Detected (sounded like an internal effort):
"On January 14, 2009, the University of Florida discovered that a server was accessed by an unauthorized intruder from outside UF. This server contained names and Social Security Numbers (SSNs) for 97,200 people that used the system between 1996 and 2009. Although no evidence was found that this information was accessed, there is no absolute certainty that it was not."
Eradicated:
"...the University of Florida discovered that a configuration error allowed outside access to a directory containing Social Security numbers, information normally protected from unauthorized access. UFID numbers and Social Security numbers were used interchangeably for verification purposes until the university discontinued the practice in 2003.
The configuration error was fixed immediately. An investigation revealed the error allowing the unauthorized access had been made four months earlier by an information technology specialist working on the directory. We have no evidence any personal information was obtained, but out of an abundance of caution, the University is working to notify those individuals with information on the directory
Educated
"Answers to Commonly Asked Questions Regarding Grove Incident"
When I went through the list of questions and answers, I was impressed. They did a great job of detailing just about every question that goes through someone's mind when they're affected by something like this.
Obviously, breach = no good. On the other hand, I think (from a high-level) the University did a great job in how they reacted. And isn't it all about detection and reaction?
First off, they perform system audits and are actively looking for anomalies. It's how they found the compromise. This is a clear indicator that they take information security risk and minimum security baselines seriously.
Second, they decided to err on the side of caution. They stated that after their investigation and forensic analysis (which lasted 2 weeks) gave no indication that Personally Identifiable Information (PII) was accessed or copied, but there was no definitive indication that it WAS NOT. This is key. If you can't prove that information has NOT been compromised, you need to notify the people potentially impacted. Notification is expensive. I'm sure it was for the University: more than 97,200 people. On top of that, they don't have contact information for 5,000 of the affected. Again, more time and effort will be spent by the University to track down those people and notify them. To summarize, they did the right thing.
Finally, they used the breach to effectively communicate a LOT of information about information privacy, details around the incident, and effectively highlight their Information Privacy repository. Education, education, education. All of the news sources point to their Privacy site.
Security breaches happen. How you react to the breach (do we notify? priority of incident?) as well as how you educate those parties affected sets you apart from the flunkies. From a 20,000 foot view, the Gators did a good job...
Read more!
Tuesday, February 24, 2009
Monday, February 2, 2009
SecureState Speaks at ShmooCon 2009
SchmooCon for SecureState! SecureState's Dave Kennedy and Matt Neely will be speaking at ShmooCon in Washington, D.C., the annual East coast hacker convention hell-bent on offering three days of an interesting atmosphere for demonstrating technology exploitation, inventive software & hardware solutions, and open discussions of critical infosec issues. The first day is a single track of speed talks, One Track Mind. The next two days, there are three tracks: Break It!, Build It!, and Bring It On!.
Principal at SecureState, Dave Kennedy focuses on the technical side of security, performing penetration tests, source code review, web application security, data forensics, electronic discovery and wireless assessments. Prior to SecureState, Dave worked for the National Security Agency (N.S.A.) and has worked with some of the nations most elite security groups. Dave is also the author of Fast-Track, an open-source penetration testing suite available in Linux, has previously presented at Defcon, and is a contributor to the BackTrack distributions.
Dave's presentation (The Fast-Track Suite: Advanced Penetration Techniques Made Easy) will be the last talk in the Bring It On! track where he will discuss attacks in detail and also release the newest version of Fast-Track.
Matt Neely, Profiling Manager at SecureState, will be presenting "Radio Reconnaissance in Penetration Testing - All Your RF Are Belong to Us," in the first talk of Bring It On! track this Saturday.
Read more!
Principal at SecureState, Dave Kennedy focuses on the technical side of security, performing penetration tests, source code review, web application security, data forensics, electronic discovery and wireless assessments. Prior to SecureState, Dave worked for the National Security Agency (N.S.A.) and has worked with some of the nations most elite security groups. Dave is also the author of Fast-Track, an open-source penetration testing suite available in Linux, has previously presented at Defcon, and is a contributor to the BackTrack distributions.
Dave's presentation (The Fast-Track Suite: Advanced Penetration Techniques Made Easy) will be the last talk in the Bring It On! track where he will discuss attacks in detail and also release the newest version of Fast-Track.
Matt Neely, Profiling Manager at SecureState, will be presenting "Radio Reconnaissance in Penetration Testing - All Your RF Are Belong to Us," in the first talk of Bring It On! track this Saturday.
Read more!
Friday, January 16, 2009
SecureState Attends PCI Compliance Seminar with ISACA
Craig Monastra of Sterling Jewelers with Brian Telesz and Nicole McClain of SecureState
Today, ISACA’s membership—more than 86,000 strong worldwide—is characterized by its diversity. Members live and work in more than 160 countries and cover a variety of professional IT-related positions inlcuding but not limited to IS auditor, consultant, educator, IS security professional, regulator, chief information officer and internal auditor.
SecureState's Brian Telesz and Nicole McClain (pictured above with Craig Monastra of Sterling Jewelers) attended the most recent ISACA seminar at Harry's Steakhouse for good food and a great presentation on PCI Compliance. Keynote speaker was Lisa Peterson of Progressive Insurance.
The Information Systems Audit and Control Association is primarily focused on promoting quality IS audit and governance education to its members. The IS audit profession is based and dependent upon technological expertise. With Audit and Compliance being one of SecureState’s four divisions of expertise its helps our consultants and directors keep abreast on the latest hot topics, concerns and trends in the IT audit world. SecureState is a leader in the Audit and Compliance world. We engage in many different environments such as finance, insurance, manufacturing, retail and energy which gives us a very diverse expertise in the many compliances and security regulations that companies need to adhere to.
In addition to the importance of Audit and Compliance, SecureState belongs to the local chapter and attends the monthly meetings to keep SecureState in front our current and prospective clients who are members. We will also speak and present at these monthly meetings which helps educate ISACA chapter members on what SecureState sees out in the field during engagements and clarify and educate on IT audit issues.
Would you like SecureState to speak at your next event? Contact SecureState at 800.903.6264 for more information.
SecureState's Brian Telesz and Nicole McClain (pictured above with Craig Monastra of Sterling Jewelers) attended the most recent ISACA seminar at Harry's Steakhouse for good food and a great presentation on PCI Compliance. Keynote speaker was Lisa Peterson of Progressive Insurance.
The Information Systems Audit and Control Association is primarily focused on promoting quality IS audit and governance education to its members. The IS audit profession is based and dependent upon technological expertise. With Audit and Compliance being one of SecureState’s four divisions of expertise its helps our consultants and directors keep abreast on the latest hot topics, concerns and trends in the IT audit world. SecureState is a leader in the Audit and Compliance world. We engage in many different environments such as finance, insurance, manufacturing, retail and energy which gives us a very diverse expertise in the many compliances and security regulations that companies need to adhere to.
In addition to the importance of Audit and Compliance, SecureState belongs to the local chapter and attends the monthly meetings to keep SecureState in front our current and prospective clients who are members. We will also speak and present at these monthly meetings which helps educate ISACA chapter members on what SecureState sees out in the field during engagements and clarify and educate on IT audit issues.
Would you like SecureState to speak at your next event? Contact SecureState at 800.903.6264 for more information.
Read more!
Wednesday, December 24, 2008
Security Stuck at the Kids Table?
Where does the Security Department reside at your organization?
I am sure many readers with first answer this question with, “What Security Department?” That is a fair answer for many organizations out there in the real world and for those of you that answered the question that way, I feel sorry for you and your organization... It is only a matter of time before you end up on the front page on the newspaper with a headline reading something like, “Hacker Breaches Company ABC, takes 100,000 Social Security Numbers” or “Insider Steals 20,000 Credit Card Numbers from Company XYZ.” Trust me, I have seen it before. It is only a matter of time.
For the rest of you, where does Security sit? Under the Director of IT? Under the Chief Information Officer? How about under the Audit Department? While there are advantages to each, the disadvantages far outweigh the benefits.
Let’s examine.
Under the Director of IT: Last time I checked, the IT department’s main concern is the availability of resources and data. As a security guy, I really don’t care about availability. If our network is unavailable, we are secure. As such, every decision I make in the best interest of security is going to be analyzed based on the effects of availability, and if these decisions conflict with their goals, they are not going to go far.
Under the CIO: Same problems as above and also include problems with lack of funding, lack of power (i.e. the ability to make decisions and have them implemented), and lack of representation in senior management.
Under the Audit Department: Who is an auditor’s on friend? Another auditor! Okay, so that wasn’t a good joke, but there is truth to it. Most people don’t like auditors and being stuck under that department makes others think Security is one of them. Therefore, everyone from the bottom to the top will be generally “on guard” when you come around and resistant to your goals because of it.
So where is the best place for Security to sit? At the same level as the CIO, but independent from them. Security should be its own Department and have its own voice in the Senior Management circle. They should have their own budget and the ability to defend all decisions made in the best interest of security without being kyboshed before it makes it to the C-level.
In a world with increasingly more stringent regulations and compliances (i.e. PCI, HIPAA, SOX, GLBA), and more sophisticated hackers and hacking techniques, it’s time to move Security where it rightfully belongs, at the adult table.
Read more!
I am sure many readers with first answer this question with, “What Security Department?” That is a fair answer for many organizations out there in the real world and for those of you that answered the question that way, I feel sorry for you and your organization... It is only a matter of time before you end up on the front page on the newspaper with a headline reading something like, “Hacker Breaches Company ABC, takes 100,000 Social Security Numbers” or “Insider Steals 20,000 Credit Card Numbers from Company XYZ.” Trust me, I have seen it before. It is only a matter of time.
For the rest of you, where does Security sit? Under the Director of IT? Under the Chief Information Officer? How about under the Audit Department? While there are advantages to each, the disadvantages far outweigh the benefits.
Let’s examine.
Under the Director of IT: Last time I checked, the IT department’s main concern is the availability of resources and data. As a security guy, I really don’t care about availability. If our network is unavailable, we are secure. As such, every decision I make in the best interest of security is going to be analyzed based on the effects of availability, and if these decisions conflict with their goals, they are not going to go far.
Under the CIO: Same problems as above and also include problems with lack of funding, lack of power (i.e. the ability to make decisions and have them implemented), and lack of representation in senior management.
Under the Audit Department: Who is an auditor’s on friend? Another auditor! Okay, so that wasn’t a good joke, but there is truth to it. Most people don’t like auditors and being stuck under that department makes others think Security is one of them. Therefore, everyone from the bottom to the top will be generally “on guard” when you come around and resistant to your goals because of it.
So where is the best place for Security to sit? At the same level as the CIO, but independent from them. Security should be its own Department and have its own voice in the Senior Management circle. They should have their own budget and the ability to defend all decisions made in the best interest of security without being kyboshed before it makes it to the C-level.
In a world with increasingly more stringent regulations and compliances (i.e. PCI, HIPAA, SOX, GLBA), and more sophisticated hackers and hacking techniques, it’s time to move Security where it rightfully belongs, at the adult table.
Read more!
Tuesday, December 23, 2008
Economy bad… breaches go up!
Cut jobs, layoff people, hell don’t buy coffee, but don’t spend less on assessments during a down economy!
Contrary to popular belief during a down economy it is crucial that companies maintain an assessment program. Based on an article I recently wrote for law.com... when the economy is bad (which appears to be the case for 2009) the chance for theft of corporate assets increases. Based on the fraud triangle below are three areas that if aligned a person is willing to steal, commit fraud or worse.
Getting budget gets tougher and tougher when you don’t know what the real risks are. Hence, next year (2009), spend money on a risk assessment. Yes risk assessments cost more, but they identify more risk and more importantly map the business requirements to those risks. Now you are telling the board or CEO of the risks, not just the results of a penetration test. This is key; we as security practitioners do not want to hold the risk!
Over the past several years I have noticed an increase in January/February breaches and hacking activity. While I can not statistically back up this observation, I can guarantee you that with a down economy and the holiday season, people will have more free time. Especially kids that are off from school, this is an ideal time to try some new hacks out, maybe the latest version of FastTrak.
Read more!
Contrary to popular belief during a down economy it is crucial that companies maintain an assessment program. Based on an article I recently wrote for law.com... when the economy is bad (which appears to be the case for 2009) the chance for theft of corporate assets increases. Based on the fraud triangle below are three areas that if aligned a person is willing to steal, commit fraud or worse.
- Rationalization- The day an employee starts they start to rationalize… I worked all weekend and no one else was here… especially my boss!
- Pressure- Given the economy this is an understatement; pressure is all over the place. With one in five homes being foreclosed on it’s a safe bet that one of your employees will have financial pressure.
- Opportunity- Probably the only area that we can actual control. Taking away or reducing the opportunity is key. Assessments are actually the lowest cost solution to identify the risky areas.
Getting budget gets tougher and tougher when you don’t know what the real risks are. Hence, next year (2009), spend money on a risk assessment. Yes risk assessments cost more, but they identify more risk and more importantly map the business requirements to those risks. Now you are telling the board or CEO of the risks, not just the results of a penetration test. This is key; we as security practitioners do not want to hold the risk!
Over the past several years I have noticed an increase in January/February breaches and hacking activity. While I can not statistically back up this observation, I can guarantee you that with a down economy and the holiday season, people will have more free time. Especially kids that are off from school, this is an ideal time to try some new hacks out, maybe the latest version of FastTrak.
Read more!
Monday, December 1, 2008
e.Discovery Planning
E-Discovery is a topic that is quickly becoming a more common conversation point. The average person really does not know what E-Discovery is and why it is important. The same can actually be said for a large amount of businesses out there today. E-Discovery is not a topic that most companies spend a lot of time talking about. That is until they find themselves part of a situation that makes them understand what E-Discovery is and they soon realize the importance of having a plan for preserving and gathering electronic data that may be used as evidence in a legal proceeding. What data would be important to preserve? The most common type of E-discovery evidence would be e-mail. A lot of transactions and conversations take place via e-mail. Companies such as internet service providers have more of a dilemma, as it is difficult for them to maintain large amounts of data, and they are often presented with requests to preserve information. Many ISP's only keep information for short periods of time due to storage space limits. Other types of data that could possibly be of importance could be database files, documents, picture files, audio, and video files. Many times there is more than is apparent on the surface of a file. The ability to hide incriminating evidence within an audio file or photo is not something that most people are aware of. Instant messaging data is also growing fast. So it becomes apparent that as technology evolves and companies are involved in legal proceedings more and more emphasis is going to be placed on E-Discovery. Many companies will experience this first hand, some will learn from the mistakes of others. Most large companies could potentially have several legal proceedings going on at any given time. This makes it necessary to implement some type of strategic plan for discovering electronic evidence.
A plan for discovering electronic data or evidence is known as Proactive E-Discovery. As mentioned earlier companies are beginning to realize the importance of E-Discovery. Electronic data is one of the most difficult forms of evidence to destroy completely. As data makes its way from system to system it creates another point of presence in which the data can be discovered or hidden. Data itself is growing rapidly, and this further complicates the matter. So why is it so important to have a plan in place for discovering electronic data? An answer that is becoming more and more a reality is "because you have to". A situation such as a legal proceeding could require the presentation or disclosure of relevant data in a very short time frame. According to the Federal Rules of Civil Procedure, data must be produced within 120 days. As part of the discovery phase of a legal proceeding it is required that known information such as data be presented to the opposing counsel. If there is not a plan in place for retrieving this data it is possible that a company could be levied with fines or sanctions for not complying or being unable to comply.
Having had the opportunity to begin studying this field as part of perusing a bachelor degree in computer and digital forensics it has become clear to me the focus the legal system is beginning to put on data that can be stored electronically, and the ability to quickly discover and present that data. As mentioned before the Federal Rules of Civil procedure have been modified, putting focus on the need for companies to know what they are storing and to have a procedure in place to quickly discover the necessary data and present it as evidence to legal counsel. Knowing what is stored is an issue companies will struggle with as any data that is stored can potentially be called into question and become part of an ongoing investigation. A major driving force behind the scramble to implement E-Discovery plans is the potential for sanctions. Courts have a good amount of leeway when imposing sanctions. These sanctions can amount to million dollar penalties that could potentially bankrupt an organization. In general the sanctions can be determined by the severity of the failure to comply and the actions taken by representatives to either help or hinder the discovery of data. The following link is an article that talks about the World Trade Center Insurer, and their legal counsel that were hit with E-Discovery sanctions: http://www.ediscoverylaw.com/2007/07/articles/case-summaries/wtc-insurer-and-its-counsel-hit-with-ediscovery-sanctions/
The E-Discovery business is the real deal, and as more and more companies are penalized for failing to comply, more and more companies will be looking to adopt policies and procedures that will allow them to know what it is they are archiving, and exactly how they will go about discovering and presenting this data. Their efforts will likely save them millions of dollars and the ugly embarrassment of their names being publicized as having violated E-Discovery regulations. E-Discovery compliance will also continue to grow and become more main-stream as society continues to move in the direction of electronic lifestyles. The more electronic data there is in the world, the more important E-Discovery will become.
Read more!
A plan for discovering electronic data or evidence is known as Proactive E-Discovery. As mentioned earlier companies are beginning to realize the importance of E-Discovery. Electronic data is one of the most difficult forms of evidence to destroy completely. As data makes its way from system to system it creates another point of presence in which the data can be discovered or hidden. Data itself is growing rapidly, and this further complicates the matter. So why is it so important to have a plan in place for discovering electronic data? An answer that is becoming more and more a reality is "because you have to". A situation such as a legal proceeding could require the presentation or disclosure of relevant data in a very short time frame. According to the Federal Rules of Civil Procedure, data must be produced within 120 days. As part of the discovery phase of a legal proceeding it is required that known information such as data be presented to the opposing counsel. If there is not a plan in place for retrieving this data it is possible that a company could be levied with fines or sanctions for not complying or being unable to comply.
Having had the opportunity to begin studying this field as part of perusing a bachelor degree in computer and digital forensics it has become clear to me the focus the legal system is beginning to put on data that can be stored electronically, and the ability to quickly discover and present that data. As mentioned before the Federal Rules of Civil procedure have been modified, putting focus on the need for companies to know what they are storing and to have a procedure in place to quickly discover the necessary data and present it as evidence to legal counsel. Knowing what is stored is an issue companies will struggle with as any data that is stored can potentially be called into question and become part of an ongoing investigation. A major driving force behind the scramble to implement E-Discovery plans is the potential for sanctions. Courts have a good amount of leeway when imposing sanctions. These sanctions can amount to million dollar penalties that could potentially bankrupt an organization. In general the sanctions can be determined by the severity of the failure to comply and the actions taken by representatives to either help or hinder the discovery of data. The following link is an article that talks about the World Trade Center Insurer, and their legal counsel that were hit with E-Discovery sanctions: http://www.ediscoverylaw.com/2007/07/articles/case-summaries/wtc-insurer-and-its-counsel-hit-with-ediscovery-sanctions/
The E-Discovery business is the real deal, and as more and more companies are penalized for failing to comply, more and more companies will be looking to adopt policies and procedures that will allow them to know what it is they are archiving, and exactly how they will go about discovering and presenting this data. Their efforts will likely save them millions of dollars and the ugly embarrassment of their names being publicized as having violated E-Discovery regulations. E-Discovery compliance will also continue to grow and become more main-stream as society continues to move in the direction of electronic lifestyles. The more electronic data there is in the world, the more important E-Discovery will become.
Read more!
Friday, November 21, 2008
Intrepid Metasploit Ruby 1.8.7 Fix
Just a quick one here, if you use Ubuntu and have updated to the latest Intrepid release, you undoubtedly know that Metasploit hoses over short-name constants. The fix has been released already to Jaunty (the next Ubuntu release 9.04), however is still in intrepid-proposed for Intrepid. If you need Metasploit to work and can't wait for the release next week of the committed version to the normal repositories. If your seeing the following exploit failed message in Metasploit: "Exploit failed: uninitialized constant Msf::ModuleSet::NDR" or variances of that you have the issue. Additionally, when you load up metasploit you may see the following message:
***********************************************************************
***
*** This version of the Ruby interpreter has significant problems, we
*** strongly recommend that you switch to version 1.8.6 until these *
*** issues have been corrected. Alternatively, you can download,*
*** build, and install the latest Ruby snapshot from: *
*** - http://www.ruby-lang.org/ *
*** For more information, please see the following URL: *
*** - https://bugs.launchpad.net/bugs/282302 *
***
***********************************************************************
Heres a workaround:
Go to the software updates under Administration, click the "Updates" tab and select Proposed updates (intrepid-proposed)
If you don't want it to install everything in intrepid proposed you can do selective intrepid-proposed, to do this create a new file under /etc/apt/ and call it preferences and add the following:
Package: *
Pin: release a=intrepid-updates
Pin-Priority: 900
Package: *
Pin: release a=intrepid-proposed
Pin-Priority: 400
From there, simply go into synaptic package manager, reload the packages, and do a search for ruby1.8, mark for upgrade, install, and metasploit should be working without the short-name constants. The name of the new package is ruby1.8_1.8.7.72-1ubuntu1 (or 0.1).
References:
https://bugs.launchpad.net/ubuntu/+source/ruby1.8/+bug/282302
Read more!
***********************************************************************
***
*** This version of the Ruby interpreter has significant problems, we
*** strongly recommend that you switch to version 1.8.6 until these *
*** issues have been corrected. Alternatively, you can download,*
*** build, and install the latest Ruby snapshot from: *
*** - http://www.ruby-lang.org/ *
*** For more information, please see the following URL: *
*** - https://bugs.launchpad.net/bugs/282302 *
***
***********************************************************************
Heres a workaround:
Go to the software updates under Administration, click the "Updates" tab and select Proposed updates (intrepid-proposed)
If you don't want it to install everything in intrepid proposed you can do selective intrepid-proposed, to do this create a new file under /etc/apt/ and call it preferences and add the following:
Package: *
Pin: release a=intrepid-updates
Pin-Priority: 900
Package: *
Pin: release a=intrepid-proposed
Pin-Priority: 400
From there, simply go into synaptic package manager, reload the packages, and do a search for ruby1.8, mark for upgrade, install, and metasploit should be working without the short-name constants. The name of the new package is ruby1.8_1.8.7.72-1ubuntu1 (or 0.1).
References:
https://bugs.launchpad.net/ubuntu/+source/ruby1.8/+bug/282302
Read more!
Subscribe to:
Posts (Atom)
Posts
