FFT news digest — 24 December 2020
FFT news digest — 24 December 2020
Catastrophe
There are incidents and there are catastrophes. This week’s revelations about the compromise of SolarWinds’ network management solution sits firmly in the latter category. Or, as described in one tweet, it’s the “Pearl Harbor” of cyber espionage. What: SolarWinds’ Orion platform is designed to allow administrators to manage and monitor complex IT networks. To do that, it obviously requires pretty much unfettered access to the network, making it an ideal candidate for a “supply chain” attack. This means it’s absolutely critical to stop anyone tampering with its code and using it as a mechanism to gain entry to target organisations…and yet that is exactly what happened, giving attackers a potential opportunity to roam around the networks of thousands of companies, universities and government agencies. How: As is so often the case, a (very) basic security failure may have contributed to this attack. A researcher told The Register that SolarWinds’ update server was accessible with the password ‘solarwinds123’. Reuters reports that as far back as 2017 criminals in underground forums were offering to sell access to SolarWinds’ computers. Compromising the update process meant that when a new version of Orion was installed, so was malicious software enabling attackers to access their target. Latest reports suggest SolarWinds may have been only one part of a highly sophisticated offensive. Who: Attributing attacks is problematic, but fingers are pointing firmly towards Moscow. Democrat Senator, Richard Blumenthal, tweeted , “Stunning. Today’s classified briefing on Russia’s cyberattack left me deeply alarmed, in fact downright scared”. Governments around the world are potentially affected, although Microsoft says only a small number of victims were selected for ongoing attack and it’s believed classified networks may not have been breached. In the US, SolarWinds customers include all branches of the US military, as well as the Treasury, Homeland Security, the FBI and the National Security Agency. It’s also worth pointing out that the issue probably wouldn’t have been discovered if a leading cybersecurity firm, FireEye , hadn’t been among those affected. Sell-off: SolarWinds’ share price lost a fifth of its value after the breach was disclosed. The Washington Post reports that, just days earlier, two venture capital firms which owned 70% of the company sold nearly $300 million of their holdings. And so what?: It will take time for the impact of this affair to emerge, and its true extent may never be known. The obvious lesson is that basic security measures are fundamental, particularly when it comes to a software solution as powerful as Orion. That means more effective vendor security checks including comprehensive monitoring of information sources (such as underground forums). Once installed, it’s essential to check solutions like Orion to ensure they’re doing what they’re supposed to and nothing more. In the case of Orion, SolarWinds advised customers that, “to run more efficiently”, they should exclude some files, directories and ports from anti-virus protection. TrustSec has a comprehensive set of recommendations . As this week illustrates, cyber espionage is rampant. In another example, Reuters reported on a breach affecting the African Union’s HQ in Addis Ababa. Acting on a tip-off from Japanese researchers, a cluster of servers were found in a basement. A Chinese hacking group is blamed. The aim was to steal footage from surveillance cameras. “The time of innocence is over. We know that we are a target. We need to modernize, reinforce, and adapt,” the European Commission’s Vice-President said this week. The EU has kicked off a consultation aimed at revamping supra-national cybersecurity rules that date from 2008.
Threats
Outlook migration : Attackers impersonate an IT team message about migration to a new version of Microsoft Outlook in order to steal credentials. Abnormal Security Spear-Phishing : A widespread, coordinated campaign has been targeting targeting enterprises with a torrent of personalised emails sent from compromised legitimate accounts (including eFax). Abnormal Security Harass : The FBI says the DoppelPaymer ransomware group is harassing victims by threatening to send individuals to their homes if they don’t pay the ransom. ZDNet Broadband : Criminals are impersonating well-known broadband providers, promising compensation because of IT issues. The aim is to persuade the target to download a troubleshooting tool which actually gives the attackers access to their computer or phone. Action Fraud Doxxing : Ugly word for an ugly business. The Electronic Frontier Foundation has advice on how to protect yourself from having personal information released online. The key points; research yourself, make sure you do the basics like avoiding passwords reuse and adopting multi-factor authentication. Bitdefender research illustrates the scale of the problem. EFF DPD : Bogus delivery emails are particularly popular at this time of the year. If you’re concerned about a package, don’t click on a link - just go direct to the retailer’s or courier’s website. Action Fraud Subway : Members of Subway’s loyalty scheme are being targeted with emails designed to trick them into downloading malicious software. The messages aren’t very credible, but the campaign is widespread. Sophos Air-gapped : File under extraordinary, but not an immediate threat to most people. An Israeli researcher has shown how to enable WiFi connectivity in a computer that doesn’t have any WiFi hardware in it. The aim would be to use the capability to steal data from a device that had been deliberately separated (or air-gapped) from the outside world. AIR-FI
Privacy wars
Facebook is engaged in a very public war of words with Apple, which it has accused of introducing privacy permissions that will “devastate” small businesses. In two days of full-page advertisements in leading US papers, Facebook said the changes would limit the ability of small businesses to run personalised ads and reach customers effectively. Of course, Facebook’s concern may not be entirely altruistic since personalised, targeted adverts are the bedrock of its business. And, in any case, Apple isn’t blocking targeted adverts; it’s simply requiring users’ permission for it.
Twitter fined
The Irish data protection regulator, the DPC, has fined Twitter €450,000 for a software failure that made private tweets public. The DPC’s decision runs to 188 pages and make clear it’s penalising Twitter for failing to meet the 72-hour deadline to disclose breaches of personal data to the regulator, and for not documenting what data was involved and how it responded to the incident. Twitter told The Register that the delay in notifying the regulator was due to ‘an unanticipated consequence of staffing between Christmas Day 2018 and New Years’ Day”. A clear lesson from the Irish regulator’s decision is that 72 hours means 72 hours, even if it is during a holiday period. And keeping accurate records is not optional.
Regulating big tech
A groundswell of regulatory activity is lapping at the shores of big tech. This week, Texas announced it is suing Google for anti-competitive conduct, a decision that follows earlier antitrust lawsuits filed against Google and Facebook in October. Meanwhile, the EU unveiled draft legislation that would limit the powers of global internet businesses in Europe and would break them up if they repeatedly engage in anti-competitive behaviour. It is proposing to hold companies with over 45 million EU users to stricter standards by designating them as “digital gatekeepers”. The EU’s competition chief said the rules seek to bring “order to chaos”
Passwords
Extraordinarily, it turns out Donald Trump’s Twitter password really was MAGA2020! and the account really didn’t have any additional protection. This emerged in October when a Dutch researcher revealed he had broken into the account after just five attempts to guess the password. Despite tweeting a satirical link, there was some scepticism about his claims because no-one could believe (a) Trump was stupid enough to use such a weak password and (b) his account required no authentication beyond a password. But it turns out to be true, at least according to Dutch public prosecutors. They investigated, “tested” the researcher’s intentions and behaviours, and decided he had no case to answer because he had acted responsibly by disclosing the issue. Trump emerges from the incident less favourably. The same researcher had accessed his Twitter account 4 years earlier by guessing his password. Which was yourefired.
In brief
Signal : Some breathless reporting suggested an Israeli company had developed a way to break into Signal’s encrypted messages. Not so . What it can do is extract data from an unlocked phone (which does serve as a good reminder to use a complex pin/passphrase for your device). Google outage(s) : A bad week for Google, with two outages affecting millions of users. The first (and wider-reaching) problem was ascribed to “an internal storage quota issue” which took down its authentication system. Google hasn’t confirmed that it ran out of memory, but it sure sounds like it. Remote : If you’re wondering what the new normal might look like, here’s Google’s version. Employees will be able to work from home until next September. After that, it is examining a “flexible workweek” with at least three days at home and the rest in the office. NYT ($) Senior managers : As many readers will be well aware, senior managers are often the worst offenders when it comes to lax information security. OneLogin has the research to back this up. It found that, compared to their juniors, senior managers were twice as likely to share a work device with someone outside their organisation. EU domains : Just a reminder that from January 1,UK organisations and individuals lose the right to use .eu domain names. EURid Secret filming : The Austrian data protection regulator fined a man €150 for secretly filming a woman with his smartphone while she was using a public toilet. GDPRHub Zoom free : The 40-minute meeting limit for free accounts is being lifted over the holiday period; until 0100GMT tomorrow for the end of Hanukkah, from Dec 23-26 for Christmas and from Dec 30-Jan 2 for New Year/Kwanzaa. The Verge
Updates
iOS : Version 14.3 for iPhones and iPads addresses a number of security issues, but some users have reported problems. On balance, these don’t appear to be show stoppers at the moment. It’s worth noting that the new version does bring a lot of new functionality, notably in fitness monitoring. macOS : Big Sur 11.1 fixes 59 vulnerabilities, half of them serious. There are also security updates for Catalina and Mojave. FCP : Update to Final Cut Pro for Mac brings new options for sharing to YouTube and Facebook. Also updates for iMovie and Clips on iOS, as well as Motion and Compressor on Mac. Jabber : Another set of patches for Cisco’s messaging platform to address issues that earlier updates didn’t fix. Signal : New feature supports group video calls for up to 5 participants. Tails : Version 4.14 addresses “many” security vulnerabilities and should be installed as soon as possible. Thunderbird : Version 78.6.0 for all supported operating systems is a security update that includes new features, changes, and many fixes. Microsoft passwords : Microsoft is getting into the password manager game. A preview is built into its Authenticator app. We support anything that helps avoid password re-use, but we still prefer solutions like LastPass and 1Password for whom security is existential. Trend Micro : Update for InterScan Web Security Virtual Appliance (IWSVA) addresses several potentially serious vulnerabilities, including ones that can be exploited to remotely control the appliance. HP : A serious vulnerability affects HPE Systems Insight Manager (SIM) software for Windows and Linux. There are mitigations but no fix yet. Zimbra : Zimbra 9.0.0 “Kepler” Patch 10 and 8.8.15 “James Prescott Joule” Patch 17.