<![CDATA[[SecurityRatty] tag: computer]]> http://securityratty.com/tag/computer Mon, 30 Jun 2008 17:03:54 +0000 iRatty Engine http://blogs.law.harvard.edu/tech/rss <![CDATA[Daily Mail publisher admits to stolen laptop]]> http://securityratty.com/article/9af68c57ed3f10d814be79e5d395b72b http://securityratty.com/article/9af68c57ed3f10d814be79e5d395b72b Security Breach

Date Reported:
7/4/08

Organization:
Daily Mail and General Trust plc

Contractor/Consultant/Branch:
Northcliffe Media
Associated Newspapers Ltd

Victims:
Staff, suppliers and contributors

Number Affected:
"thousands"

Types of Data:
"name, address, bank account number and bank sort code"

Breach Description:
"Daily Mail publisher Associated Newspapers has admitted that a laptop containing financial and personal details of thousands of staff, suppliers and contributors has been stolen."

Reference URL:
ComputerWorldUK
Guardian News (UK)
Guardian News (UK) additional info

Report Credit:
Guardian Newspaper

Response:
From the online sources cited above:

Daily Mail publisher Associated Newspapers has admitted that a laptop containing financial and personal details of thousands of staff, suppliers and contributors has been stolen.

A Daily Mail & General Trust spokeswoman said: "DMGT confirms that a laptop company computer containing certain confidential information was stolen last week.

After months of criticising "criminally careless" government departments for losing confidential records, the company has been forced to send out an embarrassing letter telling journalists they may now be at risk of identity theft
[Evan] This is the same Daily Mail managed by Associated Newspapers that according to The Guardian "has been at the forefront of coverage of the recent bank and government department missing data scandals".  It would be very difficult for Associated Newspapers to claim that they didn't know any better than to store confidential information on a poorly protected laptop.

Details such as names, addresses, bank account numbers and sort codes were on the laptop

the laptop was "password protected" but tell recipients to contact their banks and also "consult the government website ... for advice on avoiding or dealing with identity theft"
[Evan] The mention of password protection is nothing more than an effort to minimize the effect of the breach.  It does very little (if anything) to protect the personal information.

In a letter to those who details were affected, Simon Dyson, finance director at Daily Mail publisher Associated Newspapers, and Martyn Hindley, his counterpart at sister company Northcliffe, said it was likely that the details had been erased by the thief.
[Evan] How is the conclusion drawn?  I don't see how there could be enough information to determine what the thief was likely to do.

From the letter to affected persons from the Associated Newspapers group finance director, Simon Dyson, and his Northcliffe counterpart, Martyn Hindley:

"Unfortunately one of the company's laptops has been stolen."

"The contents included personal data, some of which related to you."

"The laptop was password-protected. "
[Evan] So what?  This won't adequately protect the information on the laptop, so why mention it?

"We are writing to you as quickly as possible to alert you to the fact that the theft has happened and to inform you of the data types lost, so that you can take appropriate action."
[Evan] I guess we should give some credit for the quick notification, if nothing else.

"In your case, your name, address, bank account number and bank sort code were the sensitive information lost."

"The likelihood is that this theft was carried out in an opportunistic manner by a thief who will not realise that there is any personal data on the laptop and who may just erase what is on the hard disk in order to disguise the fact that the laptop is stolen."
[Evan] This is nothing more than speculation.  I can't imagine that there are any specific facts for which this conclusion is based on.

"We have, of course, notified the police of the theft of the laptop and are talking to the Office of the Information Commissioner about what has happened."

"On behalf of the company, I would like to offer my sincere apologies for any annoyance and inconvenience to you that this breach of security may cause."

"I can assure you that we take security of personal data very seriously and have, since this incident, which was inadvertently caused by a technical issue, already further strengthened procedures."
[Evan] This breach was caused by a "technical issue"?  Like what?  I presume that the technical aspects surrounding this breach were working exactly as they were designed to in the manner of which that they were implemented.  Without further elaboration, "strengthened procedures" is subjective and means little.  Organizations should offer details, instead of general statements in order to bolster some sense of confidence.

Commentary:
This breach must be embarrassing for Associated Newspapers.  A breach like this should be embarrassing for any organizations.  Unencrypted lost of stolen laptops storing personal (or other confidential) information is a pretty well-known risk nowadays.  An unacceptable risk for most.

Past Breaches:
Unknown

]]> Sat, 05 Jul 2008 08:55:49 +0000 information personal information daily mail publisher daily mail personal store confidential information laptop personal data laptop company computer Daily Mail publisher admits to stolen laptop <![CDATA[Lithuania: Attacks focused on hosting company]]> http://securityratty.com/article/e46c46b91c606612b837d2cbb11d5c78 http://securityratty.com/article/e46c46b91c606612b837d2cbb11d5c78 Thu, 03 Jul 2008 20:00:00 +0000 computer security expert attacks lithuania web sites web server friday week vulnerability Lithuania: Attacks focused on hosting company <![CDATA[CCleaner and SpyBot are in the top five!]]> http://securityratty.com/article/14f215a49046d1f13a23bb1af3a0d0fa http://securityratty.com/article/14f215a49046d1f13a23bb1af3a0d0fa Great post over at LifeHacker today. It would heed you to listen up to the advice given.
clipped from lifehacker.com

You download, create, delete, and move around countless files and endless piles of data on your PC every day. While your PC would ideally handle all of this data for you, it doesn’t take long before you end up with a disorganized, cluttered computer.
  blog it
]]> Thu, 03 Jul 2008 15:13:40 +0000 windows maintenance tools lifehacker data endless piles countless files move heed post handle CCleaner and SpyBot are in the top five! <![CDATA[Misc Reading Related To Verizon Breach Report]]> http://securityratty.com/article/1c291acddf9bcf88c7738b092ad66b32 http://securityratty.com/article/1c291acddf9bcf88c7738b092ad66b32 All sort of fun stuff was unearthed, discussed and - sometimes -  made-up upon reading the Verizon Security Breach Investigations report. Here are some things from the pile which I found fun:

And of course, here is my favorite part: "In 82 percent of cases, our investigators noted that the victim possessed the ability to discover the breach had they had they been more diligent in monitoring and analyzing event-related information [AC - i.e. logs] available to them at the time of the incident." and this  "Furthermore, a crime scene devoid of any network and system logs, a key resource for computer forensics, is a disturbingly common occurrence."

What can I say? Back to battle stations for me - to fight the war of making logs more popular! :-)

About me: http://www.chuvakin.org
]]> Thu, 03 Jul 2008 10:07:00 +0000 verizon report fun fun follow-ups logs system logs verizon report crime scene devoid disturbingly common occurrence Misc Reading Related To Verizon Breach Report <![CDATA[Great re-visit on a little known tip about blocking Malware]]> http://securityratty.com/article/919a6207560411988d92cd082ddcc8fe http://securityratty.com/article/919a6207560411988d92cd082ddcc8fe Ran across this site and found this great article on a little known tip for blocking Malware by editing your hosts file.
I like this site!
clipped from pctechbytestoday.com


Modify Your Hosts File to Block Malware

By now, most of us know what spyware is and what it can do to your computer. If your PC is connected to the Internet, chances are you have some form of spyware. It attaches to your PC as you casually roam websites or download files. But you can be proactive and block some of the known malware websites by altering your hosts file in Windows.
  blog it
]]> Wed, 02 Jul 2008 19:53:53 +0000 malware hosts file block malware block malware websites spyware tip roam websites site Great re-visit on a little known tip about blocking Malware <![CDATA[SP 800-53A Now Finally Final]]> http://securityratty.com/article/5dfd935d866322acbf482eda2099739d http://securityratty.com/article/5dfd935d866322acbf482eda2099739d The perpetual draft document, SP 800-53A, has been officially released after 3 years.  Check out the announcement from NIST here.

Now the interesting thing to me is that NIST is working with some other players (DNI comes to mind) on reference implementations of 800-53A.  This is big, so big that I can’t add enough hyperbole to it.

Why do they need to do reference implementations?  Well, because by itself, SP 800-53A is dangerous if it’s given to people who “don’t get it”.  By that what I mean is this:

  • SP 800-53 needs tailoring to distill into actual requirements.
  • SP 800-53A needs a huge amount of tailoring to distill into test cases/procedures that match the tailoring that you did with 800-53.
  • Taken at face value, 800-53 and 800-53A become the source of “death by compliance”.
  • If you think the auditors could grill you to death with 800-53, 800-53A gives them tons more material.

Now time for a war story: I worked on a project where the contractor was having a hard time building a security program, mostly because they didn’t have the right staff to get the job done.  The government told the contractor to use 800-53A as a starting point, and 6 months of insanity followed with 13 “security engineers” in a conference room cranking out documentation that had no basis in reality.  At the end of it all, the contractor handed the Government a bill for $1M.

Now don’t get me wrong, I like the ideas behind 800-53A, but the first thing you need to know when you start using it is when you shouldn’t use it:

  • Don’t run test procedures on every computer you have, use an automated tool and do spot-checks to validate that the automated tool works.
  • Use less test procedures on low-criticality systems.
  • “This procedure is conducted as part of the hardening validation process.”
  • Common controls are even more important because you do not want the repetition of effort.

And whatever you do, don’t let 800-53A turn your risk management into a compliance activity.  It has all the potential to do that.

US Government Docs

US Government Doc’s photo by Manchester Library.

]]> Tue, 01 Jul 2008 08:08:12 +0000 800-53a government docs photo government reference implementations test procedures compliance hard time time perpetual draft document SP 800-53A Now Finally Final <![CDATA[Fast Track to Botnet Central]]> http://securityratty.com/article/d62636e855a8a6846b44ec6cafe10519 http://securityratty.com/article/d62636e855a8a6846b44ec6cafe10519
Seriously though, becoming a victim to a hacker's botnet is incredibly easy.  These attacks are not typical to other forms of destruction found on the internet.  There true intent is usually to remain hidden from view until called upon.  In the case of FastTrackBot however there is a new objective.  FastTrackBot downloads several executable files that keep your computer clicking on the attacker's affiliate links.  These executable files keep the webpages in hidden iexplore.exe windows in order to hide the application from suspicious eyes.  If you're using X-cleaner, I suggest you take a look at the Expert Tab.  The Show All Hidden Windows function is great for showing you exactly what is open at the time.


replace ad.pngFastTrackBot phones home to several of these sites in order to keep the user clicks through affiliate links.

Aside from creating invisible windows to hog your bandwidth up, it also attempts to install a rogue anti-spyware application.  This is a popular technique when attempting to fraud the victim into leaking credit card information when actually attempting to purchase the fake product.  FastTrackBot inserts a fake security center that appears identical to the one found in Windows XP.

securitycenter.pngAs you can see in the address bar, this is not the actual security center.  Clicking anywhere on this window means almost certain doom in the worst way possible...a never ending stream of fake "YOU ARE INFECTED!!!!" alerts.

infect.png
In order to kill the actual application, you have to remove it from memory first, then remove its autostart which is found in 5 different locations - or simply remove with our free Microscanner.
]]> Tue, 01 Jul 2008 05:41:45 +0000 fasttrackbot fasttrackbot inserts windows invisible windows fake actual application fake security center fasttrackbot phones home application Fast Track to Botnet Central <![CDATA[Decrypting and Restoring GPcode Encrypted Files]]> http://securityratty.com/article/e39ad499bbe55c20aca17c7ba23989b4 http://securityratty.com/article/e39ad499bbe55c20aca17c7ba23989b4
The futile attempt to directly attack the encryption algorithm used by the GPcode ransomware, is prompting Kaspersky Labs to invest in a more pragmatic solutions to the problem, with a new version of the StopGpcode tool released last week. More info :

"It turns out that if a user has files that are encrypted by Gpcode and versions of those same files that are unencrypted, then the pairs of files (the encrypted and corresponding unencrypted file) can be used to restore other files on the victim machine. This is the method that the StopGpcode2 tool uses.

Where can these unencrypted files be found? They may be the result of using PhotoRec. Moreover, these files may be found in a backup storage or on removable media (e.g., the original files of photographs copied to the hard disk of a computer that has been attacked by Gpcode may still be on a camera’s memory card). Unencrypted files may also have been saved somewhere on a network resource (e.g., films or video clips on a public server) that the Gpcode virus has not reached."

As the customer support desk behind GPcode pointed out in an interview, the malware is prone to evolve, and the simplistic file deletion process will be replaced by secure file deletion in order to render all data recovery tols useless, unless of course backups of the affected data are available. They often aren't, and depending on the importance of the files encrypted, the successful ransom is all a matter of the momentum.

"A person, presumably the author of Gpcode, contacted at one of the e-mail addresses left behind by the program stated that future development efforts will likely increase the key size to 4,096 bits, "if AV companies or other (people) crack the current key, but (that's) impossible. The self-proclaimed author, who used the name "Daniel Robertson," also said that other standard techniques to defeat antivirus will be added, including polymorphic encryption, anti-heuristic features and the ability to self propagate, turning the program into a computer virus. It well pays back itself," he said"

There are even more pragmatic approaches to dealing with this problem, next to backups undermining their business model. Try following the virtual money for instance.
]]> Tue, 01 Jul 2008 04:26:39 +0000 files gpcode original files gpcode virus gpcode ransomware file secure file deletion computer virus key Decrypting and Restoring GPcode Encrypted Files <![CDATA[Kill Switches and Remote Control]]> http://securityratty.com/article/6faff6d8aced2811984a7463136f6b3a http://securityratty.com/article/6faff6d8aced2811984a7463136f6b3a ability for the police to shut off your engine remotely. Buses are getting the same capability, in case terrorists want to re-enact the movie Speed. The Pentagon wants a kill switch installed on airplanes, and is worried about potential enemies installing kill switches on their own equipment. Microsoft is doing some of the most creative thinking along these lines, with something it's calling "Digital Manners Policies." According to its patent application, DMP-enabled devices would accept broadcast "orders" limiting capabilities. Cellphones could be remotely set to vibrate mode in restaurants and concert halls, and be turned off on airplanes and in hospitals. Cameras could be prohibited from taking pictures in locker rooms and museums, and recording equipment could be disabled in theaters. Professors finally could prevent students from texting one another during class. The possibilities are endless, and very dangerous. Making this work involves building a nearly flawless hierarchical system of authority. That's a difficult security problem even in its simplest form. Distributing that system among a variety of different devices -- computers, phones, PDAs, cameras, recorders -- with different firmware and manufacturers, is even more difficult. Not to mention delegating different levels of authority to various agencies, enterprises, industries and individuals, and then enforcing the necessary safeguards. Once we go down this path -- giving one device authority over other devices -- the security problems start piling up. Who has the authority to limit functionality of my devices, and how do they get that authority? What prevents them from abusing that power? Do I get the ability to override their limitations? In what circumstances, and how? Can they override my override? How do we prevent this from being abused? Can a burglar, for example, enforce a "no photography" rule and prevent security cameras from working? Can the police enforce the same rule to avoid another Rodney King incident? Do the police get "superuser" devices that cannot be limited, and do they get "supercontroller" devices that can limit anything? How do we ensure that only they get them, and what do we do when the devices inevitably fall into the wrong hands? It's comparatively easy to make this work in closed specialized systems -- OnStar, airplane avionics, military hardware -- but much more difficult in open-ended systems. If you think Microsoft's vision could possibly be securely designed, all you have to do is look at the dismal effectiveness of the various copy-protection and digital-rights-management systems we've seen over the years. That's a similar capabilities-enforcement mechanism, albeit simpler than these more general systems. And that's the key to understanding this system. Don't be fooled by the scare stories of wireless devices on airplanes and in hospitals, or visions of a world where no one is yammering loudly on their cellphones in posh restaurants. This is really about media companies wanting to exert their control further over your electronics. They not only want to prevent you from surreptitiously recording movies and concerts, they want your new television to enforce good "manners" on your computer, and not allow it to record any programs. They want your iPod to politely refuse to copy music to a computer other than your own. They want to enforce their legislated definition of manners: to control what you do and when you do it, and to charge you repeatedly for the privilege whenever possible. "Digital Manners Policies" is a marketing term. Let's call this what it really is: Selective Device Jamming. It's not polite, it's dangerous. It won't make anyone more secure -- or more polite. This essay originally appeared in Wired.com.
]]> Tue, 01 Jul 2008 02:48:37 +0000 wireless devices devices devices inevitably digital manners policies prevent prevent security cameras difficult security cameras prevent students Kill Switches and Remote Control <![CDATA[William Jackson on FISMA: It Works, Maybe]]> http://securityratty.com/article/23ddad0ab4920cf875a8ac91773447fd http://securityratty.com/article/23ddad0ab4920cf875a8ac91773447fd Article from William Jackson in Government Computer News:  Security policies remain a burden to federal IT managers, but they are producing results.

First off, GCN, come into the modern Web 2.0 era by letting people comment on your articles or at least allow trackbacks.  Having said that, let’s look at some of Mr Jackson’s points:

  • NIST Special Publications: They’re good.  They’re free.  The only problem is that they’re burying us in them.  And oh yeah, SP 800-53A is finally final.
  • Security and Vendors/Contractors:  It’s much harder than you might think.  If there’s interest, I’ll put out some presentations on it in my “copious amounts of free time”.  In the meantime, check out what I’ve said so far about outsourcing.
  • Documentation and Paperwork:  Sadly, this is a fact of life for the Government.  The primary problem is the layers of oversight that the system owner and ISSO have.  When you are as heavily audited as the executive branch is, you tend to avoid risks and overdocument.  My personal theory is that the reason is insistence on compliance instead of risk management.
  • Revising FISMA:  I’ve said it time and time again, the law is good and doesn’t need to be changed, the execution is the part that needs work.
]]> Mon, 30 Jun 2008 17:03:54 +0000 free time free security policies remain government security time william jackson government computer news nist special publications William Jackson on FISMA: It Works, Maybe