Equifax Security Breach Is A Complete Disaster... And Will Almost Certainly Get Worse

from the hang-on... dept

Okay, chances are you've already heard about the massive security breach at Equifax, that leaked a ton of important data on potentially 143 million people in the US (basically the majority of adults in America). If you haven't, you need to pay more attention to the news. I won't get into all the details of what happened here, but I want to follow a few threads:

First, Equifax had been sitting on the knowledge of this breach since July. There is some dispute over how quickly companies should disclose breaches, and it makes sense to give companies at least some time to get everything in order before going public. But here it's not clear what Equifax actually did. The company has seemed almost comically unprepared for this announcement in so many ways. Most incredibly, the site that Equifax set up for checking if your data has been compromised (short answer: yeah, it almost certainly was...) was on a consumer hosting plan using a free shared SSL certificate, a funky domain and an anonymous Whois record. And, incredibly, it asked you for most of your Social Security Number. In short, it's set up in a nearly identical manner to a typical phishing site. Oh and it left open the fact that the site had only one user -- "Edelman" -- the name of a big PR firm.

Not surprisingly, it didn't take long for various security tools to warn that the site wasn't safe.

And, when Equifax pushed people to its own "TrustedID" program to supposedly check to see if you were a victim of its own failures... it just started telling everyone yes no matter what info they put in:

So, yeah, what the hell did Equifax do during those six weeks it had to prepare? Oh, well, a few of its top execs used the delay to sell off stock, which may put them in even more hot water (of the criminal variety). Also, just days before it revealed the breach, and long after it knew of it, the company was talking up how admired its CEO is. This is literally the last tweet from Equifax prior to tweeting about the breach (screenshotted, because who knows how long it'll last):

I can't see any scenario under which Smith keeps his job. And it seems likely that many other execs are going to be in trouble as well. Beyond the possible insider trading above, there's already scrutiny on its corporate VP and Chief Legal Officer, John J. Kelley, who made $2.8 million last year and runs the company's "security, compliance, and privacy" efforts.

And despite six weeks to prepare for this, the following was Equifax's non-apology:

We apologize to our consumers and business customers for the concern and frustration this causes.

That's a classic non-apology. It's not apologizing for its own actions. It's not apologizing for the total mess it's created. It's just apologizing if you're "concerned and frustrated."

Oh, and did we mention that the very morning of the day that Equifax announced the breach, it tweeted out about a newsletter it published about how "safeguarding valuable customer data is critical." Really (again, screenshotted in case this disappears):

What the fuck, Equifax? Should we even mention that Equifax has been a key lobbying force against data breach bills? Those bills have some problems... but, really, it's not a good look following all of this.

And while there was some concern that signing up to check to see if you were a victim (again: look, you probably were...) would force you out of being a part of any class action lawsuit, that's since been "clarified" to not apply to any class action lawsuits over the breach. And you better believe that the company is going to be facing one heck of a class action lawsuit (a bunch are being filed, but they'll likely be consolidated).

That's all background of course. What I really wanted to discuss is how this will almost certainly get worse before it gets better. More than twelve years ago, I wrote that every major data breach is later revealed to be worse than initially reported on. This has held true for years and years. The initial analysis almost always underplays how serious the leak is or how much data is leaked. Stay tuned, because there's a very high likelihood we'll find out that either more people were impacted or that more sensitive information is out there.

And that should be a major concern, because what we already know here is stunning. As Michael Hiltzik at the LA Times noted, this is the mother lode of data if you want to commit all sorts of fraud:

The data now at large includes names, Social Security numbers, birthdates, addresses and driver’s license numbers, all of which can be used fraudulently to validate the identity of someone trying to open a bank or credit account in another person’s name.

In some cases, Equifax says, the security questions and answers used on some websites to verify users’ identity may also have been exposed. Having that information in hand would allow hackers to change their targets’ passwords and other account settings.

Other data breaches may have been bigger in terms of total accounts impacted, but it's hard to see how any data breach could have been this damaging. For over a decade, we've pointed out that credit bureaus like Equifax are collecting way too much data, with zero transparency. In fact, back in 2005, we wrote about Equifax itself saying that it was "unconstitutional and un-American" to let people know what kind of information Equifax had on them. The amount of data that Equifax and the other credit bureaus hold is staggering -- and as this event shows, they don't seem to have much of a clue about how to actually secure it.

At some point, we need to rethink why we've given Equifax, Experian and TransUnion so much power over so much of our everyday lives. You can't opt-out. They collect most of their data without us knowing and in secret. You can't avoid them. And now we know that at least one of them doesn't know how to secure that data.

Filed Under: cybersecurity, fraud, leak, security, security breach
Companies: equifax

FDA, Homeland Security Issue First Ever Recall, Warnings About Flimsy Pacemaker Security

from the your-heart-attack-has-an-IP-address dept

We've well established that the internet of things (IOT) market is a large, stinky dumpster fire when it comes to privacy and security. But the same problems that plague your easily hacked thermostat or e-mail password leaking refrigerator take on a decidedly darker tone when we're talking about your health. The health industry's outdated IT systems are a major reason for a startling rise in ransomware attacks at many hospitals, but this same level of security and privacy apathy also extends to medical and surgical equipment -- and integral medical implants like pacemakers.

After a decade of warnings about dubious pacemaker security, researchers at Medsec earlier this year discovered that a line of pacemakers manufactured by St. Jude Medical were vulnerable to attacks that could kill the owner. The researchers claimed that St. Jude had a history of doing the bare minimum to secure their products, and did little to nothing in response to previous warnings about device security. St. Jude Medical's first response was an outright denial, followed by a lawsuit against MedSec for "trying to frighten patients and caregivers."

Ultimately, the FDA was forced to issue its first ever warning about the security of a pacemaker earlier this year, though the agency somewhat downplayed the potentially fatal ramifications:

"The FDA has reviewed information concerning potential cybersecurity vulnerabilities associated with St. Jude Medical's Merlin@home Transmitter and has confirmed that these vulnerabilities, if exploited, could allow an unauthorized user, i.e., someone other than the patient's physician, to remotely access a patient's RF-enabled implanted cardiac device by altering the Merlin@home Transmitter. The altered Merlin@home Transmitter could then be used to modify programming commands to the implanted device, which could result in rapid battery depletion and/or administration of inappropriate pacing or shocks."

Inappropriate, indeed. St. Jude Medical has since been acquired by Abbott Laboratories, and back in April the FDA sent a warning to Abbott that it needed to design a comprehensive plan to fix the flaw (first revealed in August of last year) within fifteen days. That was followed up with a formal, voluntary recall notice issued by the FDA regarding the impacted pacemaker, believed to be the first such warning of its kind. In its warning, the FDA urged the estimated 400,000 owners of this pacemaker model to schedule a physician appointment for a firmware update, lest they find themselves quite literally hacked.

The FDA's alert was also joined by a warning by the Department of Homeland Security outlining the problem as such:

"The pacemaker’s authentication algorithm, which involves an authentication key and time stamp, can be compromised or bypassed, which may allow a nearby attacker to issue unauthorized commands to the pacemaker via RF communications....The pacemakers do not restrict or limit the number of correctly formatted “RF wake-up” commands that can be received, which may allow a nearby attacker to repeatedly send commands to reduce pacemaker battery life."

Comforting. Many security experts have been quick to point out that this may be the turning point at which companies finally begin taking these sorts of problems more seriously. But the lengths it took to bring us to this point are downright comical, involving MedSec going so far as to at one point short St. Jude stock to bring necessary attention to the problem. Hopefully, the entire saga is a shot over the bow that other security-apathetic medical impact manufacturers will wisely heed.

Filed Under: cybersecurity, dhs, fda, pacemakers, security
Companies: st. jude medical

Contractor Exposes Personal Information Of 1.8 Million Chicago Voters On AWS

from the oops dept

At some point, it seems clear that if Chris Vickery comes a-callin', you've screwed up when it comes to keeping the private information of customers/voters secure. Vickery works for Upguard, a cyber-security consulting firm that regularly seeks out insecure sites and works with their owners to secure them. Vickery's fingerprints have been on discoveries such as Verizon's exposure of the personal information of 6 million of its customers and a firm contracted by the GOP exposing the personal data of roughly every American voter everywhere.

And now Vickery and Upguard have found that a contractor managing the city of Chicago's voter rolls appears to have exposed more personal information on an AWS server.

The acknowledgment came days after a data security researcher alerted officials to the existence of the unsecured files. The researcher found the files while conducting a search of items uploaded to Amazon Web Services, a cloud system that allows users to rent storage space and share files with certain people or the general public. The files had been uploaded by Election Systems & Software, a contractor that helps maintain Chicago's electronic poll books.

Election Systems said in a statement that the files "did not include any ballot information or vote totals and were not in any way connected to Chicago's voting or tabulation systems." The company said it had "promptly secured" the files on Saturday evening and had launched "a full investigation, with the assistance of a third-party firm, to perform thorough forensic analyses of the AWS server."

So, a couple of things to note here. First, while it's true no voting information was exposed, a good deal of personal information certainly was. Names, addresses, last four digits of social security numbers; you know, all of the things one would need to wreak havoc on a person using their identifying information. Second, it appears that "promptly securing" the files mostly had to do with actually having a password needed to access them. There was no hacking required for Vickery to get to these files, because there was no password protecting them. Great.

Now, where I will give ES&S credit is that they are working with Upguard, rather than trying to vilify it, as we've seen done to so many other security researchers. That's a good thing. Still, Chicago officials are pretty pissed off.

"We were deeply troubled to learn of this incident, and very relieved to have it contained quickly," Chicago Election Board Chairwoman Marisel A. Hernandez said in a statement. "We have been in steady contact with ES&S to order and review the steps that must be taken, including the investigation of ES&S' AWS server. We will continue reviewing our contract, policies and practices with ES&S. We are taking steps to make certain this can never happen again."

Allen added that the board is considering how to notify and potentially offer remedies to those whose information was exposed.

"The expense for that is going to be borne by ES&S," Allen said. "This was a violation of the contract terms that explicitly lay out the requirement to safeguard the voters' data."

It's a wonder to this writer that the constant calls for things like e-voting machines continue when those in charge of securing voter data can't even do that right.

Filed Under: aws, chicago, chris vickery, cybersecurity
Companies: upguard

Oversight Report Shows NSA Failed To Secure Its Systems Following The Snowden Leaks

from the NSA-officials:-'feel-good-story-of-2015,-etc.' dept

It appears the NSA hasn't learned much since Ed Snowden left with several thousands of its super-secret documents. Agency officials were quick to claim the leaks would cause untold amounts of damage, but behind the scenes, not much was being done to make sure it didn't happen again.

A Defense Department Inspector General's report obtained via FOIA lawsuit by the New York Times shows the NSA fell short of several security goals in the post-Snowden cleanup. For an agency that was so concerned about being irreparably breached, the NSA still seems primed for more leakage. Charlie Savage reports:

The N.S.A. failed to consistently lock racks of servers storing highly classified data and to secure data center machine rooms, according to the report, an investigation by the Defense Department’s inspector general completed in 2016. The report was classified at the time and made public in redacted form this week in response to a Freedom of Information Act lawsuit by The New York Times.

The agency also failed to meaningfully reduce the number of officials and contractors who were empowered to download and transfer data classified as top secret, as well as the number of “privileged” users, who have greater power to access the N.S.A.’s most sensitive computer systems. And it did not fully implement software to monitor what those users were doing.

Let's not forget the NSA wants to be engaged in ensuring the cybersecurity of the nation. It's repeatedly asked for more power and a better seat in the CyberWar room. But it doesn't even take its OWN security seriously. The NSA told its oversight it was engaging in 40 "Secure the Net" initiatives, directly after the first Snowden leak. Two years later, it told Congress it had completed 34 of 40 STN initiatives. The term "completion" apparently has multiple definitions, depending on who's using the word. The IG sampled only seven of the initiatives and found four were mostly done and three were nowhere near completed. Extrapolating from the sampling, it's safe to assume the NSA's internal security efforts are only slightly more than half-baked.

The three the NSA failed to implement are of crucial importance, especially if it's looking to keep its in-house documents safe at home. From the report [PDF]:

NSA officials did not effectively implement three PRIVAC [Privileged Access]-related STN initiatives:

- fully implement technology to oversee privileged user activities;

- effectively reduce the number of privileged users; and

- effectively reduce the number of authorized DTAs [Data Transfer Agents].

First off, the NSA -- prior to the Snowden leaks -- had no idea how many users had privileged access. Post-Snowden, things hardly improved. Considering the tech capabilities of the agency, it's incredibly amusing to see how the NSA "tracked" privileged users.

NSA officials stated they used a manually kept spreadsheet, which they no longer had, to identify the initial number of privileged users.

Pretty much useless, considering this number the NSA couldn't verify (thanks to its missing spreadsheet) was supposed to be used to establish a baseline for the planned reduction in privileged users. Despite missing this key data, the NSA moved ahead, "arbitrarily revoking access" and asking users to reapply for privileged status. It then reported a reduction by citing the number of users it denied restoration of access privileges. It did not factor in any new users it granted privileged access to or tally up the number of accounts it never bothered to revoke.

As the fully-redacted chart presumably points out (according to the text above it), the NSA had a "continued and consistent increase in the number of privileged users once the [redacted] enrollment process began."

The NSA also claimed it had reduced the number of DTAs. And again, the NSA had no receipts.

Although repeatedly requested, NSA officials could not provide supporting documentation for the total number of DTAs before and after the purge or the actual number of users purged.

The NSA's objectively-terrible internal controls (again) ensured no number could be verified.

NSA did not know how many DTAs it had because the manually kept list was corrupted during the months leading up to the security breach.

The NSA handled these missing numbers the same way it had privileged users: it made up a new baseline, arbitrarily decided it could show a downtrend in DTAs, and delivered this as "proof" of another completed security initiative.

The report points out repeatedly the NSA's failure to provide documentation backing its STN claims -- either from before the initiatives took force or after they supposedly hag been completed. The IG's comments note the NSA's response to the report ignored its detailed description of multiple failures in order to spin this as a "win" for the agency.

Although the Director, Technology Directorate NSA/CSS Chief Information Officer, agreed, he did not address all the specifics of the recommendation. Therefore, we request that the director provide additional comments on the final report that identify specific actions NSA will take.

Here's how the NSA portrayed the report's findings:

While the Media Leak events that led to Secure the Net (STN) were both unforeseen and serious, we consider the extensive progress we made in a short time to be a "good news" story.

Sure, if you consider a half-done job securing NSA assets to be "good news," rather than just an ongoing series of security holes left halfway unplugged while agency officials testify before Congressional oversight in front of a "MISSION ACCOMPLISHED" banner backdrop.

Filed Under: cybersecurity, ed snowden, nsa, security

As The Battleground For Warfare Moves To Cyberspace, DOD Contemplates Altering Recruitment Requirements

from the getting-basic dept

While we've viewed much of the hyped up discussions about cyberwarfare with some trepidation here, we now live in a reality where it would be clearly silly to suggest that the internet and internet-connected devices are not an emerging battleground for rival nations. While much was made these past few years about what mostly amounted to the penetration of private business networks, the discussion about several democratic elections throughout the country and the clear interference in them, potentially by state actors, has pushed the overdrive button on all of this. As you can imagine, groups in charge of defense for the nations of the world have been paying attention, including the US Department of Defense.

But it seems the DoD has a problem: it isn't meeting its recruitment goals for its Cyber Command division.

The US military is having a hard time getting people with essential information technology and information security skill sets as the services struggle to build a force of "cyber-warriors." During a Senate Armed Services Committee hearing today, senators focused in part on how the work force problem is affecting the US Cyber Command's (US CYBERCOM's) ability to deal with the demands of information warfare and threats both to the Defense Department's networks and those of other agencies and industry.

The goal put in place for the DoD was to have CYBERCOM fully operational by 2018. Michael Rogers stated at the hearing that he believed that goal could still be met, but the larger problem of keeping CYBERCOM operational was driven by a lack of bulk in qualified personnel. Senator John McCain noted part of the problem is that CYBERCOM officers slated for duty have routinely been rotated out of that role when deployed on tour. It seems there isn't a full commitment by some branches of the military that are likewise generally hurting for bodies. The partnerships the DoD has forged with organizations like the National Science Foundation, the Office of Personnel Management, and DHS to promote its CyberCorps scholarship program haven't managed to fill the ranks, either.

Mostly, this comes down to recruiting requirements.

But as Rogers noted in his testimony, "We need a broad range of skills, and many of the best candidates won't necessarily have advanced educations but have deep experience in the field." And the problem won't be fixed with the military's current approach to workforce development, Rogers acknowledged. "We can't keep relying on five- to ten-year development cycles in terms of manpower," he said.

That will require a radical departure from the military's usual approach to recruiting—particularly since few people who already have the skills the DOD wants would be drawn to the typical military recruitment cycle. People who are usually drawn to the military would require years of training to meet the services' needs. But Rogers was insistent that, whatever the solution, it wouldn't be a separate "cyber force," because the military needs personnel who had the context of the overall mission. Only people embedded in the military would have that.

Except that this sentiment is belied by some of the proposed changes to recruitment currently be considered by the DoD. The headline-grabber of these proposals is the one that would allow new recruits for CYBERCOM to skip basic training altogether.

One of the possible solutions that the DOD has looked at is bringing people with experience and skills essential to offensive and defensive cyber operations into the service "laterally." That means giving them ranks (and pay grades) commensurate to their skills and entirely bypassing the normal recruitment and advancement process.

Even the Marine Corps, which has long required all marines to go through the same basic rifleman training, is considering changes. The potential changes include allowing people with sought-after skills to enter the Corps directly as noncommissioned officers and skip boot camp.

There is some precedent for this, though that precedent doesn't translate particularly well. The Ars post refers to how the Marines have allowed recruits for the Marine Corps Band to join with this kind of lateral entry, where recruits simply audition for the band as opposed to going through basic training. But that sort of lateral entry is worlds away from having active soldiers in the ranks that are actively engaged in what the DoD claims is a pivotal battlefield as opposed to playing Hail to the Chief in the Rose Garden. The dropping of basic training would need to be coupled with a relaxed education requirement, as many of the most talented individuals in technology can often boast an almost clean slate of educational achievement, while still being the best at what they do.

Regardless, we talk all the time about how technology drives change and innovation. It seems even the military branches are not immune from this.

Filed Under: cybercommand, cybersecurity, defense department, recruitment

Trump Orders The Cyber To Be Fixed In The Next Sixty Days

from the all-power-to-C:-drive dept

No one likes it when a new boss takes over the office and starts acting like the entire operation can be turned around in a matter of days, if not hours. A "can do" spirit is overrated, especially when it's possessed by someone who knows almost nothing about the day-to-day business or, indeed, anything about this sort of business in general.

But that's what we have going on here. Within days of taking over the job, the new President has unleashed multiple orders and directives to FIX EVERYTHING… with details to follow sometime between "shortly" and "never." The plan to "make America great again" involves:

1. Telling Americans you're going to "fix" all of these things.
2. Telling government agencies and officials that they're going to fix all these things
3. Right now
4. ????

Ars Technica reports:

Today, the Washington Post published what appears to be a draft of an executive order to be signed by President Donald Trump. The order, entitled “Strengthening US Cyber Security and Capabilities,” puts flesh on the bones of the “cyber review” promised by Trump during the campaign. It spells out who will conduct the review and what its specific goals are. The order also sets a brisk pace for the review, calling for initial recommendations for the security of “national security systems” and critical infrastructure within 60 days. The review also has a 60-day deadline to provide the president with a list of “principal cyber adversaries.”

While fire in the belly proclamations aren't unique to the new president, the expectation that multiple officials and agencies will be able to come up with what's required in the next 60 days borders on ridiculous. There's also a 100-day window for recommendations on how to draft the private sector into the government's cyberwar. At this point, multiple agencies are still fighting over who gets to be the top cyberwarrior, as well as whose particular data silo gets to be the biggest. Expecting something coherent in the next couple of months is delusional.

This administration-ordered time crunch -- as unrealistic as it is -- isn't limited to President Trump. As Ars Technica's Sean Gallagher points out, President Obama did the same thing. His 2015 cybersecurity "sprint" order was just as misguided. In the end, all Obama got out of it was some agency head resignations. Government systems are still, for the most part, as insecure as they've been since before the "sprint," when the Government Accountability Office reported that 23 out of 24 agencies surveyed failed to meet information security standards.

But this sort of speedy order is swiftly (no pun intended) becoming a Trump trademark. America's problems can apparently be solved with presidential "to do" lists fired off to a variety of agencies. He appears to believe that if he orders it, it will be done. How do you win the War on Terror, currently in year 16 of ∞? Easy. Come up with a plan to win and then win.

(ii)   Within 30 days, a preliminary draft of the Plan to defeat ISIS shall be submitted to the President by the Secretary of Defense.

(iii) The Plan shall include:

(A) a comprehensive strategy and plans for the defeat of ISIS;

It's breathtaking in its simplicity. It's a shame no previous presidents had the forethought to demand a plan to defeat ISIS. And it's doubly-shameful no one involved in the War on Terror could be bothered to formulate a plan for beating terrorists until the president demanded one. Trillions of taxpayer dollars could have been saved if only George W. Bush had demanded a "comprehensive strategy for the defeat of [current top terrorist organization]" to be delivered to him by the end of 2001, AT THE LATEST.

And here's what's going into these orders and directives. Not much. Not even a legal review by White House lawyers.

NBC is reporting that the document [immigration/visa order] was not reviewed by DHS, the Justice Department, the State Department, or the Department of Defense, and that National Security Council lawyers were prevented from evaluating it. Moreover, the New York Times writes that Customs and Border Protection and U.S. Citizen and Immigration Services, the agencies tasked with carrying out the policy, were only given a briefing call while Trump was actually signing the order itself. Yesterday, the Department of Justice gave a “no comment” when asked whether the Office of Legal Counsel had reviewed Trump’s executive orders—including the order at hand. (OLC normally reviews every executive order.)

This process is a reflection of Trump's personality, and it's not a good look for someone in the most powerful office in the world. The federal government often has trouble accomplishing the mundane. Now, its new boss wants it to deliver miracles and is only willing to wait a couple of months for them to be delivered. At some point, realism has to set in, but we're still at the point where the new president believes mountains can not only be moved, but have always been able to be moved at the slightest notice. All that's been missing is someone willing to order the mountain's relocation.

Filed Under: cybersecurity, donald trump, executive order

Rudy Giuliani To Head Up Trump's Cybersecurity Team As The Internet Laughs At Giuliani's Security Bona Fides

from the sigh dept

Our soon-to-be American President has made quite a show about bolstering the country's efforts for cybersecurity. The "cyber", as he is wont to call the issue, is claimed to be in disrepair and requires brave new minds to protect the country's computer systems from hacks and attacks from outside forces. We've already discussed in the past how depressing it is to learn just how little actual computer science knowledge exists floating in the minds of our elected leaders and their top-level appointees. There is an opportunity to get very smart, very well-educated people on matters of cybersecurity involved in government.

But it appears that Trump is choosing instead to pass on that opportunity, instead tapping Rudy Giuliani to head up his cybersecurity task force. Giuliani runs a consulting firm that claims to be involved in cybersecurity, of course, except that the extent of its work on the subject appears to be the claims that it does so.

Giuliani does head a consulting firm in New York called Giuliani Partners that supposedly focuses on cybersecurity, but Vice’s Motherboard reported yesterday, it’s tough to tell what they actually do, and it’s even tougher to tell what Giuliani does for them, besides being the face of the operation while saying outrageous things on television.

As Motherboard’s Jason Koebler and Lorenzo Franceschi-Bicchierai wrote, “Unlike many other cybersecurity firms, Giuliani Partners does not publish white papers about malware and large-scale hacks, or push for increased adoption of encryption, which would enhance cybersecurity across the board. In fact, it doesn’t talk much about cybersecurity at all, instead choosing to focus on its more traditional anti-crime consulting work.”

So we're off to a great start. Instead of bringing in someone with actual knowledge and experience in cybersecurity, the President Elect has instead put a cybersecurity cosplayer in charge. And not even a particularly good impersonator of a cybersecurity expert, it seems, as the internet has already begun poking fun at the security measures, or lack thereof, Giuliani Consulting has deployed for its own website.

We might be better off if Trump decided to employ one of the four-hundred pound slobs in their mother's basement he's referenced previously, as they seem to have a better handle on the very basics of web security than Giuliani. And they'd probably be cheaper as well, as the former mayor is on the record that his "cybersecurity firm" was more a venture of opportunism than one of added value for his clients.

Look, combating risks on "the cyber" (sigh) may indeed require a high-profile face, if only for the purposes of reassurance and PR. Sadly, those purposes are not fulfilled by a former mayor with a cybersecurity company that doesn't do cybersecurity, even for its own website.

Filed Under: cybersecurity, donald trump, rudy giuliani

Potential New FCC Boss Blames Obama For The Washington Post's Botched Russian Utility Hacking Story

from the finger-pointin' dept

We've noted how one of Trump's top telecom advisors is Jeffrey Eisenach, a long-time Verizon consultant and aggressive opponent of net neutrality. Eisenach's one of three Trump advisors who have made it clear their top priority in the new administration will be to not only gut net neutrality, but to defang and defund the FCC as a consumer watchdog on telecom issues. Eisenach isn't just an advisor, he's also on the shortlist to be the next head of an agency he doesn't believe in.

But when Eisenach isn't busy dreaming about dismantling net neutrality, he can apparently be found writing logically incoherent op-eds over at the Wall Street Journal. In a strange little tirade posted on January 3, Eisenach quite correctly ridicules the Washington Post's recent false claim that Russians were busy hacking U.S. utilities. In short, a piece of common malware was found on one PC, and because the Washington Post couldn't be bothered to even call the company in question, the paper created a bogus narrative, based entirely on anonymous sources, that casually pushed the country closer to war.

Yeah, no biggie.

Eisenach starts off well enough, quite correctly illustrating the depth of the Washington Post's failure on the story, and how the malware was arguably run of the mill, and certainly not directly tied to the government:

"The kind of malware involved in these two intrusions is neither new nor particularly sophisticated. It is run-of-the-mill spyware that has probably been implanted on thousands of networks around the world, from home computers to those inside banks, power companies and government agencies. These bugs are freely available online, and the code found at the Democratic National Committee and the power company isn’t even the latest version. The notion that such a mundane piece of software reveals a new and ominous threat to critical infrastructure is laughable."

All true. But Eisenach's piece then takes a strange turn, in that it somehow tries to blame the Washington Post's awful reporting on... the outgoing President:

"Misleading the American people to advance a political narrative has been a hallmark of President Obama’s foreign policy. The most recent example is the administration’s attempt to conflate the hacking of the Democratic Party with potential cyberattacks on critical infrastructure...Cyberthreats pose a clear danger to national security, and building an effective defense will take a concerted effort by the Trump administration. Americans are right to be concerned. But by playing on those fears, the Obama administration is putting politics ahead of the national interest."

While the Washington Post was once again happy to quote all manner of anonymous, pearl-clutching intelligence sector insiders for its story (a bipartisan disorder for sure), Obama wasn't among them. Nor is there any indication that the Obama administration actively encouraged the Washington Post to trip over its own shoelaces and perform an epic, journalistic face-plant. Obama certainly has been no saint on cybersecurity, but to blame him for the Washington Post's dysfunction is more than a little strange, especially when the entire point of your article is to lament the senseless politicization of cybersecurity.

Someone might want to notify Eisenach that as a top advisor and potential new FCC boss, he's now the one in a position of power. If your goal is to demonstrate that partisan patty cake should be nowhere near technology and cybersecurity policy, why not demonstrate that with your actions -- instead of penning editorials that completely undermine the entire point you're trying to make?

Filed Under: cybersecurity, donald trump, fake news, fcc, hacking, jeffrey eisenach, president obama, reporting, russia

Ex-MI6 Boss: When It Comes To Voting, Pencil And Paper Are 'Much More Secure' Than Electronic Systems

from the and-he-should-know dept

Techdirt has been worried by problems of e-voting systems for a long time now. Before, that was just one of our quaint interests, but over the last few months, the issue of e-voting, and how secure it is from hacking, specifically hacking by foreign powers, has become a rather hot topic. It's great that the world has finally caught up with Techdirt, and realized that e-voting is not just some neat technology, and now sees that democracy itself is at play. The downside is that because the stakes are so high, the level of noise is too, and it's really hard to work out how worried we should be about recent allegations, and what's the best thing to do on the e-voting front.

What we really need is someone distant from the current US debate, and yet with a great deal of knowledge of how foreign intelligence services hack into computer systems. Maybe someone like Sir John Sawers, former head of MI6, the UK's CIA. Here's what he said recently to the BBC on the subject of e-voting:

"Bizarrely the stubby pencil and piece of paper that you put your cross on in the ballot box is actually much more secure than anything which is electronic."

And added:

"The more things that go online, the more susceptible you are to cyber attacks."

Since MI6 has probably been involved in quite a few of those attacks, Sir John speaks with a certain authority. He also has a good analysis of why there is this constant push for e-voting, even though security experts are pretty unanimous in their warnings of the dangers:

"The only trouble is, the younger generation of people expect to be able to do things remotely and through electronic devices."

That also goes some way to explaining the naivety of most people when it comes to the Internet of Things. Many people just "expect" everything to be digital and online and linked to its own app, even when it's just a hair brush.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: cybersecurity, e-voting, evoting, john sawers, mi6, security, uk

White House Kicks Russian Diplomats Out Of The Country, Releases Preliminary Report On Russian Hacking With More To Come

from the escalation-time dept

As was widely expected, the White House officially announced its response to claims of Russian interference in our election process, and the "response" is basically kicking 35 Russian diplomats out of the country. Russia admittedly suggested it will do the same. The announcement also includes adding some entities to the official list of "Specially Designated Nationals and Blocked Persons." Somewhat incredibly, now added to that list is the FSB, which is the modern incarnation of the KGB. What's incredible about this was that it took until now for this to happen. With this, the administration also issued an executive order expanding on a previous executive order from last year, enabling it to take these actions.

Somewhat ridiculously, the new executive order just shows the full new order, and doesn't call out what changes were made from the original. So I went through and did a diff on the two executive orders myself. The first major change is an additional first line of who can be sanctioned. While the original had a description of what types of people could be sanctioned for cybersecurity violations, that same sanction has been bumped down to the 2nd item, and the new first item is:

the persons listed in the Annex to this order

Hmmm. That feels unfortunately close to an "enemies list."

The second major change is the addition of this action which can get you sanctioned to a long list of reasons:

tampering with, altering, or causing a misappropriation of information with the purpose or effect of interfering with or undermining election processes or institutions;

Yup. Remember, we noted already that interfering with "election systems" was not previously listed as a sanctionable offense. Now it is. That was to be expected.

Along with this report, Homeland Security and the FBI also (finally) released something of a "Joint Analysis Report" about the alleged Russian interference. The only major revelation in there is that the US government is referring to this hacking program as "GRIZZLY STEPPE."

This Joint Analysis Report (JAR) is the result of analytic efforts between the Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI). This document provides technical details regarding the tools and infrastructure used by the Russian civilian and military intelligence Services (RIS) to compromise and exploit networks and endpoints associated with the U.S. election, as well as a range of U.S. Government, political, and private sector entities. The U.S. Government is referring to this malicious cyber activity by RIS as GRIZZLY STEPPE.

Previous JARs have not attributed malicious cyber activity to specific countries or threat actors. However, public attribution of these activities to RIS is supported by technical indicators from the U.S. Intelligence Community, DHS, FBI, the private sector, and other entities. This determination expands upon the Joint Statement released October 7, 2016, from the Department of Homeland Security and the Director of National Intelligence on Election Security.

This activity by RIS is part of an ongoing campaign of cyber-enabled operations directed at the U.S. government and its citizens. These cyber operations have included spearphishing campaigns targeting government organizations, critical infrastructure entities, think tanks, universities, political organizations, and corporations leading to the theft of information. In foreign countries, RIS actors conducted damaging and/or disruptive cyber-attacks, including attacks on critical infrastructure networks. In some cases, RIS actors masqueraded as third parties, hiding behind false online personas designed to cause the victim to misattribute the source of the attack. This JAR provides technical indicators related to many of these operations, recommended mitigations, suggested actions to take in response to the indicators provided, and information on how to report such incidents to the U.S. Government.

Other than that, the report really doesn't tell us much more than was already reported in the past by various cybersecurity outfits, about the supposed infiltration by two hacking groups -- called APT28 and APT29 (APT: Advanced Persistent Threat) that people say are connected to the Russian government. There is a nifty graphic, though: The report also posts the YARA signature of the malware that was used (and encourage security folks to check for matching YARA signatures on their systems), and highlights (as was already known) that most of the "hacking" involved spearphishing (directly targeting individuals and tricking them into giving up passwords, with fake password reset requests).

The report does not add much to prove that it was actually the Russians behind this, though everyone insists that's now the consensus view. The NY Times notes that "a more detailed report on the intelligence... will be published in the next three weeks," which certainly could reveal more details. But... of course... "much of the detail -- especially evidence collected from "implants" in Russian computer systems, tapped conversations and spies — is expected to remain classified." In other words, for those who are still skeptical that it was Russia, don't expect them to be convinced by any of this.

Meanwhile, Donald Trump, when asked about all of this managed to toss off his typical word salad of nothingness:

“I think we ought to get on with our lives. I think that computers have complicated lives very greatly. The whole age of computer has made it where nobody knows exactly what is going on. We have speed, we have a lot of other things, but I’m not sure we have the kind, the security we need.”

Yes, it's true that attribution in online security is difficult, but most of that statement is completely ridiculous.

And, of course, this is all kinds of a mess. You have claims of attacks that no one wants to back up with actual details, for fear that it will reveal too much about sources and methods. You have escalation of "diplomatic responses" to counter this attack that everyone tells us was done by the Russians. You have an incoming President who basically said "how do I even computer." None of this is good, and none of it should be okay from no matter where you sit. If we're going to get into a fight with Russia, it would be nice if we had more evidence that "hey, someone broke into the email systems of political parties -- because those organizations are bad at security." But that doesn't seem likely to happen.

Instead, we're left with this weird game where we're constantly being told "trust us" by one side and "computers confusing" by the other. That's not comforting.

Filed Under: cybersecurity, diplomats, election, russia, sanctions, white house