Verizon 'supercookies' could be a boon to advertisers, hackers

Supercookies could take a bigger bite out of your privacy than you think, say researchers. Here's what they're worried about.

It's bad enough that Verizon and AT&T have unleashed a new breed of "supercookie" that can track your every online move, even as you switch between your smartphone, tablet and TV. Far worse is the possibility of abuse by advertisers, governments and hackers, privacy experts warn.
"Any website you're going to end up on is going to get this supercookie," said Marc Maiffret, chief technology officer of cybersecurity company BeyondTrust. That opens the potential for these supercookies to be exploited by many more people than Verizon anticipated with its tracking program, he said.
Verizon, the largest mobile carrier in the US, uses information gleaned from its supercookies to understand your interests and concerns by tracking the websites you visit and links you click on. It then supplies that information to its advertisers so they can craft finely targeted advertising campaigns.
About 106 million of Verizon's consumer customers have been tracked this way for over two years by the company's Precision Market Insights program, according to a report by the Electronic Frontier Foundation published last week. AT&T tracks fewer customers, but only because the company says its program is still being tested.
Verizon and AT&T are the largest wireless carriers in the US.
"You're making it very difficult for people who want privacy to find it on the Internet," Paul Ohm, a senior policy adviser to the Federal Trade Commission and associate professor at the Colorado Law School, told The Washington Post, which reported the tracking programs last week.
Supercookies aren't called "super" for nothing. It's hard if not outright impossible to delete them. Verizon does allows customers to opt out of the tracking program: To opt out, consumers must unsubscribe from Precision Market Insights via Verizon's Wireless Web portal, its mobile app or over the phone.
"Customer privacy is a top priority. We never, ever share customer information with third-parties," said Verizon Wireless representative Adria Tomaszewski.
Verizon also changes its supercookie once a week, at the least. That's frequently enough to prevent third parties from exploiting Verizon's supercookie to their advantage, Tomaszewski said.
AT&T's supercookie is similar, although the company changes its supercookie every 24 hours and doesn't attach it after a customer deactivates it, the company told CNET News.
Cryptography researcher Kenneth White said his research indicates those supercookies never really go away.
And that's the problem, added Jacob Hoffman-Andrews, a senior technologist at the Electronic Frontier Foundation. "Your identity can be [rebuilt] from the cookies," he said.
T-Mobile said it has no plans to use supercookies. Sprint didn't return a request for comment.

Adobe Patches 18 Vulnerabilities in Flash

Adobe pushed out security updates for Flash Player this afternoon, addressing 18 different vulnerabilities, all critical, that could allow an attacker to take control of an affected system running the multimedia platform according to a security bulletin posted today.

The Patch Tuesday updates, available for Windows, Macintosh, and Linux machines, remedy vulnerabilities in several builds of Flash Player and AIR, Adobe’s run-time system.

The lion’s share of the vulnerabilities – 15 of the 18 – a use-after-free, double free, memory corruption, type confusion and buffer overflow vulnerability, could lead to code execution if left unpatched. Other vulnerabilities patched include issues that could trigger session tokens to be disclosed, and cause privilege escalation.
Researchers with Google Project Zero, the Chromium Rewards Project, Microsoft, and several other firms dug up the vulnerabilities.
Adobe is urging users running older versions of Flash Player (15.0.0.189 and earlier, 13.0.0.250 and earlier 13.x versions, 11.2.202.411 and earlier for Linux) and older versions of AIR (15.0.0.293 and earlier, SDK 15.0.0.302 and earlier, SDK & Compiler 15.0.0.302 and earlier, 15.0.0.293 and earlier for Android) to update as soon as possible.
In October, one week after Adobe pushed its last handful of patches for Flash, attackers began bundling one of the fixed vulnerabilities (CVE-2014-0569) into the Fiesta exploit kit. Independent malware researcher Kafeine wrote at the time that it was a “really fast integration” into an exploit kit and that whoever coded it must have reversed the patch in two days. It remains to be seen whether any of the 18 vulnerabilities that were fixed today are either currently being exploited in the wild or if they’ll eventually be incorporated into a future exploit kit.
- See more at: http://threatpost.com/adobe-patches-18-vulnerabilities-in-flash/109300#sthash.YgMJDDtV.dpuf

The lion’s share of the vulnerabilities – 15 of the 18 – a use-after-free, double free, memory corruption, type confusion and buffer overflow vulnerability, could lead to code execution if left unpatched. Other vulnerabilities patched include issues that could trigger session tokens to be disclosed, and cause privilege escalation.

Researchers with Google Project Zero, the Chromium Rewards Project, Microsoft, and several other firms dug up the vulnerabilities.

Adobe is urging users running older versions of Flash Player (15.0.0.189 and earlier, 13.0.0.250 and earlier 13.x versions, 11.2.202.411 and earlier for Linux) and older versions of AIR (15.0.0.293 and earlier, SDK 15.0.0.302 and earlier, SDK & Compiler 15.0.0.302 and earlier, 15.0.0.293 and earlier for Android) to update as soon as possible.

In October, one week after Adobe pushed its last handful of patches for Flash, attackers began bundling one of the fixed vulnerabilities (CVE-2014-0569) into the Fiesta exploit kit. Independent malware researcher Kafeine wrote at the time that it was a “really fast integration” into an exploit kit and that whoever coded it must have reversed the patch in two days. It remains to be seen whether any of the 18 vulnerabilities that were fixed today are either currently being exploited in the wild or if they’ll eventually be incorporated into a future exploit kit.

Adobe pushed out security updates for Flash Player this afternoon, addressing 18 different vulnerabilities, all critical, that could allow an attacker to take control of an affected system running the multimedia platform according to a security bulletin posted today. - See more at: http://threatpost.com/adobe-patches-18-vulnerabilities-in-flash/109300#sthash.YgMJDDtV.dpuf

Hijacking The Secret Sauce: Intellectual Property

I’m always amazed when an employee steals intellectual property (IP) from their company. Only to take it with them as they head out the door for a new job. I wonder what is the thought process that they go through? I’m sure you may know a story or two about people who helped themselves. At one company that I was working for years back, I had set up SNMP (simple network management protocol) monitoring of the printers in the company. In turn that data was fed back into the centralized logging solution. One Friday afternoon I noticed a series of print jobs from a person who I knew had given their notice already two weeks previous. I read the names on the print jobs and I could not stop laughing. He was printing out internal documentation that was not meant to be distributed, let alone taken to his next job.
I picked up my coffee and stifled a smile. I decided to stroll by his desk. I walked by his, let’s call him Frank, desk. I took a sip and said, “Hey Frank. Just packing up?” He looked at me visibly unnerved. “Yup, last day you know.” I took another sip and answered back, “Oh right. Well, best of luck at the new gig.” I winked and walked away.
I positioned myself in a meeting room down the hall and around the corner. I was in a spot where I could see people leaving the building but, I was not readily visible unless someone looked back as they exited. I set up access to the CCTV on my screen and I waited. Thankfully, I didn’t have to wait long at all. Here he came along the hallway with three massive binders full of printouts. I just shook my head. Did “Frank” really think he was pulling one over on people? I was absolutely confused as to his logic.

I picked up the phone and called “Frank’s” boss. After I let him know what was transpiring he quickly slipped down the stairs and was sitting at the front door before the elevator made it to the lobby. They’re slow as molasses in January but, sometimes you really have to love hydraulic elevators.
Needless to say “Frank” was met in the lobby and he surrendered his binders claiming he wasn’t doing anything wrong. He also returned the other large binders that were in the trunk of his car.

This is a type of behaviour that seems to happen a lot. An example that I can point to from another former job is from this article on Ars Technica.

AMD filed a complaint yesterday alleging that four of its former employees—one former vice-president and three former managers—transferred sensitive AMD documents before joining competing graphics chip maker Nvidia and then violated a “no-solicitation of employees” promise. The company alleges that Robert Feldstein, Manoo Desai, and Nicolas Kociuk collectively downloaded over 100,000 files onto external hard drives in the six months before leaving the company. All three and another manager, Richard Hagen, were accused of recruiting AMD employees after leaving for Nvidia.

Since this is already in the public domain I will merely nod my head. I wish I could comment at length on this one but, I can merely say that operations security or OPSEC was not high on their list of priorities.
Another example is the recent case of Dr. Franklin R. Cockerill III who was the president/CEO of Mayo Medical Labs. He was alleged to have been siphoning trade secrets for months prior to moving to a competitor.
Source

 

Data Breach in U.S. Postal Service  

The Federal Bureau of Investigation is leading an investigation into a data breach at the U.S. Postal Service, which affected employees and customers.

In a Nov. 10 statement, which provides few details, USPS says it recently learned of a "cybersecurity intrusion" into some of its information systems. All operations are now functioning normally, according to the statement.
More than 800,000 employees were impacted in the breach, says David Partenheimer, spokesperson for the USPS. Employee information potentially compromised includes names, dates of birth, Social Security numbers, addresses, beginning and end dates of employment and emergency contact information.
Customers who contacted the Postal Service Customer Care Center with an inquiry via telephone or e-mail between Jan. 1 and Aug. 16 were also potentially affected, although USPS is still investigating the exact number of individuals impacted, Partenheimer says. Potentially compromised customer details include names, addresses, telephone numbers and e-mail addresses.

CNN, citing a U.S. official familiar with the breach, says 2.9 million postal service customers were affected by the breach.
Transactional systems in post offices, as well as on usps.com, where customers pay for services with credit and debit cards, have not been affected by the breach, USPS says. There is also no evidence that any customer credit card information from retail or online purchases, such as Click-N-Ship, the Postal Store, PostalOne!, change of address or other services was compromised, officials say.

China Involved?

Some news reports are indicating China may be behind the attacks, but Partenheimer says he cannot confirm that because "the source of the intrusion is under investigation."
But security consultant Richard Stiennon, author of Surviving Cyberwar, doesn't suspect China is behind the USPS breach. "They are still in the espionage and reconnaissance phase of their cyber-evolution," he says. "On the other hand ... one has to question the timing of the notification considering that President [Obama] arrived in China today."
Karl Rauscher, ambassador-at-large and chief architect for cyberspace policy at the Institute of Electrical and Electronics Engineers, says that cyber-attacks, like the one that targeted USPS, are becoming more sophisticated, "and even those best capable of reacting to them are overwhelmed. Cybersecurity today is typically practiced in a reactive posture to an ever growing number of threats."

No Evidence of Fraud

The USPS says it's not aware of any evidence that any of the potentially compromised customer or employee information has been used to engage in malicious activity.
But Dan Waddell, director of government affairs at (ISC)2, a global information security training and certification organization, warns that the incident, which involved the theft of e-mail addresses, could lead to targeted spear-phishing attacks. "USPS employees should be on the lookout for any suspicious e-mail that would serve as a mechanism to extract additional information, such as intellectual property, credit card information and other types of sensitive data," he says.
Impacted individuals are being offered one year of free identity theft protection services, Partenheimer says.
In addition to the FBI, the USPS is working on the investigation with the Department of Justice, the USPS Office of Inspector General, the Postal Inspection Service and the U.S. Computer Emergency Readiness Team. Private-sector specialists have also been brought in to assist in the investigation and remediation.
"We have recently implemented additional security measures designed to improve the security of our information systems, including certain actions this past weekend that caused certain systems to be offline," Partenheimer says. "We know this caused inconvenience to some of our customers and partners, and we apologize for any disruption."

 

Technical Hack Of ballot from Wireless Routers

Good paper, and layman's explanation.
 It gives hackers the potential to seriously disrupt our democratic processes.Its really scary and will leave the democracy no more exist.

Luxurious Attack Using Hotel Network 

Kaspersky Labs is reporting (detailed report here, technical details here) on a sophisticated hacker group that is targeting specific individuals around the world. "Darkhotel" is the name the group and its techniques has been given.

This APT precisely drives its campaigns by spear-phishing targets with highly advanced Flash zero-day exploits that effectively evade the latest Windows and Adobe defenses, and yet they also imprecisely spread among large numbers of vague targets with peer-to-peer spreading tactics. Moreover, this crew's most unusual characteristic is that for several years the Darkhotel APT has maintained a capability to use hotel networks to follow and hit selected targets as they travel around the world. These travelers are often top executives from a variety of industries doing business and outsourcing in the APAC region. Targets have included CEOs, senior vice presidents, sales and marketing directors and top R&D staff. This hotel network intrusion set provides the attackers with precise global scale access to high value targets. From our observations, the highest volume of offensive activity on hotel networks started in August 2010 and continued through 2013, and we are investigating some 2014 hotel network events.

Good article. This seems pretty obviously a nation-state attack. It's anyone's guess which country is behind it, though.

Targets in the spear -- phishing attacks include high-profile executives -- among them a media executive from Asia­as well as government agencies and NGOs and U.S. executives. The primary targets, however, appear to be in North Korea, Japan, and India. "All nuclear nations in Asia," Raiu notes. "Their targeting is nuclear themed, but they also target the defense industry base in the U.S. and important executives from around the world in all sectors having to do with economic development and investments." Recently there has been a spike in the attacks against the U.S. defense industry.

We usually infer the attackers from the target list. This one isn't that helpful. Pakistan? China? South Korea?

 Incident Management its 10X ?

Security is a combination of protection, detection, and response. It's taken the industry a long time to get to this point, though. The 1990s was the era of protection. Our industry was full of products that would protect your computers and network. By 2000, we realized that detection needed to be formalized as well, and the industry was full of detection products and services.
This decade is one of response. Over the past few years, we've started seeing incident response (IR) products and services. Security teams are incorporating them into their arsenal because of three trends in computing. One, we've lost control of our computing environment. More of our data is held in the cloud by other companies, and more of our actual networks are outsourced. This makes response more complicated, because we might not have visibility into parts of our critical network infrastructures.
Two, attacks are getting more sophisticated. The rise of APT (advanced persistent threat)--attacks that specifically target for reasons other than simple financial theft--brings with it a new sort of attacker, which requires a new threat model. Also, as hacking becomes a more integral part of geopolitics, unrelated networks are increasingly collateral damage in nation-state fights.
And three, companies continue to under-invest in protection and detection, both of which are imperfect even under the best of circumstances, obliging response to pick up the slack.
Way back in the 1990s, they used to say that "security is a process, not a product." That was a strategic statement about the fallacy of thinking you could ever be done with security; you need to continually reassess your security posture in the face of an ever-changing threat landscape.
At a tactical level, security is both a product and a process. Really, it's a combination of people, process, and technology. What changes are the ratios. Protection systems are almost technology, with some assistance from people and process. Detection requires more-or-less equal proportions of people, process, and technology. Response is mostly done by people, with critical assistance from process and technology.
Lorrie Faith Cranor once wrote, "Whenever possible, secure system designers should find ways of keeping humans out of the loop." That's sage advice, but you can't automate IR. Everyone's network is different. All attacks are different. Everyone's security environments are different. The regulatory environments are different. All organizations are different, and political and economic considerations are often more important than technical considerations. IR needs people, because successful IR requires thinking.
This is new for the security industry, and it means that response products and services will look different. For most of its life, the security industry has been plagued with the problems of a lemons market. That's a term from economics that refers to a market where buyers can't tell the difference between good products and bad. In these markets, mediocre products drive good ones out of the market; price is the driver, because there's no good way to test for quality. It's been true in anti-virus, it's been true in firewalls, it's been true in IDSs, and it's been true elsewhere. But because IR is people-focused in ways protection and detection are not, it won't be true here. Better products will do better because buyers will quickly be able to determine that they're better.
The key to successful IR is found in Cranor's next sentence: "However, there are some tasks for which feasible, or cost effective, alternatives to humans are not available. In these cases, system designers should engineer their systems to support the humans in the loop, and maximize their chances of performing their security-critical functions successfully." What we need is technology that aids people, not technology that supplants them.
The best way I've found to think about this is OODA loops. OODA stands for "observe, orient, decide, act," and it's a way of thinking about real-time adversarial situations developed by US Air Force military strategist John Boyd. He was thinking about fighter jets, but the general idea has been applied to everything from contract negotiations to boxing--and computer and network IR.
Speed is essential. People in these situations are constantly going through OODA loops in their head. And if you can do yours faster than the other guy--if you can "get inside his OODA loop"--then you have an enormous advantage.
We need tools to facilitate all of these steps:

• Observe, which means knowing what's happening on our networks in real time. This includes real-time threat detection information from IDSs, log monitoring and analysis data, network and system performance data, standard network management data, and even physical security information--and then tools knowing which tools to use to synthesize and present it in useful formats. Incidents aren't standardized; they're all different. The more an IR team can observe what's happening on the network, the more they can understand the attack. This means that an IR team needs to be able to operate across the entire organization.


• Orient, which means understanding what it means in context, both in the context of the organization and the context of the greater Internet community. It's not enough to know about the attack; IR teams need to know what it means. Is there a new malware being used by cybercriminals? Is the organization rolling out a new software package or planning layoffs? Has the organization seen attacks form this particular IP address before? Has the network been opened to a new strategic partner? Answering these questions means tying data from the network to information from the news, network intelligence feeds, and other information from the organization. What's going on in an organization often matters more in IR than the attack's technical details.


• Decide, which means figuring out what to do at that moment. This is actually difficult because it involves knowing who has the authority to decide and giving them the information to decide quickly. IR decisions often involve executive input, so it's important to be able to get those people the information they need quickly and efficiently. All decisions need to be defensible after the fact and documented. Both the regulatory and litigation environments have gotten very complex, and decisions need to be made with defensibility in mind.


• Act, which means being able to make changes quickly and effectively on our networks. IR teams need access to the organization's network--all of the organization's network. Again, incidents differ, and it's impossible to know in advance what sort of access an IR team will need. But ultimately, they need broad access; security will come from audit rather than access control. And they need to train repeatedly, because nothing improves someone's ability to act more than practice.

Pulling all of these tools together under a unified framework will make IR work. And making IR work is the ultimate key to making security work. The goal here is to bring people, process and, technology together in a way we haven't seen before in network security. It's something we need to do to continue to defend against the threats.