Downclimb

2017.09.10

Weekly infosec news summary for 2017.09.03 – 2017.09.10

Quotes

“Logs are like ice cream, if you keep them out, they are going to melt and will be of no use, consume them at your earliest and enjoy.” Nag Medida

“If you have an EDR or Sysmon deployed, probably the best thing you can do with it is identify attack surface you don’t use and kill it. If you’re spending all of your time authoring and deploying detections for stuff 1% of your users actually need, time to rethink the approach” Dave dwizzzle Weston‏

“Reminder that it’s 2017 and there’s still no reliable built-in way to encrypt a file to send to a peer on any mainstream OS. […] Encrypting a file is an unbelievably simple cryptographic problem; literally the “hello world” of the problem space. And nothing does it. You will have a TLS handshake with not one but two different post-quantum key exchanges before you have simple file encryption.” Thomas H. Ptáček‏

“When you look into compilers long enough, the compilers also look into you and point out your inefficiencies.” flacs

“the kernel has 5 separate ASN.1 parsers” Edge Security

“Hack Like Nobody’s Watching (because it is highly likely that nobody is watching)” ryan huber

“‘Just encrypt it’ is the favorite go-to suggestion of the semi-informed. Services that have to provide plaintext data need other protections. Encryption can be a very strong mechanism for internal access control and to reduce certain attack surfaces. But we gotta be realistic about the irreducible risks posed by services that must magically decrypt to work.” Alex Stamos

“Equifax is an example of how cybersecurity operates as a market failure. Little pressure for day-to-day prevention before the breach. Sounds odd perhaps, but ongoing systematic cybersecurity is expensive. Cost of infrequent brand-hit + crisis firm often cheaper than defence. Especially when defence costs dollars now, breach costs unknown dollars later. And defence reduces but doesn’t eliminate threat of breaches. Need to push up the cost of breaches to the point where folks insure against them. Then the insurance premiums will rapidly start depending on your security posture. And then cybersecurity team looks less like a net cost.” @pwnallthethings

Top stories

Equifax breach

One of the “big-three” U.S. credit bureaus, Equifax, announced it was breached, which may impact 143M Americans (link). There are a lot of bad aspects to what happened, in addition to credit histories being stolen. Here are some:

As part of the breach notification (link) the company created the site www.equifaxsecurity2017.com “to help consumers determine if their information has been potentially impacted and to sign up for credit file monitoring and identity theft protection.” You have to pay to sign up for that. The domain looks like a phishing site and was so new that many security products did not trust it. In order to see if you were impacted you had to wave some legal rights, such as filing a class-action law-suit. That aspect was quickly jumped on by district attorneys to fight against.
The breach was discovered on July 29, but not reported publicly until September 7 (40 days). Upon disclosure, the stock dropped 13.5% in after-hours trading. Within a few days of the breach discovery, and before it was public, a handful of execs, including the CFO, sold shares of stock outside of 10b5-1 scheduled trading plans (link). For those not versed in such things, for an executive to sell stock in the company they work at without it looking like insider trading, they normally announce and schedule their activities 90 days in advance of the sale so they can’t take advantage of sudden decisions or news. It is possible to legally make trades outside of these schedules, but should involve approvals from other execs, so we should expect these trades to be investigated to see who knew of the breach before making them.
Two days prior to the breach announcement, an employee at FireEye (which was the incident response company brought in to investigate this), purchased the domain equihax[.]com. It is hard to imagine a good reason for that domain purchase, so FireEye is going to need to firm up their NDA contracts and employee training.

As a consumer, there isn’t anything you should do for this situation to protect yourself individually, as most of this information likely already was available in some form to people. You should regularly review your credit report as needed (as in whenever you want to have good credit to buy a house for example) which you can get for free quarterly or get one for free more often from banks. See this write-up from Patrick McKenzie which explains this more thoroughly and what to do if you find something on that credit report that is fraudulent. If you want (although this isn’t really needed), you could put a freeze on your credit file as Krebs explains here.

For companies, this breach highlights the problems with identifying people, as it is assumed yet more PII about people has been stolen. You should not rely on things like social security numbers to identify people or to correlate them with other databases. They are not a shared secret. Avoid using them for anything. Consider all of your identifiers and your assumptions about them. Many people, as much as it may surprise you, share computers, smart phones, credit cards, phone numbers, email accounts, and various other online accounts with family members, coworkers, and more. Things you think might be secret for them (such as all of them aforementioned items) may not be, and worse they can end up being compromised in ways outside of the users control, such as this Equifax breach highlights for one such set of “secrets”.

Additionally, assume someone knows who all of the employees at your company are with financial issues who can most easily be blackmailed. Some background checks involve credit history checks for this reason.

Conference materials and publications

Sophisticuffs: The Rumble over adversary sophistication: Presentation by Paul Jaramillo on measuring attacker sophistication through his ACTOR method.

Tools

salesforce/ja3: A team at Salesforce has released a tool for fingerprinting the SSL/TLS client application as detected via a network sensor or device, such as Bro or Suricata, and is able to use that to detect applications such as Chrome running on OSX, the Dyre malware family running on Windows, or Metasploit’s Meterpreter running on Linux.