ITACS 5211: Introduction to Ethical Hacking

Wade Mackay

Insider Threats

Insider Threats

by 2 Comments

A recent research provided from Imperva explained that one in every fifty employees is a malicious insider.  This reaffirms Gartner’s research that the insider is not just disgruntled employees leaving the organization.  Departing disgruntled leaving an organization is often anticipated, but the article warns that attention should also be rendered to current employees who sells information as a secondary source of income.

Impreva’s research, reviewed 140 security incidents and quizzed 250 UK based IT professionals which showed that these insider threats can have severe impacts on the organization.  These events include theft or dissemination of confidential data, indemnity theft, loss of productivity and damage to equipment and facilities.  The study showed that the biggest threat to enterprise security is the people that’s already on their payroll.

It also provides some mitigation and detecting techniques such as proper data classification, storage, and processes involving sensitive data.

Source: http://www.infosecurity-magazine.com/news/1-in-50-employees-a-malicious/

Cyber-Security regulations issues by Newyork state department of financial services

by 4 Comments

The New York State Department of Financial Services has proposed a new regulation imposing significant new cybersecurity requirements on banks, insurance companies, and other financial services institutions regulated by DFS .

The new requirements will require such institutions to, among other things, establish and maintain a cybersecurity program, create an immediate response plan for security breaches, and designate a qualified individual to serve as Chief Information Security Officer (“CISO”).  The Proposed Regulation contemplates an effective date of January 1, 2017, with compliance required 180 days later

http://www.jdsupra.com/legalnews/new-york-state-proposes-new-27798/

How did FBI hack terrorist’s iPhone? News groups sue to find out

by 4 Comments

When the government was able to unlock the San Bernardino shooter’s iPhone, they backed off of their demands that Apple assist with the breaking into the device.  They did not, however, provide Apple with details into how they were able to unlock the iPhone.  In my opinion, and apparently the opinion of the Associated Press, Gannett Satellite Information Network (”USA TODAY”), and Vice Media, this is a disservice to the millions of taxpayers that use iOS devices.  These organizations are suing the FBI for not disclosing how they were able to break into the phone.  This leaves potentially millions of iOS devices exposed to the vulnerability that allowed the FBI to obtain access to a locked iPhone.

The NIST Cybersecurity Framework, a government published set of standards, encourages information sharing about vulnerabilities and threats between private and public organizations.  I am a strong advocate of this principal because as companies work together to share information to protect against cyber threats, the benefits of increased security extends beyond the walls of the organization that identified the cyber threat.  It also helps us to collectively solve for vulnerabilities that are identified and shared.

In this case, however the FBI appears to be withholding information about the vulnerability for their own benefit.  If they publicly share the method in which they were able to unlock the device (or even privately with Apple), the folks in Cupertino will almost certainly address the security flaw immediately.

There is a fine balance between strong security and enabling our law enforcement to investigate, however I am not in favor of providing back doors to law enforcement and withholding security flaws that leave millions exposed.

Article links:

https://www.cnet.com/news/fbi-sued-over-apple-iphone-hack-by-vice-ap-gannett/

https://www.documentcloud.org/documents/3109606-16-Cv-1850-Dkt-No-1-Complaint.html

 

Volkswagen launches new cybersecurity firm to tackle car security

by 5 Comments

Volkswagen has teamed up with an Israeli group to launch a cybersecurity company. This company is called Cymotive and will be headquarted in both Israel and Germany. The Cymotive chairman said:

“Together with Volkswagen we are building a top-notch team of cyber security experts. We are aware of the significant technological challenges that will face us in the next years in dealing with the cyber security threats facing the connected car and the development of the autonomous car.”

Now that cars are becoming ‘smarter’, security for the connected cars is becoming top priority. I wouldn’t be surprised if more car companies start some kind of cyber initiative similar to this one. I just hope that the car companies collaborate together in terms of research and development to improve the security of these cars.

link: http://www.zdnet.com/article/volkswagen-launches-new-cybersecurity-firm-to-tackle-car-security/

 

Cyberattacks on Athletes May Be Russian Distraction Tactic

by 4 Comments

This past Wednesday, private information about international athletes leaked on the internet.  This information was allegedly leaked from the World Anti-Doping Agency, and included 25 medical drug exemptions given to athletes from 8 different countries.  As many of you may know, Russia was banned from competing in the Olympics in several sports this summer in Rio, due to a systematic doping scandal with Russian athletes in all sports.  The hackers originally gained access through a phishing technique used against the whistle-blower that accused Russia of state-sponsored doping.  There is no proof that Russia was behind the cyber-attack, but all evidence suggests it was a hacking group called “Tsar Team” or “Fancy Bear”.

 

http://www.technewsworld.com/story/83906.html?google_editors_picks=true

Backdoor Government Decryption Hurts My Business and Yours

by 4 Comments

This article written by the CEO of Carbonite, a business that backs up more than 1.5 million businesses worldwide, would have to give up their encryption technology if the legislation proposed by Senators Burr and Feinstein is passed. The legislation they are proposing makes companies provide a “backdoor” to their encryption if a judge deems it necessary. Ali explains that if cyber criminals were to discover these backdoors that it would be like “…building a home with state-of-the-art alarm systems, but then cutting off the power to them.” Ali also says that it would essentially undermine years of progress by engineers in encryption technologies back tracking their progress and making systems ultimately more vulnerable. The government needs to strongly think about cyber security as a whole and see how something like this could plague both the internet and the US economy.

Article: https://hbr.org/2016/09/backdoor-government-decryption-hurts-my-business-and-yours

Cybersecurity: Two-thirds of CIOs say threats increasing, cite growth of ransomware

by 4 Comments

Over the past few years, it is no secret that Malware, Denial of Service Attacks and Zero Day Exploits have been among the most popular ways hackers launch cyber-attacks. Also, as cyber threats is becoming a more growing concern, so does the type of attacks that are available today. According to the author of “Cybersecurity: Two-thirds of CIOs say threats increasing, cite growth of Ransomware,” Alison DeNisco, Ransomware is rapidly multiplying and more than 718,500 users were hit with encryption Ransomware over a one-year period (2015 – 2016). The writer continues to add that this is an increase of 550% compared to the same period in 2014-2015 according to Kaspersky Lab.

As stated in the title, two-thirds of CIOs now believe threats increasing, cite growth of Ransomware. This is true because Ransomware is developed as one of the quickest ways for hackers to get money. For example, LA Times’ Richard Winton reported on February 18 this year that, “Hollywood Presbyterian Medical Center paid a $17,000 ransom in bitcoin to a hacker who seized control of the hospital’s computer systems and would give back access only when the money was paid, the hospital’s chief executive said Wednesday.”

Ransomware is an issue that the FBI and the U.S. Homeland Security need to address rapidly before it becomes more popular. For example, they can invite malware researchers to work with organizations to legally get paid if they can prove that known vulnerabilities exist or can be exploited.

Below are the two articles:

http://www.techrepublic.com/article/cybersecurity-two-thirds-of-cios-say-threats-increasing-cite-growth-of-ransomware/

http://www.latimes.com/business/technology/la-me-ln-hollywood-hospital-bitcoin-20160217-story.html

Hacker making up money by revealing client vulnerability through stock market

by 3 Comments

How can the market players play with security vulnerabilities of different firms…Ill share the news
There is always a pact between a cybersecurity researchers and the companies that when a cyberSec. firm finds a vulnerability in an organization they will report it to the organization directly and get the money in reward or as per the deal.
But a strange thing somehow happened a Cybersecurity Firm- MED SEC found alleged bug in the St. Jude Medical company implantable heart equipment.
MedSec rather than approaching the medical company it went to the shortseller firm MUDDY WATER.
The investment firm Muddy Water would make the vulnerabilities public in exchange for giving the cybersecurity firm a cut of the profits Muddy Waters made from betting against the medical device maker’s stock.
http://www.denverpost.com/2016/09/04/cybersecurity-strategy-insecure-companies-wall-street/

Google Launches Android Hacking Contest

by 2 Comments

Here you go hackers, if you want to make up to $200 k, here is the way.

The project Zero Prize is a way for participants to find a full exploit that will allow them to achieve remote code execution on up-to-date Nexus 6P and Nexus 5X devises, by knowing only their email address and phone number, with a few conditions.

The first prize is a juice $200,000 and $100,000 for the second place, how about that?

Natalie Silvanovich is Google’s Project Zero team lead and explained that their “main motivation is to gain information about how these bugs and exploits work”

This article also talks in detail on how to play and other rewards offered by the giant search engine.

 

http://www.securityweek.com/google-launches-android-hacking-contest