What are they doing with our data?

With the 'breach' at Facebook they won't get my trust back again.  They can call it anything they want, but, from my point of view it is a 'breach'.  MY data was taken and used in ways I did not give MY permission for.  It isn't just Facebook, but, anyone who offers services over the internet that we need to be more aware of what they know about us and are willing to share to others.  It doesn't matter that it is 'free' like Facebook or a paid service we need to demand that they treat our personal information like crown jewels and do their best to make sure that it isn't taken without our knowledge and permission.

I don't know what they put into the document for data analysis by that 'researcher', but, here are a few things I can quickly think of for anyone who is thinking about people getting access to our data.

• Where is the data stored?
• What is the data you need, why do you need it, and, for how long will you require to keep the data for?
• How is the machine secured both from a physical access point and software?
• Does the system which holds the data accessible from your LAN and/or internet?
• What software tools are being used for data storage and analysis and are they up-to-date for patching?
• Has your hardware been patched for the latest identified vulnerabilities?
• How did you test the security of your systems?
• Who has access to the machine?
• Do you limit access to 'need-to-know' and only the data required?
• Do you limit how the data is moved off the system when 3rd parties have access?
• If so, how?
• What agreements do you have in place for 3rd party access and what do the agreements say?
• If law enforcement or government request access to the data what is the process you follow to grant them access?  
• Do you notify the original owner of the data for such data requests?
• What is the process you follow when there is a network or physical breach of your system?
• How are the backups done and secured and who has access to those backups?
• When you are done with the analysis how is the data deleted?  
• Does that include all backups?
• How do you prove that the data was deleted and can never be recovered?

I understand that they need to make money, but, when the data leaves their control then anything can happen and they need to do a better job documenting what was requested, why it was requested, how it was secured and how it was deleted when done.  For myself I have downloaded my Facebook data to see what they have and I am now looking at other services that respect my privacy more.  It will be hard as Facebook has a massive population, but, other communities in the past have fallen (MySpace, AOL come to mind).

Possible ad-malware attempt

For the last several days my Android tablet was opening windows at random.  At first I thought it was me, but, yesterday the following happened and the tablet was sitting on the table untouched:

• Multiple search windows open;
• Over 12 tabs opened in the browser going to a number of sites with the same prefix.  I won't name it as I don't want them to get the ad revenue;
• My BANKING app was opened up.  I don't have auto-sign-in there so no damage done.  I checked the bank account from my Linux machine and no activity to my account (yay!);
• Multiple apps opened up.  Again these had ads so I suspect they were trying to maximize their ad revenues.  Either that or they wanted someone to pay a lot of ad money for spam clicks;

I know what the last app I installed so I suspected that app as they are ad supported.  After I removed the app and let the machine sit for 24 hours I had no more random windows opened so I may have guessed correctly.

I also run AVAST on the machine and I scanned everything and it was clean.  I know if it is very new the scanner may not detect it, but, I wanted to make as sure as possible I wasn't infected with a known virus.

I also sent Google a feedback that the app may have ad-malware and see if there is anything that they could see and do.  May not be much, but, at least I wanted to make them aware of the issue.

My guess for next gen malware encryption

I am going to make a bet that the next generation of file encryption malware is going to be a lost nastier.  Your best defence is:

• Backups.  Keep multiple backups and not connected to any network after your backups are done.  Don't just do backups, test them!  Too many times someone approaches me saying they need help as they tried to restore files from backups and they don't work;
• Up-to-date software.  When patches comes out for your operating system and applications install them ASAP.  Most of the time those patches are due to holes and the hackers are already using them.  It does not matter what O/S you use, Windows, Linux, OS/X all need to be up-to-date;
• Home routers.  Keep them up-to-date also.  Sometimes your ISP will patch their routers, ASK them to keep their hardware up-to-date;
• Good anti-virus software and keep them up-to-date;
• Do and not opening up attachments from emails that you didn't ask for is also a good step;
• Good web surfing habits.  Sometimes a site will pop-up 'You need to update or install this program to view'.  Don't trust any site doing this.  Most of the time it is for Flash and people think 'Oh, I am out-of-date again' and click install.  NEVER DO THAT, go directly to the source of the program and check.  If it is out-of-date install from the maker directly and not from a web site.

Unfortunately the writers of these nasty programs won't stop there.  They have been using ad-malware and then getting into legit sites serving ads and try to infect you when you view their "ads" and try to bypass asking your permission to install.

Right now when your system is infected and your files are encrypted some people recommended to turn back the system clock so time does not expire. Right now that works, but, I suspect not for very long.  The writers of these programs know that "trick" and I suspect they are working on how to counter that.  I see them saving the system clock information and the network time information at time of infection.  With that they know exactly when they installed on your system.  They also can determine the basic time differential between your system and the network.  If they then compare that information the next time it runs the program may just nuke your files if the date on system clock is less than their time-stamp.  Also, if they are really nasty they will also nuke the files if they cannot make a connection to the network to verify the time.  When they can make a connection they will use the time differential to see if you played with the system clock.  I would also be willing to bet that they will advertise what they did and why so that fact will spread around that playing with your system clock or unplugging from the network will nuke your files.  I don't know if (or when) that will happen, but, it will make your backups much more important as the only way to restore your system is to do a total wipe and restore.

IoT now being used for DDOS

It was a matter of time before this happened.  With the various manufacturers of IoT devices worried more about being first, market share or making money (or all three) they have left device security as an afterthought.  Brian Krebs is one of the first that I know of where those not happy about what he does tried to silence him using a massive DDOS attack that appears to be using IoT devices.  In the past he has been a target for swatting.  At this time his site Krebs on Security isn't back up  at the time of this blog being written and that is a shame.  Ars Technica has a good article on this subject that you can read.  I agree with the article that this is troubling development.

The problem is that it is like the wild west with IoT devices.  If manufacturers don't do something about security and upgrades soon web providers and/or the government will do something about it and the potential will be stifled.

I see this as an opportunity for Anti-virus makers and software developers.  If they can develop a simple application to

1. Scan your network for IoT devices and present you with their findings;
2. Make it extensible to allow us to manually identify and flag IoT devices that were not detected and send feedback to the developer about the new devices;
3. Identify potential security holes and list options the user can make to secure their devices;
4. Automate the fixing of holes and changing settings to make the devices more secure.

Developers who can do the above will have an opportunity to make money while helping secure the newest set of toys on the internet.
In the long term manufacturers need to put security and the ability to upgrade at the top of the list and to firmly step on the neck of marketers and tell them NO, security comes first, not market share or money.  That is hard as they will tell everyone that a company is in the business of making money.  That is fair, but, they should be reminded that if people cannot trust their product that they will not be making any money!

I may be an exception to many people looking at IoT products for the home (or office) as I look at:

1. Can it be patched when security holes are identified and fixed?
2. Does it ask out of the box for the user to create an admin account and passwords and does not have default?
3. Good documentation on the production and configuration.  A simple user guide will suffice and then point the user to a web site with more detailed documentation;
4. Certificates can be added/changed/deleted so that one default certificate isn't used on every device made by that manufacturer?  I do this for my browsers and Linux boxes.  There are certain countries (like China and soon Russia) where I disable ALL their certificates as I don't trust them, may be wrong or paranoid, but, my machines my rules;
5. A tool to manage the IoT device and the ability to log all actions to a write only area by the IoT device.  The reasons for Write-Only is that if hackers do get in we want to make it a bit harder to alter the logs;
6. What is the support policy and expected life for support?
7. If it requires using the cloud to do its work
• Is the communication encrypted end-to-end?
• Can the end user create their own local server?  The reason is that the manufacturer will eventually stop supporting the product or go out of business.  When that happens we are left with a working product, but, non-functional.

At this time hackers can (and are) using the weaknesses in IoT devices to create massive bot nets and disrupt access for individuals and companies (like battlenet and Runescape) and shut down access until they cave to their demands or spend a massive amount of money to mitigate future DDOS attacks.  Hackers are not stupid and realize that this is a ripe area to exploit as there isn't much in the way to detect and stop them.  The individuals behind the DDOS are bullies and need to be recognized as such and treated as such.  Krebs and battlenet are the most recent victims, but, will not be the last.  The question is how many more times and how many people will be impacted before action is taken?

Update 2016/09/25:

Looks like Krebs site is back up.  Good to know that he is back and the DDOS bullies didn't win this time.

Heartbleed from my perspective

For the record, I am not a security expert.  However, I have been working as a professional for over 32 years in the I.T. industry so I believe I can make comments on a number of items about Heartbleed.

Please try to remember is the internet was not designed to be secure.  It was originally designed for universities to communicate and they trusted everyone on the network.  Over the years bits and pieces were bolted on to help with security as the internet grew and was opened up to more and more businesses/people. 

A bit of background about myself:

1. I have a diploma in Business Administration, Programming major.
2. I can work in Assembler (PC and mainframe versions), APL, AWK, Bash, Basic, C, COBOL, Pascal, PL/1, and REXX in various levels of expertise.  (there are others that I have used, but, I have minimal knowledge of those languages)
3. Over 32 years I have worked on dozens of software projects large and small.  I performed a number of roles during this time such as developer, tester, business analyst, support and team lead.
4. Where I am currently working my role is interface expert for systems requiring access to to that system.  At this time the client is moving from FTP to SFTP and as a result I have obtained a working knowledge about SSH, SSL, certificates and private/public keys.
5. I can work with CP/M, DOS, Windows, Z/OS (AKA TSO), V/VSE, UNIX and Linux.

 

 First thing, don't panic!  

Second thing is don't change all of your passwords until the sites have updated their SSL and received new certificates.  Changing them right now probably will not protect you if the site site has been compromised.  When the site asks you to change, or, when they fix the site then change it ASAP!  Pick a moderately long password that is not easily guessed (no kids/pets/wife names/birth dates).  I usually pick two or more words not related and string them together with numbers to make it harder to guess.  One other important thing is never use the same password for different sites!  If you do get hacked, don't make it easy for them by using one password for everything.  You also should change passwords on a regular basis.

I was reading the news and some of the politicians here in Canada blame the government service cuts for this problem.  In my less than humble opinion this is complete utter BULLSHIT!  This problem has nothing to do with the government in any way, this is a very short code change in one OpenSSL module by a person several years ago and it passed a review before being deployed.  When I looked at the code fragment identified I didn't see any problem with it other than why do it just for performance reasons?  This is something that is usually bundled with the operating system if not then offered as an add-on for secure communications.  There was no reason to check this and no way to know there was a hole.  The blame is just cheap political theater and does not do anything to help fix the issue.

For those who are saying "why publish it, you are creating panic and letting hackers know about the hole?"  All I can say is:

1. True hackers (not script kiddies) probably knew about this and were making use of the hole.  Until recently there was no way the sites would be able to detect use of the hole and log the attempts to compromise the security of the system.  There are now signatures to help IDS identify possible hackers using the hole.
2. Various experts wanted to inform the general public about the issue and what they need to do, when to do it and how to do it.  These researchers who found this hole assumed hackers already knew about it!
3. Alert site owners who are using SSL to look at their operations to see if they are impacted and to determine their next steps to fix their systems if they are vulnerable.
4. If the site was compromised then the safest thing is to assume that all encrypted communications can be read until they fix the site, revoke their old certificates and publish new certificates.  If you are aware the site has been compromised you can make informed decisions as to if  you want to communicate with that site before a fix is in place.

I have seen others asking why some sites (like some banks) say they are OK.  We will need to trust those sites there, but, the likely reason is that they are not running the impacted OpenSSL module.  It would help if they could give a high level reason why they are not impacted.

Lessons learned:

1. For businesses you may want to review your BR/DR (Business Recovery / Disaster Recovery) plans to see if this type of problem is identified.  If not, then take the time and review the documents and insert what steps should be followed if there is a suspected breach in your network.
2. Software code reviews are a great way to identify potential problems before it is released.  The reviews may not catch all bugs, but, it helps confirm that good coding practices are followed at a minimum.
3. Security should be considered at the start of any code change.  It does add extra work and cost, but, it is easier to fix a bug before it gets out the door.  A process and set of test rules may also be a good way to check for specific errors.  There are packages out there that could be useful to the developers if management is willing to invest a wee bit of money.
4. Never let marketing dictate the timeline of a project, or, how the software is developed/tested.
5. Default settings for software should by default tend to be more paranoid and lock things down.  Explain each setting and the possible holes they may open up if they are changed.
6. Never have a default password, on install ask the end user what their password will be.
7. For users, never re-use your password!

 Other thoughts:

Can this happen in the future?  Optimistic me says no, realistically speaking it just may happen again.  Try to remember that a lot of the Open software is written by people who does this for the love of programming and don't get paid full time to do this and many do it without getting paid anything.  Many of the tools you are using are written by these people and the result is the wonderful rich online environment we have today.  The downside is they don't get a lot of money to pay people to do full time work where they can check for holes, review code checked in and improve the infrastructure we call the internet.

For those who say proprietary is better as they get paid my response is you don't know what the proprietary code does as we cannot review their work.  With open software we can review the code itself and in many cases make changes ourselves, compile those changes if we have a special case, you can't do that with proprietary code.

What can we do?  Well pull out your wallet and give a wee bit to the developers of the free software you are using would be a start.  Hopefully politicians and businesses see the benefit of funding a core set of people to work full time reviewing the core of the internet and make improvements as we are now dependent on the net for more and more of our daily lives.