Insights For Success

Strategy, Innovation, Leadership and Security

How to protect your PC from infection

GeneralEdward KiledjianComment

Think of all the valuable data your PC contains (pictures, files, invoices, contacts, etc). Now imagine losing all of that data Virus' are still a thing but you should be more worried about ransomware, worms and all of the other digital creepy crawlies roaming the net looking to make you their next victim.

Go read my article entitled "How to secure Windows 10".

Backup everything, then back it up again

In 2012, I wrote an article entitled "The best way to protect your data - images, music, documents". The main point is that you should always remember the 3-2-1 rule of backups:

  1. Have 3 copies of all of your important data (1 primary and 2 backups)
  2. Make sure your 2 backups are on separate media technologies (e.g.1 on a hard drive and the other in the cloud or 1 on a hard drive and the other on a tape backup)
  3. 1 of your backups should be offsite in a remote location that would not be impacted by a major disaster that hits your area (e.g. in the cloud).

The advantage of most cloud backups is that they support version control which means if you infect your files with ransomware, you can always go back to  a known good version. My backup strategy involves:

  1. 1 primary version of my data and a local hard drive backup
  2. 1 complete synchronization of my files on a fully encrypted trust no one online storage service
  3. 1 complete backup using a remote backup service (like backblaze or carbonite)

Update everything

WannaCry created an incredibly outcry in the tech world with thousands of companies getting infected in hundreds of countries. The truth is that an update published 2 months prior patched that vulnerability. Updating computers in large companies is complicated but your home PC shouldn't be.

You must must must update your operating system and applications regularly to stay protected.

The latest version of the operating systems from Microsoft, Apple and Ubuntu are all configured to auto-update themselves. In addition to the OS, make sure you periodically check for application updates.

If you use an Apple Macintosh computer, you may even want to use something like MacUpdate Desktop to constantly check if any of your installed apps have updates available.

Leave the built-in firewall on

Some "Security" apps turn off the built in firewall but it is critically important to ensure it is always on. On Windows, you can turn if on/off with these instructions. You can find information about the Apple Mac application firewall here

Use an antivirus

The question I get asked the most often is should I buy a third party antivirus for my home computer and my answer is no. Anytime you add a third party tool, you increase the attack vector therefore rely on what Microsoft bundles with Windows 10. You can follow these instructions to change the Windows Defender Antivirus cloud-protection level to 10.

In February I wrote an article entitled "Companies buying bitcoin to prepare for cyber extortion" and in there included this paragraph:

Companies have started to jump on the Ransomware protection bandwagon. An EDR &”next-generation AV” company called Cybereason offers a free product called RansomFree. They claim it protects against 99% of ransomware by monitoring how applications interact with files on your computer. Did I mention RansomFree is free? I haven’t used their product and thus can’t recommend it but it does seem to be useful and could really help the average consumer ensure they don’t end up getting victimized.

You can run something like RansomFree on your home PC in addition to the Windows antivirus. 

Upgrade the fleshware

The truth is that even the best most advanced technology can't prevent an infection if the user does something stupid. Often users are the weakest link the the corporate security chain and you are no different. 

Using good security hygiene will go a long way to protecting you. Basic tips:

  • never open an attachment from a user you do not know well or that you are not expecting
  • never click on a link embedded in an email
  • never install applications from untrusted sources (including torrents or anything pirated)
  • Remember that you can also get infected from a website so use Google Chrome with the the Ublock Origin plug-in

What to do if you get infected?

If a user's PC or Mac does get infected, their first thought is to find someone that can clean it. The truth is that once your PC is infected, it can' really be cleaned properly or trusted. At that point, you must do  a clean re-installation from a known clean source and then recover your files from a known good backup.

Some technical support companies will offer cleanup services but don't do it. Once your PC is infected, you don't know what else could be lurking in the background waiting to strike again. The best course of action is to start fresh.

Hopefully you have backups and everything will work out just fine. If you don't have backups and your files are encrypted by ransomware, you can always check out a free online site called No More Ransom Project and see if they offer a free decryptor for your ransomware. There are no guarantees your infection strain has a decryptor but it doesn't hurt to check.

 

Your cloud provider is making you a target

GeneralEdward KiledjianComment

Phishing is a powerful and effective tool and a favorite in the threat actor arsenal. So what happens when your cloud provider gives threat actors a roadmap to steal from you?

A couple of weeks ago, Workday sent a security advisory to its customers regarding a phishing campaign targeting its customers. Although details of the attack campaign are light, here is what I believe is happening based on discussions on various darknet forums.

What was the Workday phishing attack model?

First, none of this is a weakness or vulnerability in Workday or any of its systems or processes. The threat actors send an email to employees, pretending to originate from a high ranking executive (CFO, CEO, SVP HR, etc.) and are asking, asking them to log into "Workday" to fix an issue. This fake Workday site harvests the credentials which then allow the threat actors to log in and change direct deposit accounts for employees thus stealing money. 

Based on reports I have seen, these emails are professionally written (so they do not contain the telltale signs of being a scam) and are currently not being caught by many large spam filtering services.

How did Workday facilitate this attack?

Like many SAAS and cloud service providers, Workday proudly displays a ling list of satisfied customers on its webpage. This marketing list basically becomes an attack plan for these threat actors by knowing exactly which customer to target with which SAAS provider name and which attach to use. 

Security is a balancing act. It always has been and always will be. Ultimate security means severely reduced usability and no marketing. More marketing and usability means less security.
 

Security is a balancing act

Marketing is tasked with growing the business and nothing helps more than social proof (aka showing others that have made the same decision you are thinking about). The fact Workday marketing is publishing hundreds of customer names on its website is aligned with their objective of supporting business growth. After all, why should marketing avoid using all of the tools available to it just to protect the business from some attack that may or may not occur?

Even if marketing hadn’t published an exhaustive list, they probably would publish a press release when a new big-name customer was signed. This means a determine attacker could build his own list of high-value targets. Right?

As an example, they published this press released in April entitled “Workday Continues Momentum in Canada.” This wonderful piece of marketing includes this section:

To be clear, this is not a Workday issue but a generalized cloud services provider issue. As an example, a service provider called CVM solutions has a customer search on its webpage:

 

Where does marketing end and security start? 

Stop making it easy

In addition to publishing a customer list, most Software As A Service (SAAS) companies publish a custom login page for each customer (which is usually pretty easy to find).

In Workday's case, you go here

Enter the customer name of a customer and find their login page

Again this is a common practice by many large SAAS providers. Even a giant like Microsoft does this for their Office 365 in the cloud offering. I searched the web for Microsoft Office 365 success stories and stumbled on blog post. 

So I know the American Cancer Society uses Office 365. I then need an email address to plug into the portal page so Microsoft switches me to their customized Office 365 login portal. In this case, I chose to use a service called Jigsaw.com (from Salesforce.com) and found the email address of their CEO.

Keep in mind that finding email addresses is easy. There are billions of them on the web. There are dozens of hacked site database dumps every week. This is trivial but I chose Data.com just to show it visually here.

You then are sent to the appropriate login page for authentication.

If you are a threat actor, you scrape this page, register a close-looking URL and then target all of the users of Cancer.org you can find (remember there are huge lists everywhere on the web and darknet if you know where to look).

Let's be real

Marketing is a business necessity and every company has an obligation to maximize its top line by leveraging everything it legally can. As a potential customer, I love hearing about other customers that have already chosen the product I am evaluating and learning how they leveraged it to improve their operations (Social Proof - Social Influence). If a vendor tells me that one of my main competitors chose their product and that it is contributing to their success, I really want to know more. How can I leverage their tool too?

If I am a threat actor and determined to phish a particular company, there are other means for me to collect the data I need. A popular technique is called Open Source Intelligence (OSINT for short) and the folks at Rapid7 provide a nice example here

Using OSINT techniques, they provide a list of customers that include SAAS providers in their publicly available SPF records.

So the question is how easy to we want to make it for threat actors? OSINT is intelligence gathered from public legal sources but it still requires a more sophisticated attacker. Publishing a list of customers on your website means even the most garden variety kiddy "attacker" can easily target your customer.

I've spent half my career on the consulting and services provider side and understand the hugely powerful tool of social proof. If I tell a small shop owner other small shops (like his/hers) are using a tool and have found it immensely useful, that is a huge motivator. People love seeing others like them making the same decisions. It validates their choices. 

The company I work for recently conducted product reviews for various security tools, and  having spoken to another large multinational customer was one of the reasons we chose that product. It validated our findings and also showed others (like us) made the same conclusions.

There is no real answer

I'm going to disappoint you and say there is no magical silver bullet . Obviously user awareness is critical, since most often, the human firewall is what will allow or prevent an attack. 

Companies have and will continue using customer names to convince the next prospect to jump on-board. Threat actors will always continue to be create and find news ways to do bad things to good companies.

I believe the only solution is to ensure marketing and security are talking regularly and openly about strategy and impact. It is only through tight collaboration built on mutual respect and trust, that companies can decide what the right balance is between public disclosure and security.

To a hammer, everything looks like a nail. To a security professional, everything looks like a security vulnerability, but it is important to remember that sales is the only reason you are around. Our job as security professionals, is to provide enough security to protect our customers and support our business objectives. 

Michael Moore launches Trumpileaks using strong encryption tools

GeneralEdward KiledjianComment
Image by g4ll4is used under creative commons license

Image by g4ll4is used under creative commons license

American politics is an extremely divisive issue and I will not be taking any sides in this debate. The purpose of this article isn't to promote any sides but rather to talk about how encrypted communication tools are being used.

Michael Moore launched a sub-page to his domain called Trumpileaks. The purpose is to give whistle blowers a "secure mechanism" to share information. 

The website recommends a bunch of encrypted messaging apps to share information via the web or by traditional mail. It recommends the use of Signal, Peerio, WhatsApp, Encrypted Email (Protonmail), traditional mail or general email if you just don't care.

These tools are very good for general secure communication but not if you are trying to "hide" from the american intelligence community. All of these tools leave a crumb trail of meta data which can be tracked back to you and the fact this isn't mentioned is irresponsible (my opinion).

What follows is not an exhaustive operational security guide (OPSEC) but just general recommendations.

Protecting your network access

The first thing you will want to do is protect your network identity, which would be used to narrow down a list of suspects when trying to identify you. 

Connect from free WIFI

The first recommendation is to use free open WIFI in a location away from your normal living areas (home, work, etc). Chose a place that is relatively far away like a coffee shop. Before using it to leak info, make sure you visit it looking for cameras in and around the area. When visiting it do not buy anything or leave any trail you were here. 

Remember that your cell phone is a beacon that broadcasts your location constantly and turning it off doesn't work. Either leave it behind or place it in a cell phone blocking Faraday cage bag (buy or make your own). You must block your signals before leaving your house.

I recommend going to your end location using public transit (since your car can get tracked via license plate or in-car navigation). Pay using anonymous transit tokens purchased with cash.

Use an anonymous VPN

Once you have found a good location, you will need a VPN device like the Invizbox (review here or you can buy it here. Since you will use this once, I recommend buying one with 2 months of VPN access. Invizbox allows you to buy via Bitcoin so do that. Make sure you setup a non trackable one time use bitcoin wallet for this transaction and ship the device to a fake name/fake location (so it can't be tracked back to you). 

Set up the Invizbox a couple of days before using a secure machine (described later), at another anonymous WIFI location using fake information. 

Use a service like Fake Name generator to help you create your fake identity. 

When setting up your Invizbox Go, use their VPN service to connect to a location like Switzerland. but do not use their TOR service.

How to buy anonymous bitcoin

Cash is king but for some transactions you may need bitcoin. You can use a site like LocalBitcoins to find a local Bitcoin trader that will allow you to pay cash and stay anonymous. 

I am not endorsing this trader, I am providing this as an example only.

I am not endorsing this trader, I am providing this as an example only.

Keep transferred amounts small so as not to arouse law enforcement interest (less than $500 per transaction). Use a disposable cheap android phone to host your bitcoin wallet and load only 1 identity on it. 

Create a fake identity that cannot be traced back to you. Buy burner phones cash. 

Remember, making one mistake will cause your anonymity to fall.

Protecting your Operating System

Use a secure Operating System with TOR

Your computer can be compromised to leak your identity. Even without being compromised, it leaks your identity all the time. Not only do you leak data but the unique setup of your computer leaks your digital fingerprint to any site that wants to track you (article here). If you want to test this yourself, check out Panopticlick

Hopefully you now agree that traditional operating systems aren't secure enough for the purposes of anonymity. You will need an Amnesic Incognito Live System called TAILS. This is a free operating system that you boot from a USB key that is fresh everytime you use it and doesn't leave any forensic traces on the machine it was used on. 

Tails also routes all internet traffic through TOR or I2P (use TOR). So you will use the Invizbox Go to tunnel to Switzerland and then you will use Tails with TOR to get to the dark web.

Tails is built for privacy and has a specially designed browser to minimize tractability. Ensure you follow the instructions to double check the integrity of the file you download. You will then need 2 fresh USB keys to built the final Tails USB bootable system.

You will have to make sure you laptop is compatible.

Protecting your transmission

Secure email

If you are going to use email, then make it as secure and anonymous as possible. Use a free Potonmail account (review here) via TOR. 

Anonymize your style - Stylometry

Well funded threat actors and nation state intelligence are able to identify people using stylometry. This is a technology that analyzes your writing style and then uses this knowledge to de-anonymize your content on darknet sites. 

Think of stylometry as a digital fingerprint built against your writing style (how to evade stylometry) . You may also want to checkout the Anonymouth tool  from The Privacy, Security and Automation Lab (PSAL) Drexel University, Philadelphia PA. 

Using Anonymouth will allow you to engage online while minimizing the intelligence community's ability to perform stylometry on you.

Michael Moore should setup a TOR SecureDrop service

The best way to send information as a leaker is to use a TOR service hosting SecureDrop (create by internet privacy advocate Aaron Swartz). It is an encrypted dead drop used by journalists to collect info from whistle-blowers while protecting their identity. 

The Freedom of Press Foundation has taken over the project since Aaron's death and helps media organizations install and run the tool. the FPF is addressing all of the shortcomings of the original tool

Don't trust printed leaks

You may be thinking printing and mailing is the best option but it isn't. Many printers have a hidden feature which adds invisible identification to every printed page (see EFF article here). These "invisible" yellow dots allow intelligence agencies and police to track down which printer printed a document. Recently this technique was used to track down an NSA leaker when a picture of a leaked document was show by The Intercept and the NSA found out the document was printed on one of its documents.

If you are interested, you can read about this technique here

Conclusion

Simply following the basic instructions on the Trumpileaks website is irresponsible and dangerous. Ask yourself what would be the impact if the leak was tied back to you?  Are you willing to live with the consequences?

Even with strong knowledge and good security hygiene, perfect anonymity does not exist on the internet. If you are determined to leak, learn how to do it and take the above precautions but know there is always a risk you will be discovered.

Best 360 degree camera for consumers

GeneralEdward KiledjianComment
Nokia Ozo. Photo courtesy of Nokia.

Nokia Ozo. Photo courtesy of Nokia.

360 degree videos are the new THING because they capture more of the experience you are trying to share. Facebook, Youtube & Twitter all support this new more immersive medium. So the question is "What's the best 360 degree consumer video camera available?" Good question considering your local BestBuy has over a dozen in store and on display.

Having tested about a dozen of them, the best one is still the Ricoh Theta S. 

img_s_mainVisual.png

Ricoh

Theta S

Why the Theta S? First it is easy to use. You press that big button and it starts to record. It has built in WIFI that allows you to review the captured content or control the camera with your smartphone. Last but not least, it captures good quality video.

Video is good but not great

When buying one of these devices, it is important to understand that you will get good video but it won't be an ultra sharp crystal clear 4K video (like one coming from a mid priced DSLR). The video quality will be good and acceptable but the manufacturers chose not to go super high quality because the stitching would require too much horsepower. 

Some technical specs

So what kind of sensor does this little device have? It has 2 12 megapixel sensors and  ultrawide 240 degree lenses. The camera then processes these two inputs and automatically created one 14 megapixel video (at 1080p) that automatically hides the camera. 

Pair this 360 degree video with some kind of VR headset (even a cheap Google Cardboard) and you get wonderfully imersive video that feels like you are in the moment. You can move around and see everything. This means you (as the photographer) have to consider this immersive experience when taking the video. Be cognizant of how you are holding the camera. 

Let's talk quality of video

So the Ricoh Theta S produces some very good video with good color reproduction (even is low light situations). Using the smartphone app, you can tune basic settings like exposure compensation, shutter speed, ISO and go fully manual (which I don't recommend).

Video clips can be up to 25 minutes long. Let's be honest, you videos shouldn't be longer than this anyway.

Let's talk device in hand

The Ricoh Theta S is a slim device which means it is easy to hold even for people with smallish hands. It is thin and long and a bit thick (which makes holding the device easy and comfortable).

It has a nice easy to hold onto plastic surface that has good grip. It has a standard tripod mount on the bottom which means you can easily mount this to any tripod (including a flexible Joby Griptight).

The device is easy to use and allows you to quickly switch from 360 degree videos to 360 degree pictures and back. All without having to fiddle with finicky menus or having to use the smartphone app. You can turn WIFI on or OFF (WIFI sucks battery so turn it off when not needed).

Let's talk battery life

Richoh doesn't provide good information about battery life. Assuming you are using the device for videos and have WIFI tuned off, you can expect about 1 hour of use time on a single charge. The device does not have a removable battery so you'll have to charge it with a portable battery when in the field. 

It's a 360 degree video

The output from the device is either a JPG or MP4 file with metadata identifying it as a 360 degree video. You can upload this to Youtube, Facebook, Twitter or Flickr and it will identify the file appropriately and then perform all of the required processing in the background to make it immersive and navigable.

Each 1 minute of video consumes about 100MB of storage and if you transfer it via WIFI to your phone will take 3-5 minutes. During this time you have to leave the app open and therefore won't be able to do anything on your device (or you can transfer it via USB if you have a laptop).

The free Theta+ or Theta+ video apps let you edit videos and even create non 360 degree cropped output files. They are fairly basic but allow you to add text, music or trim the video length.

When possible, use a tripod (even a mini one) to hold the camera otherwise you are likely to see fingers in the shot as you press the recording button. Or use the smartphone app to start/stop recording.

It can live stream

The Ricoh Theta S can also live stream when connected to a desktop with the special Theta software loaded on it (Mac and Windows). To enable live streaming you "Press the shooting mode button and power button of the camera together". 

You can live stream your 360 degree masterpiece to Youtube or Facebook. You may want to add the free OBS Studio app to the streaming mix.

Important considerations

  • First is the price. At roughly $350US it isn't a cheap product and it can't be your main or only recording device. 
  • It doesn't shoot in 4K. Considering most people will be viewing this content on VR visors, smartphones or in web browsers, this should be a major problem but it is important to remember.
  • The built in 8GB of storage (no SD Card support) is annoying. It's major competitors (Nikon Keymission 360, Samsung Gear 360 and Insta360 all accept nano SD cards).
  • Without a removable SD card, you also can't just "pop out" the card and transfer data at super fast speeds using a USB card reader.
  • If you edit the 360 pictures, some editors will strip the 360 degree marker from the metadata and the uploaded sites won't know that it requires special handling. You can add this back but its a pain.

Conclusion

If you want to buy an affordable, easy to use 360 degree video camera, the Ricoh Theta S is the one to buy today. It offers the right combination of quality, price and features. With everything said and done, it is still early days and the experience still isn't perfect.

I wouldn't recommend my parents go out and buy this. Not yet. Not right now. If you have a desire for 360 degree video then go out and get one. You won't be disappointed as long as you remember it's not a mass market product yet.

For John and Jane Doe, the technology still needs to mature and improve a bit.

 

 

 

Downloaded over a billion email addresses and passwords this weekend

Edward KiledjianComment

I am a CISO (Chief Information Security Officer) for a major tech company and manage people, budgets and strategy. But the security researcher in me never went away. Over the weekend our intelligence service downloaded 3 separate dumps totalling over 1B leaked credentials (the largest of which was the 400M+ credentials.)  The smallest one was a Pastebin dump that contained 6,500 email addresses with cleartext passwords (I was able to verify 3 email/passwords listed in the list by contacting people I recognized on the list).

We use these list to check for employees that may be impacted by these breaches (or close-knit partners. 

How most people should check

John / Jane Doe won't look for or find these dumps. So what should they do?

Most people should just to go Troy Hunt's Have I been Pwned and use the free lookup service.

You visit the site and enter your email address (one by one if you have multiple)

And hopefully you get this happy green message that tells you everything is ok (at least the site thinks its ok).

Or you can get the dreaded "red box"

Millions of sites have been compromised

Funny enough I wrote on article on May 3 called 2017 has started as a busy year for hackers and talked about the major compromises we have seen in 2017 (before the major dumps I picked up this weekend). At the end of that article, I had a section called What can you do. I suggest you go read it but the summary sentence is " you are responsible for your data protection".

  •  you are responsible for your data protection
  •  you are responsible for your data protection
  •  you are responsible for your data protection
  •  you are responsible for your data protection

We are complacent and neglectful. We create accounts everywhere using the same easy to guess password. Then someone hacks a site with poor security practices and suddenly your entire digital life is there on display for the hackers.

LinkedIn lost the account information for 167 million users. To protect passwords properly, sites need to salt then hash them. It seems that LinkedIn had not been salting passwords (when the hack was undertaken) and the passwords were only hashed. What does this mean to you? Hackers were able to easily reverse engineer the hash and convert the passwords to plaintext.

It is important that you create a long unique and random password for each site or service you use.

The moral of the story is that your information will eventually get hacked. Make it difficult for hackers by using long complex unique passwords that for each service you use. That way cracking the security on one site doesn't expose your entire life.

Anytime hackers gain access to un-encrypted passwords or are able to reverse engineer the badly protected ones, they feed these into automated systems that test these accounts against the top 20 major global website (Gmail, Hotmail, Outlook, Facebook, Twitter, etc) and try to determine which ones are good, fresh and valid.

Unfortunately people often reuse the same password or use a derivative of the same password and this allows hackers to wreck peoples lives.

If a hacker logs into a service with a valid account, the service will most likely not know it is a fraudulent transaction. Don't rely on companies to protect you.

Anytime we find a data dump, we look for information pertaining to our company and also analyze the content looking for source and hacker.

Looking at stupid passwords in a 6500 account Pastebin dump

People still use stupid easy to guess dictionary based passwords. Why oh why?  Several dozen  people in the above list use Pa55word as their password.

Some people used variations of "123456" such as a123456b.

Other "gems" used as passwords in this dump include: letmein, monkey, trust, trustme, etc. And simple variations of these like adding numbers at the end (letmein01, monkey123, etc).

Don’t use common words in your passwords. You complex random passwords.

Most password managers can generate complicated random passwords or checkout my article entitled 5 best Random Password Generators

Conclusion

As security researchers and a corporate security team, we are careful about how we handle the data. We make sure we securely delete the details once we have scraped it for our own corporate information (so we can proactively reach out to those users and offer advice and guidance).  

Hackers are so considerate. Someone will try to hack you, the question is how easy will you make their job?