I know that many security 'professionals' will scaremonger and preach doom and gloom at every turn in order to drive up sales. However, they're not always wrong. I read the article 'Mobile device users fail to take basic steps to protect themselves, survey finds' and wanted to relate an event that happened this weekend. Many people are saying that mobile device security threats are hype and that nobody is actually exploiting them. That's possibly true to a certain extent at the moment, but for how long? Another article claims that identity theft is now more profitable than car theft! A mobile phone is a very good start for this purpose.
An interesting figure that comes from the article above is that 160,000 mobile phones are lost or stolen every day. I assume that this is just in America, as in Britain the figure is around 20,000 a day. Whether or not these figures are accurate is immaterial, the fact remains that a lot of phones go missing. What do you have access to from your mobile?
The recent incident that I mentioned above happened on Sunday. Someone left their iPhone at a sports training ground I was at. On inspection of the phone, there was no authentication set on it at all. I was able to see photographs, names, addresses and telephone numbers of family and friends. In addition to this, they had a Facebook App, which was still signed in. It would have been very easy to update their status with a malicious link for all their friends to visit. Worse than this, however, was the fact that they had access to their corporate email and address book from the phone - a FTSE 100 company. Again, this was still signed in with no additional authentication required. What corporate information could I have gained access to?
As it was, a phone call to the telephone number entered as 'Home' enabled the phone to be returned without stripping data off it or sending phishing messages. However, what if someone else had picked it up? The survey in the article stated that, of those interviewed, over 65% used their mobile phone to access corporate email and networks. "Do you send or receive sensitive information via email?" should have been the next question.
Businesses and employees should think carefully about the data held on their devices and the level of access they have to the corporate network. At the very least people should always have some form of authentication set on their phone, e.g. a PIN, password or stronger authentication. The majority of users leave applications, such as email and social media accounts, perpetually logged in and many users leave their devices unlocked. Even when they are forced to lock them due to policies, they don't always really secure the device. I have seen many users with corporate phones that require passwords use simple passwords (such as 'qwerty') so that they are easy to type. They site difficulties in typing complex passwords as being the major reason for choosing simple passwords, which is in line with the findings of the survey.
The bottom line is that these devices are part of the corporate network, whether the IT department is aware of them or not. They need protection. Even as an individual, protect your identity and your contacts by employing automatic locking of your mobile with passwords or long PIN numbers and don't leave apps permanently logged in. (I find it surprising/worrying that I have to give this warning/advise!)
Showing posts with label social media. Show all posts
Showing posts with label social media. Show all posts
Tuesday, 11 October 2011
Thursday, 9 June 2011
Skype Phishing from ONLINE HELP
It seems that many users are receiving Phishing phone calls through Skype from a profile called 'ONLINE HELP'. This call, if answered, plays a recorded message telling the user that their computer is not protected and that they must go to visit www.hosog.com. If you do visit this site, it is riddled with malware. This is a phishing scam!
The user account that I have observed is drationlinehelpgb and shows as being registered in the US, but seems to have been taken down now. However, others have reported a user account of drajizonlinehelp, which appears to be registered in Afghanistan. This one is still live at the time of writing and is using the same 'ONLINE HELP' profile name. It would appear that new accounts are being created as the old ones are blocked by people and reported for abuse to Skype.
It is slightly worrying the number of people who are reporting having answered this call. If you receive any unsolicited calls through Skype from users outside your contacts, don't answer them. Indeed you should actually change your privacy settings in Skype if you haven't already. Choose the Privacy... menu item in the Skype menu to open up the Privacy settings tab in the Options dialog. Make sure that all the options are set to people in my Contact list only. I suggest that you also don't share your online status on the Web. You shouldn't now receive calls out of the blue from scammers.
The problem is that people are becoming trained into accepting connections in social media sites and it spills out into their other online activities. People still think that SPAM and phishing scams only happen over email. Actually, people are usually fairly vigilant with their email, so it is more likely to be successful if they try other avenues. Sophos did an experiment at the end of 2009 where they created two fictitious Facebook users, one with a profile picture of a rubber duck. They had thousands of people sign up to 'friend' them. How carefully do users check links from their 'friends'? It opens up a very good channel for SPAM and phishing attacks. As a general rule of thumb don't connect or share details with anyone you don't personally know through social media, voip, email, etc. Also, if you use these media channels a lot, you should think about investing in a security product to help protect you.
The user account that I have observed is drationlinehelpgb and shows as being registered in the US, but seems to have been taken down now. However, others have reported a user account of drajizonlinehelp, which appears to be registered in Afghanistan. This one is still live at the time of writing and is using the same 'ONLINE HELP' profile name. It would appear that new accounts are being created as the old ones are blocked by people and reported for abuse to Skype.
It is slightly worrying the number of people who are reporting having answered this call. If you receive any unsolicited calls through Skype from users outside your contacts, don't answer them. Indeed you should actually change your privacy settings in Skype if you haven't already. Choose the Privacy... menu item in the Skype menu to open up the Privacy settings tab in the Options dialog. Make sure that all the options are set to people in my Contact list only. I suggest that you also don't share your online status on the Web. You shouldn't now receive calls out of the blue from scammers.
The problem is that people are becoming trained into accepting connections in social media sites and it spills out into their other online activities. People still think that SPAM and phishing scams only happen over email. Actually, people are usually fairly vigilant with their email, so it is more likely to be successful if they try other avenues. Sophos did an experiment at the end of 2009 where they created two fictitious Facebook users, one with a profile picture of a rubber duck. They had thousands of people sign up to 'friend' them. How carefully do users check links from their 'friends'? It opens up a very good channel for SPAM and phishing attacks. As a general rule of thumb don't connect or share details with anyone you don't personally know through social media, voip, email, etc. Also, if you use these media channels a lot, you should think about investing in a security product to help protect you.
Friday, 3 June 2011
Google email Accounts Compromise
I was asked to comment yesterday on the story that emerged about the Google mail accounts that were compromised over the last few days, so I thought I'd put some of my answers down here. First off, Google wasn't compromised; a set of phishing emails were sent out and a fake Gmail login set up to harvest login details. These were used to set up forwarding rules to copy mail to another account.
Unfortunately, although a large number of people are aware of phishing and are (to a certain extent) vigilant, it only takes one person within the organisation to fall for the attack to compromise security. The scammers are becoming better at targeting people and making the initial phishing contact more believable to some people. Phishing is not just about email, although that is the most common avenue for the initial contact. Social media is also commonly used and we have seen the use of SEO to force phishing sites to the top of search engine rankings as well. User education is the only real way out of this.
Could this be cyber espionage? I would think that is most likely given the profile of those targeted. Information is worth a lot of money and political weight. In recent years we have seen a decrease in attacks designed to deface/destroy/delay/deny services and information. Instead, we are now seeing information and identity theft as major goals. Viruses won't necessarily stop your computer from working, but they will use Trojans to steal your login credentials. Malware now will silently sign your machine up to botnets rather than perform an obviously malicious action.
What can companies like Google do to stop this? Well, they can improve their SPAM filtering for a start. It is possible to eliminate the vast majority of phishing emails, which would drastically reduce the problems. However, many of the major vendors aren't strong enough on this. Secondly, user education would help a lot, but can't always help you against the best social engineers. To be honest, though, the governments and organisations that these people work for shouldn't allow the use of gmail, or other accounts (which have fewer controls than a corporate email setup), for official business and should educate their users to use different passwords, be vigilant, etc.
Spear phishing is a more difficult one to combat as it targets a specific user or group of users that the attacker has knowledge of. If I know your habits and who your friends are then I can use that information to trick you much more easily. If you receive an email or Facebook message from your partner, do you hesitate before opening it? The reason this doesn't happen more is that it takes background research and, by definition, targets very few people. This technique is only relevant if you want what that specific user has access to. Hence it is more likely to be information that they were after.
Another way to combat these types of attack is to use one-time passwords as well, so that intercepting a single logon only gives you access during that session, and isn't valid in the future. However, tokens are prohibitively expensive for Google to hand out to everyone. There are other solutions such as SMS tokens, but these aren't all that cheap, when multiplied up by the number of gmail users, and aren't without their problems. Software token solutions such as Swivel, GrIDsure, FireID, etc., are possibly cost-effective enough to be implemented and could drastically reduce the success of these attacks. However, none of these stop the man-in-the-middle (MITM) attack, so you could still hijack the session and set up a forwarding rule to obtain a copy of all their mail. Google do allow you to set up alerts and have to validate changes through a 2-step process, but you have to enable this. This should be the default for all of these services. Perhaps they could also add a footer to all versions of the email to specify where it has been forwarded to.
How worrying is this sort of attack? Well, that depends. Most people can be socially engineered - look at Derren Brown! For the individual, spear phishing is unlikely to be a problem, but with a lack of education they may well fall for a bulk phishing scam anyway (thousands do or nobody would bother). However, for those with access to secrets or other valuable information, it is a serious issue. It all comes down to how good the attacker is. I believe that HM Treasury is the most attacked entity in this country and that is mostly for information rather than evading tax or performing Denial-of-Service, etc. They should be worried about this type of attack.
Unfortunately, although a large number of people are aware of phishing and are (to a certain extent) vigilant, it only takes one person within the organisation to fall for the attack to compromise security. The scammers are becoming better at targeting people and making the initial phishing contact more believable to some people. Phishing is not just about email, although that is the most common avenue for the initial contact. Social media is also commonly used and we have seen the use of SEO to force phishing sites to the top of search engine rankings as well. User education is the only real way out of this.
Could this be cyber espionage? I would think that is most likely given the profile of those targeted. Information is worth a lot of money and political weight. In recent years we have seen a decrease in attacks designed to deface/destroy/delay/deny services and information. Instead, we are now seeing information and identity theft as major goals. Viruses won't necessarily stop your computer from working, but they will use Trojans to steal your login credentials. Malware now will silently sign your machine up to botnets rather than perform an obviously malicious action.
What can companies like Google do to stop this? Well, they can improve their SPAM filtering for a start. It is possible to eliminate the vast majority of phishing emails, which would drastically reduce the problems. However, many of the major vendors aren't strong enough on this. Secondly, user education would help a lot, but can't always help you against the best social engineers. To be honest, though, the governments and organisations that these people work for shouldn't allow the use of gmail, or other accounts (which have fewer controls than a corporate email setup), for official business and should educate their users to use different passwords, be vigilant, etc.
Spear phishing is a more difficult one to combat as it targets a specific user or group of users that the attacker has knowledge of. If I know your habits and who your friends are then I can use that information to trick you much more easily. If you receive an email or Facebook message from your partner, do you hesitate before opening it? The reason this doesn't happen more is that it takes background research and, by definition, targets very few people. This technique is only relevant if you want what that specific user has access to. Hence it is more likely to be information that they were after.
Another way to combat these types of attack is to use one-time passwords as well, so that intercepting a single logon only gives you access during that session, and isn't valid in the future. However, tokens are prohibitively expensive for Google to hand out to everyone. There are other solutions such as SMS tokens, but these aren't all that cheap, when multiplied up by the number of gmail users, and aren't without their problems. Software token solutions such as Swivel, GrIDsure, FireID, etc., are possibly cost-effective enough to be implemented and could drastically reduce the success of these attacks. However, none of these stop the man-in-the-middle (MITM) attack, so you could still hijack the session and set up a forwarding rule to obtain a copy of all their mail. Google do allow you to set up alerts and have to validate changes through a 2-step process, but you have to enable this. This should be the default for all of these services. Perhaps they could also add a footer to all versions of the email to specify where it has been forwarded to.
How worrying is this sort of attack? Well, that depends. Most people can be socially engineered - look at Derren Brown! For the individual, spear phishing is unlikely to be a problem, but with a lack of education they may well fall for a bulk phishing scam anyway (thousands do or nobody would bother). However, for those with access to secrets or other valuable information, it is a serious issue. It all comes down to how good the attacker is. I believe that HM Treasury is the most attacked entity in this country and that is mostly for information rather than evading tax or performing Denial-of-Service, etc. They should be worried about this type of attack.
Friday, 29 April 2011
InfoSecurity Europe 2011
InfoSecurity Europe is over for another year. Once again there were several interesting companies and sessions worth noting. The 'themes' (if they can be called that) or 'hot topics' were cloud security again, social media and mobile access/the consumerisation of IT. The big difference seemed to be in the attitudes of people - more 'how can we reduce the risks to an acceptable level?' rather than 'we can't secure it, so we won't allow it!'
We are seeing a shift in the types of systems end users are accessing the corporate network from. The IT department are no longer dictating what will or will not be allowed. More and more users want to use their own personal devices, such as iPhones or iPads, on the network. In the past IT departments have resisted this and said no to the users. However, this attitude is beginning to change and there were a raft of organisations with solutions to help secure these devices and manage the data they contain. However, an awareness of risk and what it means to consumer devices and ownership must be understood beforehand.
With cloud security a big issue, and still stopping some organisations from adopting cloud services, I decided to speak to some of the cloud services providers about their security. Many of them couldn't give me the real technical details, but some of them did have some reassuring things to say. Unfortunately, not all services are equal and organisations are still going to have to do a lot of research on the providers and make sure that they ask to see independant reports on the security of any potential provider. Make sure you ask them the difficult technical questions and only use their service if you are happy with their answers. Again, always remember that you can't outsource risk, so think carefully about what you want to use the cloud for.
Social media is still an issue that some organisations are solving by blocking it and others are ignoring. With the latest generation of products, again we can be quite granular with the level of access granted to social media, so a default blocking isn't necessary in all circumstances. The (ISC)2 have conducted a very interesting survey on security that shows some interesting trends, not least of which is that 49% of organisations block Facebook and around 20% don't monitor social networks at all. As social engineering and backdoors through user activity are some of the main causes of problems, this is worrying. Indeed, the survey showed that security professionals put education and policy mechanisms as the top 6 security security solutions required, with software and technologies coming in 7th and 8th respectively.
We are seeing a shift in the types of systems end users are accessing the corporate network from. The IT department are no longer dictating what will or will not be allowed. More and more users want to use their own personal devices, such as iPhones or iPads, on the network. In the past IT departments have resisted this and said no to the users. However, this attitude is beginning to change and there were a raft of organisations with solutions to help secure these devices and manage the data they contain. However, an awareness of risk and what it means to consumer devices and ownership must be understood beforehand.
With cloud security a big issue, and still stopping some organisations from adopting cloud services, I decided to speak to some of the cloud services providers about their security. Many of them couldn't give me the real technical details, but some of them did have some reassuring things to say. Unfortunately, not all services are equal and organisations are still going to have to do a lot of research on the providers and make sure that they ask to see independant reports on the security of any potential provider. Make sure you ask them the difficult technical questions and only use their service if you are happy with their answers. Again, always remember that you can't outsource risk, so think carefully about what you want to use the cloud for.
Social media is still an issue that some organisations are solving by blocking it and others are ignoring. With the latest generation of products, again we can be quite granular with the level of access granted to social media, so a default blocking isn't necessary in all circumstances. The (ISC)2 have conducted a very interesting survey on security that shows some interesting trends, not least of which is that 49% of organisations block Facebook and around 20% don't monitor social networks at all. As social engineering and backdoors through user activity are some of the main causes of problems, this is worrying. Indeed, the survey showed that security professionals put education and policy mechanisms as the top 6 security security solutions required, with software and technologies coming in 7th and 8th respectively.
Subscribe to:
Posts (Atom)