Knocked into a cocked (Panama) hat

11 04 2016

Unless you’ve been living under a rock for the past week you can’t have failed to be aware of the ‘Panama Papers’. 2.6Tb of data, 11.5m documents, 30,000 lorries worth if you printed then out and so on and so forth.

Information relating to offshore companies, tax avoidance and (possibly) tax evasion, dodgy art deals, alleged money laundering activities, corrupt country leaders and multi millionaires.

So what has this to do with my reader base? Well unless you’ve been keeping something from me and you’re actually an international bad guy, up there with Scaramanga and Blofeld, not a lot on the face of it.

But, let’s just take a step back and look at this from a slightly different angle.

Here we have a law firm, Mossack Fonseca, who prided themselves on guaranteeing confidentiality, indeed on their web site under data security they say “Your information has never been safer than with Mossack Fonseca’s secure Client Portal”. The people they dealt with chose them because they didn’t want their activities to be under public scrutiny, they designed company structures to be obscure and obtuse, everything was geared towards secrecy.

And yet, based on reviews carried out by various security firms, they were running software that was not only out of date, but which had well publicised (and exploited) vulnerabilities. Their servers were not protected by firewalls, the secret data was unencrypted, and it appears their monitoring was so poor (or maybe non-existent) that they failed to notice the exfiltration of vast amounts of data over many months.

So, just to repeat, this company existed in a world where secrecy and confidentiality was everything. Where their customers made fundamental assumptions that their activities would remain hidden from public gaze, and that they could trust their lawyers to protect their interests at all times.

Despite all of that, this organisation appears to have disregarded pretty much every rule of information security.

So if a firm operating in that environment could be so bad at looking after their customer’s data, what about the thousands of other companies with an internet presence who are holding YOUR data. The small (and not so small) organisations you share your details with on a daily basis, the ones you order from online, send emails to with personal details included, upload files of photos, documents or whatever. How confident can you be that they are any better prepared than Mossack Fonseca?

And that’s why this story is relevant to my readers. Poor information security practices are endemic across all industries and all sizes of organisation. We put up with it because we are not big enough to make the difference on our own, and not rich enough to organise the campaigns necessary to force changes through.

Mossack Fonseca is the 4th biggest player in this field, you can bet the clients of numbers 1,2 and 3 have been asking some very pointed questions over the past few days.

Maybe, just maybe, the exposure of the personal details of the richest, most powerful (and let’s be honest, most scary) people on the planet might be the trigger that pushes achieving real information security to the forefront of the thinking of governments and other influential bodies. Could this incident be the tipping point that’s always eluded us, because as sure as eggs are eggs the hundreds of millions of personal records of ‘ordinary’ people that have been leaked over the past year were not seen as important enough.

Fingers crossed.

David

 

Advertisements




Stand and deliver – your money or your (computer) life

28 03 2016

Ransomware. It’s been around for a few years now but in the last 6 months or so it’s really hit the mainstream press, and therefore entered the consciousness of the ‘ordinary person’. Recent high profile cases include a couple of hospitals in the US, a police station and a local authority in the UK.

Before I go into the details and explore what you can, or more likely can’t, do to protect yourself, I think it’s worth taking a step back and looking at the so called ‘underground economy’ of cyber crime.

Back in the day, the bad guys in the computer world were generally loners who did what they did for kicks and credibility amongst their peers. Very irritating, occasionally brilliant and generally disorganised.

That changed once it became clear that there was money to be made from what has come to be known as cybercrime. The professionals moved in as organised crime saw it as another lucrative string to their bow, promising low risk and high returns. Along with the increased organisation and the massive amounts of money, came demands for structure, specialists, quality control and co-ordination as well as the incessant demand for more and better products.

Nowadays a complete ecosystem is in place that is at least as organised as the mainstream legitimate economy. There are market places for the sale and exchange of everything from software to stolen credit cards. Code comes with money back guarantees, free trials, help manuals and even help desks. Every aspect of the economy has specialists who only focus on what they do best and hand on to the next person in the chain when their part is complete.

Into this mix comes ransomware.

Ransomware is, to put it in simple terms, a piece of computer code that you inadvertantly download to your PC. It might infect your PC via an email attachment, a website or even from an advert you click on. However it gets in, it has one purpose, to encrypt your files, and once those files are encrypted they will stay encrypted unless you can obtain the decryption key. And here’s the clever bit, in exchange for a fee usually in bit coins the bad guys will send you the decryption key.

The first you will probably know about it is a screen that will pop up on your computer looking something like this which is from Cryptolocker,

blog-cryptolocker

but they are all pretty much the same. At that point you have three choices:

  1. Restore your files from the backup (you do have backups don’t you?)
  2. Pay the fee
  3. Accept you have lost the files for ever and just move on.

Option 1 is fine as long as the backups are not accessible from the PC and the ransomware has not already found them and encrypted them as well. Assuming they are OK you simply need to disinfect your PC by running up to date antivirus software (the av software usually runs a day or so behind new ransomware so it might not work immediately – check online), delete the encrypted files and restore from your backups.

Option 2 is not ideal for a couple of reasons. Firstly the current fee is around 4 Bit Coins, which at time of press is about $700. For a company, that might be a small price to pay, for the audience of this blog it’s a not inconsiderable amount. Secondly, whilst it’s in the interest of the bad guys to make the process work, there are a number of reasons why it could fail. There might be an error in their code, there might be a problem with their use of encryption or law enforcement may have found them and taken the website down that’s hosting the decryption key. But as I said previously, this is a business and they are keen to maintain their reputation, and anecdotal evidence suggests that paying the fee will result in you receiving the decryption key.

Option 3 depends on you knowing what’s on your PC and whether you care about it. You still need to disinfect your PC but that’s about it.

So what can you do to protect yourself from ransomware? To be honest, beyond the normal good practice of regularly applying security updates and running up to date antivirus software not a lot. The age old advice of avoiding ‘dodgy’ websites, whilst still valid is not sufficient as many mainstream websites are infected these days (often via their advertisers’ sites). Not clicking on unexpected email attachments or following unknown links in emails is also fundamental good practice but is no guarantee that you’ll be safe.

One thing you might want to consider is to remove the admin rights from your normal account and create a separate account that you only use for admin type things (such as installing software). Some of the ransomware relies on being the Administrator on the box, so if you are logged in as a ‘normal’ user then it won’t work, or at least will only work on those files you control. Not perfect, but something.

The bottom line is that you are in the same position as the rest of us in the Commercial world. You have to expect the attack and then plan your response and try and mitigate the impact.

What stuff on your PC do you care about? Unless you are running a business, it probably boils down to photos and music, with a few personal letters thrown in.

You should make sure that you have backup copies of these important things. My previous blog about the Cloud gives some suggestions, but you could also consider offline backups on USB drives, SD cards or whatever. The main thing is to have them somewhere that is not immediately accessible from your PC, so that if bad stuff happens you’ve still got those photos of great aunt Daisy’s 100th birthday.

So that’s it I’m afraid. Ransomware is here to stay and will get more effective and more prevalent as time passes. Using the Internet gets more like Russian roulette every day, bad stuff is out there and it’s likely to get you at some point. All you can do is do the basics right (many of which I’ve covered in previous blog entries), and know what you are going to do when it’s your turn to get hit.

Depressing? Probably, but like everything else, until the general public really cares about something, governments and business won’t pay attention and get the problems fixed. Internet security is bubbling to the surface but at the moment there is more lip service than customer service being paid to solving the problem. Whilst software companies can get away with writing poor code, ISPs can get away with not caring about what they are hosting and Joe Public continues to do stupid things Internet crime will continue on an upwards tick that shows no sign of flattening out anytime soon.

 

Safe surfing

 

David

 

 

 

 





Of Passwords and PINS (3)

8 02 2013

In the final part of this series I’ll look at PINs and what you can do to make them easier to remember.

PIN numbers, generally 4 digits, and used to validate debit and credit cards, lock your i-phone, access buildings, secure safes and all manner of  other things have become one of those things we all have to remember. The 4 digit card PIN only offers 10,000 possible combinations, so it’s not really that secure, which is why so many systems operate the ‘3-strikes and you’re out’ control. But why only 4 digits? For the answer you have to ask John Shepherd-Barron the inventor of the ATM. It seems that Mr Shepherd-Barron favoured using 6 digits, but his wife preferred 4!

In the same way as there are commonly used passwords (see the previous post for more details), there are some PINs which appear on an all too frequent basis. A recent analysis by Data Genetics revealed how unimaginative people are.  Over 10% of the PIN codes analysed were 1234, and 6% were 1111. The least common PIN was 8068, but probably best not to use that now as the bad guys can also read the reports.

Maybe you need a different approach. In the same way as you can have a memorable password, why not have memorable PINs? No! Not your birthday, or your partners birthday, or your house number, too many people already know them. But why not use the letters A through J to reflect the numbers 1 to 0, and create a combination that is meaningful to you? First four words of a favourite tune, initials of four family members, first four letters of you home town.

Most organisations which require you to have a PIN allow you to change them, usually on-line or at the ATM, so that’s not much of a chore, BUT, don’t change them all to the same value. Like passwords, it makes sense to have a variety of PINs, and to he honest you’re unlikely to have as many PINs as you have passwords (unless you collect credit cards as a hobby).

The standard instruction (as with passwords) is not to write them down, but again, as with passwords, there are variations on a theme. Clearly no-one would write in their diary: Barclaycard 1234; Amex 3456; M&S 4567 would they (pause whilst some readers tear page out of diary), but it is possible to be more discreet and still record those which you use less often in the same way as you can record passwords.

The frequently used ones you will remember because you use them everyday, especially if you have made the memorable in the first place.

Anyway, that’s enough on Passwords and PINs, next time I’m going to start on Social Engineering and how the bad guys WILL obtain those carefully protected pieces of information you have created.

Until then, keep safe and keep aware

David





Of Passwords and PINS (2)

6 10 2012

In the last posting I briefly referred to ‘strong’ passwords and said I’d come back to them a bit later on. So, what is a ‘strong’ password? As I said last time, the holy grail of password creation is to have something which is easy to remember AND hard to guess. Individually these are simple to achieve, putting them together is a much harder task.
Before getting into the mechanics of password creation, let’s take a couple of seconds thinking about how the ‘bad guys’, (and gals), will try and misuse them. At the most basic, they sit at a computer, enter your account name and then just try and guess your password by hitting characters on the keyboard. If the system allows infinite attempts then they can continue until they get bored or strike lucky. The more sophisticated attacks will use technology, i.e. software, which will perform the same activity but automatically. So called ‘dictionary’ attacks, do just that. The software has millions of words in their database and they just trawl through them until they get a match or run out of words. The more sophisticated also include character replacement checks as well (more on that in a moment) which provides millions of additional permutations. The final way is to obtain the password file from the system itself which is hopefully encrypted. If it’s not then it doesn’t matter how good your password is, they’ve got it! If it is, then the complexity you use will make it that much harder for ‘them’ to decode it.

So lets look at our two objectives separately to see how we can solve the problem.
Picking something really obvious would be daft of course and no-one would do that would they? Think again, surveys of the most common passwords are produced every other week such as this report in the Daily Mail, with ‘Password’ and ‘123456’ always being in the top 10, (quick pause here whilst you go off and change yours?).
It is generally easier to remember something which is personal to you rather than a completely abstract item, but make it too personal (pet’s name, your birthday, mother’s maiden name(!)) and far too many other people will already know it. Quick aside here, just because you are are asked to provide your mother’s maiden name at registration does not mean you actually have to provide the exact name. It’s a security control, not a test. Just make sure you remember what you tell them!
But there are things which are personal to you that you can use as long you mix it up a bit. Favourite places, favourite songs, recent events are all good sources for passwords, you can have those little triggers in the back of your mind to help you remember them BUT, as I’ve already said you need to mix it up a bit, which is where we apply the ‘hard to guess’ angle.
Let’s start with the basics. Say you wanted to use the name of a city where you had a great weekend, such as Norwich. It’s quite hard to guess, unless people knew you liked it, seven characters long so it’s not bad from that perspective, but it’s in every dictionary so would be a soft target from that angle. Simple character replacement and changing the case of the letters will immediately make it even harder to guess (e.g. N0rw1cH), and placing the first and last characters in the middle will defeat any dictionary attack however sophisticated (e.g. 0rwNH1c), simples (as the Meerkat says). But the root (Norwich) is still a valid word and potentially guessable, so another approach is to use a phrase as the root. Pick the first 8 words from a song and use the first letter from each word (e.g. gsogqllo – “God save our gracious queen…”), mix up the cases and do a bit of character replacement (G50gQll0), and bob is your mother’s brother as they say. You can try the same thing with first words from a favourite book, or just a favourite saying. Easy to remember and had to guess, just don’t hum the tune as you type it in!
Now for the really clever bit. Best practice says, have a different password for each account, common sense says you’re never going to remember all of those passwords. So how can you get the best of both worlds? If you take your common password, say G50gQ110, and then add two letters to signify the application you are using it for, e.g. FB for Facebook, HM for Hotmail, NW for your Nat West bank account etc., you have something you will always remember and something that will be extremely hard to guess.
So there you have it, strong passwords with minimal effort.

Till next time

d4v1D








%d bloggers like this: