Will Sony ever learn its security lessons?

Once again Sony remind us of the importance of IT security.

For the last week the gossip and tech industry websites have been full of revelations gleaned from a massive hack into the network of entertainment company Sony.

Sadly it isn’t surprising that Sony that targeted in that hack, 2011 was described by this site as the ‘year of the hack’ and at the time I wondered when corporate managers would start taking IT security seriously.

As the most recent security breach shows, Sony’s managers certainly weren’t taking their information security seriously as alleged North Korean hackers gleefully disabled systems and downloaded confidential documents.

While Sony’s woes are deeply damaging to the company, not least for the executives caught out gossiping about movie stars, the stakes are far higher for other companies.

In Turkey its alleged a 2008 oil pipeline explosion was caused by Russian hackers while in the US, Palestinian sympathisers are accused of causing massive damage to the IT systems of the Sands Casino group.

Sony may be one of the most digitally incompetent business in history – at least in respect to IT security – but it’s important for every business to making sure their information systems and critical business systems are hardened against attacks.

Rigging the Internet of Things

The Internet of Things offers many new opportunities for hackers

Hackers are infiltrating public companies to gain an edge on Wall Street warns a story on financial website Finextra.

This is not news, companies’ networks have been the target of insider traders since the early days of corporate computing. What is different today though are the nature of the risks as Chinese and even North Korean hackers are probing networks containing vast amounts of information to find weaknesses and confidential information.

For insider traders, it may be the internet of things turns out to be a boon. By hijacking delivery or supply data, traders may have an advantage over the market.

Things could get very nasty if those hackers subtly alter the data, say over reporting production yields, so a company gives the wrong income guidance based on faulty information.

Security is one of the big issues facing the internet of things sector and the consequences of poorly protected sensors or systems could be immense when governments, businesses and communities come to rely on a stream of data they can trust.

The bad guys are only just starting to explore the possibilities of the connected world.

Apple’s security challenge

As Apple move into the internet of things, they are going to have to take cloud security more seriously.

This week’s news about celebrities’ personal photos being stolen from their iCloud accounts would be irritating Apple ahead of their September 9 media event.

Unfortunately for Apple they seemed to have walked into this by making things convenient for users rather than enforcing strong security measures.

As Arik Hesseldahl in Re/Code describes, this breach was probably due to Apple not encouraging two factor authentication and not limiting the number of password guesses.

The latter is particularly irritating as it shouldn’t be hard for a system to pick when a brute force attack — a computer guessing a password millions of times a second — is being staged against a user.

It’s also trivial to limit the number of guesses as most other services do.

For users, the best protection is to have complex passwords which reduces the effectiveness of brute force attacks. It’s also worthwhile being careful with your personal nudie photos.

The consequences of having your iCloud account compromised are more than just losing your embarrassing photos, Wired’s Mat Honan had his entire digital life hijacked through this method two years ago.

With Apple aspiring to control the smarthome and smartcar markets, the consequences of accounts being breached becomes exponentially greater. These are issues Apple and the rest of the internet of things industry need to take seriously.

Hopefully at Apple’s big media event next week, some brave journalist will stand out of the assembled masses of sycophant hacks and ask CEO Tim Cook some hard questions about security on the shiny new iDevices.

The messy business of metadata

At present we’ve defined metadata too broadly and private information too narrowly which allow governments and businesses to overreach

“We kill people based on metadata,” former US National Security Agency director Michael Hayden told a panel at John Hopkins University last year.

That statement brings sharply into focus the current Australian debate about Telcos being mandated to retain metadata. This information is powerful and can be used in ways not expected by the community.

How metadata is used depends upon how it is defined; one of the worrying parts of the Australian debate is just how nebulous the definition of ‘metadata’ is.

Defining metadata

The basic definition of metadata is that it is ‘data about data’, every packet of data that’s transmitted across the internet is wrapped in information to help the network deliver it to its intended location in a useful form.

Strictly speaking this is where the glib ‘address on the envelope’ line so beloved by clueless politicians promoting data retention comes in; this information is useful but not private as anyone can see it.

That view underlies the defining metadata case, the 1979 US Supreme Court’s Smith v Maryland case, that held telephone numbers are not private information as they’ve been disclosed to the phone company.

Metadata everywhere

With the rise of digital technologies, metadata became much more than just phone numbers and addresses; digital cameras encode photographs with EXIF information that includes details of the date, time camera, shutter speed, focal length and increasingly the location where the photo was taken.

The smartphone you might take that photo with is logging into base stations which telcos are tracking, this is one of the applications law enforcement agencies regularly use to catch criminals, and increasingly near field communications like BlueTooth are being logged by everything from toll gates to bus shelters to track phone usage.

Every email sent has dozens of lines of metadata describing the servers, routing and software used in sending it. Only a tiny fraction of a Twitter message is the 140 character content, the rest is metadata.

This site has hundreds of lines of metadata to tell your browser how to display it and your browser itself is storing dozens of cookies that tell other sites where you’ve been – all of this is metadata.

When we add the Internet of Things to the metadata debate things get even more complex. As home devices, smartcars and wearable technology generating packets of data, it becomes far easier for governments and private enterprise to stitch together a complete picture of an individual even without looking at the actual content of the packets.

The risks for service providers

As Australian ISP iiNet raised in an excellent submission to the Senate committee on data retention, collecting all of this data creates costs and risks for service providers as they have to store, manage and protect massive amounts of data.

Most of that data will never be looked at, but agencies want the information stored because they can. The bizarre thing is that under Australian law, specifically section 313 of the Telecommunications Act, is that a public servant – not just a a law enforcement officer – only has to ask for the information.

For most people the dangers of government surveillance are remote however all of this information is also available to private organisations ranging from health insurers to credit checking bureaus; the real debate is just how much data do we want others to have on our private lives.

At present we’ve defined metadata too broadly and private information too narrowly.

What’s notable in every discussion about increasing government or police powers is the mantra of getting the laws to catch up with technology.

In the case of metadata it may well be the definition of individual rights has to catch up with modern technology, not the powers of government.

Hacks on a plane

That avionic systems could be vulnerable to hacking is a wake up call for the internet of things industry.

One of the great concerns about the internet of things is what happens when older computer technology that was never designed to be connected to the net is exposed to the online world.

A presentation to the Black Hat Conference in Las Vegas this Thursday by researcher Ruben Santamarta promises to show some of the vulnerabilities in aircraft avionic systems.

Today’s aircraft are extremely smart devices with the downsides shown in the tragedy of AF447 where an Air France jet plunged into the Atlantic Ocean when two undertrained pilots didn’t understand what their plane was doing as it encountered severe ice conditions in a storm.

With aircrew increasingly dependent upon computers to help them fly planes, the risks of bugs or security weaknesses in aircraft systems is a serious issue and with the continued mystery of MH370’s fate adds an element of speculation that a glitch of some form was responsible for its disappearance.

It wouldn’t be the first time a passenger plane came to grief because of a computer error; most notably Air New Zealand flight 901 crashed into Antarctica’s Mount Erebus during a 1979 sightseeing trip due to wrong information being loaded into the navigation system.

The internet adds numerous risk factors to aircraft – Santamarta’s hack allegedly works through in plane WiFi systems – particularly given these avionics systems haven’t been designed to deal with unauthorised access into their networks.

Should Santamarta’s demonstration prove feasible, it will be an important warning to the aviation industry and the broader Internet of Things community that security is a pressing issue in a world where critical equipment is connected.

The internet of insecure things becomes a problem

Security with the internet of things is becoming a serious issue warns HP

Following yesterday’s posts on BlackBerry, security and the Internet of Things, HP Fortify released a report saying seventy percent of IoT devices are vulnerable to hackers.

The list of weaknesses is chilling and illustrates why IoT security is an issue that has to be resolved now.

It may well be that John Chen, BlackBerry’s CEO, has backed the right horse for his company.

Smartphone safety and online trust – ABC Nightlife technology

The July ABC Nightlife radio segment looks at how elusive the truth can be online along with smartphones and sight impaired tech.

Smartphones for the vision impaired, malware on portable devices and online trust were the topics of the July technology spot on Tony Delroy’s Nightlife along with why a restaurant claims Google sent it broke and how we can’t always trust what we hear online.

If you missed the show, you can download the program from the website.

For sight impaired smartphone users both Doug and Nick called in to suggest Vision Australia’s services. The organisation has a page dedicated to smartphone and tablet resources.

Nick and Peter asked about malware protection for Android smartphones. Both Intel’s McAfee Mobile Security and Sophos’ Mobile Security for Android are free for home users.

The next spot is scheduled for 4 September, if you have any topics you’d like to discuss contact me or the Nightlife producers.

Jailbreaking the Internet of Things

Jailbreaking the smarthome opens some complications for the Internet of Things

The news that hackers have turned their attention to Nest thermostats raises some delicious possibilities for the Internet of Things.

Jailbreaking smartphones has been normal for years as people circumvent restrictions to add features or software and there’s no reason that this can’t be done to smart thermostats, light bulbs or kettles.

Almost all the smart devices being deployed have processors and capabilities far greater than what’s needed to carry out their designed purpose, so an imaginative hacker can do some interesting things with a jailbroken home automation system.

Using your kettle to control your lights or fridge to open your garage door is a bit of gimmick but there’s plenty of potential for doing some cool, and mischievous, things.

While hacking the smart home for kicks might be relatively harmless, tinkering with industrial devices could have unintended and disastrous consequences. It’s another example why security is one of the top concerns as the Internet of Things is rolled out.

Security in the age of connected kettles

We need to start demanding more of our government and business leaders in enforcing online security

A few weeks back I gave a presentation to the Australian Seniors Computer Clubs Association as part of Staying Safe Online Week.

The presentation, Security In The Age of Connected Kettles, looked at where we are today with online security and some of the challenges facing individuals, businesses and communities as threats become more pervasive with cloud computing, personal technology and the internet of things while the people creating these risks become more professional.

Overall, it’s not a cheery scenario and I end with a call to action that we have to start insisting business, public sector and political leaders start taking online security seriously as a public safety issue.

Over ten slides we covered where we are today in personal and small business online security and some of the challenges facing individuals as computing moves onto the cloud and smartphones.

The ongoing online safety battle

Online safety is evolving as we move from PCs to tablets and smartphones, today the risks are increasingly appearing on our mobile devices although the desktop computer and email scams remain the biggest risk.

It’s increasingly about the money

A change to the security landscape in recent times has been the rise of professional malware. While a decade ago most of the hacks and viruses we saw were the work of people demonstrating their skills or causing mischief, today there is big money in compromising computers and capturing data.

The rise of ransomware

One of the best examples of the professionalisation of the internet’s bad guy is the rise of ransomware.

Ransomware locks your computer with a demand for payment to release your data; if you don’t pay you lose all your information.

Many of the online threats though are far more subtle; the theft of data from Target, compromises of Sony’s customer databases and ongoing security breaches illustrate how the risks are far greater than just on our desktop.

Smartphone lockups

Ransomware has moved off personal computers onto smartphones with both Android and Apple systems being attacked.
The ‘hacked by Oleg Pliss’ message is a good example of how Apple’s products are just as much at risk as other companies’ platforms.
Also the ‘hacked by Oleg Pliss’ lockup shows how the security aspects of cloud computing services are going to become more important to the average person.

Security basics

The basic advice for the average user remains the same;

Strong passwords
Don’t use common passwords
Be careful what you click on or visit
Keep your systems up to date
Have good security software

However times are changing and many security issues are out of the average person’s control.

Lessons from Heartbleed

The Heartbleed Open SSL bug illustrated the limits of individuals in protecting their information. As a bug in the secure socket layer software, the Heartbleed Bug could expose sensitive data on websites using the service.

The disappointing thing with Heartbleed is that people following good security policies were vulnerable.

Probably the biggest threat with Heartbleed however is the Internet of Things, where relatively simple devices – the connected kettle – could expose security credentials.

The Target hack

Another example of how security is beyond the control of the individual user is the Target hack. Hackers found their way into the US department store’s network though an airconditioning contractor. From there, they were able to steal millions of customer payment details.

The Target hack is one of dozens of similar coporate security compromises and this will continue until security is taken seriously by company directors and regulators.

A pocket sized security breach

As the Oleg Pliss hack showed, smartphones are not immune to security breaches.

With our phones gathering increasingly more data on our behaviour, protecting the data they gather is going to become one of the biggest challenges facing us.

Rich data

Smartphones are not just gathering location data, as technologies like iBeacons roll out more information is being gathered from more sources.

When we go shopping, attend a football game or visit the doctor these technologies are collecting information on our personal habits and behaviour.

Not a generational issue

One of the myths around security and privacy is that concerns revolve around the generations.

The idea that only older people care about privacy or that younger folk understand technology is a myth.

Unfortunately however our political and business leaders come from a segment of society that doesn’t care about or understand the technology or issues.

If meaningful change is to be made in securing our information, then we’re going to have to demand our business and political leaders take these issues seriously.

The online security pains of a growing business

Stratfor’s humiliating computer hack is a lesson for all businesses about IT security

Possibly the most embarrassing of the outbreak of computer hacks in late 2011 was the breaching of prominent geopolitical analysts Strategic Consulting, also known as Stratfor.

The Daily Dot dissects what went wrong for Stratfor based on a leaked report from Verizon Business who carried out a “forensic investigation” of the hack which the company claims cost them $3.8 million in damages.

While the monetary damages were substantial for a relatively small company, Stratfor’s reputation was probably the greatest casualty as customers’ credit card details were exposed and the firm’s confidential files were distributed by Wikileaks.

The tragic thing is that none of this would have happened had Stratfor followed basic IT security practices, something that every business should be following.

Don’t store credit card details

Probably Stratfor’s biggest mistake was storing customers’ credit card details – there is no reason for saving your clients’ payment details. Ever.

If you’re accepting credit cards, organise a payment service to handle that work for you as they know what they are doing and take most of the management hassles, security and fraud risks.

In most cases, these companies’ fees are no more than manual processing fees that Stratfor and most businesses manually processing payments get hit with anyway.

Password policies

Another basic mistake was that passwords were shared and kept simple; there is no excuse for giving staff the same password to access confidential or critical files and systems.

Similarly, there wasn’t a ‘need to know’ policy; that is, that an analyst has no reason to have access to HR files and the receptionist no need to be looking at sales figures. Sensitive data should only be accessible to those who need it for their day-to-day work.

Remarkably, Stratfor didn’t have any properly configured firewalls and on many computers didn’t have up to data anti-virus protection. All of this made it easy for hackers to get into the network and access confidential information.

The online pains of growing a business

In some respects it’s possible to feel sorry for Stratfor’s management, the report is a classic example of a business that outgrew the IT structure for a one or two person operation founded by men who didn’t understand the risks of the internet.

Today there’s no excuse not to have systems locked down or to lack a company culture that recognises data security as being essential in the modern business world.

Stratfor’s hack was a spectacular example of what could go wrong, but it’s a warning for all businesses about the importance of security in a connected world.

Fear in the cloud – the loss of trust in online business

Should online businesses, particularly cloud services and social media platforms, begin to worry they’ve lost the trust of the community?

Today I spoke about online safety to the Australian Seniors’ Computer Clubs Association about staying safe online.

Hopefully I’ll have a copy of the presentation up tomorrow but what was notable about the morning was the concern among the audience about security and safety of cloud services.

The ASCCA membership are a computer savvy bunch – anyone who disparages older peoples’ technology nous would be quickly put in their place by these folk – but it was notable just how concerned they are about online privacy. They are not happy.

Another troubling aspect were my answers to the questions, invariably I had to fall back on the lines “only do what you’re comfortable with” and “it all comes down to a question of trust.”

The problem with the latter line is that it’s difficult to trust many online companies, particularly when their business models relies upon trading users’ data.

Resolving this trust issue is going to be difficult and it’s hard to see how some social media platforms and online businesses can survive should users flee or governments enact stringent privacy laws.

It may well be we’re seeing another transition effect happening in the online economy.