Sensitive Data Security

Prior to extensive research into this subject, I'll note here my seat-of-the-pants understanding of the issue of protecting proprietary information, results of research, confidential contingencies, legal obligations, etc. If there's a cache of important stuff you need to store in electronic form, how do you protect it? Such a question brings up not only new issues, but rather well-established ones.

AIRGAPPING - To have a node or nodes dedicated to storage is an obvious but often not actually used method. Probably a sub-concept of network segmentation in a proper hierarchy, a clumsy way to state it would be to tell an administrator not to put the backups on the same network as what's being backed up (AND to give that admin or admin group the authorization and money to set the system up and maintain it...). USB HDDs and thumb drives are there if you're really strapped for cash.

BACKUPS - Sort of off the subject, but security concerns extend to backups as well as "live" parts of your operation. The important stuff lives there as well. Not only should there be a program of backing up confidential things and testing the backups regularly, there should be a scheme in which the form of storage (encryption?) is considered, the storage location is considered (not only cloud, but an alternative to cloud if there's a provider issue) and the security of the communication route TO the backup storage locations is considered. This last would be a candidate for a latter-day form of vampire tapping. No need for tar commands later.

NETWORK SEGMENTATION - Any organization that has proprietary data could use particular subnets for not only that data but for financial people or groups, the managerial and scientific research groups and high-level admin people who might need a method of access for evaluation and countermeasures related to network attacks (to the extent effective).

SECONDARY PROVIDER - one's infrastructure or cloud provider might be a center of or source of the problem, so backup relationships would be good there, sort of as a 'warm site' as described in the sense of physical locations. And this would be good in case of the financial predicament I often bring up: I was once told of a large bank that failed to pay a monthly bill to a cloud provider and a few days after the first of the month, several virtual machines, switches, routers, lots of data, hourly transactions, logs and things just went POOF. While working all that out, one could hot-switch to the secondary provider perhaps.

So a combination of segmentation and backup sequestering seems to be the way to go about this. Communication channels are also a concern. All three items are a risk, since if I were a cyber soldier for a third world country and wanted to score some free research results from a first world nation, I'd look at them all. Are backups and communications in the clear? Is everything on the same network? Did management spend much on security? Did they spend much on network architecture originally or is this a (typically) patched-together situation? Do they even have IT??

I'll leave us with a checklist:

SEGMENTATION: separate node(s), directories, networks
ENCRYPTION: nothing in the clear
BACKUPS: data, configurations, locations, multiple copies
COMMUNICATIONS: multiple providers, devices, virtual devices, financial contingencies

A Simple Analogy

Many technically competent people with whom I speak persist in the belief that online communications (web pages, email, VPNs) are secure. They are of course right... and wrong, depending upon several issues. Here's an analogy which either is original with me, or bears repeating if I've stolen it.

Imagine a tin can telephone system; that's our network analogy. There's a sending point, a point of reception and a communications route (encrypted tunnel, in our properly configured case). The tunnel is where the people that assume secure states are right. That encryption will prove really hard to crack. While anything can be defeated in theory, modern big-key systems will approach absolute uncrackability at current levels of technology.

But the tunnel is the middle point of this three-point system. There's also the transmission and reception points (the cans), being with the sender and the reciever of the message. The devices at those two points are where almost all questions of maintenance reside. In banking, the reception end is most often the institution, where InfoTech people are hired specifically to keep the nodes, servers, systems, switches, etc. properly configured, patched and monitored. You'd naturally assume a problem at the other end of this financial communication: the customer doing his banking (and personal social media stuff, email, shopping, census response, tax filing, etc.) on the same desktop on which his son plays online gaming. Antivirus? Too expensive! All bets are off where that PC is concerned.

And if there's a transaction involving a very careful user (you or me, maybe using a sacrifice VM on which to communicate in a paranoid mood) but a questionable recieving end (a local or county/tribal government agency), then there's either a management issue, a budgetary problem or something else to consider. So the two endpoints can be a problem even in the era of easy encryption. BUT there are two additional considerations beyond the current state of the endpoints.

First, there's the future state of the endpoints. Even if all config checks, patching, firewalling etc. have been checked, what about tomorrow? Zero day hits? New patches? New knowledge base releases prior to patches? New releases of software keys or default passwords on the dark channels? What if the cracker doesn't enter the network via the PC we're scrutinizing but via the router or a webcam or a web-enabled Barbie or GIJoe toy? Or the smart TV? Or audio streaming section of the stereo receiver? According to Leftronic, 127 new IOT devices connect to the web every second, meaning that load on networks increases steadily.

And second, there's data creation. If previous data, copies, emails, messages, other communications, login states or something is piling up on one end of the pipe regarding the person or organization at the other end of the pipe, then I (as a nasty actor) might be very interested in sneaking into some storage location and dd'ing all that stuff for later analysis. And it could be a relatively slow and quiet hack, since any Intrusion Detection regime would probably be more interested in the live network than in HDDs sitting around half-idle. And speculatively, perhaps I could use the stolen items now... or sell them later.

So there are various points about which to consider issues: sending point, tunnel (transmission point), receiving point, patching/monitoring/version issues for all points and data creation.

Oh. I forgot backup... and encryption for the backups - and to park the backups at a location NOT ON THE PRIMARY NETWORK WITH EVERYTHING ELSE. But then everybody forgets all that.

OpenSUSE Leap 15.0

This new desktop incarnation of OpenSUSE Linux successfully installed on a Core 2 Duo Dell box of about 10 years' age. I'm finding various oddball items of behavior but it's generally solid.

This load is my first experience with the Brave web browser, which defaults to several good security practices such as searching for HTTPS connections wherever possible. It's a rewrite of Chrome minus several... questionable practices. My only trouble with it would be the practice of closing the bookmark menu any time a change is made, requiring the user to re-enter the menu, unlike Firefox which doesn't close the menu after creation of folders, for instance.

When connecting a camera (Android in this case), I've been seeing intermittent connections for both charging and transferring pictures. And when pics successfully transfer, it's possible only by "manually" right-clicking on the file and doing a move to a home directory. Within the graphics program, the move or copy always fails, so I don't open it until after the move or copy is done.

In YAST (yet another setup tool), the Software Update app has no obvious refresh control, but several hidden in the dropdown menus which usually work. A equivalent tray symbol, a circle with an "UP" arrow in it - with a blue dot indicator - has proven stable so far, though, for noting when the system detects an update ready for installation.

I haven't been able to configure the wireless NIC yet, although the system did detect nearby networks with no problem (this issue could just be me).

I did like the Security & Hardening Center app, though, which is extensive and uncomplicated. Overall this version of OpenSUSE would not be a system for a newbie but is stable (no crashes so far after about 3 weeks of testing) and with further debugging looks to be an interesting contender in the desktop Linux race.

Fresh Rethink

In the technical sense, what is security? Or, what are the most common categories of activity in which the issue comes up? Secure coding practices? Networks? Email? Insider threats? Domain registration/hijacking? All those are contenders but let's look at four examples I've personally seen or heard testimony regarding from those that were involved.

DDOS ATTACKS

Distributed Denial Of Service attacks, in which a bad guy tries to knock you off the air, are persistent and automated. There are many protection services such as Cloudflare that offer access to defense networks for a fee. Your internet service or cloud provider may have filtration devices (network appliances) in a network operations center that can be temporarily effective. Your administrator - if you have one - may know of onboard options in your server or desktop/tablet/phone operating systems that can help, like firewalls, but recall that firewalls are only as good as the rules maintained by the administrator. Also, firewalling is not usually a network-related but a local damage control approach, at least from the end user's perspective.

RANSOMWARE

A stealth attack or a click by an employee on a bad email link can result in the presence of an outside program that can encrypt valuable information. The perpetrator then demands a fee for MAYBE restoring the data (and the encryption method may have inadvertently destroyed some of the data in the process). I think the only way to protect against this sort of thing that offers a high degree of success is an effective backup strategy. Saving all data, configurations and network information in secure, out-of-band or offsite areas gives you the ability to bounce back from most issues. It's business continuity.

CLOUD ISSUES: disappearance

I was told a story by someone involved that a company had a network of virtual computer instances along with virtual routers and switches at a major cloud provider. The company didn't pay its provider bill one month. A few days after the deadline, 32 instances and their related virtual network components simply went away. Vanished. Backups existed and were current. But it took a week to rebuild all the nodes of various kinds. Could your organization survive a week of customer interruption? The cause was an accounting error, producing a sort of security issue. But it's really a continuity issue.

CLOUD ISSUES: hypervisor code

I was witness to a problem at a provider that ran a popular hypervisor on the large servers on which it created virtual computers that were then rented to end users. A coding problem caused by the company that wrote and maintained the hypervisor program was identified that took about ten days to patch. For those ten days we were inundated with frightened questions from customers who were potentially exposed to data exfiltration and we couldn't do a thing for them. If you have sensitive data or trade secrets this may be an argument against cloud structure and for being in control of your own bare metal.

My constant individual user advice: go to the PUB!

PASSWORDS - change them often, with no dictionary words allowed. No storage in the clear (on the network)!
UPDATES - check operating systems, applications, firmware and processor issues regularly.
BACKUPS - check for successful and readable second copies of anything important, and store in some way unconnected to the primary network. Constant connection from primary to backup location could be a problem, allowing an attack to encrypt or erase backups in addition to originals.

The Landroid by Worx, inc. - a robotic lawn mower

Spoiler: I'm known for being critical of automation and this time will be no exception.

Full disclosure: although I use another Worx product, I have not done any hands-on examination on this line of mowers.

Only recently did I learn of the existence of automated lawn mowers - and apparently they've been around for awhile. In the process of discovering this, I've not changed my attitude about the automation of potentially dangerous devices. But I did learn much that I didn't know with just a bit of searching.

First, the forum conversation largely discusses limitations in the device capability, such as the issue of sensing short obstacles under 15 cm or 5 inches. It also (at default) uses a random algorithm like the Roomba vacuum cleaner in order to eventually cover all of its assigned area. This default can be changed with specified instructions, though this could be challenging for the mower's target audience, which is retired homeowners. [ :begin rant: Our wireless world now makes Joe Sixpack his own network administrator, meaning that many, many issues of technological maintenance will go undone... :end rant: ] And there's the possible odd appearance of random patterns cut into the grass.

But a search confirms many of my automation suspicions. In addition to onboard controls, the device is operated through phone applications and router connections. A location feature uses GPS information from cell towers to locate a lost Landroid should it stray from its assigned zone, which is delineated with a wire that must be installed at the area's edge, forming a "fence". And hackaday(dot)com reports the controller as using a "an NXP LPC1768 ARM Cortex-M3, and the debug pins are labelled on the backside. The manufacturer didn't protect the flash memory". This level of automation brings several possibilities to mind: there is already talk of some manufacturers of programmable mowers being able to restrict replacement parts to expensive proprietary ones, and of using later software to brick earlier versions. And if you don't get along with your neighbor, why not have his mower cut dirty words into the yard, bricking itself upon completion? And how much onboard memory and storage have we got? Spam server, anyone? Get your whole situation blacklisted, anyone? But the obvious issues to me would simply be that the connectivity is yet another route to the router, to be used to exploit more general vulnerabilities - and that wifi range is not properly sensed by the unit in order to avoid losing the ability to receive commands (to Work's credit, their site does note the issue and advises as to how possibly to avoid it). And the potential (haha) for coding issues and Personally Identifiable Information misuse always exists with manufacture-provided apps AND the phone companies through which such apps almost always operate.

So aside of questions of practicality (does an automated mower create more work for the user than it saves?), this appears to be yet another category of unpatched potential holes in someone's digital exposure. But it's an interesting category to investigate. From a pentesting perspective, the installation of such automated convenience devices could provide clues about the level of security overall, and about the psychology of the target user(s).

Third Week of StayCation: Different Uses For Multiple Boxes

One would be really dumb to try to do everything on one's phone: banking, insurance payments, stock trading, plotting illegal activities while assuming messaging is totally unmonitored... as if anybody ever actually did that. Oh, and doing one's taxes over a "smart"phone... that's a real winner.

But sitting at home on Covid-19 break, it occurred to me that there's enough PCs/Macs/Linux/whatever machines around here to be apportionable to many different needs. Imagine if one were to use dedicated boxes for specific risk levels or hardware needs. Let's list a few:

SECURE COMMUNICATIONS AND FINANCIAL ACCOUNTS - This would not argue for Windows XP. This would argue for a current, constantly-updated, antivirus-equipped (if applicable) latest-thing desktop or laptop. Don't load free gambling programs on this one.

CASUAL COMMUNICATIONS, SOCIAL MEDIA AND VIDEOCONFERENCING - This also argues for frequent patching and up-to-date hardware. But heavy malware scanning and general lack of trust would be important.

GAMING - High-performance hardware requirements and total lack of trust are the driving issues here.

CLONE/BACKUP OF OTHER UNIT - Mainly with the business/financial computer, if you have a crash you may need a quick replacement to step in.

OFFLINE ARCHIVING - Important files need to be stored in a safe place. This box doesn't need to be networked and you might even unplug this one when not used. And it's a good backup for a backup; the only place big enough to copy over an outboard HDD is another big drive.

FIREWALL/ROUTER/PROXY SERVER UNIT - If you have heavyweight networking requirements, a filtration point might be needed.

ODDBALL COMPATIBILITY UNIT - Particular jobs or situations could demand a particular operating system, application, application set or configuration(s). If the boss says to set it up a certain way, this is the box on which to do that.

So I've suggested that you need a minimum of SEVEN computers in your Undisclosed Location.

So? What's so strange about that? (everybody peers into my room, shakes head, walks away)

The Most Recent End Of The World

According to previous job descriptions, I have some experience in emergency operations of several kinds (I’ll keep details to myself since many of you know that stuff already and the internet already knows too much). Here’s my perspective on the current virus outbreak and how it can be somewhat managed:

1. Frequent hand-washing and refraining from touching the face are good moves. Using disposable gloves is also a good idea, as is social distancing whenever practical. Masks and buying lots of toilet paper are mistakes; the mask will not prevent a virus from getting through, but will help an infected person NOT infect someone that’s clear of the virus by containing the cough droplets. Also, intestinal problems are not present during most infections so the panic buying of toilet paper is misguided.

Edit: Information is not clear but it looks like masks could have some positive effect even if not 100% reliable, and on the toilet paper issue I've been told by a grocer that most of the cheap TP comes from China, where supply chain disruption has happened. So not all the TP went away from hoarding, and masks could be a good thing even in less effective contexts.

2. Many people appear to be buying more groceries than usual, perhaps since they’re not going to restaurants and bars so much. From what I’ve seen, the supply chain for produce and other foods is functioning well, but still needs overnight restocking. This is an opportunity for those of us that have earthquake kits (on the West coast), tornado kits (in the Great Plains) and hurricane kits (East coast and gulf coast) to restock and discard out-of-date canned goods, expired and leaking batteries and so forth. And in many areas take-out service or drive-through is still done at coffee houses and restaurants. And it may be a first that Texas restaurants are allowed to deliver alcoholic beverages with food orders, a measure not previously allowed in that US state.

3. Although much of the economy is being upset, many things still function. Power systems and telephone/internet transmission is good. Fuel oil, diesel and gasoline supplies are plentiful. Car repair places are still doing good business where I am (central US). The medicine I need is easy to get. Water/sewer service is unimpeded. And the weather has been mild. It could be worse.

4. The internet is rising to the occasion with not only new resource pages, but with the ones that already existed such as www.cdc.gov and www.ready.gov at least for the US.

5. Finally, remember that corona-family virii have been around for some time, and the infectious disease experts have been to this rodeo before (I think about ten times in the last 25 years or so for the US). If recent Chinese reports are accurate, the Hunan area is seeing a drop in need for bed space, treatment, therapeutic medicine and so forth, suggesting that the curve is already headed down at their locations. And early fast-spread statistics from Italy are something that I think could be explained by the close-in conversation habit that Italians consider normal. This effect would not apply to most other societies and I’ve seen at least one report that suggests that the Italians now are doing better than other European countries at social distancing practices.

I invent a new acronym...

... mainly for my own convenience: ITNA - Individually Targeted National Attack.

Here's a good Forbes Magazine article about the most recent developments in what we used to call 'wardriving'.

Driveby Vulnerability story

And here's one of the latest things on the Huawei issues.

Huawei story

At the risk of repeating myself, I'll speculate on the global possibilities of such hyper-local matters. One of the exposures of the Imperial Japanese Navy in attempting to knock out the American Pacific fleet in 1941 was the possibility that they'd be discovered as they slogged their way from Japan to Midway. They got discovered, thereby failing in their efforts. What if that trip had been unnecessary?

The whole "digital Pearl Harbor" scenario posits the internet as a remote access point to sensitive areas that an enemy would wish to use as attack vectors. Put that idea together with such things as personal data leaks and you get the possibility of attacking an enemy nation via bypassing national defense infrastructure. The Russians have already approached this by trying a cyberattack on Ukraine's municipal power grid some time ago. If citizens can be attacked directly, then there's little need for near-Napoleonic Era infantry advances. Observe this list of aspects of an individual's digital life:

Phone GPS tracking and phone company cloud data backups/saves

Smart home connections from digital assistants to smart light bulbs with insecure protocols

Financial information in data leaks

Medical information in data leaks

Email accounts, particularly free webmail

Government (national, state and local) information in data leaks

Information publicly viewable from government or Google

Resume information posted to job sites or on personal pages



First, set up a data collection project to track every citizen in the target country - let's say around 100 million people. Every citizen has a file. That file would become a dossier to use to feed an attack script specific to the person. The script could have sections for dox-ing personal contact info, for shutting down phone numbers and accounts with a phony email claiming a move to a competitor, for making unauthorized purchases that could trigger auto-shutdowns of credit, for making false police calls... get the idea?

Add those custom measures to the obvious things like attacks on police dispatch communications, remote traffic control systems, computer-controlled telephone exchanges, food distribution networks, internet-accessible remote starting in recently built cars and trucks... and all the other new exposures or vulnerabilities that have arisen over the last ten to fifteen years. And the Stuxnet worm has shown everyone that (with access to certain programs and languages) it's possible to destroy industrial devices with instructions inserted into the control points from outside.

So Country A could attack the 100 million citizens of Country B after first building the citizen files, then getting the attack scripts finished, then populating the attack script with info on the target citizen. After that, it's an access question (perhaps constructing backdoors over time) and then one simply selects a time to pull the trigger. No armies or navies needed. It's a software development project with a very large database. That sort of thing is done every day; it's just been weaponized by someone in this example.

How to protect oneself? If I were the government, I'd pull back on commercial off-the-shelf solutions and use more home-grown ideas, plus put more people onto network monitoring jobs. Individuals would benefit from my "Go to the PUB" advice: maintain Passwords, Updates and Backups. And don't load gobs of free apps onto your phone without knowing who they talk to.

Biting The Bullet: getting a Windows 10-native box due to Window 7 end-of-support

Short Report: buying and setting up the hardware was the usual three hour configuration process for a new box - but the discovery of a new OS was also usual in that one discovers yet again how Microsoft is always able to make some things marginally worse. And when it didn't really have to.

Longer Version: I got a fresh build of Win10 (not an upgrade from 7 or 8) from Office Depot's website's off lease resale page. My alternates were Tiger Direct, Micro Center and discountelectronics.com and they are probably equally trustworthy (although in my experience the last one listed has the fastest delivery time). Office Depot probably was the low price leader but took 10 days to deliver from a 3rd party refurbisher. Quality of the box was very good.

Sequence of events:

1. physical hookup and establishing of user account
2. Windows updates and related reboots
3. installation of other browser of preference
4. installation of duckduckgo and/or startpage.com search into browser of preference
5. installation of BrightFort Spyware Blaster (malware install preventer)
6. installation of Safer-Networking Spybot Anti-Beacon (blocks lots of Win10 chatty telemetry)
7. installation of other 3rd party things like openoffice.org, Audacity audio recorder, antivirus...
8. installation of iTunes VIA HAVING TO GOOGLE FOR Win10 INSTALLER rather than go through MS Store from Apple link
9. do 1st snapshot with BrightFort Spyware Blaster (a kind of short config backup)
10. do real backup (discovering that one outboard device had no Win10 driver available; used another that did)
11. test programs like mrt, disk utilities etc. to see if they work.
12. discover that "Photos", the replacement for Windows Photo Viewer, is clunkier and less stable
13. realize that "Backup" hid the control for "run now" in the More Options menu, which is stupid
14. realize that "Photos" sometimes wants connectivity to no useful purpose
15. move in remaining amount of needed data from other places if you require it

The more things change, the more they stay the same.

Kinda saw this coming...

... since Richmond had been warning us for oh, about 2 years.

I'll be complimenting one of my institutions (Chase) for NOT allowing this to happen. There are two or three ways to prevent this error message, all of which cost a bit of money. And the Info Tech people have to get it from some level of - you guessed it - MANAGEMENT and the managers at Chase, to my knowledge, understood the issue and I haven't seen this goofup at any of their ATMs. I don't actually know where this machine is, but it's at one of their competitors.

If I were Chase, I'd milk this for all it's worth, never letting the cheaper banks forget it. Hard to sweep this one under the rug.