Monthly Archive for August, 2009

———————————

UPDATE:  @lbhuston gives us the dirty low down here: http://stateofsecurity.com/?p=766

———————————

This was a test of the emergency broadcast system.  This was only a test, had this been a real change in the Threat Landscape…..

You may have read in various media outlets about a little incident that happened yesterday concerning the mailing of a CD full of malware to a credit union.

Before we go any further the following caveats totally apply:  I’m pretty close with several of the actors in this “incident”.  In fact, had this been a few years ago, there’s a good chance that I would have been the guy responsible for building the forgery and burning the CD.  So my biases are apparent. And I have purposefully not talked directly with any of the parties (MicroSolved, the credit union, NCUA, SANS, ThreatPost, etc…) before sharing with you my impression and what I take away from yesterday.

So yesterday, there was an alarm raised about a “new” form of attack, purportedly against “banks” or even “the financial infrastructure” if you believed at the time what you saw on everything from national media websites to Twitter.  What has been revealed so far to have really happened was this:

A credit union received a mailed a CD and letter that looked like it was from the NCUA (the gov’t body in charge of CU regulation and governance) claiming to be training materials to be viewed on a PC.  But the credit union saw this as a forgery, and escalated the matter.   Somehow, this attack then turned into multiple attacks on “banks” by the time it hit “big” media.  An alarm went out, and basically by early afternoon, any credit union security admin who could fog a mirror knew that there might be something focused at them.

Except that it was really just part of a contracted, valid penetration test by the security firm MicroSolved.  So really, it was a false alarm.

I would just like to state that I think:

THIS IS NOT A BAD THING*

Real quickly, let’s get this out of the way.  For there to be a false alarm, several things must have failed yesterday.  Having worked for MicroSolved, I can tell you that the paperwork we developed there for scoping is pretty durn good.  When I worked there we set bounds, we described who needed to know and who didn’t, gave expectations as to attack type, general time frames to expect it, and so forth.  The scoping and execution process were always phenomenal (pats self on back).  But as an outsider looking at it now:

There May Have Been A Problem With The Penetration Test Scope.

This could have come from one of two sources, MicroSolved, or the CU. MicroSolved could have stepped out of bounds with scoping, or somehow unwittingly created an exception to a tight scoping process. Alternately, the CU themselves, as they were going through the scoping process, might have left out a key player on their side who is part of the fraud reporting process. I say that because:

There May Have Been A Problem With The Credit Union’s Internal Processes.

For the mailing to get to the NCUA as an actual incident, it would mean that either the credit union had poor fraud reporting processes, or someone at the CU probably didn’t follow procedure and reported to the NCUA out of process.

There May Have Been A Problem With The NCUA Alarm Process.

We don’t know what happened to cause a Pentest to be reported as an actual attack, but somewhere once the ball was handed to the NCUA, there should have probably been a verification process in place (I say this having talked last night – well, laughed is more like it- with ex-NCUA InfoSec friends).  I’m guessing that there may have been a failure here, as well.

There May Have Been A Problem With The General Reporting Process.

By the time it hit SANS, SCMagazine, ThreatPost, Slashdot, The Washington Post, etc. The incident grew from one credit union to pretty much the imminent collapse of the financial infrastructure of western civilization. Again, verification and fact checking.  How it got form one CU to multiple or even across the stream into banks is not known.

With That Out Of The Way…

But if we look at what happened, the time frame in which it all happened, we can see a lot of success:

• MicroSolved did the right thing in executing a feasible, clever attack.
• The Credit Union did the right thing in recognizing the attack and reporting it (even if out of process – believe me, as a veteran of Credit Union SE attacks – they could have not caught the attack or even just thrown the material away and not reported it).
• The NCUA did the right thing and got the word out.
• The Press/Media/Alerting System did the right thing and raised the alarm.
• Even we, the Security Professionals via phone to friends and via Twitter, did the right thing as a group and put the notice out.

So rather than playing a cynic and saying the system failed because a false alarm got out, I think we can say:

We Did A Pretty Good Job*

Now of course, the asterisks in both positive statements above should suggest to you my wise reader that I know that repeated false alarms are a bad thing.  And there are certainly lessons learned here.   But pretty much, the system of alarm worked.  We did all right.  And we did much better than one alternative, not sharing information about a perceived critical change in the threat landscape.

Bottom line, we shared information – and that’s pretty durn NewSchool if you ask me.

Bill Brenner has an interview with Robert Carr, the CEO of Heartland. It’s headlined “Heartland CEO on Data Breach: QSAs Let Us Down.” Some smart security folks are outraged, asserting that Carr should know the difference between compliance and security, and audit and assessment. Examples include Rich Mogull’s “Open Letter to Robert Carr” and Alan Shimel’s “Heartland CEO thought QSA’s would make him compliant and secure.”

Rich wrote:

It is unfortunate that your assessors were not up to date on the latest electronic attacks, which have been fairly well covered in the press. It is even more unfortunate that your internal security team was also unaware of these potential issues, or failed to communicate them to you (or you chose to ignore their advice).

One definition of insanity is to keep doing the same thing over and over and expect different results. Without disagreeing with Rich about the responsibilities of the CEO, we in infosec make lots of assertions about what other people should know. But we rarely test if our attempts to educate get through. There are lots of people who assert, correctly, that the CEO needs to know X, Y and Z. But it’s the responsibility of the people under him to communicate effectively, and reading Brenner’s interview, it’s pretty clear that Heartland’s infosec people didn’t deliver a message that sank in. What’s the message that sinks in? Real hard numbers about how often these things happen and their impact, so the CEO can allocate scarce resources based on something other than assertions that he must invest in this or that. Switching gears for a moment, Alan wrote:

Isn’t that the real travesty of our industry though? Only after the cows have run out and the barn has burned down does anyone really give a crap. Even by his own admission with what happened to him and his company, when he goes to talk to others in his industry the feeling is still it can’t happen to them. What will it take? Does every single one need to to have a security incident?

What it will take is talking about what goes wrong. That’s why I’m glad Carr is speaking out, but he’s doing so anecdotally. As Carr asks:

The QSAs in our shop didn’t even know this was a common attack vector being used against other companies. We learned that 300 other companies had been attacked by the same malware. I thought, ‘You’ve got to be kidding me.’ That people would know the exact attack vector and not tell major players in the industry is unthinkable to me. I still can’t reconcile that.”

Why can that malware be used in 300 attacks, and “compliance” not involve a validation that the AV in use will catch it? It’s because we don’t talk about what’s going wrong. We keep saying the same things over and over, and hoping that they’ll work differently. But here’s a prediction: if the QSAs had said “your anti-malware is missing malware that’s been implicated in 300 breaches,” that issue would have been cleaned up inside of days, either by the vendor adding signatures, or being replaced.

The outrage is that we’re still, as Carr and I put it, sweeping it all under the rug.