Dangerous Encryption?

I had always thought of encryption as a tool for security, never a tool for hackers. That changed when I came across this recent article about Ransomware, a Trojan that gains access to a user’s files and encrypts them against their will, essentially denying a user access to their own media and Microsoft Office files. This Trojan is so named because it asks for a $120 ransom in exchange for decrypting the files. Once the Trojan is installed, the wallpaper on the victim’s computer turns into a ransom note, reading "All your personal files (photo, documents, texts, databases, certificates, kwm-files, video) have been encrypted by a very strong cypher RSA-1024. The original files are deleted. You can check this by yourself - just look for files in all folders. There is no possibility to decrypt these files without a special decrypt program. Nobody can help you - even don't try to find another method or tell anybody."

Victims of this Trojan have acquired it from a defective pdf file, named Troj/PDFJS-ML, which downloads and installs the Ransomware. The article that I posted below states that this Trojan has the capability of encrypting a number of different types of files, including jpg, .jpeg, .psd, .cdr, .dwg, .max, .mov, .m2v, .3gp, .doc, .docx, .xls, .xlsx, .ppt, .pptx, .rar, .zip, .mdb, .mp3, .cer, .p12, .pfx, .kwm, .pwm, .txt, .pdf, .avi, .flv, .lnk, .bmp, .1cd, .md, .mdf, .dbf, .mdb, .odt, .vob, .ifo, .mpeg, .mpg, .doc, .docx, .xls, and .xlsx, but that it usually only encrypts the first 10% of a file.

The article does not, however, offer much advice as to what one should do if faced with this type of attack, other than that you should not pay the ransom. All computer users should prevent this kind of attack by making sure to install all software updates (especially for Adobe Acrobat) and by backing up their files in case they do become inaccessible.

http://www.esecurityplanet.com/trends/article.php/3914811/Ransomware-Scams-Take-Your-Data-Hostage.htm

Security Review: SugarSync

The use of multiple “smart” technology devices by an individual has increased dramatically over the past couple of years. Individuals are now using laptops, ipads, smart phones, and every gadget imaginable for work or school. A problem with the use of multiple devices is: how are you able to access a specific document on your laptop when the device is not accessible? The answer is a data backup company. SugarSync is an online data backup company that allows users to backup, share and access personal files from any computer, smart phone or other device with internet access (SugarSync.com). A user simply uploads the information from any device into the secure SugarSync “cloud” storage. When a user makes a change to a specific document already stored in SugarSync, the document is automatically updated (SugarSync.com). If a user is working on a project with a group, the individual can share the files with the other group members. SugarSync is a convenient way to have access to every file stored on the many devices a person owns.

It is imperative that the owner of SugarSync has many security goals in order to protect the vast amount of customer information stored by the company. It is essential that SugarSync maintain the confidentiality of a customer’s documents. Many businesses use SugarSync to backup their information. Therefore, there is personal data that, if compromised, could financially injure a company. Encrypting this data would prevent a hacker from being able to access personal information. SugarSync uses SSL encryption during the file uploading process and the files stored are protected by 128-bit AES technology. The combination of these two technologies protects the confidentiality and integrity of the customer’s information. It is also important that the company prevent anyone from making unauthorized changes to a user’s data. The files must be available to the individuals with authority to access them, while preventing unauthorized users from gaining access. SugarSync does this by password protecting the information, and then using multi-level security. The multi-level security gives higher-cleared individuals the option to provide access to files to other people, or prevent access.

A hacker would be able to exploit the technology of SugarSync by solving a decryption key. By solving the decryption key, the hacker would be able to steal the files in the SugarSync network. Gaining access to these files would allow the hacker to compromise any information that the user stored on the SugarSync network. The hacker could also alter the information being stored on SugarSync after he or she gained access. By gaining access to a file on SugarSync, the hacker could adjust the login name and password, which would prevent the owner from being able to access their files.

Because SugarSync can be accessed from a phone, I find this to be the easiest way for an attacker to enter personal files. SugarSync recently added more security to the Android App that allows a user to protect their files with a pin. However, the user can shut this mode off. A hacker could potentially steal the phone and access the files. Then they could change the password to prevent the authorized user from accessing their files.

As stated before, SugarSync is one of the most secure data backup servers. They run their company by the highest security standards; therefore, I believe the greatest risk with using the technology is in the user’s hands. Most people don’t want to enter a pin every time they access SugarSync on their mobile device. Because of this, I believe many will deactivate the pin security system. I can’t see a major breach in the SugarSync system because of their rigorous security standards, but I can picture a smaller number of breaches into individual files because a user doesn’t password protect their information.

SugarSync already has very rigid security guidelines that protect the customer’s information on the main server. They also back up the files in two state of the art data centers. This prevents total data loss if one of the data centers crashes. Because of the actions they have taken to secure customer data, I think the best recommendation I can give the company is to make sure everything is up to date. This will require the company to research new ways to stay ahead of hackers who attempt to breach their system. I would also recommend that the company make pin codes mandatory on devices such as the android. This would mitigate the risk that unauthorized users access files.

www.sugarsync.com

Course Slides

Here are links to all of the slides used in the course:

• Introduction
• Risk Assessment Example
• Access Controls
• VA Case
• Business of Security
• Cryptography
• Asymmetric Cryptography
• Network Security
• Firewalls
• Wireless Security
• Legal Issues
  
• Incident Response
• Intrusion Detection
  

Two Students Charged in Hacking - Current Event

Two former students, Joseph Camp and Daniel Fowler, at the University of Central Missouri have been indicted on the charges of breaking into university databases. They acquired over personal information on 90,000 students, faculty, staff, and alumni and attempted to sell the data. The students launched a virus on the UCM computer system and attempted to steal funds from the university.

The duo completed the attacks during last year's fall semester while they were both students at the school. They used a dorm room as the "home" of their attacks. They used a virus to infect the system - the source was typically a USB drive that they convinced people to insert into their computers. Another way they launched their virus was through enticing links in e-mails.

The virus allowed them to monitor all happenings on the network - including keystrokes, steal data, etc. It seems as if their main motivation was money because they attempted to sell the data they stole and add money to their student accounts.

I think that the cause of the event was fairly obvious. The users that allowed Camp and Fowler to gain access to their systems by either inserting a USB drive into their computer or clicking on a link in an e-mail.

I think it is necessary for everybody to become as educated on information security as possible. It is obvious that some education could have prevented this attack. If individuals would have known that the links were not safe to click on and to not load a USB onto their computer then it could have been prevented. Every user needs to be cautious all the time because there could always be somebody attempting to gain access to your computer (and personal information). On a larger scale, I think that the university needs to protect their students. I think that they could involve some sort of data encryption (possibly a hash function or triple DES) for very personal information. Although it would take more time and money to retrieve the data, the school could be certain that their students' information is protected.

http://www.computerworld.com/s/article/9197884/Two_former_students_charged_in_university_hack_in_Mo.?taxonomyId=17

Security Review: Notre Dame ID Cards

Your student ID card may not be as secure as you may think. The magnetic strip on your ID card contains your card number (your 90 ndID number, sans the first 9 and with a two digit number appended to the end, identifying which card you’re on – so if your ndID was 901234 and you’re on your second card, then your card number would be 0123402). The school has made an attempt to secure the magnetic strip by obscuring the card number in a string of random numbers. However, if you know the pattern and have access to just one student ID card, it is possible to identify the pattern and figure out how to extract data from the card.

As the user of a student ID card, I would want the card to be as secure as possible. In terms of confidentiality however, it is unreasonable to assume that the ID number will be confidential because it must be decrypted to be read by card scanners. Instead, confidentiality should be achieved through alternate means, namely a PIN. The University recognizes that it is not possible to fully protect the ID number by making it a non-sensitive internal ID number, one that has little significance outside the organization. In terms of integrity, very light protection is provided by printing the card number on the face of the card so it can verified against what is encoded on the magnetic strip. However, this is easily overcome by simply printing one’s own card that looks like a Notre Dame ID card with matching card numbers printed on the front and on the magnetic strip. The Notre Dame ID card system’s availability depends on whatever the system the card is being used to access – this could be the Registrar’s computer system/Banner, the dorm/University locksmith systems, or another system that utilizes an ID card for access.

The primary vulnerability in the ID card system, then, is the potential for an attacker to create their own ID card by simply acquiring a student ID number through social engineering and writing it to blank card, which they could make (if necessary) look like a legitimate ID card. While attackers could always skim the data off a card’s magnetic strip by swiping it through an illegitimate card reader that copies the data, attackers could also obtain the card data through social engineering. Because the University views the ND ID number as a non-sensitive identifier, it appears all over the place – on most Banner pages (including course schedules) and some professors use it to post grades. Thus, the primary threat here is a threat of disclosure.

Someone could then, in theory, generate their own ID cards to either gain access to dormitories or steal meal plans. The attacker should ideally target freshmen. This is because of two reasons: freshmen are more likely to print out their schedules at the beginning of a semester – and this schedule has both their names and student ID numbers printed on it. Secondly, freshmen are more likely than any other class to be on their first ID card, making it safer to assume that their ID card number ends in 01. As you move up through the classes, there is greater variance as people move onto their second or third (or more) card. All an attacker needs to do is to obtain the student’s schedule printout which they can do through social engineering techniques or just dumpster diving. Armed with the student ID number, an attacker simply needs to strip off the leading 9, append an 01 to the end, and add the requisite number of leading and ending random digits. With a convincingly printed card, an attacker could use the card to steal the person’s meal plan. And, with the owner’s name printed on the schedule, a quick Facebook search can reveal the person’s birth date, and thus their access code into a dormitory.

This, of course, assumes that card readers simply remove the random digits, and append a 9 to derive the student’s ID number, from which they perform a database lookup. A more secure method of encoding an ID card would be not to use random leading and ending digits for obfuscation, but to make these digits derived from other static but not too common information. For example, the random numbers could be replaced with a truncated (first 5 characters) hash of the last four digits of the person’s (freshman year) phone number. Hashing the data keeps it secure, while using the last four digits of their phone number allows for greater variance among the student body. If ZIP code or area code were to be used, for example, there would be a lot of repetition among the student body given that a lot of people come from the same (Chicagoland) areas. Finally, the freshman year phone number is used to avoid the need to issue a new ID card every time the student’s contact information changes.

This system would be more secure because when the card readers derive the student’s ID number and make their database lookup, they should also lookup the student’s freshman year phone number, hash the last four digits, and truncate the hash to just its first five characters – then compare these characters to the leading digits on the ID card. If they match, then we can have greater assurance that the ID card is legitimate and not a socially engineered fake. However, the phone number can also be socially engineered (though the task of getting more information increases the “cost” of creating fake ID cards) and this solution does not eliminate the issue of skimmed/copied ID cards.

Human, technology key to security defense

SINGAPORE--Security experts are calling for greater emphasis on human factors in dealing with IT security risks and reiterating the need for technology to be the last line of defense.

Speaking at the Enterprise Information Security 2010 conference held here Tuesday, Fuller Yu, vice president of resiliency and IT risk management at JP Morgan Hong Kong, said the key to protecting sensitive data is to inculcate an environment where employees are educated and aware about potential risks. He revealed that the financial services company requires all its staff, as well as third-party vendors that have access to JP Morgan's data, to undergo IT security training.

Yu explained: "The training is to ensure staff members take responsibility in maintaining data security. You will take very good care of your mobile phone and money, so this applies to data at work. If there is no proper training, people may shirk responsibility and say this information does not belong to me."

He also urged senior IT executives to start similar training programs as education is a "multi-investment and most effective way" of keeping the organization's sensitive data and transactions at bay. It is not enough to simply rely on technology alone, he said.

Muhammed Dawud Saifullah, head of IT infrastructure at Celcom Axiata, concurred. He acknowledged that while most organizations would have to work within a limited amount of resources, they should evaluate the feasibility of increasing efforts on training staff members to better handle security matters.

Also a speaker at the conference, Saifullah suggested using branding and marketing tactics, such as corporate wallpaper with a one-sentence reminder highlighting "safety" best practices to drive home the message. Such "motivation" efforts are especially relevant in combating security attacks which carry a sociological element, he said.

He pointed to Kevin Mitnick, the infamous IT hacker who, among other crimes he committed, was able to obtain the source codes of a Motorola mobile phone simply by speaking to a staff member and "dropping names".

Saifullah said studies have shown that it is human nature to respond to familiarity and form relationships, and Mitnick took advantage of this trait and deployed social engineering to gain sensitive information.

"For you to secure the infrastructure, you need to look at what motivates people to act the way they do, then come up with initiatives such as slogans or mascots. With greater understanding comes better security behavior," he said.

However, he cautioned against implementing tough penalties on any breach of security protocols as it is proven that security effectiveness is inversely proportionate to the severity of the punishment. "Whereas, if employees buy-in [to the idea], then it becomes a motivational factor [to comply with the protocols]," he said.

Deepak Rout, chief information security officer at Uninor, added that if IT departments feel the need to implement "penalty" for policy breaches, these should be linked to HR (human resource) policies to ensure effective results.

UAE faces government challenge

While enterprises today are faced with multitudinal security issues in the workplace, those operating in United Arab Emirates (UAE) have more issues to address, according to Samir Abdullah, director of fixed and core network security at du, a telecommunication services provider based in the UAE.

Samir, who also spoke at the conference, explained that operators in the local telecom industry have to comply strictly with regulatory guidelines and need extra manpower to monitor certain applications such as Skype.

"You always keep a certain percentage [of the budget] dedicated for security, and enterprises have to be mindful that this is an expense that they have to consider," he explained.

"Don't Fight the Cloud"

Cloud computing has been in recent news as the next big evolutionary change in the computing world. What is all this hype about? More importantly, what is cloud computing? Cloud computing does not have one establish and widely agreed upon definition, but it is accepted as a relatively new concept of computing outside of servers. It “is Internet-base computing, whereby shared resources, software, and information are provided to computers and other devices on demand, like the electricity grid.”

John Thompson, a chairman for the Symantec Corp., compares cloud computing to any natural evolutionary process under which it is inevitably going to be a significant part of our future. He continues to argue that we should, therefore, embrace it and take advantage of the benefits that it can offer the computer world. However, as with every new technology, the security concerns must be addressed.

Many believe that computing on the cloud, and therefore having sensitive information available on the cloud, is a significant concern. Inherently it is believed that this information is safer when handled internally. John Thompson argues that these insecurities can be managed. Security focuses would no longer be focus on hardware and infrastructures; rather the focus would switch to purely information-based. This would require constant monitoring, however these are concerns are being addressed by the Cloud Security alliance, a nonprofit dedicated to promoting security assurance in cloud-based computing. Furthermore, people need to take the time to understand the technology that they are dealing with; John Thompson recommends easing into the technology, starting with little amount of insignificant information being moved to the cloud and work from there.

Ultimately, I am interested to see what role the Cloud will play in our computing future. This new idea definitely has its perks of convenience, speed, centralization of information, and other distinguishing features, but with new security issues (such as not have the ability to physically remove malware, like can be done on a server) it is absolutely necessary for the success of this technology that the proper security conditions are implemented to protect information on the Cloud.