Wi-Fi Security Flaws

     Wireless Internet use has helped to make accessing the Internet easier.  The trend of WiFi based products has been steadily increasing.  The ease of WiFi use has carried in to everyday products designed to make people's lives easier.  Smart homes are becoming more common and the majority of the home can be controlled remotely through WiFi based products.  This of course can leave the person's network vulnerable to new wireless attacks.

     LIFX Smart LED light bulbs can be controlled remotely by mobile devices.  This convenience means a person can turn on or off all of the lights or selected lights in their home from their mobile device.  There was discovered to be a security flaw in the light bulbs WiFi that allowed an attacker to steal WiFi passwords.  The attacker could begin the hack once they discovered which bulb was the master bulb.  From there they were able to expose the user's network configuration.  LIFX utilizes a meshed network and researchers were able to inject packets into the network without any authentication.  Being able to accomplish this without authentication enables them to capture WiFi details and decrypt the credentials.  All of this occurs without ever being detected.  The researchers did conclude that a widespread attack would not be possible because the attacker would have to be located within 30 meters of wireless range.  While this is the case with LIFX, there are other wireless products on the market that have no range restrictions. 

     When companies are developing new products that can be used with WiFi they need to consider security vulnerabilities such as the ones that occurred with the LIFX light bulbs.  As Smart homes are dubbed with being more energy efficient and this technology trend will likely continue.  By doing so companies may be putting consumers at risk with such vulnerabilities. 


 

Paganini, P. (2014, July 9). Hacking LIFX Smart LED Light Bulbs to Steal WiFi Passwords. Retrieved July 10, 2014, from Security Affairs: http://securityaffairs.co/wordpress/26475/hacking/hacking-lifx-smart-led-light-bulbs-steal-wifi-passwords.html

Threat Intelligence Sharing - Week 5

     There are numerous threats that businesses face everyday.  After the Target security breach occurred there has been greater discussion about threat intelligence sharing between organizations.  It also encouraged retailers to create a formal response to manage threat intelligence information.  This process also paved the way as a means for businesses to share the threats as well as the actions they took.

     Threat information sharing is beneficial to businesses for several reasons.  It makes retailers aware of emerging security threats.  Becoming aware of threats other businesses have encountered allows them to better prepare themselves against the same type of threats.  By working together companies are helping to eliminate these threats from becoming more widespread.  This unity prevents attackers from achieving the goal they set out to reach.

     To create a trusted communication point for retailers to share threat information, collaboration was needed.  In June 2014, the National Retail Federation established "a Retail Information Sharing and Analysis Center (ISAC), which includes participants from the Department of Homeland Security and the Secret Service, which investigates large-scale credit and debit card breaches" (Westervelt, 2014).  This will be a good platform for threat information sharing, but initially it will take time for trust to be established amongst the retailers.

     In order for retailers to be better prepared to respond to threats they must establish better incident response plans as well as regularly testing them.  This will not only help retailers with their threat mitigation and response, but it will also help other retails to develop better response plans as well.  Some retailers may not have the correct tools to properly identify the threats that are occurring.  The ISAC may also provide a good resource for retailers to relay the correct and necessary tools that others should be using to properly detect threats.  This is because those involved in ISAC will have built a relationship of trust amongst one another.

     While this is a step in the right direction, it does not eliminate all of the potential problems that currently exist with threat information sharing between public and private sectors.  Often private sectors are at an advantage because they are more financially secure and can afford the necessary tools to detect the threats.  To provide better threat information sharing automation is needed.  MITRE Corporation is a nonprofit organization that is working on Structure Threat Information eXpression (STIX).  STIX is a standardized language that represents structured cyberthreat information, which allows security incidents to be properly described in a formal manner that creates a better resource for threat sharing.  It does seem that with enough cooperation threat information sharing will become extremely beneficial to those involved.

 

Westervelt, R. (2014, July 3). The Rise of Threat Intelligence Sharing. Retrieved July 4, 2014, from CRN: http://www.crn.com/news/security/300073317/the-rise-of-threat-intelligence-sharing.htm

How Secure is Your Email Address?

    Over the years I have had many different email accounts.  The deciding factors to make me change accounts was how much junk email or spam  I received and if there were any security concerns with my current email provider.  Recently Gmail was discovered to have a new security vulnerability.  This vulnerability put an indefinite number of Gmail addresses as well as business emails at risk.  Why is gaining an unlimited amount of Gmail addresses so valuable?  The reason this vulnerability is important is because it allows the attacker to send phishing campaigns and targeted attacks to an unlimited amount of users.  This guarantees that the attacker will have a higher amount of victims.

    The vulnerability allows an attacker to gain access to a list of Gmail addresses.  This discovery was made by Oren Hafif, a researcher at Trustwave's SpiderLabs.  He reported the vulnerability to Google, who has since fixed it.  One may ask how was this vulnerability even possible?  Hafif found a token exposed in a URL and was able to expose every Gmail address.  The URL token was found when using Gmail's delegation feature.  When an account user delegates that account to allow another person to access it, the delegated party has to accept or decline the delegation via an embedded URL link.  These links were nearly identical, the only difference was one link included /mdd (mail delegation deny servlet) while the other included /mda (mail delegation accept servlet).  He then researched URLs that Google used and determined that the sequence which followed mda and mdd was being used as an authentication token. 

    With the authentication token Hafif started running a brute force attack and was able to gain so many email addresses that every tool he used to conduct the brute force crashed from the overload.  To overcome this problem he wrote his own multi-threaded script in Ruby.  In addition to Gmail addresses, he discovered he was also obtaining non-Gmail addresses.  These were most likely businesses who were using Google Apps such as a mail service.  Hafif commented on the potential security threats that companies may face when considering if they should move their information to the cloud as many companies have done by choosing Gmail as their organization email manager.  When vulnerabilities like this exist it creates additional potential threats such as spear phishing attacks, advance persistent threats as well as other targeted attacks.  It is important to keep this possible vulnerability in mind when planning security threat mitigation for not only your personal email accounts, but also your company's email accounts.

 

Paganini, P. (2014, June 12). Gmail hacking, a mine of data for phishing and spam attacks. Retrieved June 23, 2014, from Security Affairs: http://securityaffairs.co/wordpress/25676/hacking/gmail-hacking.html

    

    

Privacy Threat Model

     When creating a threat model it also becomes important to examine privacy issues.  Microsoft has updated their free threat modeling tool for 2014.  These updates include improving security and privacy weaknesses.  Privacy has become an important issue not only for individuals, but for companies who are protecting their own information as well as customer information. 

      In order to understand privacy threat models it is important to examine Solove's taxonomy of privacy harms.  The harms are not only threats, but also the impact of the threats.  To use Solove's taxonomy in a threat model one should pay close attention to personal data within the threat model.  A few recommendations on where and how to focus on finding the harms is given by Adam Shostack in his book Threat Modeling Designing for Security.  They include: data collection points on web forms; inbound data flows from external entities; where the system has in-person interaction; where data is brought together for decision making purposes; secondary use that may cross trust boundaries including those that customers may expect and in person intrusion.  By closely examining data on the threat model one may see potential privacy threats.  Understanding the key to finding privacy threats will greatly help those creating threat models.

    To gain a new perspective on creating a threat model be sure to visit Microsoft's new Threat Modeling Tool.  One advantage of this is that it no longer requires Microsoft Visio to create new threat models.  Now it can be created using the included stencil set.  For more information visit http://blogs.msdn.com/b/sdl/archive/2014/04/15/introducing-microsoft-threat-modeling-tool-2014.aspx

Shostack, A. (2014). Threat Modeling Designing for Security. BoulevardIndianapolis: Wiley.

Threat/ Vulnerability Assessment

     Companies face many different types of threats on a daily basis which range from human error to criminal threats to natural weather related threats.  To ensure that business is running smoothly, it is necessary to develop a threat or vulnerability assessment.  The purpose of these assessments are that they will help develop plans to put in place to eliminate or mitigate the potential threats.  Threat assessments can be created to focus on one specific area such as software or a facility in its entirety. 
    
     When starting a threat assessment, the first step is to identify the area or areas that need to be protected.  Once identified, those involved must evaluate potential threats.  Several different methods can be utilized; they include brainstorming, reviewing past threats and vulnerabilities, thinking like criminals or hackers and asset or software driven threats.  After these credible threats are identified they should be ranked from highest to lowest threat impact.  This will help identify which threats are more likely to occur and the severity if it were to occur so they can be prevented or mitigated.

     To mitigate threats it is important for companies to have a documented plan in place to educate employees on what steps are to be taken to mitigate the threat.   In addition to being a resource for employees the plan also serves the purpose of being continuously reviewed to ensure the plan still mitigates the threats effectively.  Should it no longer be effective, the plan should be updated.  This process is cyclical as threats may never be 100% eliminated.  The frequency of review can vary from days, weeks, months or even years.  It all depends on the asset and the time frame those involved determined the system to be reviewed. 

     While a threat or vulnerability assessment may seem like a tedious or daunting task, it is necessary.  The only way for companies mitigate potential threats is to identify them beforehand.  Should they fail to do this it could cost the company more than just a financial loss, it could damage the company's reputation.

Risk

     Every company faces risk in some shape or form.  It is up to them to decide which of these risks are acceptable and which need to be mitigated.  In today's world it is uncommon for a business to not have a website or conduct their business online.   Since we have become increasingly reliant on technology to help run our businesses, we have to address the potential threats that they pose. 

     One of the most effective ways to mitigate these risks is through threat modeling.  Threat modeling offers different methods to examine potential threats.  During the next nine weeks I will be discussing various aspects and methods for threat modeling that will help businesses mitigate potential risks. 

Risk Management

It is important for businesses to create risk management plans that are appropriate for their company.  They may look to best practices as a guide to create their risk management plans, but a cookie cutter approach does not always work.  Every business is different even if they are in the same industry.  They each have their own acceptable levels of risk and their assets are not always valued at the same level as another company. 

            The amount of money a business spends on their risk management plan also varies from company to company.  A small or large budget may be required, but how effective and well managed their risk management plan is will play a large role in the overall cost of it.  Companies that compare how much they each spend on risk management may prove to not be as helpful as some have previously believed.  It could help determine a general guideline for how much the company might need to spend, but it is not an absolute amount.  Jack Jones has given a great example on how to determine how much you should spend.  He compares it to buying car insurance.  You can get an estimate how much most people are paying, but you will not use that as your only reference.  You would want to know how much coverage you would need based on risks and assets as well as if are there enough funds to pay for it. 

            Leadership can often be left out of this equation.  If management does not believe that there is much risk despite what they have been told, the company will surely be in poor condition in regards to the risks they are taking.  Risk management should influence company policies, priorities, initiatives and actions.  If a business only has the tolerance for low risk, their decisions should reflect that.  Keeping this in mind is key to successful risk management.  It is also important to make changes to the risk management plan when necessary.  If the company cannot mitigate a risk that they previously could, they need to evaluate how it will affect the company overall and change their policies accordingly.  Keeping employees informed of risks and how their decisions can affect the company’s overall risk is also important. 

            Every business faces their own unique types of risk.  To manage their risk appropriately they must examine how much risk they face, what level of risk they can tolerate, how much they can spend to mitigate their risks and how their policies reflect their risk.  Using best practices as a guideline will help keep them on track to effectively managing their risk.  Ultimately it is up to the company to develop their own risk  management plan that is tailored to meet their needs.

References:

Jones, J. (2011). To Be FAIR About It A perspective on risk and risk management. Retrieved Oct 22, 2013, from Risk Management Insight: riskmanagementinsight.com/wp-content/uploads/2011/03/to-be-fair-about-it-v1.pdf