In late November, Sony Pictures Entertainment was hacked by a group calling itself Guardians of the Galaxy (GOP). What initially appeared to be another hacktivist attack, later turned out to be a sophisticated operation possibly orchestrated by a state actor.

The hackers’ activities came to light on November 24, when the computers of Sony employees started displaying an image of a skull accompanied by a warning message. In the following days, the hackers started leaking large amounts of information stolen from the entertainment giant’s networks. The leaked data included unreleased movies, private emails, the personal details of actors, financial and business information, and employee records (including medical information).

North Korea was named a suspect after investigators found similarities between this attack and others believed to be carried out by Pyongyang. Shortly after, the hackers told Sony to erase all traces of The Interview, a comedy about a plot to assassinate North Korean leader Kim Jong-Un. Sony initially called off the release of the movie because of the hackers’ threats, but later decided to go ahead with the release on Christmas Day, as planned.

Sony has avoided pointing a finger at North Korea. United States authorities, on the other hand, say they’re certain North Korea is behind the attack, but they haven’t provided any proof to back their claims, except for the fact that the attackers used IP addresses “exclusively used by the North Koreans.”

North Korea has denied being responsible, but officials admitted that it might be the work of supporters furious over The Interview. Last week, the US imposed new sanctions on North Korea in retaliation for the attack on Sony. On Wednesday, Director of National Intelligence James Clapper claimed that he dined with the North Korean general who Clapper says was responsible for overseeing the attack against Sony, during a secret mission to Pyongyang two months ago.

Everyone agrees that attribution is tricky. Some believe US authorities are jumping to conclusions, but others say the FBI surely has other evidence, which they might never share with the public, to back their claims.

This topic will be debated by a panel of experts and moderated by The Wall Street Journal’s Danny Yadron at the Suits and Spooks DC conference on February 4-5 at the Ritz-Carlton, Pentagon City.

And the Feedback Begins…

Jeffrey Carr, President/CEO, Taia Global, Inc:

“The evidence that the FBI believes it has against the DPRK in the Sony attack stems from the data that it received on the Dark Seoul attack last year from the private sector. The FBI, the NSA, and the private security companies upon which they rely for information believe that any attack linked to a North Korean IP address must be one that is government sanctioned since North Korea maintains such tight control over its Internet and Intranet. That is the FBI’s single point of failure because while that might have been true prior to 2009, it isn’t true any longer.

 

Access to those blocks is relatively easy if you go in through China, Thailand, Japan, Germany or other countries where North Korea has strategic connections.

 

It simply isn’t enough for the FBI director to say “We know who hacked Sony. It was the North Koreans” in a protected environment where no questions were permitted. The necessity of proof always lies with the person who lays the charges. As of today, the U.S. government is in the uniquely embarrassing position of being tricked by a hacker crew into charging another foreign government with a crime it didn’t commit. I predict that these hackers, and others, will escalate their attacks until the U.S. figures out what it’s doing wrong in incident attribution and fixes it.”

Joshua Cannell, malware intelligence analyst at Malwarebytes Labs:

“Many people continue to speculate about who was really behind the cyberattack against Sony Pictures. We know the director of the F.B.I. has made it publicly clear that North Korea was to blame, and the fact that he’s pushing to declassify that information should tell the world that they have solid evidence to back it up. If we weren’t living in a time where the ability to trust a U.S. Intelligence agency hadn’t recently been questioned during the release of incriminating N.S.A. documents, most people would have likely accepted the F.B.I.’s statement as fact long ago. It seems that by releasing more information, the F.B.I. is hoping to regain the confidence placed in U.S. Intelligence.

 

You have to look at some of the details leading up to the hack in November. North Korean officials called the release of The Interview ‘an act of terrorism,’ and there was a Facebook group sending threats to Sony Pictures months before the movie’s release. When that was shut down, actors continued to use other methods to communicate their threats, like e-mail. Finally, the threats came to fruition, and simply saying ‘it wasn’t us’ at this point doesn’t do much when all of the evidence points at them. There may have been others involved, that’s true, but that doesn’t change the conclusion of a lengthy federal investigation.”

Jay Kaplan, CEO of Synack:

“The security pundits that we’ve seen in the media disagreeing with the government’s assertion of North Korean attribution are ill-informed with conclusions that I believe to be fundamentally flawed. Even with the latest revelation of details tying North Korea to the Sony breach by “slipping up”, there is much more under the covers that the public is not seeing (and will never see as a result of classified sources.) Conclusions made by security firms after reviewing methodology, technical capability, and modus operandi are flawed given their non-complete picture of the situation at hand.

 

It is especially interesting to see how just a few months ago the world thought the government had too much information — the intelligence community was running rampant, too much data was being siphoned, and the integrity of our privacy was in question. Yet today, post-Sony breach, people are questioning the same government for coming to conclusions due to a lack of knowledge and perspective.”

Ken Westin, senior security analyst, Tripwire:

“It is difficult if not impossible for those of us in the private sector to verify the FBI¹s findings without access to the information they have.

 

However, I think it is important to note that in this latest statement they are tying their attribution case to IP addresses they say were exclusively used by the North Koreans. I think it is important to point out that Comey said they were IP addresses exclusively used by the North Koreans and not IP addresses in North Korea. The IP addresses that were issued to the public in their flash advisories were IP addresses that have been seen before and used for spam and command and control by other criminal actors. This was a key reason many in the security community were skeptical of the findings, as based on the evidence provided there wasn’t exactly a smoking gun and the information was vague and inconclusive.

 

I would like to give the FBI the benefit of the doubt and assume that they have additional evidence aside from just IP addresses, which I think they must if they have the level of confidence that Comey is claiming. The difficult part of that for the security community is trusting the FBI. Trust does not come easily to this group, as by nature of their profession they are paranoid and skeptical and want to see the evidence for themselves to establish the facts.”

Suits and Spooks DC: Not Just a Conference, a Collision. Washington DC, Feb 4-5. See the Agenda & Register Today

Marc Gaffan, CEO & Co-founder of Incapsula:

“While we may never know the the motives behind the Sony Pictures attack, we’ve found that some attackers will publicly deny involvement, but leave breadcrumbs in an attempt to demonstrate prowess without taking the full brunt of public criticism. As for North Korea’s cyber espionage capabilities, despite the fact that their Internet capacity is less than half of the Falkland Islands, it would be foolhardy to equate a small Internet presence with a lack of skilled individuals working with or for their government.

 

Regardless of origin or motive, companies need to turn their focus to the blind spots in their organizations. Hackers will only continue to create more illusive and inventive ways to take down websites or steal information; our global networks see new methods every day. Sony Pictures learned their lesson, but will other companies? This remains to be seen.”

Michael Sutton, VP of Security Research, Zscaler:

“Attribution is hard. This is always the case when dealing with a cyber attack where IP addresses can be spoofed, proxies can be employed and digital weapons copied. Attribution is impossible when we don’t have all the facts. The FBI was surprisingly quick to finger the DPRK for the Sony attacks. Less than a month after the breach, the FBI confidently proclaimed that they had “enough information to conclude that the North Korean government is responsible for [the attacks]”.

 

Contrast that with the grand jury indictment of five Chinese Military officials charged last year with cyber espionage, a case which involved years of investigation. Why did the FBI move so quickly this time? Was it truly an open and shut case? Were there other political motivations for fingering North Korea? Without full transparency we’ll likely never know but we can presume that attribution was needed prior to retaliatory measures. Measures that have already publicly emerged in the form of US sanctions, but other more covert responses are no doubt also currently underway and unlikely to show up in the headlines.

 

Some have claimed that the DPRK did not have the means to conduct such a successful attack, but this is a country that has had an offensive cyber capability for many years and has shown a willingness to leverage it against foreign nations/companies. The Sony breach, while broad in terms of the damage caused, would not have required great sophistication if network admin credentials were indeed stolen and the target had poor internal controls to limit the reach of that individual’s network access. Given Sony’s poor history with previous attacks, including a 23 day DoS attack on the PlayStation Network in 2011, it’s not hard to fathom that internal security controls were lacking.”

Mike Tierney, COO at SpectorSoft:

“As the feeding frenzy around the possibility a nation was behind the Sony hack calms a bit, more and more credible experts are indicating that it is at least as likely that the hack and subsequent data dump were clearly designed to embarrass Sony. The fact that the tie between a pending movie release and the hack was originally made in news reports, and not by the hacker(s), lends some credence to the idea that there may be a more mundane, but all too common, perpetrator.

 

Very often, data leaks of this type stem from a disgruntled employee. Whether the source of their anger is specific, as in the case of a poor performance review or being passed over for a promotion, or more general, as in the case of rumored layoffs (which seem to be a possibility in the Sony case), disgruntled employees can and do present significant risk to organizations.”

Greg Martin, CTO at ThreatStream:

“The big issue with the Sony hack is that any “Security Expert” outside of the core investigation can claim an “alternate theory.”

 

This has been highly confusing to the public who have been hungry for more details which the FBI finally came out with. The FBI had clear evidence that they have some ‘smoking gun’ data showing the North Korean hackers were sloppy when setting up their social media accounts.

 

This is a common mistake made by many hackers – even the very sophisticated ones – and it’s one of the more common ways they get caught. My question to the ‘truthers’ is: why is that so hard to accept?”

Tal Klein, VP of Strategy, Adallom:

“The trouble with breach attribution is that smoking guns are hard to come by. A more concerning issue to those of us watching from the sidelines is that the initial attack vector has still not been discovered, and no breach containment announcement has been made thus far. That means we don’t know whether the attackers still have a foothold in Sony’s infrastructure or if there are more exfiltrated data dumps coming.

 

It is strange that the U.S. would rush to point fingers at North Korea, especially given that any recourse would doubtlessly punish the hapless DPRK proletariat more than government or military. Further, it seems obvious in hindsight that the FBI’s most recent revelations, as presented, would not quell detractors’ call for solid attributable evidence—so one wonders, ‘Why bother?’”

Lior Div, CEO and Co-founder of Cybereason, a MalOps protection company:

“When a company is attacked, it reduces the liability and blame of the attacked company if the public believes it is a nation state attack. This attack may have very well been done or aided by insiders, or other players, including North Koreans that are not nation state cyber attackers, but…certainly the legal and PR fallout for Sony will be less severe if it was believed the attack was state sponsored terrorism as opposed to a disgruntled insider.

 

From all that we’ve read so far, we haven’t seen significant hints for attribution to North Korea as a nation-state sponsored attack. The FBI stated that the attackers were negligent, leaving evidence that ties the attack to North Korea, but in my experience hackers with the capacity to exfiltrate the amount of data involved in the Sony attack are very far from being negligent. It is quite possible that any indicators pointing to North Korea were intentional, left or intentionally planted in order to mislead investigators.

 

So either the FBI knows things that were not shared with the media (possible) that clearly proves it in NK, or – somebody is leveraging it for his own political purposes. That includes the US government, Sony, the hackers…really, we may never know…”

Brendan Spikes, CEO, Spikes Security:

“Given the dangers of using the web today, is it not unreasonable to assume that any network can be breached by web malware trojans? This could surely include servers thought to be used exclusively by North Koreans. I wouldn’t be so quick to assume that someone intending to frame NK for the Sony attack could not intentionally leave breadcrumbs leading back to compromised NK servers.”

TaaSera CTO, Vice President and Founder, Srinivas Kumar:

“Attacker attribution requires reliable information to analyze how the breach was orchestrated internally, identifying the origin of the malicious code (supply chain), and finally tracking down the location of the attackers. The warrant required in a breach investigation to convict the cyber criminals must provide credible evidence as assurance that no evasion techniques were detected, including use of Tor networks, Fast flux DNS, and IP address spoofing. Further, for long duration and high volume data haul, determination of the corpus of actors by geo-location may be an authoritative assertion of the locality or distribution of the attackers.

 

Most investigations today that typically follow in the wake of high profile breaches rely on static geo-location markers for the network addresses and domain names linked to the security episode. The availability of cloud computing services, elastic IPs, Tor networks coupled with the dynamic domain name services, domain name and IP address fast flux warrant evidence beyond reasonable doubt to determine true actors (perpetrators).”

TK Keanini, CTO at Lancope:

“While attribution can be difficult in the physical world, it is incredibly tricky in the digital world. Not only are there effective tools to remain anonymous but there are equally as many tools to make it look like it is attributed to a certain source when it is actually another.

 

Conflict in simpler times was very symmetrical in that the red team versus the blue team but these days in the digital realm of the Internet, it is almost never that simple. an orange team can make it look like the red team is to blame for the attack on the blue team and from there it can grow even more complex. This asymmetrical pattern is the new pattern of cyber conflict and the sooner we all recognize it the better.

 

Ultimately there is an information layer that is adjacent to the physical world meaning at some point you do get back to a person or set of people who are behind the attacks. The synthesis and analysis that lead up to this is complex and not well understood by everyone. Those that understand the dynamics of information spaces are slow and cautious to point fingers as we have seen in the controversy around attribution the Sony Pictures attacks. Even when the culprit stands up, makes themselves known as the Guardian of Peace (GOP), law enforcement still struggles to ties it all back to the physical world where laws can be enforced.”

Ian Amit, Vice President of ZeroFOX:

“Attribution is always a dangerous game. Attackers leave plenty of red herrings to cover their footsteps and make following their trail next to impossible. This is exactly the case with Sony – a few lines of code or IP addresses indicate North Korea, making for a great story, but the actual attack could have come from anywhere.

 

In short, attribution is not a technology game, and trying to deduce attribution based on technical indicators is inherently flawed. If a hacker has deep access in the system, it is extremely easy to change the evidence in order to throw off the trail. What you find from a forensic perspective can mean a thousand different things all at once, based on little fragments of code here or there or the geographic location where an attack was routed though. All these red herrings mean is that attribution becomes political very quickly: any party can conduct their own analysis and come to a conclusion that suits their purposes, all supported by some pieces of incomplete technical evidence.”

Jason Lewis, Chief Collection and Intelligence Officer of Lookingglass Cyber Solutions:

“Attribution is an extremely complex challenge that requires the support of all forms of intelligence to include network, signals, physical, human, etc. In this case, let’s assume the attacker is highly skilled. A highly skilled attacker would understand that leaving false evidence would confuse investigators and lead them to conclusions that point away from themselves.

 

I view this scenario based on how I would compromise a target. First, I would be sure to have multiple launch points between my clandestine Internet connection and my target. That means I would chain multiple compromised hosts through a series of VPNs that encrypt all my traffic. If an investigator was able to trace from the target to my last launch point, they would only find evidence of my tunnel termination. All of my traffic would be passing through the host, never leaving a trace of my activity. If I was determined to frame a person or entity for my activity, I would certainly attempt to compromise a host on their network that was used by many other users, a proxy for example. My malicious traffic would be lost in the noise of thousands of other users.

 

Tracing activity back to me through my tunneled infrastructure may not be impossible, but it would be extremely difficult given that I’m focused on not being caught. If I accessed this network on multiple occasions, I would change the compromised hosts I used for my tunnels and never use the same combination twice. Every comment referencing attribution in the SONY attack introduces more questions.”

Don’t miss the upcoming panel “Sony and the DPRK: A Question of Attribution” at Suits and Spooks DC moderated by The Wall Street Journal’s Danny Yadron.

Until Next Friday…Have a Great Weekend!

Tags:

• NEWS & INDUSTRY
• Tracking & Law Enforcement

Security experts weigh in on what they would like to see in 2015 to make their jobs wrangling users, infrastructure, and data easier.

The new year ahead is a good time to reflect on what infosec professionals need to keep users and data safe—before the inevitable race to stay ahead of the crises and firefighting begins in earnest. In previous years, SecurityWeek asked experts to talk about their security resolutions. This year, security experts weigh in on their 2015 wish list—things they would like to see happen in their organization and the security industry as a whole.

Information security is a tough job. There is an element of fortune telling to figure out where the next threats will come from, as well as continuous gate keeping to monitor everything that comes in and out of the organization.

Intent and motives matter, since the same action can be malicious, negligent, or benign based on the circumstances. Locking things down annoys users, so there has to be controls in place to let users do what they want while still maintaining a certain level of protection. When something goes wrong, such as the case of a failed compliance audit, regulatory investigation, data breach, cyber-attack, or data theft, there is always finger pointing and recriminations.

Faced with these challenges, what do CSOs/CISOs, information security practitioners, and other experts wish for? The gamut of responses ranged from the serious (implementing new controls) to humorous (a time machine). At the heart of all the responses was the recognition that security is visible and their jobs are on the line when things go wrong.

“If I was a practicing CISO right now, the very first thing on my wish list would be a ‘keep me from getting fired’ gift card,” said Eric Cowperthwaite, vice-president of advanced security and strategy at Core Security and the former CISO of Provident Health and Services. The card would be something CISOs can hand to the CEO after the inevitable attack, breach and theft of critical assets and say, “can’t fire me this time,” he said.

CISOs should demand access to the CEO and support of the senior executives in the company to define and protect the crown jewels, said Renee Guttmann, vice president of information risk management and member of the Accuvant Office of the CISO. Most CISOs want more attention and funding from the executive team—and a seat at the executive table to provide updates periodicall, said Guttmann, who formerly served as CISO at Coca-Cola. CISOs also want to be recognized as playing as critical a role within the organization as the CFO or COO.

“In 2015, CISOs will be asking for a corner office, with a view,” said Michael Daly, the CTO of Cybersecurity & Special Missions at Raytheon.

Talking to a Board Which ‘Gets’ Security

Most CISOs would love to switch the conversation with the board of directors from the whys of security to the hows. Even after the past year of almost non-stop breaches, it’s clear that the need to proactively implement good security is poorly understood—or simply ignored—at the highest levels of business, said Geoff Webb, senior director of solution strategy at NetIQ.

“If I could give every CISO on the planet a New Year’s wish, it would be to have that conversation changed from ‘Why should I invest in security’ to ‘How do we get the job done,’” said Webb.

CISOs want the support of their executive management to put in place the level of security consistent with the amount of risk the organization is willing to accept, said Marc Maiffret, CTO of BeyondTrust.

> Request an Invitation to the 2015 CISO Forum

Having the Industry Step Up

Several of the experts expressed their frustration on the state of the information security industry. “It’s clear that after Target, JPMC, Sony and many other highly publicized, massive attacks perpetuated in 2014, the industry needs new tools to find these attackers before they are able to successfully complete their damage,” said Mike Mumcuoglu, CTO and co-founder of LightCyber.

For years, CISO have been promised more effective security technology was on the way, and that they just needed to spend “just a little bit more” to significantly improve their security. “It hasn’t quite worked out the way it’s been promised,” said Ken Levine, CEO of Digital Guardian. CISOs should be asking for technology that works better than what’s been delivered to date for a price that reflects its actual value, he said. And that doesn’t mean yet another piece of technology blasting millions of alerts since it’s not possible to process them all.

“Memo to the security industry, giving me hundreds of thousands, if not millions of alerts is about as effective as giving me none,” Levine said. “Will you please tell me which alerts I need to worry most about!”

There is a lot of conversation about security analytics, but it’s still just a lot of promises and not enough reality. “This is all vendor hype as none of the technologies integrate enough of the products in my environment to make the data useful without me having to put asterisks next to the data in my presentations,” said Mike Davis, CTO of CounterTack.

It would be nice to have security reports that show the state of the organization that “don’t put people to sleep,” said Gil Zimmermann, CEO and co-founder of CloudLock.

It’s not just technology that needs to change—the way the industry treats standards also need to change as well, so that standards are actually treated as something that works across platforms and organizations. “Too many standards that aren’t interoperable between products prevents me from deploying different tools,” Davis said.

Along with standards, the industry needs to define security and risk metrics for making informed decisions and managing a security program. Other c-level executives have a set of metrics they can use to explain what they are doing and what the effects to the business are. At the moment, there is no consensus on key performance indicators or a widely adopted set of quantifiable metrics, so cyber-security decisions are “perceived as mere guess work by boards of directors and other corporate executives,” said Jonathan Trull, CISO of Qualys and former CISO of Colorado. The lack of trust in CSOs and security community as a whole is a major barrier to obtaining additional funding and resources.

“CISOs must be able to answer the question: For x amount of money spent on cyber security, what will be the return?” Trull said.

Cool Tools That Need to Exist

Along with asking for better security technology to make the day-to-day operations as well as overall risk management possible, security professionals have their own list of products that would make their jobs easier—and more fun.

Zimmerman said a “one-year paid membership to tech gadgets of the month club” would be a good thing for a CISO to have.

“A time machine so I can go back in time and make a bunch of different investment choices,” said Core Security’s Cowperthwaite.

“’X-Ray Data Goggles’ to give me a deep look into the network to determine where my critical or sensitive data is, what assets support the data, and what controls keep the data safe,” said Arlie Hartman, a consultant at Rook Security.

“’Information Security Pocket Translator’ to refine my message to the board, to speak their language, and enable the business to work within acceptable risks,” said Randy Wray, a consultant with Rook Security.

Having Necessary Tools on Hand

CISOs want to be able to proactively track specific adversaries as they “walk” their way through the network, said Rick Howard, CSO of Palo Alto Networks. By identifying indicators of compromise as part of an attack, CISOs will be able to determine their response. “In my perfect fantasy world, I would like to be able to track adversaries — criminals, spies, hacktivists, and ankle biters — by watching for sets of Indicators of Compromise at every link in the Kill Chain,” he said.

CISOs need the attacker profile, not the actual identity. If the attacker is a spy out to steal mergers and acquisitions documents, and those documents are on the organization’s network, then the internal security team should be on high alert. Otherwise, the team can deal with the threat without turning this into an emergency firefighting situation, he said.

Failing that perfect scenario, CSOs and CISOs should have technology configured correctly—oftentimes organizations discover too late the settings they thought they were getting weren’t turned on when the technology was initially turned on. “We spend gazillions of dollars to buy the latest and greatest, and yet fail to squeeze as much efficiency out of it as possible,” said Howard. While it may be more interesting to talk about nation-state attacks, CSOs need to focus on device configuration. “We should at least get that right before we move on to the sexy stuff.”

Target has set a very public precedent for financial liability in the case of a targeted attack on personal financial information. As a result, every major financial, retail, and online entity will be looking into cyber-insurance, said Mike Mumcuoglu, CTO and co-founder of LightCyber. Cost-effective data breach insurance will be on many CISO wish lists this year, he said.

Effective Collaboration With Others

Security is much more visible in that people are more aware and pay attention when something goes wrong, but it’s not yet viewed as a joint effort. There is still the sense that users do their own thing while the security folks in the backroom keep things humming. There needs to be formal agreements between business, IT, and security teams to integrate information security into the process instead of treating it as an add-on commodity, said Chris Blow, a consultant with Rook Security.

“It would be nice to have an IT team and user base that cares about security as much as the security team,” Zimmermann said. “Or being included in conversations about new technology developments, purchases, or deployments before final decisions are made.”

It would also help the CSO to have “better clarity from legal on what a breach is, what an incident is, and what we can safely ignore,” Davis said.

IT should “actually follow the security guidelines we built instead of always getting a risk waiver,” added Davis. The waiver means IT essentially says it understands the risks and doesn’t have to implement the proper controls or take specific tasks to resolve an issue. This doesn’t help the organization’s overall security. Vendors also need to think about security—whether it’s in their software development cycle, the patching system, or even maintaining their cloud infrastructure. “Tired of getting vendor software that isn’t secure and I can’t make secure,” he said.

Speaking of software development, proper tools are critical. All developers should have security training so that they think about security right from the design phase, said Steven Lipner, chairman of SAFECode and partner director of program management at Microsoft’s Trustworthy Computing group. Each developer in the organization should receive a full toolbox for static analysis, current compilers, and fuzzing tools to build code that contains even fewer vulnerabilities, and make it even harder to exploit any that remain, he said.

Legions of Experienced Folks

The biggest challenge for CISOs is not fighting for the ideal infosec budget, but finding and hiring employees with necessary skills and experience. CISOs want a “proper staff” of experienced and knowledgeable security professionals and are looking for the right people to handle the security fundamentals, Maiffret said.

CISOs want to hire staff who are focused on analytics and risk, not just running firewalls, Cowperthwaite said. This echoed CounterTack’s Davis, who noted that universities tend to focus on network security, not realizing that network security is not the same as IT security.

“It is only one slice of the problem,” Davis said.

Turning Wishes into Reality

As the old saying goes, “If wishes were horses…” CISOs may have a long list for what they would like to see, but they can’t just sit back and wait for their wishes to be granted. CISOs should make a New Year’s resolution to become a corporate business leader, said Trull. CISOs need to become more integrated into c-suite conversations, focus on the integration between DevOps and security teams, learn the business and understand the financials, and learn to speak the language of other executives including the ability to calculate and demonstrate a return on investment for cybersecurity spending.

Security leaders must align themselves more closely to business strategy and “operationalize on the fundamentals of good IT,” said Rafal Los, director of solutions research and member of the Accuvant Office of the CISO. The goal is to get business leaders to see security as a strategic asset and not a drag on the budget.

CISOs must “resolve to be more than a technical security professional and to take responsibility for making difficult risk-benefit decisions that drive the business forward,” Trull said.

All of these wish list items sounded reasonable, but there was a sense of frustration among security experts about the obstacles in their way. The technology was not available, other C-suite executives and the board remained uninterested, or the integration with IT was too tense. Would 2015 be the year when information security professionals would get a seat at the table and be able to work with the organization to improve security?

If the wish list items were too much to ask for, “would you consider coming up with some sort of solution that would allow CISOs to take Sundays off?” Levine said.

Related Event: Request an Invitation to the 2015 CISO Forum

Tags:

• NEWS & INDUSTRY
• Risk Management
• Security Infrastructure
• Management & Strategy

The United States imposed new sanctions Friday on North Korea in retaliation for a cyber attack on Hollywood studio Sony Pictures.

In an executive order President Barack Obama authorized the US Treasury to place on its blacklist three top North Korean intelligence and arms operations, as well as 10 government officials, most of them involved in Pyongyang’s arms exports.

Obama said he ordered the sanctions because of “the provocative, destabilizing, and repressive actions and policies of the Government of North Korea, including its destructive, coercive cyber-related actions during November and December 2014.”

The activities “constitute a continuing threat to the national security, foreign policy, and economy of the United States,” he added, in a letter to inform congressional leaders.

“The order is not targeted at the people of North Korea, but rather is aimed at the Government of North Korea and its activities that threaten the United States and others,” Obama added.

The sanctions come after hackers penetrated Sony’s computers in late November, stealing and releasing over the Internet employee information, unreleased films and an embarrassing trove of emails between top company executives.

The hackers — a group calling itself Guardians of Peace — then began to issue threats against the company over the looming Christmas release of the comedy film “The Interview”, which depicts a fictional CIA plot to kill North Korea’s leader.

The threats led first to worried movie theater owners dropping the film and then Sony cancelling the public debut altogether, before releasing it online.

After the hackers invoked the 9/11 attacks in their threats, the White House branded it a national security threat, and an investigation by the FBI said North Korea was behind the Sony intrusion.

Pyongyang repeatedly denied involvement, but has applauded the actions of the shadowy Guardians of Peace group.

‘Proportional’ response

The White House stressed Friday that its response will be “proportional”, but also that the sanction actions were only “the first aspect of our response.”

“We take seriously North Korea’s attack that aimed to create destructive financial effects on a US company and to threaten artists and other individuals with the goal of restricting their right to free expression,” said White House press secretary Josh Earnest.

In parallel with the White House announcement, the Treasury named the first targets of sanctions in the Sony case.

They included the Reconnaissance General Bureau, the government’s main intelligence organization, and two top North Korean arms exporters: Korea Mining Development Trading Corporation (KOMID) and Korea Tangun Trading Corporation.

The individuals named included agents of KOMID in Namibia, Russia, Iran and Syria, and other representatives of the government and the sanctioned organizations.

An administration official, briefing reporters, said that they remain “very confident” in their assessment that Pyongyang is behind the attack on Sony, amid doubts raised by security experts.

The official said the three organizations had “no direct involvement” with the hacking. “They’re being designated to put pressure on the North Korean government,” the official said.

It was the first time the Treasury sanctions mechanism had been invoked due to a threat to a private company, the official acknowledged.

The sanctions forbid US individuals and companies from doing business with those blacklist, and freezes any assets those blacklisted might have on US territory.

A particular aim of such sanctions is to limit their access to international financial services by locking them out of the US financial system.

All three of the organizations blacklisted in the Sony case are already under US sanctions for the country’s persistence with its nuclear weapons program, its alleged provocations on the Korean peninsula, and other “continued actions that threaten the United States and others,” as Obama said in his letter.

Tags:

 Researchers at Trend Micro say attackers are actively exploiting a vulnerability in Android’s WebView browser in order to compromise Facebook accounts. 

The flaw allows the attackers to bypass Android’s Same Origin Policy (SOP), and impacts devices running versions of the operating system prior to 4.4. The vulnerability, CVE-2014-6041, was first disclosed in September by an independent researcher. But months later, the vulnerability continues to be exploited in the wild.

“The Android WebView in Android before 4.4 allows remote attackers to bypass the Same Origin Policy via a crafted attribute containing a u0000 character, as demonstrated by an onclick=”window.open(‘u0000javascript: sequence to the Android Browser application 4.2.1 or a third-party web browser,” according to the National Vulnerability Database.

According to Trend Micro Mobile Security Engineer Simon Huang, the attack targets Facebook users via a link in a particular Facebook page that leads to a malicious site. The page contains obfuscated JavaScript code that includes an attempt to load a Facebook URL in an inner frame. The user will only see a blank page as the page’s HTML has been set not to display anything via its div tag while the inner frame has a size of one pixel, he added.

“While these routines are being carried out, the SOP bypass is being performed,” he blogged, adding that a remote JavaScript file is loaded from a legitimate cloud storage provider.

The file, he noted, contains the malicious code of the attack and enables the attackers to perform the following activities on Facebook:

1. Add friends
2. Like and follow Facebook pages
3. Modify subscriptions
4. Authorize a Facebook app to access the user’s public profile, friends list, birthday information, likes and friends’ likes
5. Steal the victim’s access tokens and upload them to their server  at http://{BLOCKED}martforchristmas.website/walmart/j/index.php?cid=544fba6ac6988&access_token= $ token;
6. Collect analytics data (such as victims’ location, HTTP referrer,  etc.) using the legitimate service at https://whos.{BLOCKED}ung.us/pingjs/

“In addition to the code at the above site, we found a similar attack at <a href="http://redirect.viglink.com?key=11fe087258b6fc0532a5ccfc924805c0&u=http%3A%2F%2Fwww.%257bBLOCKED%257dphp.com%2Fx%2Ftoplu.php%22%3Ehttp%3A%2F%2Fwww.%7BBLOCKED%7Dphp.com%2Fx%2Ftoplu.php%3C%2Fa%3E%2C" Huang explained. "We believe both of them are created by the same author because they share several function names, as well as the client_id of the Facebook app."

“The client_id involved in this malware was “2254487659”,” he added. “This is an official BlackBerry App  maintained by BlackBerry. We confirmed with BlackBerry and clarified that this malware is trying to take advantage of the trusted BlackBerry brand name and steal user’s access-tokens, which can be used to make requests to Facebook APIs and read user’s information or to publish content to Facebook on behalf of a person.”

Blackberry is working with Facebook and Trend Micro to address the issue. Google has already issued a fix for the vulnerability for Android users.

Tags:

• INDUSTRY INSIGHTS
• Vulnerabilities

North Korea on Saturday called US President Barack Obama a “monkey” for inciting cinemas to screen a comedy featuring a fictional plot to kill its leader, and blamed Washington for an Internet blackout this week.

The isolated dictatorship’s powerful National Defence Commission (NDC) threatened “inescapable deadly blows” over the film and accused the US of “disturbing the Internet operation” of North Korean media outlets.

The Internet outage triggered speculation that US authorities may have launched a cyber-attack in retaliation for the hacking of Sony Pictures — the studio behind madcap North Korea comedy “The Interview”.

Washington has said the attack on Sony was carried out by Pyongyang.

The NDC accused Obama of taking the lead in encouraging cinemas to screen “The Interview” on Christmas Day. Sony had initially cancelled its release after major US cinema chains said they would not show it, following threats by hackers aimed at cinemagoers.

“Obama always goes reckless in words and deeds like a monkey in a tropical forest,” a spokesman for the NDC’s policy department said in a statement published by the North’s official KCNA news agency.

“If the US persists in American-style arrogant, high-handed and gangster-like arbitrary practices despite (North Korea’s) repeated warnings, the US should bear in mind that its failed political affairs will face inescapable deadly blows,” the NDC spokesman said.

He accused Washington of linking the hacking of Sony to North Korea “without clear evidence” and repeated Pyongyang’s condemnation of the film, describing it as “a movie for agitating terrorism produced with high-ranking politicians of the US administration involved”.

Unlikely symbol of free speech

The film took in $ 1 million in its limited-release opening day, showing in around 300 mostly small, independent theatres. It was also released online for rental or purchase.

The film, which has been panned by critics, has become an unlikely symbol of free speech thanks to the hacker threats that nearly scuppered its release.

The low-brow comedy revolving around the fictional assassination of North Korean leader Kim Jong-Un played to packed cinemas across the US.

A file sharing website reported the film had been illegally downloaded more than 750,000 times.

Online services for Sony’s PlayStation and Microsoft’s Xbox gaming consoles, which had decided to release the film online, went down Thursday, apparently attacked by hackers.

Microsoft’s online network for its Xbox gaming console was restored to nearly full service Friday but the PlayStation network remained down.

The NDC spokesman called again for a joint investigation into the Sony hack, which has already been rejected by the US, while accusing Washington of “beating air after being hit hard by others”.

“In actuality, the US, a big country, started disturbing the Internet operation of major media of the DPRK (North Korea), not knowing shame like children playing a tag,” he said.

From Monday night, websites of the North’s major state media went dead for hours.

The cause of the outages in North Korea’s already limited Internet access has not been confirmed. The US has refused to say whether it was involved in the shutdown.

The North has about one million computers — mainly available at educational and state institutions — but most lack any connection to the world wide web.

All online content and email are strictly censored or monitored with access to the Internet strictly limited to a handful of top party cadres, propaganda officials and expatriates.

KCNA previously compared Obama to a black “monkey” in a zoo in May, prompting Washington to condemn the comments as “ugly and disrespectful”.

The North Korean mouthpiece also earlier this year called South Korean President Park Geun-Hye a “prostitute” in thrall to her “pimp” Obama.

Tags:

• Cyberwarfare
• NEWS & INDUSTRY

Researchers at Trend Micro revealed details of an attack against a major Korean utility company hit by malware designed to wipe the master boot records (MBR) of compromised computers.

According to Trend Micro, the malware is believed to have infected the targeted systems through a vulnerability in the Hangul Word Processor (HWP), a commonly-used application in South Korea. The attackers used a variety of social engineering lures as well.

“We detect the malware as TROJ_WHAIM.A, which is a fairly straightforward MBR wiper,” according to Trend Micro. “In addition to the MBR, it also overwrites files that are of specific types on the affected system. It installs itself as a service on affected machines to ensure that it will run whenever the system is restarted. Rather cleverly, it uses file names, service names, and descriptions of actual legitimate Windows services. This ensures that a cursory examination of a system’s services may not find anything malicious, helping this threat evade detection.”

“This particular MBR-wiping behavior, while uncommon, has been seen before,” the researchers noted. “We observed these routines in March 2013 when several attacks hit various South Korean government agencies resulting in major disruptions to their operations. The malware involved in this attack overwrote the MBR with a series of the words PRINCPES, HASTATI, or PR!NCPES. The recent attack on Sony Pictures also exhibited a similar MBR-wiping capability.”

Trend Micro also found similarities to the previous MBR wiper attacks as well. All three attacks overwrite the MBR with certain repeated strings; this attack uses the repeating “Who Am I?” string, while the Sony attack used a repeating 0xAAAAAAAA pattern.

The attack on Sony has caused a further rift between North Korea and the United States, as U.S. President Barack Obama promised last week that the United States would offer a proportional response to North Korea’s involvement in the attack.

North Korea has denied any involvement in the incident. The country began suffering Internet outages this week, though the cause of those outages remains unclear.

“While there are definite similarities in the behavior of all these attacks, this is not enough to conclude that the parties behind the attacks are also related,” according to Trend Micro. “All three attacks have been well documented, and it is possible that the parties behind each attack were “inspired” by the others without necessarily being tied. Without sufficient evidence, we cannot make claims either way.”

“These attacks highlight our findings about the destructive, MBR-wiping malware that appear to have become a part of the arsenal of several threat actors,” the researchers added. “This is a threat that system administrators will have to deal with, and not all targeted attack countermeasures will be effective. Techniques to mitigate the damage that these attacks cause should be considered as a part of defense-in-depth networks.”

Tags:

• Cyberwarfare
• NEWS & INDUSTRY

On Dec. 16, Internet Corporation for Assigned Names and Numbers (ICANN) said it fell victim to a spear phishing attack that resulted in email credentials of several ICANN staff being compromised.

The incident, which occurred in late November and was discovered in early December, allowed attackers to access the Centralized Zone Data System and the ICANN GAC Wiki.

The attacker(s) were able to poke around ICANN systems and obtain administrative access to all files in the CZDS, including copies of the zone files in the system, as well as user information such as name, postal address, email address, fax and telephone numbers, username, and password, according to the original announcement.

Fortunately, ICANN said that those compromised accounts did not have access to the IANA functions systems, which the organization says are a separate system with additional security measures that have not been breached.

IANA functions coordinate domain names with IP addresses to appropriately direct DNS requests to the appropriate server.

ICANN has a contract with U.S. Department of Commerce to maintain the IANA functions on behalf of the entire Internet community.

“During and after the attack, all critical functions hosted by ICANN, including the IANA functions, remained fully operational and unaffected by the attacker’s activities,” ICANN said in an update.

“ICANN employs multiple levels of protection for its most critical services. While the attackers were able to breach the outermost layer of defenses, our on-going investigation indicates our most critical systems were not affected.”

Related: Don’t Let DNS be Your Single Point of Failure

Related: DNS Hijack – How to Avoid Being a Victim

Tags:

• NEWS & INDUSTRY
• Security Infrastructure

The distributed revision control system Git is affected by a serious vulnerability that could be exploited by an attacker to execute arbitrary commands and take over a developer’s machine.

The flaw (CVE-2014-9390) affects all versions of the official Git client and related software that interacts with Git repositories. Git 2.2.1 has been released to address the issue, but updates have also been made available for older maintenance tracks (1.8.5.6, 1.9.5, 2.0.5, 2.1.4).

The vulnerability, which affects users running Windows and Mac OS X, was discovered by the developers of the cross-platform, distributed revision control tool Mercurial. They initially identified the security hole in Mercurial, but after further investigation, they determined that Git is affected as well.

GitHub for Windows and GitHub for Mac have been updated to address the vulnerability. GitHub says GitHub Enterprise and github.com are not directly affected, but users are advised to update their clients as soon as possible.

Maintenance versions that include the fix for this flaw have also been released for libgit2 and JGit, two major Git libraries. Since Microsoft uses libgit2 in Visual Studio products, the company has rolled out patches for Visual Studio Online, Codeplex, Visual Studio Team Foundation Server (TFS) 2013, Visual Studio 2013 RTM, Visual Studio 2013 Update 4, and for the VS 2012 VSIX extension.

Apple’s integrated development environment Xcode also uses Git. The issue has been addressed by adding additional checks in Xcode 6.2 beta 3.

The disclosure of the vulnerability and the release of patches have been coordinated by all affected parties.

“The vulnerability concerns Git and Git-compatible clients that access Git repositories in a case-insensitive or case-normalizing filesystem. An attacker can craft a malicious Git tree that will cause Git to overwrite its own .git/config file when cloning or checking out a repository, leading to arbitrary command execution in the client machine,” GitHub’s Vicent Marti explained in a blog post.

Marti noted that the flaw doesn’t affect Linux clients if they run in a case-sensitive filesystem. However, Junio Hamano, who maintains Git since 2005, has pointed out that some Linux users might also have to take measures.

“Even though the issue may not affect Linux users, if you are a hosting service whose users may fetch from your service to Windows or Mac OS X machines, you are strongly encouraged to update to protect such users who use existing versions of Git,” Hamano said in an advisory.

Microsoft’s Brian Harry believes that an attack leveraging this vulnerability is likely to work only in certain environments.

“For someone to do this to you, they have to have commit rights to a repo that you pull from. Inside a corporation, that would likely have to be an attack from the inside. The most likely (not only, but most likely) scenario here is in some small OSS project. Large ones generally have pretty well known/trusted committers,” Harry said.

Tags:

• NEWS & INDUSTRY
• Vulnerabilities

The PCI Security Standards Council (PCI SSC) published guidance today on the secure development and maintenance of software designed to run on point-of-interaction (POI) devices.  

POI devices are hardware or software components in point-of-sale equipment that allow a consumer to use a credit card to make a purchase, such as a PIN pad. According to the PCI SSC, the document is intended to address software that exists on POI devices, including payment and non-payment applications, and reinforce the importance of a layered approach to security.

“The goal of this document is to ensure that all organizations responsible for software development (and device management) understand the potential threats, and employ appropriate processes throughout the development life cycle to counter those threats,” according to the document. “The processes followed will depend on the organization, the type of application being developed, and the software languages used, but the principles remain the same.”

The document is meant to help organizations – including POI device vendors – that write or implement applications within a POI device understand the threats and counter them throughout the development lifecycle, according to the PCI SSC. It also comes at a time when cybercriminals have increasingly been paying attention to point-of-sale devices and targeting both retailers as well as vendors of point-of-sale devices (PoS). 

“Criminals are looking at every aspect of a payment transaction to find ways for data exfiltration,” said PCI SSC Chief Technology Officer Troy Leach, in a statement. “While consumers and merchants alike benefit from additional features, complexity and increasing dependency on third-party applications can create new opportunities for exploit which is why due diligence is so vital in the development of software that terminals rely upon. This paper highlights important best practices for software coding in this unique environment.”

According to the PCI SSC, organizations can use this guidance to help ensure standard secure coding practices are followed, including:

Security awareness training that supports secure software development:

• Those involved in the development process (including software developers and peer reviewers), have important roles to play in developing software to ensure secure coding practices are implemented and address current threats. Those roles need to be defined before development begins and those individuals need to be trained and understand the secure software development program.

Secure software development lifecycle:

• Organizations need to have a software security roadmap defined before development begins that will address known threats. The software needs to be mapped and documented, and rules and processes defined so that security is implemented as part of the development process and not incorporated as an afterthought.

Device-level testing:

• It is imperative to understand how the application will work when used with the hardware, firmware, and other applications that it is intended for use with. While simulators and unit testing are essential, testing the device with the complete solution should be a priority.

Internal process reviews:

• The threat environment is constantly evolving which is why organizations need to stay current on the latest threats and changes to ensure the procedures in place are still sufficient and are actually being followed.

Michael Belton, team lead of assessment services at Rapid7, said that for an average retailer, performing hardware and software security testing on a product they purchased is cost-prohibitive.

“Security awareness training for developers, along with secure software development lifecycle practices, help ensure consistency across developers working on an application,” he said. “This consistency in security design and expectations means applications are released with fewer bugs that can be exploited. Penetration testers encounter issues related to security lifecycle practices every time they perform an assessment. These two items are perhaps the most critical challenges towards creating software that operates in a secure and predictable manner.”

The document can be read here.

Tags:

• NEWS & INDUSTRY
• Compliance

Indian police on Saturday arrested a 24-year-old executive believed to be the handler of an influential Twitter account supporting the Islamic State group, officials said.

Mehdi Masroor Biswas, employed with an Indian food conglomerate in the southern city of Bangalore, is alleged to be the handler of the Twitter account @ShamiWitness.

The account had 17,700 followers, including many foreign fighters, until it was shut down following a report by Britain’s Channel 4 News on Thursday.

Tweets from @ShamiWitness contained jihadist propaganda as well as information for would-be recruits and messages praising fallen fighters as martyrs.

Related Reading: ISIS Cyber Ops: Empty Threat or Reality?

“He has been taken into custody,” police director general L.R. Pachuau told AFP. Police raided his house in an upscale suburb of Bangalore early Saturday and seized “incriminating documents, Islamic literature and many photos”, Pachuau said.

Pachuau added that details of his arrest would be revealed at a news conference later Saturday.

The Channel 4 report quoted Biswas as saying that he had personally not joined IS ranks in Iraq and Syria because his family was financially dependent on him.

“If I had a chance to leave everything and join them I might have,” he was quoted as saying.

However, in an interview to the Indian Express newspaper published Saturday Biswas said his claims to Channel 4 were meant to get the television reporter off his back.

“When Channel 4 called me first and asked if @ShamiWitness was my Twitter handle, I did not oppose it… my outright rejection would not have convinced them. I therefore decided to admit that I was indeed @ShamiWitness in the hope that they would not air the programme,” Biswas told the daily.

The Press Trust of India news agency said Biswas was likely to be charged with cyber terrorism and sentenced to life imprisonment.

The IS militant group has made extensive use of social media for propaganda and recruitment, as well as for disseminating grisly execution videos.

Related Reading: US Cyber-Warriors Battling Islamic State on Twitter

Related Reading: ISIS Cyber Ops: Empty Threat or Reality?

Tags:

• Cyberwarfare
• NEWS & INDUSTRY
• Tracking & Law Enforcement