Home About Black Hat Contact Essays Fireside Chats My Take News Alerts Q&A Reels RSAC Videocasts ☰
 

Videocasts

 

VIDEO: Ripples from Internet of Things create sea change for security, liability

By Byron V. Acohido

Fact about Dick Cheney: When he was vice president of the United States, Cheney so fretted about someone remotely hacking into his heart defibrillator that he had his doctors disable the device’s wireless feature.

Cheney’s prescience about unprecedented exposures arising from the Internet of Things has been borne out.

Manufacturers are foisting Internet-connected medical devices, automobiles, TVs, gaming consoles, webcams, thermostats, utility meters and household appliances on consumers faster than hackers—both white hats and black hats—can identify the intrinsic coding flaws.

About 70 percent of the most commonly used IoT devices contain password, encryption, authentication and other vulnerabilities, according to a 2014 Hewlett Packard study. HP reviewed 10 of the most popular IoT devices and uncovered an average of 25 software flaws per device.

The good news is that the tech sector is cognizant of these new risks and is moving to establish baseline stability for the Internet of Things.

It may take a while. A cabal of IT security startups and entrenched tech giants has emerged as the source of proposals to shape a stable foundation on which IoT can stand. Ideas range from software patching to assembling innovative wireless networks dedicated to IoT devices.

“You can think of a future where … there will be tons of sensors around our physical environment,” says Chenxi Wang, vice president of cloud security and strategy at cloud encryption vendor CipherCloud. “It can collect data about our movement, even our body temperature. Privacy is a big issue. Safety could be an issue when those devices are operating critical tasks, like driving a car.”

Unique characteristics

IoT devices tend to have limited networking and storage capacities. So there’s little room for traditional security software, says May Wang, co-founder and CTO of Silicon Valley-based ZingBox, a startup that provides IT network security services.

“It’s hard to deploy per-device security measures,” says May Wang, no relation to Chenxi Wang.

What’s more, IoT devices often … more

Comment | Read | September 9th, 2015 | For consumers | For technologists | Videocasts | Videos

VIDEO: Elastica discovers major vulnerability in Salesforce cloud CRM app

By Byron V. Acohido

Cloud application security start-up Elastica should be commended for alerting Salesforce privately about a notable flaw Elastica researchers discovered in one of the subdomains of the official Salesforce website.

Elastica gave Salesforce the heads-up last month, and waited until the CRM giant readied a patch before going public with its finding Wednesday.

Elastica researchers unearthed a cross-site scripting (XSS) vulnerability in admin.salesforce.com, a subdomain used by Salesforce administrators.

Had criminal hackers beat Elastica to the punch, they could have moved to exploit a huge vector of attack. Thousands of companies, many of them small and mid-size organizations that subscribe to Salesforce, would have been exposed.

Security & Privacy Weekly News Roundup: Stay informed of key patterns and trends

An attacker would have been able to execute phishing attacks from inside Salesforce and harvest users’ credentials, with a good chance of eluding spam filters and anti-phishing solutions.

But there is a larger lesson here. Business software can be riddled with flaws like this one, waiting to be discovered. Depending on who finds these so-called zero-day vulnerabilities first, either patching or exploitation can be expected to eventually follow. ThirdCertainty asked Aditya K. Sood, lead architect of Elastica Cloud Threat Labs, to outline the wider context.

3C: Can you characterize how pervasive these types of latent, but as yet undiscovered, vulnerabilities are in business software?

Sood: Any public-facing application is susceptible to an attack. It is difficult to say how many business applications are, but developers can make mistakes, which could result in vulnerabilities. For that reason, we require security assessments of business applications before they are deployed in production environments.

3C: How effective are bounty programs in keeping these types of vulnerabilities mitigated?

Sood: Bug bounties motivate researchers to disclose vulnerabilities to the vendors in a responsible fashion and, in return, researchers get rewarded for their efforts. It definitely helps to build positive relationships with security researchers. It is a very cost-effective … more

Comment | Read | August 13th, 2015 | For consumers | For technologists | Privacy | Videocasts | Videos

VIDEO: Why it’s high time ‘unstructured data’ gets acknowledged, protected

By Byron V. Acohido

Companies are generating mountains of unstructured data and, in doing so, unwittingly adding to their security exposure.

Unstructured data is any piece of information that doesn’t get stored in a database or some other formal data management system.

Some 80 percent of business data is said to be unstructured and that percentage quite obviously has to be rising. Think of it as employee-generated business information—the sum total of human ingenuity that we display in the workplace, typing away on productivity and collaboration software, and dispersing our pearls of wisdom in digital communications.

Unstructured data is all of the data that we are generating on our laptops and mobile devices, storing in cloud services, transferring in email and text messages, and pitching into social media sites.

Many companies are just starting to come to grips with the complex challenge of figuring out how to categorize and manage this deluge of unstructured data.

Sensitive data at risk

But what’s more concerning is the gaping security exposure.

It was unstructured data—in the form of a text message transcript of employees conversing about deflating footballs—that blindsided the New England Patriots NFL team and its star quarterback, Tom Brady.

Yet the full scope of risk created by unstructured data is much more profound.

“The risk that unstructured data poses dwarfs that of any other type of data,” says Adam Laub, product management vice president at STEALTHbits Technologies.  “It is the least understood form of data in terms of access, activity, ownership and content.”

I met with Laub as he was pitching STEALTHbits’ technology at the recent RSA Conference in San Francisco. “Any single file can contain the data that puts an organization in the headlines, and turning a blind eye to the problem or claiming it’s too big to handle is not a valid excuse for why unstructured data hasn’t been secured properly,” Laub says.

STEALTHbits helps companies that use Windows Active Directory … more

Comment | Read | May 17th, 2015 | My Take | Privacy | Steps forward | Top Stories | Videocasts | Videos

VIDEO: Why $3.6 million to prevent next Heartbleed isn’t enough

By Byron V. Acohido

A dozen tech behemoths — led by Microsoft, IBM, Google, Intel and Cisco — have stepped forward with cold, hard cash to prevent the next Heartbleed.

Each has pledged $100,000 annually for the next three years to a war chest earmarked to fund improvements of open source technology.

That’s a collective pledge of $3.6 million, through 2016, set aside in something called the Core Infrastructure Initiative, administered by The Linux Foundation.

Comment | Read | April 25th, 2014 | Videocasts | Videos

VIDEO: Heartbleed threatens financial channels

By Scott Borg

There seems to be some confusion about what Heartbleed is good for. Heartbleed is primarily useful for retrieving information from webservers that reveals the details of those servers’ recent interactions with clients.

This allows attackers to steal the “handshake” information that is used to authenticate an interaction between a client computer and a webserver. In particular, Heartbleed allows attackers to steal the private keys and other long-term authentication codes that are used to set up  private, encrypted communication sessions.

Heartbleed can also allow the attacker to steal enough of the content of the server’s recent communications to capture account numbers and passwords. Together, these pieces of information can allow the attacker to impersonate a client computer without any need to invade that computer.

Criminals using Heartbleed would be able to arrange improper transfers of funds on a fairly large scale, unless the various kinds of authentication codes were changed in time. While Heartbleed can also be used to invade many types of client computers, such as Android phones, potential attackers don’t need Heartbleed to do that. Most Android phones, for example, can already be compromised, using any of several tools currently available from cyber-crime websites.

Sophisticated attackers taking advantage of Heartbleed will be after bigger, more lucrative game than cell phones and credit card numbers. A large portion of the web’s financial channels were potentially in jeopardy.

Fortunately, there were probably not many cyber attackers aware of the Heartbleed vulnerability before the patches for it started to be distributed. Perhaps even more important, there were not enough criminal attackers who understood enough about how financial transactions are carried out to take full advantage of the possibilities Heartbleed opened up.

This means that the biggest opportunities that Heartbleed created for stealing money were mostly closed up before they were much exploited. If there were some large diversions of funds accomplished by using Heartbleed, these will probably never be publicly acknowledged, because … more

Comment | Read | April 21st, 2014 | Videocasts | Videos

VIDEO: A roadmap for triaging Heartbleed exposures

By Byron V. Acohido

The most worrisome aspect of Heartbleed arguably is the fact that  this gaping security hole is so pervasively embedded in the fabric of the  commercial Internet.  “There are a few protocols that dominate when it comes to the security and operation of the Internet as a whole, SSL/TLS is one of them.” says TK Keanini, CTO at Lancope.   “Everyone should have seen this coming.”

Companies and organizations ought to be scrambling over the next several days and weeks to triangulate and mitigate potential exposures relating to the wide use of the  OpenSSL encryption protocal recently shown to be dangerously squishy, from a security standpoint, observes  Dr. Mike Lloyd, CTO of RedSeal .  Top of mind should be the spectre of data thieves and cyber spies  hustling to exploit  the Heartbleed flaw in order to exfiltrate sensitive data, especially  private encryption keys, Lloyd says.

The potential for profound damage is such that a consensus is building in the security community that a  smart thing organizations should consider doing is stopping all transactions for a few days to do such an  assessment.

The mindset of IT security managers should be: “how fast can you identify unpatched machines and remediate them? Ideally you’d have a real-time map that can expose the vulnerabilities with a simple query or two to identify what’s been affected by Heartbleed, and what’s exposed,” Lloyd says. Extended exposures

So is this urgency warranted? Absolutely yes.

That’s because it’s not just web servers that are vulnerable, as widely reported this past week. Lancope’s Keanini points out that OpenSSL is also widely used to secure other types of network communication, which may or may not use a traditional browser.

This past week VMware and Cisco led a parade of device manufacturers releasing security patches to address Heartbleed in their devices. “Flaws in cryptographic libraries are much more wide spread than flaws in applications because these cryptographic libraries see so much re-use,” … more

Comment | Read | April 11th, 2014 | Top Stories | Videocasts | Videos

VIDEO: Über nasty Heartbleed bug exposes fabric of the Internet

By Byron V. Acohido

KINGSTON, Wash. – An über nasty security flaw has arisen from the din to command the attention of the global security community, rightfully so.

The so-called “Heartbleed” flaw represents a path bad guys can use to tap into OpenSSL, the open-source implementation of the SSL and TLS protocols that are used all across the Internet to encrypt sensitive data.

“This is a very serious vulnerability. It allows attackers to see a portion of the contents of memory of the vulnerable server,” says Matt Willems, LogRhythm Labs engineer. “This particular vulnerability still exists in many locations, so changing your password may just mean that the new password is vulnerable.”

John Miller, Security Research Manager at Trustwave, observes that the Heartbeat flaw was spawned when OpenSSL was tweaked more than two years ago. He says it makes sense that criminals took notice prior to good guy researchers at Google and a small security firm, codenomicon, identifying the flaw this week.

“Attackers may have already exploited the vulnerability, stealing passwords, payment card information and other sensitive data without the end-user or business even realizing it,” Miller says. “And, unfortunately, this attack will most likely have a long tail.”

By impersonating the server, attackers can decrypt traffic moving in and out of a business’ network to steal sensitive data. Even worse, they can grab private encryption keys, opening a Pandora’s box of exposures, says Jean Taggart, senior security researcher at Malwarebytes.

With possession of private encryption keys, an intruder can “impersonate the victim, and set up an undetectable man-in-the-middle attack,” says Taggart. “This is a huge issue that impacts the fabric beneath secure communications on the web.”

Small business exposure

Attackers can take advantage by decrypting traffic moving in and out of a business’s networks to steal sensitive information or gain access to users’ accounts. Small businesses that contract out hosting services, in particular, may be unaware of data leaking through the Heartbeat … more

Comment | Read | April 9th, 2014 | Imminent threats | Top Stories | Videocasts | Videos

« Newer Articles
Older Articles »