Monthly Archives: May 2008

Raiders of the Lost Backup Tapes

0
Posted by Tom on May 30, 2008 – 7:00 pm
Filed under General Security

<%image(20080530-000625_37.jpg|320|240|Indy likes lost backup tapes!)%>

Amazing that security breaches like the one I am about to tell you about are becoming more common…so common that the mainstream media like CNN doesn’t even report it anymore. If you haven’t read about this pretty significant security breach yet…let me briefly tell you about it…

Bank of New York (BNY) Mellon and People’s United Bank of Bridgeport, CT may have Social Security numbers and bank account information lost when unencrypted backup tapes went “missing” from BNY Mellon. No big deal right? Only 4.5 million customers affected. From the Reuters article:

“…on February 27, Bank of New York Mellon was transferring back-up tapes with data, including names, addresses, birth dates and Social Security numbers, when it lost a box with six to 10 unencrypted tapes….an archiving vendor lost the tapes from its Shareowner Services unit, but there was no evidence any data had been inappropriately accessed or used.”sic

Basically People’s hired BNY Mellon Shareowner Services in 2007 to tabulate votes and process stock orders during its conversion from a mutual bank, which is owned by depositors, to one that is fully publicly traded.

Moving on…nothing to see here right?

The problem is that this data was not BNY Mellon’s customer data but the customer data from People’s United Bank, some Wachovia employees and some 64,000 MetLife shareholders…

“People’s United claims this was a BNY Mellon security lapse, as People’s United transmitted encrypted information to BNY Mellon who in turn created the unencrypted backup tape(s) that was lost.”

Good for People’s Bank for encrypting the data in the first place…but the problem lies with the vendor(s). It seems that more and more financial institutions are letting other financial institutions and other vendors process transactions and convert information for them. Trusting others with your sensitive data is not always the best idea (even though thats how business gets done these days), however, BNY Mellon should have encrypted these backup tapes in the first place! What about the vendor (Archive Systems Inc.) who actually lost the box of tapes? I would think that they are to blame as well. Sounds like a lot of vendor management issues here from many angles.

I would think that a large archive vendor like this would have some kind of policy stating some form of compensation for losing a box of tapes in transit. Almost how armored truck carriers transfer money from a bank branch to a financial processing center…if the armored car was compromised in transit and the bank lost all the money inside the car, it’s not the bank’s fault…thus the armored car carrier is responsible for the loss and would have to compensate the bank.

Looks like 4.5 million customers will get one year of crappy credit monitoring service as usual because of poorly managed vendor relationships. Nice.

KeePass Password Manager

1
Posted by Tom on May 29, 2008 – 6:00 am
Filed under General Security

<%image(20080528-plockb75.gif|75|75|KeePass Password Manager)%>

I wrote an article some time ago about multiple platform password managers. At the time I talked about PasswordSafe and Password Gorilla. While both of these are really good password managers that work on Linux, Windows and OSX…Matt Neely talked about KeePass at the NEO InfoSec Forum last week and how KeePass is probably the best password manager available.

What is really cool about KeePass is that you can use it on just about anything including Blackberry and Windows Mobile devices. Having a password manager on the Blackberry just about sold me and I have yet to try it, however, what did sell me was the KeePass port called KeePassX for Linux and OSX! I downloaded and installed it on my Mac and it is way faster then the old Password Gorilla. The features are really great to with automatic clearing of your clipboard, a nice easy to navigate interface and a password expiration system. My only gripe was that I had to load up the Windows version to import my PasswordSafe formatted database file for use in the OSX version. The Windows version has a plugin you can download which will automatically import your database file from PasswordSafe. There is no PasswordSafe import plugin for OSX currently. Other then that, I am converted and love it!

TJX Employee Fired for Posting Security Issues

0
Posted by Tom on May 28, 2008 – 7:00 pm
Filed under General Security

This is just classic. A TJX employee, Nick Benson, was fired for posting about security issues on the TJX internal network to this sla.ckers.org forum. Nick attempted to report security issues to his management back in 2006 (before the massive TJX security breach) and nothing changed. Apparently things like having blank passwords on servers were in effect up until May 8th of this year! Some of the issues he identified are noted from the SecurityFocus article below:

“Security was so lax at the TJ Maxx outlet located in Lawrence, Kansas, that employees were able to log onto company servers using blank passwords.”

“…a store server that was running in administrator mode, making it far more susceptible to attackers…”

and my favorite…

“My store manager even posted the password and user name on a post-it note…”

So whats the issue here? Two things…sure, telling your management that there are security issues was the right thing to do. However, when nothing changes based on the information you told them then things need to be escalated to a higher level of management. I would hope that TJX has some sort of “ethics” or “privacy” hotline (most major companies have these and they are anonymous) that this guy could have called. How about doing some research within the company Intranet to find out who to contact…that would be an easy approach to take if your management is not listening to you. Secondly, not the brightest idea to post on a hacking forum to let the whole world know of these issues. This guy was easily tracked back to his real IP…heck he probably even posted from work which made tracking him even easier! If he was really serious about not wanting to be caught then he should have used Tor or some other anonymous proxy to setup the account and make those postings (keep in mind he was just a retail worker, no IT background so Internet anonymity was an afterthought). Either way, not a very smart thing to do.

I still find it hard to believe that the TJX information security department would have thought it was ok to have blank passwords to log on to servers! If so these are not security professionals in my book…heck, a bunch of script kiddies wouldn’t even use blank passwords! My guess is that the information security department never even knew about these issues. The “management” that he reported the issue to was actually the loss prevention department. The loss prevention department in retail and other companies mainly deal with preventing shoplifting and theft…really not the right people to handle information security issues. Regardless, TJX still seems like a security train wreck…they won’t be getting my business anytime soon.

SecuraBit: New Security Podcast

1
Posted by Tom on May 26, 2008 – 2:03 pm
Filed under General Security

Looking for a fresh, new look at all the recent security news and threats? Check out the new security podcast called “SecuraBit“. The crew of the SecuraBit podcast includes Jason Mueller, Chris Gerling (you may know him from Hak5), Anthony Gartner and Christopher Mills. It’s nice to have another podcast following in the footsteps of Pauldotcom…no BS, just good security talk with guys that know what they are talking about.

The Ethical Hacker Network: Interview with Ed Skoudis of Intelguardians

0
Posted by Tom on May 21, 2008 – 9:52 am
Filed under Penetration Testing

<%image(20080521-edbanner.jpg|532|159|Ed Skoudis)%>

Very good interview over at The Ethical Hacker Network with Ed Skoudis of Intelguardians. Ed talks about his career, how Intelguardians came to be, his new SANS 560 Course, and a little about his hacker challenges that he is famous for. I know several of the Intelguardians and I have a huge amount of respect for all of them. If you are just getting into information security or penetration testing, Ed is one person that should be a role model for your career.

From the article’s author it looks like part two and three will be with Johnny Long and HD Moore. Awesome stuff…looks to be like a great series of interviews.

Attendees to be tracked with RFID at The Last HOPE

1
Posted by Tom on May 19, 2008 – 11:10 am
Filed under Hacking

<%image(20080519-rfid.jpg|108|108|RFID Tag)%>

According to 2600 News, 1,500 attendees of this years Last HOPE (Hackers On Planet Earth) hacker conference will be tracked via RFID in a large social experiment which will include games focused on RFID technology. From the press release:

“Players will seek ways to protect their privacy, find vulnerabilities in the tracking system, employ data mining techniques to learn more about other participants, and choose how much personal information they will disclose in order to play.”

Cool stuff…if you are into being tracked via RFID! It should be interesting to see some of the results of this experiment from the conference attendees and to see some cool hacks to gather RFID data and ways to protect your privacy. I did an article on RFID awhile back talking about ways to protect your identity using credit card “shields”.

The Last HOPE takes place July 18 to July 20, 2008 at the Hotel Pennsylvania in New York City.

Debian and Ubuntu OpenSSL Vulnerability

4
Posted by Tom on May 17, 2008 – 11:30 am
Filed under Vulnerabilities

<%image(20080517-debian-girl.jpg|137|103|Debian Girl)%>

I won’t go into all the details since every other security blogger on earth is covering it….however, as a reminder this issue is pretty serious if you had generated any keys on affected Debian or Ubuntu systems. The best summary I have found of the issue with links to all the “toys” that have come out to attack this vulnerability are on HD Moore’s web site. Here is a summary from HD:

“All SSL and SSH keys generated on Debian-based systems (Ubuntu, Kubuntu, etc) between September 2006 and May 13th, 2008 may be affected. In the case of SSL keys, all generated certificates will be need to recreated and sent off to the Certificate Authority to sign. Any Certificate Authority keys generated on a Debian-based system will need be regenerated and revoked. All system administrators that allow users to access their servers with SSH and public key authentication need to audit those keys to see if any of them were created on a vulnerabile system. Any tools that relied on OpenSSL’s PRNG to secure the data they transferred may be vulnerable to an offline attack. Any SSH server that uses a host key generated by a flawed system is subject to traffic decryption and a man-in-the-middle attack would be invisible to the users. This flaw is ugly because even systems that do not use the Debian software need to be audited in case any key is being used that was created on a Debian system.“

Ugly vulnerability is right for an OS that changes you….

Nessus “registered” plugin feed to be discontinued

2
Posted by Tom on May 14, 2008 – 1:26 pm
Filed under Penetration Testing

<%image(20080514-nessus.jpg|76|73|Nessus)%>

I came across this post by Martin McKeay on the Network Security Blog today talking about changes to the Nessus license that Tenable will be starting July 31st. Martin makes some really good points and I recommend you read his post. Basically as a corporate user you will need to pay for the new “ProfessionalFeed”. A corporate user is classified as anyone that uses Nessus in a corporate environment, including MSSP’s and security consultants (some exceptions apply for non-profit and charities). From the Nessus announcement:

“…Tenable’s “Direct Feed” will be re-named to the “ProfessionalFeed” and the “Registered Feed” will be discontinued. The ProfessionalFeed will entitle subscribers to the latest vulnerability and patch audits, configuration and content audits and commercial support for their Nessus 3 installation. The ProfessionalFeed will serve as Tenable’s commercial subscription and will be required for individuals and organizations that want to use Tenable’s Nessus plugins commercially.”

Looks like you are now getting everything that you would have gotten if you were a previous “commercial” user including support for Nessus 3. Home users will still be allowed to download the free “HomeFeed”.

My thoughts are that I personally get a ton of value out of Nessus…it’s simply the most versatile vulnerability scanner out there (from a pentest and customization perspective especially). Now that it is going to this “pay for plugins” model it doesn’t really change much for me..I think the Tenable guys do great work and now that they will have more cash flowing in I would suspect the Nessus product offering will only get stronger.

Oh, and don’t forget that Tenable is offering a limited time rebate for corporate users:

“Tenable is offering a 25 percent rebate for the Direct Feed subscription service (normally available at $1200 per year), beginning May 14, 2008 until July 31, 2008 only when purchased through Tenable’s e-commerce site.”

Lessons Learned from the Lowe’s Hacker Brian Salcedo

2
Posted by Tom on May 13, 2008 – 4:27 pm
Filed under Hacking

<%image(20080513-BrianSalcedo.jpg|180|216|Brian Salcedo)%>

Brain Salcedo was convicted back in 2004 of hacking the Lowe’s (a national home improvement retail chain) computer network through an unsecured wireless network. Brian and his partner found the unsecured wireless network while Wardriving. Brian’s plan was to eventually tap in and siphon off millions of credit card’s through a backdoor installed in a proprietary Lowe’s program called “tcpcredit” that Brian and his partner had modified.

Brian is currently serving out a nine year prison term even though there is no evidence that he even saw one credit card number (note that the longest federal sentence for a hacking offense was the 68 months imposed on Kevin Mitnick). During the investigation only six credit card numbers were found in the file that was created from the modified “tcpcredit” program. Ironically enough Brian seems to blame lack of fame and notoriety as to why he did what he did (he mentions the felony he was on probation for before the Lowe’s hack):

“It took awhile to work out the dilemma then consuming my head. Why did those around me get acclaim for exposing security flaws? They got hired, I was convicted of a felony. What was I doing wrong? After what seemed like a lifetime absence from computers, I decided to renege on my commitment to stay away from it and I simply relapsed into this all-out cracking binge.”

Two years later enter TJX …

Back in November of 2006 TJX disclosed that there was about 17 months of unauthorized network access resulting in the compromise of 46 million credit card accounts. To date this is the largest single breach of personal data in history. How did the TJX breach happen? Almost the same way Lowe’s got hacked…lack of wireless security. In this case TJX was using WEP which is known to be extremely vulnerable to attack. Of course there were other vulnerabilities that had to be exploited on the internal TJX LAN but the wireless network was the start. As we all know, it only takes one vulnerability to potentially bring down a network.

Two more years later enter Dave & Buster’s and Hannaford…

Just today, it was announced that Dave and Buster’s was victim to a data breach that resulted in bank losses of up to $600,000. This time apparently the attackers used “social engineering” to install packet sniffers to obtain credit card information. That’s right…social engineering. Ironically, one of the accused was apparently involved in the TJX breach (I could only find one source on this). Hopefully we find out more details in coming days about how this social engineering attack took place.

The Hannaford Supermarket breach resulted in 4.2 million credit card numbers being compromised just this year. The attackers had apparently planted malware on the servers at each of the 294 affected stores. This malware apparently sent the compromised data overseas.

While details about all of these intrusions are still coming out, one can start to see the similarities with Lowe’s, TJX, Dave & Busters and Hannaford.

Lessons Learned:

- Wireless is dangerous for retail if not properly secured. Now that WPA2 is widely available there is no reason that a retailer should not use WPA2. Interesting to note that I have reliable sources tell me that other major retailers are still using WEP to secure their wireless networks…and it’s 2008!

- Stealing data in transit within an internal company network is the new hotness! Most of this information is unencrypted until it gets to the database. In many cases it’s rather trivial to get this level of access (administrator rights on a workstation or server) to install a packet sniffer once you are on the internal network.

- Social engineering is on the rise! I wouldn’t be surprised if all it took was a simple phone call from “the IT guy” asking a store manager to install a new piece of software in the case of Dave & Busters (or Hannaford, you never know).

- If you are a criminal thinking about doing the same thing…it’s only a matter of time, you will most likely be caught and if you are a US citizen prepare to get the book thrown at you like what happened to Brian Salcedo.

- Finally, as a company don’t put all your eggs in the PCI basket! Just because you are certified PCI compliant (Hannaford) doesn’t mean you are secure!

HSBC branch server goes missing

0
Posted by Tom on May 9, 2008 – 10:49 am
Filed under Physical Security

<%image(20080509-hsbc.jpg|133|86|HSBC branch server goes missing!)%>

This is one of those security breaches that underlines the need for physical security if you are doing remodeling or construction where there is potentially sensitive customer data being held…like a bank! From the official bank disclosure:

“The Hongkong and Shanghai Banking Corporation Limited confirms one of its computer servers went missing on 26 April 2008 at its Kwun Tong Branch, which has been undergoing renovation. The data held on the server includes account number, customer name, transaction amount and transaction type.”

Nice! This just adds to the list of breaches that HSBC has announced recently…not a good time to be an HSBC customer. Seriously though, all banks should look at the physical security around these renovations..most construction sites I have seen have no security at all. I hardly ever see even a security fence around these locations. Take a look next time you drive by a store or building that is under a remodel or construction. You might be surprised at the lack of physical security of these locations.