Patch Available to Fix Microsoft Date Coding Flaw; Large Scale Data Arrays Need Special Attention to Assure Backup; Chinese Social Media Surveillance Drives Need for Open Source Intelligence

Representing dates properly remains a common problem. There are a number of standard solutions (e.g. ISO time formats or Unix timestamps), which are not foolproof but will beat and one-off implementation.

Johannes Ullrich

An obvious failure in Microsoft’s software development lifecycle and pre-release testing. Hopefully, Microsoft’s testing in the future will now routinely include setting clocks forward during test…

John Pescatore

January 1st 2022 is when a signed 32bit Integer can no longer hold the date value, sometimes called a Y2K22 bug. There is a manual fix available from Microsoft which stops the FIP-FS scanning engine, removes old AV files, installs a new AV engine, and restarts services. A fully automatic fix is still being developed. You can download the Reset-ScanEngineVersion.ps1 script from https://aka.ms/ResetScanEngineVersion.

Lee Neely

Doing backups well is hard and boring. Which means it doesn't get done properly. Remember the old rule that data that doesn't exist at least three times in three different physical locations (and at least one of them offline) should be considered already lost.

Johannes Ullrich

The old trope of testing patches probably doesn't apply since most organizations won't have multiple large-scale storage arrays with which to test patches on. Even then, the “test” likely can impact production data. Second, although the article suggests the impact was backup data, that seems a bit misleading. In some scientific research contexts, data stored on device other than where it was generated is noted as “backup” data. While the 77TB lost was characterized as having been generated over a three day period, that doesn't mean it can be reconstituted in three days. It was generated over a specific three day period. I've been involved in a few research situations where this three day loss could destroy months or years of work. In a typical situation, the data is generated and then processed from a high redundancy storage cluster (such as the one that had the errant software update). Aggregate data of a much smaller size is then stored longer term. It is simply infeasible to say “keep multiple copies with offline backups” when you're generating this much data on a daily basis, that's why the org invested in such a high performance (and obscenely expensive) storage system in the first place.

Jake Williams

HPC has graded storage, where data is migrated to slower and slower storage as the local on-line storage comes at a premium. The software which manages the migration of data, and ultimately deletion, is a critical component as it not only tracks data migration, but also maintains the working space needed for the system to continue to operate. The new script was deployed without quiescing the running scripts as well as fully testing the modified logic. The intention was to only remove log files more than ten days old. Recreating the lost data by re-running the experiments, in this case, may not be practical due to system availability coupled with the time and expense needed to prepare them to run.

Lee Neely

Consider regular internal or contracted OSINT hunts. These should be deep dives for corporate officers and at least sweeps for all employees/corporate identities. Use some of the tools on https://osintframework.com/ for a self-checkup!

Christopher Elgee

China is not the only country doing this, and indeed your competitors may also be monitoring the social media activity of your key staff members. Start 2022 by running an awareness campaign to staff on how to secure their online social media accounts and how to better protect themselves and your business online.

Brian Honan

Don’t count on the data collection terms published by social media sites to protect your data. If you don’t want it viewed publicly, don’t post it on social media. Also, review your profile with an eye to how that information could be used to target you, your employer, or co-workers.

Lee Neely

On the surface, sending all the state’s data to an agency and letting them figure out what was theirs, sounds like an easy fix which avoids omitting needed records. This also exposes data to an agency which they don’t have a need to know (regardless of regulation) for and adds liability to the receiving party to properly protect that data. Make sure that when you are sharing data, you only share the records which are in scope, and that both parties are appropriately protecting that data.

Lee Neely

Well, pretty much every sector is “… at risk from increased cyber-attack surface areas and limited cybersecurity workforces related to the COVID-19 pandemic.” And, the report is pretty lightweight – mostly pointing out possible risks of moves to robotic process automation bringing increased Internet exposure. But, good to use as ammunition if your company is planning on migrating to RPA technology soon.

John Pescatore

When we entered the pandemic, we rapidly created remote management/monitoring capabilities for many systems, including some which may not be suited for it. We also stepped-up automation and other processes which allowed for operation with fewer humans. Take a pause and assess the security of those systems, making sure that only authorized devices and users can access those networks, be sure you can detect anomalous traffic and behavior. Assess for cases where you no longer need that access and remove it.

Lee Neely

BlackBerry hardware running the Android OS are not impacted. In 2017 BlackBerry announced they would only support these legacy operating systems for two more years. The good news for the enterprise is if you have users who refused to upgrade because things were not broken, this is no longer the case; you can migrate them to a current supported device. The bad news is they likely want a replacement device asap; make sure you have some spare/loaner devices on-hand.

Lee Neely

Blackberry were once the industry leaders for secure mobile communications. It is sad to see them come to EoL but a reminder from a cybersecurity perspective that reliance on a single technology to be your main security provider is not a wise long term strategy and that you should regularly review the technological solutions you rely on.

Brian Honan

This document contains 50 requirements statements (search for “should”), 18 of which (the ones in the last two sections) are very good requirements to convince procurement to include in all RFPs and contracts for medical devices and services.

John Pescatore

The guidance includes important notifications, such as warrantee and lifecycle information, partnerships to resolve security incidents in a timely fashion, as well as breach/incident sharing with the appropriate ISAOs without non-disclosure provisions. The problem is the guidance needs to be implemented. Healthcare providers will need to push on their suppliers to ensure they are complying with appropriate security practices prior to signing contracts. Suppliers need to make sure the providers understand the needed security when deploying their products and services. Then healthcare providers need to actively assess their protections regularly.

Lee Neely

Indications are the third-party provider’s access was used to access another account which could access the exfiltrated data. In addition to resetting all passwords, Broward Health is implementing multi-factor authentication for all users as well as added minimum security posture requirements for devices they don’t manage connecting to their network. When providing remote services consider requiring not only MFA, but also VDI or similar protections to insulate your system from weaknesses in the connecting system. Only permit access to needed services, at all layers.

Lee Neely

An interesting vulnerability, but it isn't clear if it is exploitable in “real life.” To exploit this issue, the victim would need to install a rogue application and give it permission to access the HomeKit configuration.

Johannes Ullrich

The flaw is triggered by changing the name of a HomeKit device to a string of over 500,000 characters. A partial fix is included in iOS 15 which limits the length of a name in a HomeKit device, which only works if all devices with access to that HomeKit are running iOS 15. When exploited, recovery requires restoring iOS devices and disabling Home Data until all HomeKit devices are renamed or removed from your iCloud account.

Lee Neely