Business Continuity/Disaster Recovery , Cybersecurity , Governance

Vendor Security Alliance Formed to Improve Cybersecurity of Third-party Providers by Malwarebytes Labs Malwarebytes • October 11, 2016    

Nine technology companies—Uber, Docker, Dropbox, Palantir, Twitter, Square, Atlassian, GoDaddy, and Airbnb—have recently founded the Vendor Security Alliance (VSA), an independent, non-profit coalition that aims to help member companies evaluate or assess the security and privacy of third-party providers whom they heavily rely on and even entrust their users most important data with. They also have taken upon themselves to standardize and create a benchmark of acceptable cybersecurity practices vendors need to comply with.

If you may recall, criminals are able to compromise companies they're eyeing on by breaking into systems of third-party providers or subcontractors first. Such has been the case with the Target breach.

In a blog post, George Totev of Atlassian gives their readers a bird's eye view of how the group will be performing their duties:

We believe trust begins with transparency and accountability, and having an independent entity [to] manage this process for all its members will provide an efficient, common, and credible way of evaluating the vendors we all use. [For example] Each cloud company will be evaluated, audited, and scored based on a set of common criteria that measures cybersecurity risk, policies, procedures, privacy, vulnerability management, and data security.

Each year, VSA will be creating and pushing out a security and compliance questionnaire that companies can use to assess vendor risks based on a set of predetermined criteria (Note that only members of VSA can go through an independent auditing of vendors). Once scored, vendors can then use their VSA rating when offering their services, effectively skipping the process of verification done by prospective businesses.

VSA will make the first questionnaire available to the public on the 1st of October 2016.

Ken Baylor, President of VSA and Head of Compliance in Uber, explains why this alliance is an industry game changer:

Companies belonging to the VSA can draw on the collective expertise across the industry, gaining trust and verification of vendors' security practices. The VSA will also enable companies to save time and money through the use of a standardized cybersecurity evaluation with real-time answers. The current way of evaluating cybersecurity risks and approving vendors can take several months - the new VSA process cuts the process down to minutes.

It's important to mention that VSA is only one of several created security groups we have now that aim to address one part—particularly, third-party security compliance and risks—of a whole complicated cybersecurity problem we all face.

In March of 2009, eBay and ING announced the formation of the Cloud Security Alliance in order to promote best practices to assure secure cloud computing. Then in September of 2015, AirWatchformed the Mobile Security Alliance together with 10 other companies, aiming to mitigate the growing threat within the mobile threat landscape.

Endpoint Security , Risk Management , Technology

IoT Hackers Scoring Hits Using a 12-Year-Old OpenSSH Vulnerability Jeremy Kirk (jeremy_kirk) • October 14, 2016    

A long-known weakness in an authentication protocol shipped in millions of routers, surveillance devices and satellite antennae is being used in attempts to compromise accounts at popular web services, according to new research from Akamai.

See Also: Main Cyber Attack Destinations in 2016

The research findings add to concerns that hackers increasingly are using internet of things devices to stage attacks, a situation that experts say could be difficult or in some cases impossible to fix (see How an IT Pro Kicked Hackers Off Surveillance Cameras).

Akamai, which offers content delivery network services, says the equipment is being used as relays for "credential stuffing" attacks, where breached logins and passwords are used in an attempt to take over accounts. The IoT devices effectively act as proxies, masking the IP addresses from where the attacks actually originate.

The networking vendor cautioned that the technique is not a new vulnerability or attack, but that it has seen a dramatic rise in strikes against its customers.

"While this has been reported before, the vulnerability has resurfaced with the increase of connected devices," Akamai says in a 10-page technical report. "Our team is currently working with the most prevalent device vendors on a proposed plan of mitigation."

Although experts have warned that the increasing connectivity incorporated into devices will pose new security risks, the last couple of months have proved their predictions true. IoT devices are often poorly secured, ship with default login credentials and are never updated by manufacturers, making them more attractive targets than PCs, which are generally more secure.

In mid-September, devastating distributed denial-of-service attacks were launched that marshaled insecure devices. DDoS attacks flood online services with garbage data traffic, consuming resources and bandwidth with the goal of shutting services down (see Hacked IoT Devices Unleash Record DDoS Mayhem).

SSHowDowN

The situation described by Akamai doesn't involve DDoS attacks. The company began investigating a network video recorder that was sending suspicious traffic to its customers.

The device shipped with default passwords, which made it easy for attackers to take it over. Although users are encouraged to change default passwords, they're often left in place for as long as the devices lives.

Many IoT devices ship with OpenSSH, known as Secure Shell, which is a protocol that allows remote log in. This particular DVR wouldn't allow someone to gain access to SSH using the default credentials. But the SSH configuration does allow someone to use the device as a proxy and forward their attack traffic through the IoT device to another service.

This authentication bypass vulnerability, which can allow for what's called "port bouncing attack" has been known for at least 12 years. Although some devices can be fixed to eliminate the vulnerability, other IoT devices can't be fixed, writes Eric Kobrin, who is director of adversarial resistance at Akamai. The company nicknamed the attack SSHowDowN.

Some of the attack traffic came from routers made by Ruckus Wireless, which is now owned by Brocade Communications Systems. Ruckus issued an advisory and a patch in 2013.

"It was discovered that a malicious user could abuse the TCP tunneling feature of the SSH daemon on Ruckus devices to proxy random TCP streams," the advisory reads. "The user does not have to be authenticated to the Ruckus device for requesting and establishing such a tunnel. Once a tunnel is established, the user's TCP stream would be carried over SSH to the Ruckus device, which would forward the traffic to an IP and port of the user's choosing."

Akamai says it has seen attack traffic coming from CCTV cameras, NVRs, digital video recorders, routers, ASDL modems and network attached storage devices.

IoT Security Standards

Compromising IoT devices offers a layer of security for hackers. The services experiencing the attack see the IP address of the hacked device in their logs. The owner of the IoT unit invariably has no idea about the abuse.

ISPs can also detect attack traffic and alert customers whom they think may have an infected device on their network. But IoT devices, particularly older ones, may no longer be supported by manufacturers and receive no security updates. Users plug in the devices, and as long as they're functioning, forget them.

Efforts are underway to ensure that future generations of devices can't be compromised so easily. The Open Connectivity Foundation has developed a security framework that is designed to allow IoT devices to communicate securely. The group is aiming to develop standards as well as a certification program that can be used across the industry.

And there is a sense of urgency: Gartner predicts that by 2020, some 20.8 billion IoT devices will be in use, up from about 6.4 billion this year, adding to a massive pool of already insecure devices - which could cause headaches for years to come.

Anti-Malware , Payments , Risk Management

Now a Second Gang - Not Bangladesh Bank's Attackers - Is Gunning for Banks Mathew J. Schwartz (euroinfosec) • October 13, 2016    

A malware-wielding gang has been targeting financial firms' SWIFT software to inject fraudulent money-moving messages since at least January in "discreet campaigns" not tied to the Bangladesh Bank hack, security firm Symantec warns.

See Also: Avoid Theft of Your Privileged Credentials

The emergence of the targeted attacks, which rely on malware called Odinaff, is bad news for banks that rely on the SWIFT network to send money-moving messages. Symantec reports that the malware includes the ability to alter client-side logs used by SWIFT software. It says the attackers appear to be seeking high-value targets and attempting to avoid discovery, rather than pursuing mass-infection campaigns.

The Society for Worldwide Interbank Financial Telecommunication, as SWIFT is formally known, is a cooperative owned by 3,000 banks that bills itself as "the world's leading provider of secure financial messaging services." It's now used by more than 11,000 banks globally to process 25 million communications daily that collectively account for billions of dollars' worth of transfers.

The payoff for attackers who can inject fraudulent money-moving messages into SWIFT's network by hacking into PCs that interface with the network is clear: They can literally transfer themselves money.

A SWIFT spokesman tells Information Security Media Group that the organization is aware of the attacks and related modus operandi, as detailed by Symantec, and that its new customer security intelligence team has issued an alert to the organization's customers.

"We published related indicators of compromise and a practical example of the MO for our community earlier this summer," the spokesman says. "This work forms part of SWIFT's information sharing initiative, which has grown significantly since its launch, and which includes detailed intelligence and analysis on the modus operandi of attackers in customer fraud cases."

Life After the Bangladesh Bank Hack

Symantec's alert says at least two groups have been actively targeting SWIFT-using banks.

The first has been tied to the February hack attack against the central bank of Bangladesh that resulted in attackers stealing $81 million from Bangladesh Bank's account at the Federal Reserve Bank of New York via fraudulent SWIFT messages. That attack, and the discovery of similar, related attacks - before and after the Bangladesh Bank theft - sent shock waves through the financial services sphere, triggering concern from regulators and legislators around the world, and resulted in SWIFT taking a more active role in securing customers' use of its messaging network and related software.

Systems at Bangladesh Bank were infected by "Banswift" malware that allowed attackers to inject fraudulent money-moving messages into the SWIFT network. Attackers also employed trojanized PDF reader software that prevented details of the transactions from being printed out on the bank's printer, thus delaying the bank's discovery of the fraud.

Security experts have traced those attacks to the Lazarus Group, as first detailed in a February report into Operation Blockbuster that was coordinated by anti-fraud and analytics firm Novetta.

Inside Odinaff

The newly identified Odinaff attacks, however, work in a slightly different way and use entirely unrelated malware. For starters, Odinaff serves as a "dropper," meaning it allows attackers to download selected, additional attack tools onto victims' systems, Symantec's Security Response team says in a blog post. One such tool is a backdoor called Batle, Symantec says, which "is capable of running payloads solely in memory, meaning the malware can maintain a stealthy presence on infected computers.

"Symantec has found evidence that the Odinaff group has mounted attacks on SWIFT users, using malware to hide customers' own records of SWIFT messages relating to fraudulent transactions," the security firm says. "The tools used are designed to monitor customers' local message logs for keywords relating to certain transactions. They will then move these logs out of customers' local SWIFT software environment. We have no indication that [the] SWIFT network was itself compromised."

Symantec says this "suppressor" malware watches for "specific text strings," including dates and specific International Bank Account Numbers, or IBANs. It adds that another attack file that's been installed on infected systems can overwrite the first 512 bytes of a hard drive, which contains the Master Boot Record, or MBR, that the PC requires to boot. "We believe this tool is used to cover the attackers' tracks when they abandon the system and/or to thwart investigations," Symantec says.

The security firm hasn't revealed how many related infections it has seen, and it says it can't trace 60 percent of attacks to a specific industry. For those attacks that it has been able to trace, one-third have targeted financial services firms, Symantec says. Organizations in the United States have been most frequently targeted, followed by Hong Kong, Australia, the United Kingdom and Ukraine.

Multiple Malware Distribution Techniques

Odinaff is being distributed in multiple ways, including via spear-phishing documents that contain a malicious Microsoft Office macro. If the user has left macros disabled - as security experts recommend - then the lure document tries to trick them into turning macros on.

The Odinaff lure document tries to trick viewers into enabling macros in Microsoft Word (source: Symantec).

Symantec says the malware is also being distributed via botnets as well as hidden inside "a Trojanized installer for AmmyyAdmin, a legitimate remote administration tool." The website that distributes AmmyyAdmin has been repeatedly hacked in recent months, with various types of malware hidden inside the software that users can download.

Potential Carbanak Tie

Three command-and-control IP addresses used to control infected Odinaff endpoints were previously used by C&C servers tied to Carbanak malware campaigns, Symantec says. The Carbanak gang was tied to at least $1 billion in fraud from 2012 to 2014, and it appears to have made a comeback starting in 2015 with a range of attacks tied to point-of-sale devices.

Of those three IP addresses, Symantec adds, one was previously used in the massive Oracle MICROS breach, which some security experts have attributed to the Carbanak gang. The reused IP addresses may only have been rented from a third-party cybercrime service provider, although Symantec said that "the infrastructure crossover is atypical, meaning it could also be a similar or cooperating group."

Another theory, however, is that the Carbanak gang has been diversifying from banking Trojan infections into targeting SWIFT-using banks and is now running a compartmentalized, highly targeted operation using Odinaff that can access and manipulate SWIFT logs and inject fraudulent money-moving messages into the SWIFT network.

Audit , Governance , Insider Threat

Rep. Chaffetz, Victim of a Secret Service Insider Breach, Describes IG Audit as 'Alarming' Eric Chabrow (GovInfoSecurity) • October 14, 2016     Rep. Jason Chaffetz (left) and Secret Service Director Joseph Clancy

"Unacceptable vulnerabilities" exist in the U.S. Secret Service's information technology, leaving systems susceptible to potential unauthorized employee access, the Department of Homeland Security inspector general says.

See Also: API vs. Proxy: Understanding How to Get the Best Protection from Your CASB

An IG audit uncovered numerous problems with Secret Service's IT management, including inadequate system security plans; systems with expired authorities to operate; inadequate access and audit controls; noncompliance with logical access requirements; inadequate privacy protections; and over-retention of records.

The IG contends that Secret Service's IT management is ineffective because it has historically not given it priority. According to the audit, the Secret Service CIO's office lacks authority for all IT resources and is not effectively positioned to provide necessary oversight. In addition, agency gives inadequate attention to updating IT policies and Secret Service personnel are not receiving adequate training regarding IT security and privacy. The IG made 11 recommendations, and the Secret Service agreed to take the recommended corrective actions.

The investigative report, made public Oct. 14, follows an earlier IG audit into Secret Service employees improperly accessing and disclosing information about Rep. Jason Chaffetz, the Utah Republican who chairs the House Oversight and Government Reform Committee, which monitors Secret Service operations.

Insider Breach Remains Possible

"Today's report reveals unacceptable vulnerabilities in Secret Service's systems," DHS Inspector General John Roth says. "While Secret Service initiated IT improvements late last year, until those changes are fully made and today's recommendations implemented, the potential for another incident like that involving Chairman Chaffetz' personal information remains."

The Secret Service is a unit within DHS.

In September 2015, the IG issued a partially redacted report that said 45 agents accessed Chaffetz' 2003 application to be a Secret Service agent - he wasn't hired - though only four of them had an "arguable legitimate need to access the data." (See IG Reopens Probe Into Secret Service Agents Spying on Chaffetz Files.) The first unauthorized query of Chaffetz' name in the Secret Service database, made by a senior Secret Service agent, occurred 18 minutes after Chaffetz convened a March 24, 2015, hearing on the Secret Service concerning allegations that two agency supervisors breached a crime scene and may have been drunk. Chaffetz was elected to Congress in 2008.

Chaffetz issued a statement characterizing the latest audit issued Oct. 14 as "alarming."

Unaccountable Leadership

"The Secret Service believes they have a core mission to protect the nation's financial infrastructure from cyber-related crimes, yet can't keep their own systems secure," Chaffetz says. "Despite past warnings, USSS is still unable to assure us their IT systems are safe. The loss or theft of law enforcement sensitive information is disastrous and jeopardizes witnesses involved in criminal cases or the identities of undercover officers, or worse. USSS's cyber-related responsibilities should be moved elsewhere. They lack the right personnel to do the job and senior leadership isn't accountable."

That lack of leadership was raised last year with the earlier audit.

A year ago, the IG's office said it reopened the investigation into the agency's IT management because Secret Service Director Joseph Clancy had a different "recollection of the events in question" than what he told the IG when interviewed on July 17, 2015. Clancy was unaware of the unauthorized access until shortly before the media published accounts of it, according to the IG report. Clancy served 27 years in the Secret Service until retiring in 2011. President Obama appointed Clancy the agency's director in February 2015.

Eliminating the Insider Risk

The new audit points out that the Secret Service must make IT a priority, including implementing an IT governance framework that addresses, at a minimum, the IT organizational and management deficiencies identified in this report. That, the IG report says, would require the Secret Service leadership to fully understand and address the potential for insider-threat risks, not only from system administrators and inadequately managed IT contractors, but also from employees and business partners.

Assistant Inspector General Sondra McCauley, writing in the report, says the Secret Service's new CIO - Kevin Nally - is aware of the severity of the issues and has begun to formulate a strategic plan to address long-standing IT deficiencies. "Time will tell how effective these efforts prove in changing the USSS culture so that a premium is placed on ensuring a holistic information security program with effective technical, operational and management controls," she says.

CISO , Cybersecurity , Governance

Mandates for CISOs, Breach Notification Are Too Prescriptive, Some Argue Tracy Kitten (FraudBlogger) • October 14, 2016    

In January, banks and other financial services companies based in New York may have to comply with tough new cybersecurity requirements outlined in what Gov. Andrew Cuomo says would be the nation's first state regulation designed to help thwart cyberattacks against the financial sector.

See Also: Hide & Sneak: Defeat Threat Actors Lurking within Your SSL Traffic

"This regulation helps guarantee the financial services industry upholds its obligation to protect consumers and ensure that its systems are sufficiently constructed to prevent cyberattacks to the fullest extent possible," Gov. Cuomo says of the New York State Department of Financial Services' proposal, announced last month.

But some critics contend that New York's regulatory proposal is far too prescriptive, making it challenging for banking institutions, especially smaller ones, to comply.

"Banks continue to use limited resources to keep up with regulations that bring us no closer to actual results," says Ted Tomita, CTO of Catskill Hudson Bank in Monticello, N.Y. "For smaller institutions, these regulations make it very difficult to operate. Meanwhile, larger institutions absorb this as a minor inconvenience."

New York's proposed new regulation, if left unchanged, will require that every New York banking institution, regardless of size, hire or designate a "qualified" CISO to oversee the institution's cybersecurity program. It also will require institutions to notify the state within 72 hours of any cybersecurity event that could impact business or consumer privacy.

Other requirements in the new regulation - including mandatory multifactor authentication for all employees, contractors and others who've been granted privileged access to internal systems as well as encryption of all nonpublic information that is stored or transmitted - are listed on the state department's website.

The state is accepting comments on the proposed regulation until the end of October, after which it could make refinements before the regulation is finalized.

Far Different Approach Than FFIEC

Unlike New York, the Federal Financial Institutions Examination Council has taken a less prescriptive approach to cybersecurity, focusing on outlining best practices instead (see FFIEC Plans Cybersecurity Assessments, FFIEC Issues Cyber Assessment Tool and FFIEC Issues Cyber-Resilience Guidance).

Rather than mandating, for instance, that all institutions have a CISO, the FFIEC recommends that institutions ensure that all executives and staff have "clearly defined roles and responsibilities" that carry with them assigned accountability "to identify, assess and manage cybersecurity risks."

By comparison, the state of New York is coming across like a micromanager, argues Avivah Litan, a financial fraud expert who's an analyst at the consultancy Gartner.

"The FFIEC has been at this much longer than New York state and has taken a more seasoned risk-based approach that reflects a deeper and more practical understanding of the different profiles of the wide range of banks - small and large - that they regulate," she says. "I don't think the FFIEC will move backwards and demand banks appoint CISOs, especially when they are not staffed for such functions. The banks that need CISOs -generally the larger banks - already have them. And some have multiple CISOs for different areas."

The proposed New York regulation, Litan argues, "reads more like a checklist of compliance requirements that reminds me of the PCI standard, which is a step backwards from the FFIEC's cybersecurity assessment guidelines. The FFIEC guidelines, which rightfully leverage NIST standards, demand a comprehensive, risk-based approach and assessment."

CISO Requirement Criticized

Tomita of Catskill Hudson Bank argues that requiring banks to designate a "qualified" CISO won't improve cybersecurity.

"At the end of the day, it's simply a title and 'qualified' is open to interpretation," he says. "Financial institutions are facing new challenges every day. Having someone who can understand the unique risks of their institution and implement the proper tools to address those risks is critical to having an effective security program."

Austin Berglas, head of cyber defense at cyberthreat intelligence firm K2 Intelligence, predicts the state will receive many questions during the comment period about the proposed requirement for institutions to designate a qualified CISO.

"The role of a CISO can mean different things to different organizations depending on size, internal structure and needs," he says. "The CISO role is commonly described as a senior-level position responsible for establishing and maintaining the organization's strategy and program to ensure assets are properly protected. Depending on the size and sophistication, some organizations may view this role as a more strategic versus technical role."

Breach Notification

Cybersecurity attorney James Pastore, a litigation partner at the New York law firm Debevoise & Plimpton, contends the proposed New York regulation's provision for breach notification is unrealistic.

"The 72-hour notice period is both short and broad," he says. "Victims of an 'actual or potential' incident rarely have many facts at that point, and if NYDFS [New York Department of Financial Services] really wants to hear about every potential unauthorized access, they will need a hotline."

The regulation also contains a built-in "tripwire," Pastore notes. Any call to another government agency, such as law enforcement, automatically requires notice to NYDFS. "That may chill some calls to law enforcement and will not help the existing tension between the company being treated as a hacking victim on the one hand and being treated by regulators as negligent for losing customer data on the other," he says.

President Obama sharing his thoughts on the intersection of artificial intelligence, medical viruses and cybersecurity leads this edition of the ISMG Security Report.

In the report, you'll hear (click player above to listen):

The ISMG Security Report appears on this and other ISMG websites on Tuesdays and Fridays. Be sure to check out our Oct. 7 and Oct. 11 reports, which respectively analyze the PCI Security Standards Council's new requirements that are designed to help thwart attempts to defeat encryption in point-of-sale devices and Hillary Clinton's and Donald Trump's head-to-head clash over purported Russian hacks. The next ISMG Security Report will be posted on Tuesday, Oct. 18.

Theme music for the ISMG Security Report is by Creative Commons license.