Shadow BYOD

Dumb and dumber: Shadow BYOD in government agencies

A rising concern for government organizations is the so-called shadow IT ecosystem --the unauthorized applications that employees download and use at work without formal agency permission.

That poses serious security headaches for network administrators, who don’t know which applications are out there and who has them, and therefore find it impossible to write effective security policies. It's similarly difficult to optimize  network parameters when traffic is produced by unknown sources.

The bring-your-own-device movement has generated its own security headaches over the past few years, and agencies have struggled to come up with ways to let employees use their own mobile devices for government work. A few have done that, but most have simply barred employees from using their personal phones and tablets to handle government data.

Case closed? If only.

Were there really that many IT executives who thought that, simply by saying so, people used to peering at their screens every few minutes outside work would meekly give that up at the office and switch to agency-sanctioned devices? Hillary Clinton is not the only one who doesn’t want to swap phones to get emails or other communications.

Mobile security company Lookout wanted to see what the reality of this “shadow BYOD” is, and it’s not pretty. An analysis of records for Lookout-enabled devices found 14,622 associated with government networks. More than one in 10 of those devices registered a "serious mobile threat encounter" over the course of a year.

In a survey of over 1,000 government employees at 20 agencies in June, Lookout discovered that fully half of them have used their personal devices to get email, and nearly as many have used them to download work documents.

And the threat from mobile devices not only is real -- it seems to be higher than that found outside government. Some 18 percent of federal employees claim to have encountered malware on their mobile devices, the Lookout survey found, including both their personal and government-issued devices. That’s more than double the average percentage reported overall for iPhone and Android devices.

This all comes on the heels of a number of recent announcements of dangerous bugs found in the Android operating system. One was the so-called Stagefright vulnerability, which could affect up to 95 percent of all Android devices and has been likened by some to the OpenSSL Heartbleed bug of 2014.

Now another bug has been found in an Android system-level app. Called Google Admin, it allows Android to accept URLs from other apps, which could be manipulated to give malware access to private data on the device.

This bad news for Android continues to pile on, with vulnerabilities also found in various browsers used with Android. But don’t make the mistake in thinking Apple’s iOS is immune to cyber threats.

The trick, of course, is in making sure users install all the patches that come out for Android and iOS to fix these vulnerabilities, and do so in a timely manner. Perfect patching doesn’t happen, so at any one time there will be vulnerable devices accessing government systems and data.

Then there’s just the dumb stuff that no one can govern. The Lookout survey found that some 58 percent of respondents were aware of the potential consequences of using their personal devices at work, but 85 percent admitted to using them for risky activities anyway.

It’s back to school time for most of America. Maybe it’s also time for the federal government to get back to basics with cybersecurity and put together formal policies to handle BYOD. The practice is only going to get more prevalent over time – and so will the potential risks.

Posted by Brian Robinson on Aug 28, 2015 at 10:04 AM0 comments

Windows 10 touts enterprise- and mobile-friendly security

Windows 10 touts enterprise- and mobile-friendly security

Microsoft has provided its latest Windows 10 operating system as a free upgrade for current Windows users, and as with most new offerings it comes standard with several security features, including ones that are aimed specifically at government and enterprise customers.

It’s not likely to mean much to agencies immediately, however, as most seem unlikely to upgrade anytime soon.  If history is any guide, given the headaches past updates have posed (think Vista, Microsoft 7 and – gasp! – Windows 8), it could be much longer than the 12 months or more that some surveys have suggested.

Also bear in mind that government agencies are notoriously slow in moving to new systems, given money and mission concerns. The fact that there’s still a large number of users on the now-officially defunct Microsoft XP is testimony to that.

Microsoft itself is touting Windows 10’s “encryption containers” and two-factor authentication (using fingerprint and facial recognition biometrics) as ways to toughen access requirements and help prevent data loss even when systems are breached.

These and other security features are becoming common in new operating systems –-  and are even seen as competitive necessities. For Microsoft, they should help the venerable desktop OS stay relevant. More important, given the company’s belated recognition of the mobile universe, it could buttress Microsoft’s attempt to make Windows 10 a viable, if minor, competitor to Apple’s iOS and the multiple varieties of Android.

In fact, some observers think Microsoft is deliberately trying to make Windows 10 much more like a smartphone environment from the get-go, combining the various security features with a new Windows Store for authorized and vetted applications, a la the Apple Store and Android app markets.

Microsoft’s Device Guard, for example, requires a three-way sign-off by app vendors, the Windows Store and the enterprise for any application to work -- an attempt to block zero-day attacks. And Windows Hello (how do they come up with these names?) is the biometric security feature that works with Windows 10’s new Passport to verify you actually have the device on which you are trying to access services within your possession.

Not everything appears hunky dory with Windows 10 security, however. The “next generation” OS apparently requires an opt-out statement by a user to decline a default feature that allows Windows 10 to share access to any network the user logs onto with contacts listed in both Outlook and Skype, the VoIP provider Microsoft bought several years ago.

Some people are poo-pooing the concern over this feature, saying users still must affirmatively allow this sharing. All well and good, but how many users will take the steps to actively opt out, safeguarding themselves from possibly leaking access credentials or unintentionally giving someone access to a network?

To be continued, no doubt.

Stage fright: Android’s Heartbleed moment?

On the Android front, there is apparently a bundle of vulnerabilities that some experts are saying could leave most Android phones open to attack with just a single multimedia text. It could, they warn, turn out to be the worst Android flaw ever, along the lines of the OpenSSL Heartbleed bug that caused such panic last year.

Apparently, the fault lies with remote execution bugs in Android's Stagefright media playback tool. Joshua Drake, a researcher at Zimperium zLabs who first reported the bugs in April, said the vulnerability could affect 95 percent of all Android devices -- and the exploits don’t even require the user to interact with the text.

The U.S. Computer Emergency Response Team has published a formal alert on Stagefright, with pointers to various patches and other ways to guard against possible exploits.

Posted by Brian Robinson on Jul 31, 2015 at 9:01 AM0 comments

Windows XP: The undead OS

Windows XP: The undead OS

It’s been one of the longest retirement parties in the IT world, but finally we should be able to say that Windows XP is now gone. Except that it isn’t, and what that means for the security of a – still – large slab of government XP users is an open question.

Microsoft officially ended its support for XP in April 2014, meaning it would not provide any more versions of the venerable operating system, introduced way back in 2001. At that time it also stopped providing security patches for XP through its Microsoft Security Essentials, though it continued to deliver anti-malware signature updates for a time.

That very last grace period finally came to an end on July 14 when Microsoft finished with XP signature updates along with the use of its Malicious Software Removal Tool for XP. If your XP machine gets infected with malware from now on… tough.

OK, you say, why should that bother me since every agency must have figured this out a long time ago and ditched XP in favor of another operating system that is regularly updated?

If only that were so. There still seems to be plenty of these old systems around. Market analyst firm Net Applications earlier this year said XP makes up nearly 17 percent of the total worldwide desktop operating system market share. Other analysts come in lower, but they still suggest over 10 percent of desktop users work with XP.

There are no overall figures for government, but occasional revelations indicate it’s not insubstantial. The Labor Department’s CIO was quoted earlier this year as saying there were still some 10,000 XP users in her agency, while the Navy last month signed a two-year, $9.1 million contract with Microsoft for its direct support of 100,000 mission critical systems, including thousands of XP computers.

No one expects these systems to be used forever. Labor and the Navy are both trying to transition away from these kinds of legacy systems, and so must the other agencies still running the aged operating system. However, no one knows how vulnerable the machines are.

And given the example of the recently announced breaches at the Office of Personnel Management, where OPM executives admitted the attacks on their systems could have been going on for at least a year, there’s a good chance that at least some XP systems still in use have been successfully penetrated. Attackers need only one infected machine to access other systems in the enterprise, from which they can cause damage and grab valuable data.

So, you say, at the very least agencies must be targeting these old XP systems as a priority for replacement? Again, that’s hard to say. And some recent reports and surveys indicate that desire and reality is a hard union to consummate in government IT.

The Professional Services Council in its recent CIO survey, for example, reported that cybersecurity remains the top priority for government CIOs, but that modernizing the IT environment in a way that could aid their cybersecurity efforts remains a challenge for many, because the predominant portion of their IT budgets goes to maintaining legacy systems. The Defense Department, for one, said only 20 percent of its budget is available for investing in next-generation solutions.

The situation out in state and local government is no better. In a study of state IT investment management strategies, a National Association of State CIOs  report said nearly half of state CIOs spend 80 cents of every IT dollar on maintaining existing systems.

What all of this suggests is that old Windows XP systems, particularly if they get lost in the intense competition of IT priorities, could be a problem for cybersecurity for some years yet.

According to Microsoft, Windows XP is now dead, dead, dead. Except when it’s not.

Posted by Brian Robinson on Jul 17, 2015 at 10:35 AM1 comments

Government credentials show up on paste sites

Government credentials show up on paste sites

While much attention has been paid to the very public attacks on government agencies, particularly the breach at the Office of Personnel Management, less has been made of the whereabouts of the exfiltrated data. So how easy is it for John Doe to get his hands on the information let loose in these attacks? Extremely, it seems, according to one recent report.

Security threat analyst Recorded Future, using open source intelligence on 17 paste sites over a single year ending in November 2014, discovered possible exposure of 47 U.S. government agencies across 89 unique domains. The Energy Department alone had email/password combinations on the sites for nine different domains.

A paste site gives users -- usually programmers and coders -- a place to store and share short items in plain text. Pastebin is the best known of these, though there are dozens of others. Anyone on the web can access them, and large companies such as Facebook have started to mine them for information to make their own sites more secure.

Credentials that grant access to agency networks have become a major target for Black Hats because they more easily open up an organization’s data. In fact, most of the sophisticated attacks on government agencies were enabled by attackers who had privileged account information.

Hackers in search of credentials often target agency contractor or business partner sites, as those organizations' employees are given agency access privileges for certain uses. And Recorded Future, in fact, found that most of the exposures at the paste sites were from these kinds of third-party websites, along with government employees using their government email accounts to register for web-based services -- a growing security concern in itself.

The Recorded Future study can’t specify the actual damage from all of this posted information, but it’s easy to infer the possibilities.

Much of the potential damage could be significantly lessened with the use of fairly simple security steps such as requiring two-factor authentication for network access. However, as the Recorded Future report pointed out, OMB has found that many major agencies don’t employ this safeguard for privileged access. The OPM breach was directly tied to this lack of two-factor authentication.

Recorded Future shared the results of its analysis with the government and agencies last year, well before it made them public. It also made a list of helpful suggestions for agencies to protect  themselves against the effects of the paste site exposures:

  • Enable multi-factor authentication and/or VPNs.
  • Require government employees to use stronger passwords that change with greater regularity.
  • Gauge and define use of government email addresses on third-party sites.
  • Maintain awareness of third-party breaches and regularly assess exposure.
  • Ensure Robot Exclusion Standard (robots.txt) is set for government login pages to prevent listing of webmail/web-services in search engines.

All good suggestions. How many would you guess will be standard operating procedure at agencies a year from now?

Mudge to the rescue!

One of the other problems that plague government, along with industry at large, is being able to gauge the quality and reliability of the software it acquires. As last year’s Open SSL Heartbleed affair showed, even well established software can be vulnerable.

Peter Zatko, known affectionately in security circles by his hacker handle Mudge, is leaving his job at Google to help the government create a CyberUL, a cyber version of the famous Underwriters Laboratory that is considered a stamp of approval for the worthiness of many products. He first made his announcement on Twitter.

Zatko went to Google via the Defense Advanced Research Projects Agency, where he was developing technical skills and techniques for use in cyber combat. Before that he was with BBN Technologies and other security research companies.

Not much is yet known of what Zatko will be doing for the government, but he was reportedly a member of the L0pht hacker collective in the 1990s, which published a paper that described a possible model for a CyberUL.

Posted by Brian Robinson on Jul 06, 2015 at 11:06 AM0 comments