Woesnotgone Meadow; December 12, 2018

Woesnotgone Meadow

December 12, 2018

#

All is relatively well here at Woesnotgone Meadow, where everyone has above average bandwidth.

In the Meadow, most people have a computer. The models vary per the manufacturer and what the residents want the systems to do. The computers are used for menial tasks on up to coding. A portion of the Meadow uses the Dell systems. This may be due to the person having an account at Dell. For this, this just makes sense to purchase there due to the ease. Although this is easier for the client, recently there was an issue with Dell.

Breach

This took place on November 9, 2018. There was unauthorized access attempted to Dell.com, Premier, Global Portal, and support.dell.com. This, fortunately, was detected on the same day when the Admins noted the unusual activity.

The attacker’s focus was on the customer’s information and data. This included the customer’s name, email address, and hashed passwords. The hashed passwords appear to be a great idea. The issue, however, is Dell did not detail the hashing algorithm. In theory, this could be very weak, which could make the security aspect moot.

In this case, the data was possibly exfiltrated. On its own, the data was very marketable. Curiously with this attack, they did not focus on the payment card data, or other private customer data. Dell was not aware of how the compromise was done. This may have been a case of credential stuffing. The compromise did not affect their operations.

Client’s Affected

As of the end of November 2018, Dell was still investigating the issue. Dell has refused to provide an estimate for the number of clients affected.

Remediation

Dell initiated a password reset for the customer accounts on November 14, 2018. They also notified law enforcement and contracted with a digital forensics business to investigate the compromise.

Thanks for visiting Woesnotgone Meadow, where the encryption is strong, and the O/Ss are always using the latest version.

Resources

Cimpanu, c. (2018, November 28). Dell announces security reach. Retrieved from https://www.zdnet.com/article/dell-announces-security-breach/

Cluley, G. (2018, November 29). Dell suffers security breach, reset customer passwords (but didn’t tell customers why until now). Retrieved from https://www.grahamcluley.com/dell-suffers-security-breach-resets-customer-passwords/

Fossbytes. (2018, November 29). Dell.com breached: Hackers tried to steal customer data. Retrieved from https://fossbytes.comdell-says-a-security-breach-to-steal-customer-data-was-attempted

KFOR-TV, & Query, K. (2018, November 28). Dell warns customers about ‘potential cybersecurity incident’. Retrieved from https://kfor.com/2018/11/28/dell-warns-customers-about-potential-cybersecurity-incident/

Kumar, M. (2018, November 28). Dell resets all customer’s passwords after potential security breach. Retrieved from https://thehackernews.com/2018/11/dell-data-breach-hacking.html

Media Relations. (2018, November 28). Dell announces potential cybersecurity incident. Retrieved from https://www.dell.com/learn/us/en/uscorp1/press-releases/2018-11-28-customer-update

Nichols, S. (2018, November 28). What the dell? Customer passwords reset after miscreants break into big mike’s IT emporium. Retrieved from https://www.theregister.co.uk/2018/11/28/dell_resets_passwords_hack_alert/

O’Donnell, L. (2018, November 28). Dell warns of attempted breach on network. Retrieved from https://threatpost.com/dell-warns-of-attempted-breach-on-network/1394641  

RTT News. (2018, November 28). Dell announces security breach. Retrieved from https://www.nasdaq.com/article/dell-announces-security-breach-20181128-01275

Winder, D. (2018, N0vember 29). Dell admits to hackers may have stolen customer data. Retrieved from https://www.forbes.com/sites/daveywinder/2018/11/29/dell-admits-hackers-may-have-stolen-customer-data/#412f3fac215c

Woesnotgone Meadow; December 10 2018

Woesnotgone Meadow

December 10, 2018

#

All is relatively well here at Woesnotgone Meadow, where everyone has above average bandwidth.

The Meadow has a number of people who enjoy asking questions about the various topics seen across the news channels. These persons are not much for introspection. These topics could be focused on technology, farming, or the new coffee crop.

As the residents ask each other these questions, there is also another source for the back and forth question and answer questions.

Quora, the knowledge sharing website, experienced a minor issue this year. Quora was founded in 2009 by two former Facebook employees and is located in Mountain View, CA.

Compromise

The compromise was manifested by the unauthorized access to one of the Quora systems, discovered on November 30, 2018. There is not a mass amount of information regarding the attack vector or method for others to learn from. Only the general actions were noted. Quora has noted their teams believe they have found the root cause for the breach, and allegedly have taken the appropriate steps to address the issue. The investigation though is still on-going.

Affected Users

This was not a small, incidental compromise. This affected approximately 100M of the Quora users. To remediate this, the company logged out the potentially affected users. Quora also contracted with a leading digital forensics and security firm to assist them with the investigation.

Data Exfiltrated

The attackers were able to secure data from Quora for their uses. This included the name, email address, encrypted password, and user imported data from the linked websites. These were expected to be Facebook and Twitter. The attackers also were able to secure details on the user’s non-anonymous activities on Quora (e.g. questions, answers, and up- and down-votes). Although this data was stolen, most of the data would have been accessible publicly.

As noted, the passwords were encrypted. Seemingly, this would be the perfect situation. Quora however did not detail the format of the encrypted passwords. This could have been weak. These could have been hashed instead, however, this could have been weak or without being salted.

Thanks for visiting Woesnotgone Meadow, where the encryption is strong, and the O/Ss are always using the latest version.

Resources

Acharya, B. (2018, December 3). Quora says 100 million users hit by security breach. Retrieved from https://www.reuters.com/article/us-quora-cyber/quora-says-100-million-users-hit-by-security-breach

Woesnotgone Meadow; 12 11 2018

Woesnotgone Meadow

December 11, 2018

#

All is relatively well here at Woesnotgone Meadow, where everyone has above average bandwidth.

Most people in the Meadow enjoy the occasional donut at Margie’s Donuts. In between the convenient space on Main Street, the company, and heavenly scents from the kitchen, people come and go. People have the option of paying with cash, or credit card. Margie just started an awards program for the clients who purchase a dozen at a time.

That reminds me; Dunkin’ Donuts has a reward program also (DD Perks). This service had an issue recently.

Secondary Risk with Compromise

 There are a vast number of compromises with the different industries and varied number of affected users. The range of affected parties may vary greatly from hundreds to hundreds of millions. Nearly all the compromises have a common thread. The breach and compromise yield data for the attackers and these have very usable data (e.g. username and passwords for the respective company). Clearly this is bad for the client or user, however, there are longer-term effects for them also. There is the temporary loss of revenue, sales, and fines. Other areas more difficult to measure may be loss of standing in the community, and market share.

The attackers use this data in various ways. One in particular is to take the login data and attempt to use this with other login portals at other companies. This is a popular and surprisingly efficient attack due to the users tending to reuse their passwords and usernames with other web portals. This is easier for them, and unfortunately, also for the attackers. This works with Attacker A using the credentials from other breaches to try and access the users accounts. The attackers may know what these are, or create a list from an educated guess. The attackers, in substance, are stuffing the credentials used for one website into another. This process, if manual, would take a significant amount of time, dependent on the target. With this, however, being automated, and adjustable, this is an efficient attack. As for the adjustments, if Dog1 were to fail, the system could modify this password guess to Dog2, Dog3, etc. This attack has become more notable in the news recently.

Data Security Breach

The breach was discovered on October 31, 2018. Dunkin’ Donuts communicated the issue to its customers involved with the DD Perks program. The unauthorized third party had accessed the DD Perks system without authorization. The third parties had used the client’s usernames and passwords to log into their accounts. This data was acquired through other company’s security breaches. The attackers were able to automate the attack. The successful account manipulation was done through this credential stuffing. Dunkin’ Donuts were notified of the issue by one of their security vendors. It is notable that most of the attempts were not successful.

Data

The data would vary for each user. This was due to the clients sharing different data, based on their comfort level. In general, the minimum data accessed would have been their first name, last name, username, 16-digit DD Perks account number, and the DD Perks QR code.

Remediation

Dunkin’ Donuts forced a password reset for the customers. They also replaced the DD Perks account number, along with working with law enforcement.

Thanks for visiting Woesnotgone Meadow, where the encryption is strong, and the O/Ss are always using the latest version.

Resources

CBS Philly. (2018, November 2). Dunkin warns customers of data breach. Retrieved from https://philadelphia.cbslocal.com/2018/11/28/dunkin-warns-customers-of-data-breach/

Cimpany, C. (2018, November 29). Dunkin’ donuts accounts may have been hacked in credential stuffing attack. Retrieved from https://www.zdnet.com/article/dunkin-donuts-accounts-may-have-been-hacked-in-credential-stuffing-attack/

Dunkin’ Brands. (2018). Security update. Retrieved from https://www.dunkindonuts.com/content/dam/dd/pdf/Security_Update.pdf

Jimenez, T. (2018, November 29). Dunkin’ donuts to data breach affects DD perks members. Retrieved from https://kywnewsradio.radio.com/articles/news/dunkin-donuts-data-breach-affects-dd-perks-members

O’Laughlin, F. (2018, November 29). Dunkin’ warns customers of data breach. Retrieved from https://whah.com/news/dunkin-warns-customers-of-data-breach/

6abc. (2018, Novembe 28). Dunkin’ donuts warns customers of data breach. Retrieved from https://6abc.com/technology/dunkin-warns-customers-of-data-breach/4785174/

Woesnotgone Meadow; December 9, 2018

All is relatively well here at Woesnotgone Meadow, where everyone has above average bandwidth.

In the Meadow, we have the usual life events for the residents. These include birthdays, anniversaries, occasional weddings, and other events we publish in the Gazette. Our local jeweler, Margie’s Bling, is our main source for gifts given with an open heart for these occasions. A recent issue with Jared and Kay Jewelers showed the Meadow there can be issues even with a simple jewelry purchase.  

Data leaks are occurring at a greater rate than in prior years. The individual leaks themselves appear to be allowing more data to escape. The combination of this tends to be a bit scare and a rather significant, growing issue. On the bright side, these tend to be remediated rather quickly on average. The data are not all handled in the same manner though. When these are not fixed immediately, the user’s data may be present to be exfiltrated and used or sold.

Related to this, Jared and Kay Jewelers had a bit of an issue. When a customer purchases the jewelry online, they have the option to have the receipt emailed to them. This is handy and may be a benefit. The client receives a link in an email for this receipt. The attack focusses on the link. After the attacker was to post the modified link in the web browser, they were able to access another client’s data (e.g. name, billing and shipping addresses, email address, phone number, the items ordered, total cost, tracking link, delivery date, and last four digits of the credit card number). All of this would be very useful and marketable on the dar web. The attacker could also use a quicker, more direct method to be unjustly enriched. They could complete an automated search for packages within a driving distance of their location. Any packages being delivered in the future could be picked up by the unauthorized person after delivered and prior to the recipient actually picking up the package from their porch.

They could also social engineer the business since they know all of the relevant information the customer service representative would ask. They could also social engineer the client, with the same information used for the prior attack. A simpler attack would involve the plain phishing attack for all the clients the data had been gathered on.

Jared’s parent company, Signet Jewelers, was notified of the issue. This problem only affected the Jared and Kay Jewelers client, not the other entities owned by Signet Jewelers (Zales and Piercing Pagoda). After a few weeks, there was no resolution to the issue. KrebsOnSecurity was contacted in mid-November 2018. At this point, Signet Jewelers thought it was pertinent enough to address. The CISO noted the issue was fixed for the future orders at that point. They did not understand the issue also applied to past orders. This was later fixed. The issue was with the coding not taking cybersecurity into account.

Thanks for visiting Woesnotgone Meadow, where the encryption is strong, and the O/Ss are always using the latest version.

Resources

Bradley, B. (2018, December 3). If you’ve ordered jewelry from these sites, your information may have been exposed. Retrieved from https://www.komando.com/happening-new/516632/jared-kay-jewlers-data-leak

Krebs, B. (2018, December 3). Jared, kay jewelers parent fixes data leak. Retrieved from https://krebsonsecurity.com/2018/12/jared-kay-jewelers-parent-fixes-data-leak/  

Woesnotgone Meadow; December 8, 2018

All is relatively well here at Woesnotgone Meadow, where everyone has above average bandwidth.

In the Meadow, we have plenty of reasons to celebrate. There are birthdays, anniversaries, new careers, and sometimes just because it is Tuesday. When we have these occasions, generally flowers are ordered. Locally, we can call Margie’s Florist and she has the assistant deliver these. One service with our neighbors to the north is Canada’s 1-800-FLOWERS. They,  however, seem to have an issue which has become known recently.

Issue

The Canadian branch of 1-800-FLOWERS is a service, which as the name implies, allows the consumer to order flowers to be delivered. There was, unfortunately, malware on their web app, which was finally detected malware on its website. The malware allowed unauthorized access to the customer’s credit card details. These issues, as we know, occur sporadically throughout the different industries. What makes this an anomaly is the malware was present for four years, unknown. This period is estimated at August 15, 2014, to September 15, 2018. During this time, the clients using the service potentially had their credit card information exfiltrated.

Data

The data available for the attackers to peruse through included the client’s first name, last name, credit card payment data, expiration date, and the card’s security code. During this time, the client’s card could have been used fraudulently by unauthorized persons to fraudulently purchase products. On a side note, due to the number affected parties being 500 as it relates to California residents, the business had to notify the affected persons, naturally, and also the California attorney general.

Odd

This exploited vulnerability was present and active for four years, undetected. The InfoSec team did not notice the data being exfiltrated for the four years, day after day, week after week. The SIEM appears also to not have detected this during the subject time period. Some persons would believe this is acceptable and not their fault due to the complexity of the system. The excuse of “We don’t have the staffing or organizational structure” is not valid. There are tools to automate certain processes and if this were to be the case, the issue needs to be brought to the C-Level and Board of Director’s attention.

The shocking point, however, is if these reasons were in effect, the problem is systemic. The management and Board of Directors did not, in this case possibly, act in a prudent manner. Some may even say this was negligent.

Malware

We should learn from our and other’s mistakes; this is how the industry gets better. In this case, however, it has not been published how this malware was planted. This has and will for years to come to cause issues for the clients until their credit cards are replaced or cycled through the usual process of replacement.

Thanks for visiting Woesnotgone Meadow, where the encryption is strong, and the O/Ss are always using the latest version.

Resources

Avast Security News Team. (2018, December 4). More data breaches; This time at quora and 1-800-FLOWERS. Retrieved from https://blog.avast.com/1-800-flowers-and-quora-report-data-breaches

Shekar, S. (2018, December 4). Canada’s 1-800-FLOWERS finds credit card stealing malware after 4 years. Retrieved from https://mobilesyrup.com/2018/12/04/canada-1-800-flowers-finds-credit-card-stealing-4-years/

Whittaker, Z. (2018, December 3). Credit card stealing malware on canada’s 1-800-FLOWERS website went undetected for four years. Retrieved from https://techcrunch.com/2018/12/03/credit-card-stealing-malware-flowers-four-years/  

Woesnotgone Meadow; December 7, 2018

All is relatively well here at Woesnotgone Meadow, where everyone has above average bandwidth.

Here in the Meadow, parking really isn’t an issue. We only have the two meters, both in front of the city hall. Generally, our residents put their dimes in the meters and we are happy. From time to time Margie walks out from her office to write out a ticket. This happens so infrequently, Margie regularly misplaces her ticket pad.

This was not the case in Ames, Iowa. Regularly, visitors and residents receive tickets for parking violations. This tends to give the people a slight headache when they see the paper, waving in the wind beckoning the driver “Hello!” The city even has the option to pay these online.

Issue
Unfortunately, there was a data breach with the online payment system for their parking tickets (Click2Gov). The city learned of the compromise on November 18th or 19th, 2018, through their IT department. Once this occurred, the city notified Click2Gov. In response, the online parking ticket payment system was taken offline. The administrative actions for the issue involved replacing the web server. This service was brought back online on November 20th. Although the service was back online, the city is still reviewing the compromise to review what the vulnerability was allowing the successful attack.

Affected Parties
There were approximately 4,600 Ames, Iowa residents who paid their parking tickets to the city online using the provided service. The other city’s residents not using this service were not affected. The potentially affected residents were mailed the written notice and emailed the same.

Data Exfiltrated
The data for the residents included their data as provided when they were using the service. This included the first name, last name, mailing address, email address, and debit/credit card numbers. If there were to be an enterprising person who just happened to have this data, it may be useful for phishing, fraudulent credit card transactions, and other exciting activities. Due to this compromise, the affected persons will need to monitor their personal credit for years and years to come.

We have the opportunity to learn from this. For this application, a simple static review would be warranted, along with monitoring more closely the SIEM.

Thanks for visiting Woesnotgone Meadow, where the encryption is strong, and the O/Ss are always using the latest version.


Resources
Associated Press. (2018, November 30). City of ames warns of parking ticket system data breach. Retrieved from https://www.washingtimes.com/news/2018/nov/30/city-of-ames-warns-of-parking-ticket-system-data-b/

City of Ames. (2018, November 30). Data breach compromises parking ticket payment system. Retrieved from https://www.cityofames.org/Home/Components/News/News/5117/

Leeson, D. (2018, December 2). Ames parking tickets data breach could have compromised 4,600 motorists payment information. Retrieved from http://www.iowastatedaily.com/news/ames-parking-ticket-data-breach-could-have-compromised-motorists-payment/

Olenick, D. (2018, December 3). Ames, Iowa, parking ticket payment system breached. Retrieved from https:/www.scmagazine.com/home/security-news/ames-iowa-parking-ticket-payment-system-breached/

Tribune Staff. (2018, November 30). Data breach found in city’s parking ticket payment system. Retrieved from https://www.amestrib.com/news/2081130/data-breach-found-in-city8217s-parking-ticket-payment-system

U.S. News. (2018, November 30). City of ames warns of parking ticket system data breach. Retrieved frm https://www.usnews.com/news/best-states/iowa/articles/2018-11-30/city-of-ames-warns-of-parking-ticket-system-data-breach 

Woesnotgone Meadow; December 6, 2018

Woesnotgone (Woes-not-gone) Meadow

December 6, 2018

#

All is relatively well here at Woesnotgone Meadow, where everyone has above average bandwidth.

In the Meadow, occasionally our residents have health issues. When we do, naturally we make the doctor’s appointment. It appears as though a medical business in Florida has had a recent issue with HIPAA.
Advanced Care Hospitalists (ACH) was founded in 2005 and is located in Lakeland, FL. The business operates as a physician’s contractor group. They provide internal medicine doctors to hospitals and nursing homes located in West Florida. ACH provides services to over 20,000 patients annually and employed 39-46 persons during the affected time frame. Clearly the business handles client medical records and has to comply with HIPAA.

Issue
From November 2011 to June 2012, ACH obtained billing services from an individual. This person claimed to be a representative of Doctor’s First Choice Billings, Inc. This firm is also a medical billing services provider, also happened to be located in Florida. By all appearances the person was involved with First Choice, and used the business name and website.
The problem is First Choice was not aware of the person. The business did not authorize the person to use the business name or website. The underlying question is, how did ACH contract with the unauthorized person and not notice anything was wrong. As a general rule of thumb, a business would investigate and research another business before allowing them to become a vendor.

Data
The patient data exposed included their name, date of birth, social security number, and clinical data. This is a rather useful set of data. The attackers could, in theory, take over the patient’s identity, or sell the data on the dark web. The affected patients now have the opportunity to monitor their personal credit for over a decade.
Red Flag
On February 11, 2014 ACH received an unusual communication. A local hospital found a portion of their patient’s data accessible on the First Choice website. This just happened to be unauthorized.

Reporting
The data breach report was submitted to the US Department of Health & Human Services (HHS) Office for Civil Rights (OCR) in April 2014 by ACH. The official cause for this was the disclosure of the patient’s protected health information (PHI). The initial report noted 400 patients were affected by the compromise. This was later updated to 9,255 patients.
ACH did not follow the HIPAA rules or implement portions of HIPAA as it relates to this specific case prior to April 2, 2014. This also noted the business did not implement prudent security controls, did not perform a risk analysis prior to March 4, 2014, and did not sign a BAA (business associate agreement) with the person not associated with First Choice.

Fine
For all of these mis-steps or failures, ACH paid a fine or penalty of $500,000. ACH also agreed with a plan to correct the issues. Part of this plan is to complete a risk analysis within 120 days, evaluate security risks and vulnerabilities, and inventory all electronic equipment, data systems, and apps which contain or store ePHI.

Thanks for visiting Woesnotgone Meadow, where the encryption is strong, and the O/Ss are always using the latest version.

Resources

Davis, J. (2018, December 4). OCR fines florida physicians group $500,000 for hipaa failure. Retrieved from https://healthitsecurity.com/news/ocr-fines-florida-physicians-group-500000-for-hipaa-failures

Dissent. (2018, December 4). Florida contractor physicians’ group settles HHS claims after they failed to have a BA agreement in place with a vendor who had a breach. Retrieved from https://www.databreaches.net/florida-contractor-physicians-group-settles-hhs-claims-after-they-failed-to-have-a-ba-agreement-in-place-with-a-vendor-who-had-a-breach/

HHS. (2018, December 4). Florida contractor physician’s group shares protected health information with unknown vendor without a business associate agreement. Retrieved from https://www.hhs.gov/about/news/2018/12/04/florida-contractor-physicians-group-shares-protected-health-information-unknown-vendor-without.html

The HIPAA Guide. (2018, December 4). Advanced care hospitals pays $500,000 to settle multiple HIPAA violations. Retrieved from https://www.hipaa.guide.net/advanced-care-hospitalists-pays-500000-for-multiple-hipaa-compliance-violations/