If you thought you had data breach fatigue, prepare to be exhausted this week:
- Hacker tries to scam Internet with fake DropBox password database – DropBox refutes the claim, noting the “proof of hack” provided consisted of known stolen passwords from other sources.
- Kmart Hacked – Undisclosed Quantity of Credit Card Numbers Stolen – Sears-owned retail outlet may have been a victim of known point-of-sale malware “Backoff”, says no identity info stolen, just credit and debit card numbers.
- SnapChat denies it was source of potential racy photo leak – Third-party addon app “SnapSaved” blamed for providing an avenue for hackers to save pictures from SnapChat. SnapSaved admits to security breach, but downplays claims that hackers could provide a “searchable” database of photos.
- NATO Summit Gets Breached by Russian Hackers – Hackers whom security analysts believe to be Russian exploited a Zero-day flaw in Windows operating systems through a spearphishing campaign targeting Ukrainian government workers, leading to breaches on government servers and probably information leaks from Summit proceedings.
- Google Documents Flaw in SSL 3.0 Protocol – Google documents a serious flaw in encryption protocol SSL 3.0, immediately removes it from Chrome web browsers. Though outdated, SSL 3 is still widely used as a fallback protocol when newer protocols fail to function.
- 850K Records Exposed in Oregon Employment Dept Website Breach – State-run website exposes personal information on hundreds of thousands of job seekers. No financial information was exposed, but leaked info could lead to identity theft.
Portable flash drives, also known as “thumb” drives, are about as common as their physiological namesake. They are readily available, useful for a variety of tasks, and now so cheap as render them nearly disposable. Partly because of their ubiquity and seemingly innocuous profile, they make extremely effective malware vectors and continue to be the bane of information security professionals everywhere:
- As part of a security test conducted by the Department of Homeland Security, USB drives were left in the parking lots of other government agencies and private contractors. After being spotted and picked up by employees, almost two-thirds of the orphaned drives were plugged into networked computers, even though the users had no clue as to the thumb drive’s origins, and if the thumb drive had a faux government logo on them, nearly 90% were accessed via networked computers.
- A survey of 300 IT professionals conducted at the 2013 RSA Security Conference found that almost 80% of respondents have plugged in thumb drives with questionable or unknown origins, despite probably knowing full well the dangers such an action could present.
- Infamous NSA whistleblower Edward Snowden purportedly copied digital documents supporting his claims onto a thumb drive that he smuggled without much effort into and out of the National Security Agency.
What this means for you:
Because of their size and capability, thumb drives are not something that will be controlled through simple policy and half-hearted enforcement. Companies with tightly managed technology environments can enforce a ban on non-authorized USB devices through centrally controlled software policies, and some have gone so far as to glue shut open USB ports in an attempt to close this security gap. For smaller companies with less dire security requirements, this may not be a reasonable solution. Instead, you should continue to make sure that you have working anti-malware in place and set to scan any storage device inserted into your computer. On top of this, if you regularly use thumb drives to transport business data, those drives should be encrypted with a strong password to prevent security breaches due to loss or theft, and obviously, they should be backed up regularly for the same reason. And for goodness sakes, don’t pick up some random thumb drive lying on the ground and plug it into your computer. You really don’t know where that thing has been!
Image courtesy of bplanet / FreeDigitalPhotos.net
In a follow-up to the much-publicized security breach that exposed sensitive data on millions of South Carolina residents, the governor’s office has released the official report on the incident, as researched by security firm Mandiant. The origin of the attack was traced to an unnamed state employee clicking on a phising email, leading to the immediate compromising of that employee’s network credentials. From there, the hackers were able gain access to 44 different government systems and 74GB of uncompressed taxpayer data and encryption keys. More importantly, it was revealed that the millions of Social Security numbers stolen in this attack were being stored unencrypted, primarily because the current Internal Revenue Service standards do not require encryption of any kind.
What this means for you:
It’s a running joke that governments are typically way behind the times when it comes to operational efficiency, which was fine in the days of mimeographs, fax machines and microfiche, but it’s no longer a laughing matter in the age of the Internet. The fact that the IRS still isn’t requiring states to encrypt your critical data is an open invitation to cybercriminals everywhere, as well as every amateur hacker looking for a quick payday and street cred. On top of this, the fact that government agencies like South Carolina’s Revenue Department are relying on outdated and unsafe standards that even sophomore technology professionals would recognize as being insufficient is appalling and reprehensible, mea culpa notwithstanding.
Despite the egregious lack of security, the breach in question happened because an employee open the door. You may be well-informed and security conscious, but are your employees properly trained to spot and avoid phishing emails? Are they engaging in insecure behavior, either out of ignorance or willful disregard of company policy? If you handle sensitive personal information during the course of normal business, are they aware of the federal regulations regarding the handling and disposing of that information?