“A great year for data thieves”

Recently a report from the Verizon Buisness RISK Team was released showing that over 285 million records were stolen last year, which is more then the past 4 years combined.

How was all this data lost and was it preventable? According to this report, 99% of it was from compromised servers and applications, 20% of that was from insiders within the company and 87% of the losses were easily preventable. The majority of the organizations, some 81%, weren’t even PII compliant.

"We find that many organizations achieve very high levels of security in numerous areas but neglect others," wrote Verizon. "Criminals will almost always prefer the easier route. Identifying a set of essential controls and ensuring their implementation across the organization without exception, and then moving on to more advanced controls where needed is a superior strategy against real-world attacks."

Read report here:
http://www.verizonbusiness.com/resources/security/reports/2009_databreach_rp.pdf

Technology can’t prevent Identity Theft

The Wall Street Journal recently published an article (LINK HERE) explaining the problems that exist when we depend on technology to solve social problems. It is a good article and has links to some of the more famous identity theft attacks that have happened recently, including the Barrack Obama twitter hijack listed below. It even lists some of the more basic criminal tactics I have never really classified as identity theft such as

1) Impersonating parking lot attendants to collect fees
2) Impersonating garbage men to collect tips
3) Impersonating people like policemen, security guards and meter readers

The reason I bring this article up, is it reminds me of a white paper I read for my technical review as part of my preliminary exam. The paper was titled “Detecting Social Engineering” and it talked about this method which would allow a computer to analyze a phone conversation and determine if one of the two callers is not telling the truth.

The first way of doing this, comparing the information received to information in a database made sense, but the second method used “natural language processing techniques” to determine if a person is lying. This piece was the part where I felt it start to go into a fairy tale. I find it hard to believe that there is software that can take a text conversation and pick out what are lies in it. Computers don’t have the ability to “think” like humans (yet) and until they do, they can’t be expected to solve a human problem.

I believe the solution to problems such as Identity Theft or Social Engineering do not lie solely in technology or human education, but is some combination of both.

Nate Evans

Employees cause most corporate data loss

According to a new study from Compuware, IT departments should be rewarded—only 1 percent of corporate data losses this past year were due to hackers. Unfortunately, the buck doesn’t end there. Employees are the largest cause of data breaches, but IT managers also listed outsourcing and malicious employees as two significant reasons why data breaches often occur.a

Compuware reports that of the 1,112 IT practitioners it surveyed, 79 percent reported that their organization had experienced at least one data breach.

This paper also has a couple very interesting graphs (courtesy of arstechnica.com) in it. One is the confidence level that all security breeches, which result in loss of personal information, are being detected by the organization (31% of people are not confident).



And then we get to the key data, who is responsible?


This obviously makes some sense, given that the IT department wasn't hired to teach Security 101 and focus much more on preventing technological security breeches. Companies need to hire an almost equal amount of employees to deal with training and to prevent data loss from a negligent employee!

An interesting Social Engineering Example

This is a very interesting story posted on CIO insight involving social engineering:

Every few days, Richard would seek out Sally, a twenty-something salesclerk at a retail outlet of a telecommunications conglomerate. When they first met, Richard, who’s in his early 30s, said he was the manager in charge of buying telecom equipment for a fast-growing startup, and he did, in fact, make a purchase on each visit.

Richard and Sally became friendly, and after a month, he took her out to lunch and confessed, “You’re a nice woman, but I’m not interested in you as a friend. I’m on a secret mission from the CEO of your company, and we need your help.”

He explained that a midlevel manager had been stealing trade secrets from the company, and they needed Sally’s help to replicate the methods they thought the manager was using. Sally had access to a PC that was connected to the corporate network, and Richard told her how to retrieve confidential files. He swore her to secrecy, telling her that only the CEO, a vice president, Richard and now Sally knew of this operation.

What Richard didn’t tell Sally was that this was all a lie: He actually worked for her company’s rival. Unwittingly, Sally became a corporate spy for the competition and began dutifully relaying files to a secret e-mail account.

A few weeks later, Richard told Sally that the vice president wanted to meet her at a restaurant. When they arrived, Sally saw the executive sitting at a table across the room with a man she didn’t recognize. Richard walked over to their table and, out of Sally’s earshot, began chatting with the companion. Unbeknownst to the VP, the man was an agent who was working with Richard and had arranged to meet the VP at the restaurant.

Richard soon returned to Sally and told her the VP had had second thoughts about meeting in public for fear it could jeopardize the operation. He said the VP wanted to recognize her cooperation, so Richard asked Sally to glance over at the VP. When Sally turned toward the executive, she could no longer see Richard, who then waved to the VP. The executive waved back, and Sally assumed that he was acknowledging her.

Weeks passed, and Richard gave Sally a $15,000 bonus as part of the “anti-fraud team.” Months later, he gave her a $30,000 bonus. She was hooked and would do anything Richard asked.

Eventually, Richard told Sally the truth. Though shocked and dismayed, she was too deep into the scheme to back out.

Do you think this could happen to your company?

Nate Evans

Cramming

I recently came across a very interesting article on “cramming.” Cramming is when a “scamming company” gets a hold of your phone number and bills you for a variety of services such as voicemail accounts, call waiting, etc.

For example, the author of this story got “crammed” when his wife signed up to win a free Vegas Vacation on one of those online popups. He suddenly had a bill for 4 voicemail accounts on his AT&T bill. AT&T can’t remove the charges as the phone companies just pass charges through (similar to how collect calls work). There is no authentication involved, all that is needed is a phone number. Meaning if I entered your phone number into this form, you would be billed 14.95 a month X3 for three new voicemail services.



The FTC states that you should:
1) Call the company and request that they refund your money.
2) Call your telephone company and see their policy for this
3) File a complaint with the FTC

None of the following guarantee you get your money back. My experience with a recent scam has been that the company does not have a real phone number, or no one ever picks up. The Phone companies, or Credit Card Companies can usually block charges but will rarely do so each month (meaning you need to call them each month). And a complaint with the FTC will get resolved in the usual government fashion... slowly.

To read more, including a couple scripts on his calls: http://arstechnica.com/articles/culture/cram-this.ars

Overall I would recommend that everyone be diligent online. Use common sense (A free Vegas Vacation is too good to be true) and check your bills carefully!

Nate

Happy Valentines Day

I consider myself pretty good when it comes to determining what is real e-mail and what is fake phishing e-mail. I must admit though over the past couple months they have been getting pretty good. From ebay e-mails asking me questions about an item I am selling to paypal e-mails trying to get me to update my security settings. All of them made me take a second look and ask myself... Am I selling anything on ebay?

Recently though over the past couple days I have been flooded by e-mails titled: “My Heart for you,” “What is Love,” “Just for you,” “Phone Love,” “Is anything as beautiful as a rose,” “I like you,” etc. When I open each of there they usually have a short message saying “I love you” and a link to some crazy site like moonstarfood.com or destroythemoon.com. Honestly does anyone fall for these?

I am assuming the smarter phishing scams such as ebay and paypal duplication e-mails must not be gaining the collective gullible folks like they used to. They seem to have returned to the ideal of spamming hundreds and hundreds of e-mails out and hopefully one returns positive! The one in a million attack.

Just to see what all you need to do to get infected, I figured I would click on a link (using my mac) and see what happened. The first couple sites didn’t even resolve, meaning the officials must have already shut those down, but the third one did.

I was sent to a website displaying a heart and a message saying “Your download will begin shortly.” Below that was a message which stated “If your download does not begin automatically click here and choose run.” I did as it said and it tried to send me a file called withlove.exe (which my mac did not know what to do with). I saved it on my desktop for later dissection.

Looking through this file it seems to do the following:
1) Disable AntiVirus
2) Opens some ports to listen for incoming commands from the master computer
3) Begin to send out more of this “I Love You” SPAM mail.

After doing some research this latest attack seems to be the work of the infamous Storm Worm. For those of you who have not heard of Storm Worm, it is a botnet of about a million computers which are under control of this group called The Storm Factory. They use all these computers to fill up our inboxes with SPAM. The question is why? As I mentioned in the update to “Who is You,” the motivation behind the attacks is more important then the attacks itself.

What is to gain by this? Growth of course, but why does Storm Worm need more computers? The million or so they have now sends me about 1 e-mail every 15 minutes (When I turn off SPAM filters). Somehow I don’t think 1 every 10 minutes is going to trick me into falling for this.

Most security professionals are worried about the the use of these Million computers as a Denial Of Service Tool. If each machine tried to access a website, they could effectively take down the website. But they haven’t done that yet (at least not that I know). Maybe they could use these computers to fold proteins or search for extra life (SETI). Would this be such an urgent problem then? What if they just applied patches to fix the systems.

This group has been doing this for each holiday. Christmas, Super Bowl, Thanksgiving, etc. However the best defense against this may be the fact that this is done for Valentines Day. Christmas is when you get in touch with long lost friends, etc, but Valentine’s Day is usually something celebrated between couples who hopefully know each others name and style of e-mails!

My question to the group: If this was all done for the good of the individual would it be a bad thing?

Nate Evans
ISEAGE PBS Leader
The Krell Institute

IP address = personal information

Yesterday the European Parliament's Civil Liberties Committee discussed the idea of linking your IP address to personal information. This would effectively give legal protection to IP addresses.

Of course, businesses who collect this information are against it. The leader of the pack being Google, which logs massive amounts of data and where it comes from. Tracking IP addresses can help google crack down on click fraud or identify the geographical region of its customers and in many ways is crucial to the company.

Google’s Peter Fleischer was quoted to have said: "There is no black or white answer: sometimes an IP address can be considered as personal data and sometimes not; it depends on the context, and which personal information it reveals" (Link to PDF).

On the opposite side of the debate the Electronic Privacy Information Center argues that with the upcoming IP6 model of the internet, IP addresses are being more and more personal.

Another big supporter of this side of the debate is Germany’s Peter Scharr, who heads the EU’s Data Protection Working Group. He believes that an IP address has to be regarded as personal data in situations where it can be used to identify someone.

If this idea does gain traction in Europe, it's unlikely to prevent the collection of IP addresses, which are used for everything from busting child pornography suspects to finding file-swappers to blacklisting spam domains, but it would no doubt require databases of IP addresses to meet certain security and retention standards.

Do you think IP addresses personal information and as such, should be protected legally?

Nate Evans
ISEAGE PBS Leader
The Krell Institute

Employee anger almost causes problems for company

Before I jump into my story, I wanted to introduce myself. Michael McCoy honored me by asking if I could contribute to this blog. My name is Nate Evans and I am a PHD candidate at Iowa State University in computer engineering. My research expertise is in an area very close to identity theft, social engineering. In some ways you could classify identity theft as a small piece of social engineering, but I don’t want to step on anyones toes here! I currently am working on my dissertation and am employed part time for the Walt Disney Company and The Krell Institute.

So in short, expect stories from me involving people ripping other people off.

When people define social engineering and try to explain the problem about it, they normally start with something like this:

“You can spend millions of dollars building a super secure computer system, but if the system admin sells his pass for $1,000, your system is now worth $1,000.” What if the system admin does not sell the password but instead uses it against the company to destroy or sell company data? This brings me to my story.

Recently a 51 year old administrator, Andy Lin, was given 30 months in jail and fined $81,200 for trying to destroy a medical drug database in a company he was employed with.

Way back in 2003, Andy learned that his company, Medco, was going to lay people off and he wasn’t sure he would survive the layoffs. In a fit of anger, he decided he would make the company pay by writing a script to delete everything in the company’s database. The script was set to go into effect automatically on his birthday April 23, 2004.

Well a couple weeks rolled by and Andy did not get laid off. As such he attempted to edit the code to make it ineffective. He failed and on April 23, 2004, the code deployed anyway.

Luckily the code contained numerous bugs and his program just crashed. Andy, still the cautious type, fixed the bug and reset his doomsday timer to the April 23, 2005.

Fortunately for the company, another System Admin was looking into this odd crash and found Andy’s code. On January 2005, Andy was arrested and pleaded guilty to one count of transmitting computer code with the intent to cause damage in excess of $5,000, and he was sentenced last week.

Its amazing how much damage one employee could do to a company. If that database was deleted the company would be in massive trouble. Imagine if the employee, instead of destroying it, sold it to the competitors...

You could take one of two lessons from this: Either don’t trust people, or pay your system administrators more!

Nate Evans
ISEAGE PBS Leader
The Krell Institute