. Wardle, a former NSA hacker, has also developed and released a variety of free security tools for Mac, available via his Objective-See website.

"I'm a firm believer that macOS users should install additional (3rd-party) security tools," Wardle says. "Various built-in security mechanisms of macOS are somewhat trivial to bypass. Apple's rather deceptive marketing has made Mac users overconfident in the security of their devices. This means malware can (and does) often finds a way onto macOS systems. 3rd-party security and AV products can help."

Wardle says Microsoft has done a "lovely job with Defender on Windows," but it remains to be seen how that will translate to the different malware techniques, families and payloads that get crafted to exploit the macOS ecosystem.

3rd Party Risk Management , Data Breach , Data Loss

An incident involving a third-party vendor migrating a server containing archived email of emergency medical device provider Zoll has resulted in a reported health data breach impacting more than 277,000 individuals.

See Also: Live Webinar | Passwords: Here Today, Gone Tomorrow? Be Careful What You Wish For.

As of Thursday, the incident is the fourth largest health data breach listed so far in 2019 on the Department of Health and Human Services' HIPAA Breach Reporting Tool website.

Commonly called the "wall of shame," the website lists health data breaches impacting 500 or more individuals.

Pennsylvania-based Zoll, which provides emergency medical products such as wearable heart defibrillators, therapeutic temperature management systems, and ventilation devices, reported the breach on March 18 to HHS as a hacking/IT incident involving a network server and a business associate.

The incident was reported as impacting 277,319 individuals.

Incident Details

In a March 18 statement, Zoll notes that its email is archived by a third-party service provider to comply with record retention and maintenance requirements, policies and procedures.

"During a server migration, some data from Zoll emails was exposed. The vendor believes that the incident occurred between Nov. 8, 2018 and Dec. 28, 2018," Zoll says.

"At this point, Zoll is not aware of any fraud or identity theft to any individual as a result of this exposure. The vendor has since confirmed that all information has now been secured."

Information potentially exposed includes patient names, addresses, dates of birth, and limited medical information. A small percentage of patients also had Social Security numbers exposed, Zoll says. The company is offering free credit and identity monitoring services for one year to impacted patients.

"Upon learning of the incident, Zoll immediately initiated an internal review and retained a leading independent forensics firm to conduct a thorough investigation of the incident," the company says. "Law enforcement and federal and state agencies have been notified to give them the opportunity to further investigate."

In addition, Zoll says it is taking steps to review its process for managing third party vendors and confirmed that the impacted vendor has also taken actions to help prevent against similar incidents in the future.

Zoll declined an Information Security Media Group request to identify the vendor involved in the incident.

Just the Latest Incident

The incident involving Zoll and a third-party service provider is among the latest health data security mishaps involving vendors and server-related snafus.

For instance, earlier this week, Sacramento, Calif.-based Meditab Software Inc., which provides fax services and more for healthcare providers, confirmed a report by a security researcher that the vendor leaked patient records through a fax server that was hosted by a subdomain of one of its affiliate companies, MedPharm Services, based in Puerto Rico (see Unsecure Fax Server Leaked Patient Data).

In the Zoll situation, "it seems that the organization was leveraging a third party to accomplish email retention and maintenance requirements," notes Mark Johnson, a former healthcare CISO and currently a shareholder at consultancy LBMC Information Security.

"In my view this is not unlike any other record retention for back-up, disaster recovery, or regulatory requirement. Therefore, this is not per se an email issue. This is more of a record retention issue," he says.

"However, in general, email should be encrypted if it contains sensitive data, like PHI in transmission or at rest. But if the system is on, it is technically not at rest, so encryption is not really applicable here. Data loss prevention is also a great idea, if configured correctly."

Any migration presents risk, Johnson adds. "Typically, migrations are large changes, from one version to another or from one solution to a different solution. Any large change has many moving parts," he says.

"This event is doubly hard, since it wasn't the organization who made the change, but their vendor," Johnson adds. "This highlights an area that most miss in their vendor risk management process: How does the vendor plan and execute major changes - for example, migrations - so events like this don't happen."

Every vendor, like any other organization, changes their infrastructure, he notes. "Products are updated, organizations change products, all the time. So, cybersecurity must be part of that process. Vendor risk management should understand how cybersecurity is involved in these efforts to understand the risk."

Critical Steps for PHI Security

Tom Walsh, president of tw-Security, notes that covered entities and their vendors need to take a variety of critical steps to prevent PHI from being exposed during email and other server migrations.

For starters, make sure the staff doing the migration is well-rested, he says. "In most cases, migrations take place afterhours to minimize business disruption of services. If the IT staff has already worked a full shift and is then expected to either stay late or report back later that night to the make the migration - they may be tired," he says. "Mistakes are more likely to happen when people are tired."

Also, it's critical to review access controls and user access/rights prior to the migration, he notes.

"User access rights have a tendency to drift over time, giving some users more access rights than what are needed. There may be some accounts with elevated privileges or system administrator rights giving them direct access to the whole database of emails as opposed to just a single user's mailbox," he says.

Reviewing the server settings or rules is also important, Walsh says. "Test environments or staging environments need the same level of security controls as production environments. Because these servers are 'temporarily' being used, sometimes organizations let down their guard to make it easier to do the migration," he notes.

Next, entities need to ensure that server migrations have proper oversight, including securing data that's involved. "Updates or migrations can be perceived as routine or sometimes 'grunt work' and may not have the attention of the information security officer or even a higher-level of technical expertise overseeing the migration."

Walsh also suggests purging data when finished with server migrations. "Many of the reported data breaches have occurred with old data left on test systems, staging environments, and on decommissioned servers. It is important to remove real identifiers from nonproduction systems when no longer in use," he says.

Finally, change control/change management should never be short-changed, he says.

"While most organizations today strictly follow change control processes for production applications, the discipline is often lacking when it comes to general support systems such as network equipment and email," Walsh says.

"Because formal change control involves documentation and meetings, some IT staff may not see any value in doing change control. That is of course, until something bad happens during an upgrade or a migration, as in this case."

Governance , Next-Generation Technologies & Secure Development

Enterprises are getting wiser to understanding the insider threat. But mitigating it? That remains a challenge - especially at a large scale. Mohan Koo of Dtex Systems talks about how to blend human and data analytics to address the challenge.

See Also: Live Webinar | Passwords: Here Today, Gone Tomorrow? Be Careful What You Wish For.

In a video interview with Information Security Media Group at RSA Conference 2019 in San Francisco, Link discusses:

Koo is co-founder and CTO at Dtex Systems.

Data Breach , File & Data Security , Fraud Management & Cybercrime

Facebook has corrected an internal security issue that allowed the company to store millions of user passwords in plaintext that were then available to employees through an internal search tool. The move follows a report published Thursday on Krebs on Security.

See Also: Live Webinar | Passwords: Here Today, Gone Tomorrow? Be Careful What You Wish For.

All told, the social media giant had stored between 200 and 600 million passwords in plaintext, some of which date to 2012. Internally, some 20,000 employees could access the data although the company claims that insiders did not abuse their access, according to Krebs.

In a statement posted Thursday, Pedro Canahuati, vice president of Engineering, Security and Privacy at Facebook, says that the company has stopped the practice of storing passwords in plaintext and that no one from outside the company accessed the data.

However, Krebs reports that over the past several years, about 2,000 Facebook engineers and developers made about 9 million internal queries for data, which used many of these plaintext passwords.

Almost immediately after the Krebs post went public, Facebook issued a statement that the issue was first discovered in January and that the company had corrected it and that no passwords leaked. Despite the reassurances, the company is likely to face additional scrutiny over how it treats user data and privacy.

If we ever get the ground truth on why @facebook was storing passwords in the clear, I'll bet 2:1 odds that they were either being logged as a URL parameter or used to impersonate users to see their user experience first hand. 1/2 https://t.co/z2C4rvqpq5

Facebook users are being notified as of Thursday. Asked for comment, a company spokesman referred Information Security Media Group back to the statement posted on its press site.

"To be clear, these passwords were never visible to anyone outside of Facebook and we have found no evidence to date that anyone internally abused or improperly accessed them," Canahuati writes. "We estimate that we will notify hundreds of millions of Facebook Lite users, tens of millions of other Facebook users, and tens of thousands of Instagram users."

Facebook Lite is a version of the social media platform that is predominantly used by people in regions with lower levels of connectivity.

Facebook had approximately 2.32 billion monthly active users in the last quarter of 2018, according to surveys.

Facebook's Privacy Problems

This latest episode will likely add to the numerous problems that Facebook has encountered when it comes to ensuring user privacy.

Earlier this year, reports surfaced that the U.S. Federal Trade Commission is close to concluding its report about Cambridge Analytica, the now defunct political consulting firm associated with President Donald Trump's 2016 campaign, and how that company accessed data on about 87 million Facebook users without their consent.

The FTC could levy a record-setting fine against the company, according to public reports.

In February, Germany's competition authority cracked down on Facebook's data collection ability, requiring the company to gain a user's permission before it gathers any personal information. Facebook is expected to appeal that decision.

Additionally, Facebook is still investigating a data breach that its engineers first found in September 2018, which affected some 30 million users after attackers found a vulnerability in the site's "View As" feature that exposed security tokens.

Passwords Exposed

Facebook is only the latest example of companies that have exposed user passwords through plaintext.

In May 2018, social media rival Twitter urged its 330 million users around the world to change their passwords after a bug in the hashing process, which is supposed to replace the password with a string of random characters, saved passwords in plaintext to an internal log.

A similar bug in GitHub's system also exposed user passwords in plaintext around the same time as Twitter reported its problem. It's not clear how many user accounts in that case were exposed, but the company did urge anyone who thought their password was exposed to reset it.

In its Thursday statement, Facebook's Canahuati writes that the company uses hashing methods to hide passwords, as well as cryptographic keys to replace passwords with a random series of characters. Facebook also deploys other technology to alert users if someone else attempts to log into their account.