2016 Top Hacking Tools

Back on the top from 2015 are: Nmap, Metasploit, Burp Suite, John The Ripper, THC Hydra
Others listed on www.techworm.net—

• 2016: Acutenix Web Vul Scanner, OWASP Zed Attack Proxy Project, Wireshark, Burp Suite, Aircrack-ng
• 2015: Cane and Abel, Angry IP Scanner, Burp Suite, Nessus Remote Security Scanner, Ettercap, Wapiti

Nice to see some of the oldies of 10+ years ago have continued to make the top of the list including: Nmap, Metasploit and John The Ripper!  The fundamental of network sniffing, password cracking and vulnerability exploitation has remain static - and as open source and some really cheap investments.  Technology has advanced but the same tools that guaranteed 100% success in penetration testing have not. I would also add to the collection: WebScarab, DumpSec, netStumbler, Nipper, Minikatz, netcat, Ngrep and suite of PS tools…  Happy hacking from VMs instead of the old/clumsy drive partitions ;)

Oncology data breach

2.2 Million patient names, SSNs, diagnosis/treatments, and insurance information hacked – copied and transferred.  Notifications were sent to past/current patients if 21st Century Oncology, Florida-based healthcare provider, (across 145 cancer treatment centers in the U.S. and 36 in Latin America).  Of course credit monitoring was offered as a result.  Notification came from the FBI of the data loss and after the company hired investigators, revealed hackers accessed the database in October 3, 2015 but we’re authorized to publically notify till March 4, 2016. Questions remain unanswered (or to be published) by why weren’t 21st Century Oncology security and systems altered of the issue beforehand?  And not to confuse it with the 34 Million Fraud case...
This is coming off the heels of a settlement (unrelated) of St. Joseph Health patients to receive $242 (and plaintiffs can apply up to $25K for suffered identity theft losses) based on a 2012 data breach.  Of course attorney fees/costs mounted to $7.5 Million.  St. Joseph also spent more than $17 Million on added security systems and $4.5 Million on credit monitoring fees for patients.
Details: businesswire.com 

Breach or not - Retailers and regulators again

To investigate effectively and not cause panic without having full/most of the background, security breaches are not made known for a little while until an organization (or investigators) has formalize a communication strategy.  Hence, Amazon’s recent email blast regarding resetting passwords could be a prelude to sometime - or maybe nothing at all.  Based on the limited details thus far, it does not appear to be a phishing attempt since no link is present in the email, yet a mention of passwords might have been posted online thereby, suggest of changing.
In an unrelated matter, the CFPB (Consumer Financial Protection Bureau) issued its first Consent Order against an online payment platform – questioning reasonable and appropriate data security practices not in place i.e. not meeting at least industry security standards.  Citing mishap in employee data security training, lack of encryption, no periodic internal risk assessment and missing policies, procedures, etc.
Hence, CFPB issued order without prior report of a breach and is proactively representing consumers (which is adding to the growing awareness) and actions taken by authorities such as SEC and FTC (Securities and Exchange Commission and Federal Trade Commission).  CFPB included the following recommendation:

• Annual/bi-annual security risk assessment
• 3-rd party to perform audit
• Maintaining reasonable procedures
• Encrypting data
• Regular employee training
• Appropriate customer identity authentication
• Update security patches for web and mobile applications

Tale of two breach payouts

Can’t help but compare Home Depot's $19 Million vs Erin Andrew's $55 Million though realizing it’s two different kinds of breach, or is it?  Loss of privacy, sensitivity information, trust, and the other weighing in more on dignity...
While Erin Andrews court appears comes to a close (pending potential appeals), Home Depot is will to pay out $13 Million in funds for “reasonably traceable fraud” to compensate 56 Million effected customers’ out of pocket costs (from a malware breach of credit card information in 2014).  Proposed class action lawsuits amount to at least 57 filed in the U.S. and Canada; but the balance of the funds would go to legal fees.  And, on the other side, speculation has it that the sports announcers may only end up with approx. $5 Million after all the legal fees / attorney profits, etc.  Home Depot also reported booking $161 Million in pre-tax expenses for the breach… Of course, the infamous Target breach offered $10 million to settle the class-action lawsuit; and Obama’s administration reported to have shelled out $19 Billion to improve security for individuals, companies and government agencies.

By the numbers...of headlines making the news this week

International Women’s Day – except from RSAC2016 and more

Women account for 10% for the InfoSec workforce which remain consist from last year…according to ISC2.org.  The number is bumped to 20% for GRC (Governance Risk and Compliance) and risk management roles.  Women considerably dominate in these role both as leaders and practitioners (versus mostly operational roles where men dominate in both role types).  So, shortage in technology talent estimated at 545,000 and Symantec saying 1.5 million by 2019) is consistent and filling the roles, regardless of gender is attributed to mixture of monetary and non-monetary incentives...more so than ever. Study also showed a spike of interest from women post 9/11; and women are taking jobs the men aren’t.  Women employed percentage totals (ISC2):

• 74% HR Managers
• 38% Management occupations
• 26% Cmoputer and information systems managers
• 26% Chief executives
• 25% Computer and mathematical occupations
• 18% Information security analysts

Titles are one thing, but experts predict 65% of children entering schools today will have entirely different job titles by the time they enter the workforce.  Retention mimic each other regardless of gender but 3 areas where women leave are a result of:

• Poor leadership / management: 44% women vs 39% men
• Unhappy with work environment/culture: 41% women vs 34% men
• Lack of work/life balance: 26% men vs 21% men

In a salary study of mostly U.S. respondents, the results show women in GRC groups average salary were 4.7% less than men ($115K vs $121K); and while salary is approximately equal or more throughout the ranges except for salaries range over $120K.
Takeaway is invest in women/girls, roots of socialist holiday and first held in 1914 till UN proclaimed it as a holiday in 1977…and now, 2015 International Women’s Day
Additional links: UNwomen.org | The Guardian | India | quotes

RSAC2016 25th Anniversary

Another great show at #RASC2016 except the crowd this year – So, brain dump of key takeways. First, I did not win the CloudLock Harley Davidson raffle [Bummer]. Other big ticket items including asking yourself “what does the data say” which runs parallel my own motto, “follow the data” trail.  Both have significant impact in how you address holistic data security practices, diversity in implementation and incident recovery.  Having an exit prevention strategy, for example, can be as essential, if not more, to being proactive and preventative controls.  While it has been proven that no security is full proof, there are many commonalities the root-cause. But first recapping the notables: Anthem 80 Million medical records which is the largest of it’s kind and new pathway to type of rich data breach; Premera for 11 Million accounts compromised for over 9 months which would segway to Dwell-time (I posted in the past)?; or Ashley Madison for failure of contracted services and security (so not actually/so much for the profile who likes what data itself i.e. $19 fee for deletion of data was not delivered prior to incident); 333,000+ IRS breach of records which is still climbing – that revealed 400,000 attempts of credits reports leading to this hack…
And so the commonalities:

• Improperly segmented networks
• detection deficit disorder (ignoring or looking at incidents in wrong places)
• Failure to white list
• Not monitoring critical systems
• Poor awareness
• No multi-factor authentication
• Phishing messages 

Can’t have an IT discussion without, The Cloud – Companies should be responsible for their data and so warrants should be issued to the individual organization not to the cloud service providers.  Yes, worth more than a few words but does allow and command more transparency for customers and their clients to have the level of “trust” and necessary attestation upon signing-up for cloud services.  Matters of privacy is a timeless value and a balance between right to privacy and personal data, public value, and safety will be in the hot seat in legal, courts as the laws try to catch up with technology.
RSA’s key note heightened the privacy issues and how that would related to opening pandora’s box for allowing backdoors, etc. revealed without textual diligence, modern technological construct and consideration of its impact, both fundamental practices in the past as well as decisions for the future.

So, what’s the long-and-short? Defense in Depth is Dead. The source is not connecting data elements and lack of collaboration within teams and outside company boundaries.  Solutioning is based on now based on integration and not layers!  The 6 key domains are

• Discovery-got to know what’s on networks not just servers but cloud providers, IOT
• State of security for each asset we own – not just vulnerability , malicious file e.g. phishing exploiting client-side vulnerability
• Need ability to monitor activity across the network – packet inspection integration
• Analyze – pulling domains together (event correlation, behavior analysis) to prioritize
• Response – typically the SOC and effectively response
• Protect – proactively protect devices (NOT prevent) and can it be done in an automated way – longest item for industry to solve since it’s based on trust of ability to do this

As a result, the upshot is (1) results will be visibility (for all state of assets including shadow), (2) understanding critical context (to prioritize threats/weaknesses), and (3) ability to take appropriate action in a decisive manner.  Conclusion instead is Long Live Depth in Defense.

More recap / notes...as RSAC comes to a close

#darktriad - Psychopathy | Narcissism | Machiavellianism

The dark side harbors the bright side…I guess
It’s Friday - copy-paste from Harvard Business Review:

• Narcissism was positively linked to salary
• Machiavellianism was positively linked to leadership level and career satisfaction
• individuals with psychopathic and narcissistic characteristics gravitated towards the top of the organizational hierarchy and had higher levels of financial attainment
• Base rate for clinical levels of psychopathy is three times higher among corporate boards than in the overall population
• Dark triad traits tend to enhance competitiveness, if only by inhibiting cooperation and altruistic behaviors at work
• dark triad personality characteristics constitute the essence of the freeriding
• An intermediate – rather than low – level of Machiavellianism predicts the highest level of organisational citizenship, perhaps because Machiavellian individuals are politically savvy and good at networking and managing upwards
• Best leaders displayed the bright-side features of narcissism while inhibiting its dark-side traits: they were high in egotism and self-esteem but low in manipulativeness and impression management

...for me, it’s all about Balance

Opt-in to Leadership

Talent does not equal success.  Some of the most successful business man/women, politicians, Presidents, etc. rank in the lower half of their graduating class (and some didn't even graduate college).  Talent might very well be given to you or inherent but success must be earned.
Often times leaders are thrust upon the role due to technical accomplishments or accolades from previous projects or tasks but to be success, however, starts within oneself and can incite the unlimited human potential of others and deliver results.
While leadership is a teachable skill, it can be a lifelong process and may come more natural for some.  Capitalize on each opportunity and buy-in to earning success because your potential is limitless.
“HOW YOU LEAD DETERMINES HOW SUCCESSFUL YOU ARE” - Richard Rierson’s Dose of Leadership

UK CIOs' cyber readiness may not be what you think

82% of UK CIOs are pressured by the business to prevent, detect and resolve security incident faster (particularly in financial sector) however,
• 25% not concerned with security breach
• 15% are proactively identifying threats
UK CIO’s believe 26% would be able to uncover breach within 14 days and 33% within 90 days. Additionally, the biggest tale revealed/say, 52% would know how and what systems were affected if a breach were to happen today and within 24 hours.  Really...with other stats that show:
• 256 days to detect breach
• 100-120 days to remediate after attack
• Average cost of $3.8 million

Alarming statistics particularly since hackers are no longer just smart young kids but instead, heavily funded organizations with high stakes and very passionate motives.
End-point protection is still lacking in comparison to the deployment of traditional firewall, anti-virus, intrusion detection system and encryption.  External partner connections extend the physical boarder which offers no consistency in data protection today and dialog between companies as well as inter-countries have proven to be a challenge.  Additionally, another gap is the lack of qualified cyber security professionals as seen by the large volume of open positions that have proven difficult to fill.  Cyber security is the 6th fastest growing industry in the UK and is set to grow 13% per year according to the Department of Business, Innovation and Skills (BIS)…which some say can take 20 years to fulfill.

Article sources:
Carbon Black 
Ponemon 
Computer Weekly

Encryption and Backdoors

The upshot of ISACA's the sky is falling article identifies the following, from an SME that lives and breathes cybersecurity and forensics:

•          Humans are the weakest link i.e. phishing and social engineering
•          Security awareness training is essential…since data harvesting can occur over years
•          Continuous communication since some of the preventative items seemingly easy and just makes common sense

Now, instead of diving deep into forensics which is probably best left as a separate post, lets transition off to recent events. Trending lately is data encryption and backdoors by the way of Blackberry and RSA, respectively.

As if Blackberry didn’t have enough to worry about its place in the market.  A claim has surfaced that its PGP used for email can be decrypted with commercially available tools.  In fact source, Dutch investigators, was quick to point out that not all, but nearly 85% of encrypted emails including deleted messages were recovered. Blackberry’s response have been limited, to be expected, but what encryption isn’t full proof, right. 

There again, unless you purposefully or offer to leave backdoors…as reported by Reuters that NSA paid RSA for making the random number generator algorithm the default option in its cryptographic toolkit.  Of course Snowden’s information leaks spurred conversation which now may have some affects on the upcoming 2016 RSAConference.  Over half-dozen presenters have withdrawn including members of Google, Mozilla, Taia Global, F-Secure and now OWASP is voting on the boycott matter.  Unfortunately, the RSA named conference was intended to be an independent forum anyway; yet likely to suffer from the RSA brand for which the event is hosted under.  Wonder if naming it EMConference make a difference?  The vendor presentations, exhibits and sponsorships has opened doors for other companies and it does not seem to have a short of those requesting.

Identity Theft: 65,000 UCF SSN

If you’re the not so lucky University of Central Florida Sentinels past/current study or staff, you will be receiving notice today of a Social Security Number security breach.  Records also included student IDs, class studies and their sports - including 600 student-athletes of 2014-2015.  Apparently access shown to occur on Jan. 8 and realization of breach occurred on Jan. 15, but release notification held due to investigations and work with law enforcement.  It’s suggested that hack resulted from multiple individuals, and phishing is suspected but not confirmed.  While no evidence indicated thus far that the information has been published or used/exploited, free 1-year credit reporting and services is being offered as a result of the mishap.
Recall other notable other higher education breach: University of Maryland and North Dakota University with 300,000, Auburn University with 370,000 and Butler University with 163,000 records...

TalkTalk update to earlier post & Outsourcing

It’s been months since the UK cyber attack and while investigation continues, but last week 3 Wipro Kolkata call center employees were arrested in connection with the 157,000 customer records (and approx 15,000 banking information) data breach.  Apparently the BPO relationship had been formed to increase customer satisfaction by 10% and targeting results in the tunes of $2 million in annual cost plus $1 million increase in revenue via analytics that would lead to reduction in TalkTalk customer complaints.  Reports indicate TalkTalk’s had lost 7% of its existing customers as a result of the breach (of which 250,000 broadband customers the week of the breach in October).
Of course, Wipro isn’t commenting much on an existing investigation but state the confidentiality and integrity of its customers’ data is important and has zero tolerance policy.  Recall another outsourcing competitor, Infosys, who lost their CEO and CFO of BPO Operations that resulted in overbilling of Apple by Infosys employees.  Looks like the new Wirpo CEO, Mr. Neemuchwala, will be relying on it's new-age technology and artificial intelligence to make some immediate impact...on top of trying to grow the 3rd largest software firm and its profits.

Vendor and Supplier Information Security Diligence and Audit programs are essential part of doing business...across the street or across the pond.  It always a balance of business capability/flexibility and IT/security - but particular focus areas including: data exfiltration [thin clients], comingling of data [network and application segregation], dedicated resources/SME [least privileges], accountability/liability [contract/legal/incident response], and spot/surprise audits [contracts].

Cyber events in early 2016

Few of the notable conferences:

• First, needing no intro, who’s going to the February 25th anniversary of #RSAC in the Bay?
• General Audit Management Conference in Dallas, March – IIA summit for audit management with tracks from Technology Risk, Leadership and of course, auditing strategically
• SANS Cyber Threat Intelligence Summit in Alexandria, February – with SANS courses including hacking, monitoring/operations and forensics
• B-Sides Tampa Security Conference in April – for security hackering
• ICISSP 2016 in Rome, Italy, 2nd Annual in February – Security and Privacy practitioners
• CISO Summit in New York, February – for practices in Enterprise Security Threats
• Secureworld in Boston, March – for cybersecurity
• CyberSecurity – Women in cyber, Dallas in March
• ASIS International in London, UK, April – European security conference on various industries and topics on threat landscape
• Interop Las Vegas, in May – with various conference tracks

Just a few that crossed the radar.  Enjoy...see you out there