Social Engineering « The GANSEC Security Weblog

As a business,you may be responsible for fraudulent charges,not your bank

By Sven Olensky,on June 9th,2011%

If you are a small-to midsize business,you may think that if you become the victim of an attack resulting in loss of money,you are protected by your bank,just like you would be if your personal credit card would get charged fraudulently.

Well,you may be wrong. You may be on the hook for the entire amount yourself.

DarkReading reports,

A recent ruling by a U.S. District Court of Maine magistrate in favor of a bank being sued by a construction company that had money stolen from its account by hackers highlights how vulnerable small to midsize business owners are to online fraud.
Unlike consumer bank accounts that come with fraud-reversal protection,businesses are left on the hook for fraudulent transfers —a fact that many remain ignorant about,but of which hackers are well-aware,say security experts.
“They don’t get the same kind of protection that an individual consumer gets,but they don’t get much more attention than an individual consumer [from banks],so they are very vulnerable from that standpoint,”says Terry Austin,CEO of Guardian Analytics. “And the criminals figured this out. A lot of the action a couple years ago was in retail banking,and we still see fraud there,but the big,really significant fraud attacks have been against the small-business community. There are hundreds of thousands of dollars,sometimes up to million-dollar attacks on these small businesses.”

This is very disconcerting. So what can you do?

You need to make sure that you are as secure as you can be.

The article continues,

But SMBs must also do their part to secure their machines. Often small-business owners assume that if they’re ever hit by bank-stealing malware,the bank will reverse charges because this is what they are conditioned to believe due to their retail banking experiences. But banks rarely extend the same fraud reversal for business accounts as they do for consumer accounts. So SMBs at the very least need to start with the most basic principles of installing security software,establishing strong passwords,and limiting access to banking credentials across the organizations. Many experts also believe that small businesses should consider buying a dedicated machine solely for online banking.
“One thing I recommend to every small business is to not bank from a computer you use for anything else,period. Just don’t do it,”says Chet Wisiniewski,senior security adviser at Sophos. “Don’t ever search the Web,don’t go to Google,don’t go to Facebook. Because of the Web risk,simply visiting an infected site puts you at risk. Do you really want to take that chance if you can buy the perfect banking netbook for $200? An alternative to that,too,is to use a live CD Linux distribution that’s not writable.”
Additionally,SMBs need to know to ask the right questions when they’re looking for a bank,Austin says.
“These small businesses don’t know how to ask their banks the right questions about their fraud policies,”Austin says,explaining that companies need to ask about what their liability is in the event of an attack,what kind of authentication the bank uses,how the bank monitors activity to look for anomalous behavior,whether the bank utilizes risk-detection technology with behavioral analytics,and what the processes are when fraud is detected.

Good advice.

UPDATE –RSA hacked –SecurID internals stolen

By Sven Olensky,on March 17th,2011%

UPDATE:

Darkreading reports that the attack against RSA was done using social engineering,installing trojans and stealing credentials.

They report,

Turns out the targeted attack that breach that exposed RSA’s SecurID technology started with one of the oldest tricks in the book—a phishing email with an infected attachment,according to new details revealed today by RSA and security analysts.
[…]
The attack then installed a Poison Ivy variant for remotely controlling the infected machine[…]
[…]
The exploit,a Trojan,stole user credentials from RSA employees,including IT staff,and eventually gained privileged access to the targeted system,according to Avivah Litan,vice president and distinguished analyst with Gartner.

Nothing special here.

END UPDATE.

=====

Well,anyone can get hit,even the ones that you shouldn’t be able to hit. As an Executive Chairman of RSA announced in an open letter,

Our investigation has led us to believe that the attack is in the category of an Advanced Persistent Threat (APT). Our investigation also revealed that the attack resulted in certain information being extracted from RSA’s systems. Some of that information is specifically related to RSA’s SecurID two-factor authentication products. While at this time we are confident that the information extracted does not enable a successful direct attack on any of our RSA SecurID customers,this information could potentially be used to reduce the effectiveness of a current two-factor authentication implementation as part of a broader attack.

Translation:“we got hacked and sensitive information regarding the functionality of our SecurID-token functionality was extracted. Apparently they gained enough information to use this against systems that employ RSA SecurID authentication,and they may be successful.”

This is pretty big. To put it into scale:this may as big as if Pepsi would gain access to the Coca Cola formula.

What can customers do who use RSA SecurID?

Well,RSA recommended this,in their SEC filing (Thanks Sophos,for digging through it),ironically:

* We recommend customers increase their focus on security for social media applications and the use of those applications and websites by anyone with access to their critical networks.
* We recommend customers enforce strong password and pin policies. We recommend customers follow the rule of least privilege when assigning roles and responsibilities to security administrators.
* We recommend customers re-educate employees on the importance of avoiding suspicious emails,and remind them not to provide user names or other credentials to anyone without verifying that person’s identity and authority. Employees should not comply with email or phone-based requests for credentials and should report any such attempts.
* We recommend customers pay special attention to security around their active directories,making full use of their SIEM products and also implementing two-factor authentication to control access to active directories.
* We recommend customers watch closely for changes in user privilege levels and access rights using security monitoring technologies such as SIEM,and consider adding more levels of manual approval for those changes.
* We recommend customers harden,closely monitor,and limit remote and physical access to infrastructure that is hosting critical security software.
* We recommend customers examine their help desk practices for information leakage that could help an attacker perform a social engineering attack.
* We recommend customers update their security products and the operating systems hosting them with the latest patches.

This can be read in a way that would make one think that RSA might have been having the same issues a lot of ‘normal’companies have:

lack of security awareness training
lack of protection of critical systems
weak password enforcement policies
use of social networking sites,being exposed to risks resulting from using those (“install this app,let me steal your information,and hey,you are using the same password for your Facebook account as you do for your email and your access to your file servers!”)

This is a fairly common combination of issues. Something similar happened to HBGary not too long ago.

Google collecting children’s social security numbers under the guise of an art contest

By Sven Olensky,on February 23rd,2011%

The Huffington Post has an interesting article about Google collecting personally identifiable information about children under the guise of an art contest.

They write,

[...] has been asking parents nationwide to disclose their children’s personal information,including Social Security Numbers,and recruiting schools to help them do it —all under the guise of an art contest. It’s called,“Doodle-4-Google,”a rather catchy,kid-friendly name if I do say so myself. The company is even offering prize money to schools to enlist their help with the promotion. Doesn’t it sound like fun? Don’t you want your kid to enter too?
What could be wrong with filling out a few entry forms?
A national,commercial database of names and addresses of American children,especially one that includes their dates of birth and SSNs,would be worth many millions to marketing firms and retailers.
Of course,data collection is not the reason Google gives for doing this competition. Their FAQ says it’s because “We love to encourage and celebrate the creativity of young people…”etc. If that’s so,then why on earth would the contest’s original Parent Consent Form ask for the child’s city of birth,date of birth and last four digits of the child’s SSN? Along with complete contact info of the parents.
You see what Google knows and many parents don’t know is that a person’s city of birth and year of birth can be used to make a statistical guess about the first five digits of his/her social security number. Then,if you can somehow obtain those last four SSN digits explicitly —voila,you’ve unlocked countless troves of personal information from someone who didn’t even understand that such a disclosure was happening.
This kind of data can be linked with other databases to target advertising. It’s worth many times more than what Google will spend on prizes (each State Finalist gets a T-shirt!).
[...]
So in closing,three simple ideas for you,gentle reader,to take away. (1) City of birth,when coupled with year of birth,can be correlated to social security numbers,so don’t give it out just because a box appears on a form. (2) No public contest should ask for any part of a social security number,especially involving kids. (3) For internet searches,have you tried Yahoo! or Bing lately? You just might find what you’re looking for.

Scary. And yes,what would hold Google back from making this information available to marketers?

How HBGary Federal was compromised –lessons to be learned for everyone

By Sven Olensky,on February 16th,2011%

ARSTechnica has an excellent writeup on what happened to HBGary Federal,the company whose CEO claimed he infiltrated Anonymous,the well-known group that was responsible for the attacks on MasterCard,PayPal and others back in December. Once his claim spread on the Internet,Anonymous broke into his company’s infrastructure,retrieved over 60,000 emails,hacked his web site,his Twitter account and pretty much made an embarrassment out of him on the Internet. Well,out of him,his boss and his company. Furthermore,they were in talks of getting bought for up to $2 million,all of which fell through because he leaned out of the window too far.

ARSTechnica illustrates how HBGary Federal’s infrastructure was compromised by using the most basic methods of intrusion,a combination of exploitation of common vulnerabilities and the realization that the CEO/COO used simple passwords.

Lessons for others:

make sure that your public facing services are not vulnerable. (Shameless self-promotion:we at GANSEC can help you figure out if they are)
do not use simple passwords –I had an article about this last year –please read it here if you need information on this
do not use passwords in more than place –see more information in that same article that I wrote last year
don’t fall for social engineering. Do not send out passwords or any other sensitive information to people without verifying their identity. Call them back on a known number,don’t send passwords in email.
don’t claim you infiltrated one of the most notorious hacker groups out there without having properly secured your stuff. You will regret it.

UPDATE:How to enable encryption for your Facebook account –IMPORTANT!

By Sven Olensky,on January 28th,2011%

UPDATE:

Facebook is slowly rolling this out to the user base. If you haven’t been able to set this yet,try again and keep checking back on it in 24 hour intervals.

The good folks at Sophos created a video that shows you how you can enable SSL encryption for your Facebook sessions. That way your sessions cannot be monitored anymore,and your account information cannot be stolen via tools like Firesheep.

The video is here.

Basically,in your Facebook browser window,execute the following steps:

1. Navigate to Account (top right) –Account Settings –Account Security

This is in the process of being rolled out,so you may not see the next option just yet,if you do not,check back in half a day or so:

2. Under ‘Secure Browsing (https)’,check ‘Browse Facebook on a secure connection (https) whenever possible’.

3. Hit ‘Save’.

4. Log out of your Facebook session via ‘Account’–‘Logout’or close your browser (via ‘Quit’).

5. From now on,navigate to https://www.facebook.com to log in,not ‘http://www.facebook.com’.

That’s it!

NOTE:THIS DOES NOT PROTECT YOU FROM KEYLOGGERS AND VIRUSES THAT ARE INSTALLED ON YOUR MACHINE. It is NOT RECOMMENDED to hit up the Internet from public terminals that you do not control yourself. Attackers can still infect those machines and steal your information! Always use your own laptop/device to connect to public sites,especially if you have to submit log-in information at any point.

Are you affected by the Gawker account hack?

By Sven Olensky,on December 16th,2010%

This site enables you to enter your email address to see if your account was part of the database theft that occurred last week.

As you may know,hackers stole over 1.3 million accounts after breaking into the user database that hosts accounts for the Gizmodo,Gawker,Deadspin,Kotaku,Jezebel,IO9,Jalopnik and Lifehacker blogs.

Facebook crawler collects more than 170 million data sets

By Sven Olensky,on July 28th,2010%

Heise reports:

Hacker Ron Bowes has written a web crawler which he used to systematically graze through [public Facebook profiles]. Bowes claims to have collected more than 170 million sets of data containing the names and URLs of public profiles. The files do not contain any further personal data such as friend lists,but the links in the profiles can easily be used to send out another crawler to collect this information. Bowes has formatted the list and,together with the crawler itself,made it available as a 2.8 GB torrent.

You may want to double check what you choose to have public.

The GANSEC Security Weblog

DarkReading

Blog Archive

SANS News

Recent Posts

Post Overview