<![CDATA[[SecurityRatty] tag: royal]]> http://securityratty.com/tag/royal Thu, 26 Jun 2008 17:51:41 +0000 iRatty Engine http://blogs.law.harvard.edu/tech/rss <![CDATA[British Hospital System Hit by Computer Virus]]> http://securityratty.com/article/f1d8bd877d349859de699cde8caa6ac4 http://securityratty.com/article/f1d8bd877d349859de699cde8caa6ac4 have been forced to shut down their computer systems for at least 24 hours due to a computer virus attack. The three hospitals are Barts in the City, the Royal London Hospital in Whitechapel and The London Chest Hospital in Bethnal Green. Neither a BBC report nor a press release from the hospitals said anything about the nature of the attack or the extent of the damage or if patient services were affected, although one would think this would have to be the case. The terse press release says that "The Trust's well rehearsed emergency procedures have been activated to ensure that key clinical systems continue safely while the system is being stabilised and a solution is being found." The problem was first detected at 12:00 GMT Monday according to a spokesman.

]]> Tue, 18 Nov 2008 06:01:25 +0000 press release terse press release attack trust london hospitals computer virus attack hospitals london nhs trust royal london hospital British Hospital System Hit by Computer Virus <![CDATA[Attacker's Royal Road to Your Company's System]]> http://securityratty.com/article/8e08f4d0bfb36f6dd51634749e58be0e http://securityratty.com/article/8e08f4d0bfb36f6dd51634749e58be0e Following up on earlier posts on systemic failures and their causes, this is a great line by Vordel's Mark O'Neill:


Freud wrote that dreams are the "Royal Road" to the unconscious. Messaging Systems and mainframes can be the Royal Road for a malicious user to attack a banking system, unless the security thinking moves from a "claim by claim" thinking to thinking about the full transaction.


What a great concept - you are dreaming that the messaging system does not need security, and instead you give the attacker a Royal Road straight to your book of business.

Also, Vordel's conference is coming up this month in Dublin, the lineup looks good, esp. the keynote - Don Adams's (TIBCO CTO) "Service Oriented Architecture, Security and a Modern Shillelagh"


]]> Tue, 09 Sep 2008 05:47:52 +0000 royal road royal road straight system security keynote -don adams tibco cto systemic failures claim modern shillelagh Attacker's Royal Road to Your Company's System <![CDATA[Global Dispatches]]> http://securityratty.com/article/7d7c0f7f4677a576c3437a0239aed902 http://securityratty.com/article/7d7c0f7f4677a576c3437a0239aed902

]]> Mon, 01 Sep 2008 03:33:25 +0000 global dispatches sap services firm lost laptop scotland customers royal bank acquire data infosys Global Dispatches <![CDATA[Blackwater Preps for Hurricane Gustav]]> http://securityratty.com/article/0b62df6a433b2afd278f5f889cf5c670 http://securityratty.com/article/0b62df6a433b2afd278f5f889cf5c670
]]> Sun, 31 Aug 2008 19:15:00 +0000 british royal navy hurricane gustav lumbers gulf coast blackwater orleans military respond Blackwater Preps for Hurricane Gustav <![CDATA[Bank Details of 1 Million Customers Sold on eBay]]> http://securityratty.com/article/7eea356d64e44982bc1591d09f99d2cd http://securityratty.com/article/7eea356d64e44982bc1591d09f99d2cd Wed, 27 Aug 2008 10:35:34 +0000 million customers auction site ebay personal details american express royal bank scotland computer Bank Details of 1 Million Customers Sold on eBay <![CDATA[Erase Your Hard Drives Before Selling Them]]> http://securityratty.com/article/1863838def4b467b54e51c1ef762ffdf http://securityratty.com/article/1863838def4b467b54e51c1ef762ffdf Sounds like a no-brainer, but it’s a lesson that some large companies still have to learn.

IT manager Andrew Chapman purchased a used drive on eBay, for just 77 British pounds, only to find that it contained the financial history and information for several million people, customers of the Royal Bank of Scotland (RBS) and its subsidiary, Natwest. Luckily for them, Chapman had their best interests at heart and reported the problem, rather than selling or using the information.

According to Evan at the Breach Blog:

The University of Glamorgan conducted research about hard drives bought on eBay that contained sensitive information and published their findings in September 2007. If people don’t think that criminals are buying hard drives on eBay, searching for sensitive information (personal information, health information, corporate secrets, intellectual property, etc.), then they are deluded

Click here to read the full article.

]]> Wed, 27 Aug 2008 06:48:00 +0000 information personal information health information sensitive information chapman manager andrew chapman hard ebay people Erase Your Hard Drives Before Selling Them <![CDATA[Banker Malware Targeting Brazilian Banks in the Wild]]> http://securityratty.com/article/4c146364a5e5366271bb42a4f795af8d http://securityratty.com/article/4c146364a5e5366271bb42a4f795af8d
Despite the ongoing customerization of malware, and the malware coding for hire customer tailored services, certain malware authors still believe in the product concept, namely, they build it and wait for someone to come. In this underground proposition for a proprietary banker malware targeting primarily Brazillian bank, the author is relying on the localized value added to his malware forgetting a simply fact - that the most popular banker malware is generalizing E-banking transactions in such a way that it's successfully able to hijack the sessions of banks it hasn't originally be coded to target in general.

Banks targetted in this banker malware :
Bank Equifax
Bank Itau
Bank Check
Bank Vivo
Bank Banrisul
Tim Bank Brazil
Bank Nossa Caixa
Bank Santander Banespa
Bank Infoseg
Bank Paypal
Bank Caixa Economica Federal
Bank Bradesco
Bank Northeast
Royal Bank
Bank Itau Personnalite
Bank PagSeguro
Australia Bank
Credicard Citi Bank
Credicard Bank Itau
Rural Bank

Taking into consideration the fact that not everyone would be willing to pay a couple of thousand dollars for a banker malware kit targeting banks the customer isn't interested in at the first place, malware authors have long been tailoring their propositions on the basis of modules. Adding an additional module for stealtness increases the prices, as well as an additional module forwarding the process of updating the malware binary to the "customer support desk". Moreover, stripping the banker kit from modules in which the customer doesn't have interest, like for instance exclude all Asian banks the kit has already built-in capabilities to hijack and log transactions from, decreases its price.

In a truly globalized IT underground, Brazillian cybercriminals tend to prefer using the market leading tools courtesy of Russian malware authors, so this localized banker malware with its basic session screenshot taking capabilities and accounting data logging has a very long way to go before it starts getting embraced by the local underground.

Related posts:
The Twitter Malware Campaign Wants to Bank With You
Targeted Spamming of Bankers Malware
A Localized Bankers Malware Campaign
76Service - Cybercrime as a Service Going Mainstream
The Underground Economy's Supply of Goods and Services
The Dynamics of the Malware Industry - Proprietary Malware Tools
Using Market Forces to Disrupt Botnets
Multiple Firewalls Bypassing Verification on Demand
Managed Spamming Appliances - The Future of Spam
Localizing Cybercrime - Cultural Diversity on Demand
E-crime and Socioeconomic Factors 
Malware as a Web Service 
Coding Spyware and Malware for Hire
Are Stolen Credit Card Details Getting Cheaper?
Neosploit Team Leaving the IT Underground
The Zeus Crimeware Kit Vulnerable to Remotely Exploitable Flaw
Pinch Vulnerable to Remotely Exploitable Flaw
Dissecting a Managed Spamming Service
Managed "Spamming Appliances" - The Future of Spam
]]> Mon, 18 Aug 2008 03:01:03 +0000 banker malware banker malware kit kit popular banker malware malware bank itau personnalite bank itau malware authors russian malware authors Banker Malware Targeting Brazilian Banks in the Wild <![CDATA[UPDATES GALORE! or, THE PRONOUN WE MEANS YOU AND ME!]]> http://securityratty.com/article/6ebd2507c3c7a5fbc11f6123a9af9559 http://securityratty.com/article/6ebd2507c3c7a5fbc11f6123a9af9559 So much traveling, so little blogging.  Sorry everyone.  I’ve gotta say first that I really enjoyed meeting readers and friends of the blog this past two weeks.

Today, allow me to update you on FAIR and the movement towards a formal, open standard.  There’s a couple of cool things going on in our little risk-world.

First, The Open Group Security Forum continues to move towards a formal adoption of FAIR.

WHAT DO YOU MEAN “WE” - YOU GOT A STANDARDS BODY IN YOUR POCKET OR SOMETHING?

Our meeting in Chicago a few weeks ago was great, but also slightly disturbing for me. I got pronoun-confusion syndrome.   I’m used to using the “we” pronoun to refer to RMI, or Jack and myself as we vet the models.  So without even thinking I would said “we have been looking at how loss occurs, and may want to change the model some” and The Open Group Members freaked out (rightfully so).  Adrian Seccombe gently reminded me that the “we” was now the Security Forum, and that “we” didn’t go changing things at will without vetting against each other.  Man I love this stuff.  I get to run our thoughts and ideas past some great folks now - you know, those smart people who tend to have really complex problems and are trying hard to solve them.

Formal Adoption:  Soon, Very Soon Now

Formal Adoption basically means we’ve made this document, everyone is close to saying that they generally like it, and once that finally happens then “bam”, we’re ready to move onward and upward with better things (see Cookbooks, below).  We’ve got a couple of changes to the current document that have been requested that aren’t a big deal.  For example, one request is that we make some statement about general applicability of FAIR to risk domains outside of the IT realm.   But once additions like that and others are done, this long process should be complete.

New Document Moving Towards Public Release:

We’ve got a basic document that should be public in the next few weeks on “What Makes a Good Risk Assessment Methodology” - written by yours truly and Jack.  It’s a very high-level document, and serves two purposes:

  • For novices it helps parse out what is important in any undertaking to understand corporate risk (the repeated discussions on the ISO 27001 mailing list make me think it would be a place ripe for such a document).
  • For those who “know” risk, it helps to re-establish some fundamental principles like the use of scales (ratio, please), the implications of dealing in probabilities, what attributes like consistency and defensibility mean, how “risk” should be reported to the business (something you know, meaningful) and so on.

When this doc is deemed ready for public consumption I’ll be sure to post on this blog here.

COOKBOOKS, EUROPEAN AGENCIES, AND, IRON CHEF “RISK” - WHOSE CUISINE WILL REIGN SUPREME?

One interesting thing that came up in the Chicago meeting was that ENISA (The European Network and Information Security Agency) developed a very nice document that reviewed something like 18 different risk assessment methodologies against their Criteria for Goodness.  FAIR was one of the ones they reviewed, and we (the royal “we” used there to include all us FAIR-Folk) did awfully well.  Things of interest:

  1. They based their work on the current introduction paper which is not at all a step-by-step guide towards an organizational risk assessment (what ENISA really wanted) and we did pretty well.  Well enough that if we had developed a paper along the lines of NIST 800-30 or OCTAVE for the use of FAIR in a formal process, we could have done really, really well.  Like won-the-bake-off kind of well.
  2. FAIR is actually not at all incongruous to many of the risk assessment methodologies offered, and in fact compliments many of them by letting those methodologies develop real, structured probabilities.  Think OCTAVE, where they basically say “math is (probabilities are) hard, so if you want to do them for reals, good luck!  But here’s a nonsensical way to do things if you want to believe in magic-fairy risk“.  FAIR fits right in there by stomping on the magic-fairy risk with the jack-boots of rationality.  FAIR similarly helps other risk standards that might lack structured probability development.

So The Open Group Security Forum decided that though we could create a new document and totally p0wn any future ENISA bake-off, there wasn’t much demand for the development of that documentation by the membership  - a point which was made quite apparent at the beginning of the discussion when one large European company CISO asked “What’s ENISA?”  Relevancy is everything, I suppose.

But that second item up there - the one about helping rather than competing with other “risk assessment methodologies” - really struck a chord.  So “we” (The Security Forum) are going to develop some “Cookbooks” that basically are high-level documents that say “If you want to use FAIR with (OCTAVE/COSO/CoBIT/Whatever) here’s how it fits, makes it better, and improves your life.  I’m pretty excited about these, and our first document looks like it’s going to be COSO integration.

THE OPEN GROUP SECURITY FORUM - THEY’RE A TRUSTING BUNCH (WITH QUALIFICATION, OF COURSE)

Finally, many people have asked me “Why work with The Open Group?”  There are many reasons, to be sure, but I will give you one example.  Members of the Security Forum there are not only great at vetting the model and getting consensus on risk and risk factors - but they’re quick to start applying.  So in Chicago, I thought I’d be talking about FAIR and the standard and fighting groupthink.  Nope.  Not at all.  In fact, the forum members spent more time suddenly discussing use of FAIR in a new Trust Model they’re developing.  So all of the sudden, I’m part of a new and exciting project to develop a Trust Model - how cool is that?  While formal adoption of the Trust Model will be necessarily long and deliberate - the collaboration and development is happening much faster than I can keep up with.  But if you all will allow me, it will help me get my head around it all by blogging about it later this week.  So be prepared to read about me dealing in “Trust” a little bit.

]]> Wed, 13 Aug 2008 11:24:17 +0000 risk risk assessment methodologies security forum forum magic-fairy risk risk standards fair risk-world fair similarly helps UPDATES GALORE! or, THE PRONOUN WE MEANS YOU AND ME! <![CDATA[You dont think they would install Vista do you?]]> http://securityratty.com/article/a6adede95a24680736503522afb1701f http://securityratty.com/article/a6adede95a24680736503522afb1701f For the love of all thats holy, dont install Vista!
clipped from www.theregister.co.uk

Upgrade drags Stealth Bomber IT systems into the 90s

While it might seem odd to some readers that the US Air Force’s multibillion dollar flagship plane is only now “upgrading” to fairly basic tech, this is commonplace in advanced aerospace and military kit. The space shuttle’s flight computers, similarly critical to it remaining under control, are likewise basic. In the early years of the 21st century, the main battle computer of a Royal Navy destroyer was still based around two 24-bit, 1 MHz processors each with 25KB of RAM.
  blog it
]]> Fri, 11 Jul 2008 11:08:07 +0000 install vista royal navy destroyer main battle computer fairly basic tech military kit likewise basic similarly critical mhz processors 21st century You dont think they would install Vista do you? <![CDATA[Civilians Ask Whats With All the Privacy Act Kerfluffle?]]> http://securityratty.com/article/d5daa36201f5ba38464b919d3abcc3dc http://securityratty.com/article/d5daa36201f5ba38464b919d3abcc3dc And by “kerfluffle”, I mean these articles:

Well, let’s talk about how privacy and the Government works with Uncle Rybolov (please hold the references to Old Weird Uncle Harold until we’re through with today’s lesson please).

We have a law, the Privacy Act of 1974.  Think about it, what significant privacy-wrenching activities happened just a couple of years prior?  Can we say “Watergate Scandal“?  Can we say “Church Committee“?  Suffice it to say, the early 1970s was an era filled with privacy issues and is where most of our privacy policy and law comes from.  Remember this for later:  this was the 1970’s!

Each of the various sections of the Privacy Act deals with a particular data type.  For instance, Title 13 refers to data collected by the Census Bureau when they’ll go count everybody in 2010.

The Privacy Act talks about the stuff that everybody in the Government needs to know about:  how you’re going to jail if you disclose this information to a third party.  For those of you who have ever been in the military or had to fill out a government form that required your social security number, the light in the back of your head should be going off right now because they all have the warnings about disclosure.

Huts and Chairs Need Privacy Too

Remember to respect the privacy of the beach huts and chairs photo by Joe Shlabotnik

When it comes to IT security, the Privacy Act works like this:

  • You realize a need to collect PII on individuals.
  • You do a privacy impact assessment to determine if you can legally collect this data and what the implications of collecting the data are.
  • You build rules about what you can do normally with the data once you have collected it.  This is called the “routine use”.
  • You write a report on how, why, and about whom you’re collecting this information.  This is known as the “System of Record Notice”.
  • You file this report with the Federal Register to notify the public.
  • This IT system becomes the authoritative source of that information.

IE, no secret dossiers on the public.  We’ll suspend our disbelief in FISA for a minute, this conversation is about non-intelligence data collection.

Now the problem with all this is that if you stop and think about it, I was 1 year old when the Privacy Act was signed.  Our technology for information sharing has gone above and beyond that.  We can exchange data much much much more quickly than the Privacy Act originally intended.  As a result, we have PII everywhere.  Most of the PII is needed to provide services to the citizens, except that it’s a royal PITA to protect it all, and that’s the lesson of the past 2 years in Government data breaches.

Problems with the Privacy Act:

  • The SORN is hard to read and is not easy to find.
  • Privacy Act data given to contractors or “business partners” (aka, state and local government or NGOs) does not have the same amount of oversight as it does in the Government.
  • Data given to the Government by a third-party is not susceptible to the Privacy Act because the Government did not collect it.  Wow, lots of room for abuse–waterboarding-esque abuse.
  • Privacy Act procedures were written for mainframes.  Mainframes have been replaced with clusters of servers.  It’s easy to add a new server to this setup.  Yes, this is a feature.
  • If you build a new system with the same data types and routine uses as an already existing SORN, you can “piggyback” on that existing SORN.
  • It’s very easy to use the data in a way that isn’t on your “routine use” statement, thus breaking the entire privacy system.

Obviously, at this point, you should have gotten the hint that maybe we need to revise the Privacy Act.  I think GAO and OMB would agree with you here.

So, what alternatives do we have to the existing system?

  • Make blanket data types and do a PIA and SORN on them regardless of where that data lies.
  • Bend the Paperwork Reduction act and OMB guidance so that we don’t collect as much information.
  • Make the Privacy Act more specific on what should be in SORN, PIA, and routine use statements.

To be honest, it seems like most of this is already in place, it just needs to get tuned a little bit so we’re doing the right things.  Once again, the scale of the Government’s IT infrastructure is keeping us from doing the right thing:    there isn’t enough time in the day to do PIAs on a per-server basis or to keep track of every little bit of data.  You have to automate our privacy efforts in some fashion.

And this is why, dear readers, I think the Government needs DLP solutions more than the private sector does.  Too bad the DLP vendors are stuck on credit cards and social security numbers.

]]> Thu, 26 Jun 2008 17:51:41 +0000 privacy act privacy act procedures privacy act deals privacy act data privacy data data lies privacy act talks privacy policy Civilians Ask Whats With All the Privacy Act Kerfluffle?