Information Security Report – January 2018

Current Threats and Exploits

  • Meltdown? Spectre? Where Can We Find Out More? – Early January saw the industry start the year with a bang as rumors of an Intel bug being released online. Google’s Project Zero quickly announced on the 3rd of January that nearly all modern processors are affected by a vulnerability that when exploited can allow for potentially sensitive information to be accessed from memory across local security boundaries. A combined response from processor and operating system vendors is currently underway with most vendors releasing a statement or patch where applicable. It is recommended that local administrators investigate their organisations exposure to the bug and begin a remediation plan where possible. Additional detail and vendor responses can be found in the references below. (1, 2, 3, 4)
  • Risks Created by Bitcoins Surge in Popularity – Driven by the rise in value of bitcoin over in recent months, crypto currency has become a hot topic for those in and out of the IT space. With a large number of people newly becoming curious or looking to make some quick money in crypto markets, scammers and attackers have also been thinking about how they can leverage the new found popularity of these currencies. In recent months there has been an increase in bitcoin related phishing and online scams in an attempt to either steal bitcoin or wallet private keys / passwords from unsuspecting users.

Recent Breaches

  • Forever 21 POS Malware Reminds about Encrypting Data at Rest – Retailer Forever 21 announced that for 7 months last year a number of cash register and point of sale devices were infected with malware that was successfully able to swipe payment card details. In addition to this it was reported that the malware was also present on some systems and were able to view transactional logs on a central server that were generated by non-compromised devices. It has been confirmed that encryption on these devices was not always enabled, and during periods where encryption was not enabled the logs could be read by the malware which would search for payment card details. Although POS malware is a constant threat, it is also important to ensure you are aware of all systems in your organisation that hold or process any form of payment card information. Regular testing and quality control of controls such as encryption of data at rest, and reduction of sensitive information in logs can ensure that in the event of compromise, the malware would not be able to find sensitive information. (8)
  • Leaky (S3) Buckets At it Again – Once again, a publicly exposed Amazon S3 bucket containing sensitive information was found. This time the information contained details on an estimated 123 million American households. With more companies using cloud services for storage and business, it is important to gain a good understanding of the access controls in place for data kept in the cloud. Regular reviews of access to your cloud services and data is also recommended. If you are looking for more information about securing S3, see this article here. (9)

Other News

  • What to expect in 2018 – With 2017 teaching us all some new lessons about patch management, ransomware, crypto currencies and securing the cloud, it is expected that 2018 will provide a similar education. With more companies looking to invest in the cloud and in new technologies, there is an increased risk in how we can better secure the modern business. The internet of things and the issues these devices have faced in the past is a constant reminder of this. Further to this it is expected that financially motivated cybercrime will remain a constant threat through the means of social engineering/phishing, crypto-currency targeted malware and possibly more organisation specific ransomware. From a defender perspective, it is expected that two factor authentication (2FA) will increase significantly. As many credential based attacks can be mitigated by enabling 2FA, and with 2FA gaining wide-spread support (especially in the cloud and online services), 2018 should see a welcomed increase in 2FA uptake. (10)