A "HIPPA Extortion" case hit the news

Following my recent article where I tried to explain the concept of "GDPR Extortion", a data breach of a Health IT provider hit the news early this week, and the case of "HIPPA Extortion" became a sad reality.

For those of you who are not familiar with HIPAA (Health Insurance Portability and Accountability Act of 1996), is a United States legislation that provides data privacy and security provisions for safeguarding medical information, and in this case it applies to the Health IT provider that was breached.

The Nashville-based company (Medhost) is being asked by the cyber-criminals to pay 2 Bitcoins (BTC) which at the moment is approximately $35K (USD), otherwise they will sell the data they managed to steal. What is however very interesting in this story, is that they try to make their case by saying that they will do:

" ..a media release regarding the lack of security in a HIPPA environment. "

The screenshot is from Google's cache*, as the website of the breach company appeared on 19/Dec 2017 at 20:02 GMT. 

Will "GDPR Extortion" become the new "trend" in cybercrime?

Even though this is not an "official" term that is being used (well, at least not yet), it does describe the concern I am trying to explain to people at different occasions. I often discuss GDPR from the security perspective, and the conversations most of the time end up focusing at the implications of the regulation and the "next day". 

This is when I end up trying to describe the potential scenario of "GDPR Extortion", as I always like to see things through different lenses when it comes to forward-thinking in Information Security and CyberSecurity. 

By saying "GDPR Extortion" I tend to mean something similar to "DDoS Extortion", and it is easier to give an example to people in order to explain this type of potentially evolving threat. 

RIPE NCC - RIPE ATLAS

I recently saw Vesna Manojlovic’s  (@Ms_Multicolor) talk at BalCCon (@BalCC0n) about the RIPE Atlas device and I wanted to find out more about the project. I felt a need to play around with the device, see how it works, run a few security tests, and of course, be part of the online community that has access to the data in real-time.

Getting started with the RIPE Atlas probe (@RIPE_Atlas) was more or less straightforward. 

The RIPE NCC (@RIPE_NCC) is building the largest Internet measurement network ever made. 

For those who are not familiar, the RIPE NCC assigns and allocates Internet number resources across Europe, the Middle East and parts of Central Asia. The RIPE Atlas employs a global network of probes that measure Internet connectivity and reachability, providing an unprecedented understanding of the state of the Internet in real time. You can explore the RIPE Atlas measurements, maps and tools, once you register for an account. 

Starting with the probe I had to visit the URL http://probev3.ripe.net which redirected me to https://atlas.ripe.net/docs/probe-v3/. On that page, one can find further information about the device, and what one should do if they find one connected to a network, and of course what to do if one has found a lost device. 

"Moving Towards CyberResilience", BalCCon2k17

This year is my first time to the Balcan Computer Congress, known as BalCCon (BalCCon2k17) in Novi Sad, in Serbia. I have visited Serbia a few times for work and it is a pleasure to have the opportunity be back, attending this amazing conference and present a talk. 

BalCCon (@balcc0n) is a three-day conference with a great line-up of speakers, hackspace activities that include soldering and hardware hacking, retro gaming, workshops, and a pleasant atmosphere with a party-mood throughout the day. 

This year’s event is the 5th BalCCon2k17.  The conference opened on Friday 15/Sep/2017 by Jelena Georgijevic Krasojevic. She welcomed everyone and gave a small introduction about the event and its history. The event started at 14:00, which gave people enough time to fly to the country in the morning or make sure they had a really good night sleep if they arrived the previous night. 

If you haven't been to BalCCon, it is time for you to make plans for next year. The package includes, amazing talks, plenty activities for people to do, many workshops to attend, a friendly atmosphere, good food, and warm weather. 

Security BSides Amsterdam 2017

My passion for contributing to the information security community as much as possible, led me into getting myself involved with the formation of another information security conference. After a number of discussions, I decided to help out with putting together a Security BSides conference in the Netherlands. More specifically, the first ever Security BSides Amsterdam 2017 (www.bsidesams.nl) took place on Friday, 1/Sep/2017 in the heart of Amsterdam, at Zalen Pakhuis de Zwijger B.V. (dezwijger.nl). 

We tried to engage the Dutch information security community as much as possible as this was  our first attempt to make this conference a reality. We were very pleased to have so many speakers submitting a talk to the conference, and the support of OWASP and especially OWASP Netherlands. 

On our account on peerlyst you will find a list of all the talks of the day, along with their respective YouTube video. 

You can also find all of the videos on our YouTube channel, all combined in one playlist here. 

Security BSides Athens 2017

This was the second Security BSides Athens in Greece this year, which allowed us to move to a slightly bigger venue. We tried to put together a better event since last year and further improve the quality of the conference.

Security BSides Athens 2017 (www.bsidesath.gr) took place at "The Athinais Cultural Center" - ATHINAIS

OWASP London chapter meeting (Guest Speaker)

It is a great honour to have been invited to speak at the OWASP London Chapter meeting this May. (Thursday, 18 May 2017 - Central London)
More importantly, as this meeting is sponsored by WorldPay, it is a fantastic opportunity to share previous work I have done on payment systems over the past few years.   

Allow me to say a big Thank You to the OWASP London Chapter organisers for the work they put in to keep the London chapter so live & active, and of course to WorldPay, for supporting this meeting, and for being so kind to host it at their premises. If you are interested to find out more OWASP, make sure you attend the OWASP Summit 2017.

Given the opportunity for this blog-post, I would also like to thank you all for your messages about my talk. I am very pleased to hear that the tickets for OWASP London Chapter meeting this month were sold-out that fast and that the organisers had to activate the waiting list. The organisers also mentioned that due to the high demand, they will consider live streaming. So, stay tuned for updates on that as I am planning to schedule a number of tweets to go out before and during the talk. Thus, for updates you can follow me on Twitter: @drgfragkos

30 days to go for the OWASP Summit 2017

Owasp will host its 2017 Global Summit in London where hundreds of participants will join forces in Working Sessions focused on solving hard Application and Cyber Security problems.

This is not a conference with unidirectional presentations. Using the same model as the past two OWASP Summits in Portugal, this 5-day event will be a high-energy experience, during which attendees get the chance to work and collaborate intensively. Every thoroughly prepared working session is geared towards a specific application security challenge and will be focused on actionable outcomes.

With participants flying from all over the world and from major security/development teams, service/product providers and research organizations, this is the place to be to learn and collaborate with industry peers (and even competitors).

The event is split over the following tracks, each focusing on a specific set of challenges:

• Threat Modeling - This is one of the strongest tracks, with most of the core Threat Modeling talent in the world joining forces and collaborating
• OwaspSAMM - This is another track where we have the main contributors and users of this Owasp project participating at the Summit
• DevSecOps - This track has been generating quite a buzz among participants, since it is addressing real pain points and problems that companies face today
• Education - Always strong in OWASP, this track ranges from University master degree to how to create the next generation of AppSec professionals
• Mobile Security - Another track where the key Owasp leaders of Mobile-related Owasp projects are participating
• CISO - This track reaches a wide audience of CISOs and covers a wide range of CISO-related topics
• Research - This track covers really important and interesting research topics (it’s important to look at the future and work on the next generation of Application Security)
• Agile AppSec - This is a track driven by a couple participants who really care about Agile and want to find better ways to integrate it with AppSec practices
• Security Crowdsourcing - This is a track that is focused on scaling AppSec activities via internal and external crowdsourcing
• Owasp Project’s Summit - Last but not least, this track has 31x Working Sessions directly related to an Owasp Project (with most having the Project Leader participating)

Ransomware outbreak at a global scale | #wannacry

Approximately 74 countries are currently under an ongoing cyber-attack. The NHS in the UK has been massively affected, along with major companies worldwide. 

Computer systems are being infected with the ransomware known as WanaCrypt0r 2.0 (known as WCry and WannaCry). The malicious file targets a known computer vulnerability (MS17-010). 

System Administrators:
- Ensure systems are fully patched, especially by addressing the MS17-010 vulnerability. 
- Disable SMBv1.
- Firewall protect ports: 139/445 & 3389
- Make sure you have a backup of your data and it is also stored offline. 
- Ensure Antivirus is installed and active.

Legacy systems should be isolated and any systems which are infected, consider removing them from the network. 

Under Attack?

• Customers in the healthcare sector should follow the national guidance as instructed by the NHS and the National Cyber Security Centre (NCSC).
• UK customers consult the Cyber Information Sharing Platform (CiSP).
• DeepRecce customers requiring further advice or information should contact our 24/7 incident response line www.deeprecce.com

--

Repository of information:

WannaCry|WannaDecrypt0r NSA-Cybereweapon-Powered Ransomware Worm
https://gist.github.com/pcostesi/87a04a3bbbdbc4aeb8b787f45eb21197 

Microsoft released notes:
https://blogs.technet.microsoft.com/mmpc/2017/05/12/wannacrypt-ransomware-worm-targets-out-of-date-systems/

OWASP Top 10 (2017 Release Candidate) - Thoughts

OWASP Top 10 2017 Release Candidate - PDF

I understand the importance of highlighting the Underprotected APIs (A10), and I do agree with the importance of it. However, to my eyes this is another stage during a security assessment, while the penetration tester is engaging into testing for different types of Injections (A1). 

I believe Injections (A1) should include the Underprotected APIs.
(especially based on the example attack scenarios given in the PDF page 17 for the Top 10 RC)

From what I have seen on several real-world projects, Unvalidated Redirects and Forwards, is a very common security issue (when you manage to identify where it is hiding) but it is not highlighted in security reports (and penetration testing reports) that often. Thus, it seems and fills like, it is not that popular as a finding. 

One of the main reasons this particular security issue is not mentioned that often, is because businesses (the business perspective) see this highlighted risk as a "two-step attack", so, instead of addressing it, they simply "accept the risk".

From what I have seen in different real-life projects, dropping "A10 – Unvalidated Redirects and Forwards" will be mistakenly perceived (misunderstood) as an "insignificant" security issue, while, it can be used to spawn a number of attacks. 

If an attacker manages to redirect/forward a user to a fraudulent website (that looks exactly like the legitimate one), then it is game-over for that user. How many of you remember the issues with the Unicode URLs back in the day? In one case, two companies lost a significant amount of money because of a fraudster, due to this "insignificant" issue.

Just to mention a couple very recent examples: 
punicode https://www.wordfence.com/blog/2017/04/chrome-firefox-unicode-phishing/
or the unvalidated redirect on linkedin, which allowed to download malware from linkedin redirects (even though they were hashing the urls).
https://gfragkos.blogspot.co.uk/2015/06/linkedin-security-issue-unvalidated.html

So, in my humble opinion, A1 should be Injections that include calls to Underprotected APIs: 
A1 - Injections, including Underprotected APIs

and keep:
A10 - Unvalidated Redirects and Forwards. 

This blog post is intended to be perceived as food-for-thought.

Xcode update is stuck at waiting

This is something that happens often and I wanted to make sure you are going to fix this the right away, without causing any problems to your system and save you some time. 

This was written for Xcode 8.3 (but it has worked for previous versions as well) and it is confirmed that it works on:
OS X 10.10 Yosemite, OS X 10.11 El Capitan, and macOS 10.12 Sierra.

I am assuming that you are at your Updates screen and Xcode is stuck at "waiting". Click on Xcode (the actual name/caption of the pending update) and the relevant page of Xcode on App Store will show (see below). 

When you click the Update button (beneath the application icon on App Store), a little progress bar appears beneath it, and it usually tells you "less than a minute" (but it is stuck there forever). 

Don't navigate away from this screen on App Store, because we want this little progress bar to be our indicator on what is happening. 

• Open a new Finder window and click Applications (top left hand side). 
• Scroll down to the Xcode application and drag the application to Trash.
• You will be asked to confirm your password before moving Xcode to Trash.
• Once you enter your password, there will be a prompt asking you if you want to cancel the update or delete the app. Choose delete. 
• You will notice that immediately after clicking delete, xcode starts downloading the updated version, and you can see/confirm that at the progress bar (as discussed earlier on) and it will tell you how long it will take (it can take an hour, depending on your Internet connection).
• (optional) If you want to save some space on your disk, go to Trash, right-click on xcode, and delete it completely from the system. It will ask you again to confirm your password. 

Don't forget to plug-in your computer, as the whole process takes a while, and the computer might go to sleep and suspend the download and/or the installation. 

IBAN Country List

IBAN (International Bank Account Number) that originates from a member or joining country of the EU or the EEA. FYI: Switzerland and other countries that have adopted the use of IBAN. 

A couple things about the IBAN

Instructions for Screen or Braille Reader users

• This IBAN Checker validates the format of an IBAN which you can either type or paste into the input boxes.
• The results of validation are normally shown on the screen. To receive the IBAN Checker results in a dialogue box that your screen reader should be able to interact with, check the first checkbox that you come across in the form. The prompt for this box reads 'Screen reader users please check this box to receive the results of the IBAN Checker as a dialogue box'.
• Two sets of input text boxes are provided for you to enter your IBAN for checking.
  • The first set of nine input text boxes allow you to type in the IBAN four characters at a time.
    • You will need to tab from one text box to the next.
    • Each text box will only allow a maximum of four characters.
    • The IBANs have a specific format, and some possible formatting errors are detected as you are keying characters into these text boxes.
    • These errors are notified to you in dialog boxes with an OK button which you must action before you carry on.
    • When you action these dialogue boxes you should be aware that incorrect input is not cleared out of the input text boxes.
  • After the multiple input boxes there is a single longer input box into which you can type the complete IBAN. Or alternatively you can paste the IBAN into this box if you have received it electronically - ie in an email.
  • Typing into any of the multiple input text boxes will clear out any characters you may have typed or pasted into the longer input text box.
  • Similarly typing or pasting into the longer text box will clear out any characters you may have typed into the multiple input text boxes.
• Two buttons are provided on the form.
  • The first button triggers the checking of the IBAN you have entered.
  • The second button clears out all the input text boxes.

- Each IBAN has a predefined length (depending the country it belongs to).
- Each IBAN has a country prefix.
- The IBAN should not contain spaces when processed electronically (or the word 'IBAN').

In case someone needs this information, I will just leave that list below :)

Ticketbleed (CVE-2016-9244)

A vulnerability similar to the well-known heartbleed was discovered in the TLS/SSL stack of F5 BIG-IP appliances that allows a remote attacker to extract up to 31 bytes of uninitialized memory at a time. This vulnerability is called Ticketbleed as it lies in the implementation of Session Tickets, which is a resumption technique used to speed up repeated connections. The vulnerability affects the proprietary F5 TLS stack which exposes 31 bytes at a time.

F5 published article K05121675 addressing this vulnerability. You can read the story of how Ticketbleed was found and a complete technical walkthrough on the Filippo.io blog.

Test
You can test your domain using the automated script which you can find at: https://filippo.io/Ticketbleed/

Alternatively, you can test for Ticketbleed yourself with a Go script: here

Fixes and mitigation
The full list of affected versions is available on the F5 website. At the time of this public disclosure not all releases have upgrade candidates available.

Disabling Session Tickets is a complete mitigation, which will only cause a performance degradation in the set-up phase of resumed connections.

Reproduced here are the instructions provided by F5 and available at the link above.

1. Log in to the Configuration utility
2. Navigate on the menu to Local Traffic > Profiles > SSL > Client
3. Toggle the option for Configuration from Basic to Advanced
4. Uncheck the Session Ticket option to disable the feature
5. Click Update to save the changes

Source: https://filippo.io/Ticketbleed/

Guest Speaker for University of South Wales (Information Security Research Group) - InfoSec Community; Stepping into the security industry

I had the pleasure to be invited as a guest speaker to the University of South Wales by the Information Security Research Group (ISRG). The talk was about the Information Security community and more specifically how young professionals can step into the security industry.

During this talk, the students (graduates & postgraduates) had the opportunity to understand and discuss what they can do today in order to ensure they are well prepared when it comes to stepping into the security industry.

The talk included an introduction to what is considered to be a security oriented mindset, provided a number of quick tips, mentioned several online resources, and last but not least how to prepare for an interview. The students among a number of subjects that were raised during the talk, were also introduced to penetration testing types, practices, methodologies, real stories from the industry, tools, and techniques. Black Box testing versus White Box testing was explained, the significance of white-listing was discussed and a brief comparison between Vulnerability Assessments and Penetration Testing was given.