The Target Breach: How Network Security Best Practices Could Have Prevented It

Who would have thought that an HVAC system could lead to the data of millions of people being compromised? Target surely didn’t. Recently, it has come to light that the Target breach hackers likely gained access to the areas of its network where customer information was stored by remotely infiltrating the company’s HVAC system contractor. Let’s break down how this particular Advanced Persistent Threat (APT) was able to access Target’s customer information: It all started with an email attack, according to information security expert Brian Krebs. The malware-laced email was likely sent out to a broad range of targets gleaned from Target’s public-facing vendor documentation. It was then downloaded by a contractor at Fazio Mechanical, a heating, air conditioning and refrigeration firm, hired by Target to maintain its HVAC system. The likely malware downloaded was Citadel, a password-stealing bot that is derived from the ZeuS banking trojan. The malware was undetected by Fazio Mechanical’s malware prevention software, the free version of Malwarebytes Anti-Malware. Because the company was not using an enterprise-grade or real-time solution, the malware was able to compromise the employee’s password, thus gaining access to Fazio Mechanical’s entire network. If Target had the right access control and central management mechanisms in place, this is where the malware would have been stopped. From there, the hackers connected to Target’s network and accessed the parts of its network that Fazio Mechanical had access to, its external billing system, called Ariba, and several project management-related portals. According to an unnamed source who was formerly employed by Target on its security team, “the Ariba system has a back end that Target...

Why Enterprises Are Struggling So Much with Encryption

Encryption. For most organizations, the need for it is very apparent, but for some reason, its implementation often falls well short of goals and expectations. The obvious question here is: why? A recent Ponemon Institute study took a closer look at what exactly is giving enterprises such a headache when it comes to efficiently using encryption. The results were interesting, to say the least. According to InformationAge, the research, which included more than 4,800 business and IT managers worldwide, unsurprisingly revealed encryption use is on the rise, as companies try to stay ahead of growing privacy and compliance regulations, consumer concerns and increasingly sophisticated cyber attacks. In fact, 35 percent of organizations now have enterprise-wide encryption, compared to 29 percent last year. What was surprising, however, was the apparent objective shift, “For the first time, the primary driver for deploying encryption in most organizations was to lesson the impact of data breaches, whereas in previous years the primary concern was protecting the organization’s brand or reputation.” An alarming fact found in the study is only 20 percent of organizations polled think they are obligated to disclose data breaches, and of those, nearly 50 percent believe that because the data is encrypted, that circumvents the need to publically acknowledge an infiltration occurred. While the ethics of those policies are certainly subject to debate, a bigger problem perhaps is that all organizations surveyed are challenged with simply finding their sensitive data, as more than 60 percent agree that discovering exactly where it resides is the greatest challenge to deploying an encryption policy. More than half also agreed managing keys and certificates...

A Closer Look at the Android VPN Flaw

It’s been a rough couple of years for Android devices. Sure, there may have been more than 900 million of them activated in 2013 alone, but those impressive sales numbers do nothing to inhibit cyber criminals from exploiting these open source devices. We’ve discussed Android vulnerabilities at some length, and have demonstrated how a centrally managed VPN as part of a defense in depth secure remote access framework can mitigate many of these threats. However, the recent revelation from Ben Gurion University of malicious apps that can be used to bypass VPN configurations and push communications to a different network address changes the conversation entirely. As Jeffrey Ingalsbe, director of the Center for Cyber Security and Intelligence Studies at the University of Detroit Mercy, told SC Magazine, that’s because this new vulnerability “attacks one of the [security] pillars we thought we could count on in the mobile world,” – VPNs. Ingalsbe is right – VPNs have been a cornerstone to secure remote access to corporate networks for a long time now, and the possibility that the peace of mind they ensure has been compromised is alarming. However, if we take a closer look at the vulnerability uncovered by Ben Gurion University, it becomes apparent that cyber criminals are attempting to use an old trick in a new disguise. Man-in-the-middle (MitM) attacks, a form of which the researchers used to bypass VPN security, are actually pretty simple. They are designed to intercept communications between two endpoints (e.g. an Android device and a corporate network) before those communications have entered the safety of a VPN’s encrypted tunnel. Instead, the unencrypted data...

Stopping Remote Access Breaches with “Honey”

Encryption has long been one of the most effective tools to prevent the exposure of sensitive data. As such, hackers are constantly working on new ways to crack encryption algorithms and exploit lapses in security. Information security professionals must be ever vigilant and constantly create innovative new methods to thwart attacks. Recently, one interesting new encryption security method has come to light that takes inspiration from another, quite different tactic, honeypots, to trap and confuse hackers. The new approach, called “Honey Encryption”, could potentially offer more effective digital security by making fake data appear to be legitimate and valuable information to hackers. The project, developed by former RSA chief scientist Ari Juels and the University of Wisconsin’s Thomas Ristenpart, is currently a prototype and takes advantage of the brute-force cracking methods used by attackers. With each incorrect guess a cracking program makes, the software adds a piece of made-up data to the dataset. For example, if a hacker is trying to break into an enterprise’s credit card database, the program will create numbers that look like real credit card numbers, instead of the gibberish that attackers would currently see. With thousands of attempts in a typical attack, hackers will be bombarded with fake information, making it enormously difficult to determine whether information is real or not. Currently, the prototype only protects encrypted data stored in password vaults, but the technology could have tremendous future implications for other forms of encrypted information. One day, a similar program could perhaps generate bogus but plausible network communications when a hacker is trying to break into a VPN’s encrypted tunnel. Or, a hacker...