Authentication , Data Breach , Technology

69 Million Dropbox Passwords Compromised; Last.fm Reportedly Breached in 2012 Mathew J. Schwartz (euroinfosec) • September 1, 2016     Photo: Dropbox in 30 Minutes (Flickr/CC)

To the annals of super-bad historical mega breaches that no one knew about, add a new entry: file-hosting service Dropbox. Separately, music service Last.fm also was reportedly breached badly in 2012, although that has yet to be independently confirmed.

See Also: How to Mitigate Credential Theft by Securing Active Directory

On Aug. 27, Dropbox began alerting customers that if they had signed up to the service before mid-2012 but not changed their passwords since mid-2012, then they would be required to do so.

"We recently learned about an old set of Dropbox user credentials (email addresses plus hashed and salted passwords) that we believe were obtained in 2012," Dropbox says on its website, indicating it first heard related rumors in mid-August. Resetting the passwords that it believes may have been exposed "ensures that even if these passwords are cracked, they can't be used to access Dropbox accounts," the alert notes.

Dropbox first learned about that breach in 2012 and issued an alert to users in July of that year, saying it had traced the breach to an employee reusing their corporate password across multiple sites. The company said it added new security features designed to protect against such breaches. But at the time, Dropbox evidently failed to comprehend the true magnitude of the breach and forced relatively few password resets.

What's belatedly come to light, however, is that as a result of that 2012 breach, details for almost 69 million user accounts - including email addresses and hashed passwords - were stolen. The information reportedly began circulating recently on underground forums.

More Historical Mega Breaches

This year has seen a spate of mega breaches belatedly coming to light. Four announced in May came from MySpace - the date of its breach remains unclear, though it's obviously not recent; LinkedIn, which disclosed that its 2012 breach resulted in 165 million passwords being compromised; Tumblr, which warned that 65 million accounts were breached in 2013, prior to its acquisition by Yahoo; and "adult social network" Fling, which said that 41 million accounts were breached in 2011.

On Sept. 1, paid data breach site Leaked Source described yet another old, alleged breach, this one hitting music service Last.fm. Leaked Source claims that the service was hacked in March 2012 and data on 43.6 million users - including usernames, email addresses and passwords - was stolen. While that breach has yet to be independently verified, Leaked Source says that it successfully cracked 96 percent of the site's unsalted passwords, which had been hashed with MD5.

Last.fm didn't immediately respond to a request for comment on that report.

Dropbox Breach: Worse than Believed

Dropbox's Aug. 27 breach alert arrived just a few months after several identity theft services misreported that user data from the site had been leaked (see Dropbox Confident Amidst Breaches).

It turns out, however, that the 2012 Dropbox breach appears to have been much worse than originally believed. Indeed, sometime after Dropbox was hacked in mid-2012, "a large volume of data totaling more than 68 million records was subsequently traded online and included email addresses and salted hashes of passwords, half of them SHA-1, half of them bcrypt," says Troy Hunt, who runs the free Have I Been Pwned? website.

Security experts laud bcrypt as an excellent, purpose-built password-hashing algorithm, but warn that SHA-1 - as well as MD5 - are deprecated and shouldn't be used. Dropbox, to its credit, in recent years appears to have phased out SHA-1 in favor of bcrypt.

Technology news site Motherboard reports that it obtained a sample of the data that hackers allegedly stole from Dropbox, and that it contains details relating to 68.7 million accounts, including email addresses and hashed passwords. It says that an unnamed, senior Dropbox employee confirmed that the information was legitimate.

Dropbox couldn't be immediately reached for comment on that report.

But Hunt says he independently reviewed the data and found it to be authentic. He acknowledges that it contains old passwords set by him and his wife.

That's both my wife's & my unique 20 random character passwords always stored in an encrypted password manager confirmed in the Dropbox data

The Dropbox passwords were salted, which refers to the practice of adding data to a password before it gets run through a one-way hashing algorithm, which makes it more difficult for attackers to crack. Whenever users enter their password in the site again, it gets salted and run through the password-hashing algorithm, and if there's a match, then the site knows the password is authentic.

Hunt says that while the passwords are salted, that doesn't mean they were invulnerable. "The risk is they may be cracked, but their password hashing approach means that's only likely with bad passwords," Hunt says via Twitter.

Hunt has added the Dropbox breach to his website's list of the top 10 breaches of all time. It currently holds sixth place, behind breaches of Adobe (152 million accounts exposed), China's Badoo (112 million) and Russian social media site VK (93 million), among others.

Enable Two-Step Verification

Two safeguards against breaches that may happen today, but not be revealed until well into the future, are to use unique passwords for each site - thus blocking attackers from reusing the credentials to log into other sites - as well as to enable two-step authentication whenever possible. The latter means that even if attackers obtain a user's valid password, they can't use it unless they can somehow also obtain, for example, a one-time verification code.

After it was hacked in July 2012, the next month Dropbox introduced two-step verification as a free option for all users. Today, it works via text messages or a mobile app, generating a unique six-digit security code that users must enter to log in. The authentication feature also works with some types of security keys - small USB or near-field communication devices that typically get carried on a keychain and are used as the second step for verification.

Anti-Malware , Fraud , Technology

Citing Fresh Fraud Attempts, SWIFT Urges Banks to Improve Defenses Mathew J. Schwartz (euroinfosec) • August 31, 2016    

Attackers have been continuing to compromise banks' local security controls to send fraudulent messages via SWIFT's interbank messaging network.

See Also: Managing Identity, Security and Device Compliance in an IT World

That alert comes via a private letter sent from SWIFT to its customers on Aug. 30, warning that since June, it's cataloged multiple attempts by attackers to hack into banks' systems and issue fraudulent SWIFT transfers, reports Reuters, which obtained a copy of the letter. Some banks have lost money as a result, the letter reportedly notes.

Formally known as the Society for Worldwide Interbank Financial Telecommunication, SWIFT is a member-owned, Brussels-based collective. About 11,000 institutions in more than 200 countries use SWIFT's interbank messaging software and network.

A SWIFT spokesman declined to share a copy of the letter, but confirmed that "the cooperative has uncovered new cases of input fraud" that have been reported by clients since the February theft of $81 million from the central bank of Bangladesh's account at the Federal Reserve Bank of New York via fraudulent SWIFT messages.

"Whilst preserving the anonymity of the affected firms, the letter sets out how the attackers have followed a broadly similar modus operandi in these attacks, specifically tailoring every attack to each individual target," the spokesman tells Information Security Media Group.

The letter to customers does not specify which institutions were targeted, which attacks were successful or how much was stolen, he says.

"The letter explains that the targeted customers varied in size and geography; have used diverse connectivity methods and a range of interfaces from different vendors, but have all had particular weaknesses in their local security," he says. "These weaknesses have been identified and exploited by the attackers, enabling them to compromise the customers' local environments and input the fraudulent messages."

In the letter, SWIFT reiterates that there are no indications that its network or messaging services have been hacked, he says. SWIFT also indicates that its new customer security program, launched this past summer, has produced results. The spokesman, however, did not detail those results.

The letter also "warns customers that the cyber threat is persistent, adaptive and sophisticated, cautions customers that they are potentially at risk if they fail to ensure the physical and logical security of their environment, and sets out a number of measures they should take to protect themselves," the spokesman says.

According to Reuters, the letter also threatens to report banks to their regulators and banking partners if they don't meet a Nov. 19 deadline for installing updated SWIFT software that includes better user authentication, stronger password management rules, as well as better tools for detecting hacker attacks.

Who's at Fault?

Shortly after the Bangladesh Bank hack, similar SWIFT-related attacks came to light, including the theft of $12 million from Ecuador's Banco del Austro in January 2015 and the attempted theft of $1.4 million from Vietnam's Tien Phong Bank in late 2015.

Who's responsible for fraud via SWIFT? After it lost $81 million, Bangladesh Bank blamed SWIFT and the New York Fed. But both organizations have strongly rejected that assertion. Backed by Bangladesh police reports noting that the country's central bank lacked firewalls and used $10 second-hand switches to network its computers, SWIFT has called on all client banks to ensure that they're using strong security practices.

Bank Hacks: No Surprise

It's not surprising that some banks with poor security are getting hacked by attackers and potentially seeing millions of dollars get stolen via fraudulent SWIFT messages, asserts Alan Woodward, a computer science professor at the University of Surrey who's also a cybersecurity adviser to Europol, the EU's law enforcement intelligence agency.

"People don't seem to realize that - as that program says on the TV - you are the weakest link," he says. "It's down to the person who makes the most stupid mistake or the cheapest most insecure bit of equipment in your network - those are the sorts of things that people have really got to start thinking about seriously."

Professor Alan Woodward of the University of Surrey discusses fraud perpetrated via SWIFT.

How Much Power Does SWIFT Wield?

Some security experts contend that SWIFT has little power to hold banks accountable and that it's up to countries' banking regulators to ensure that their financial institutions have robust information security practices. In fact, regulators in some regions have already called on banks to outline how they're responding to these threats. For example, in April, the Bank of England reportedly ordered U.K. banks to detail their response plans.

In June, the Federal Reserve began auditing its effectiveness when it comes to ensuring that U.S. banks have robust information security policies, procedures and practices in place, including the ability to quickly detect and respond to data breaches. Multiple members of Congress have also been asking questions about banking security.

This month, the Federal Reserve, Office of the Comptroller of the Currency and the Federal Deposit Insurance Corp. instructed their examiners to pay closer attention to the security of banks' links to the SWIFT network, The Wall Street Journal reported.

Customer Security Program

Still, former members of SWIFT's management team and board have said the organization failed to do enough to secure communications sent via its network, according to a Reuters report (see Report: SWIFT Screwed Up). "It's a huge wake-up call," Leonard Schrank, who served as SWIFT's chief executive for 15 years until he left in 2007, told The Wall Street Journal in May, following the Bangladesh Bank heist. "They should play a higher role."

Since then, however, SWIFT appears to have begun moving in that direction. In late May, SWIFT launched a new customer security program designed to articulate best practices for using its software and urged banks to share more information about how they're being targeted, with SWIFT promising to share that information in anonymized form with other institutions.

Then in July, SWIFT announced the launch of an incident response team in collaboration with cybersecurity specialists BAE Systems and Fox-IT. The team will help hacked banks investigate intrusions and trace fraudulent SWIFT transfers and attempts (see SWIFT to Banks: Who You Gonna Call?).

Data centers aren't easy to secure, which makes them big targets for hackers. And it's challenging for defenders to keep abreast of near-constant changes in applications and data.

Defending the perimeter of the data center has been a major focus for information security teams. That's important, but keeping track of what's going on inside is also key, says Nathaniel Gleicher, a former U.S. government official who is now head of cybersecurity strategy at Illumio.

In an interview with Information Security Media Group, Gleicher says the best advice comes from Rob Joyce, who is head of the National Security Agency's Tailored Access Operations unit, which specializes in infiltrating networks. Joyce spoke at the Usenix Enigma computer security conference in January. "Sophisticated attackers know the data center, know their target network better than the defenders," Gleicher says. "If the attacker knows your network better than you do, you are already on your back foot and in a very, very difficult position."

Data center administrators have an advantage, though. They control the turf, and there are lessons that can surprisingly be taken from physical security, Gleicher says. A key first step is knowing the data center well and where the most sensitive information is located. Gleicher says no one would try to protect a physical space without a map, yet few organizations have a clear map of what's inside their data center.

"You would never try to defend something you couldn't see, and yet that's generally what we do in the context of cybersecurity," Gleicher says.

In this interview (see audio player below photo), Gleicher also discusses:

Why defending the inside of the data center is just as important as defending the perimeter; Why it's important to understand what's going on inside the data center, creating order from chaos; The importance of segmentation, which can block hackers from moving around if they get inside.

Gleicher is head cybersecurity strategy at Illumio, which specializes in securing data centers and cloud computing applications. Previously, Gleicher was director for cybersecurity strategy on the National Security Council at the White House. The attorney also formerly served as a federal cybercrime prosecutor with the U.S. Department of Justice.

Data Breach , Forensics , Fraud

All 62 Hotels and Many Restaurants Suffered POS Malware Infection Mathew J. Schwartz (euroinfosec) • September 1, 2016     Kimpton Morrison House hotel in Alexandria, Va.

Point-of-sale malware attacks: Another week, another hotel chain warning that it's suffered a malware-fueled data breach that led to the theft of customers' card data.

See Also: Detecting Insider Threats Through Machine Learning

This week's data breach notification comes from Kimpton Hotels & Restaurants, a boutique hotel and restaurant chain with 62 properties in about 30 U.S. cities. It's warning all customers that their payment card data and names may have been compromised via a POS malware infection that lasted nearly five months.

Kimpton couldn't be immediately reached for comment about how many payment cards were stolen or how many customers might have been affected.

The San Francisco-based chain's data breach notification, posted on Aug. 31 to Kimpton's website, says that it's working with law enforcement agencies to investigate and notes that it gave payment card issuers a heads-up on the breach to help them monitor for future fraud.

Based on a now concluded digital forensic investigation into the suspected breach, Kimpton's breach notification says that malware infected every one of the hotel's properties, potentially compromising cards used at front desks and many of the hotel's restaurants at various points between Feb. 16 to July 7.

Kimpton says it launched its investigation July 15 after receiving "a report ... of unauthorized charges occurring on payment cards after they had been used by guests at the restaurant in one of our hotels."

The hotel chain says it hired multiple cybersecurity firms to investigate. "Findings from the investigation show that malware was installed on servers that processed payment cards used at the restaurants and front desks of some of our hotels ... [that] searched for track data read from the magnetic stripe of a payment card as it was being routed through the affected server," Kimpton says. Compromised information included card numbers, expiration dates, internal verification code and "in a small number of instances" potentially also cardholders' names.

62 Properties Affected

Kimpton has published a list of affected properties and infection dates on its website. "We regret any inconvenience this may have caused," it says. Of course, affected cardholders may yet face future inconvenience as well.

Kimpton says that it's eliminated the malware from its systems, putting unspecified security improvements in place and also notifying customers directly for whom it has contact information. "Kimpton Hotels & Restaurants does not have information available to identify the name and address of restaurant guests. We will be mailing letters to those guests who used their card at a front desk during an at-risk time frame for whom we have a mailing address."

Linked to HEI Breach?

The breach confirmation from Kimpton - owned by InterContinental Hotels Group - comes just three weeks after hotel management firm HEI reported a POS malware breach affecting 20 U.S. hotels that it manages. The two incidents are potentially related, since the list of breached hotels managed by HEI includes properties it manages for InterContinental Hotels Group, as well as Hilton, Hyatt, Marriott and Starwood Hotels and Resorts (see Recent POS Attacks: Are They Linked?).

A spokeswoman for Kimpton couldn't be immediately reached for comment about how it learned about the breach, which cybersecurity firms it hired, whether its breach appears to be linked to the HEI breach, or which POS system supplier it uses.

The identity of Kimpton's POS supplier is potentially relevant, because Alex Holden, CISO at security and digital forensics firm Hold Security, recently discovered that 10 POS vendors had been compromised, including Cin7, ECRS, NavyZebra, PAR Technology and Uniwell. Holden told Information Security Media Group that the attacks date from mid-July and that "huge amounts of data - anywhere from 14 GB to 16 GB - was exfiltrated by hackers from most of the 10 identified POS providers," he said.

Holden's investigation was triggered by Oracle last month warning that it had found "malicious code in certain legacy MICROS systems." MICROS, which Oracle acquired in 2014, builds POS software and hardware that Oracle says is used across 330,000 customer sites in 180 countries (see MICROS Breach: What Happened?).

Follows Millennium, Noble Breaches

Kimpton is far from the only hotel chain to recently warn that it suffered a POS malware infection that compromised cardholder's payment card data. In late August, both Denver-based Millennium Hotels & Resorts North America and Noble House Hotels and Resorts, based in Kirkland, Wash., separately warned that they'd learned their systems had been breached. Both organizations said they learned of the breaches via the U.S. Secret Service (see POS Malware Hits Two Hotel Chains).

Neither hotel would comment on which POS vendor they used. But MHR's breach notification used language that closely paralleled Oracle's MICROS notification, noting that its "third-party service provider - that supplies and services the affected point-of-sale systems - [warned] that it had detected and addressed malicious code in certain of its legacy point-of-sale systems, including those used by MHR."

Their breaches follow a similar spate of POS malware infections at hotel chains in recent months that have affected Hilton, Hyatt, Starwood Hotels and Resorts, Omni Hotels & Resorts and Trump Hotels, among others.

ATM Fraud , Fraud

Asian Banks Get Stung; Expert Predicts More Attacks Jeremy Kirk (jeremy_kirk) • August 31, 2016     ATM in Bangkok. Photo: nist6dh (Flickr/CC)

Daniel Regalado, a FireEye senior staff malware researcher, had a feeling something was going wrong somewhere in the world when he saw the alert: A never-seen-before type of malicious software designed to steal money from ATMs had been detected.

See Also: Managing Identity, Security and Device Compliance in an IT World

An hour later, the first news report arrived: Three groups of men had scattered through six provinces in Thailand, commanding 21 ATMs to disgorge a total of 12 million baht ($350,000). (See New 'Ripper' Malware Fueled Thai ATM Attacks.) The incident had an eerie familiarity: In mid-July, $2.2 million was stolen from dozens of ATMs in Taiwan in a flash strike that sent shivers through the banking industry (see Taiwan Heist Highlights ATM Weaknesses).

Regalado, an expert in ATM malware, has watched as cybercriminals have had astounding ATM-draining success in countries such as Mexico and Ukraine. The attacks have highlighted the failings of some banks to secure their ATMs, most of which still run Microsoft's retired Windows XP operating system.

FireEye's alert was generated by a custom system it has developed that quickly classifies malware uploaded to Google's VirusTotal repository by its intentions. VirusTotal indicated that the malicious file, nicknamed "Ripper" by FireEye, had been uploaded from Thailand.

"It was like a movie, but it was real," Regalado says. "An hour later, I started seeing the news. I said, 'Wait a minute. Thailand.'"

One-Card Jackpot

Ripper isn't that different from other kinds of ATM malware, Regalado says. The aim of such programs is generally to direct the machine to dispense its cash, via what's often referred to as a "jackpotting" or "cash out" attack.

But the new malware has some key characteristics that link it to reported observations of the criminals in Thailand and Taiwan. News reports have indicated that the thieves used the ATM like anyone else, inserting a payment card into the ATM's slot. Regalado, who wrote a blog post detailing Ripper's innards, quickly suspected that Ripper was used in both incidents.

Digging into Ripper's code reveals what is going on. The criminals use EMV payment cards that have been encoded to authenticate the card to malware that's already been installed on the ATM. The chip says to the malware: "I'm here. Let's drain this machine."

Once an attacker inserts a special EMV card, the malware grants them access to a range of functions. By entering preset codes into the keypad, they can access a menu of options, including dispensing currency. There's also a twist to the malware: It disables network access to foil real-time anti-fraud detection systems on the bank's side.

Ripper's code doesn't indicate how it's installed on the ATMs, Regalado says. But the malware-distribution method became clear after one affected ATM vendor, NCR, provided the most detailed information yet on the Thailand attacks .

NCR says the network of Government Savings Bank, one of Thailand's largest financial institutions, was breached. Once the attackers were inside the bank's network, they delivered Ripper malware to ATMs via the bank's software distribution tool, built by InfoMindz. After related ATM heists were spotted, the bank reportedly shut down 3,300 of its NCR-built ATMs, which comprise nearly half of its 7,000-machine fleet. The bank says it expects to have the ATMs scrubbed and back in service in September.

One Ripper For All

Both FireEye and NCR have confirmed that Ripper is compatible with ATMs made by two other major vendors aside from NCR, although they have declined to identify the other two vendors. As far as ATM malware goes, Regalado says Ripper is unique because it works with all three vendors' ATMs with no customization.

All ATMs support APIs known as XFS, for Extensions for Financial Services, which is a middleware specification that defines how hardware on ATMs - including text displays, card readers, PIN pads, safes and dispenser units - talk to the host Windows operating system, Regalado says.

ATM vendors often run their own customized version of XFS. The developer of Ripper has coded the malware with an interface that adheres to the public XFS specification, allowing the malware to be cross-compatible with ATM vendor software but also, for example, talk to the cash dispenser.

Regalado says a way to stop this problem is to restrict ATMs' XFS implementations from talking to other XFS interfaces. "That way, these guys should not be able to just play with the standard," Regalado says.

Unfortunately, when an attacker issues a request via the XFS interface to dispense money, anti-virus software won't flag that request, Regalado says, because it looks like normal behavior. What needs to happen, he says, is for ATMs to begin authenticating interfaces, so that requests made by a new XFS interface would by default be blocked.

Cataloging ATM Weaknesses

ATM malware has been around since 2009, when Kaspersky Lab discovered malicious software called Skimer. But what is significant about the Taiwan and Thailand attacks is that both involved crews of criminals hitting fleets of ATMs, which had been pre-infected with malware, in coordinated strikes.

Experts have warned that ATMs have long been a weak point in the banking infrastructure. The use of the aging, embedded versions of Windows XP is one major problem, although that is not exclusively to blame.

Because ATMs are computers, the devices face various computer-attack vectors, including cracking open the lock to gain access to a USB port and exploiting insecure network configurations. Other attacks, meanwhile, have included dragging ATMs out of walls using chains attached to pickup trucks and later cracking open the interior safes with power tools. Some robbers, meanwhile, simply pump explosive gas into the machine.

Thieves blow up an ATM at a gas station in an attempt to steal cash.

It's time-consuming and expensive to upgrade or replace ATMs, so it's not surprising that criminals are finding success in far-flung locales where the banking infrastructure and related security practices may be less advanced.

FireEye's Regalado predicts more attacks will soon come. Even if cybercriminals who attempt to gain access to ATMs via a bank's internal network strike out, there are other potential weaknesses to exploit. Criminals can always attempt to recruit bank employees and ATM technicians, not least in less-developed countries.

"It is not only that those countries are running old machines, it is also easier in those countries to hire people to install the malware," Regalado says. "That is a perfect combination."

The way the U.S. federal government funds information technology served as a major contributor to last year's breach of computers at the Office of Personnel Management that exposed 21.5 million records, many of which included personally identifiable information of employees and contractors with security clearances, says Federal Chief Information Officer Tony Scott.

Congress, for the most part, funds federal civilian agencies to maintain their information systems, not to modernize them. "It's a culture of, what I call 'set it and forget it,'" Scott said at an Aug. 31 symposium on trustworthiness held at the National Institute of Standards and Technology in Gaithersburg, Md. "Go put something in, and then assume your work is done."

Scott says that approach was in play at OPM. "What you have is a recipe for high costs, cost overruns, projects that can't be completed or difficult to start and the whole litany of things that we all know historically have been true," the CIO says. "And, indeed, in OPM we found exactly that. We found there, and across the federal government, when we looked at it, projects that could have been done in one or two years were taking 10 years to do because they couldn't put together enough funding in one budget cycle or two budget cycles to do the needed work.

"And, you know what happens in 10 years: Management changes, priorities change, talent changes, all kinds of things change. So, any project that will take 10 years to do, probably is destined to failure."

In this report (click on player beneath image to listen), you'll hear Scott:

Describe a $3 billion Obama administration initiative to seed a fund that will allow agencies to borrow money to modernize their information technology; Discuss government guidance that requires agencies to be more diligent in assessing IT risk; and Defend OPM's leadership during and after the breach, in which he points out it was the implementation of an IT modernization program that enabled the agency to identify the breach.

Before President Obama tapped Scott to be chief information officer of the United States in February 2015, he led the global information technology group at VMware. Previously, he served as CIO at Microsoft and The Walt Disney Co. and chief technology officer of information systems and services at General Motors.