homepage
Open menu

SANS NewsBites

Coronavirus Affecting Conferences; Median Dwell Time Falling; U.S. DoD DISA Breach Affects 200,000; Wyden Pushing for Release of Voting System Audit

February 25, 2020  |  Volume XXII - Issue #16

Top of the NewsThe Rest of the Week's NewsInternet Storm Center Tech Corner

Top of the News

2020-02-21

Coronavirus: More Companies Backing Out of Conferences

AT&T Cybersecurity and Verizon have decided not to attend the RSA Conference in San Francisco this week, citing concerns about the coronavirus. IBM announced its decision not to attend RSA on February 15. The conference is taking place this week as scheduled. Sony and Facebook's Oculus have pulled out of the Game Developer Conference scheduled for March 16-20 in San Francisco. Coronavirus worries have already caused the cancellation of the World Mobile Congress that was to have taken place in in Barcelona February 24-27. Black Hat Asia 2020 has been postponed to fall 2020, and Cisco has cancelled its Cisco Live! Conference that was scheduled to be held in Melbourne, Australia early next month.

Editor's Note

The best advice comes from the WHO and CDC regarding the Coronavirus ad should be incorporated in making a decision relating to attending or hosting an event.

William Hugh Murray
William Hugh Murray

The increasing spread of the Coronavirus is a great opportunity for companies to revise their Business Continuity Plans (BCPs). Too often BCPs focus on the IT aspect of an interruption to business and not on the human element. Getting senior management to understand the impact of large numbers of staff being quarantined or out of work sick can help get the buy-in required for the non-IT element of BCPs. The Irish government has published an excellent guide for companies to deal with an influenza outbreak which can be adapted for use with the Coronavirus https://www.gov.ie/en/publication/2f5d5f-business-continuity-planning-checklist-of-preparatory-actions-in-res/: Business Continuity Planning - Checklist of Preparatory Actions in Responding to an Influenza Outbreak

Brian Honan
Brian Honan

2020-02-20

Median Dwell Time for Breaches is Falling Worldwide

According to the M-Trends 2020 Report, the global median "dwell time" - the time from initial breach to detection - fell from 78 days to 56 days in just one year. The report also found that while breaches are being detected more quickly, they are more often discovered by third parties rather than internally.

Editor's Note

More rapid discovery of breaches is moving the bar in the right direction. That external parties are discovering them first is an indication that partnering with an external service can help cover gaps in internal services and could be used with an accompanying build or buy decision for the long-term strategy.

Lee Neely
Lee Neely

It is good to see a downward trend in this statistic, however it is still way too high. The fact that breaches are being discovered by third parties rather than the victims is still a worrisome trend. Preventive controls are essential in cybersecurity, but equally important is having appropriate detection controls in place and effective incident response.

Brian Honan
Brian Honan

2020-02-24

U.S. Defense of Department DISA Breach Exposed PII of 200,000 People

The US Department of Defense's (DoD's) Defense Information Systems Agency (DISA) has acknowledged a network breach that compromised the personal information of at least 200,000 individuals. On February 11, 2020, DISA sent letters to the people whose data were compromised, telling them that the breach occurred between May and June 2019. DISA secures and manages White House communications.

2020-02-24

Wyden Pushing for Release of ShiftState Voatz Audit Results

US Senator Ron Wyden (D-Oregon) is asking a company that conducted an audit on the Voatz mobile voting app to disclose the results. While ShiftState's audit gave Voatz "high marks," researchers at MIT recently published a paper enumerating security concerns present in Voatz. Specifically, Wyden wants to know how many "ShiftState personnel that audited Voatz [have] experience in election security, cryptographic protocol design and analysis, side channel analysis, and blockchain security;" whether ShiftState detected the same flaws the MIT researchers found; and whether the company agrees or disagrees with the MIT findings and why.

Editor's Note

Something as critical as voting software should have more public security testing references than just a small company that has been in existence for under two years. Voatz has started up a managed bug bounty program, talking about many of the right things security-wise but anything connected to elections needs to have the talk verified to see if the right actions match the talk.

John Pescatore
John Pescatore

The challenge will be finding a repeatable methodology that adequately tests the security of voting apps irrespective of who performs that assessment. Given the stakes, reconciliation of assessments from multiple sources is appropriate to ensure election integrity.

Lee Neely
Lee Neely

The Rest of the Week's News

2020-02-11

Car Thieves Disabling OnStar, Replacing Vehicle Computers

In "a recent string of stolen Chevrolet Silverado pickups," thieves disabled the OnStar anti-theft technology almost immediately, reducing the likelihood of the vehicles' recovery. Surveillance video has shown how fast the thieves operate - pop the lock, open the hood, change the computer, and disable OnStar tracking.

2020-02-24

Man Arrested in Connection with Political Website DDoS Attacks

The FBI has arrested a California man for allegedly launching distributed denial-of-service (DDoS) attacks against the website of a political candidate. The suspect's wife worked as a campaign staffer for one of the victim's political opponents.

2020-02-21

ISS World Recovering from Malware Attack

Copenhagen-based ISS World says it is recovering from a malware attack that hit its network last week. The facilities management has more than half a million employees around the world. ISS says it has determined the "root cause" of the problem, but has not said if the malware is ransomware.

2020-02-21

NRC Health Ransomware Attack

NRC Health, a company that administers patient satisfaction surveys for hospitals across the US, has acknowledged that its systems were hit with a ransomware attack on February 11. The company shut down its "entire environment" to limit the damage. Hospitals have expressed concern about the security of patient data.

2020-02-18

Toll Group Working to Recover from Ransomware Attack

Australian freight delivery provider Toll Group is still recovering from a ransomware attack that hit its network in late January. The company has not and does not plan to pay the ransom demand. Toll customers have expressed frustration with delays that resulted from network downtime.

2020-02-20

The Most Important Open Source Components and Associated Security Issues

The Census Program II "identifies the most commonly used free and open source software (FOSS) components in production applications and begins to examine them for potential vulnerabilities." The report is the work of the Linux Foundation's Core Infrastructure Initiative (CII) and the Laboratory for Innovation Science at Harvard (LISH).

Editor's Note

The security of software components continues to be a problem. This report focuses in particular on JavaScript Node Package Manager (npm) packages. Over the last year, a number of npm packages has been compromised. If you are using npm (and at this point, there are hardly any organizations that do not), you need to come up with a way to inventory and audit the packages you use. This isn't easy, and will take time, but is essential just like your hardware inventory.

Johannes Ullrich
Johannes Ullrich

The challenge of open source is determination of how well it has been assessed. A report like this provides an extra data point to accompany your own assessment and validation processes.

Lee Neely
Lee Neely

2020-02-24

Samsung Discloses Data Security Incident

Samsung said that a data security incident last week allowed some users to view other users' information. The company says the incident was not related to the mysterious "1/1" push notifications some users reported receiving. Those notifications came from the Find My Mobile app even if the users had it disabled.

2020-02-22

FBI Touts Passphrases Over Passwords

A Tech Report from the FBI's Portland, Oregon Field Office encourages people to use passphrases of at least 15 characters rather than passwords, because the longer passphrases are more difficult to crack. The passphrases do not need to contain numbers, special characters, or a combination of upper- and lower-case letters.

Editor's Note

NIST 800-63-3 provides guidance which supports this choice. In addition to length, and lack of special characters, password systems need to prevent the use of single dictionary words and words related to the service or person creating the passphrase. Lastly, the ability to manage a banned-words list built from prior incidents and breaches should be considered.

Lee Neely
Lee Neely

2020-02-24

Zyxel Provides Fix for Zero-day Vulnerability in NAS Devices

Zyxel, which makes networking devices, has released a fix for a remote code execution vulnerability affecting some of its Network Attached Storage (NAS) products. Zyxel learned of the issue nearly two weeks ago, when KrebsOnSecurity notified the company that directions for exploiting the flaw were being offered for sale online. Some of the products affected by the vulnerability are no longer supported.

Internet Storm Center Tech Corner

Old Style Excel Macro Malware

https://isc.sans.edu/forums/diary/Maldoc+Excel+4+Macros+in+OOXML+Format/25830/


Simple But Efficient VBScript Obfuscation

https://isc.sans.edu/forums/diary/Simple+but+Efficient+VBScript+Obfuscation/25828/


Let's Encrypt Beefs Up Validation

https://letsencrypt.org/2020/02/19/multi-perspective-validation.html


ScrollToTextFragment Privacy Concerns in Google Chrome 80

https://github.com/WICG/ScrollToTextFragment/issues/76#issue-538137989

https://docs.google.com/document/d/1YHcl1-vE_ZnZ0kL2almeikAj2gkwCq8_5xwIae7PVik/edit#heading=h.uoiwg23pt0tx


Google Warns of Microsoft Edge (in German)

https://www.heise.de/security/meldung/l-f-Google-findet-den-neuen-Edge-Browser-doof-und-unsicher-4665634.html


Google Play Store Joker / Clicken Malware

https://research.checkpoint.com/2020/android-app-fraud-haken-clicker-and-joker-premium-dialer/


Another OpenSMTPD Vulnerability

https://github.com/OpenSMTPD/OpenSMTPD/releases


WhatsApp Group Invite Links in Search Engines

https://twitter.com/JordanWildon/status/1230829082662842369