Category Archives: HOW TO

Famed Hacker Kevin Mitnick Shows You How to become Invisible Online

If you’re like me, one of the first things you do in the morning is check your email. And, if you’re like me, you also wonder who else has read your email. That’s not a paranoid concern. If you use a web-based email service such as Gmail or Outlook 365, the answer is kind of obvious and frightening.

About the author

Kevin Mitnick (@kevinmitnick) is a security consultant, public speaker, and former hacker. The company he founded, Mitnick Security Consulting LLC, has clients that include dozens of the Fortune 500 and world governments. He is the author of Ghost in the Wires, The Art of Intrusion, and The Art of Deception.

Even if you delete an email the moment you read it on your computer or mobile phone, that doesn’t necessarily erase the content. There’s still a copy of it somewhere. Web mail is cloud-based, so in order to be able to access it from any device anywhere, at any time, there have to be redundant copies. If you use Gmail, for example, a copy of every email sent and received through your Gmail account is retained on various servers worldwide at Google. This is also true if you use email systems provided by Yahoo, Apple, AT&T, Comcast, Microsoft, or even your workplace. Any emails you send can also be inspected, at any time, by the hosting company. Allegedly this is to filter out malware, but the reality is that third parties can and do access our emails for other, more sinister and self-serving, reasons.

While most of us may tolerate having our emails scanned for malware, and perhaps some of us tolerate scanning for advertising purposes, the idea of third parties reading our correspondence and acting on specific contents found within specific emails is downright disturbing.

The least you can do is make it much harder for them to do so.

Start With Encryption

Most web-based email services use encryption when the email is in transit. However, when some services transmit mail between Mail Transfer Agents (MTAs), they may not be using encryption, thus your message is in the open. To become invisible you will need to encrypt your messages.

Most email encryption uses what’s called asymmetrical encryption. That means I generate two keys: a private key that stays on my device, which I never share, and a public key that I post freely on the internet. The two keys are different yet mathematically related.

For example: Bob wants to send Alice a secure email. He finds Alice’s public key on the internet or obtains it directly from Alice, and when sending a message to her encrypts the message with her key. This message will stay encrypted until Alice—and only Alice—uses a passphrase to unlock her private key and unlock the encrypted message.

So how would encrypting the contents of your email work?

The most popular method of email encryption is PGP, which stands for “Pretty Good Privacy.” It is not free. It is a product of the Symantec Corporation. But its creator, Phil Zimmermann, also authored an open-source version, OpenPGP, which is free. And a third option, GPG (GNU Privacy Guard), created by Werner Koch, is also free. The good news is that all three are interoperational. That means that no matter which version of PGP you use, the basic functions are the same.

When Edward Snowden first decided to disclose the sensitive data he’d copied from the NSA, he needed the assistance of like-minded people scattered around the world. Privacy advocate and filmmaker Laura Poitras had recently finished a documentary about the lives of whistle-blowers. Snowden wanted to establish an encrypted exchange with Poitras, except only a few people knew her public key.

Snowden reached out to Micah Lee of the Electronic Frontier Foundation. Lee’s public key was available online and, according to the account published on the Intercept, he had Poitras’s public key. Lee checked to see if Poitras would permit him to share it. She would.

Given the importance of the secrets they were about to share, Snowden and Poitras could not use their regular e‑mail addresses. Why not? Their personal email accounts contained unique associations—such as specific interests, lists of contacts—that could identify each of them. Instead Snowden and Poitras decided to create new email addresses.

How would they know each other’s new email addresses? In other words, if both parties were totally anonymous, how would they know who was who and whom they could trust? How could Snowden, for example, rule out the possibility that the NSA or someone else wasn’t posing as Poitras’s new email account? Public keys are long, so you can’t just pick up a secure phone and read out the characters to the other person. You need a secure email exchange.

By enlisting Lee once again, both Snowden and Poitras could anchor their trust in someone when setting up their new and anonymous email accounts. Poitras first shared her new public key with Lee. Lee did not use the actual key but instead a 40-character abbreviation (or a fingerprint) of Poitras’s public key. This he posted to a public site—Twitter.

Sometimes in order to become invisible you have to use the visible.

Now Snowden could anonymously view Lee’s tweet and compare the shortened key to the message he received. If the two didn’t match, Snowden would know not to trust the email. The message might have been compromised. Or he might be talking instead to the NSA. In this case, the two matched.

Snowden finally sent Poitras an encrypted e‑mail identifying himself only as “Citizenfour.” This signature became the title of her Academy Award–winning documentary about his privacy rights campaign.

That might seem like the end—now they could communicate securely via encrypted e‑mail—but it wasn’t. It was just the beginning.

Picking an Encryption Service

Both the strength of the mathematical operation and the length of the encryption key determine how easy it is for someone without a key to crack your code.

Encryption algorithms in use today are public. You want that. Public algorithms have been vetted for weakness—meaning people have been purposely trying to break them. Whenever one of the public algorithms becomes weak or is cracked, it is retired, and newer, stronger algorithms are used instead.

The keys are (more or less) under your control, and so, as you might guess, their management is very important. If you generate an encryption key, you—and no one else—will have the key stored on your device. If you let a company perform the encryption, say, in the cloud, then that company might also keep the key after he or she shares it with you and may also be compelled by court order to share the key with law enforcement or a government agency, with or without a warrant.

When you encrypt a message—an e‑mail, text, or phone call—use end‑to‑end encryption. That means your message stays unreadable until it reaches its intended recipient. With end‑to‑end encryption, only you and your recipient have the keys to decode the message. Not the telecommunications carrier, website owner, or app developer—the parties that law enforcement or government will ask to turn over information about you. Do a Google search for “end‑to‑end encryption voice call.” If the app or service doesn’t use end-to-end encryption, then choose another.

If all this sounds complicated, that’s because it is. But there are PGP plug-ins for the Chrome and Firefox Internet browsers that make encryption easier. One is Mailvelope, which neatly handles the public and private encryption keys of PGP. Simply type in a passphrase, which will be used to generate the public and private keys. Then whenever you write a web-based email, select a recipient, and if the recipient has a public key available, you will then have the option to send that person an encrypted message.

Beyond Encryption: Metadata

Even if you encrypt your e‑mail messages with PGP, a small but information-rich part of your message is still readable by just about anyone. In defending itself from the Snowden revelations, the US government stated repeatedly that it doesn’t capture the actual contents of our emails, which in this case would be unreadable with PGP encryption. Instead, the government said it collects only the email’s metadata.

What is email metadata? It is the information in the To and From fields as well as the IP addresses of the various servers that handle the email from origin to recipient. It also includes the subject line, which can sometimes be very revealing as to the encrypted contents of the message. Metadata, a legacy from the early days of the internet, is still included on every email sent and received, but modern email readers hide this information from display.

That might sound okay, since the third parties are not actually reading the content, and you probably don’t care about the mechanics of how those emails traveled—the various server addresses and the time stamps—but you’d be surprised by how much can be learned from the email path and the frequency of emails alone.

According to Snowden, our email, text, and phone metadata is being collected by the NSA and other agencies. But the government can’t collect metadata from everyone—or can it? Technically, no. However, there’s been a sharp rise in “legal” collection since 2001.

You’d be surprised by how much can be learned from the email path and the frequency of emails alone.

To become truly invisible in the digital world you will need to do more than encrypt your messages. You will need to:

Remove your true IP address: This is your point of connection to the Internet, your fingerprint. It can show where you are (down to your physical address) and what provider you use.
Obscure your hardware and software: When you connect to a website online, a snapshot of the hardware and software you’re using may be collected by the site.
Defend your anonymity: Attribution online is hard. Proving that you were at the keyboard when an event occurred is difficult. However, if you walk in front of a camera before going online at Starbucks, or if you just bought a latte at Starbucks with your credit card, these actions can be linked to your online presence a few moments later.

To start, your IP address reveals where you are in the world, what provider you use, and the identity of the person paying for the internet service (which may or may not be you). All these pieces of information are included within the email metadata and can later be used to identify you uniquely. Any communication, whether it’s email or not, can be used to identify you based on the Internal Protocol (IP) address that’s assigned to the router you are using while you are at home, work, or a friend’s place.

IP addresses in emails can of course be forged. Someone might use a proxy address—not his or her real IP address but someone else’s—that an email appears to originate from another location. A proxy is like a foreign-language translator—you speak to the translator, and the translator speaks to the foreign-language speaker—only the message remains exactly the same. The point here is that someone might use a proxy from China or even Germany to evade detection on an email that really comes from North Korea.

Instead of hosting your own proxy, you can use a service known as an anonymous remailer, which will mask your email’s IP address for you. An anonymous remailer simply changes the email address of the sender before sending the message to its intended recipient. The recipient can respond via the remailer. That’s the simplest version.

One way to mask your IP address is to use the onion router (Tor), which is what Snowden and Poitras did. Tor is designed to be used by people living in harsh regimes as a way to avoid censorship of popular media and services and to prevent anyone from tracking what search terms they use. Tor remains free and can be used by anyone, anywhere—even you.

How does Tor work? It upends the usual model for accessing a website. When you use Tor, the direct line between you and your target website is obscured by additional nodes, and every ten seconds the chain of nodes connecting you to whatever site you are looking at changes without disruption to you. The various nodes that connect you to a site are like layers within an onion. In other words, if someone were to backtrack from the destination website and try to find you, they’d be unable to because the path would be constantly changing. Unless your entry point and your exit point become associated somehow, your connection is considered anonymous.

To use Tor you will need the modified Firefox browser from the Tor site (torproject.org). Always look for legitimate Tor browsers for your operating system from the Tor project website. Do not use a third-party site. For Android operating systems, Orbot is a legitimate free Tor app from Google Play that both encrypts your traffic and obscures your IP address. On iOS devices (iPad, iPhone), install the Onion Browser, a legitimate app from the iTunes app store.

In addition to allowing you to surf the searchable Internet, Tor gives you access to a world of sites that are not ordinarily searchable—what’s called the Dark Web. These are sites that don’t resolve to common names such as Google.com and instead end with the .onion extension. Some of these hidden sites offer, sell, or provide items and services that may be illegal. Some of them are legitimate sites maintained by people in oppressed parts of the world.

It should be noted, however, that there are several weaknesses with Tor: You have no control over the exit nodes, which may be under the control of government or law enforcement; you can still be profiled and possibly identified; and Tor is very slow.

That being said, if you still decide to use Tor you should not run it in the same physical device that you use for browsing. In other words, have a laptop for browsing the web and a separate device for Tor (for instance, a Raspberry Pi minicomputer running Tor software). The idea here is that if somebody is able to compromise your laptop they still won’t be able to peel off your Tor transport layer as it is running on a separate physical box.

Create a new (invisible) account

Legacy email accounts might be connected in various ways to other parts of your life—friends, hobbies, work. To communicate in secrecy, you will need to create new email accounts using Tor so that the IP address setting up the account is not associated with your real identity in any way.

Creating anonymous email addresses is challenging but possible.

Since you will leave a trail if you pay for private email services, you’re actually better off using a free web service. A minor hassle: Gmail, Microsoft, Yahoo, and others require you to supply a phone number to verify your identify. Obviously you can’t use your real cellphone number, since it may be connected to your real name and real address. You might be able to set up a Skype phone number if it supports voice authentication instead of SMS authentication; however, you will still need an existing email account and a prepaid gift card to set it up.

Some people think of burner phones as devices used only by terrorists, pimps, and drug dealers, but there are plenty of perfectly legitimate uses for them. Burner phones mostly provide voice, text, and e‑mail service, and that’s about all some people need.

However, purchasing a burner phone anonymously will be tricky. Sure, I could walk into Walmart and pay cash for a burner phone and one hundred minutes of airtime. Who would know? Well, lots of people would.

First, how did I get to Walmart? Did I take an Uber car? Did I take a taxi? These records can all be subpoenaed. I could drive my own car, but law enforcement uses automatic license plate recognition technology (ALPR) in large public parking lots to look for missing and stolen vehicles as well as people on whom there are outstanding warrants. The ALPR records can be subpoenaed.

Even if I walked to Walmart, once I entered the store my face would be visible on several security cameras within the store itself, and that video can be subpoenaed.

Creating anonymous email addresses is challenging but possible.

Okay, so let’s say I send a stranger to the store—maybe a homeless person I hired on the spot. That person walks in and buys the phone and several data refill cards with cash. Maybe you arrange to meet this person later away from the store. This would help physically distance yourself from the actual transaction.

Activation of the prepaid phone requires either calling the mobile operator’s customer service department or activating it on the provider’s website. To avoid being recorded for “quality assurance,” it’s safer to activate over the web. Using Tor over an open wireless network after you’ve changed your MAC address should be the minimum safeguards. You should make up all the subscriber information you enter on the website. For your address, just Google the address of a major hotel and use that. Make up a birth date and PIN that you’ll remember in case you need to contact customer service in the future.

After using Tor to randomize your IP address, and after creating a Gmail account that has nothing to do with your real phone number, Google sends your phone a verification code or a voice call. Now you have a Gmail account that is virtually untraceable. We can produce reasonably secure emails whose IP address—thanks to Tor—is anonymous (although you don’t have control over the exit nodes) and whose contents, thanks to PGP, can’t be read except by the intended recipient.

To keep this account anonymous you can only access the account from within Tor so that your IP address will never be associated with it. Further, you should never perform any internet searches while logged into that anonymous Gmail account; you might inadvertently search for something that is related to your true identity. Even searching for weather information could reveal your location.

As you can see, becoming invisible and keeping yourself invisible require tremendous discipline and perpetual diligence. But it is worth it. The most important takeaways are: First, be aware of all the ways that someone can identify you even if you undertake some but not all of the precautions I’ve described. And if you do undertake all these precautions, know that you need to perform due diligence every time you use your anonymous accounts. No exceptions.

Excerpted from The Art of Invisibility: The World’s Most Famous Hacker Teaches You How to Be Safe in the Age of Big Brother and Big Data, Copyright © 2017 by Kevin D. Mitnick with Robert Vamosi. Used with permission of Little, Brown and Company, New York. All rights reserved.

 www.scamsfakes.com

www.crimefiles.net

www.freephonelink.net

www.policesearch.net

www.ispysite.com

Henry Sapiecha

Protect your emails from being spied on by doing this

We live in a post-Edward Snowden world, in which US tech companies have been accused of complicity in mass surveillance by the US National Security Agency. One recent allegation is the claim that Yahoo scanned hundreds of millions of emails at the NSA’s request.

We don’t truly know how much or how often this is happening within the companies that host millions of people’s email accounts.

Yahoo secretly scans emails for US

Yahoo said to have secretly scanned all of its customer emails for US intelligence officials.

According to Reuters, Yahoo was ordered by the secret US Foreign Intelligence Surveillance Court (FISC) to scour emails for a specific string of characters. This is significant, as it required Yahoo to create a custom-built program for real-time surveillance of email traffic.

The power for this type of surveillance was expanded by the US Patriot Act, which allows for the use of secret National Security Letters to compel service providers to hand over customer data. The letters come with gag orders, prohibiting companies like Yahoo from even admitting that they have been ordered to monitor customers.

oooYAHOO SIGN OFFICE image www.intelagencies.com

Email scanning does not only occur at the behest of national security agencies. 

But email scanning does not only occur at the behest of national security agencies. The past decade has seen the rise of “surveillance capitalism” and “data brokers”, who collect your information for behavioural profiling and targeted advertising.

Google has admitted to scanning emails to deliver targeted advertising and customised search results. Facebook is currently facing legal action for scanning private messages to do the same. And earlier this year Yahoo itself settled a class action lawsuit for scanning non-Yahoo customer emails without consent.

Protecting your privacy

So with all this going on, is it possible protect your privacy? And if so, how?

One way is through encryption, which allows only the sender and the receiver to read the content of messages, as it converts information into a secret code that requires a key to decode it.

Public-key cryptography is one type of encryption, involving two paired keys – one public and one private. When an encrypted email is sent it is encoded or “locked” with the receiver’s public key. Only the receiver can “unlock” it with their private key.

End-to-end encryption involves encrypting information before it leaves your device, with it only being decrypted once it reaches the receiver’s device. In other words, it is encrypted “at the ends” where the keys are held. This means that security and privacy are not dependent on the channel of communication – in this case the email provider – because if the message is intercepted it cannot be deciphered. This prevents eavesdropping in transit.

There are now numerous services that promise free end-to-end encrypted communication, including ProtonMail, Tutanota, and the messaging app Signal. Look for those with open source code because it enables peer-review, guaranteeing there are no backdoors.

The push-back against encryption

With increased encryption comes more demands from authorities for companies to “unlock” information. The best example may be the Apple-FBI case, which saw the FBI attempt to compel Apple to unlock a suspect’s iPhone. In the end this wasn’t necessary. There has also been a simultaneous rise in companies like Cellebrite who offer digital forensic services to decrypt and extract data.

Therefore, the best services use principles of privacy by design, that limit how much information the service provider themselves can collect or access. ProtonMail and Signal, for example, cannot access their users’ information, no matter how hard they try. If issued with a subpoena all they could provide is the date and time a user registered and the last date of connection.

Partly as a result of this encryption war, some states are considering outlawing encryption entirely. Criminalising encryption has been discussed in the United States, Britain, Australia, and elsewhere.

Tech companies safeguarding secrecy

But not all hope is lost. There is a growing trend of tech companies fighting back and refusing to comply with surveillance orders.

In 2014 Lavabit chose to shut down rather than turn over the private encryption key to a customer’s account. This customer was later revealed to be Edward Snowden. Microsoft has refused to hand over emails stored on its servers in Ireland, arguing that this would constitute an impermissible extraterritorial search by the FBI. And of course, Apple refused to disable inbuilt security features to crack an encrypted iPhone.

This shows that service providers are aware of the importance of developing and maintaining consumer trust in matters of privacy. They are intimately, and commercially, invested in protecting it.

Transparency reports and warrant canaries

Another way companies have attempted to gain trust is through transparency reports that detail the orders they have received from authorities. These can be found on company websites and are often reported in the media. Many of these reports feature a workaround to the restrictions on letting customers know if surveillance has been ordered. Companies simply include a statement that they have not been subject to a secret order. If this statement ever goes missing, customers know an order has been issued. This is known as a “warrant canary”.

Several companies routinely issue transparency reports with warrant canaries. Apple and Reddit have set them off, implying that they have received secret orders to provide data.

The same workaround may not be available in Australia however. Recent data-retention laws introduced journalist information warrants that made it an offence to disclose information about the existence (or non-existence) of the warrant, effectively outlawing warrant canaries for journalists in Australia.

The future

Encryption and transparency reports are some of the last protections that consumers have against both governments and the big tech companies we rely on. As more of our lives transition online, we will need them to protect civil rights and individual privacy. We can’t afford for either to be weakened or outlawed.

There are a couple of challenges under way. NSL statutes and gag orders are currently being challenged by the Electronic Frontier Foundation and members of the US Congress as unconstitutional. Watch this space. The Conversation

Monique Mann is a lecturer at the Crime and Justice Research Centre at  Queensland University of Technology in Australia.

Meet_Russian_728_90

Henry Sapiecha

www.scamsfakes.com

 

How to build defenses against the internet’s doomsday of DDoS attacks

Last week assault on Dyn’s global managed DNS services was only the start. Here’s how to fend off hackers’ attacks both on your servers and the internet.

internet-of-things-symbol image www.intelagencies.com

We knew major destructive attacks on the internet were coming. Last week the first of them hit Dyn, a top-tier a major Domain Name System (DNS) service provider, with a global Distributed Denial of Service (DDoS) attack.

As Dyn went down, popular websites such as AirBnB, GitHub, Reddit, Spotify, and Twitter followed it down. Welcome to the end of the internet as we’ve known it.

Up until now we’ve assumed that the internet was as reliable as our electrical power. Those days are done. Today, we can expect massive swaths of the internet to be brought down by new DDoS attacks at any time.

We still don’t know who was behind these attacks. Some have suggested, since Dyn is an American company and most of the mauled sites were based in the US, that Russia or Iran was behind the attack.

It doesn’t take a nation, though, to wreck the internet. All it takes is the hundreds of millions of unsecured shoddy devices of the Internet of Things (IoT).

In the Dyn onslaught , Kyle York, Dyn’s chief strategy officer said the DDoS attack used “tens of millions” devices. Hangzhou Xiongmai Technology, a Chinese technology company, has admitted that its webcam and digital video recorder (DVR) products were used in the assault. Xiongmai is telling its customers to update their device firmware and change usernames and passwords.

Good luck with that. Quick: Do you know how to update your DVR’s firmware?

The attack itself appears to have been made with the Mirai botnet. This open-source botnet scans for devices using their default username and password credentials. Anyone can use it — China, you, the kid next door — to generate DDoS attacks. For truly damaging DDoS barrages, you need to know something about the internet’s architecture, but that’s not difficult.

Or, as Jeff Jarmoc, a Salesforce security engineer, tweeted, “In a relatively short time we’ve taken a system built to resist destruction by nuclear weapons and made it vulnerable to toasters.” That’s funny, but it’s no joke.

Fortunately, you can do something about it.

Russian_Girl_1_728_90

Securing the Internet of Things

First, and this unfortunately is a long-term solution, IoT vendors must make it easy to update and secure their devices. Since you can’t expect users to patch their systems — look at how well they do with Windows — patching must be made mandatory and done automatically.

One easy way to do this is to use an operating system, such as Ubuntu with Snap, to update devices quickly and cleanly. These “atomic” style updating systems make patches both easier to write and deploy.

Another method is to lock down IoT applications and operating systems. Just like any server, the device should have the absolute minimum of network services. Your smart TV may need to use DNS, but your smart baby monitor? Not so much.

That’s all fine and dandy and it needs to be done, but it’s not going to help you anytime soon. And, we can expect more attacks at any moment.

Defending your intranet and websites

First, you should protect your own sites by practicing DDoS prevention 101. For example, make sure your routers drop junk packets. You should also block unnecessary external protocols such as Internet Control Message Protocol (ICMP) at your network’s edge. And, as always, set up good firewalls and server rules. In short, block everything you can at your network edge.

Better still, have your upstream ISP block unnecessary and undesired traffic. For example, your ISP can make your life easier simply by upstream blackholing. And if you know your company will never need to receive UDP traffic, like Network Time Protocol (NTP) or DNS, your ISP should just toss garbage traffic into the bit bin.

You should also look to DDoS mitigation companies to protect your web presence. Companies such as Akamai, CloudFlare, and Incapsula offer affordable DDoS mitigation plans for businesses of all sizes.

As DDoS attacks grow to heretofore unseen sizes, even the DDoS prevention companies are being overwhelmed. Akamai, for example, had to stop trying to protect the Krebs on Security blog after it was smacked by a DDoS blast that reached 620 Gbps in size.

That’s fine for protecting your home turf, but what about when your DNS provider get nailed?

You can mitigate these attacks by using multiple DNS providers. One way to do this is to use Netflix‘s open-source program Denominator to support managed, mirrored DNS records. This currently works across AWS Route53, RackSpace CloudDNS, DynECT, and UltraDNS, but it’s not hard to add your own or other DNS providers. This way, even when a DDoS knocks out a single DNS provider, you can still keep your sites up and running.

Which ones will work best for you? You can find out by using Namebench. This is an easy-to-use, open-source DNS benchmark utility.

Even with spreading out your risk among DNS providers, DNS attacks are only going to become both stronger and more common. DNS providers like Dyn are very difficult to secure.

As Carl Herberger, vice president for security solutions at Radware, an Israeli-based internet security company, told Bloomberg, DNS providers are like hospitals: They must admit anyone who shows up at the emergency room. That makes it all too easy to overwhelm them with massive — in the range of 500 gigabits per second — attacks. In short, there is no easy, fast fix here.

One way you can try to keep these attacks from being quite so damaging is to increase the Time to Live (TTL) in your own DNS servers and caches. Typically, today’s local DNS servers have a TTL of 600 seconds or 5 minutes. If you increased the TTL to say 21,600 seconds or six hours, your local systems might dodge the DNS attack until it was over.

fhj,ljk

Protecting the internet

While the techniques might help you, they don’t do that much to protect the internet at large. DNS is the internet’s single point of total failure. That’s bad enough, but as F5, a top-tier ISP notes, DNS is historically under-provisioned. We must set up a stronger DNS system.

ISPs and router and switch vendors should also get off their duffs and finally implement Network Ingress Filtering, better known as Best Current Practice (BCP)-38.

BCP-38 works by filtering out bogus internet addresses at the edge of the internet. Thus, when your compromised webcam starts trying to spam the net, BCP-38 blocks these packets at your router or at your ISP’s router or switch.

It’s possible, but unfortunately not likely, that your ISP has already implemented BCP-38. You can find out by running Spoofer. This is a new, open-source program that checks to see how your ISP handles spoofed packets.

So why wasn’t it implemented years ago? Andrew McConachie, an ICANN technical and policy specialist, explained in an article that ISPs are too cheap to pay the small costs required to implement BCP-38.

BCP-38 isn’t a cure-all, but it sure would help.

Another fundamental fix that could be made is response rate limiting (RRL). This is a new DNS enhancement that can shrink attacks by 60 percent.

RRL works by recognizing that when hundreds of packets per second arrive with very similar source addresses asking for similar or identical information, chances are they’re an attack. When RRL spots malicious traffic, it slows down the rate the DNS replies to the bogus requests. Simple and effective.

Those are some basic ideas on how to fix the internet. It’s now up to you to use them. Don’t delay. Bigger attacks are on their way and there’s no time to waste.

Beautiful_Russian_2_728_90

Henry Sapiecha

6 critical steps for responding to a cyber attack

6-critical-steps-for-responding-to-a-cyber-attack-700x357 image www.intelagencies.com

So you’ve been hacked? Here’s how to contain and mitigate the consequences of a security breach 

Cyber security affects all businesses and industries and it is now a board-level agenda item, placed at number three on the Lloyds Risk Register (2013). Dealing with cyber attacks is a “whole of business” issue, affecting every team within an organisation. It is also a people and operational issue, rather than just a technical issue.

In today’s modern environment, where every single organisation is reliant to a certain extent upon technology and telecommunications, it is not a case of “if” a cyber security breach occurs, but rather a case of “when”.

When a breach is discovered, it is essential to act comprehensively and quickly, or it may expose the business to greater liability. There are six critical steps the organisation must take to deal with it.

It is important to bear in mind that these steps are not sequential – in practice, it will be necessary to think about most of them in parallel, particularly in the initial aftermath of the breach where the priorities will be to contain it in order to mitigate any risk of further damage or loss of data.

1. Mobilise the incident response team

An incident response team should be formed and include all relevant internal stakeholder groups, such as a technical team to investigate the breach, HR and employee representatives where the breach affects employees, intellectual property experts to help minimise brand impact or recover stolen IP/information, data protection experts where personal data is involved, and public relations representatives. There may also need to be external representatives – for example, where the internal teams do not have sufficient capability or capacity.

The team should also include representatives from the organisation’s legal team and possibly also external counsel. There are a number of legal implications of any cyber attack, and it will therefore be of vital importance to the organisation to seek legal advice as soon as possible after becoming aware of an attack.

As part of this, it will also be necessary to check whether losses from a cyber attack are covered under the organisation’s existing business insurance policies. Where there is insurance in place, the organisation will need to review the relevant policies to determine if insurers must be notified of a breach. Some policies cover legal and remedial costs, but only from the date of notification.

2. Secure systems and ensure business continuity

Following a breach, the first key step from a technical perspective will be to secure the IT systems in order to contain the breach and ensure it is not on going.

This could mean that an organisation has to isolate or suspend a compromised section of its network temporarily or possibly even the entire network. This can of course be extremely disruptive and potentially costly for the business.

It is necessary also to consider how and when the breach was detected, and whether any other systems have been compromised. Organisations should have in place suitable measures to ensure that any network or other intrusions are detected immediately.

3. Conducting a thorough investigation

An investigation will need to be carried out as to the facts surrounding the breach, its effects and remedial actions taken. The organisation will need to decide who should take the lead on the investigation and ensure that they have appropriate resources available to them.

Where there is potential employee involvement in the breach, the investigation will also need to take into account any applicable labour laws, and the investigation team should therefore consult and involve HR representatives as appropriate.

Finally, the investigating team will need to ensure that they document any and all steps taken as these may be required as part of any regulatory notification to be submitted. In practice, investigations are usually iterative: further lines of enquiry will become apparent as the circumstances surrounding the breach become clearer.

Whenever there is a breach, it is important to feed back the conclusions from the investigations into the policies and procedures in place and the incident response plan, and to ensure that employees are given appropriate notice and training on them.  Regulators are often just as interested in what has been done to remedy processes going forward, as in the breach itself.

4. Manage public relations

This will be a key requirement of the incident response team, particularly where the organisation involved is a consumer-facing organisation.

Not all security breaches will become public, but for many it will be inevitable – for example, where customers’ personal data has been compromised and is in the public domain, or where the relevant data protection legislation requires the affected individuals to be notified. Being timely in managing announcements to the public and being accurate, open and honest in the messages given are crucial.

5. Address legal and regulatory requirements

Specific legislation may contain regulatory notification requirements that apply in the event of a breach. Although most jurisdictions do not (yet) have a specific and all-encompassing cyber security law, there is often a patchwork of laws and regulations that have developed in response to evolving threats.

Some of these laws will apply universally across sectors, whilst industry-specific legislation is continuing to develop to target the most at-risk sectors – for example, financial services, critical utilities infrastructure and telecommunications.

In the US, the legal patchwork includes: the National Institute of Standards and Technology Cybersecurity Framework, which consists of standards, guidelines, and practices to promote the protection of critical infrastructure; and Executive Order 13636, which, amongst other things, expanded the existing programme for information sharing and collaboration between the government and the private sector.

In the EU, organisations should pay particular attention to data protection legislation. The proposed new Data Protection Regulation in Europe includes a mandatory obligation for organisations across all sectors to inform their relevant data protection authority of any security breaches, including the facts surrounding the breach, its effects and any remedial actions taken by the organisation.

The EU is also proposing a new Cyber Security Directive, which would include a requirement for “market operators” (for example, electricity, oil, gas, transport, financial/banking etc.) to report security incidents to the competent authority.

Some legislation may also require, in addition to a regulatory notification, the notification of individuals whose data have been compromised as a result of the cyber security breach.

Deciding who to notify is not easy – it may not be possible to identify whose data has been affected, as opposed to whose could have been affected. If an organisation has many millions of customers, the prospect of notifying all of them should not be taken lightly.

6. Incur liability

Unfortunately, no matter how prepared an organisation is, it is nonetheless likely to incur some form of liability in the event of a cyber-security breach. There are various ways in which an organisation could incur this liability.

There could be direct non-legal liability as a consequence of a cyber attack. This liability could arise, for example, through blackmail attempts, theft, ransomware and ex-gratia payments that an organisation may choose to make from a public relations and customer relationship perspective. This final category can be a major cost to organisations following a cyber attack but can really help to mitigate any damage to the customer relationship. For example, an organisation for which customer credit card details have been compromised might choose to offer complimentary credit screening for the affected customers for a period of time.

There will very often be regulatory liability resulting from cyber security breaches. From a data protection perspective, current EU law requires organisations to have in place appropriate technical and organisational security measures to protect personal data. If an organisation is found to have failed in its implementation of this regulatory requirement, it could be subject to a penalty. In the UK, the current maximum fine under the Data Protection Act 1998 is £500,000, and Sony was fined £250,000 by the UK Information Commissioner for its PlayStation breach in 2011.

However, if the EU’s proposed new Data Protection Regulation is adopted, this could see the maximum fines being increased to €100 million or 5% of the organisation’s annual worldwide turnover, whichever is the greater.

In certain areas, sector-specific regulation could also apply. In the UK financial services sector, the regulator has historically levied greater fines for security breaches than the Information Commissioner. For example, in August 2010, the FSA fined Zurich Insurance Plc £2.275 million following the loss of 46,000 customer records on an unencrypted backup tape, which was being sent to a South African subsidiary for processing.

Liability for cyber security breaches could also be incurred in litigation for breach of statutory obligations, breach of contract, breach of equitable duties, and negligence. To date, the majority of cases have occurred in the United States. For example, in March this year, Target agreed to pay $10 million in a proposed settlement of a class-action lawsuit related to its 2013 breach.

Although the focus of this article has been on what to do in the event of a breach, it is also important to bear in mind that there are a number of proactive steps that organisations can take in order to mitigate the risk of a cyber attack before it happens.

In particular, organisations should carry out a comprehensive assessment of their existing processes and procedures, identifying what needs to be protected and assessing the specific risks and potential impacts on the business.

Thereafter, a response plan should be put in place including designating a suitable response team and making any necessary changes to policies and procedures to deal with any immediately apparent issues.

In addition, given that many data security breaches happen as a result of employee action or inaction, user education and awareness is crucial.

ooo

Henry Sapiecha

 

FFIEC offers cyber attack resources

cyber attack army on keyboard image www.intelagencies.com

Agency emphasizes preparation

The Federal Financial Institutions Examination Council issued two statements about ways that financial institutions can identify and mitigate cyber attacks that compromise user credentials or use destructive software.

The statements do not contain any new regulatory expectations, but are intended to alert financial institutions to specific risk mitigation related to the threats associated with destructive malware.

In addition, the Exam Council provided information on what institutions can do to prepare for and respond to these threats.

Cyber attacks have increased in frequency and severity over the past two years. The attacks often involve the theft of credentials used by customers, employees, and third parties to authenticate themselves when accessing business applications and systems.

Cyber criminals can use stolen credentials to commit fraud or identity theft; modify and disrupt information system; and obtain, destroy, or corrupt data.

Also, cyber criminals often introduce malware to business systems through e-mail attachments, connecting infected external devices, such as USB drives, to computers or networks, or by introducing the malware directly onto the business systems using compromised credentials.

Cyber guidance from Exam Council

In accordance with FFIEC guidance, institutions should:

• Securely configure systems and services.

• Review, update, and test incident response and business continuity plans.

• Conduct ongoing information security risk assessments.

• Perform security monitoring, prevention, and risk mitigation.

• Protect against unauthorized access.

• Implement and test controls around critical systems regularly.

• Enhance information security awareness and training programs.

• Participate in industry information-sharing forums, such as the Financial Services Information Sharing and Analysis Center.

ooo

Henry Sapiecha