The Security Skeptic

Top 5 #InfoSec Reads: April 26 - May 3

An upsurge in botnet-based attacks, Android closes security gap on iOS, Facebook faces down the EU nations, Raspberry Pi gets a new OS, and yet another embarrassing surveillance revelation are this week's top 5 #infosec reads.

botnet attacks on the rise; PoS systems still at risk of threats

A Dell SecureWorks report, Banking Botnets Persist Despite Takedowns, finds that despite global anticrime efforts to takedown botnets (Gameover Zeus ,  Operation Tovar, Shylock), botnet based attacks against point of sale systems remain a persistent and serious threat. Perhaps more seriously, botnet attackers are casting a wider net against financials, targeting more than 1,400 financial institutions across more than 80 countries. Dell SecureWorks notes an increase in the use of the initial downloaders ("droppers") known as Kegotip, Chanitor, Upatre, and Lerspeng and increased activity from the Dyre, Gozi/Vawtrak, and Bugat v5 botnets. If you must bank online from a Windows system, dedicate an old laptop for banking purposes only. For a $50 investment, you can bank from a Linux build on a Raspberry Pi. Both are small investments with big risk mitigation returns.

Why Android 5.0 doesn't measure up to iOS 8 security

Lisa Phifer packs a lot of important takeaways for corporate mobile device administrators in this article. Apple's single biggest advantage over Android? Tight curation of App Store, which greatly reduces the malware threat. Does Android for Work close the gap between iOS and Android? A bit: Google's added means for admins to prevent sideloading and restrict apps on company-owned or administered Android devices. Data protection measures? Both Google and Apple are improving, but Lisa points out that Apple's big advantage here is legacy, "Every iPhone and iPad manufactured since 2009 supports hardware-based AES-256 bit encryption, which the end user cannot disable. Android 5.0 supports hardware-based AES-128 bit encryption, but many devices running Android don't support encryption."

Facebook threatens Europe with fewer features due to fragmented regulation

Multi-national online services complain constantly about regulatory excesses but as this article notes, Facebook, et. al., must contend with per country fragmented and inconsistent sets of requirements. FB's chief of public policy perhaps speaks for most multi-nationals when he argues that operating as a pan-European business should be done subject to one coherent set of pan-European rules instead of having to "comply with 28 independently shifting national variants." The EU apparently acknowledges and intends to address the issue as part of its Digital Agenda for 2020 (2020... really): the EU's Single Digital Market hopes to define a consistent business environment across member states.  

 Windows 10 for IoT

I love the Raspberry Pi. I have two on my network. One serves as a name resolver, a privacy/content proxy, and firewall log server. The other runs an intrusion detection system. What I don't have yet is a Pi for experimenting with Internet of Things applications. After reading this article and watching the video of Microsoft's Pi-powered B15 robot, I'm eager to make time, purchase a Pi 2, and install the Windows 10 IoT Core Insider Preview. 

German prosecutor to investigate state spy agency’s partnership with the NSA

Let's briefly recap.

September 2013:  Der Spiegel reports that NSA is monitoring smart phones.

October 2013: Der Spiegel reports that NSA is monitoring Chancellor Merkel's smart phone, that the Chancellor placed a "strongly worded phone call to US President Barak Obama" regarding the alleged monitoring: 62% of Germans approve of Merkel's comments on spying allegations, where she asserts, "Spying between friends, that's just not done".  

June 2014: The Guardian reports that Germany opens inquiry into claims NSA tapped Angela Merkel's phone.

April 2015: The Verge reports that German intelligence helped the NSA spy on European politicians and defense contractors.

May 2015:  The Verge reports that German prosecutor to investigate state spy agency’s partnership with the NSA.

Takeaway? "Spying between friends" seems to be trending.

Top 5 #InfoSec Reads: April 19-24

An embarrassing surveillance revelation for Germany, an important finding regarding blacklists, a vulnerability affecting 1500 iOS apps, a DDoS war story, and unintended consequences for legit CloudFlare customers are this week's Top 5 #infosec reads.

German intelligence helped the NSA spy on European politicians and defense contractors

While reviewing Germany's information sharing agreement with the United States, German Parliament has learned that Germany's BND has  provided the NSA with intelligence data associated with telephone numbers, IP addresses and email addresses when requested. Parliament is now looking to narrow the terms of access allowed by the NSA. As criticism mounts, important trade and other agreements are now in jeopardy. Angry reaction remains anchored at the US, but it will be interesting to see how long this theme persists as country after country has its own surveillance and information sharing practices exposed. 

Blacklist Ecosystem Analysis Update: 2014

Blacklists are security data feeds that identify malicious domains or internet addresses. This study examines eighty-five (85) Internet blacklists  for patterns in entries the lists have in common. A number of different comparison techniques were used during the analysis. An important finding for blacklist users - basically, everyone from individual users with antispam measures on devices to enterprise IT - was that "there is surprisingly little overlap between any two blacklists". The most important action for blacklist users? Don't rely on one blacklist, use several... or many!

1,500 iOS apps have HTTPS-crippling bug. Is one of them on your device?

A vulnerability in an open source library used by 1,500 iOS apps exposes users to SSL traffic interception. The AFNetworking library creates opportunities for attackers to intercept SSL connection requests of vulnerable iOS devices on shared, open (WiFI) networks, where they impersonate a secure site using a fraudulent SSL certificate. SourceDNA, who discovered the vulnerability, has developed a search tool to helpusers check if  apps they use are vulnerable.

A true story of combating a large-scale DDoS attack

This article relates the defensive measures a SaaS-based supplier of web content management took during a thirty-nine hour distributed denial of service (DDoS) attack against one of its customers. The author describes the initial attack vector, attack traffic composition and origins, and the initial abatement tactics. The author next describes subsequent attack stages where the attackers changed tactics and how supplier chose to respond, and concludes with a summary and useful discussion on how to protect against a DDoS attack. These recommendations are similar to those I've mentioned in some of my DDoS protection articles (1, 2).

Pirate Bay Blockade Censors CloudFlare Customer

A UK ISP put blocking in place to prevent access to the Torrent sharing site, Pirate Bay. These included conventional domain and IP address blocking; however, the ISP did not consider the impact their blocking would have on legitimate customers who shared the same IP addresses as a Pirate Bay proxy. This incident provides a good opportunity to remind readers (and ISPs) about unintended consequences and how to choose wisely when blocking, seizing or taking down domains, sites, or content.