Archive for the ‘FAIL’ Category
A Real Cardinal of the Kremlin: An Asset In The Kremlin Exfiltrated and Blown By Russia and MSNBC
Breathlessly and with great hyperbole the MSNBC report came across my iPad as I sipped my morning coffee. The reporter eagerly reporting on their “scoop” of locating, potentially, the Russian source inside the Kremlin’s whereabouts in Washington DC. As I sat agog at their reporting, a mix of “OMG OMG OMG LOOK AT US!” and “Sorry, I can’t report the details because two guys in an SUV came at us after we rang a doorbell!” as the bile rose inside of me. I then took to Twitter and began to get information that surprised me and made it all the worse. It turns out that MSNBC buried the real lede in their reporting. It seems their “tip” on the possible asset that was exfiltrated in 2017 was in fact from the Russian government by proxy of a news site called Kommersant.ru.
The Kommersant article, posted yesterday before MSNBC made their rush to the address of the alleged Russian asset in DC, gives the name plainly, which I will not do here, and links to earlier stories of the missing official who went on vacation in 2017 and “disappeared without a trace”… Of course the Russians would have readily known who the asset was after the EXFIL, but, to post it online was an interesting move. Originally “The Storm”, another Russian news outlet posted in October 2017 of the missing Russian official but no one in the media took note it seems. The updated story in Kommersant though was prompted by the stories in the media about how Trump could not be trusted with intel much like (think Lavrov and Kislyak in the Oval) where Trump released code word intel to them and blew an Israeli operation. As the stories swirled from CNN quoting that the exfil had happened because Trump, the Russians I am sure began to ponder how they could stick a finger in the eye of the US and the CIA.
What they did was just remind everyone that the name of the asset in their opinion was <REDACTED> and that his new address was <REDACTED> in Virginia USA. They actually gave the address in the article. MSNBC got the tip somehow (likely monitoring sites like Kommersant) and immediately dispatched a crew to go to the address and knock on the door Geraldo style and get the scoopy scoop and win the news day! Pay no mind to the potential intelligence disaster it may cause to someone who did a great service to this country.
…But hey HEADLINES! CLICKS! ADS! BYLINES!
Anyway, the asset has been moved I am sure but a lot still needs to be discussed here about this whole thing. I mean, why would they re-settle this guy and his family under his own name? Why would they allow them to purchase a rather large house under their names? I mean, once upon a time when you were exfiltrated from Russia (SOV Bloc) you got a new name and you got some money and lived quietly as you are consistently debriefed. Has the CIA lost it’s collective mind? Is this even the guy? What the hell is going on here? With that question upon my mind I will give this a bit of thought.
Is this the asset in question? … Given the details of their disappearance in 2017, and his role in the Kremlin, I am going to lean toward yes.
Why was this guy allowed to buy property and live in the open under his real name? … I honestly have a few theories:
- The CIA wanted the Kremlin to know as a poke in the eye and a challenge. If this guy gets a polonium enema in the US, shit is gonna go plaid.
- Also, the assets new life in a free country with considerable assets would perhaps entice others.
- His EXFIL was pretty out in the open once he went RED RABBIT, so, perhaps there just was no need for an elaborate re-settlement and name change.
- Lastly, perhaps there is some incompetence going on? Who knows, maybe the asset demanded they live free and under their own name?
What is going to happen now? … Well, if this asset has been moved as I suspect, then they likely will get that name change because they are spectacularly blown because of Kommersant and now MSNBC and all the other services. I mean, I did not name the guy here but Kommersant did and with just the name I tracked them down to the house through sales records online!
Jeez!
All in all, this whole affair just makes me scratch my head. I mean, we are really through the looking glass in 2019 with everything that has been going on since 2016 but wow. This whole thing at least moved me to post, something I have been uninterested in doing for a long while now, so there is that. I will watch the game unfold and see what plays out. I gotta say though, recent events regarding losses for the CIA in China and Iran have me worried that we have lost some of our skill sets in HUMINT. I would love to find out that this whole debacle was really a play at something larger by the CIA, but, I fear it wasn’t.
Interesting times…
K.
Equifax and Musicians
So here’s my thing; It isn’t about the fact she was a music major and had two degrees in that. What it is really all about is the fact that she had no discernible security experience in the time she was working in the position or before to make her qualified to handle the job. THIS IS THE ISSUE PEOPLE! It is not about that she had a degree in nothing to do with security. So please stop all the 140 character bullshit and get it through your thick heads that even if you have a degree in IT this does not make you qualified necessarily to handle a job in information security ok?
Now that the CSO’s and CISO’s linkedin pages are redacted you can’t see much of anything but before they took them down I looked and neither had the requisite experience that would make me consider them for a position as an executive in charge of insuring that the security of the company and more importantly, the security of the clients data was in capable hands. Look. let’s face it you can say that the exec is just there as an advocate or to manage Trust me though, if they have no experience in the arena either they listen to their guys in the field and implicitly trust them and advocate or they just are compliance monkeys of the worst order.
I have lived it and I have seen it throughout my career in security. So please stop all the fuckery about “I have a degree in animal science and woe is me I am unfit for security!”
BULLSHIT
If you have a degree or not, you have to have put in the hours of study and actually doing the things! If you haven’t then you are out of your depth and bad things will happen.
Just look at Equifax.
K.
ASSESSMENT: Target Media and Lawsuit Failures
The Target Hack Media Failures:
From the moment that Brian Krebs first put out his story on the Target hack it’s been mostly a feeding frenzy of reporters trying to out scoop not only Brian but everyone else they could leverage to get a headline. Throughout the whole affair though there has been a lot of speculation on how the hack happened, the timelines and just what if anything Target knew about what was happening to them as it was going on. Since the first report we have come a long way to understanding through confidential sources just how the happened but the reality is that there are many things still unsaid about the hack itself with any certainty.
The biggest hole in the whole story to date has been how did the hackers infiltrate into Target in the first place? After looking at data that Brian had shown me and doing my own research on Rescator and the Lampeduza he and I came to some conclusions on how they most likely got into their systems. Primarily the phish on Fazio allowed the attackers to gain access to Target’s booking/payment systems for doing business with their vendor’s online. It was a supposition on my part that they used an infected Excel sheet, doc file or pdf to gain access to the peripheral system connected to the internet by passing it with the stolen credentials to Target’s online system. Once a user had the file inside they likely opened the document and infected themselves and thus allowed access to the general network. Of course then it become simply an issue of locating a machine that sits on the LAN where the servers and the POS can be accessed.
The media generally though has been harping on the idea that since Fazio is an HVAC company that they had access to ICS or PLC units within the Target network as this is all the rage in the news. There never has been any proof of this happening and in fact Fazio has made a statement saying they never had access to the Target HVAC systems remotely as they don’t do that kind of work for them. This however escaped the media in general as well as some Infosec bloggers that I know as well. Now however we have a new twist on this media festival of failure with the advent of the Target lawsuits recently brought out by banks involved with this mess.
The Target Lawsuit Failures:
The Target lawsuit now not only goes after Target Corp itself but also Trustwave, a security company that allegedly carried out the Target PCI-DSS (Payment Card Industry) assessment at or around the same time as the compromise to Target was happening. It was at this time that Trustwave certified that Target was in fact “PCI Compliant” and that in the industry’s eyes secure. Of course this is a misnomer that many in the security field have been venting about for years and the popular euphemism for it is “Check box Security” because in reality it is just a check mark on a form and not a real means of protecting data.
The lawsuit is filled with ill informed views on what happened to Target as well as how security works and has been roundly regarded in the security community as well as the legal community as a joke. Using dubious sources on cyber security and primarily believing all that the media has written on the subject of the Target breach this lawsuit makes assumptions about the PCI that are common and untenable. One of the more egregious failures in comprehension is that any system of checks and or regulations would make any system or database secure just by the very fact that you have checked off all the boxes in a list of things to do. This is especially the case with PCI due in a larger part because of the way it is audited and by whom.
PCI-DSS Failures:
One of the real issues that seems to be coming out of the lawsuit and the reporting on it centers on encryption of data. The encryption of data at rest (in a database) or in flight (on the network between systems) is the crux of the issue it seems to the legal team for the litigants in the Target affair but I would like to state here and now that it is a moot one. The idea is that if everything is encrypted end to end then it’s all good. This is not the case though as in the case of this particular attack on Target the BlackPOS malware that was used scraped the RAM of the systems which was not encrypted and usually isn’t. This is a key factor in the case and unfortunately I know that the legal teams here as well as the legal system itself are pretty much clueless on how things work in technology today so this will just sail right over their heads.
Here are the facts in as plain a way as I can get across to you all:
- BlackPOS infects the system and scrapes the RAM for the card data
- BlackPOS then copy’s the data and exfiltrates it to an intermediary server to be sent eventually to the RU
- The data is not encrypted at this time and thus all talk of encryption of data or databases is moot unless said data came from database servers and not copied from POS terminals
- Encryption therefore in database or on the fly is a MOOT POINT in this case
There you have it. It’s a pile of fail all the way round and the media and the law are perpetuating half truths and misconceptions on how things really work in the digital world. There are many issues with PCI-DSS and the encryption issue that is cited in the law suit and the Wired piece linked above are just silly because the writers and the lawyers haven’t a clue. While PCI needs to either die a quick death for something better it is not the only reason nor the primary one that the attack on Target worked. There are of course many other reasons due to inaction that have been brought forth recently that do paint quite another picture of ineptitude that are the real culprits here.
Analysis:
Overall the analysis here is that there are many to be blamed for this hack and not all of them are the adversaries that carried it off. The fallout now with the lawsuits and the press coverage of the debacle has only amplified the failures and is making things worse for some and better for others. We have seen an uptick already in finger pointing as well as sales calls laden with snake oil on how their products could have stopped Rescator cold. The fact of the matter is Fireeye and Symantec both tried but the end users failed to allow it to act as well as heed their warnings. Of course one also should look at this and see that even if the tools had been heeded it may not have stopped the attack anyway without a full IR into what was going on.
The people who are any good in this business of security live every day with the assumption that their network is already compromised. This is a truism that we all should take to heart as well as the knowledge that we cannot stop every attack that is carried out against us. We can’t win every battle and we may never win the war but we have to try. Targets failures will hurt for some time within the company as well as to those who were working there at the time. I have no doubts that heads rolled and perhaps that was necessary. It is also entirely possible that people did try to stop this event but were told not to do something because it might affect their production environment. Of course this is all speculative but you people out there reading this from this business know what I am talking about. It’s a universal thing to be shackled in your battle to secure the network because it affects the bottom line.
What I would like you all to take away here though is that PCI is not the only reason for this hack and certainly it isn’t because Target was not encrypting their traffic or their databases. This is just a ridiculous argument to be having. Just as ridiculous as it is to have the cognitive dissonance to believe that checking a box in an audit makes anything more secure.
K.
YES WE CAN! (deploy a website without security and expect everyone in the nation to put their personal details into it)
Zep whpcd as Sdefp Ihfctv jfg ti!
Hackers In The House
I sat in horror and increasing rage inside my office watching the live online stream of the House committee’s Science and Technology meeting concerning the security of healthcare.gov. Horror and rage that were fuelled by cogent statements made by a panel of security experts that shown light on the fact that the US government had completely abdicated any responsiblity for security on the healthcare.gov site. My rage came from the responses by house members who for all intents and purposes but by the grace of god have the ability to wipe themselves in the morning after their daily ablutions.
The hackers or more to the point security professionals that included @hackingdave made a reasonable argument that the healthcare site was in fact fundamentally flawed where security was concerned and that it seemed that the government had in fact not considered the security import of the nature of the data they were to traffic in. SQL flaws are abundant on the site and the interconnections to backend databases including places like the IRS will make it the single point of failure for what I am sure will be the worlds largest compromise of PII data on the planet short of the machinations of the NSA.
While I understand that many of the players in the House committee are not technically capable of even programming a blinking VCR properly, I expect that they could actually listen and comprehend the basic fact that identity theft is a large issue today in the world and that this site would be a gold mine to anyone perpetrating such a crime. It seems though from watching many of these dullards questions to the panel this week that most in the halls of power cannot conceive of anything more than what they are going to have for lunch later and what party line they are going to tow.
Healthcare.gov Is A Ticking Time Bomb
To put it plainly the healthcare.gov site is a bomb just waiting to go off. The vulns that were discussed in the hearing and on the blogs thus far are not out of the capabilities of many of the bad guys online today and will be exploited. …That is if they haven’t already. What I heard in this hearing made me cringe due to the ease of the attacks as well as the seeming lack of due diligence on the part of the Canadian firm that made it not to mention the US government’s abdication of controls to be implemented in design.
As the panel pointed out the federal government wants us to not only become accustomed to using all of our PII to log into this shitty site but also that by inference, they don’t give a damn about our privacy never mind out PII or HIPAA data by the size of things. All that really counted in the creation of the healthcare.gov site was the speed at which it could be implemented. Something that as we have seen also caused as another byproduct, a shitty infrastructure that failed to handle the load required. Now ponder the code errors that live within the massive amount of code and your head will explode from the security failure potential here. I am pretty sure that the code has not been vetted properly from a rugged devops standpoint so let’s just assume that it is riddled with bugs.
Lest we not forget too all of the back-end database connections, infrastructure design, and implementation that in all likelihood is greatly flawed as well and one might lose sleep at night. I sat through the committee meeting also wondering about what mitigations that they may have for security on the DMZ/Back-end/internally such as SIEM, Firewalls, and IDS/IPS. Do they have any? A question came up in the meeting that had me even wondering IF they were logging event logs for security at all within this Rube Goldberg device they are calling healthcare.gov as well.
In the end I think the House and the Senate should really look at this whole issue and DEMAND that an accounting be made of the security that may or may not have been built into this site’s code base, the way it is run, and all the connections to the various back-ends in other government facilities and databases BEFORE we start signing up anyone else to it. I don’t give a fuck about the politics of it! They have done a shitty job of protecting the American citizen’s interests here from both parties machinations and it has to stop.
Perhaps “someone” should start a petition on the whitehouse.gov site for an investigation to be carried out?
Just a suggestion…. Or wait.. Is that site down now too?
Media DERPOUT
Oh well it’s not like all this security stuff matters really I guess judging by the response of the media to this story. A day after the hearing only one major news source (ABC) had a story that Google could find. The rest of the media seem to be blind or ignoring the large bag of fail that is the security posture of the healthcare.gov site. Even now days after the fact the news media seem rather tepid on it all. We will I suppose, have to wait until the ultimate compromise happens to a majority of the US citizenry’s PII data and other records to happen before it makes it even to NPR as a story huh?
What makes me wonder though is why none of this seems to be lighting a fire under anyone other than the security community? Is it because as we all well know in the industry that we speak a foreign language than the rest of the world? Is it because we are seen as Cassandra’s or boys crying wolf? I am flummoxed about this really and I could spend time pondering over the psychological aspects of denial and comprehension of security risks but I find of late there just is no point anymore. We are fucked and there is naught we can do about it. I think Dave and the panel could probably attest to that now but probably more so as time passes and nothing is substantively done about the security of this site.
So go get your healthcare people! For every 100th visitor your data gets a free trip to Ukraine!
K.